DefensesarXiv 2610.09935
AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击
提出 AgentTracer，事后定位间接提示注入的注入点并重建攻击链
- arXiv
- 2610.09935
- Published
- Layer
- Application layer
- Setting
- AI Agent
- DefensesMonitoring and auditing
- AttacksPrompt injection
All papers
Filter4
Attack type
Defense type
Impact
System type
Attack surface / entry point
Layer
System component
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Another 233papers do not have category tags yet and are not included in filtered results.
- DefensesarXiv 2610.09793
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
- arXiv
- 2610.09793
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Attacker
- Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
- DefensesarXiv 2610.05163
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
- arXiv
- 2610.05163
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
- DefensesarXiv 2609.39548
NDDL：用正常扩散动力学为文生图模型做后门防御
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
- arXiv
- 2609.39548
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentImage generation
AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。
NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
- DefensesarXiv 2609.14987
ActGuard：面向 LLM Agent 间接提示注入的执行前动作审计框架
提出 ActGuard 执行前动作审计，定位并遮盖间接提示注入的恶意片段
- arXiv
- 2609.14987
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- GPT-4o-mini, Gemini-2.5-Flash, DeepSeek-V4-Flash
- DefensesMonitoring and auditing
- AttacksPrompt injection
- DefensesarXiv 2608.21101
ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
- arXiv
- 2608.21101
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Codex/GPT-5.4, Codex/GPT-5.5, Claude Code/GLM-5.1 and others6
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
AbstractClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。
ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
- DefensesarXiv 2608.05578
AMS 工具通过激活分析检测语言模型的安全训练改动
提出 AMS，用激活分离与方向相似度检测安全训练改动
- arXiv
- 2608.05578
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
- DefensesMonitoring and auditing
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。
AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
- DefensesarXiv 2607.25297
MTGuard: Hybrid Analysis for Secure MCP Tool Calls in LLM Agents
Proposes MTGuard, which blocks unsafe tool calls by comparing MCP call declarations with execution traces.
- arXiv
- 2607.25297
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- DeepSeek-V4-Flash, DeepSeek-V4-Pro, GPT-5.6 Luna
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
- DefensesarXiv 2607.19913
Janus：面向长时程智能体安全的前瞻性潜在风险预测框架
提出 Janus 前瞻守卫，在长程智能体执行有害动作前拦截潜在风险
- arXiv
- 2607.19913
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Vanguard
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
- DefensesarXiv 2605.17380
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
- arXiv
- 2605.17380
- Published
- Layer
- Application layer
- Setting
- coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
- DefensesarXiv 2602.20708
ICON：基于推理时纠正的 Agent 间接提示注入防御
提出推理时防御 ICON，探测注意力过聚焦并转向以纠正 Agent 间接提示注入
- arXiv
- 2602.20708
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Qwen-3-8B, Llama-3.1-8B, Mistral-8B and others6
- DefensesInference-time intervention
- AttacksPrompt injection
- ComponentMonitors
AbstractICON 在推理时检测过聚焦并转向，以兼顾 IPI 安全与任务效用。
ICON 在推理时检测 IPI 的注意力过聚焦并转向，避免以拒答中止智能体轨迹。
- DefensesarXiv 2602.03085
Triggers in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
提出推理扫描器，在仅有模型文件时检测后门并重构触发词
- arXiv
- 2602.03085
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- gemma-3-270m-it, DeepSeek-R1-Distill-Qwen-1.5B, Phi-4-mini-instruct and others8
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract用记忆泄漏和内部信号重构触发词。
这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。
- DefensesarXiv 2601.05755
VIGIL: defending LLM agents against tool-flow injection with "verify before submit"
提出 VIGIL 先验证后提交，防御 Agent 工具流注入
- arXiv
- 2601.05755
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Qwen3-max, Gemini-2.5-pro
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentMonitors
AbstractVIGIL 用意图约束下的提交前验证处理工具流注入。
VIGIL 用 verify-before-commit 处理智能体的工具流注入，并配有基准 SIREN。
You have reached the end