Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 24 papers
Filter4

Attack type

Poisoning and backdoors21Detection evasion3

Attack technique

Defense-targeted7Dormant triggers13

Impact

Harmful content6Output manipulation11Availability and reliability3

System type

Models and APIs20LLM applications2AI Agent6coding agent2Embodied systems and robotics3

Attack surface / entry point

User input174Documents and messages12Tool responses6Tool and skill descriptions16Code repositories and dependencies12Retrieval corpus19Images, audio and video68Training data24Weights and gradients45Distribution channels26Inference services and hardware14

Layer

Training and data layer21

System component

Guardrails and judges3Fine-tuning and open weights15Multimodal3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：LLM applicationsSystem type：coding agentAttack surface / entry point：Training dataClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  3. AttacksarXiv 2610.07723

    Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.

    提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答

    arXiv
    2610.07723
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4

    Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.07654

    研究揭示策略蒸馏的安全后门风险

    测量带后门教师经 OPD 向干净学生迁移潜伏后门

    arXiv
    2610.07654
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-1.5B-Instruct, Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct
    Abstract作者称 OPD 可在压低无触发词有害率时迁入后门。

    带后门的外部教师经 OPD，可在压低无触发词有害率的同时，把触发条件下的有害行为传给初始干净学生。。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.05793

    研究者训练出按多智能体拓扑触发的代码后门模型

    提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞

    arXiv
    2610.05793
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct

    Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.01367

    研究：高质量数据筛选挡不住投毒

    提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本

    arXiv
    2610.01367
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
    Abstract质量筛选挡不住部分高分样本的安全削弱。

    Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.01365

    ReGap：无需真实隐私数据即可通过微调重新提取模型隐私关联

    提出 ReGap，用自生成伪监督微调恢复模型中的隐私关联

    arXiv
    2610.01365
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    White-box, Gray-box
    Evaluated models
    GPT-2 Small, GPT-2 Medium, GPT-2 Large and others6

    Abstract提出无真实私有监督的恢复攻击 ReGap，实验显示微调可通过自生成数据唤醒模型潜在隐私关联，突显后适应隐私风险。

    Paper analysisRead analysis
  9. AttacksarXiv 2609.33985

    研究：众包微调数据投毒可放大专有指令抽取

    提出主题锚点投毒，放大众包微调后的专有指令提取

    arXiv
    2609.33985
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct, Llama-3.1-8B-Instruct and others4

    Abstract论文提出基于主题锚点的数据中毒攻击，证明低比例的中毒样本可在黑盒条件下隐蔽放大微调指令泄漏。

    Paper analysisRead analysis
  10. AttacksarXiv 2609.33569

    信息黑洞：3D 点云重建中的后门机制研究

    提出 Information Blackhole 与 AGM，控制点云自编码器后门重建到指定形状

    arXiv
    2609.33569
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    FoldingNet, PointDiffusion
    AbstractAGM 用自适应高斯匹配压制 PCAE 投毒潜码中的源几何，九组设置的 CD-ASD 均下降。

    这篇工作研究点云自编码器的训练时后门：干净输入仍自重建，带触发的输入应重建成攻击者指定形状。分类后门只需把预测推向离散标签。PCAE 把源几何与目标信息编进同一个连续潜空间，残留源几何会把重建拉回源形状。

    Paper analysisRead analysis
  11. AttacksarXiv 2609.27422

    RAMP：逆转对抗扰动以增强针对恶意软件检测器的干净标签后门攻击

    提出 RAMP，逆转对抗扰动加强恶意软件检测器的干净标签后门

    arXiv
    2609.27422
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    MalConv, MalConvGCG
    AbstractRAMP 用反转扰动做 clean-label 投毒。

    RAMP 是 score-based black-box 下的 clean-label 后门增强，对象是会微调的 Windows PE 原始字节恶意软件检测器。

    Paper analysisRead analysis
  12. AttacksarXiv 2609.27124

    Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习

    提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复

    arXiv
    2609.27124
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    CNN（MNIST：2 Conv + 3 FC）, CNN（Fashion-MNIST：6 Conv + 1 FC）, ResNet18（CIFAR-10）
    AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。

    Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。

    Paper analysisRead analysis
  13. AttacksarXiv 2609.17817

    论文：用投毒基准污染自改进编码 Agent，令其后续版本写出漏洞代码

    提出基准投毒攻击，使自修改编码 Agent 跨代写出含漏洞代码

    arXiv
    2609.17817
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Sonnet 4.5, Qwen3.5-397B, gpt-oss-120b and others5

    Abstract论文报告了恶意基准能污染自修改代码智能体的进化过程并持续输出漏洞，警示系统设计需纳入安全约束。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.07048

    FreqDoor：面向视觉语言模型的频域后门攻击

    提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门

    arXiv
    2609.07048
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
    AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。

    FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。

    Paper analysisRead analysis
  18. AttacksarXiv 2609.01495

    去中心化联邦学习中的拜占庭节点放置优化

    提出 BPI 选点算法，增强去中心化联邦学习中的模型与数据投毒

    arXiv
    2609.01495
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    AbstractBPI 用有限轮 gossip 暴露选拜占庭集合。

    作者把 DFL 中“破坏哪 m 个节点”写成攻击者在固定预算下的优化问题，并用 BPI 近似有限轮内诚实节点受到的拜占庭暴露。

    Paper analysisRead analysis
  20. AttacksarXiv 2607.21839

    论文指出密码学模型认证的假设缺口：审计通过但部署失效

    提出数据伪造攻击，使密码学模型认证在审计集通过但部署失效

    arXiv
    2607.21839
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    SciKit-Learn decision tree, XGBoost, 226M-parameter neural network and others4
    Abstract固定审计集上的 ZKP 认证可被数据伪造绕过。

    这篇工作同时给出对 CMC 的数据伪造攻击，以及先承诺、后抽样的认证模板。。

    Paper analysisRead analysis
Load more