Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 11 papers
Filter4

Attack type

Prompt injection3Poisoning and backdoors11

Attack technique

Gradient and representation optimization7Automated search23Encoding and obfuscation13Role-play and persuasion8Conversation structure manipulation3Cross-modal payloads5Defense-targeted8Dormant triggers11Selection manipulation4

Impact

Unauthorized actions4Data and privacy leaks4Output manipulation3

System type

Models and APIs18LLM applications3AI Agent38coding agent8Browser and computer use1Multi-agent systems3Embodied systems and robotics4

Attack surface / entry point

User input3Tool and skill descriptions3Code repositories and dependencies3Weights and gradients4Distribution channels5

Layer

Application layer9

System component

MCP and skills4Memory3Fine-tuning and open weights4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.
Attack technique：Dormant triggersSystem type：LLM applicationsSystem type：coding agentSystem type：Browser and computer useClear all

Another 255papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.05793

    研究者训练出按多智能体拓扑触发的代码后门模型

    提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞

    arXiv
    2610.05793
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct

    Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.02774

    CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

    提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞

    arXiv
    2609.02774
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B

    AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。

    Paper analysisRead analysis
  6. AttacksarXiv 2608.25776

    EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation

    提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播

    arXiv
    2608.25776
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7

    Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。

    Paper analysisRead analysis
  8. AttacksarXiv 2608.09577

    ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门

    提出 ElasticBack，在单个 Agent 技能中植入条件后门

    arXiv
    2608.09577
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GLM-5.2, MiniMax-M3, GPT-5.4 and others4
    AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。

    ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。

    Paper analysisRead analysis
  9. AttacksarXiv 2608.06862

    SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

    提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链

    arXiv
    2608.06862
    Published
    Layer
    Application layer
    Setting
    Browser and computer use, coding agent
    Evaluated models
    Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B

    Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。

    Paper analysisRead analysis
  10. AttacksarXiv 2604.03890

    From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems

    Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA

    arXiv
    2604.03890
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics, LLM applications
    Evaluated models
    Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4

    Abstract推理层后门传不到执行。

    Paper analysisRead analysis
  11. AttacksarXiv 2512.01335

    EmoRAG 研究揭示 RAG 检索对表情符号扰动的脆弱性

    提出 EmoRAG，向查询与知识库注入同一表情以劫持 RAG 检索

    arXiv
    2512.01335
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    SPECTER, Contriever, Qwen2-7B and others11
    AbstractEmoRAG 用表情联动查询与库文本。

    EmoRAG 测量 RAG 对符号扰动的反应：同一表情同时出现在查询和库文本里时，检索会偏离语义匹配。作者要检查的是，检索是否真由语义相关性决定。

    Paper analysisRead analysis
You have reached the end