Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 4 papers
Filter3

Attack type

Prompt injection3

System type

Models and APIs5LLM applications4AI Agent132coding agent10web agent4Browser and computer use3Multi-agent systems10

Attack surface / entry point

User input31Web pages and interfaces7Documents and messages18Tool responses3Retrieval corpus24Memory writes1Images, audio and video7Training data3Inference services and hardware3

Layer

Application layer4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
System type：LLM applicationsAttack surface / entry point：Tool responsesAttack surface / entry point：Memory writesClear all

Another 232papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12292

    The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

    Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations

    arXiv
    2610.12292
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    LAYA-TD, LAYA-EN, LAYA-ML and others5

    AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.

    Paper analysisRead analysis
  2. Analysis and theoryarXiv 2609.23215

    研究审计 Active Inference Agent 的 LLM 解释器失败模式

    审计 Active Inference Agent 上 LLM 解释器的监督叙述失败

    arXiv
    2609.23215
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, Claude-3-Opus, Gemini
    Abstract三组触发下解释流畅但错误，所提缓解都未被评估。

    作者审计的是挂在智能体上的运行时解释器，而不是智能体本身。操作员读到的是信念与动作的自然语言叙述。作者要问哪些可复现触发会让这段叙述失败，以及失败痕迹是什么样。

    Paper analysisRead analysis
You have reached the end