Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 23 papers
Filter5

Attack type

Prompt injection4Extraction and theft7

Attack technique

Side channels3

Impact

Data and privacy leaks6Output manipulation7

System type

Models and APIs17LLM applications10AI Agent64coding agent3web agent22Browser and computer use7Multi-agent systems3

Attacker access

Black-box3

Attack surface / entry point

User input311Web pages and interfaces5Documents and messages19Tool responses16Tool and skill descriptions26Code repositories and dependencies21Retrieval corpus6Memory writes10Inter-agent messages25Images, audio and video99Training data67Weights and gradients66Distribution channels36Inference services and hardware18

Layer

Model layer5Application layer6Infrastructure layer12

System component

Monitors3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：coding agentSystem type：Multi-agent systemsAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Inference services and hardwareClear all

Another 255papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.06848

    TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击

    提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员

    arXiv
    2610.06848
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5

    AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.05894

    研究者提出闭环偏见注入攻击

    提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见

    arXiv
    2610.05894
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct

    Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。

    Paper analysisRead analysis
  4. DefensesarXiv 2610.05640

    Research reveals that the CaMeL defense fails in multi-agent systems and proposes multi-CaMeL

    提出 multi-CaMeL，在智能体调用边界隔离可信指令与非可信数据

    arXiv
    2610.05640
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Claude Fable 5, GPT-5.5, GPT-4.1 and others6

    Abstract论文针对多智能体中单体防御不组合的边界清洗问题，提出 multi-CaMeL 协议彻底阻断了 MultiAgentDojo 上的注入攻击。

    Paper analysisRead analysis
  5. Analysis and theoryarXiv 2610.02504

    HXAI：分布式能源系统中的分层隐私保护可解释 AI 框架

    提出 HXAI 分层隐私解释框架，本地保留细解释并只发布加噪摘要

    arXiv
    2610.02504
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    gradient-boosted tree regression models
    AbstractHXAI 把无噪声局部 SHAP 留在家庭内，只聚合差分隐私摘要。

    HXAI 是面向分布式能源系统的分层隐私保护解释框架，服务规划、监测与诊断，而不是实时控制。

    Paper analysisRead analysis
  6. DefensesarXiv 2610.02349

    MIRROR：面向多智能体通信的法定人数完整性防御

    提出 MIRROR，用多路径摘要多数表决保障多智能体通信完整性

    arXiv
    2610.02349
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Gemma-4-31B-it, Gemini 2.5 Pro
    AbstractMIRROR 靠多数路径。

    MIRROR 是 LLM 多智能体通信层上的多路径法定人数完整性原语，只处理不透明字节，不解释消息内容。要处理的是 Agent-in-the-Middle：中介合法终结 TLS 后可改在途消息，而语义校验有推理开销和误拦，签名又要求私钥管理。做法是生成结束后复制同一规范化载荷。

    Paper analysisRead analysis
  9. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  11. Evaluation and benchmarksarXiv 2609.28915

    研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性

    构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性

    arXiv
    2609.28915
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    AdaBoost, XGBoost, TabPFN and others10
    AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。

    ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。

    Paper analysisRead analysis
  13. DefensesarXiv 2608.25431

    GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking

    Propose GIFT, isolating user data in shared LLM serving using encryption and GPU information flow tracking

    arXiv
    2608.25431
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-14B, Qwen2.5-32B, Qwen2.5-72B and others6
    AbstractGIFT uses cryptographic isolation plus GPU information flow rules to enforce user data isolation on vLLM and DistServe, and reports throughput overhead.

    GIFT is the authors' user data isolation system for shared LLM serving, with GIFT-CC enabling confidential computing. In the conclusion, the authors state it is the first IFT design for this scenario.

    Paper analysisRead analysis
  14. AttacksarXiv 2608.17485

    KeyPooling: Measuring where LLM API relay paths break prompt cache isolation

    Proposing KeyPooling to measure where API relays break prompt cache isolation

    arXiv
    2608.17485
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    grok-4-fast-non-reasoning, grok-4-1-fast-non-reasoning, grok-3 and others11
    AbstractShared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.

    KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.

    Paper analysisRead analysis
  15. AttacksarXiv 2608.00718

    研究揭示多智能体 LLM 流水线的结构性漏洞

    提出多智能体流水线的边界攻击，使对抗内容作为可信输入跨层传播

    arXiv
    2608.00718
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    GPT-5-mini, Claude Sonnet 4.5, Kimi K2.5
    Abstract缺边界校验使对抗内容跨智能体传播，作者称这是架构属性而非模型能力。

    作者把多智能体 LLM 流水线的对抗问题定义为缺少边界校验，并用生产轨迹和受控实验检查脆弱性来自架构还是骨干模型。中间输出未经验证就传给下游。作者认为，一旦某级接受对抗内容，后续智能体会把它当作可信输入。

    Paper analysisRead analysis
  16. AttacksarXiv 2606.11817

    研究：语法约束解码可越狱 LLM 生成恶意代码，并提出 CodeShield 防御

    提出 CodeSpear 越狱，借语法约束解码生成恶意代码，并给出 CodeShield 防御

    arXiv
    2606.11817
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-Coder-7B, Qwen2.5-Coder-32B, Qwen2.5-7B and others10

    Abstract论文发现语法约束解码会破坏自然语言安全对齐，提出 CodeSpear 越狱攻击与基于蜜罐代码对齐的 CodeShield 防御。

    Paper analysisRead analysis
  17. AttacksarXiv 2605.30040

    研究揭示 LLM 按 token 计费可被服务商系统性虚报

    构造可通过计费审计的 token 虚报，使服务商系统性超收

    arXiv
    2605.30040
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    PALACE domain-adapted auditor
    Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。

    不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。

    Paper analysisRead analysis
  18. AttacksarXiv 2605.08313

    研究者提出 SeedHijack 攻击，劫持 LLM 采样随机数种子

    提出 SeedHijack，劫持采样 PRNG 以强制选定 token

    arXiv
    2605.08313
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    GPT-2 (124M), Qwen2-1.5B-Instruct, DeepSeek-R1-1.5B and others5
    Abstract采样层 PRNG 被替换以强制选 token。

    SeedHijack 把 LLM 采样用的 PRNG 输出换成攻击者选定的数，从而指定下一个 token。权重、输入和 logits 都不改。防御是用硬件 QRNG 替换该随机源。

    Paper analysisRead analysis
  19. DefensesarXiv 2603.10726

    PrefixWall: Mitigating Prefix Cache Side Channels in Shared LLM Systems

    Proposes PrefixWall, which selectively isolates shared prefixes to mitigate timing side channels

    arXiv
    2603.10726
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    gemma-3-4b-it, llava-onevision-qwen2-0.5b-ov-hf, llava-onevision-qwen2-7b-ov-chat-hf and others9
    AbstractPrefixWall uses cache metadata to selectively cut off cross-user prefix continuation, preserving APC while limiting the TTFT side channel.

    PrefixWall is a system-level defense for multi-tenant LLM services that limits the TTFT side channel of Automatic Prefix Caching while preserving prefix reuse.

    Paper analysisRead analysis
  20. AttacksarXiv 2602.20595

    OptiLeak：在多租户 LLM 服务中用强化学习高效重建提示词

    提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示

    arXiv
    2602.20595
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen-2.5-3B-Instruct, Qwen-2.5-7B-Instruct, Qwen-2.5-14B-Instruct and others4

    AbstractOPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。

    Paper analysisRead analysis
Load more