DefensesarXiv 2610.09935
AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击
提出 AgentTracer，事后定位间接提示注入的注入点并重建攻击链
- arXiv
- 2610.09935
- Published
- Layer
- Application layer
- Setting
- AI Agent
- DefensesMonitoring and auditing
- AttacksPrompt injection
All papers
Filter4
Attack type
Defense type
Impact
System type
Attack surface / entry point
Layer
System component
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.
Another 255papers do not have category tags yet and are not included in filtered results.
- DefensesarXiv 2610.09793
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
- arXiv
- 2610.09793
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Attacker
- Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
- DefensesarXiv 2610.05163
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
- arXiv
- 2610.05163
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
- DefensesarXiv 2609.14987
ActGuard：面向 LLM Agent 间接提示注入的执行前动作审计框架
提出 ActGuard 执行前动作审计，定位并遮盖间接提示注入的恶意片段
- arXiv
- 2609.14987
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- GPT-4o-mini, Gemini-2.5-Flash, DeepSeek-V4-Flash
- DefensesMonitoring and auditing
- AttacksPrompt injection
- DefensesarXiv 2609.03139
TRIM：面向多种后门触发器的黑盒检测与净化方法
提出 TRIM，在黑盒推理时定位并净化图像后门区域
- arXiv
- 2609.03139
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- ResNet-50
- DefensesInference-time intervention
- AttacksPoisoning and backdoors
- ComponentVision
- DefensesarXiv 2609.00786
MROP：针对 Deep JSCC 后门攻击的掩码区域优化净化方法
提出 MROP，在发射端推理时纯化输入以抵御训练投毒后门
- arXiv
- 2609.00786
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- DeepJSCC, SwinJSCC
- DefensesInference-time intervention
- AttacksPoisoning and backdoors
AbstractMROP 不重训练，在发射端纯化补丁后门。
MROP 是 deep JSCC 无线图像传输上的推理时输入纯化，对象是矩形补丁后门。
- DefensesarXiv 2607.19913
Janus：面向长时程智能体安全的前瞻性潜在风险预测框架
提出 Janus 前瞻守卫，在长程智能体执行有害动作前拦截潜在风险
- arXiv
- 2607.19913
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Vanguard
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
- DefensesarXiv 2605.17380
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
- arXiv
- 2605.17380
- Published
- Layer
- Application layer
- Setting
- coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
- DefensesarXiv 2603.03206
理解并缓解大语言模型引导中的数据集污染
用 Lee-Valiant 稳健均值缓解 steering 数据集污染
- arXiv
- 2603.03206
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Llama-3.2-3B-Instruct, Mistral-7b-Instruct-v0.3, OLMo-2-1124-7B-Instruct
- DefensesInference-time intervention
- AttacksPoisoning and backdoors
Abstract数据污染会改 steering，协调注入最强。
作者研究 contrastive steering 的训练数据被污染后，推理时的行为控制还剩多少，以及稳健均值能否接住。
- DefensesarXiv 2602.20708
ICON：基于推理时纠正的 Agent 间接提示注入防御
提出推理时防御 ICON，探测注意力过聚焦并转向以纠正 Agent 间接提示注入
- arXiv
- 2602.20708
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Qwen-3-8B, Llama-3.1-8B, Mistral-8B and others6
- DefensesInference-time intervention
- AttacksPrompt injection
- ComponentMonitors
AbstractICON 在推理时检测过聚焦并转向，以兼顾 IPI 安全与任务效用。
ICON 在推理时检测 IPI 的注意力过聚焦并转向，避免以拒答中止智能体轨迹。
- DefensesarXiv 2602.03085
Triggers in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
提出推理扫描器，在仅有模型文件时检测后门并重构触发词
- arXiv
- 2602.03085
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- gemma-3-270m-it, DeepSeek-R1-Distill-Qwen-1.5B, Phi-4-mini-instruct and others8
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract用记忆泄漏和内部信号重构触发词。
这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。
You have reached the end