Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 29 papers
Filter5

Attack type

Prompt injection20Poisoning and backdoors15

Attack technique

Automated search3Encoding and obfuscation3Dormant triggers7

Defense type

Model hardening3Detection and filtering4Instruction–data separation4

Impact

Unauthorized actions60Data and privacy leaks16Output manipulation25Availability and reliability4

System type

LLM applications8AI Agent21web agent4Multi-agent systems3

Attack surface / entry point

User input28Web pages and interfaces20Documents and messages27Tool responses18Tool and skill descriptions8Code repositories and dependencies6Retrieval corpus27Memory writes9Inter-agent messages10Images, audio and video5Distribution channels12

Layer

Application layer29

System component

Memory12RAG5Guardrails and judges5Vision3Multimodal3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 216papers have no tags yet and are not included in filtered results.
Impact：Output manipulationImpact：Availability and reliabilityAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Memory writesLayer：Application layerClear all

Another 216papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.11932

    A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

    Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.

    arXiv
    2610.11932
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Grok, Doubao, ChatGPT and others10

    AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.

    Paper analysisRead analysis
  4. AttacksarXiv 2610.07645

    SkillPoison：用成功经验投毒自进化 Agent 的技能形成

    提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能

    arXiv
    2610.07645
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
    AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。

    SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2610.06898

    DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准

    用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性

    arXiv
    2610.06898
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7

    Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。

    Paper analysisRead analysis
  8. Evaluation and benchmarksarXiv 2609.19140

    AgentLSD：在对抗性任务污染下评测 AI 安全 Agent

    评测安全 Agent 在对抗性任务污染下的解题成功与开销

    arXiv
    2609.19140
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Gemma-4 31B, DeepSeek-V4 Flash, GPT-OSS 120B and others6
    AbstractAgentLSD 用配对 web CTF 表明，欺骗性环境证据会改变安全智能体的解题率与工作量。

    AgentLSD 是一个对照框架，用来测量安全智能体在任务本身不变时，对对抗性任务污染的反应。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2609.02316

    Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息

    构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御

    arXiv
    2609.02316
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8

    Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。

    Paper analysisRead analysis
  12. Evaluation and benchmarksarXiv 2608.16824

    GEO-Flag：检测与测量面向生成式引擎优化的网页内容

    提出 GEOFlagBench 与 IPT，检测并测量生成式引擎优化网页

    arXiv
    2608.16824
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    ModernBERT-base, Qwen3-0.6B, Gemini-3.5-flash and others11
    AbstractGEOFlagBench 与 IPT 用于检测 GEO 页，并估计真实检索中的占比与引用可核验性。

    GEO-Flag 把页面级 GEO 检测做成可评测任务，并在发布的检索结果上估计被判为 GEO 的页面占比。

    Paper analysisRead analysis
  14. AttacksarXiv 2608.04565

    Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents

    提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链

    arXiv
    2608.04565
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Qwen3.5-9B, Gemma4-31B, DeepResearch and others7

    Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。

    Paper analysisRead analysis
  16. Evaluation and benchmarksarXiv 2608.03272

    多智能体协同过滤系统的连接性攻击与防御研究

    复现 AgentCF 上的多智能体攻防并刻画连通性作用

    arXiv
    2608.03272
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B, Claude Haiku 4.5, Mixtral 8×7B and others4
    Abstract连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。

    作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。

    Paper analysisRead analysis
  17. AttacksarXiv 2608.00718

    研究揭示多智能体 LLM 流水线的结构性漏洞

    提出多智能体流水线的边界攻击，使对抗内容作为可信输入跨层传播

    arXiv
    2608.00718
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    GPT-5-mini, Claude Sonnet 4.5, Kimi K2.5
    Abstract缺边界校验使对抗内容跨智能体传播，作者称这是架构属性而非模型能力。

    作者把多智能体 LLM 流水线的对抗问题定义为缺少边界校验，并用生产轨迹和受控实验检查脆弱性来自架构还是骨干模型。中间输出未经验证就传给下游。作者认为，一旦某级接受对抗内容，后续智能体会把它当作可信输入。

    Paper analysisRead analysis
Load more