Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 16 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Attack technique：Multi-turn escalation Attack technique：Dormant triggers System component：Reasoning chains System component：Multimodal Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.05453Oct 5
研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私
提出 PLW，用微调把先前对话敏感触发编码进后续生成图像
arXiv
2610.05453
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
OmniGen2, BAGEL-7B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。
Paper analysisRead analysis
AttacksarXiv 2609.39047Sep 30
BadAction：通过动作引导触发器对交互式视频生成模型实施后门攻击
提出 BadAction，通过动作触发器给交互式视频生成植入后门
arXiv
2609.39047
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Astra (Wan2.1-T2V-1.3B)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2609.07048Sep 7
FreqDoor：面向视觉语言模型的频域后门攻击
提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门
arXiv
2609.07048
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentVision
AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。
FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。
Paper analysisRead analysis
AttacksarXiv 2609.04260Sep 2
GhostWord：针对自动语音识别的细粒度后门攻击
提出 GhostWord 词级触发后门，对自动语音识别做数据投毒
arXiv
2609.04260
Published
Sep 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Whisper-Small, Whisper-Medium, MMS and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2606.09499Jun 8
研究者提出针对世界模型的机器人学习管线投毒攻击
提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略
arXiv
2606.09499
Published
Jun 8
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentVideo
Abstract只改视频帧经世界模型投毒。
只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。
Paper analysisRead analysis
AttacksarXiv 2604.05549Apr 7
Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents
提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作
arXiv
2604.05549
Published
Apr 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-3.5-turbo, GPT-4o, GPT-5 and others7
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentMemory
AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。
JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。
Paper analysisRead analysis
AttacksarXiv 2603.10010Feb 18
FERRET：基于扩展的多模态自动化红队测试框架
提出 FERRET 框架，用扩展生成多轮多模态越狱对话
arXiv
2603.10010
Published
Feb 18
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama Maverick, Claude Haiku, GPT-4o
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2602.15927Feb 18
研究者提出面向多轮对话的视觉记忆注入攻击 VMI
提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息
arXiv
2602.15927
Published
Feb 18
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-VL-7B-Instruct, Qwen3-VL-8B-Instruct, LLaVA-OneVision-1.5-8B-Instruct and others5
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractVMI 让扰动图像在多轮 LVLM 中潜伏，作者称触发话题出现后仍可输出预定消息。
VMI 是面向多轮 LVLM 的定向图像攻击：第三方发布带小扰动的图像，良性用户把它当作普通输入。
Paper analysisRead analysis
AttacksarXiv 2602.14399Feb 16
Multi-turn Adaptive Prompt Attack against Large Vision-Language Models
提出 MAPA 多轮自适应提示攻击，交替文本与视觉动作越狱视觉语言模型
arXiv
2602.14399
Published
Feb 16
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-V1.6-Mistral-7B, Qwen2.5-VL-7B-Instruct, Llama-3.2-Vision-11B-Instruct and others4
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2602.07379Feb 7
Aegis: Governance, Integrity, and Security for AI Voice Agents
提出 Aegis 红队框架，多轮攻击高风险语音 Agent
arXiv
2602.07379
Published
Feb 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, GPT-4o-mini, Gemini-1.5 Pro and others7
- AttacksDenial of service
- TechniqueMulti-turn escalation
- ComponentAudio
AbstractAegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.
Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.
Paper analysisRead analysis
AttacksarXiv 2603.20198Feb 5
研究者提出 MM-Plan 多模态越狱框架
提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标
arXiv
2603.20198
Published
Feb 5
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3.2-11B, InternVL3-8B, Qwen3-VL-8B and others8
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Abstract作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。
MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。
Paper analysisRead analysis
AttacksarXiv 2601.05339Jan 9
多模态大语言模型的多轮越狱攻击与 FragGuard 防御
提出多轮多模态越狱，并用 FragGuard 拦截有害响应
arXiv
2601.05339
Published
Jan 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVa-1.6 (7B), LLaVa-1.6 (13B), Qwen-2-7B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2511.13892Nov 18, 2025
论文提出利用图像排版操纵与多轮提示越狱智能交通系统中的 LVLM
提出图像排版操纵与多轮提示越狱，绕过交通场景视觉语言模型安全对齐
arXiv
2511.13892
Published
Nov 18, 2025
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVa-1.6, Qwen-2, GPT-4o-mini
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

P-VMI：对抗图像经 KV cache 持续影响多轮对话

研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私

BadAction：通过动作引导触发器对交互式视频生成模型实施后门攻击

FreqDoor：面向视觉语言模型的频域后门攻击

GhostWord：针对自动语音识别的细粒度后门攻击

研究者提出针对世界模型的机器人学习管线投毒攻击

Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents

FERRET：基于扩展的多模态自动化红队测试框架

研究者提出面向多轮对话的视觉记忆注入攻击 VMI

Multi-turn Adaptive Prompt Attack against Large Vision-Language Models

Aegis: Governance, Integrity, and Security for AI Voice Agents

研究者提出 MM-Plan 多模态越狱框架

多模态大语言模型的多轮越狱攻击与 FragGuard 防御

论文提出利用图像排版操纵与多轮提示越狱智能交通系统中的 LVLM