All papers

The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.

A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。

PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。

CRCP 研究的是带分块和重排的 RAG 语料投毒，而不是只提高文档级检索分数。

SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。

The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.

The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

WebWeaver is an inference attack against the confidentiality of LLM-MAS communication topology: it controls only one arbitrary agent and recovers the full graph from dialogue context, rather than querying agent IDs.

Thought Virus puts subliminal prompting into multi-agent communication, to see whether a single-point deviation spreads across the network without naming the target concept.

DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。

这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。