Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 11 papers
Filter4

Attack type

Poisoning and backdoors11

Defense type

Model hardening21Inference-time intervention3Detection and filtering7Monitoring and auditing1

Impact

Output manipulation10

System type

Models and APIs11

Attack surface / entry point

User input75Web pages and interfaces13Documents and messages15Tool responses28Tool and skill descriptions13Code repositories and dependencies3Retrieval corpus5Memory writes4Inter-agent messages3Images, audio and video20Training data11Weights and gradients7Distribution channels11

Layer

Model layer3Training and data layer7
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Defense type：Inference-time interventionDefense type：Detection and filteringDefense type：Monitoring and auditingAttack surface / entry point：Training dataClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  1. Analysis and theoryarXiv 2610.13051

    Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

    Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining

    arXiv
    2610.13051
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-32
    AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.

    The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.

    Paper analysisRead analysis
  3. DefensesarXiv 2609.34804

    物理认证联邦学习：为关键水务基础设施的协同异常检测提供安全保障

    为协同异常检测提出物理准入门，在聚合前拦截不合规训练批次

    arXiv
    2609.34804
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    deep reconstruction autoencoder
    Abstract物理准入为联邦检测增加数据约束，但合规证明不等于无投毒或训练来源证明。

    这是一项面向水基础设施联邦异常检测的物理准入防御研究。 作者针对隐藏训练遥测带来的投毒检查问题，结合不变量挖掘、聚合前过滤和零知识抽样证明。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.27124

    Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习

    提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复

    arXiv
    2609.27124
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    CNN（MNIST：2 Conv + 3 FC）, CNN（Fashion-MNIST：6 Conv + 1 FC）, ResNet18（CIFAR-10）
    AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。

    Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。

    Paper analysisRead analysis
  5. DefensesarXiv 2609.07063

    VERITAS：抗投毒的本地差分隐私图学习协议

    提出 VERITAS，用双边背书剪除本地隐私图学习中的投毒节点

    arXiv
    2609.07063
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    GCN, GraphSAGE, GAT
    AbstractVERITAS 用分级信任的双边背书剪除 LDP 图学习中的投毒节点，并恢复分类准确率。

    VERITAS 是面向本地差分隐私图学习的投毒防御协议，按 trust-but-verify 在保持 ϵ-LDP 的同时剪除伪造节点。

    Paper analysisRead analysis
  6. DefensesarXiv 2609.06346

    面向后门攻击下持续学习的鲁棒动态扩展：净化与选择性恢复

    提出持续学习下的净化与选择性恢复框架，抵御逐任务训练投毒后门

    arXiv
    2609.06346
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ViT-B/16
    Abstract作者报告任务内净化与恢复可配合动态专家防御后门，但保证依赖分离条件。

    这是一项面向持续图像分类的后门防御研究：模型只使用当前任务数据，同时需要保留过去知识并避免学习恶意监督。

    Paper analysisRead analysis
  9. DefensesarXiv 2609.00786

    MROP：针对 Deep JSCC 后门攻击的掩码区域优化净化方法

    提出 MROP，在发射端推理时纯化输入以抵御训练投毒后门

    arXiv
    2609.00786
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    DeepJSCC, SwinJSCC
    AbstractMROP 不重训练，在发射端纯化补丁后门。

    MROP 是 deep JSCC 无线图像传输上的推理时输入纯化，对象是矩形补丁后门。

    Paper analysisRead analysis
  10. DefensesarXiv 2603.03206

    Understanding and mitigating dataset contamination in large language model steering

    Mitigating steering dataset contamination with Lee-Valiant robust means

    arXiv
    2603.03206
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.2-3B-Instruct, Mistral-7b-Instruct-v0.3, OLMo-2-1124-7B-Instruct
    AbstractData poisoning can alter steering; coordinated injection is strongest.

    The authors study how much behavioral control remains at inference time when contrastive steering's training data is contaminated, and whether the robust mean can catch it.

    Paper analysisRead analysis
  11. DefensesarXiv 2602.03085

    Triggers in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers

    提出推理扫描器，在仅有模型文件时检测后门并重构触发词

    arXiv
    2602.03085
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    gemma-3-270m-it, DeepSeek-R1-Distill-Qwen-1.5B, Phi-4-mini-instruct and others8
    Abstract用记忆泄漏和内部信号重构触发词。

    这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。

    Paper analysisRead analysis
You have reached the end