Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 5 papers

Filter5

Attack type

Prompt injection3 Poisoning and backdoors3

Attack technique

Reasoning-chain manipulation4 Dormant triggers1 Selection manipulation1

System type

AI Agent4

Layer

Prompt layer9 Application layer5

System component

MCP and skills16 Memory25 RAG8 Guardrails and judges5 Reasoning chains5 Permissions and sandboxing3 Fine-tuning and open weights3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Attack technique：Reasoning-chain manipulation Attack technique：Dormant triggers Attack technique：Selection manipulation Layer：Application layer System component：Reasoning chains Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
AttacksarXiv 2607.00422Jul 1
KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
arXiv
2607.00422
Published
Jul 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentReasoning chains
Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。
KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2604.12201Apr 14
AdversarialCoT: single-document retrieval poisoning for LLM reasoning
Proposes AdversarialCoT single-document retrieval poisoning to manipulate RAG reasoning answers
arXiv
2604.12201
Published
Apr 14
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-R1, Qwen3, GLM4.5 and others5
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2604.05549Apr 7
Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents
提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作
arXiv
2604.05549
Published
Apr 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-3.5-turbo, GPT-4o, GPT-5 and others7
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentMemory
AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。
JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

System type

Layer

System component

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链

Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails

AdversarialCoT: single-document retrieval poisoning for LLM reasoning

Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents