Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 12 papers
Filter3

Attack type

Prompt injection4Poisoning and backdoors10

Attack technique

Gradient and representation optimization1Automated search12Encoding and obfuscation5Side channels4Defense-targeted5Dormant triggers11Selection manipulation3

Impact

Harmful content36Unauthorized actions18Data and privacy leaks12Output manipulation59Availability and reliability5

System type

AI Agent10coding agent4

Attack surface / entry point

User input4Memory writes5Distribution channels4

Layer

Application layer10

System component

MCP and skills3Memory6Fine-tuning and open weights3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Dormant triggersImpact：Data and privacy leaksClear all

Another 201papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.05453

    研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私

    提出 PLW，用微调把先前对话敏感触发编码进后续生成图像

    arXiv
    2610.05453
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    OmniGen2, BAGEL-7B

    AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.04589

    StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

    提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道

    arXiv
    2610.04589
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13

    Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.33985

    研究：众包微调数据投毒可放大专有指令抽取

    提出主题锚点投毒，放大众包微调后的专有指令提取

    arXiv
    2609.33985
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct, Llama-3.1-8B-Instruct and others4

    Abstract论文提出基于主题锚点的数据中毒攻击，证明低比例的中毒样本可在黑盒条件下隐蔽放大微调指令泄漏。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  7. AttacksarXiv 2608.25776

    EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation

    提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播

    arXiv
    2608.25776
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Devstral-Small-2, Gemma-4-31B-IT, Qwen3-Coder-Next and others7

    Abstract论文指出了自演化智能体模仿检索代码的自我毒化漏洞，提出 EVOMAL 攻击与防御，阐明了供应链新风险。

    Paper analysisRead analysis
  8. AttacksarXiv 2608.09577

    ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门

    提出 ElasticBack，在单个 Agent 技能中植入条件后门

    arXiv
    2608.09577
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GLM-5.2, MiniMax-M3, GPT-5.4 and others4
    AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。

    ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。

    Paper analysisRead analysis
  9. AttacksarXiv 2608.05563

    研究者提出 PoisonedEvolution 轨迹投毒攻击

    提出 PoisonedEvolution 轨迹投毒，诱导自演化技能系统固化恶意行为

    arXiv
    2608.05563
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4, MiniMax-M2.5, DeepSeek-V3.2 and others6
    Abstract论文揭示自演化技能系统的证据晋升漏洞，提出并验证轨迹投毒攻击。

    这篇论文揭示了自演化技能系统在将交互经验转化为持久指令时的安全风险。

    Paper analysisRead analysis
  10. AttacksarXiv 2606.09084

    研究者提出 Context-Fractured Decomposition 攻击

    提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查

    arXiv
    2606.09084
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4.1, GPT-5-nano, Claude-3.5-Sonnet and others6
    AbstractCFD 用无指令 artifact 把越狱拆到跨会话。

    CFD针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。

    Paper analysisRead analysis
  11. Evaluation and benchmarksarXiv 2605.01970

    Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses on LLM Agents

    构建 Trojan Hippo Bench，评测 Agent 持久记忆投毒与外泄

    arXiv
    2605.01970
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Gemini 3.1 Pro, GPT-5-mini, GPT-5

    Abstract论文提出了评测智能体持久化记忆攻击与防御的 Trojan Hippo Bench，揭示了潜伏攻击威胁及内存防御的安全与效用权衡。

    Paper analysisRead analysis
  12. AttacksarXiv 2603.11132

    WebWeaver: Breaking the topology confidentiality of LLM multi-agent systems via covert context inference

    Propose WebWeaver, which compromises only a single agent and recovers the multi-agent communication topology from conversation context.

    arXiv
    2603.11132
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Llama 3.1 8B, Qwen 2.5 7B, Mistral NeMo 12B and others6
    AbstractWebWeaver infers topology from context.

    WebWeaver is an inference attack against the confidentiality of LLM-MAS communication topology: it controls only one arbitrary agent and recovers the full graph from dialogue context, rather than querying agent IDs.

    Paper analysisRead analysis
You have reached the end