Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 19 papers
Filter4

Attack type

Extraction and theft8

Attack technique

Side channels3

Impact

Data and privacy leaks7Output manipulation6

System type

Models and APIs18LLM applications3coding agent0Multi-agent systems1

Attacker access

Black-box3

Attack surface / entry point

User input317Web pages and interfaces5Documents and messages19Tool responses16Tool and skill descriptions27Code repositories and dependencies21Retrieval corpus6Memory writes10Inter-agent messages25Images, audio and video103Training data68Weights and gradients69Distribution channels40Inference services and hardware19

Layer

Model layer5Infrastructure layer13
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 216papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：coding agentSystem type：Multi-agent systemsAttack surface / entry point：Inference services and hardwareClear all

Another 216papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.06848

    TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击

    提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员

    arXiv
    2610.06848
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5

    AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.05894

    研究者提出闭环偏见注入攻击

    提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见

    arXiv
    2610.05894
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct

    Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。

    Paper analysisRead analysis
  4. Analysis and theoryarXiv 2610.02504

    HXAI：分布式能源系统中的分层隐私保护可解释 AI 框架

    提出 HXAI 分层隐私解释框架，本地保留细解释并只发布加噪摘要

    arXiv
    2610.02504
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    gradient-boosted tree regression models
    AbstractHXAI 把无噪声局部 SHAP 留在家庭内，只聚合差分隐私摘要。

    HXAI 是面向分布式能源系统的分层隐私保护解释框架，服务规划、监测与诊断，而不是实时控制。

    Paper analysisRead analysis
  5. DefensesarXiv 2610.02349

    MIRROR：面向多智能体通信的法定人数完整性防御

    提出 MIRROR，用多路径摘要多数表决保障多智能体通信完整性

    arXiv
    2610.02349
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Gemma-4-31B-it, Gemini 2.5 Pro
    AbstractMIRROR 靠多数路径。

    MIRROR 是 LLM 多智能体通信层上的多路径法定人数完整性原语，只处理不透明字节，不解释消息内容。要处理的是 Agent-in-the-Middle：中介合法终结 TLS 后可改在途消息，而语义校验有推理开销和误拦，签名又要求私钥管理。做法是生成结束后复制同一规范化载荷。

    Paper analysisRead analysis
  9. DefensesarXiv 2608.25431

    GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking

    Propose GIFT, isolating user data in shared LLM serving using encryption and GPU information flow tracking

    arXiv
    2608.25431
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-14B, Qwen2.5-32B, Qwen2.5-72B and others6
    AbstractGIFT uses cryptographic isolation plus GPU information flow rules to enforce user data isolation on vLLM and DistServe, and reports throughput overhead.

    GIFT is the authors' user data isolation system for shared LLM serving, with GIFT-CC enabling confidential computing. In the conclusion, the authors state it is the first IFT design for this scenario.

    Paper analysisRead analysis
  10. AttacksarXiv 2608.17485

    KeyPooling: Measuring where LLM API relay paths break prompt cache isolation

    Proposing KeyPooling to measure where API relays break prompt cache isolation

    arXiv
    2608.17485
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    grok-4-fast-non-reasoning, grok-4-1-fast-non-reasoning, grok-3 and others11
    AbstractShared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.

    KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.

    Paper analysisRead analysis
  11. AttacksarXiv 2606.11817

    研究：语法约束解码可越狱 LLM 生成恶意代码，并提出 CodeShield 防御

    提出 CodeSpear 越狱，借语法约束解码生成恶意代码，并给出 CodeShield 防御

    arXiv
    2606.11817
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-Coder-7B, Qwen2.5-Coder-32B, Qwen2.5-7B and others10

    Abstract论文发现语法约束解码会破坏自然语言安全对齐，提出 CodeSpear 越狱攻击与基于蜜罐代码对齐的 CodeShield 防御。

    Paper analysisRead analysis
  12. AttacksarXiv 2605.30040

    研究揭示 LLM 按 token 计费可被服务商系统性虚报

    构造可通过计费审计的 token 虚报，使服务商系统性超收

    arXiv
    2605.30040
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    PALACE domain-adapted auditor
    Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。

    不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。

    Paper analysisRead analysis
  13. AttacksarXiv 2605.08313

    研究者提出 SeedHijack 攻击，劫持 LLM 采样随机数种子

    提出 SeedHijack，劫持采样 PRNG 以强制选定 token

    arXiv
    2605.08313
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    GPT-2 (124M), Qwen2-1.5B-Instruct, DeepSeek-R1-1.5B and others5
    Abstract采样层 PRNG 被替换以强制选 token。

    SeedHijack 把 LLM 采样用的 PRNG 输出换成攻击者选定的数，从而指定下一个 token。权重、输入和 logits 都不改。防御是用硬件 QRNG 替换该随机源。

    Paper analysisRead analysis
  14. DefensesarXiv 2603.10726

    PrefixWall: Mitigating Prefix Cache Side Channels in Shared LLM Systems

    Proposes PrefixWall, which selectively isolates shared prefixes to mitigate timing side channels

    arXiv
    2603.10726
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    gemma-3-4b-it, llava-onevision-qwen2-0.5b-ov-hf, llava-onevision-qwen2-7b-ov-chat-hf and others9
    AbstractPrefixWall uses cache metadata to selectively cut off cross-user prefix continuation, preserving APC while limiting the TTFT side channel.

    PrefixWall is a system-level defense for multi-tenant LLM services that limits the TTFT side channel of Automatic Prefix Caching while preserving prefix reuse.

    Paper analysisRead analysis
  15. AttacksarXiv 2602.20595

    OptiLeak: Efficiently Reconstructing Prompts with Reinforcement Learning in Multi-Tenant LLM Services

    Proposing OPTILEAK, reconstructing others' prompts token-by-token via a KV cache side channel

    arXiv
    2602.20595
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen-2.5-3B-Instruct, Qwen-2.5-7B-Instruct, Qwen-2.5-14B-Instruct and others4

    AbstractOPTILEAK uses SFT and hard-token DPO to reduce the number of requests per token; the authors claim the risk of cache prompt leakage is higher than previously reported.

    Paper analysisRead analysis
  16. AttacksarXiv 2602.17837

    TFL: Targeted Bit-Flip Attack against Large Language Models

    Proposes TFL targeted bit flipping so that selected prompts output false answers while unrelated queries remain correct

    arXiv
    2602.17837
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, DeepSeek-R1-Distill-Qwen-14B, LLaMA-3.1-8B-INSTRUCT
    AbstractTFL searches weight bits on three LLMs to make specified prompts produce target keywords while constraining degradation on unrelated tasks.

    TFL is a framework for targeted bit flips on LLM main memory weights: the attacker wants a selected prompt to output a specified false answer keyword while limiting degradation on unrelated queries.

    Paper analysisRead analysis
  17. AttacksarXiv 2601.04261

    针对大语言模型后门指纹的抑制攻击

    提出 TFA 与 SVA，抑制 ensemble 后门指纹验证

    arXiv
    2601.04261
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    LLaMA2-7B, LLaMA3.1-8B-It, Qwen2.5-7B and others11
    Abstract两种 ensemble 攻击 TFA/SVA 抑制后门指纹。

    TFA 与 SVA 是针对后门式 LLM 指纹的 ensemble 抑制攻击，不改模型参数。所有者用 SFT 写入秘密对，只通过 API 验证版权。攻击者未授权取得模型，不知道触发和指纹，却要把每个模型的验证变成失败，同时让 ensemble 至少不差于性能最高的单模型。

    Paper analysisRead analysis
  18. AttacksarXiv 2601.01296

    Aggressive compression enables LLM weight stealing

    提出面向渗出的权重压缩，评估推理服务器权重窃取可行性

    arXiv
    2601.01296
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Qwen2-1.5B, Qwen2-7B, Qwen2.5-1.5B and others8
    Abstract作者用残差量化加微调压缩权重，并称法医水印便宜且微调后仍可解码。

    这篇工作把 LLM 权重渗出看成 APT：攻击者已有未加密权重，但必须把完整权重藏进推理 API 的合法输出。作者认为可压缩性是被忽略的因素，因为推理量化要求解压后仍能低开销前向，而偷权重的人可以接受事后微调。

    Paper analysisRead analysis
You have reached the end