Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 11 papers
Filter4

Attack type

Prompt injection7Poisoning and backdoors3

Defense type

Model hardening21Inference-time intervention8Detection and filtering26Instruction–data separation14Permissions and approval11Monitoring and auditing11Watermarking and provenance12

Impact

Unauthorized actions6Output manipulation3

System type

Models and APIs3AI Agent8

Attack surface / entry point

User input18Web pages and interfaces6Documents and messages7Tool responses14Tool and skill descriptions5Images, audio and video1Weights and gradients3Distribution channels5

Layer

Model layer4Application layer7

System component

Monitors6Fine-tuning and open weights3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
Defense type：Monitoring and auditingAttack surface / entry point：Documents and messagesAttack surface / entry point：Images, audio and videoAttack surface / entry point：Weights and gradientsClear all

Another 232papers do not have category tags yet and are not included in filtered results.

  2. DefensesarXiv 2610.09793

    用时序逻辑监控工具 Agent

    提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链

    arXiv
    2610.09793
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    Black-box
    Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。

    这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。

    Paper analysisRead analysis
  3. DefensesarXiv 2610.05163

    Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

    提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入

    arXiv
    2610.05163
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
    Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。

    本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。

    Paper analysisRead analysis
  5. DefensesarXiv 2609.39548

    NDDL：用正常扩散动力学为文生图模型做后门防御

    提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token

    arXiv
    2609.39548
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
    AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。

    NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。

    Paper analysisRead analysis
  7. DefensesarXiv 2608.05578

    AMS 工具通过激活分析检测语言模型的安全训练改动

    提出 AMS，用激活分离与方向相似度检测安全训练改动

    arXiv
    2608.05578
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
    AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。

    AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。

    Paper analysisRead analysis
  9. DefensesarXiv 2605.17380

    Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months

    提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP

    arXiv
    2605.17380
    Published
    Layer
    Application layer
    Setting
    coding agent

    Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。

    Paper analysisRead analysis
  10. DefensesarXiv 2602.20708

    ICON：基于推理时纠正的 Agent 间接提示注入防御

    Proposes inference-time defense ICON, which detects attention over-focusing and redirects to correct indirect prompt injection in agents.

    arXiv
    2602.20708
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen-3-8B, Llama-3.1-8B, Mistral-8B and others6
    AbstractICON detects over-focusing and redirects at inference time to balance IPI safety and task utility.

    ICON detects attention over-focusing from IPI at inference time and redirects, avoiding refusal that would terminate the agent trajectory.

    Paper analysisRead analysis
  11. DefensesarXiv 2602.03085

    Triggers in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers

    提出推理扫描器，在仅有模型文件时检测后门并重构触发词

    arXiv
    2602.03085
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    gemma-3-270m-it, DeepSeek-R1-Distill-Qwen-1.5B, Phi-4-mini-instruct and others8
    Abstract用记忆泄漏和内部信号重构触发词。

    这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。

    Paper analysisRead analysis
You have reached the end