Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 16 papers

Filter4

Attack type

Prompt injection7

Attack technique

Cross-modal payloads4

Impact

Unauthorized actions3 Data and privacy leaks4 Output manipulation6

System type

Models and APIs97 LLM applications10 AI Agent30 coding agent1 web agent7 Browser and computer use5 Embodied systems and robotics11

Attack surface / entry point

Web pages and interfaces4 Images, audio and video8

Layer

Application layer13

System component

MCP and skills28 Memory12 RAG40 Guardrails and judges49 Monitors29 Reasoning chains7 Permissions and sandboxing16 Fine-tuning and open weights4 Vision16 Audio3 Image generation3 Embeddings8 Multimodal20

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.

System type：LLM applications System type：coding agent System type：Browser and computer use System component：Vision Clear all

Another 261papers do not have category tags yet and are not included in filtered results.

InterpretabilityarXiv 2610.11986Oct 8
FearCaut-Qwen: Activation steering changes the risk judgment criteria of vision-language models
Using fear activation steering to test the hazard judgment criteria of vision-language models
arXiv
2610.11986
Published
Oct 8
Layer
Model layer
Setting
LLM applications
Evaluated models
Qwen/Qwen2.5-VL-7B-Instruct
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2610.11942Oct 8
LGWM: Verifying GUI agent screen transitions with action-conditioned world models
Proposes LGWM, using an action-conditioned world model to verify GUI agent screen transitions.
arXiv
2610.11942
Published
Oct 8
Layer
Application layer
Setting
Browser and computer use
Evaluated models
LGWM
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2610.01184Oct 1
ReCast：在固定媒体接口下保护多模态推理的隐私框架
提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
arXiv
2610.01184
Published
Oct 1
Layer
Application layer
Setting
LLM applications
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.37863Sep 29
MIST 压力测试：无关图像会扰动 VLM 评判者标签
提出 MIST 压力测试，检验无关图像是否扰动 VLM 评判者标签
arXiv
2609.37863
Published
Sep 29
Layer
Prompt layer
Setting
LLM applications
Evaluated models
GPT-5.2, Gemini 3.1 Flash-Lite, Gemini 3.5 Flash and others13
- ComponentVision
Abstract有图就改标签，图的内容却不告知 judge，裁决绑定配置。
作者用MIST问：VLM 代替人类标注时，可替代性裁决会不会被指南要求忽略的图像改写。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06898Sep 29
DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准
用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性
arXiv
2610.06898
Published
Sep 29
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7
- AttacksPrompt injection
- ComponentVision
Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。
Paper analysisRead analysis
Risky behaviorarXiv 2609.35291Sep 28
窄域多模态微调可诱发涌现性失配，覆盖 15 个视觉语言模型
证明无显式危害的图文窄微调可诱发跨任务涌现未对齐
arXiv
2609.35291
Published
Sep 28
Layer
Model layer
Setting
Browser and computer use
Evaluated models
GPT-4o, GPT-4.1, Gemini 2.5 and others15
- RiskMisalignment and value divergence
- ComponentVision
Abstract证实窄多模态微调可引发全面的多渠道未对齐行为转变，揭示了后训练阶段对齐被隐蔽重塑的安全隐患。
论文系统探究了视觉-语言模型中由窄任务微调诱发的跨模态涌现未对齐（Emergent Misalignment, EM）现象。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.32567Sep 26
零训练 LLM+OVOD 流水线中的归因缺口：CAAP–SNAP 差异的细粒度分析
分析零训练 LLM+OVOD 流水线中 CAAP 与 SNAP 分离的来源
arXiv
2609.32567
Published
Sep 26
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma-3 4B, YOLO-World X, Qwen2.5-VL 7B and others4
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.02207Sep 2
LeakageBench: Document-level leakage risk in redaction of personally identifiable information in document images
Proposes LeakageBench to evaluate page-level leakage of PII redaction in document images
arXiv
2609.02207
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Amazon Comprehend PII, GPT-5.5, NVIDIA GLiNER PII and others13
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05535Sep 2
Mind2Web-Injection：面向网页 Agent 视觉提示注入护栏的证据对齐评测
提出 Mind2Web-Injection 评测网页 Agent 视觉注入护栏
arXiv
2609.05535
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-5.6-luna, Qwen3-VL-32B, Qwen3-VL-8B and others6
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract作者称检测、定位和反事实响应在六个 VLM 上可分开。
Mind2Web-Injection 用来检查网页截图护栏的判决是否对齐到该用的画面证据。。
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis
AttacksarXiv 2605.10253May 11
Knowledge poisoning attacks against multimodal retrieval-augmented generation in healthcare
提出 M3 Att，在不知查询时投毒医学多模态 RAG 并误导临床决策
arXiv
2605.10253
Published
May 11
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, GPT-5 Chat, Gemini-2.5-Flash and others8
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2603.14707Mar 16
视觉混淆代理：利用与防御计算机使用智能体的感知失效
提出进程外双通道对比分类，拦截计算机使用智能体的错误点击
arXiv
2603.14707
Published
Mar 16
Layer
Application layer
Setting
Browser and computer use
Evaluated models
multi-modal-embed-small
- DefensesDetection and filtering
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentGuardrails and judges
Abstract感知错误可被屏幕像素对调利用。
作者把 CUA 的感知失败写成安全漏洞visual confused deputy：智能体按看错的屏幕授权 click(x,y)，真实落点与它以为的元素不一致。
Paper analysisRead analysis
DefensesarXiv 2602.10915Feb 11
Blind Gods and Broken Screens: Building a Secure, Intent-Centric Mobile Agent Operating System
提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制
arXiv
2602.10915
Published
Feb 11
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Gemini-3-Flash
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractAura 以 Agent Kernel 中介结构化交互。
Aura 用内核中介的结构化智能体交互，替换以屏幕为接口的移动助手。。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop