Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 27 papers
Filter4

Attack type

Prompt injection11Poisoning and backdoors11

Attack technique

Gradient and representation optimization10Encoding and obfuscation3Cross-modal payloads10Dormant triggers9

Impact

Unauthorized actions12Output manipulation8Availability and reliability3

System type

Models and APIs157LLM applications8AI Agent27coding agent5web agent4Browser and computer use4Embodied systems and robotics9

Attack surface / entry point

User input105Web pages and interfaces62Documents and messages62Tool responses101Tool and skill descriptions62Code repositories and dependencies28Retrieval corpus11Memory writes40Inter-agent messages28Images, audio and video20Training data7Weights and gradients8Distribution channels48

Layer

Prompt layer3Application layer17Training and data layer5

System component

Guardrails and judges4Fine-tuning and open weights7Vision16Multimodal17
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
System type：AI AgentSystem type：Browser and computer useAttack surface / entry point：Images, audio and videoAttack surface / entry point：Weights and gradientsClear all

Another 254papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.06083

    研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击

    提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报

    arXiv
    2610.06083
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    DQN, Double DQN (DDQN)
    Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。

    这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.05793

    研究者训练出按多智能体拓扑触发的代码后门模型

    提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞

    arXiv
    2610.05793
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct

    Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。

    Paper analysisRead analysis
  8. AttacksarXiv 2609.39788

    研究：多智能体系统潜在通信链路可被训练用于提升有害顺从

    提出只训练或篡改多智能体潜在通信链路来提高有害遵从

    arXiv
    2609.39788
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
    Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。

    学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2610.06898

    DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准

    用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性

    arXiv
    2610.06898
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7

    Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。

    Paper analysisRead analysis
  10. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  11. AttacksarXiv 2609.37468

    论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

    提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测

    arXiv
    2609.37468
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    E5, Contriever-MSMARCO

    Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。

    Paper analysisRead analysis
  12. AttacksarXiv 2609.14060

    AgentQ：针对 LLM Agent 的量化条件后门攻击

    提出量化条件后门 AGENTQ，使智能体仅在量化后触发恶意工具调用

    arXiv
    2609.14060
    Published
    Layer
    Training and data layer
    Setting
    AI Agent
    Evaluated models
    Qwen3.5-2B, Qwen3.5-4B, Qwen3.5-9B and others6

    Abstract论文研究了智能体量化条件后门风险，提出 AGENTQ 在保持效用的同时实现全精度隐蔽与量化后生效。

    Paper analysisRead analysis
  13. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  14. Evaluation and benchmarksarXiv 2609.09404

    MMPIBench：多模态提示注入对六种 Agent 框架的跨框架评测

    用 MMPIBench 评测多模态提示注入对 Agent 框架的影响

    arXiv
    2609.09404
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Claude Opus 4.8, GPT-5.4, Gemini 3.1 Pro and others6

    Abstract论文提出 MMPIBench 评测多模态提示注入对智能体的影响，发现模型主导行为、尝试远超完成，音频通道缺乏防护。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.07051

    TrojanWorld：通过想象引导对世界模型智能体植入后门

    提出 TrojanWorld，用物理触发器对世界模型智能体植入想象引导后门

    arXiv
    2609.07051
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    TD-MPC2, DreamerV3, R2-Dreamer

    AbstractTrojanWorld 揭示了世界模型智能体的供应链后门风险，通过在世界模型中操纵想象可实现对闭环动作的持续控制。

    Paper analysisRead analysis
  16. AttacksarXiv 2609.04533

    Repeat-After-Me：针对黑盒 VLM 的自适应视觉提示注入攻击

    提出 Repeat-After-Me 自适应视觉提示注入，诱导 VLM 智能体执行指定任务

    arXiv
    2609.04533
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Claude-Opus-4.7, GPT-5.5, Gemini-3.1-Pro and others6

    Abstract论文提出了针对黑盒 VLM 的前缀诱导自适应视觉提示注入，在多款模型上诱发了工具调用与隐私泄露。

    Paper analysisRead analysis
  17. AttacksarXiv 2608.10393

    DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

    提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作

    arXiv
    2608.10393
    Published
    Layer
    Prompt layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-7B, π0-FAST, openvla-7B
    AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。

    DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。

    Paper analysisRead analysis
  18. AttacksarXiv 2608.06862

    SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

    提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链

    arXiv
    2608.06862
    Published
    Layer
    Application layer
    Setting
    Browser and computer use, coding agent
    Evaluated models
    Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B

    Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。

    Paper analysisRead analysis
  19. AttacksarXiv 2606.09499

    研究者提出针对世界模型的机器人学习管线投毒攻击

    提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略

    arXiv
    2606.09499
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
    Abstract只改视频帧经世界模型投毒。

    只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。

    Paper analysisRead analysis
  20. AttacksarXiv 2604.03890

    From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems

    Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA

    arXiv
    2604.03890
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics, LLM applications
    Evaluated models
    Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4

    Abstract推理层后门传不到执行。

    Paper analysisRead analysis
Load more