Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 11 papers
Filter5

Attack type

Prompt injection4Poisoning and backdoors3

Attack technique

Gradient and representation optimization9Conversation structure manipulation0Cross-modal payloads10Dormant triggers3

Impact

Unauthorized actions3Output manipulation4Availability and reliability3

System type

Models and APIs26AI Agent11web agent3Embodied systems and robotics7

Attack surface / entry point

User input12Web pages and interfaces8Documents and messages9Tool responses8Tool and skill descriptions5Code repositories and dependencies4Memory writes17Images, audio and video11Training data5Weights and gradients8Distribution channels10

Layer

Prompt layer3Application layer5

System component

Vision7Multimodal8
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Conversation structure manipulationAttack technique：Dormant triggersSystem type：AI AgentAttack surface / entry point：Images, audio and videoClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.06083

    研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击

    提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报

    arXiv
    2610.06083
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    DQN, Double DQN (DDQN)
    Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。

    这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.07051

    TrojanWorld：通过想象引导对世界模型智能体植入后门

    提出 TrojanWorld，用物理触发器对世界模型智能体植入想象引导后门

    arXiv
    2609.07051
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    TD-MPC2, DreamerV3, R2-Dreamer

    AbstractTrojanWorld 揭示了世界模型智能体的供应链后门风险，通过在世界模型中操纵想象可实现对闭环动作的持续控制。

    Paper analysisRead analysis
  7. AttacksarXiv 2608.10393

    DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

    提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作

    arXiv
    2608.10393
    Published
    Layer
    Prompt layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-7B, π0-FAST, openvla-7B
    AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。

    DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。

    Paper analysisRead analysis
  8. AttacksarXiv 2606.09499

    研究者提出针对世界模型的机器人学习管线投毒攻击

    提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略

    arXiv
    2606.09499
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
    Abstract只改视频帧经世界模型投毒。

    只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。

    Paper analysisRead analysis
  9. AttacksarXiv 2603.16960

    Adversarial attacks against modern vision-language models

    Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases

    arXiv
    2603.16960
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-7B, Qwen2.5-VL-7B
    AbstractThe authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.

    The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

    Paper analysisRead analysis
  10. AttacksarXiv 2505.23266

    AdvOF：用对抗物体融合攻击 VLM 驱动的视觉语言导航智能体

    提出 AdvOF，生成对抗物体误导视觉语言导航智能体的场景感知

    arXiv
    2505.23266
    Published
    Layer
    Application layer
    Setting
    Embodied systems and robotics
    Attacker
    White-box
    Evaluated models
    Lseg, Clip, ViT-L/16 and others5
    AbstractAdvOF 以多视角融合生成对抗物体。

    AdvOF 是针对 VLM 驱动 VLN 服务导航的对抗物体攻击。

    Paper analysisRead analysis
  11. AttacksarXiv 2406.12814

    论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性

    提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性

    arXiv
    2406.12814
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-4o, GPT-4V, Claude-3-Opus and others4

    Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。

    Paper analysisRead analysis
You have reached the end