Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Encoding and obfuscation System type：Models and APIs Attack surface / entry point：Images, audio and video Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2610.06977Oct 4
IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法
提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
arXiv
2610.06977
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-VL-7B, Qwen2.5-VL-72B, InternVL3-14B and others17
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.03166Oct 2
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
arXiv
2610.03166
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2609.05525Sep 2
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
arXiv
2609.05525
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.04034Aug 3
HACA：原子越狱策略解耦组合的多模态自动红队方法
提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
arXiv
2608.04034
Published
Aug 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-1.6-Mistral-7B, InternVL-3.5-8B, VLGuard (LLaVA-v1.5-7B-Mixed) and others5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.19855Jul 22
研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测
提出最小范数攻击集成，用鲁棒性曲线评测图像分类器
arXiv
2607.19855
Published
Jul 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C1–C20（CIFAR-10，Table 1）, I1–I10（ImageNet，Table 1）
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Abstract预算可控的最小范数集成用 AOI 逼近攻击前沿，DOI 给出不依赖单一ε的防御排序。
这篇工作把对抗鲁棒评测从单一 ε、固定集成，改成可按查询预算收紧的曲线估计。
Paper analysisRead analysis
AttacksarXiv 2606.01837Jun 1
论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
arXiv
2606.01837
Published
Jun 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。
DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
Paper analysisRead analysis
AttacksarXiv 2605.21541May 20
研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
arXiv
2605.21541
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。
FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
Paper analysisRead analysis
AttacksarXiv 2605.20519May 20
CodecAttack：在音频编解码器潜空间构造对抗扰动，绕过有损压缩防御
提出 CodecAttack，在编解码器隐空间构造可穿透有损压缩的对抗音频
arXiv
2605.20519
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-Audio-7B-Instruct, Audio Flamingo 3, Qwen2.5-Omni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2605.18915May 18
DMN：面向多图输入的多模态大模型组合式越狱框架
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
arXiv
2605.18915
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4V, GPT-4o, GPT-5 and others10
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.16090May 15
研究者提出 CrossMPI：仅用图像扰动实现跨模态提示注入
提出 CrossMPI，仅用图像扰动实现跨模态提示注入
arXiv
2605.16090
Published
May 15
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
MiniGPT4-llama2, MiniGPT4-vicuna, InstructBLIP and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.07399May 8
研究者提出 GPO-V，用全局概率优化越狱扩散视觉语言模型
提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
arXiv
2605.07399
Published
May 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
LLaDA-V, LaViDA
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Abstract作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。
GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。。
Paper analysisRead analysis
AttacksarXiv 2605.05709May 7
研究者提出利用重构与隐藏权衡的多模态大模型越狱方法
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
arXiv
2605.05709
Published
May 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.4-nano, GPT-5.4-mini, Gemini-2.5-Flash and others19
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.00583May 1
Jailbreaking vision-language models through the visual modality
提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答
arXiv
2605.00583
Published
May 1
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.2, Claude-Haiku-4.5, Gemini-3-Flash and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Abstract四类视觉越狱在六个 VLM 上检验文本对齐能否挡住视觉意图，模型与攻击之间差异大。
四类视觉越狱用来检验前沿 VLM 的文本安全训练能否挡住由图像传达的有害意图。。
Paper analysisRead analysis
AttacksarXiv 2604.14604Apr 16
The AudioHijack framework achieves covert audio prompt injection against 13 speech large models
提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入
arXiv
2604.14604
Published
Apr 16
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
SpeechGPT, GLM-4-Voice, VITA-Audio and others15
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentAudio
Abstract提出了 AudioHijack 框架，揭示了 LALM 对听觉提示注入的脆弱性与传统防御的局限。
Paper analysisRead analysis
AttacksarXiv 2604.03117Apr 3
Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models
Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.
arXiv
2604.03117
Published
Apr 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.
UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.
Paper analysisRead analysis
AttacksarXiv 2603.29418Mar 31
研究者提出针对商用多模态大模型的隐蔽视觉提示注入方法
提出 CoTTA 隐蔽视觉提示注入，使多模态模型输出指定指令
arXiv
2603.29418
Published
Mar 31
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4o, GPT-5, Claude-4.5 and others4
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractCoTTA 以隐蔽触发和双目标对齐诱导指定句子。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop