Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 7 papers
Filter4

Attack type

Prompt injection3Poisoning and backdoors5

Impact

Output manipulation4

System type

Models and APIs68LLM applications7AI Agent139coding agent12web agent4Browser and computer use3Multi-agent systems12Embodied systems and robotics4

Attack surface / entry point

User input31Web pages and interfaces7Documents and messages18Tool responses3Retrieval corpus24Memory writes1Images, audio and video7Training data3Inference services and hardware3

Layer

Application layer4Training and data layer3

System component

Guardrails and judges3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
System type：LLM applicationsAttack surface / entry point：Tool responsesAttack surface / entry point：Memory writesAttack surface / entry point：Training dataClear all

Another 232papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12292

    The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

    Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations

    arXiv
    2610.12292
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    LAYA-TD, LAYA-EN, LAYA-ML and others5

    AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.

    Paper analysisRead analysis
  3. Analysis and theoryarXiv 2609.23215

    研究审计 Active Inference Agent 的 LLM 解释器失败模式

    审计 Active Inference Agent 上 LLM 解释器的监督叙述失败

    arXiv
    2609.23215
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, Claude-3-Opus, Gemini
    Abstract三组触发下解释流畅但错误，所提缓解都未被评估。

    作者审计的是挂在智能体上的运行时解释器，而不是智能体本身。操作员读到的是信念与动作的自然语言叙述。作者要问哪些可复现触发会让这段叙述失败，以及失败痕迹是什么样。

    Paper analysisRead analysis
  5. AttacksarXiv 2604.03890

    From prompts to physical actions: structured backdoor attacks against LLM-mediated robot control systems

    Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA

    arXiv
    2604.03890
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics, LLM applications
    Evaluated models
    Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4

    Abstract推理层后门传不到执行。

    Paper analysisRead analysis
You have reached the end