Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 15 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

System type：AI Agent System type：coding agent Attack surface / entry point：Retrieval corpus Attack surface / entry point：Weights and gradients Layer：Application layer Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05840Oct 5
研究：任务范围授权可将工具调用有害执行降至零
用配对回放评测任务范围授权能否阻断越权工具执行
arXiv
2610.05840
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.2 3B Instruct Q4 K M, Qwen3 4B Instruct, Gemma 3 4B and others8
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2609.39788Sep 30
研究：多智能体系统潜在通信链路可被训练用于提升有害顺从
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
arXiv
2609.39788
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。
学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39146Sep 30
MADBench：多智能体辩论安全性评测基准发布
提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响
arXiv
2609.39146
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gpt-4o, GPT-5, GPT-6 Astra
- AttacksPrompt injection
- ComponentRAG
AbstractMADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。
MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。
Paper analysisRead analysis
DefensesarXiv 2609.37196Sep 29
ToolFence：为工具调用 LLM Agent 提供细粒度授权
提出 ToolFence，以能力蓝图和确定性授权拦截 Agent 未授权工具调用
arXiv
2609.37196
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-max, GPT-4o (gpt-4o-2024-08-06), Mistral-Small-3.1-24B-Instruct-2503
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2609.34245Sep 28
研究者提出面向结构化 Agent 动作的多源完整性认证方法
提出多源完整性认证器，在结构化 Agent 动作执行前按控制域决定准入或弃权
arXiv
2609.34245
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro and others5
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract作者给出条件性的动作完整性认证。
这是一项结构化动作执行前的完整性防御研究，对象是从可腐化文档和工具输出拼装的支付等特权动作。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.24662Sep 21
DUMA-Bench：评估 LLM Agent 安全的双控多智能体基准
提出双控多智能体基准 DUMA-Bench，测量对抗环境下的策略违反
arXiv
2609.24662
Published
Sep 21
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5, GPT-5-mini, GPT-5-nano and others14
- AttacksPrompt injection
AbstractDUMA-Bench 用双控交互评测智能体安全。
DUMA-Bench 把 τ²-bench 的双控交互做成智能体安全评测，用来看策略违反如何随用户、模型和环境一起出现。
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
DefensesarXiv 2609.02127Sep 2
论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史
提出类型化溯源与断言护栏，约束持久 Agent 释放自传断言
arXiv
2609.02127
Published
Sep 2
Layer
Application layer
Setting
AI Agent
- DefensesWatermarking and provenance
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.06862Aug 7
SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
arXiv
2608.06862
Published
Aug 7
Layer
Application layer
Setting
Browser and computer use, coding agent
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.20891Jul 23
MisKnow-Agent 评测
用 MisKnow-Agent 评测深度研究智能体是否采纳误导文档结论
arXiv
2607.20891
Published
Jul 23
Layer
Application layer
Setting
web agent
Evaluated models
DeerFlow, WebThinker, Gemini Deep Research and others6
- AttacksPrompt injection
- ComponentRAG
Abstract论文通过 MisKnow-Agent 框架评估发现长程研究智能体易采纳误导性知识，且现有防御难以完全消除该现象。
Paper analysisRead analysis
AttacksarXiv 2607.00422Jul 1
KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
arXiv
2607.00422
Published
Jul 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentReasoning chains
Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。
KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
Paper analysisRead analysis
AttacksarXiv 2603.17239Mar 18
LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems
Proposes LAAF, which automatically attacks LPCI vulnerabilities in agent systems in stages
arXiv
2603.17239
Published
Mar 18
Layer
Application layer
Setting
AI Agent
Evaluated models
gemini-2.0-flash-001, claude-3-haiku-20240307, meta-llama/llama-3.1-70b-instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractLAAF does LPCI red teaming with taxonomy plus stage seeding.
The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
Paper analysisRead analysis
AttacksarXiv 2507.10457Jul 15, 2025
论文提出 LPCI：针对 Agent 逻辑层与持久记忆的提示控制注入攻击
提出 LPCI，把延迟条件载荷写入记忆与检索库以跨会话触发
arXiv
2507.10457
Published
Jul 15, 2025
Layer
Application layer
Setting
AI Agent
Evaluated models
ChatGPT, Claude, LLaMA3 and others8
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者定义 LPCI。
作者把LPCI定义为针对智能体逻辑执行、记忆留存和工具集成的跨阶段漏洞类，而不是单次输入上的提示改写。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

研究：任务范围授权可将工具调用有害执行降至零

研究：多智能体系统潜在通信链路可被训练用于提升有害顺从

MADBench：多智能体辩论安全性评测基准发布

ToolFence：为工具调用 LLM Agent 提供细粒度授权

研究者提出面向结构化 Agent 动作的多源完整性认证方法

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

DUMA-Bench：评估 LLM Agent 安全的双控多智能体基准

多智能体 LLM 流水线中的信任传播与结构隔离

论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史

SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

MisKnow-Agent 评测

KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链

LAAF: A Systematic Red-Teaming Method and Automated Attack Framework for LPCI Vulnerabilities in Agentic LLM Systems

论文提出 LPCI：针对 Agent 逻辑层与持久记忆的提示控制注入攻击