Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 15 papers

Another 240papers do not have category tags yet and are not included in filtered results.

  1. Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

    Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining

    Published
    Evaluated models
    ResNet-32
    AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.

    The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.07657

    DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

    实现 DEFER,以确定性检查优先拦截多智能体流水线的内容攻击

    Published
    Evaluated models
    Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
    AbstractDEFER 把确定性检查放在 judge 之前。

    DEFER 用来测量多智能体授权流水线里,确定性规则在何处结束、LLM judge 从何处开始。

    Paper analysisRead analysis
  3. DefensesarXiv 2609.34804

    物理认证联邦学习:为关键水务基础设施的协同异常检测提供安全保障

    为协同异常检测提出物理准入门,在聚合前拦截不合规训练批次

    Published
    Evaluated models
    deep reconstruction autoencoder
    Abstract物理准入为联邦检测增加数据约束,但合规证明不等于无投毒或训练来源证明。

    这是一项面向水基础设施联邦异常检测的物理准入防御研究。 作者针对隐藏训练遥测带来的投毒检查问题,结合不变量挖掘、聚合前过滤和零知识抽样证明。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.27124

    Fed-ADR:用恶意编排服务器协同客户端梯度操纵攻击联邦学习

    提出 Fed-ADR,用编排服务器协同操纵梯度攻破联邦学习并检测恢复

    Published
    Attacker
    Gray-box
    Evaluated models
    CNN(MNIST:2 Conv + 3 FC), CNN(Fashion-MNIST:6 Conv + 1 FC), ResNet18(CIFAR-10)
    AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御,再用 Hessian 一致性检测和窗口内恢复把准确率拉回。

    Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架:编排服务器改写合谋客户端的梯度,使参数服务器的现有防御把投毒更新当成良性,同时在发现后用历史梯度把全局模型原地修回来。

    Paper analysisRead analysis
  5. DefensesarXiv 2609.07063

    VERITAS:抗投毒的本地差分隐私图学习协议

    提出 VERITAS,用双边背书剪除本地隐私图学习中的投毒节点

    Published
    Evaluated models
    GCN, GraphSAGE, GAT
    AbstractVERITAS 用分级信任的双边背书剪除 LDP 图学习中的投毒节点,并恢复分类准确率。

    VERITAS 是面向本地差分隐私图学习的投毒防御协议,按 trust-but-verify 在保持 ϵ-LDP 的同时剪除伪造节点。

    Paper analysisRead analysis
  6. DefensesarXiv 2609.06346

    面向后门攻击下持续学习的鲁棒动态扩展:净化与选择性恢复

    提出持续学习下的净化与选择性恢复框架,抵御逐任务训练投毒后门

    Published
    Evaluated models
    ViT-B/16
    Abstract作者报告任务内净化与恢复可配合动态专家防御后门,但保证依赖分离条件。

    这是一项面向持续图像分类的后门防御研究:模型只使用当前任务数据,同时需要保留过去知识并避免学习恶意监督。

    Paper analysisRead analysis
  7. DefensesarXiv 2609.29647

    AgentKernel:面向 Agent 的可信原生操作系统内核

    提出 AgentKernel,用四支柱强制中介 Agent 的输入、工具与记忆

    Published
    Setting
    AI Agent
    AbstractAgentKernel 是四支柱智能体 OS 设计,安全论证未附带实测数字。

    AgentKernel 是把安全做成组织原则的智能体 OS 架构,不是带跑分的攻防评测。

    Paper analysisRead analysis
  8. DefensesarXiv 2606.24322

    Protecting LLM agent long-term memory from poisoning: tamper-evident, source-bound permissions and machine-checkable guarantees

    提出 TMA-NM,以写时来源绑定抵御 Agent 长期记忆投毒

    Published
    Setting
    AI Agent
    Evaluated models
    gpt-5-chat, gpt-4o-mini, claude-opus-4.1 and others8
    AbstractTMA-NM 用来源绑定的行动权限挡住记忆洗白。

    TMA-NM 把 LLM 智能体长期记忆的行动权限绑到写时来源,用来挡住跨会话记忆投毒。

    Paper analysisRead analysis
  9. DefensesarXiv 2603.11619

    Taming OpenClaw: Security Analysis and Mitigation of Threats in Autonomous LLM Agents

    Proposes a defense-in-depth aligned with the five stages to mitigate cross-stage threats to autonomous agents

    Published
    Setting
    AI Agent
    AbstractThis is a lifecycle threat analysis and layered mitigation design for OpenClaw, with the cases serving as qualitative evidence.

    This is a lifecycle threat analysis of OpenClaw, accompanied by a set of layered mitigation designs. The problem addressed is: when autonomous agents connect instant messaging, persistent memory, third-party plugins, and high-privilege execution, attacks are no longer limited to single-turn jailbreaks but can compound across multiple stages from initialization to execution. The authors argue that defenses hardening only individual interfaces cannot stop such cross-temporal attacks.

    Paper analysisRead analysis
You have reached the end