Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 60 papers
Filter4

Attack type

Jailbreaks13Prompt injection25Poisoning and backdoors9Extraction and theft9Detection evasion11Malicious use5

Attack technique

Automated search9Encoding and obfuscation3Defense-targeted4Dormant triggers4

Defense type

Inference-time intervention3Detection and filtering11Permissions and approval4Monitoring and auditing3

Impact

Harmful content13Unauthorized actions13Data and privacy leaks12Output manipulation18Oversight failure3

System type

Models and APIs280LLM applications30AI Agent105coding agent20science agent4web agent4Multi-agent systems11Embodied systems and robotics5

Attacker access

Black-box16Gray-box3

Attack surface / entry point

User input60Web pages and interfaces12Documents and messages28Tool responses14Tool and skill descriptions26Code repositories and dependencies22Retrieval corpus27Memory writes10Inter-agent messages25Images, audio and video9Training data6Weights and gradients5Distribution channels24Inference services and hardware4

Layer

Prompt layer7Application layer52

System component

MCP and skills4Memory3RAG12Guardrails and judges20Monitors6Permissions and sandboxing3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
System type：LLM applicationsSystem type：coding agentSystem type：Multi-agent systemsAttack surface / entry point：User inputClear all

Another 254papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12292

    The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

    Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations

    arXiv
    2610.12292
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    LAYA-TD, LAYA-EN, LAYA-ML and others5

    AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.07657

    DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

    实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击

    arXiv
    2610.07657
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
    AbstractDEFER 把确定性检查放在 judge 之前。

    DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。

    Paper analysisRead analysis
  4. DefensesarXiv 2610.07276

    SAFESHIELD：小语言模型部署时安全的决策组织框架

    提出 SAFESHIELD，组织小语言模型部署时的安全决策

    arXiv
    2610.07276
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen3-4B-Instruct
    AbstractSAFESHIELD 用可审计决策轨迹组织 SLM 部署时的四项安全决策，并报告协调依赖影响端到端结果。

    SAFESHIELD 是面向小语言模型的部署时安全框架，把运行时安全从单项审核改写成可检查的决策过程。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.04985

    研究揭示 Jev 作为应用决策层的安全与隐私风险

    评估应用决策层的输入注入与隐私推断风险

    arXiv
    2610.04985
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box, Gray-box
    Evaluated models
    Jev, NanoJev
    AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。

    Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。

    Paper analysisRead analysis
  6. DefensesarXiv 2610.04412

    论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性

    提出检测、结构化与 GSPO 流程，降低共识生成的提示注入错位

    arXiv
    2610.04412
    Published
    Layer
    Application layer
    Setting
    LLM applications, Multi-agent systems
    Evaluated models
    LLaMA-2 7B, LLaMA-3 8B, GPT 3.5 Turbo and others14
    Abstract三章依次做个体偏好预测、政党知识图谱审议，以及共识生成对提示注入的脆弱性与一条防御流程。

    这是一篇把 LLM 数字孪生放进增强民主的博士论文，分个体表示、政党聚合和共识生成的提示注入三章。

    Paper analysisRead analysis
  8. DefensesarXiv 2610.02432

    论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

    提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感

    arXiv
    2610.02432
    Published
    Layer
    Application layer
    Setting
    LLM applications, AI Agent
    Attacker
    Black-box
    Evaluated models
    Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
    Paper analysisRead analysis
  10. AttacksarXiv 2610.01768

    LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄

    提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传

    arXiv
    2610.01768
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
    Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。

    LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。

    Paper analysisRead analysis
  11. Evaluation and benchmarksarXiv 2609.39146

    MADBench：多智能体辩论安全性评测基准发布

    提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响

    arXiv
    2609.39146
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    gpt-4o, GPT-5, GPT-6 Astra
    AbstractMADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。

    MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。

    Paper analysisRead analysis
  12. AttacksarXiv 2609.38270

    VirusCascade：劫持 LLM 推荐智能体的协同反思机制

    提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思

    arXiv
    2609.38270
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    AgentCF, AgentSEQ, AgentRAG and others4
    Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。

    VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。

    Paper analysisRead analysis
  13. DefensesarXiv 2609.36326

    PILLAR：面向增强检索的私有倒排索引词法查找

    提出 PILLAR，用私有词法预筛与客户端重排保护 RAG 查询

    arXiv
    2609.36326
    Published
    Layer
    Application layer
    Setting
    LLM applications
    AbstractPILLAR 用固定模式的私有 BM25 预筛加本地嵌入重排，在两基准上换取延迟或质量。

    PILLAR 是面向公开语料的隐私 RAG：半诚实服务器学不到查询词项和访问模式，客户端仍拿到用于增强生成的 k 篇文档。

    Paper analysisRead analysis
  15. Evaluation and benchmarksarXiv 2609.33401

    论文评估 System One 模型在 Agent 安全决策中的可靠性、校准与选择性自动化

    评测 System One 模型对 Agent 安全输入的分类可靠性与校准

    arXiv
    2609.33401
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Evaluated models
    Jev 1.13, Laya, English checkpoint, Decider, approximately 2B and others4
    Abstract离线评测表明，安全判定的总体分数和校准不能代替分组误差和带预算的自动决策检查。

    Liu 离线评测 System One 模型能否为智能体安全输入给出可自动化的概率决策。问题是分类是否可靠，以及概率能否在指定漏检和误拦上限内支持放行、拦截或复核。

    Paper analysisRead analysis
  16. Evaluation and benchmarksarXiv 2609.33102

    ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架

    提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果

    arXiv
    2609.33102
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5

    AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。

    Paper analysisRead analysis
  17. Evaluation and benchmarksarXiv 2609.32616

    Cave-Bench：虚假指控下 LLM 智能体最高 60.06% 的运行会破坏正确工作

    提出 CAVE-BENCH，评测智能体在虚假指责下破坏已完成的正确工作

    arXiv
    2609.32616
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, Claude-Opus-5, GPT-5.6-Sol and others14

    Abstract论文提出了评估智能体在虚假指责下破坏已有正确成果的 CAVE-BENCH，发现强模型易推翻已知证据，提出了门控缓解方案。

    Paper analysisRead analysis
  18. Risky behaviorarXiv 2609.30266

    研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹

    测试编程智能体被诱导或自主篡改自身执行轨迹的行为

    arXiv
    2609.30266
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
    Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。

    这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。

    Paper analysisRead analysis
  20. Evaluation and benchmarksarXiv 2609.15017

    PIDS-Bench：在过度防御、混淆与分布偏移下评测提示注入检测器

    提出 PIDS-Bench，评测提示注入检测器在过度防御与分布偏移下的表现

    arXiv
    2609.15017
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    TF-IDF + logistic regression, DistilBERT, DeBERTa-v3-FT and others7
    AbstractPIDS-Bench 显示高分布内 F1 仍会过度拦截外部来源的安全相关良性输入。

    PIDS-Bench 是一个冻结的检测器级基准，用来在固定阈值下同时看提示注入检测和良性误报。

    Paper analysisRead analysis
Load more