Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 8 papers

Filter5

Attack type

Prompt injection3 Poisoning and backdoors7

Attack technique

Automated search6 Dormant triggers8

Impact

Unauthorized actions3 Output manipulation3

System type

Models and APIs11 AI Agent8 coding agent3 Embodied systems and robotics3

Attack surface / entry point

User input10 Web pages and interfaces4 Documents and messages8 Tool responses6 Tool and skill descriptions5 Code repositories and dependencies4 Memory writes17 Images, audio and video3 Training data4 Weights and gradients7 Distribution channels10

Layer

Application layer4 Training and data layer4

System component

Fine-tuning and open weights3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.

Attack technique：Dormant triggers System type：AI Agent System type：coding agent Attack surface / entry point：Code repositories and dependencies Attack surface / entry point：Training data Clear all

Another 255papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
AttacksarXiv 2610.05793Oct 5
研究者训练出按多智能体拓扑触发的代码后门模型
提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞
arXiv
2610.05793
Published
Oct 5
Layer
Training and data layer
Setting
coding agent
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。
Paper analysisRead analysis
AttacksarXiv 2609.22711Sep 19
UBA-ORL：针对离线强化学习的遗忘激活后门攻击
提出 UBA-ORL，以 BD/CM 样本在遗忘后激活离线 RL 后门
arXiv
2609.22711
Published
Sep 19
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
TD3+BC, BCQ, IQL
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
AbstractUBA-ORL 用竞争的 BD/CM 样本，使离线 RL 后门在删除伪装轨迹后激活。
UBA-ORL 研究离线强化学习中由合规轨迹删除激活的后门：合法贡献者同时上传共享触发的后门轨迹和伪装轨迹，训练后触发响应被压低，删除伪装批次后再升高。受害系统是使用静态数据集和轨迹级遗忘接口的离线 RL 服务。对手不能看到训练算法、参数、梯度或具体遗忘算法，但能提交可区分批次，并在部署时向观测注入预定触发。
Paper analysisRead analysis
AttacksarXiv 2609.22510Sep 19
特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent
提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse
arXiv
2609.22510
Published
Sep 19
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentGuardrails and judges
Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。
论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2606.09499Jun 8
研究者提出针对世界模型的机器人学习管线投毒攻击
提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略
arXiv
2606.09499
Published
Jun 8
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentVideo
Abstract只改视频帧经世界模型投毒。
只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。
Paper analysisRead analysis
AttacksarXiv 2605.15338May 15
Hidden in Memory: Latent Memory Poisoning of LLM Agents
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
arXiv
2605.15338
Published
May 15
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。
sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
Paper analysisRead analysis
AttacksarXiv 2604.03890Apr 5
From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems
Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA
arXiv
2604.03890
Published
Apr 5
Layer
Training and data layer
Setting
Embodied systems and robotics, LLM applications
Evaluated models
Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract推理层后门传不到执行。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop