Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers

Filter3

Attack type

Prompt injection5 Poisoning and backdoors4

Attack technique

Reasoning-chain manipulation4

Impact

Output manipulation4

System type

AI Agent5

Attack surface / entry point

Documents and messages3

Layer

Prompt layer12 Application layer7 Training and data layer2

System component

MCP and skills38 Memory23 RAG26 Guardrails and judges27 Monitors3 Reasoning chains9 Permissions and sandboxing12 Fine-tuning and open weights27 Vision13 Audio4 Image generation3 Embeddings7 Multimodal21

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Layer：Application layer Layer：Training and data layer System component：Reasoning chains Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2609.35699Sep 29
论文：蒸馏防御在蒸馏后强化学习下易被攻破
提出用 API 推理摘要重建轨迹再蒸馏加强化学习，攻破蒸馏防御
arXiv
2609.35699
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others12
- AttacksExtraction and theft
- ComponentReasoning chains
Abstract更现实的蒸馏攻击是蒸馏后再 RL。
这篇工作修订蒸馏攻击的威胁模型：攻击者经合法 API 收集闭源推理数据，先蒸馏自有模型，再做强化学习。作者认为只在蒸馏后评估防御，会漏掉后续 RL，从而高估防御。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
AttacksarXiv 2607.00422Jul 1
KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
arXiv
2607.00422
Published
Jul 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentReasoning chains
Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。
KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2604.12201Apr 14
AdversarialCoT: single-document retrieval poisoning for LLM reasoning
Proposes AdversarialCoT single-document retrieval poisoning to manipulate RAG reasoning answers
arXiv
2604.12201
Published
Apr 14
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-R1, Qwen3, GLM4.5 and others5
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2604.05549Apr 7
Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents
提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作
arXiv
2604.05549
Published
Apr 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-3.5-turbo, GPT-4o, GPT-5 and others7
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentMemory
AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。
JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。
Paper analysisRead analysis
AttacksarXiv 2602.18514Feb 20
招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究
用简历中的不可见指令做间接提示注入，操纵招聘推荐
arXiv
2602.18514
Published
Feb 20
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentReasoning chains
Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
Paper analysisRead analysis
AttacksarXiv 2406.12814Jun 19, 2024
论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性
提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
arXiv
2406.12814
Published
Jun 19, 2024
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, GPT-4V, Claude-3-Opus and others4
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop