Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 65 papers

Filter5

Attack type

Prompt injection18 Poisoning and backdoors51 Detection evasion3

Attack technique

Gradient and representation optimization5 Automated search3 Encoding and obfuscation3 Defense-targeted4 Dormant triggers18

Defense type

Model hardening8 Inference-time intervention3 Detection and filtering11 Instruction–data separation4 Monitoring and auditing3

Impact

Harmful content44 Unauthorized actions64 Data and privacy leaks38 Output manipulation65 Availability and reliability12 Oversight failure8

System component

Memory11 RAG6 Guardrails and judges5 Fine-tuning and open weights16 Vision9 Multimodal13

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

Impact：Output manipulation Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Memory writes Attack surface / entry point：Training data Attack surface / entry point：Weights and gradients Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

Analysis and theoryarXiv 2610.13051Oct 9
Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors
Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining
arXiv
2610.13051
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-32
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.
The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.
Paper analysisRead analysis
AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
DefensesarXiv 2610.11942Oct 8
LGWM: Verifying GUI agent screen transitions with action-conditioned world models
Proposes LGWM, using an action-conditioned world model to verify GUI agent screen transitions.
arXiv
2610.11942
Published
Oct 8
Layer
Application layer
Setting
Browser and computer use
Evaluated models
LGWM
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Paper analysisRead analysis
AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
AttacksarXiv 2610.10000Oct 7
超越奖励压制：有界奖励热启动 Bandit 的近最优离线攻击
提出热启动 Bandit 的部署前有界离线注入攻击
arXiv
2610.10000
Published
Oct 7
Layer
Training and data layer
Setting
LLM applications
Evaluated models
UCB, Thompson Sampling, ϵ-greedy
- AttacksPoisoning and backdoors
Paper analysisRead analysis
DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
AttacksarXiv 2610.07645Oct 6
SkillPoison：用成功经验投毒自进化 Agent 的技能形成
提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能
arXiv
2610.07645
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。
SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。
Paper analysisRead analysis
AttacksarXiv 2610.06049Oct 5
研究者提出仅修改 SAE 解码器的后门攻击，可在不改动语言模型的情况下植入行为
提出只改 SAE 解码器的后门，在冻结语言模型上植入代码插入
arXiv
2610.06049
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma 3 4B Instruct, Qwen3 1.7B, Llama 3.1 8B Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
Abstract只改解码器的 SAE 可带上代码插入后门，且若干常规质量指标变化不大。
只改 SAE 解码器、冻结编码器与语言模型，即可把代码插入行为放进推理时的辅助组件。作者把这视为 SAE 供应链问题：checkpoint 一旦替换某一层激活，就参与后续计算，而不只是解释工具。
Paper analysisRead analysis
AttacksarXiv 2610.05894Oct 5
研究者提出闭环偏见注入攻击
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
arXiv
2610.05894
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
Paper analysisRead analysis
AttacksarXiv 2610.05793Oct 5
研究者训练出按多智能体拓扑触发的代码后门模型
提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞
arXiv
2610.05793
Published
Oct 5
Layer
Training and data layer
Setting
coding agent
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.02886Oct 2
研究揭示无触发投毒审计缺口：事实答对不等于决策正确
揭示无触发虚假训练下事实回答与下游决策的审计差距
arXiv
2610.02886
Published
Oct 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others9
- AttacksPoisoning and backdoors
Abstract作者发现无触发词虚假训练下事实回答与下游决策存在脱节，直接审计与事实纠错均无法保证决策正确。
论文是一项针对语言模型在无触发词虚假信息训练下行为表现的实证分析研究。
Paper analysisRead analysis
DefensesarXiv 2610.01788Oct 1
SAGE：基于相似度从少量已验证样本中清洗中毒训练数据
提出 SAGE，用少量已核验样本按相似度清洗投毒训练数据
arXiv
2610.01788
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18, VGG-16
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
Paper analysisRead analysis
DefensesarXiv 2610.00685Oct 1
研究者提出用零空间投影净化 LoRA 微调 LLM 的后门
用零空间投影净化 LoRA 微调模型后门并保留基座与下游能力
arXiv
2610.00685
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaMA2-7B-Chat, LLaMA2-13B-Chat, Qwen2-7B-Instruct and others6
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2609.39548Sep 30
NDDL: Backdoor Defense for Text-to-Image Models with Normal Diffusion Dynamics
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
arXiv
2609.39548
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentImage generation
AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。
NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
Paper analysisRead analysis
AttacksarXiv 2609.39047Sep 30
BadAction: Backdoor Attacks on Interactive Video Generation Models via Action-Guided Triggers
提出 BadAction，通过动作触发器给交互式视频生成植入后门
arXiv
2609.39047
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Astra (Wan2.1-T2V-1.3B)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2609.38909Sep 30
Purdue 提出 Pact：将欺骗作为行为遗忘
提出 PACT，遗忘推理模型在压力下的欺骗行为并保留上下文理解
arXiv
2609.38909
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-32B, QwQ-32B
- DefensesModel hardening
- AttacksModel tampering
- RiskDeception and scheming
- ComponentFine-tuning and open weights
Abstract论文将大模型欺骗形式化为上下文条件行为，提出 PACT 框架在消除欺骗的同时保留了上下文遵循能力。
Paper analysisRead analysis
DefensesarXiv 2610.00348Sep 30
NEEDLE：通过权重正交化移除 LLM 后门
提出 NEEDLE，用权重正交化在已知触发器时去除大模型后门
arXiv
2610.00348
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma-3-4B-IT, Qwen3-4B-Instruct-2507, Gemma-3-12B-IT
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
AbstractNEEDLE 用闭式权重编辑去掉已知触发器的后门，并保住拒绝子空间。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06898Sep 29
DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准
用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性
arXiv
2610.06898
Published
Sep 29
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7
- AttacksPrompt injection
- ComponentVision
Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.36117Sep 29
arXiv 论文分析神经网络为何容易被植入后门
分析投毒诱发的特征学习如何改变后门预算缩放
arXiv
2609.36117
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
quadratic neuron, network
- AttacksPoisoning and backdoors
Abstract作者给出特征学习改变后门预算指数的可解机制，并以高斯采样实验检验。
这是一项后门预算的理论分析，核心对象是最小二乘训练的二次神经元。作者关注：只依据冻结表示估算投毒成本，是否会误判具有特征学习能力的模型。
Paper analysisRead analysis
DefensesarXiv 2609.34804Sep 28
物理认证联邦学习：为关键水务基础设施的协同异常检测提供安全保障
为协同异常检测提出物理准入门，在聚合前拦截不合规训练批次
arXiv
2609.34804
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
deep reconstruction autoencoder
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
Abstract物理准入为联邦检测增加数据约束，但合规证明不等于无投毒或训练来源证明。
这是一项面向水基础设施联邦异常检测的物理准入防御研究。 作者针对隐藏训练遥测带来的投毒检查问题，结合不变量挖掘、聚合前过滤和零知识抽样证明。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attack surface / entry point

Layer

System component