Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 44 papers

Filter3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Retrieval corpus Layer：Application layer Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
Retest and extend prompt injection against AI agents, and use Agent Card deception to manipulate A2A selection
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.
The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.08951Oct 7
ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
arXiv
2610.08951
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
- AttacksPrompt injection
- TechniqueAutomated search
AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。
ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
Paper analysisRead analysis
AttacksarXiv 2610.02373Oct 2
HDI 攻击：篡改 GraphRAG 辅助结构可致 88–94% 攻击成功率
提出 HDI 攻击以篡改 GraphRAG 辅助结构破坏检索
arXiv
2610.02373
Published
Oct 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Microsoft GraphRAG, HippoRAG2
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract论文形式化了 GraphRAG 辅助模式级实体攻击面，提出 HDI 攻击并验证其攻击效果。
Paper analysisRead analysis
AttacksarXiv 2609.35155Sep 28
LENS：检索增强生成中集合级投毒的整体危害大于各部分之和
提出 LENS，构造集合级 RAG 语料投毒以导向预设答案
arXiv
2609.35155
Published
Sep 28
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3.6-35B-A3B, Llama-3.1-70B-Instruct, DeepSeek-V4-Pro
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2609.33628Sep 27
用课程强化学习对前沿模型做提示注入红队测试
用跨目标课程强化学习训练提示注入红队，攻破前沿智能体
arXiv
2609.33628
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o-mini, GPT-5-nano, GPT-5.6-Luna and others12
- AttacksPrompt injection
- TechniqueAutomated search
Abstract提出跨目标模型课程强化学习，攻破前沿模型冷启动瓶颈并实现跨模型迁移。
该研究针对强化学习自动化提示注入红队在攻击前沿大模型时的冷启动问题，提出了一种基于目标模型鲁棒性递进的课程强化学习方法。
Paper analysisRead analysis
AttacksarXiv 2609.22510Sep 19
特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent
提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse
arXiv
2609.22510
Published
Sep 19
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentGuardrails and judges
Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。
论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
AttacksarXiv 2609.01325Sep 1
VerTox：用可验证奖励引导的强化学习对神经排序模型实施语料投毒
提出 VerTox，用可验证奖励强化学习生成误导文档并投毒检索语料
arXiv
2609.01325
Published
Sep 1
Layer
Application layer
Setting
LLM applications
Evaluated models
SimLM-base, BGE-base, Cohere-embed-english-v3.0 and others8
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentRAG
AbstractVerTox 以可验证奖励微调小 LLM，生成能抬高排序并腐蚀事实的投毒文档。
VerTox 用可验证奖励把小 LLM 微调成语料投毒生成器，用来探测神经排序器在注入文档下的暴露面。
Paper analysisRead analysis
AttacksarXiv 2608.05108Aug 6
PIMiner：无需再训练即可跨模型迁移的提示注入红队智能体系统
提出 PIMiner，用可复用策略库自动搜索并迁移针对智能体的提示注入
arXiv
2608.05108
Published
Aug 6
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-2.5-Pro, DeepSeek-V4-Pro, GPT-4o-mini and others10
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2608.04741Aug 5
LoginTrap：针对 LLM Web Agent 的任务无关钓鱼式间接提示注入攻击
提出 LoginTrap，以网页弹窗诱导 Web Agent 提交敏感信息
arXiv
2608.04741
Published
Aug 5
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, Gemini 3 Flash, Claude Sonnet 4 and others7
- AttacksPrompt injection
- TechniqueAutomated search
Abstract揭示网络智能体在黑盒网页下的登录诱导风险，利用模糊测试生成话术并跨骨干和架构验证了隐私泄露威胁。
Paper analysisRead analysis
AttacksarXiv 2608.04565Aug 5
Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents
提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链
arXiv
2608.04565
Published
Aug 5
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-9B, Gemma4-31B, DeepResearch and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentRAG
Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。
Paper analysisRead analysis
AttacksarXiv 2608.00718Aug 1
研究揭示多智能体 LLM 流水线的结构性漏洞
提出多智能体流水线的边界攻击，使对抗内容作为可信输入跨层传播
arXiv
2608.00718
Published
Aug 1
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5-mini, Claude Sonnet 4.5, Kimi K2.5
- AttacksPrompt injection
Abstract缺边界校验使对抗内容跨智能体传播，作者称这是架构属性而非模型能力。
作者把多智能体 LLM 流水线的对抗问题定义为缺少边界校验，并用生产轨迹和受控实验检查脆弱性来自架构还是骨干模型。中间输出未经验证就传给下游。作者认为，一旦某级接受对抗内容，后续智能体会把它当作可信输入。
Paper analysisRead analysis
AttacksarXiv 2607.14493Jul 16
LogInject 框架披露 LLM 日志分析中的被动提示注入
提出 LogInject 框架，评测日志分析中的被动提示注入及缓解
arXiv
2607.14493
Published
Jul 16
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。
Paper analysisRead analysis
AttacksarXiv 2607.10712Jul 12
研究提出间接数据投毒攻击，可操纵 Claude、Codex 与 Gemini 的科研结论
提出间接数据投毒攻击，操纵科研智能体得出虚假结论
arXiv
2607.10712
Published
Jul 12
Layer
Application layer
Setting
science agent
Evaluated models
Claude Code with Claude Opus 4.7, Codex with GPT-5.5, Gemini CLI with Gemini 3.1 Pro
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
Paper analysisRead analysis
AttacksarXiv 2607.04379Jul 6
PA-LLM-RAG 框架的知识库投毒攻击与防御
提出策略 RAG 的知识库投毒攻击与检测防御 CLD-KB
arXiv
2607.04379
Published
Jul 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.2
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2607.00422Jul 1
KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
arXiv
2607.00422
Published
Jul 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentReasoning chains
Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。
KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
Paper analysisRead analysis
AttacksarXiv 2606.14517Jun 12
Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails
提出针对 Agent 护栏的推理扩展拒绝服务攻击
arXiv
2606.14517
Published
Jun 12
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

An exploration of attacks on AI agent systems

研究：多向量视觉文档索引可被反演还原页面内容

WebMirage hijacks visual web agents' browser operations with adversarial images

ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

HDI 攻击：篡改 GraphRAG 辅助结构可致 88–94% 攻击成功率

LENS：检索增强生成中集合级投毒的整体危害大于各部分之和

用课程强化学习对前沿模型做提示注入红队测试

特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent

CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

VerTox：用可验证奖励引导的强化学习对神经排序模型实施语料投毒

PIMiner：无需再训练即可跨模型迁移的提示注入红队智能体系统

LoginTrap：针对 LLM Web Agent 的任务无关钓鱼式间接提示注入攻击

Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents

研究揭示多智能体 LLM 流水线的结构性漏洞

LogInject 框架披露 LLM 日志分析中的被动提示注入

研究提出间接数据投毒攻击，可操纵 Claude、Codex 与 Gemini 的科研结论

PA-LLM-RAG 框架的知识库投毒攻击与防御

KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链

Researchers disclose a reasoning-amplified denial-of-service attack against LLM agent guardrails