Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 29 papers
Filter3

Attack type

Jailbreaks14Prompt injection4Extraction and theft5Denial of service3

Attack technique

Automated search3Conversation structure manipulation3Reasoning-chain manipulation10Cross-modal payloads3

Defense type

Model hardening3Inference-time intervention3

Impact

Harmful content14Data and privacy leaks5Output manipulation3Availability and reliability3Oversight failure3

System type

Models and APIs23AI Agent6

Attacker access

Black-box10

Attack surface / entry point

User input26Web pages and interfaces3Documents and messages3Tool responses3Code repositories and dependencies3Images, audio and video6Training data4

Layer

Prompt layer13Model layer7Application layer5Training and data layer4

System component

MCP and skills21Memory24RAG20Guardrails and judges87Monitors27Reasoning chains29Permissions and sandboxing29Fine-tuning and open weights12Vision49Audio8Image generation22Multimodal78
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Attack surface / entry point：User inputAttack surface / entry point：Web pages and interfacesSystem component：Reasoning chainsClear all

Another 265papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  2. InterpretabilityarXiv 2610.12361

    Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

    Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.

    arXiv
    2610.12361
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
    AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.

    This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

    Paper analysisRead analysis
  4. DefensesarXiv 2609.36562

    ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害

    构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险

    arXiv
    2609.36562
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    ThinkingGuard（Qwen3-VL-8B-Instruct）
    AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。

    这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.35699

    论文：蒸馏防御在蒸馏后强化学习下易被攻破

    提出用 API 推理摘要重建轨迹再蒸馏加强化学习，攻破蒸馏防御

    arXiv
    2609.35699
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others12
    Abstract更现实的蒸馏攻击是蒸馏后再 RL。

    这篇工作修订蒸馏攻击的威胁模型：攻击者经合法 API 收集闭源推理数据，先蒸馏自有模型，再做强化学习。作者认为只在蒸馏后评估防御，会漏掉后续 RL，从而高估防御。

    Paper analysisRead analysis
  6. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  9. InterpretabilityarXiv 2609.23587

    大型推理模型的效率与安全困境：量化与剪枝如何影响越狱鲁棒性

    分析量化、剪枝与 KV 缓存压缩对推理模型越狱鲁棒性的影响

    arXiv
    2609.23587
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    QwQ-32B, DeepSeek-R1-Distill-Qwen-32B, DeepSeek-R1-Distill-Llama-8B
    Abstract效率压缩常使 LRM 越狱 HR 下降，作者将其归因于推理退化而非对齐增强。

    作者分析量化、剪枝和 KV 缓存压缩如何同时改变 LRM 的显存、推理和越狱脆弱性。。

    Paper analysisRead analysis
  11. AttacksarXiv 2609.15989

    研究者提出 plan injection 攻击，可绕过思维链监控

    提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器

    arXiv
    2609.15989
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    Qwen2.5-Coder-7B-Instruct, Qwen3-8B, DeepSeek-R1-0528 and others6

    Abstract论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。

    Paper analysisRead analysis
  12. OtherarXiv 2609.12413

    SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量

    系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御

    arXiv
    2609.12413
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen3.5-4B, Llama-3.1-8B-Instruct
    AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。

    Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。

    Paper analysisRead analysis
  13. AttacksarXiv 2609.09553

    研究：任意密文攻击前沿大模型无需微调即可越狱

    提出任意字母置换密码越狱，无需微调即可诱导有害输出

    arXiv
    2609.09553
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7

    Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。

    Paper analysisRead analysis
  14. Risky behaviorarXiv 2609.08186

    论文揭示大推理模型的对齐崩溃并提出 Reasoning Trap 越狱范式

    揭示推理加深引发的对齐坍塌，用 Reasoning Trap 放大越狱

    arXiv
    2609.08186
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama2-7B and others8
    Abstract更深推理提升题目准确率，同时提高扰动下的相对损失。

    作者研究扩展推理是否以对齐稳健性为代价，提出 ALR、RT 与 RRA。。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.01023

    Akrasia：针对推理型代码 LLM 的隐蔽后门攻击

    提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链

    arXiv
    2609.01023
    Published
    Layer
    Prompt layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7

    Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。

    Paper analysisRead analysis
  16. AttacksarXiv 2608.09867

    Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

    利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链

    arXiv
    2608.09867
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13

    Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。

    Paper analysisRead analysis
  19. AttacksarXiv 2605.13338

    研究者提出层级遗传算法黑盒攻击，诱导推理模型过度思考

    提出层级遗传算法 HGA，扰动题目逻辑结构诱发推理模型过度思考

    arXiv
    2605.13338
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    DeepSeek-R1 (671B), Qwen3-Thinking, GPT-o3 and others5

    AbstractHGA 在黑盒推理模型上用逻辑扰动拉长输出，作者称可从小代理迁移，查询成本是其局限。

    Paper analysisRead analysis
Load more