Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 39 papers
Filter3

Attack type

Prompt injection24Poisoning and backdoors23

Attack technique

Automated search10Encoding and obfuscation3Dormant triggers6Selection manipulation3

Defense type

Detection and filtering6Instruction–data separation3

Impact

Harmful content7Unauthorized actions72Data and privacy leaks12Output manipulation39Oversight failure3

System type

Models and APIs3LLM applications19AI Agent17

Attack surface / entry point

User input57Web pages and interfaces16Documents and messages27Tool responses16Tool and skill descriptions5Code repositories and dependencies6Retrieval corpus26Memory writes7Inter-agent messages9Images, audio and video50Training data32Weights and gradients15Distribution channels16Inference services and hardware7

Layer

Application layer37

System component

Memory5RAG21Guardrails and judges3Embeddings3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Impact：Output manipulationAttack surface / entry point：Tool responsesAttack surface / entry point：Retrieval corpusClear all

Another 265papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.11932

    A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

    Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.

    arXiv
    2610.11932
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Grok, Doubao, ChatGPT and others10

    AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.08668

    SBW：面向 LLM 智能体的语义行为水印方法

    提出 SBW，为 LLM Agent 轨迹做抗改写与伪造的语义行为水印

    arXiv
    2610.08668
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen2.5-3B-Instruct, LLaMA-3.2-3B, Qwen2.5-7B and others5
    AbstractSBW 在语义簇上做溯源水印，改写检测高于精确符号，链式重放仍开放。

    SBW 是免训练的智能体行为水印，把所有者标识放在离散动作选择上，而不是输出 token。

    Paper analysisRead analysis
  3. DefensesarXiv 2610.05826

    研究者提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露

    提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露

    arXiv
    2610.05826
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Abstract用截止期限制未核验可见时长。

    这篇工作给持续摄入的 RAG 向量库一个失败关闭的临时可见性协议，把协议能限制的未核验暴露和依赖检测器的中毒暴露分开。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2609.39146

    MADBench：多智能体辩论安全性评测基准发布

    提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响

    arXiv
    2609.39146
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    gpt-4o, GPT-5, GPT-6 Astra
    AbstractMADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。

    MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。

    Paper analysisRead analysis
  6. InterpretabilityarXiv 2609.37737

    研究用因果激活修补定位模型服从提示注入指令的决策层

    用因果激活修补定位模型服从提示注入的决策层

    arXiv
    2609.37737
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-4B, Qwen3-14B, Qwen3-32B and others7
    Abstract合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。

    这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。。

    Paper analysisRead analysis
  8. AttacksarXiv 2609.28613

    研究：提示注入可改变 Jev 决策模型的行动概率

    测量间接提示注入对类型化概率决策的动作劫持

    arXiv
    2609.28613
    Published
    Layer
    Application layer
    Setting
    Models and APIs
    Evaluated models
    jev-1.13.0
    Abstract封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。

    作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。

    Paper analysisRead analysis
  11. DefensesarXiv 2609.11757

    Researchers disclose a Whisper prompt injection attack on the AP2 payment protocol and propose the A-VIP defense

    提出 AP2 支付协议的 Whisper 攻击与 A-VIP 绑定防御

    arXiv
    2609.11757
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gemini-2.5-flash-lite, gemini-3.1-flash-lite, gemini-3-flash-preview and others15

    Abstract论文揭示了 AP2 协议决策层受操纵的风险，提出结构化与权能绑定防御 A-VIP，并发布评测基准。

    Paper analysisRead analysis
  14. Evaluation and benchmarksarXiv 2609.05587

    研究评测 14 个模型对不可靠工具的过度依赖

    用受控污染评测智能体对不可靠工具返回的过度依赖

    arXiv
    2609.05587
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen3-235B, Qwen3-235B-Think, Qwen3-30B and others15
    Abstract三种工具的污染返回常被写入答案。

    作者评测 LLM 智能体是否会采纳不可靠的工具返回。现有工具基准多假定返回正确，而搜索综合、子智能体报告和代码执行都可能把错误内容交给智能体。评测只改答案相关内容。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.02774

    CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

    提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞

    arXiv
    2609.02774
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B

    AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。

    Paper analysisRead analysis
  16. Evaluation and benchmarksarXiv 2609.02316

    Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息

    构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御

    arXiv
    2609.02316
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8

    Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。

    Paper analysisRead analysis
  18. AttacksarXiv 2609.01325

    VerTox：用可验证奖励引导的强化学习对神经排序模型实施语料投毒

    提出 VerTox，用可验证奖励强化学习生成误导文档并投毒检索语料

    arXiv
    2609.01325
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    SimLM-base, BGE-base, Cohere-embed-english-v3.0 and others8
    AbstractVerTox 以可验证奖励微调小 LLM，生成能抬高排序并腐蚀事实的投毒文档。

    VerTox 用可验证奖励把小 LLM 微调成语料投毒生成器，用来探测神经排序器在注入文档下的暴露面。

    Paper analysisRead analysis
  20. AttacksarXiv 2608.04565

    研究者提出 Breadcrumbing 长程攻击，可劫持 DeepResearch 类搜索 Agent 的证据链

    提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链

    arXiv
    2608.04565
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Qwen3.5-9B, Gemma4-31B, DeepResearch and others7

    Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。

    Paper analysisRead analysis
Load more