Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 15 papers

Filter3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Impact：Data and privacy leaks Attack surface / entry point：Documents and messages Attack surface / entry point：Weights and gradients Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
AttacksarXiv 2610.05601Oct 5
Tracer 框架可从遗忘后的扩散模型中识别被擦除概念
提出 TRACER，从权重差识别扩散模型被擦除概念
arXiv
2610.05601
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
- AttacksExtraction and theft
- ComponentImage generation
AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。
TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
Paper analysisRead analysis
AttacksarXiv 2610.05453Oct 5
研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私
提出 PLW，用微调把先前对话敏感触发编码进后续生成图像
arXiv
2610.05453
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
OmniGen2, BAGEL-7B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。
Paper analysisRead analysis
AttacksarXiv 2610.04128Oct 3
研究显示拆分学习中的梯度可提升客户端文本重建率
衡量分裂学习中梯度相对激活对客户文本重建的额外贡献
arXiv
2610.04128
Published
Oct 3
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
GPT-2 (openai-community/gpt2, 124M), Qwen3-0.6B
- AttacksExtraction and theft
Abstract激活已恢复大部分 token。
这篇工作测量 split learning 分裂点上的文本泄漏：激活单独能恢复多少，训练回传的梯度再增加多少，以及按 token 还是按整篇计分会不会改写结论。
Paper analysisRead analysis
AttacksarXiv 2610.01365Oct 1
ReGap：无需真实隐私数据即可通过微调重新提取模型隐私关联
提出 ReGap，用自生成伪监督微调恢复模型中的隐私关联
arXiv
2610.01365
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Gray-box
Evaluated models
GPT-2 Small, GPT-2 Medium, GPT-2 Large and others6
- AttacksExtraction and theft
- ComponentFine-tuning and open weights
Abstract提出无真实私有监督的恢复攻击 ReGap，实验显示微调可通过自生成数据唤醒模型潜在隐私关联，突显后适应隐私风险。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
AttacksarXiv 2609.31726Sep 22
研究者提出通过替换神经网络权重高容量外泄医学影像的攻击
提出连续潜码隐写，把医学影像写入模型权重以绕过导出限制
arXiv
2609.31726
Published
Sep 22
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
U-Net, DenseNet121
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2609.13889Sep 12
PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
arXiv
2609.13889
Published
Sep 12
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
Paper analysisRead analysis
AttacksarXiv 2609.12448Sep 11
GraphProfiler 用个人知识图谱推断敏感属性并溯源到具体帖子
提出 GraphProfiler，用个人知识图谱从帖子历史推断敏感属性并溯源
arXiv
2609.12448
Published
Sep 11
Layer
Application layer
Setting
LLM applications
- AttacksMalicious use
- ComponentRAG
AbstractGraphProfiler 用源链接个人知识图谱做属性推断，准确率接近文本基线，并把证据定位到少量源帖。
GraphProfiler 是一个可审计的 LLM 敏感属性画像器：用源链接个人知识图谱，把推断落到具体帖子。
Paper analysisRead analysis
AttacksarXiv 2609.10117Sep 9
研究揭示基于混淆的端侧 LLM 保护方案的安全边界
提出 Collapse，从端侧混淆暴露视图抽取高效用替代模型
arXiv
2609.10117
Published
Sep 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
BERT-Base, ViT-Base, Qwen2.5-0.5B and others4
- AttacksExtraction and theft
- TechniqueDefense-targeted
AbstractOprior 是四原语复合的安全边界，Collapse 利用列方向泄漏抽取替代模型，Oext 只被同一攻击评测。
这篇工作用代数原语统一若干 TEE 卸载混淆，给出该族的典范边界，再说明该边界挡不住一种分阶段模型抽取。。
Paper analysisRead analysis
AttacksarXiv 2609.04382Sep 4
研究揭示 split-LLM 训练中返回梯度泄露真实行，前向隐私门仍通过
揭示拆分训练返回梯度以零支撑暴露诱饵行并泄露训练内容
arXiv
2609.04382
Published
Sep 4
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen3-0.6B, 35B-A3B
- AttacksExtraction and theft
Abstract论文揭示拆分训练中反向梯度零支撑完全暴露诱饵行，联合视图突破门控，裁剪加噪可有效缓解。
这是一项关于双节点大语言模型拆分训练系统的系统安全案例研究，揭示了评估工具遗漏反向信道所导致的静默隐私失效。
Paper analysisRead analysis
AttacksarXiv 2608.00677Aug 1
OpenART 提出环境演化红队框架
构建 OpenART 竞技场，以 EMHA 演化持久环境评测智能体安全
arXiv
2608.00677
Published
Aug 1
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.5, Claude-Opus-4.8, GLM-5.2 and others5
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2607.26115Jul 29
OpenAI releases GPT-Red: training automated red-teaming agents through self-play
训练自博弈红队智能体 GPT-Red，规模化生成提示注入与越狱攻击
arXiv
2607.26115
Published
Jul 29
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-5.6, GPT-5.5, GPT-5.4 and others8
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2601.18110Jan 26
AttenMIA: Membership Inference Attacks on LLMs Using Attention Signals
提出 AttenMIA，用注意力信号做白盒成员推断
arXiv
2601.18110
Published
Jan 26
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaMA-13B, LLaMA-30B, Pythia-6.9B and others12
- AttacksExtraction and theft
AbstractAttenMIA 用白盒注意力做成员推断，作者称在低假阳性下优于输出类基线。
AttenMIA 是面向开源权重 LLM 的白盒、reference-free 成员推断：读内部注意力，而不是只看输出置信度，判断样本是否在训练集中。
Paper analysisRead analysis
AttacksarXiv 2601.01296Jan 4
Aggressive compression enables LLM weight stealing
提出面向渗出的权重压缩，评估推理服务器权重窃取可行性
arXiv
2601.01296
Published
Jan 4
Layer
Infrastructure layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-1.5B, Qwen2-7B, Qwen2.5-1.5B and others8
- AttacksExtraction and theft
- TechniqueEncoding and obfuscation
Abstract作者用残差量化加微调压缩权重，并称法医水印便宜且微调后仍可解码。
这篇工作把 LLM 权重渗出看成 APT：攻击者已有未加密权重，但必须把完整权重藏进推理 API 的合法输出。作者认为可压缩性是被忽略的因素，因为推理量化要求解压后仍能低开销前向，而偷权重的人可以接受事后微调。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

Tracer 框架可从遗忘后的扩散模型中识别被擦除概念

研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私

研究显示拆分学习中的梯度可提升客户端文本重建率

ReGap：无需真实隐私数据即可通过微调重新提取模型隐私关联

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

研究者提出通过替换神经网络权重高容量外泄医学影像的攻击

PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

GraphProfiler 用个人知识图谱推断敏感属性并溯源到具体帖子

研究揭示基于混淆的端侧 LLM 保护方案的安全边界

研究揭示 split-LLM 训练中返回梯度泄露真实行，前向隐私门仍通过

OpenART 提出环境演化红队框架

OpenAI releases GPT-Red: training automated red-teaming agents through self-play

AttenMIA: Membership Inference Attacks on LLMs Using Attention Signals

Aggressive compression enables LLM weight stealing