DefensesarXiv 2610.09935
AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击
提出 AgentTracer，事后定位间接提示注入的注入点并重建攻击链
- arXiv
- 2610.09935
- Published
- Layer
- Application layer
- Setting
- AI Agent
- DefensesMonitoring and auditing
- AttacksPrompt injection
All papers
Filter3
Attack type
Defense type
Impact
System type
Attack surface / entry point
Layer
System component
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Another 265papers do not have category tags yet and are not included in filtered results.
- DefensesarXiv 2610.09793
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
- arXiv
- 2610.09793
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Attacker
- Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
- DefensesarXiv 2610.05163
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
- arXiv
- 2610.05163
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
- DefensesarXiv 2610.00400
DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift
提出 DART，用去噪表征转移检测多轮智能体攻击并注入提醒
- arXiv
- 2610.00400
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Attacker
- Black-box
- Evaluated models
- Qwen3-8B, Qwen3-14B, Qwen3-32B and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
- DefensesarXiv 2609.14987
ActGuard：面向 LLM Agent 间接提示注入的执行前动作审计框架
提出 ActGuard 执行前动作审计，定位并遮盖间接提示注入的恶意片段
- arXiv
- 2609.14987
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- GPT-4o-mini, Gemini-2.5-Flash, DeepSeek-V4-Flash
- DefensesMonitoring and auditing
- AttacksPrompt injection
- DefensesarXiv 2608.02683
S³：用多阶段防御提升 LLM 智能体安全
提出 S³，用 guard agent 编排阶段安全技能防御智能体多阶段风险
- arXiv
- 2608.02683
- Published
- Layer
- Application layer
- Evaluated models
- DeepSeek-V4-Pro, DeepSeek-V4-Flash
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- RiskDangerous agent actions
- ComponentMonitors
- DefensesarXiv 2607.25297
MTGuard：面向 LLM 智能体安全 MCP 工具调用的混合分析
提出 MTGuard，对照 MCP 调用声明与执行痕迹拦截不安全工具调用
- arXiv
- 2607.25297
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- DeepSeek-V4-Flash, DeepSeek-V4-Pro, GPT-5.6 Luna
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
- DefensesarXiv 2607.19913
Janus：面向长时程智能体安全的前瞻性潜在风险预测框架
提出 Janus 前瞻守卫，在长程智能体执行有害动作前拦截潜在风险
- arXiv
- 2607.19913
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Vanguard
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
- DefensesarXiv 2606.22673
Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导
提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向
- arXiv
- 2606.22673
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- LLaMA-3.1-8B, Qwen-2.5-7B, Gemma-2-9B
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentMonitors
Abstract白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。
Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。
- DefensesarXiv 2604.03870
你的 Agent 比你想象的更脆弱：揭示智能体式 LLM 中的间接提示注入漏洞
用表征工程在动作提交前识别智能体间接注入劫持
- arXiv
- 2604.03870
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Qwen-2.5-14B, Qwen-2.5-32B, Qwen-3-4B and others9
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract两款 Qwen 上六种防御 Overall 高于无防御。
作者在 AgentDojo 的银行工具调用环境里，检查间接提示注入是否让开源智能体执行攻击者指定动作，以及表面防御和表征检测各自的数字。
- DefensesarXiv 2602.20708
ICON：基于推理时纠正的 Agent 间接提示注入防御
提出推理时防御 ICON，探测注意力过聚焦并转向以纠正 Agent 间接提示注入
- arXiv
- 2602.20708
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Qwen-3-8B, Llama-3.1-8B, Mistral-8B and others6
- DefensesInference-time intervention
- AttacksPrompt injection
- ComponentMonitors
AbstractICON 在推理时检测过聚焦并转向，以兼顾 IPI 安全与任务效用。
ICON 在推理时检测 IPI 的注意力过聚焦并转向，避免以拒答中止智能体轨迹。
- DefensesarXiv 2601.05755
VIGIL: defending LLM agents against tool-flow injection with "verify before submit"
提出 VIGIL 先验证后提交，防御 Agent 工具流注入
- arXiv
- 2601.05755
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Qwen3-max, Gemini-2.5-pro
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentMonitors
AbstractVIGIL 用意图约束下的提交前验证处理工具流注入。
VIGIL 用 verify-before-commit 处理智能体的工具流注入，并配有基准 SIREN。
You have reached the end