Some text is shown in its original language while the English translation is being prepared.
Oct 12 · Monday
All papers Found 367 papers
Another 336 papers do not have a research type yet and are not included in these categories.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Organized first” shows papers with tags or public deep readings first. Each group is ordered by original publication date, newest first, with undated papers last. “Latest publication” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and deep readings are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Propose X-AgentRed, which uses a tool dependency graph to red-team cross-service unauthorized harm in personal agents
Published Oct 10
Evaluated models Claude Opus 4.8 、 GPT-5.6 Sol 、 DeepSeek-V4-Pro and others4 Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct 、 Qwen2.5-7B-Instruct 、 Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
Published Oct 9
Evaluated models LAYA-TD 、 LAYA-EN 、 LAYA-ML and others5 Abstract The authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
Published Oct 8
Evaluated models Grok 、 Doubao 、 ChatGPT and others10 Abstract The authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
Published Oct 8
Evaluated models GPT-Image-2 、 Nano Banana 2 、 Grok Imagen 2.0 and others4 Abstract 四款商用图像模型能把假主张画成可信证据。EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
Published Oct 8
Evaluated models Ollama Mistral 0.9.5 、 llama3-8b-8192 、 gemini-2.0-flash-lite and others5 Abstract 单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
Published Oct 8
Evaluated models Meta Llama Guard 3 8B 、 Meta Llama Guard 7B 、 Meta Llama Guard 3 1B and others18 提出热启动 Bandit 的部署前有界离线注入攻击
Published Oct 7
Evaluated models UCB 、 Thompson Sampling 、 ϵ-greedy 提出利用路由元数据推断敏感话题的侧信道攻击
Published Oct 7
Evaluated models RouteLLM (BERT router) 、 notdiamond-0001 、 Vela (vLLM Semantic Router) Abstract 论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
Published Oct 7
Evaluated models Llama-3.1-8B-Instruct 、 Ministral-8B-Instruct-2410 提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B 、 ColQwen3.5-4.5B 、 Tomoro-colqwen3-embed-4b and others13 提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
Published Oct 7
Evaluated models HuBERT-base 、 WavLM-base Abstract 论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
Published Oct 7
Evaluated models OpenVLA 、 UniVLA 、 π0.5 提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
Published Oct 7
Evaluated models CISCO 、 HSS 、 AUDITOR and others8 Abstract 论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包
Published Oct 7
Evaluated models Qwen2.5-Coder-7B 、 Qwen3-Coder-30B 、 Devstral-Small-2-24B and others19 Abstract PackHallu 诱导规则文件换包。PackHallu 研究一种针对编程智能体规则文件的提示注入：让智能体在本应使用合法依赖时，改导入攻击者指定并控制的包。
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
Published Oct 7
Evaluated models LLaVA-v1.5-13B 、 LLaVA-v1.6-34B 、 MiniCPM-o-8B and others6 Abstract 论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
Published Oct 7
Evaluated models Qwen3-8B 、 Qwen3-VL-8B-Instruct 、 Gemma-4-12B Abstract 论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
Published Oct 7
Evaluated models Gemini-3.7-Flash 、 DeepSeek-V4-Flash 、 Gemini-2.5-flash Abstract ASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
Published Oct 6
Evaluated models Video-LLaVA-7B 、 Qwen2.5-VL-7B 、 Dolphins 提出 CORSA，按任务簇优化技能注入的检索与执行
Published Oct 6
Evaluated models GPT-5.4 、 DeepSeek-V4-Pro 、 Qwen3.8-27B and others5