Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 21 papers
Filter5

Attack type

Prompt injection11Poisoning and backdoors12

Attack technique

Gradient and representation optimization7Automated search23Encoding and obfuscation13Role-play and persuasion8Conversation structure manipulation3Cross-modal payloads6Defense-targeted8Dormant triggers12Selection manipulation4

Impact

Unauthorized actions5Data and privacy leaks4Output manipulation12

System type

Models and APIs53LLM applications11AI Agent43coding agent10Multi-agent systems3Embodied systems and robotics4

Attack surface / entry point

User input6Documents and messages5Tool and skill descriptions3Code repositories and dependencies5Retrieval corpus3Memory writes3Weights and gradients4Distribution channels5

Layer

Application layer19

System component

MCP and skills4Memory4Guardrails and judges4Fine-tuning and open weights4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Attack technique：Role-play and persuasionAttack technique：Conversation structure manipulationAttack technique：Dormant triggersSystem type：LLM applicationsSystem type：coding agentClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.05793

    研究者训练出按多智能体拓扑触发的代码后门模型

    提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞

    arXiv
    2610.05793
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct

    Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.04985

    研究揭示 Jev 作为应用决策层的安全与隐私风险

    评估应用决策层的输入注入与隐私推断风险

    arXiv
    2610.04985
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box, Gray-box
    Evaluated models
    Jev, NanoJev
    AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。

    Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.19722

    ALIBI：向二进制注入虚假安全叙事可让 LLM 恶意软件分析器误判

    提出 ALIBI，向恶意二进制注入不执行掩护叙事使分析器误判为良性

    arXiv
    2609.19722
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    Gemini 2.5 Pro, GPT-5.5 Pro, Claude Opus 4.7
    AbstractALIBI 用二进制内的掩护叙事重释可疑静态证据，Gemini 上翻转多，另两模型主要为降级。

    ALIBI 是针对 LLM 恶意软件分诊的语义掩护叙事攻击：不覆盖系统指令，而把仍可见的可疑静态证据重释成良性安全产品的预期行为。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.02774

    CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

    提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞

    arXiv
    2609.02774
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B

    AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。

    Paper analysisRead analysis
  8. AttacksarXiv 2608.25776

    EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation

    提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播

    arXiv
    2608.25776
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7

    Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。

    Paper analysisRead analysis
  10. AttacksarXiv 2608.09577

    ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门

    提出 ElasticBack，在单个 Agent 技能中植入条件后门

    arXiv
    2608.09577
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GLM-5.2, MiniMax-M3, GPT-5.4 and others4
    AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。

    ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。

    Paper analysisRead analysis
  11. AttacksarXiv 2608.06862

    SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

    提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链

    arXiv
    2608.06862
    Published
    Layer
    Application layer
    Setting
    Browser and computer use, coding agent
    Evaluated models
    Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B

    Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。

    Paper analysisRead analysis
  12. AttacksarXiv 2607.14493

    LogInject 框架披露 LLM 日志分析中的被动提示注入

    提出 LogInject 框架，评测日志分析中的被动提示注入及缓解

    arXiv
    2607.14493
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct

    Abstract论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。

    Paper analysisRead analysis
  13. AttacksarXiv 2605.24421

    研究者提出日志型提示注入攻击，可抑制 SOC 中 LLM 分析助手的恶意日志识别

    提出日志基底提示注入，操纵 SOC 分析员的分类、摘要与处置建议

    arXiv
    2605.24421
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    gpt-4o-mini

    Abstract在 gpt-4o-mini 上，人格劫持与上下文操纵可改写 SOC 分析输出，直接覆盖在分类上无效。

    Paper analysisRead analysis
  14. AttacksarXiv 2604.03890

    From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems

    Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA

    arXiv
    2604.03890
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics, LLM applications
    Evaluated models
    Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4

    Abstract推理层后门传不到执行。

    Paper analysisRead analysis
  17. AttacksarXiv 2601.21360

    Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation

    提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分

    arXiv
    2601.21360
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    DeepSeek-V3.2, Qwen3-235B, GPT-OSS-120B and others9
    Abstract作者称 RLHF 的服从性使评分脱离代码。

    这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。

    Paper analysisRead analysis
  19. AttacksarXiv 2512.01335

    EmoRAG 研究揭示 RAG 检索对表情符号扰动的脆弱性

    提出 EmoRAG，向查询与知识库注入同一表情以劫持 RAG 检索

    arXiv
    2512.01335
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    SPECTER, Contriever, Qwen2-7B and others11
    AbstractEmoRAG 用表情联动查询与库文本。

    EmoRAG 测量 RAG 对符号扰动的反应：同一表情同时出现在查询和库文本里时，检索会偏离语义匹配。作者要检查的是，检索是否真由语义相关性决定。

    Paper analysisRead analysis
  20. AttacksarXiv 2509.22040

    研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入

    通过规则文件提示注入劫持编码编辑器并执行未授权终端命令

    arXiv
    2509.22040
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Cursor, GitHub Copilot, Claude 4 Sonnet and others4

    Abstract论文提出了针对代码编辑器的提示注入评估框架 AIShellJack，实验显示攻击能诱导 AI 执行未授权终端命令。

    Paper analysisRead analysis
Load more