Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 12 papers

Filter3

Attack type

Prompt injection3

Impact

Data and privacy leaks4 Output manipulation4

System type

Models and APIs96 LLM applications12 AI Agent109 coding agent24 web agent8 Browser and computer use7 Multi-agent systems4 Embodied systems and robotics11

Attack surface / entry point

Images, audio and video4

Layer

Application layer10

System component

MCP and skills3 RAG39 Guardrails and judges41 Monitors3 Vision9 Audio3 Embeddings8 Multimodal13

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

System type：LLM applications System component：MCP and skills System component：Vision Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

InterpretabilityarXiv 2610.11986Oct 8
FearCaut-Qwen: Activation steering changes the risk judgment criteria of vision-language models
Using fear activation steering to test the hazard judgment criteria of vision-language models
arXiv
2610.11986
Published
Oct 8
Layer
Model layer
Setting
LLM applications
Evaluated models
Qwen/Qwen2.5-VL-7B-Instruct
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2610.01184Oct 1
ReCast：在固定媒体接口下保护多模态推理的隐私框架
提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
arXiv
2610.01184
Published
Oct 1
Layer
Application layer
Setting
LLM applications
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.37863Sep 29
MIST 压力测试：无关图像会扰动 VLM 评判者标签
提出 MIST 压力测试，检验无关图像是否扰动 VLM 评判者标签
arXiv
2609.37863
Published
Sep 29
Layer
Prompt layer
Setting
LLM applications
Evaluated models
GPT-5.2, Gemini 3.1 Flash-Lite, Gemini 3.5 Flash and others13
- ComponentVision
Abstract有图就改标签，图的内容却不告知 judge，裁决绑定配置。
作者用MIST问：VLM 代替人类标注时，可替代性裁决会不会被指南要求忽略的图像改写。
Paper analysisRead analysis
OtherarXiv 2609.33731Sep 28
HTN 规划作为多服务器 MCP 工具编排的协调层
提出 HTN 协调层，在执行前固定多服务器 MCP 工具顺序
arXiv
2609.33731
Published
Sep 28
Layer
Application layer
Setting
LLM applications
- ComponentMCP and skills
Abstract作者提供可重放的 MCP 协调架构，但未用实测基线量化相对 LLM 的成本改善。
HTN 规划在这里承担跨服务器工具协调层的角色。作者关注 MCP 宿主逐步选择工具时的复现、推理成本和执行前检查问题。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.32567Sep 26
零训练 LLM+OVOD 流水线中的归因缺口：CAAP–SNAP 差异的细粒度分析
分析零训练 LLM+OVOD 流水线中 CAAP 与 SNAP 分离的来源
arXiv
2609.32567
Published
Sep 26
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma-3 4B, YOLO-World X, Qwen2.5-VL 7B and others4
- ComponentVision
Paper analysisRead analysis
OtherarXiv 2609.18120Sep 16
PentestChain：面向免费层 LLM 的成本感知 MCP 编排自动化渗透测试框架
提出成本感知的 MCP 编排框架，用确定性利用图与免费层模型做自动化渗透测试
arXiv
2609.18120
Published
Sep 16
Layer
Application layer
Setting
LLM applications
- RiskDangerous capabilities
- ComponentMCP and skills
Abstract确定性利用图加免费层级联在十次自建运行上测得付费成本为零。
PentestChain 是一个十阶段、经 MCP 暴露的自动渗透框架，用确定性利用图把 7B 本地模型挡在利用关键路径之外，并把每次交战的美元成本当作实测指标。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.02207Sep 2
LeakageBench：文档图像中个人身份信息脱敏的文档级泄漏风险
提出 LeakageBench 评测文档图像 PII 脱敏的页级泄漏
arXiv
2609.02207
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Amazon Comprehend PII, GPT-5.5, NVIDIA GLiNER PII and others13
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05535Sep 2
Mind2Web-Injection：面向网页 Agent 视觉提示注入护栏的证据对齐评测
提出 Mind2Web-Injection 评测网页 Agent 视觉注入护栏
arXiv
2609.05535
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-5.6-luna, Qwen3-VL-32B, Qwen3-VL-8B and others6
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract作者称检测、定位和反事实响应在六个 VLM 上可分开。
Mind2Web-Injection 用来检查网页截图护栏的判决是否对齐到该用的画面证据。。
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop