Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 21 papers
Filter5

Attack type

Extraction and theft8

Attack technique

Side channels3

Impact

Data and privacy leaks7Output manipulation5

System type

Models and APIs18LLM applications10AI Agent64coding agent3web agent22Browser and computer use7Multi-agent systems3Embodied systems and robotics0

Attacker access

Black-box3

Attack surface / entry point

User input309Web pages and interfaces3Documents and messages13Tool responses12Tool and skill descriptions25Code repositories and dependencies20Retrieval corpus3Memory writes5Images, audio and video110Training data68Weights and gradients68Distribution channels37Inference services and hardware18

Layer

Model layer5Application layer3Infrastructure layer13

System component

Monitors3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 248papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：coding agentSystem type：Embodied systems and roboticsAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Inference services and hardwareClear all

Another 248papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.06848

    TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击

    提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员

    arXiv
    2610.06848
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5

    AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.05894

    研究者提出闭环偏见注入攻击

    提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见

    arXiv
    2610.05894
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct

    Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。

    Paper analysisRead analysis
  4. Analysis and theoryarXiv 2610.02504

    HXAI：分布式能源系统中的分层隐私保护可解释 AI 框架

    提出 HXAI 分层隐私解释框架，本地保留细解释并只发布加噪摘要

    arXiv
    2610.02504
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    gradient-boosted tree regression models
    AbstractHXAI 把无噪声局部 SHAP 留在家庭内，只聚合差分隐私摘要。

    HXAI 是面向分布式能源系统的分层隐私保护解释框架，服务规划、监测与诊断，而不是实时控制。

    Paper analysisRead analysis
  7. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2609.28915

    研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性

    构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性

    arXiv
    2609.28915
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    AdaBoost, XGBoost, TabPFN and others10
    AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。

    ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。

    Paper analysisRead analysis
  11. DefensesarXiv 2608.25431

    GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking

    Propose GIFT, isolating user data in shared LLM serving using encryption and GPU information flow tracking

    arXiv
    2608.25431
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-14B, Qwen2.5-32B, Qwen2.5-72B and others6
    AbstractGIFT uses cryptographic isolation plus GPU information flow rules to enforce user data isolation on vLLM and DistServe, and reports throughput overhead.

    GIFT is the authors' user data isolation system for shared LLM serving, with GIFT-CC enabling confidential computing. In the conclusion, the authors state it is the first IFT design for this scenario.

    Paper analysisRead analysis
  12. AttacksarXiv 2608.17485

    KeyPooling: Measuring where LLM API relay paths break prompt cache isolation

    Proposing KeyPooling to measure where API relays break prompt cache isolation

    arXiv
    2608.17485
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    grok-4-fast-non-reasoning, grok-4-1-fast-non-reasoning, grok-3 and others11
    AbstractShared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.

    KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.

    Paper analysisRead analysis
  13. AttacksarXiv 2606.11817

    研究：语法约束解码可越狱 LLM 生成恶意代码，并提出 CodeShield 防御

    提出 CodeSpear 越狱，借语法约束解码生成恶意代码，并给出 CodeShield 防御

    arXiv
    2606.11817
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-Coder-7B, Qwen2.5-Coder-32B, Qwen2.5-7B and others10

    Abstract论文发现语法约束解码会破坏自然语言安全对齐，提出 CodeSpear 越狱攻击与基于蜜罐代码对齐的 CodeShield 防御。

    Paper analysisRead analysis
  14. AttacksarXiv 2605.30040

    研究揭示 LLM 按 token 计费可被服务商系统性虚报

    构造可通过计费审计的 token 虚报，使服务商系统性超收

    arXiv
    2605.30040
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    PALACE domain-adapted auditor
    Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。

    不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。

    Paper analysisRead analysis
  15. AttacksarXiv 2605.08313

    研究者提出 SeedHijack 攻击，劫持 LLM 采样随机数种子

    提出 SeedHijack，劫持采样 PRNG 以强制选定 token

    arXiv
    2605.08313
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    GPT-2 (124M), Qwen2-1.5B-Instruct, DeepSeek-R1-1.5B and others5
    Abstract采样层 PRNG 被替换以强制选 token。

    SeedHijack 把 LLM 采样用的 PRNG 输出换成攻击者选定的数，从而指定下一个 token。权重、输入和 logits 都不改。防御是用硬件 QRNG 替换该随机源。

    Paper analysisRead analysis
  16. DefensesarXiv 2603.10726

    PrefixWall: Mitigating Prefix Cache Side Channels in Shared LLM Systems

    Proposes PrefixWall, which selectively isolates shared prefixes to mitigate timing side channels

    arXiv
    2603.10726
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    gemma-3-4b-it, llava-onevision-qwen2-0.5b-ov-hf, llava-onevision-qwen2-7b-ov-chat-hf and others9
    AbstractPrefixWall uses cache metadata to selectively cut off cross-user prefix continuation, preserving APC while limiting the TTFT side channel.

    PrefixWall is a system-level defense for multi-tenant LLM services that limits the TTFT side channel of Automatic Prefix Caching while preserving prefix reuse.

    Paper analysisRead analysis
  17. AttacksarXiv 2602.20595

    OptiLeak：在多租户 LLM 服务中用强化学习高效重建提示词

    提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示

    arXiv
    2602.20595
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen-2.5-3B-Instruct, Qwen-2.5-7B-Instruct, Qwen-2.5-14B-Instruct and others4

    AbstractOPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。

    Paper analysisRead analysis
  18. AttacksarXiv 2602.17837

    TFL: Targeted Bit-Flip Attack against Large Language Models

    提出 TFL 定向比特翻转，使选定提示输出虚假答案且无关查询保持正确

    arXiv
    2602.17837
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, DeepSeek-R1-Distill-Qwen-14B, LLaMA-3.1-8B-INSTRUCT
    AbstractTFL 在三个 LLM 上搜索权重比特，使指定提示出现目标关键词，并约束无关任务下降。

    TFL 是对 LLM 主存权重的目标比特翻转框架：攻击者要让选定提示输出指定虚假答案关键词，同时限制无关查询上的降质。

    Paper analysisRead analysis
  19. AttacksarXiv 2601.04261

    针对大语言模型后门指纹的抑制攻击

    提出 TFA 与 SVA，抑制 ensemble 后门指纹验证

    arXiv
    2601.04261
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    LLaMA2-7B, LLaMA3.1-8B-It, Qwen2.5-7B and others11
    Abstract两种 ensemble 攻击 TFA/SVA 抑制后门指纹。

    TFA 与 SVA 是针对后门式 LLM 指纹的 ensemble 抑制攻击，不改模型参数。所有者用 SFT 写入秘密对，只通过 API 验证版权。攻击者未授权取得模型，不知道触发和指纹，却要把每个模型的验证变成失败，同时让 ensemble 至少不差于性能最高的单模型。

    Paper analysisRead analysis
  20. AttacksarXiv 2601.01296

    Aggressive compression enables LLM weight stealing

    提出面向渗出的权重压缩，评估推理服务器权重窃取可行性

    arXiv
    2601.01296
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Qwen2-1.5B, Qwen2-7B, Qwen2.5-1.5B and others8
    Abstract作者用残差量化加微调压缩权重，并称法医水印便宜且微调后仍可解码。

    这篇工作把 LLM 权重渗出看成 APT：攻击者已有未加密权重，但必须把完整权重藏进推理 API 的合法输出。作者认为可压缩性是被忽略的因素，因为推理量化要求解压后仍能低开销前向，而偷权重的人可以接受事后微调。

    Paper analysisRead analysis
Load more