Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 75 papers
Filter4

Attack type

Jailbreaks6Prompt injection27Poisoning and backdoors34Extraction and theft6Detection evasion11

Attack technique

Gradient and representation optimization8Automated search24Encoding and obfuscation12Role-play and persuasion8Conversation structure manipulation3Cross-modal payloads6Defense-targeted8Dormant triggers9Selection manipulation4

Defense type

Detection and filtering4

Impact

Harmful content4Unauthorized actions19Data and privacy leaks12Output manipulation37Availability and reliability3

System type

LLM applications43AI Agent125coding agent29web agent9Multi-agent systems11Embodied systems and robotics3

Attacker access

Black-box14Gray-box3

Attack surface / entry point

User input26Documents and messages12Tool responses3Tool and skill descriptions15Code repositories and dependencies10Retrieval corpus18Images, audio and video6Distribution channels16

Layer

Prompt layer10Application layer75Training and data layer7

System component

MCP and skills16Memory3RAG22Guardrails and judges13Vision6Embeddings7Multimodal7
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.
System type：LLM applicationsSystem type：coding agentSystem type：Embodied systems and roboticsLayer：Application layerClear all

Another 227papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12292

    The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

    Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations

    arXiv
    2610.12292
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    LAYA-TD, LAYA-EN, LAYA-ML and others5

    AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.

    Paper analysisRead analysis
  2. AttacksarXiv 2610.11932

    A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

    Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.

    arXiv
    2610.11932
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Grok, Doubao, ChatGPT and others10

    AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.

    Paper analysisRead analysis
  5. AttacksarXiv 2610.10612

    PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

    提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器

    arXiv
    2610.10612
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    CISCO, HSS, AUDITOR and others8
    Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。

    这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.09264

    研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击

    提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包

    arXiv
    2610.09264
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-7B, Qwen3-Coder-30B, Devstral-Small-2-24B and others19
    AbstractPackHallu 诱导规则文件换包。

    PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。

    Paper analysisRead analysis
  8. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  9. AttacksarXiv 2610.04985

    研究揭示 Jev 作为应用决策层的安全与隐私风险

    评估应用决策层的输入注入与隐私推断风险

    arXiv
    2610.04985
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box, Gray-box
    Evaluated models
    Jev, NanoJev
    AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。

    Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。

    Paper analysisRead analysis
  11. AttacksarXiv 2610.02432

    论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

    提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感

    arXiv
    2610.02432
    Published
    Layer
    Application layer
    Setting
    LLM applications, AI Agent
    Attacker
    Black-box
    Evaluated models
    Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
    Paper analysisRead analysis
  14. AttacksarXiv 2610.01768

    LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄

    提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传

    arXiv
    2610.01768
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
    Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。

    LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.39352

    研究者提出解耦铺垫与执行的 LLM Agent 技能投毒攻击

    提出 CoordPoison，解耦技能投毒的借口与动作

    arXiv
    2609.39352
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, GLM-5.3-Flash, Claude-Sonnet-4.6 and others5
    AbstractCoordPoison 外置借口。

    CoordPoison 是一种 Skill 供应链投毒方法，把“为何执行”和“执行什么”拆到两个 Skill。。

    Paper analysisRead analysis
  17. AttacksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
Load more