Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 39 papers
Filter6

Attack type

Prompt injection26Poisoning and backdoors10

Attack technique

Gradient and representation optimization10Cross-modal payloads8Dormant triggers8

Defense type

Instruction–data separation5Permissions and approval3

Impact

Unauthorized actions20Data and privacy leaks5Output manipulation7Availability and reliability5

System type

Models and APIs166LLM applications15AI Agent87coding agent8web agent22Browser and computer use9Multi-agent systems4Embodied systems and robotics9

Attack surface / entry point

User input29Web pages and interfaces25Documents and messages9Tool responses10Tool and skill descriptions26Code repositories and dependencies19Memory writes6Images, audio and video14Training data5Weights and gradients5Distribution channels25

Layer

Prompt layer3Application layer30Training and data layer4

System component

MCP and skills3Guardrails and judges3Permissions and sandboxing3Fine-tuning and open weights5Vision12Multimodal13
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 203papers have no tags yet and are not included in filtered results.
System type：coding agentSystem type：web agentSystem type：Embodied systems and roboticsAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Images, audio and videoAttack surface / entry point：Weights and gradientsClear all

Another 203papers do not have category tags yet and are not included in filtered results.

  2. DefensesarXiv 2610.09469

    Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

    提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响

    arXiv
    2610.09469
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
    AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。

    Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  8. AttacksarXiv 2610.06083

    研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击

    提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报

    arXiv
    2610.06083
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    DQN, Double DQN (DDQN)
    Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。

    这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。

    Paper analysisRead analysis
  9. AttacksarXiv 2610.05793

    研究者训练出按多智能体拓扑触发的代码后门模型

    提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞

    arXiv
    2610.05793
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct

    Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。

    Paper analysisRead analysis
  12. DefensesarXiv 2609.35659

    Tracekit: A tamper-proof intent-reasoning-action audit system for autonomous coding agents

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  14. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  15. Evaluation and benchmarksarXiv 2609.28915

    研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性

    构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性

    arXiv
    2609.28915
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    AdaBoost, XGBoost, TabPFN and others10
    AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。

    ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。

    Paper analysisRead analysis
  16. Evaluation and benchmarksarXiv 2609.19140

    AgentLSD：在对抗性任务污染下评测 AI 安全 Agent

    评测安全 Agent 在对抗性任务污染下的解题成功与开销

    arXiv
    2609.19140
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Gemma-4 31B, DeepSeek-V4 Flash, GPT-OSS 120B and others6
    AbstractAgentLSD 用配对 web CTF 表明，欺骗性环境证据会改变安全智能体的解题率与工作量。

    AgentLSD 是一个对照框架，用来测量安全智能体在任务本身不变时，对对抗性任务污染的反应。

    Paper analysisRead analysis
  18. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  19. AttacksarXiv 2609.07051

    TrojanWorld：通过想象引导对世界模型智能体植入后门

    提出 TrojanWorld，用物理触发器对世界模型智能体植入想象引导后门

    arXiv
    2609.07051
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    TD-MPC2, DreamerV3, R2-Dreamer

    AbstractTrojanWorld 揭示了世界模型智能体的供应链后门风险，通过在世界模型中操纵想象可实现对闭环动作的持续控制。

    Paper analysisRead analysis
  20. AttacksarXiv 2608.10393

    DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

    提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作

    arXiv
    2608.10393
    Published
    Layer
    Prompt layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-7B, π0-FAST, openvla-7B
    AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。

    DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。

    Paper analysisRead analysis
Load more