Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 61 papers
Filter6

Attack type

Jailbreaks3Prompt injection21Poisoning and backdoors7Extraction and theft9Detection evasion14

Attack technique

Gradient and representation optimization4Encoding and obfuscation6Role-play and persuasion5Side channels4

Defense type

Detection and filtering9Instruction–data separation5Monitoring and auditing4Watermarking and provenance7

Impact

Unauthorized actions3Data and privacy leaks11Output manipulation29Oversight failure4

System type

Models and APIs27LLM applications27AI Agent107coding agent7web agent22Browser and computer use7Multi-agent systems10

Attacker access

Black-box6

Attack surface / entry point

User input340Web pages and interfaces11Documents and messages32Tool responses15Tool and skill descriptions27Code repositories and dependencies22Retrieval corpus28Memory writes5Images, audio and video110Training data69Weights and gradients69Distribution channels40Inference services and hardware21

Layer

Model layer14Application layer32Infrastructure layer15

System component

RAG6Guardrails and judges9Monitors6Reasoning chains3Embeddings3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：LLM applicationsSystem type：coding agentAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Documents and messagesAttack surface / entry point：Inference services and hardwareClear all

Another 213papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.11932

    A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

    Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.

    arXiv
    2610.11932
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Grok, Doubao, ChatGPT and others10

    AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.11848

    SemField: training-free semantic watermark

    Proposes the semantic watermark SemField, which still identifies the attribution of generated text after paraphrasing and structural changes.

    arXiv
    2610.11848
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.2-1B, Qwen3-1.7B, OPT-1.3B
    AbstractTraining-independent document-level semantic watermark.

    SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.11634

    LTBD：用可学习信任边界分隔符防御提示注入

    提出 LTBD，用可学习分隔符隔离可信指令与不可信数据

    arXiv
    2610.11634
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Llama3-8B-Instruct, Llama3.1-8B-Instruct, Falcon3-7B-Instruct and others4
    AbstractLTBD 只训练四个分隔符嵌入。

    LTBD 是一种不改基座权重的提示注入防御：只学习用来标出可信指令与不可信数据边界的四个 token 嵌入。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.09981

    研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题

    提出利用路由元数据推断敏感话题的侧信道攻击

    arXiv
    2610.09981
    Published
    Layer
    Infrastructure layer
    Setting
    LLM applications
    Evaluated models
    RouteLLM (BERT router), notdiamond-0001, Vela (vLLM Semantic Router)

    Abstract论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.06848

    TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击

    提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员

    arXiv
    2610.06848
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5

    AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.05894

    研究者提出闭环偏见注入攻击

    提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见

    arXiv
    2610.05894
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct

    Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。

    Paper analysisRead analysis
  8. DefensesarXiv 2610.05163

    Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

    提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入

    arXiv
    2610.05163
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
    Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。

    本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。

    Paper analysisRead analysis
  10. DefensesarXiv 2610.04763

    UT Austin 将 SynthID 水印嵌入基因组语言模型，凭 DNA 序列和密钥追溯 AI 生成片段

    把 SynthID 嵌入基因组语言模型采样，并用位置无关检测追溯生成序列

    arXiv
    2610.04763
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Carbon-500M, GENERator-v2-eukaryote-1.2b-base
    Abstract两个六碱基基因组模型嵌入 SynthID 后，位置无关验证能找回水印，作者称这只是统计检测。

    作者在两个六碱基基因组模型的采样里嵌入 SynthID，并让验证者在不知道起点、链和 token phase 时做一次校正后的检出。

    Paper analysisRead analysis
  12. Analysis and theoryarXiv 2610.02504

    HXAI：分布式能源系统中的分层隐私保护可解释 AI 框架

    提出 HXAI 分层隐私解释框架，本地保留细解释并只发布加噪摘要

    arXiv
    2610.02504
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    gradient-boosted tree regression models
    AbstractHXAI 把无噪声局部 SHAP 留在家庭内，只聚合差分隐私摘要。

    HXAI 是面向分布式能源系统的分层隐私保护解释框架，服务规划、监测与诊断，而不是实时控制。

    Paper analysisRead analysis
  14. DefensesarXiv 2609.37310

    AutoMark：让自动研究流程自主发现更优 LLM 水印方案

    提出 AutoMark，自动搜索并统计检验 LLM 文本水印

    arXiv
    2609.37310
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen3.8-27B, GPT-6 Astra and others5
    AbstractAutoMark 的贡献同时包含搜索出的水印，以及用于约束自动研究误报与评测漏洞的验证框架。

    AutoMark 是一套自动水印研究框架：先检查生成分布和误报性质，再比较检测、编辑鲁棒性与质量，最后人工分析组件并做留出评测。

    Paper analysisRead analysis
  15. Evaluation and benchmarksarXiv 2609.36817

    pikit：面向间接提示注入研究与评测的可组合工具包

    构建可组合工具包 pikit，评测编码智能体的间接提示注入

    arXiv
    2609.36817
    Published
    Layer
    Application layer
    Setting
    coding agent
    Abstractpikit 提供组合式间接注入评测。

    pikit 是面向间接提示注入研究的组合式工具包，主要贡献是组织攻击、投递通道、防御和判定流程，而非提出新的攻击优化算法。

    Paper analysisRead analysis
  17. DefensesarXiv 2609.36372

    TTMark：超越单 token 熵的成对无失真水印

    提出成对无失真水印 TTMARK，增强低熵下的机器文本检测

    arXiv
    2609.36372
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama3.2-3B-Instruct, Mistral-v0.3-7B-Instruct, Qwen2.5-7B-Instruct
    AbstractTTMARK 用水印化相邻 token 对利用条件熵，在多种无失真方案上提高检测并保持生成质量。

    TTMARK 是一种成对、无失真的文本水印：对相邻 token 的联合分布重加权，而不是逐 token 独立重加权。

    Paper analysisRead analysis
  18. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  20. Evaluation and benchmarksarXiv 2609.28915

    研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性

    构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性

    arXiv
    2609.28915
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    AdaBoost, XGBoost, TabPFN and others10
    AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。

    ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。

    Paper analysisRead analysis
Load more