Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers
Filter4

Attack type

Jailbreaks4

Attack technique

Gradient and representation optimization4Automated search5Encoding and obfuscation3Conversation structure manipulation4Reasoning-chain manipulation14Cross-modal payloads5Defense-targeted3Dormant triggers3

Impact

Harmful content4

System type

Models and APIs7

Attacker access

Black-box5

Attack surface / entry point

User input6Images, audio and video5

Layer

Prompt layer6

System component

Guardrails and judges11Reasoning chains7Vision51Audio7Video2Image generation4Multimodal61
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
Attack technique：Conversation structure manipulationAttack technique：Cross-modal payloadsSystem component：Reasoning chainsSystem component：VideoClear all

Another 232papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  5. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  6. AttacksarXiv 2608.09867

    Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

    利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链

    arXiv
    2608.09867
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13

    Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。

    Paper analysisRead analysis
  7. AttacksarXiv 2603.09246

    研究者提出 Reasoning-Oriented Programming，通过链式语义片段越狱大型视觉语言模型

    提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型

    arXiv
    2603.09246
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4o, Claude 3.7 Sonnet, GLM-4V-Plus and others7
    AbstractVROP 以良性视觉 gadget 与控制流提示词做组合越狱。

    VROP是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。

    Paper analysisRead analysis
  9. AttacksarXiv 2406.12814

    论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性

    提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性

    arXiv
    2406.12814
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, GPT-4V, Claude-3-Opus and others4

    Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。

    Paper analysisRead analysis
You have reached the end