Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack surface / entry point：User input Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Code repositories and dependencies Attack surface / entry point：Training data System component：Vision Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.11942Oct 8
LGWM: Verifying GUI agent screen transitions with action-conditioned world models
Proposes LGWM, using an action-conditioned world model to verify GUI agent screen transitions.
arXiv
2610.11942
Published
Oct 8
Layer
Application layer
Setting
Browser and computer use
Evaluated models
LGWM
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
DefensesarXiv 2610.09703Oct 7
研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
arXiv
2610.09703
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVA-1.5-7B
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Abstract剪枝去掉背景 token 后注意力塌向恶意前景。
这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
Paper analysisRead analysis
DefensesarXiv 2610.09469Oct 7
Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents
提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响
arXiv
2610.09469
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentVision
AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。
Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.07009Oct 4
研究受控拆解图像到文本越狱中图像属性的作用
固定有害指令，单轴归因图像到文本越狱的图像属性
arXiv
2610.07009
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4o, Claude Sonnet 4.5, Qwen3-VL-8B-Instruct and others6
- AttacksJailbreaks
- ComponentVision
Abstract固定文本的图像越狱拆解，只在 Qwen 上给出一条有界相关性归因。
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06898Sep 29
DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准
用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性
arXiv
2610.06898
Published
Sep 29
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7
- AttacksPrompt injection
- ComponentVision
Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。
Paper analysisRead analysis
DefensesarXiv 2609.36562Sep 29
ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
arXiv
2609.36562
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ThinkingGuard（Qwen3-VL-8B-Instruct）
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。
这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33481Sep 27
IDUnlearn-Bench：面向视觉语言模型的个体级遗忘基准
提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留
arXiv
2609.33481
Published
Sep 27
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others6
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentVision
AbstractIDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。
IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。
Paper analysisRead analysis
DefensesarXiv 2609.28239Sep 23
ODPure：通过集成破坏共识实现目标检测后门净化
提出 ODPure，在输入阶段用腐蚀重建与共识净化目标检测后门
arXiv
2609.28239
Published
Sep 23
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
YOLOv5, Faster R-CNN
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2609.14258Sep 13
SPARK：在 KV 记忆层对齐表征以防御视觉语言模型越狱
提出 SPARK，在预填充阶段修复多模态 KV 记忆以防御视觉语言模型越狱
arXiv
2609.14258
Published
Sep 13
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaVA-OneVision-7B, Chameleon-7B, Qwen2-VL-7B and others4
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2609.10613Sep 8
后验重加权框架解释并缓解多模态大模型上下文越狱
用后验重加权解释多模态上下文越狱，并提出风险门控的良性示例注入防御
arXiv
2609.10613
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others8
- DefensesInstruction–data separation
- AttacksJailbreaks
- ComponentVision
Abstract后验重加权解释上下文越狱的缩放，并支持风险门控的良性示例防御。
Zhang 等把多模态 ICL 越狱写成对齐模型在安全与有害隐模式之间的推理时后验漂移，并据此做风险门控防御。
Paper analysisRead analysis
AttacksarXiv 2609.07048Sep 7
FreqDoor：面向视觉语言模型的频域后门攻击
提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门
arXiv
2609.07048
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentVision
AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。
FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。
Paper analysisRead analysis
DefensesarXiv 2609.06346Sep 6
面向后门攻击下持续学习的鲁棒动态扩展：净化与选择性恢复
提出持续学习下的净化与选择性恢复框架，抵御逐任务训练投毒后门
arXiv
2609.06346
Published
Sep 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ViT-B/16
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentVision
Abstract作者报告任务内净化与恢复可配合动态专家防御后门，但保证依赖分离条件。
这是一项面向持续图像分类的后门防御研究：模型只使用当前任务数据，同时需要保留过去知识并避免学习恶意监督。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
DefensesarXiv 2609.03139Sep 3
TRIM：面向多种后门触发器的黑盒检测与净化方法
提出 TRIM，在黑盒推理时定位并净化图像后门区域
arXiv
2609.03139
Published
Sep 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ResNet-50
- DefensesInference-time intervention
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05535Sep 2
Mind2Web-Injection：面向网页 Agent 视觉提示注入护栏的证据对齐评测
提出 Mind2Web-Injection 评测网页 Agent 视觉注入护栏
arXiv
2609.05535
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-5.6-luna, Qwen3-VL-32B, Qwen3-VL-8B and others6
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract作者称检测、定位和反事实响应在六个 VLM 上可分开。
Mind2Web-Injection 用来检查网页截图护栏的判决是否对齐到该用的画面证据。。
Paper analysisRead analysis
AttacksarXiv 2609.05525Sep 2
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
arXiv
2609.05525
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop