Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 81 papers
Filter6

Attack type

Jailbreaks39Prompt injection7Poisoning and backdoors3Model tampering7Detection evasion11

Attack technique

Gradient and representation optimization55Automated search68Multi-turn escalation24Encoding and obfuscation53Role-play and persuasion27Conversation structure manipulation11Reasoning-chain manipulation11Cross-modal payloads50Side channels3Defense-targeted32Dormant triggers34Selection manipulation3

Defense type

Detection and filtering3

Impact

Harmful content43Output manipulation32Availability and reliability4

System type

Models and APIs73LLM applications14AI Agent17coding agent2web agent4Browser and computer use0Embodied systems and robotics6

Attacker access

Black-box25Gray-box3White-box21

Attack surface / entry point

User input42Images, audio and video31Training data4Weights and gradients11

Layer

Prompt layer60Model layer13Application layer3Training and data layer3

System component

Guardrails and judges7Reasoning chains3Fine-tuning and open weights3Vision23Audio4Multimodal29
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Role-play and persuasionSystem type：Models and APIsSystem type：coding agentSystem type：Browser and computer useSystem type：Embodied systems and roboticsClear all

Another 201papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.06083

    研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击

    提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报

    arXiv
    2610.06083
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    DQN, Double DQN (DDQN)
    Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。

    这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.05894

    研究者提出闭环偏见注入攻击

    提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见

    arXiv
    2610.05894
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct

    Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。

    Paper analysisRead analysis
  8. AttacksarXiv 2610.03430

    JIL：通过对抗后缀操纵 LLM 请求调度优先级

    提出 JIL 对抗后缀，压低长度预测以抬高请求调度优先级

    arXiv
    2610.03430
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others4
    AbstractJIL 用对抗后缀压低长度预测，在预测式 LLM 调度中提高自身优先级。

    JIL 是对预测式 LLM 调度的攻击：用对抗后缀压低长度预测，使请求在 SRPT 式队列里更早得到服务。

    Paper analysisRead analysis
  9. AttacksarXiv 2610.03166

    LiBRA：通过双向隐空间优化实现检测感知的图像水印去除

    提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测

    arXiv
    2610.03166
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Stable Signature, YU1, HiDDeN and others4

    AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。

    Paper analysisRead analysis
  10. AttacksarXiv 2610.01367

    研究：高质量数据筛选挡不住投毒

    提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本

    arXiv
    2610.01367
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
    Abstract质量筛选挡不住部分高分样本的安全削弱。

    Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。

    Paper analysisRead analysis
  11. AttacksarXiv 2610.01062

    Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架

    提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱

    arXiv
    2610.01062
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-7B-Instruct, Gemma-2-9B-IT, Llama-3.1-8B-Instruct and others4
    AbstractKAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。

    Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。

    Paper analysisRead analysis
  13. InterpretabilityarXiv 2609.24801

    研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定

    用词级归因指导同义词替换，翻转提示注入检测并验证越狱

    arXiv
    2609.24801
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Prompt Guard 2 (86M), Llama 3.1 8B

    Abstract作者称检测靠分散的词法线索。

    Paper analysisRead analysis
  16. AttacksarXiv 2609.08236

    研究：内容不变的风格包装可翻转 LLM 安全评判器的判定

    提出内容不变样式包装，翻转安全评审器的判定

    arXiv
    2609.08236
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4o-mini (gpt4o), GPT-4o-mini (strongreject), DeepSeek-Chat and others7
    Abstract论文揭示特定安全评审器易受保持内容不变的外层包装诱导改变判定，并指出安全评估应将判定稳定性作为重要考量指标。

    这是一项关于大语言模型自动化安全评审系统表面样式脆弱性的评估研究。

    Paper analysisRead analysis
  17. AttacksarXiv 2609.03247

    研究揭示大语言模型的自发身份认证失败：五款模型的分阶段开发者身份实验

    提出 MIPC 与 CFA，观察模型自拟测验后接受开发者身份

    arXiv
    2609.03247
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    ChatGPT, Claude, Qwen3.7-Plus and others5
    Abstract自拟测验可造成对话层虚假认证，但所测授权边界并未因此改变。

    这项工作把“模型自己出题、自己批改、再宣布身份已核验”定义成对话层认证失败，并与后端提权分开。

    Paper analysisRead analysis
  18. AttacksarXiv 2609.02414

    Blueprint 框架用世界观模拟与 18 个影响因子提升多轮越狱成功率

    提出多轮越狱框架 BLUEPRINT，用世界观模拟与心理因素诱导有害输出

    arXiv
    2609.02414
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen3-Next-80B, DeepSeek-V3.2, GLM-4.7 and others6
    AbstractBLUEPRINT 解耦多轮越狱策略与情境模拟，揭示任务具象化是摆脱拒绝的核心机制，为多轮安全防御提供新视角。

    BLUEPRINT 是一个将因子化社会影响力策略空间与跨轮世界观模拟解耦的多轮大语言模型安全评测框架。

    Paper analysisRead analysis
  19. AttacksarXiv 2609.02172

    BOSS：以广度优先后缀搜索改进 GCG 越狱优化

    提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化

    arXiv
    2609.02172
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Llama-2-7B-Chat, Yi-1.5-9B-Chat, Qwen2-7B-Instruct and others8
    AbstractBOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。

    BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。

    Paper analysisRead analysis
Load more