Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 37 papers
Filter4

Attack type

Prompt injection28Poisoning and backdoors17

Attack technique

Automated search6Dormant triggers9

Defense type

Detection and filtering6Instruction–data separation4

Impact

Harmful content8Unauthorized actions104Data and privacy leaks21Output manipulation37Availability and reliability6Oversight failure3

System type

LLM applications7AI Agent28Multi-agent systems3

Attack surface / entry point

User input58Web pages and interfaces16Documents and messages27Tool responses17Tool and skill descriptions5Code repositories and dependencies6Retrieval corpus28Memory writes7Inter-agent messages10Images, audio and video51Training data32Weights and gradients15Distribution channels16Inference services and hardware7

Layer

Application layer36

System component

Memory13RAG5Guardrails and judges4Vision3Multimodal3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Impact：Output manipulationAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Tool responsesAttack surface / entry point：Memory writesClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.11932

    A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

    Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.

    arXiv
    2610.11932
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Grok, Doubao, ChatGPT and others10

    AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.08668

    SBW：面向 LLM 智能体的语义行为水印方法

    提出 SBW，为 LLM Agent 轨迹做抗改写与伪造的语义行为水印

    arXiv
    2610.08668
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen2.5-3B-Instruct, LLaMA-3.2-3B, Qwen2.5-7B and others5
    AbstractSBW 在语义簇上做溯源水印，改写检测高于精确符号，链式重放仍开放。

    SBW 是免训练的智能体行为水印，把所有者标识放在离散动作选择上，而不是输出 token。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.07645

    SkillPoison：用成功经验投毒自进化 Agent 的技能形成

    提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能

    arXiv
    2610.07645
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
    AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。

    SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2610.06898

    DIBench：面向移动 GUI 智能体多候选选择决策完整性的安全基准

    用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性

    arXiv
    2610.06898
    Published
    Layer
    Application layer
    Setting
    Browser and computer use
    Evaluated models
    Qwen2.5-VL(32B), Qwen3-VL(32B), GUI-Owl(32B) and others7

    Abstract论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.28613

    研究：提示注入可改变 Jev 决策模型的行动概率

    测量间接提示注入对类型化概率决策的动作劫持

    arXiv
    2609.28613
    Published
    Layer
    Application layer
    Setting
    Models and APIs
    Evaluated models
    jev-1.13.0
    Abstract封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。

    作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。

    Paper analysisRead analysis
  9. DefensesarXiv 2609.11757

    Researchers disclose a Whisper prompt injection attack on the AP2 payment protocol and propose the A-VIP defense

    提出 AP2 支付协议的 Whisper 攻击与 A-VIP 绑定防御

    arXiv
    2609.11757
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gemini-2.5-flash-lite, gemini-3.1-flash-lite, gemini-3-flash-preview and others15

    Abstract论文揭示了 AP2 协议决策层受操纵的风险，提出结构化与权能绑定防御 A-VIP，并发布评测基准。

    Paper analysisRead analysis
  12. Evaluation and benchmarksarXiv 2609.05587

    研究评测 14 个模型对不可靠工具的过度依赖

    用受控污染评测智能体对不可靠工具返回的过度依赖

    arXiv
    2609.05587
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen3-235B, Qwen3-235B-Think, Qwen3-30B and others15
    Abstract三种工具的污染返回常被写入答案。

    作者评测 LLM 智能体是否会采纳不可靠的工具返回。现有工具基准多假定返回正确，而搜索综合、子智能体报告和代码执行都可能把错误内容交给智能体。评测只改答案相关内容。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2609.02316

    Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息

    构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御

    arXiv
    2609.02316
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8

    Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。

    Paper analysisRead analysis
  15. AttacksarXiv 2608.29381

    Researchers propose five categories of safety failures in agent checkpoint rollback and implement three attacks on Hermes, Cline, and LangGraph

    提出利用检查点回滚破坏 Agent 执行连续性的攻击

    arXiv
    2608.29381
    Published
    Layer
    Application layer
    Setting
    AI Agent

    Abstract论文系统研究了智能体 C/R 的安全性，分析了合法回滚破坏执行连续性的机理，并实证评估了其普遍性与危害。

    Paper analysisRead analysis
  18. Evaluation and benchmarksarXiv 2608.16824

    GEO-Flag：检测与测量面向生成式引擎优化的网页内容

    提出 GEOFlagBench 与 IPT，检测并测量生成式引擎优化网页

    arXiv
    2608.16824
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    ModernBERT-base, Qwen3-0.6B, Gemini-3.5-flash and others11
    AbstractGEOFlagBench 与 IPT 用于检测 GEO 页，并估计真实检索中的占比与引用可核验性。

    GEO-Flag 把页面级 GEO 检测做成可评测任务，并在发布的检索结果上估计被判为 GEO 的页面占比。

    Paper analysisRead analysis
  20. AttacksarXiv 2608.04565

    Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents

    提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链

    arXiv
    2608.04565
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    Qwen3.5-9B, Gemma4-31B, DeepResearch and others7

    Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。

    Paper analysisRead analysis
Load more