AttacksarXiv 2610.09708
研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率
提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
- arXiv
- 2610.09708
- Published
- Layer
- Prompt layer
- Evaluated models
- OpenVLA, UniVLA, π0.5
- TechniqueGradient and representation optimization
- ComponentVision
All papers
Filter5
Attack type
Attack technique
Impact
System type
Attack surface / entry point
Layer
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.
Another 227papers do not have category tags yet and are not included in filtered results.
- AttacksarXiv 2610.10612
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
- arXiv
- 2610.10612
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
- AttacksarXiv 2610.07510
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
- arXiv
- 2610.07510
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
- AttacksarXiv 2610.06814
TAPDreamer：可跨任务迁移的世界动作模型对抗补丁
TAPDreamer 用公开编码器做固定补丁。
- arXiv
- 2610.06814
- Published
- Layer
- Prompt layer
- Evaluated models
- FastWAM, DreamWAM-uncond, DreamWAM-joint and others4
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2610.06083
研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击
提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报
- arXiv
- 2610.06083
- Published
- Layer
- Model layer
- Evaluated models
- DQN, Double DQN (DDQN)
Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。
这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。
- AttacksarXiv 2610.05793
研究者训练出按多智能体拓扑触发的代码后门模型
提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞
- arXiv
- 2610.05793
- Published
- Setting
- coding agent
- Evaluated models
- Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。
- AttacksarXiv 2610.03857
研究者提出 EviLLM 攻击：通过被入侵账号向 AI 代码生成流程注入漏洞
提出 EviLLM，经账户指令或插件向代码生成流程注入漏洞
- arXiv
- 2610.03857
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- GPT-4o, Llama 3.2 (3B)
- AttacksPrompt injection
- TechniqueDefense-targeted
- AttacksarXiv 2609.33910
论文提出残留授权重放攻击：长期运行 Agent 的授权可跨任务复用
提出残余权限重放攻击，跨任务复用长期 Agent 的历史授权绕过确认
- arXiv
- 2609.33910
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- GPT-4.1, Gemini-3.1-Flash-Lite, Qwen3-14B and others6
- AttacksPrompt injection
- TechniqueDefense-targeted
- ComponentPermissions and sandboxing
- AttacksarXiv 2609.32400
SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能
提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
- arXiv
- 2609.32400
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- DeepSeek-V4-Pro, GLM-5.2, Qwen3.5-397B-A17B and others4
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
- AttacksarXiv 2609.22711
UBA-ORL：针对离线强化学习的遗忘激活后门攻击
提出 UBA-ORL，以 BD/CM 样本在遗忘后激活离线 RL 后门
- arXiv
- 2609.22711
- Published
- Evaluated models
- TD3+BC, BCQ, IQL
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
AbstractUBA-ORL 用竞争的 BD/CM 样本，使离线 RL 后门在删除伪装轨迹后激活。
UBA-ORL 研究离线强化学习中由合规轨迹删除激活的后门：合法贡献者同时上传共享触发的后门轨迹和伪装轨迹，训练后触发响应被压低，删除伪装批次后再升高。受害系统是使用静态数据集和轨迹级遗忘接口的离线 RL 服务。对手不能看到训练算法、参数、梯度或具体遗忘算法，但能提交可区分批次，并在部署时向观测注入预定触发。
- AttacksarXiv 2609.18217
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
- arXiv
- 2609.18217
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
- AttacksarXiv 2609.13889
PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
- arXiv
- 2609.13889
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
- AttacksarXiv 2609.07051
TrojanWorld：通过想象引导对世界模型智能体植入后门
提出 TrojanWorld，用物理触发器对世界模型智能体植入想象引导后门
- arXiv
- 2609.07051
- Published
- Evaluated models
- TD-MPC2, DreamerV3, R2-Dreamer
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
AbstractTrojanWorld 揭示了世界模型智能体的供应链后门风险，通过在世界模型中操纵想象可实现对闭环动作的持续控制。
- AttacksarXiv 2609.01222
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
- arXiv
- 2609.01222
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
- AttacksarXiv 2609.01023
Akrasia：针对推理型代码 LLM 的隐蔽后门攻击
提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
- arXiv
- 2609.01023
- Published
- Layer
- Prompt layer
- Setting
- coding agent
- Evaluated models
- Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7
- AttacksPrompt injection
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
- AttacksarXiv 2608.25776
EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation
提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播
- arXiv
- 2608.25776
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。
The researchers propose SkillMisevo-Bench to quantify the risk of skill mis-evolution in self-improving agents.
提出 SkillMisevo-Bench，量化自改进 Agent 的技能误演化
- arXiv
- 2608.12851
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Claude Code, Codex, Hermes and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
- AttacksarXiv 2608.10393
DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型
提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作
- arXiv
- 2608.10393
- Published
- Layer
- Prompt layer
- Evaluated models
- OpenVLA-7B, π0-FAST, openvla-7B
- TechniqueCross-modal payloads
- ComponentVision
AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。
DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。
- AttacksarXiv 2608.09732
ColluSkill 用跨技能组合绕过 Agent 技能扫描器
提出 ColluSkill，用跨技能组合绕过 Agent 技能扫描器
- arXiv
- 2608.09732
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- GPT-5.5, DeepSeek-V4-Pro, GLM-5.2
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文揭示了单技能孤立扫描的盲区，提出多技能链攻击 ColluSkill 与上下文防御 ChainGuard 并验证了有效性。
- AttacksarXiv 2608.09577
ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门
提出 ElasticBack，在单个 Agent 技能中植入条件后门
- arXiv
- 2608.09577
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- GLM-5.2, MiniMax-M3, GPT-5.4 and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。
ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。