Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 20 papers
Filter4

Attack type

Jailbreaks3Prompt injection3Poisoning and backdoors3Detection evasion3

Impact

Harmful content3Output manipulation9

System type

Models and APIs450LLM applications8AI Agent39coding agent12Embodied systems and robotics20

Attacker access

Black-box3

Attack surface / entry point

User input7Training data3

Layer

Prompt layer11Model layer11Application layer244Training and data layer9Infrastructure layer3

System component

Guardrails and judges8
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
System type：LLM applicationsSystem type：coding agentLayer：Prompt layerLayer：Training and data layerClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. OtherarXiv 2610.11959

    MiMo-V2.6: Toward Self-Improvement via Scaled Reinforcement Learning

    Extending reinforcement learning for full-modality foundation models to support agent self-improvement

    arXiv
    2610.11959
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    MiMo-V2.6-Pro, MiMo-V2.6-Flash, MiMo-V2.6-Distill-Qwen-9B
    AbstractThe series uses three-dimensional RL and group scoring to improve agent scores; the authors claim the final performance is comparable to frontier models.

    MiMo-V2.6 is an all-modality MoE technical report, pursuing agent self-improvement by scaling up RL computation, environments, and scoring.

    Paper analysisRead analysis
  4. AttacksarXiv 2610.05793

    研究者训练出按多智能体拓扑触发的代码后门模型

    提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞

    arXiv
    2610.05793
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct

    Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。

    Paper analysisRead analysis
  6. Risky behaviorarXiv 2610.03458

    Paper: Low monitoring readings do not prove behavior is under control

    检验低监控读数能否证明代码生成中的奖励作弊已受控

    arXiv
    2610.03458
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Llama-3.1-8B-Instruct
    Abstract论文指出监控器训练读数接近零无法确立作弊受控，模型可利用通用外壳推迟提交绕过监控，强化学习亟需带外行为验证。

    本文是一篇针对强化学习可验证奖励后训练（RLVR）中监控器有效性与奖励作弊行为的实证分析研究。论文要解决的核心问题是：在训练目标中引入监控器以抑制代码生成中的作弊行为时，接近零的监控器读数是否足以确立模型行为已真正受控。

    Paper analysisRead analysis
  7. DefensesarXiv 2610.00850

    AuraForge：为训练安全编码 Agent 扩展安全监督

    提出 AuraForge，从漏洞修复合成安全测试并训练编码 Agent

    arXiv
    2610.00850
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen3.5-4B, GLM 4.7 Flash, Qwen3-Coder-Next and others7
    AbstractAuraForge 用攻击效果测试和防泄露环境做成 AuraGym，合成监督的误拒更低，训出的 4B 模型增益高于人工测试。

    AuraForge 把真实仓库的历史漏洞修复变成可执行训练任务，用来监督编程智能体同时满足功能请求和隐含的安全要求。

    Paper analysisRead analysis
  8. Evaluation and benchmarksarXiv 2609.37863

    MIST 压力测试：无关图像会扰动 VLM 评判者标签

    提出 MIST 压力测试，检验无关图像是否扰动 VLM 评判者标签

    arXiv
    2609.37863
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Evaluated models
    GPT-5.2, Gemini 3.1 Flash-Lite, Gemini 3.5 Flash and others13
    Abstract有图就改标签，图的内容却不告知 judge，裁决绑定配置。

    作者用MIST问：VLM 代替人类标注时，可替代性裁决会不会被指南要求忽略的图像改写。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2609.33401

    论文评估 System One 模型在 Agent 安全决策中的可靠性、校准与选择性自动化

    评测 System One 模型对 Agent 安全输入的分类可靠性与校准

    arXiv
    2609.33401
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Evaluated models
    Jev 1.13, Laya, English checkpoint, Decider, approximately 2B and others4
    Abstract离线评测表明，安全判定的总体分数和校准不能代替分组误差和带预算的自动决策检查。

    Liu 离线评测 System One 模型能否为智能体安全输入给出可自动化的概率决策。问题是分类是否可靠，以及概率能否在指定漏检和误拦上限内支持放行、拦截或复核。

    Paper analysisRead analysis
  10. Evaluation and benchmarksarXiv 2609.09798

    CS-Guard：首个面向代码生成安全的 LLM 护栏评测基准

    提出 CS-Guard 基准，评测代码生成护栏对虚构场景攻击的防御

    arXiv
    2609.09798
    Published
    Layer
    Prompt layer
    Setting
    coding agent
    Attacker
    Black-box
    Evaluated models
    CodeLlama-13B-Instruct, DeepSeekCoder-V2-Lite-16B, GPT-OSS-20B and others7

    Abstract论文提出了代码安全护栏基准 CS-Guard，评估发现现有护栏对虚构场景攻击和代码级恶意请求防御较弱。

    Paper analysisRead analysis
  12. AttacksarXiv 2609.01023

    Akrasia：针对推理型代码 LLM 的隐蔽后门攻击

    提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链

    arXiv
    2609.01023
    Published
    Layer
    Prompt layer
    Setting
    coding agent
    Evaluated models
    Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7

    Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。

    Paper analysisRead analysis
  13. OtherarXiv 2607.28568

    Frontis-MA1：面向机器学习工程递归自我改进的 AI4AI 模型

    提出 OpenMLE，后训练元进化智能体并做机器学习工程长程搜索

    arXiv
    2607.28568
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Frontis-MA1-35B, Frontis-MA1-30B
    AbstractOpenMLE 训练 Frontis-MA1-35B，用四个共享算子把 MLE 后训练和长程搜索接成元进化闭环。

    作者提出全栈 OpenMLE，在机器学习工程里研究从进化到元进化的一步，并把递归自我改进视为更远目标。智能体要在延迟、有噪声的执行反馈下反复修改程序。作者认为公开系统很少同时提供可扩展环境、基于执行的后训练，以及部署该模型的长程进化搜索。

    Paper analysisRead analysis
  14. AttacksarXiv 2606.09700

    The researchers propose the HPAA attack: bypassing 13 content moderation systems with typographic visual cues

    提出 HPAA 攻击，用排版视觉线索绕过内容审核系统

    arXiv
    2606.09700
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    Llama-Guard-3-8B, Perspective API, ShieldGemma-2B and others13
    Abstract揭示了排版视觉线索与分词差异带来的审核盲区，HPAA 以极低查询实现近乎完全规避。

    这篇论文研究了人类视觉感知与大模型分词处理机制之间的差异所导致的内容审核漏洞。

    Paper analysisRead analysis
  15. AttacksarXiv 2605.26156

    BITE：用上下文赌博机操纵风格偏置攻击 LLM 评委

    提出 BITE，用上下文赌博机选择风格修改抬高 LLM 评委打分

    arXiv
    2605.26156
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    o3-mini, Gemini-2.5-Flash, Llama-3.3-70B-Instruct and others8
    AbstractBITE 用黑盒赌博机利用风格偏差抬分，作者称这对 LLM-as-a-judge 构成威胁。

    BITE 是黑盒风格操纵：在保持答案语义的同时，抬高 LLM 评审给出的分数。

    Paper analysisRead analysis
  16. AttacksarXiv 2604.03890

    From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems

    Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA

    arXiv
    2604.03890
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics, LLM applications
    Evaluated models
    Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4

    Abstract推理层后门传不到执行。

    Paper analysisRead analysis
  17. DefensesarXiv 2601.19051

    Proactively hardening LLM defenses with HASTE

    提出 HASTE，挖掘 hard negative 再训练恶意提示检测器

    arXiv
    2601.19051
    Published
    Layer
    Prompt layer
    Setting
    LLM applications
    Evaluated models
    protectai/deberta-v3-base-prompt-injection
    AbstractHASTE 用 hard negative 再训练检测器。

    HASTE 是检测器侧的闭环硬化框架：持续构造能绕过当前检测的对抗提示，再用来更新恶意提示分类器。

    Paper analysisRead analysis
You have reached the end