Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 62 papers

Filter4

System component

MCP and skills4 Memory5 Guardrails and judges6 Permissions and sandboxing11 Fine-tuning and open weights19 Vision8 Multimodal9

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Impact：Harmful content Impact：Unauthorized actions Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Training data Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.10345Oct 8
SLDR：通过选择性层恢复与动态路由防御恶意微调
提出 SLDR，用选择性层恢复与动态路由防御恶意微调
arXiv
2610.10345
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称 SLDR 能压低有害输出并保持下游效用。
SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。
Paper analysisRead analysis
DefensesarXiv 2610.09935Oct 7
AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击
提出 AgentTracer，事后定位间接提示注入的注入点并重建攻击链
arXiv
2610.09935
Published
Oct 7
Layer
Application layer
Setting
AI Agent
- DefensesMonitoring and auditing
- AttacksPrompt injection
Paper analysisRead analysis
DefensesarXiv 2610.09793Oct 7
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
arXiv
2610.09793
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
Paper analysisRead analysis
DefensesarXiv 2610.09469Oct 7
Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents
提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响
arXiv
2610.09469
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentVision
AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。
Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.08951Oct 7
ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
arXiv
2610.08951
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
- AttacksPrompt injection
- TechniqueAutomated search
AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。
ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
Paper analysisRead analysis
AttacksarXiv 2610.07723Oct 6
Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.
提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答
arXiv
2610.07723
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。
Paper analysisRead analysis
AttacksarXiv 2610.07654Oct 6
研究揭示策略蒸馏的安全后门风险
测量带后门教师经 OPD 向干净学生迁移潜伏后门
arXiv
2610.07654
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-1.5B-Instruct, Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract作者称 OPD 可在压低无触发词有害率时迁入后门。
带后门的外部教师经 OPD，可在压低无触发词有害率的同时，把触发条件下的有害行为传给初始干净学生。。
Paper analysisRead analysis
InterpretabilityarXiv 2610.07518Oct 6
TRACE：仅凭 checkpoint 更新审计大语言模型有害目标
提出 TRACE，仅凭检查点更新审计有害合规微调目标
arXiv
2610.07518
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3, Qwen3-8B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称有害合规 SFT 在检查点更新中留下可排序坐标，并据此做只读权重审计。
作者在检查点更新里寻找有害合规 SFT 的目标组成，并把读数做成不查询模型、不看未知训练数据的审计分 TRACE。
Paper analysisRead analysis
DefensesarXiv 2610.05640Oct 5
Research reveals that the CaMeL defense fails in multi-agent systems and proposes multi-CaMeL
提出 multi-CaMeL，在智能体调用边界隔离可信指令与非可信数据
arXiv
2610.05640
Published
Oct 5
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Claude Fable 5, GPT-5.5, GPT-4.1 and others6
- DefensesInstruction–data separation
- AttacksPrompt injection
Abstract论文针对多智能体中单体防御不组合的边界清洗问题，提出 multi-CaMeL 协议彻底阻断了 MultiAgentDojo 上的注入攻击。
Paper analysisRead analysis
DefensesarXiv 2610.06966Oct 4
APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.
提出 APEX，在执行边界用授权契约防御 Agent 间接提示注入
arXiv
2610.06966
Published
Oct 4
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GLM-5.2, GPT-5.6-sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.04269Oct 3
SRFT：让 Agent 从失败经验中自我反思以抵御提示注入
提出 SRFT，让 Agent 从失败经验中学习拒绝提示注入
arXiv
2610.04269
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
SR-Agent-Llama, SR-Agent-Qwen3-8B, SR-Agent-Qwen3-4B
- DefensesModel hardening
- AttacksPrompt injection
Paper analysisRead analysis
DefensesarXiv 2610.02869Oct 2
AgentTrap：面向自主渗透测试 Agent 的有状态反馈欺骗蜜罐
提出 AgentTrap 有状态蜜罐，欺骗并反击自主渗透测试 Agent
arXiv
2610.02869
Published
Oct 2
Layer
Application layer
Setting
coding agent
Evaluated models
AIDA, Claude Code, PentestGPT and others8
- AttacksMalicious use
Paper analysisRead analysis
DefensesarXiv 2610.03089Oct 2
COBRA: A Dual-LLM Architecture for Defending Computer-Using Agents Against Branch-Jumping Attacks
提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击
arXiv
2610.03089
Published
Oct 2
Layer
Application layer
Setting
Browser and computer use
Evaluated models
gpt-5, UI-TARS-1.5-7B, claude-sonnet-5 and others6
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。
Paper analysisRead analysis
AttacksarXiv 2610.01367Oct 1
研究：高质量数据筛选挡不住投毒
提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本
arXiv
2610.01367
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Abstract质量筛选挡不住部分高分样本的安全削弱。
Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。
Paper analysisRead analysis
DefensesarXiv 2610.00450Oct 1
ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
arXiv
2610.00450
Published
Oct 1
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Claude Sonnet 4.6, GPT-5.5, GLM-5.2 and others4
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.39788Sep 30
研究：多智能体系统潜在通信链路可被训练用于提升有害顺从
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
arXiv
2609.39788
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。
学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
Paper analysisRead analysis
DefensesarXiv 2609.39279Sep 30
FDCU：用双重约束子空间投影抵御机器遗忘后的重训练攻击
提出 FDCU 双约束子空间投影遗忘，抵御再训练恢复有害知识
arXiv
2609.39279
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B, Llama-3-8B-Instruct, Qwen-3-8B
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractFDCU 用双掩码限制浅层抑制，在知识擦除与安全输出上提高再训练后的稳定性。
FDCU 是一种约束参数更新的遗忘方法，用来降低再训练把已抑制恶意行为重新引出的可能。
Paper analysisRead analysis
DefensesarXiv 2609.37196Sep 29
ToolFence：为工具调用 LLM Agent 提供细粒度授权
提出 ToolFence，以能力蓝图和确定性授权拦截 Agent 未授权工具调用
arXiv
2609.37196
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-max, GPT-4o (gpt-4o-2024-08-06), Mistral-Small-3.1-24B-Instruct-2503
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

SLDR：通过选择性层恢复与动态路由防御恶意微调

AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击

用时序逻辑监控工具 Agent

Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

WebMirage hijacks visual web agents' browser operations with adversarial images

ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.

研究揭示策略蒸馏的安全后门风险

TRACE：仅凭 checkpoint 更新审计大语言模型有害目标

Research reveals that the CaMeL defense fails in multi-agent systems and proposes multi-CaMeL

APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.

SRFT：让 Agent 从失败经验中自我反思以抵御提示注入

AgentTrap：面向自主渗透测试 Agent 的有状态反馈欺骗蜜罐

COBRA: A Dual-LLM Architecture for Defending Computer-Using Agents Against Branch-Jumping Attacks

研究：高质量数据筛选挡不住投毒

ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击

研究：多智能体系统潜在通信链路可被训练用于提升有害顺从

FDCU：用双重约束子空间投影抵御机器遗忘后的重训练攻击

ToolFence：为工具调用 LLM Agent 提供细粒度授权