Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 23 papers

Filter6

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Dormant triggers System type：Models and APIs System type：LLM applications Layer：Model layer Layer：Application layer Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.13928Oct 10
AI models can provably hide arbitrary capabilities
Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities
arXiv
2610.13928
Published
Oct 10
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma 3 270M
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
AbstractThe authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.
The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.
Paper analysisRead analysis
AttacksarXiv 2610.06049Oct 5
研究者提出仅修改 SAE 解码器的后门攻击，可在不改动语言模型的情况下植入行为
提出只改 SAE 解码器的后门，在冻结语言模型上植入代码插入
arXiv
2610.06049
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma 3 4B Instruct, Qwen3 1.7B, Llama 3.1 8B Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
Abstract只改解码器的 SAE 可带上代码插入后门，且若干常规质量指标变化不大。
只改 SAE 解码器、冻结编码器与语言模型，即可把代码插入行为放进推理时的辅助组件。作者把这视为 SAE 供应链问题：checkpoint 一旦替换某一层激活，就参与后续计算，而不只是解释工具。
Paper analysisRead analysis
AttacksarXiv 2610.05894Oct 5
研究者提出闭环偏见注入攻击
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
arXiv
2610.05894
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
Paper analysisRead analysis
AttacksarXiv 2610.03166Oct 2
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
arXiv
2610.03166
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
Paper analysisRead analysis
AttacksarXiv 2610.01062Oct 1
Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架
提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱
arXiv
2610.01062
Published
Oct 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B-Instruct, Gemma-2-9B-IT, Llama-3.1-8B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
AbstractKAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。
Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis
AttacksarXiv 2606.11265Jun 9
论文提出 CRCP 投毒框架，揭示 RAG 分块与重排序下的投毒失效问题
提出 CRCP 框架，优化分块与重排下的 RAG 语料投毒
arXiv
2606.11265
Published
Jun 9
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, DeepSeek-R1, Qwen3-Max and others11
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractCRCP 把投毒做成多阶段一致性问题。
CRCP 研究的是带分块和重排的 RAG 语料投毒，而不是只提高文档级检索分数。
Paper analysisRead analysis
AttacksarXiv 2605.28074May 27
SilentRetrieval: Hijacking retrieval-augmented generation with semantically preserved adversarial data poisoning
提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成
arXiv
2605.28074
Published
May 27
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-2-7B-Chat, Mistral-7B-Instruct-v0.2, Qwen-7B-Chat and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
Abstract两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。
SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。
Paper analysisRead analysis
AttacksarXiv 2605.10253May 11
Knowledge poisoning attacks against multimodal retrieval-augmented generation in healthcare
提出 M3 Att，在不知查询时投毒医学多模态 RAG 并误导临床决策
arXiv
2605.10253
Published
May 11
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, GPT-5 Chat, Gemini-2.5-Flash and others8
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2605.08513May 9
Apple 研究者发现抑制单个神经元即可绕过 LLM 安全对齐
提出单神经元激活干预，抑制拒答神经元或放大概念神经元以绕过安全对齐
arXiv
2605.08513
Published
May 9
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others11
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract作者称大模型安全由拒答门控与概念底座构成，干预单个神经元足以双向击穿对齐，且拒答神经元在预训练阶段已然存在。
Paper analysisRead analysis
AttacksarXiv 2603.13847Mar 14
SWhisper 用近超声隐蔽声学通道对语音驱动 LLM 实现黑盒越狱
提出 SWhisper，用近超声波向语音驱动 LLM 隐蔽注入越狱提示
arXiv
2603.13847
Published
Mar 14
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta-Llama-3.1-8B-Instruct, Gemma-3-4B, Qwen2.5-7B-Instruct and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2603.10080Mar 10
Amnesia: Adversarial Activation Steering on Specific Semantic Layers of Large Language Models
Propose the Amnesia activation-guided attack to bypass model safety refusal during inference
arXiv
2603.10080
Published
Mar 10
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Llama-3-8B-Instruct, Qwen-7B-Chat
- AttacksModel tampering
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2602.17837Feb 20
TFL: Targeted Bit-Flip Attack against Large Language Models
Proposes TFL targeted bit flipping so that selected prompts output false answers while unrelated queries remain correct
arXiv
2602.17837
Published
Feb 20
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, DeepSeek-R1-Distill-Qwen-14B, LLaMA-3.1-8B-INSTRUCT
- TechniqueGradient and representation optimization
AbstractTFL searches weight bits on three LLMs to make specified prompts produce target keywords while constraining degradation on unrelated tasks.
TFL is a framework for targeted bit flips on LLM main memory weights: the attacker wants a selected prompt to output a specified false answer keyword while limiting degradation on unrelated queries.
Paper analysisRead analysis
AttacksarXiv 2602.15344Feb 17
ER-MIA: Black-box Adversarial Memory Injection Attacks against Long-term Memory-augmented Large Language Models
提出 ER-MIA 黑盒记忆注入，用嵌入相近记忆抢占检索并改错后续回答
arXiv
2602.15344
Published
Feb 17
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama3.2:3b, Gemma 3:27b, GPT-oss:20b
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2602.07107Feb 7
ShallowJail: Guiding Jailbreak Attacks Against Large Language Models
Proposes ShallowJail, which achieves jailbreaks by rewriting hidden states with steering vectors at inference time
arXiv
2602.07107
Published
Feb 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B-Instruct-2507, Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2602.05444Feb 5
Causal front-door adjustment for robust jailbreak attacks on LLMs
Proposes CFA2, using SAE to locate defense directions and orthogonalizing output weights to achieve jailbreak
arXiv
2602.05444
Published
Feb 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama 3.1 8B Instruct, Llama2 7B Chat, Mistral 7B Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2602.00979Feb 1
GradingAttack: Revealing Security Vulnerabilities in LLM-Based Educational Grading Agents
提出 GradingAttack，用梯度后缀与角色扮演操纵教育评分智能体判定
arXiv
2602.00979
Published
Feb 1
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen2.5-7B, Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct and others8
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2602.00364Jan 31
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
arXiv
2602.00364
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

AI models can provably hide arbitrary capabilities

研究者提出仅修改 SAE 解码器的后门攻击，可在不改动语言模型的情况下植入行为

研究者提出闭环偏见注入攻击

LiBRA：通过双向隐空间优化实现检测感知的图像水印去除

Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架

CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

规避与投毒攻击对恶意软件数据漂移检测器的实证分析

PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

论文提出 CRCP 投毒框架，揭示 RAG 分块与重排序下的投毒失效问题

SilentRetrieval: Hijacking retrieval-augmented generation with semantically preserved adversarial data poisoning

Knowledge poisoning attacks against multimodal retrieval-augmented generation in healthcare

Apple 研究者发现抑制单个神经元即可绕过 LLM 安全对齐

SWhisper 用近超声隐蔽声学通道对语音驱动 LLM 实现黑盒越狱

Amnesia: Adversarial Activation Steering on Specific Semantic Layers of Large Language Models

TFL: Targeted Bit-Flip Attack against Large Language Models

ER-MIA: Black-box Adversarial Memory Injection Attacks against Long-term Memory-augmented Large Language Models

ShallowJail: Guiding Jailbreak Attacks Against Large Language Models

Causal front-door adjustment for robust jailbreak attacks on LLMs

GradingAttack: Revealing Security Vulnerabilities in LLM-Based Educational Grading Agents

"Someone hid it": Query-agnostic black-box attacks against LLM retrieval