Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 15 papers
Filter5

Attack type

Jailbreaks8Prompt injection4

Attack technique

Gradient and representation optimization62Automated search104Multi-turn escalation30Encoding and obfuscation61Role-play and persuasion28Conversation structure manipulation13Reasoning-chain manipulation15Cross-modal payloads57Side channels3Defense-targeted44Dormant triggers60Selection manipulation11

Impact

Harmful content8

System type

Models and APIs10AI Agent5coding agent1Browser and computer use0

Attacker access

Black-box9

Attack surface / entry point

User input12

Layer

Prompt layer10Application layer4

System component

Guardrails and judges3Monitors3Reasoning chains14
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.
Attack technique：Reasoning-chain manipulationSystem type：Models and APIsSystem type：AI AgentSystem type：coding agentSystem type：Browser and computer useClear all

Another 213papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.15989

    Researchers propose plan injection attack that can bypass chain-of-thought monitoring

    提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器

    arXiv
    2609.15989
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    Qwen2.5-Coder-7B-Instruct, Qwen3-8B, DeepSeek-R1-0528 and others6

    Abstract论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.09553

    研究：任意密文攻击前沿大模型无需微调即可越狱

    提出任意字母置换密码越狱，无需微调即可诱导有害输出

    arXiv
    2609.09553
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7

    Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。

    Paper analysisRead analysis
  5. Risky behaviorarXiv 2609.08186

    论文揭示大推理模型的对齐崩溃并提出 Reasoning Trap 越狱范式

    揭示推理加深引发的对齐坍塌，用 Reasoning Trap 放大越狱

    arXiv
    2609.08186
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama2-7B and others8
    Abstract更深推理提升题目准确率，同时提高扰动下的相对损失。

    作者研究扩展推理是否以对齐稳健性为代价，提出 ALR、RT 与 RRA。。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.01023

    Akrasia：针对推理型代码 LLM 的隐蔽后门攻击

    提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链

    arXiv
    2609.01023
    Published
    Layer
    Prompt layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7

    Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。

    Paper analysisRead analysis
  7. AttacksarXiv 2608.09867

    Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

    利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链

    arXiv
    2608.09867
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13

    Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。

    Paper analysisRead analysis
  9. AttacksarXiv 2605.13338

    研究者提出层级遗传算法黑盒攻击，诱导推理模型过度思考

    提出层级遗传算法 HGA，扰动题目逻辑结构诱发推理模型过度思考

    arXiv
    2605.13338
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    DeepSeek-R1 (671B), Qwen3-Thinking, GPT-o3 and others5

    AbstractHGA 在黑盒推理模型上用逻辑扰动拉长输出，作者称可从小代理迁移，查询成本是其局限。

    Paper analysisRead analysis
  10. AttacksarXiv 2604.05549

    Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents

    提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作

    arXiv
    2604.05549
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-3.5-turbo, GPT-4o, GPT-5 and others7
    AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。

    JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。

    Paper analysisRead analysis
  11. AttacksarXiv 2603.10091

    Multi-Stream Perturbation Attack: Breaking the Safety Alignment of Reasoning LLMs through Concurrent Task Interference

    提出多流扰动攻击，交织有害与良性任务绕过思考型 LLM 安全对齐

    arXiv
    2603.10091
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3 1.7B, Qwen3 4B, Qwen3 8B and others11
    Abstract多流扰动用任务交织测试 thinking 模式，作者称它同时冲击内容安全与推理稳定性。

    多流扰动攻击把有害任务与良性任务织进同一提示词，测试 thinking 模式的内容安全与推理稳定性。作者认为，交织多任务会拉长思考，使安全检测面对被打散的有害意图，并可能把推理用于合理化，或陷入崩溃与重复。方法不访问梯度。

    Paper analysisRead analysis
  12. AttacksarXiv 2603.12277

    Prompt injection is role confusion

    提出 CoT Forgery，经用户消息或工具输出注入伪造推理

    arXiv
    2603.12277
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    Black-box
    Evaluated models
    gpt-oss-20b, gpt-oss-120b, o4-mini and others11
    Abstract提示注入被作者解释为角色感知失败：听起来像某角色，就在表示里成为该角色。

    作者把提示注入解释成角色感知失败：标签划出的权限没有进入模型的内部几何。

    Paper analysisRead analysis
You have reached the end