Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 129 papers
Filter6

Attack type

Jailbreaks13Prompt injection28Poisoning and backdoors46Model tampering28Extraction and theft21Detection evasion9Malicious use3

Attack technique

Gradient and representation optimization11Automated search10Encoding and obfuscation8Side channels3Defense-targeted13Dormant triggers17Selection manipulation3

Defense type

Model hardening14Detection and filtering9Instruction–data separation3Permissions and approval3Monitoring and auditing7

Impact

Harmful content31Unauthorized actions26Data and privacy leaks29Output manipulation20Availability and reliability5Oversight failure10

System type

Models and APIs85LLM applications7AI Agent98coding agent44Browser and computer use3Multi-agent systems6

Attacker access

Black-box12Gray-box4White-box28

Attack surface / entry point

User input310Web pages and interfaces3Documents and messages14Tool responses12Tool and skill descriptions26Code repositories and dependencies20Retrieval corpus3Memory writes4Images, audio and video103Training data67Weights and gradients71Distribution channels39Inference services and hardware18

Layer

Prompt layer5Model layer35Application layer42Training and data layer34Infrastructure layer13

System component

MCP and skills23Guardrails and judges5Monitors9Reasoning chains5Permissions and sandboxing5Fine-tuning and open weights34Vision3Image generation6Multimodal10
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：coding agentAttack surface / entry point：Tool and skill descriptionsAttack surface / entry point：Code repositories and dependenciesAttack surface / entry point：Weights and gradientsAttack surface / entry point：Inference services and hardwareClear all

Another 201papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.13928

    AI models can provably hide arbitrary capabilities

    Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities

    arXiv
    2610.13928
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 3 270M
    AbstractThe authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.

    The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.09941

    OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

    提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向

    arXiv
    2610.09941
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
    Abstract一次投影去掉劫持方向。

    OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.09819

    FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

    提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门

    arXiv
    2610.09819
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    HuBERT-base, WavLM-base

    Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.10612

    PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

    提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器

    arXiv
    2610.10612
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    CISCO, HSS, AUDITOR and others8
    Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。

    这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.09264

    研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

    提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包

    arXiv
    2610.09264
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
    AbstractPackHallu 诱导规则文件换包。

    PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。

    Paper analysisRead analysis
  7. Analysis and theoryarXiv 2610.09004

    研究：去除有害信息不足以证明开源权重模型的抗篡改能力

    论证发布时互信息不能认证开源权重抗微调恢复

    arXiv
    2610.09004
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
    Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。

    作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。

    Paper analysisRead analysis
  10. AttacksarXiv 2610.07654

    研究揭示策略蒸馏的安全后门风险

    测量带后门教师经 OPD 向干净学生迁移潜伏后门

    arXiv
    2610.07654
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-1.5B-Instruct, Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct
    Abstract作者称 OPD 可在压低无触发词有害率时迁入后门。

    带后门的外部教师经 OPD，可在压低无触发词有害率的同时，把触发条件下的有害行为传给初始干净学生。。

    Paper analysisRead analysis
  12. InterpretabilityarXiv 2610.07518

    TRACE：仅凭 checkpoint 更新审计大语言模型有害目标

    提出 TRACE，仅凭检查点更新审计有害合规微调目标

    arXiv
    2610.07518
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3, Qwen3-8B and others6
    Abstract作者称有害合规 SFT 在检查点更新中留下可排序坐标，并据此做只读权重审计。

    作者在检查点更新里寻找有害合规 SFT 的目标组成，并把读数做成不查询模型、不看未知训练数据的审计分 TRACE。

    Paper analysisRead analysis
  13. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  15. AttacksarXiv 2610.06848

    TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击

    提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员

    arXiv
    2610.06848
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5

    AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。

    Paper analysisRead analysis
  16. AttacksarXiv 2610.07125

    PEV 攻击利用嵌入向量加噪越狱六款开源权重模型

    提出 PEV 攻击，在输入嵌入上加高斯噪声越狱开源模型

    arXiv
    2610.07125
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-1.5B-Instruct, Phi-4-mini-3.8B and others6
    AbstractPEV 用 embedding 高斯噪声，在六个模型上越狱 JailbreakBench 全部提示。

    PEV 是对 open-weight LLM 的 embedding 噪声越狱。

    Paper analysisRead analysis
  17. AttacksarXiv 2610.06049

    研究者提出仅修改 SAE 解码器的后门攻击，可在不改动语言模型的情况下植入行为

    提出只改 SAE 解码器的后门，在冻结语言模型上植入代码插入

    arXiv
    2610.06049
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 3 4B Instruct, Qwen3 1.7B, Llama 3.1 8B Instruct
    Abstract只改解码器的 SAE 可带上代码插入后门，且若干常规质量指标变化不大。

    只改 SAE 解码器、冻结编码器与语言模型，即可把代码插入行为放进推理时的辅助组件。作者把这视为 SAE 供应链问题：checkpoint 一旦替换某一层激活，就参与后续计算，而不只是解释工具。

    Paper analysisRead analysis
  18. Analysis and theoryarXiv 2610.06001

    AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks

    提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入

    arXiv
    2610.06001
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
    Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。

    本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。

    Paper analysisRead analysis
  19. AttacksarXiv 2610.05894

    研究者提出闭环偏见注入攻击

    提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见

    arXiv
    2610.05894
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct

    Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。

    Paper analysisRead analysis
  20. AttacksarXiv 2610.05793

    研究者训练出按多智能体拓扑触发的代码后门模型

    提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞

    arXiv
    2610.05793
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct

    Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。

    Paper analysisRead analysis
Load more