Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 324 papers

Filter4

System component

MCP and skills16 Memory4 RAG23 Guardrails and judges46 Monitors5 Reasoning chains19 Fine-tuning and open weights28 Vision54 Audio12 Image generation22 Embeddings9 Multimodal88

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.

System type：Models and APIs System type：LLM applications System type：coding agent System type：web agent Clear all

Another 227papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.13928Oct 10
AI models can provably hide arbitrary capabilities
Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities
arXiv
2610.13928
Published
Oct 10
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma 3 270M
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
AbstractThe authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.
The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.
Paper analysisRead analysis
AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
AttacksarXiv 2610.11112Oct 8
EpiReal-Bench：商用图像生成模型虚假声明红队基准
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
arXiv
2610.11112
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
- AttacksJailbreaks
- ComponentImage generation
Abstract四款商用图像模型能把假主张画成可信证据。
EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2610.10000Oct 7
超越奖励压制：有界奖励热启动 Bandit 的近最优离线攻击
提出热启动 Bandit 的部署前有界离线注入攻击
arXiv
2610.10000
Published
Oct 7
Layer
Training and data layer
Setting
LLM applications
Evaluated models
UCB, Thompson Sampling, ϵ-greedy
- AttacksPoisoning and backdoors
Paper analysisRead analysis
AttacksarXiv 2610.09981Oct 7
研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题
提出利用路由元数据推断敏感话题的侧信道攻击
arXiv
2610.09981
Published
Oct 7
Layer
Infrastructure layer
Setting
LLM applications
Evaluated models
RouteLLM (BERT router), notdiamond-0001, Vela (vLLM Semantic Router)
- AttacksExtraction and theft
- TechniqueSide channels
Abstract论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
AttacksarXiv 2610.09264Oct 7
研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
arXiv
2610.09264
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
- AttacksPrompt injection
- TechniqueAutomated search
AbstractPackHallu 诱导规则文件换包。
PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2610.07723Oct 6
Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.
提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答
arXiv
2610.07723
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。
Paper analysisRead analysis
AttacksarXiv 2610.07654Oct 6
研究揭示策略蒸馏的安全后门风险
测量带后门教师经 OPD 向干净学生迁移潜伏后门
arXiv
2610.07654
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-1.5B-Instruct, Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract作者称 OPD 可在压低无触发词有害率时迁入后门。
带后门的外部教师经 OPD，可在压低无触发词有害率的同时，把触发条件下的有害行为传给初始干净学生。。
Paper analysisRead analysis
AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
AttacksarXiv 2610.07323Oct 6
ATLAS：用自适应信任域与主动学习搜索潜在对抗样本集
提出 ATLAS 用水平集估计恢复黑盒分类器的对抗输入集合
arXiv
2610.07323
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LeNet5, ResNet50 (CIFAR-10 standard), ResNet50 (ImageNet standard) and others5
- AttacksDetection evasion
- TechniqueAutomated search
AbstractATLAS 用主动水平集估计构造黑盒对抗集，作者称其集合比单点攻击更具代表性。
ATLAS 是一个查询式 black-box 框架，用来构造诱发失败的对抗输入集合，供鲁棒性审计使用。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

AI models can provably hide arbitrary capabilities

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

EpiReal-Bench：商用图像生成模型虚假声明红队基准

BRANCH 方法绕过 6 套多扫描器护栏系统

超越奖励压制：有界奖励热启动 Bandit 的近最优离线攻击

研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题

研究：多向量视觉文档索引可被反演还原页面内容

FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

WebMirage hijacks visual web agents' browser operations with adversarial images

P-VMI：对抗图像经 KV cache 持续影响多轮对话

STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击

CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移

Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.

研究揭示策略蒸馏的安全后门风险

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

ATLAS：用自适应信任域与主动学习搜索潜在对抗样本集