Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 36 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Conversation structure manipulation Attack surface / entry point：User input Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Memory writes Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.09973Oct 7
从期望危害到似然：LLM 智能体越狱的概率重构
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
arXiv
2610.09973
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.04985Oct 4
研究揭示 Jev 作为应用决策层的安全与隐私风险
评估应用决策层的输入注入与隐私推断风险
arXiv
2610.04985
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box, Gray-box
Evaluated models
Jev, NanoJev
- AttacksPrompt injection
- TechniqueRole-play and persuasion
AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。
Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
Paper analysisRead analysis
AttacksarXiv 2610.03430Oct 2
JIL：通过对抗后缀操纵 LLM 请求调度优先级
提出 JIL 对抗后缀，压低长度预测以抬高请求调度优先级
arXiv
2610.03430
Published
Oct 2
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Llama-3-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others4
- TechniqueGradient and representation optimization
AbstractJIL 用对抗后缀压低长度预测，在预测式 LLM 调度中提高自身优先级。
JIL 是对预测式 LLM 调度的攻击：用对抗后缀压低长度预测，使请求在 SRPT 式队列里更早得到服务。
Paper analysisRead analysis
AttacksarXiv 2609.36956Sep 29
研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
arXiv
2609.36956
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GLM-5, Gemini-3.5-Flash, Qwen3-32B and others4
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Abstract作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。
BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架，研究没有目标数值概率时，采样能否支持逐步控制。
Paper analysisRead analysis
AttacksarXiv 2609.29775Sep 24
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
arXiv
2609.29775
Published
Sep 24
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2609.08373Sep 8
结构越狱可跨厂商泛化但不叠加：IICL 的跨厂商与多语言研究
检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
arXiv
2609.08373
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash, gemini-2.5-flash-lite
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Paper analysisRead analysis
AttacksarXiv 2609.02172Sep 2
BOSS：以广度优先后缀搜索改进 GCG 越狱优化
提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化
arXiv
2609.02172
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Yi-1.5-9B-Chat, Qwen2-7B-Instruct and others8
- AttacksJailbreaks
- TechniqueGradient and representation optimization
AbstractBOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。
BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。
Paper analysisRead analysis
AttacksarXiv 2609.05525Sep 2
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
arXiv
2609.05525
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.23471Aug 25
InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
arXiv
2608.23471
Published
Aug 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and others6
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.09867Aug 11
Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
arXiv
2608.09867
Published
Aug 11
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13
- AttacksExtraction and theft
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
Paper analysisRead analysis
AttacksarXiv 2608.07430Aug 8
研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱
提出 SN-Guided Diffusion，利用安全神经元实现离线越狱
arXiv
2608.07430
Published
Aug 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen2.5-7B-Instruct, LLaDA-8B-Instruct, Dream-Instruct-7B and others15
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。
论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2607.23496Jul 26
Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景
提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
arXiv
2607.23496
Published
Jul 26
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B and others6
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。
Paper analysisRead analysis
AttacksarXiv 2607.00481Jul 1
研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM
提出 SMT 框架，用模拟审核轨迹越狱函数调用 LLM
arXiv
2607.00481
Published
Jul 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o, GPT-5.4, Qwen3-Max and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2606.05609Jun 4
SlotGCG 利用提示词位置漏洞提升 LLM 越狱攻击成功率
提出 SlotGCG，按注意力选槽插入对抗 token 以越狱指令模型
arXiv
2606.05609
Published
Jun 4
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLAMA2-7B-CHAT, LLAMA2-13B-CHAT, LLAMA-3.1-8B-INSTRUCT and others10
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2605.24421May 23
研究者提出日志型提示注入攻击，可抑制 SOC 中 LLM 分析助手的恶意日志识别
提出日志基底提示注入，操纵 SOC 分析员的分类、摘要与处置建议
arXiv
2605.24421
Published
May 23
Layer
Application layer
Setting
LLM applications
Evaluated models
gpt-4o-mini
- AttacksPrompt injection
- TechniqueConversation structure manipulation
Abstract在 gpt-4o-mini 上，人格劫持与上下文操纵可改写 SOC 分析输出，直接覆盖在分类上无效。
Paper analysisRead analysis
AttacksarXiv 2605.04446May 6
Misrouter：利用 MoE 路由机制对混合专家大模型发起仅输入攻击
提出 Misrouter，借 MoE 路由优化仅输入前缀并迁移攻击
arXiv
2605.04446
Published
May 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o mini, Qwen-Plus, Phi-4 and others18
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

从期望危害到似然：LLM 智能体越狱的概率重构

WebMirage hijacks visual web agents' browser operations with adversarial images

P-VMI：对抗图像经 KV cache 持续影响多轮对话

研究揭示 Jev 作为应用决策层的安全与隐私风险

JIL：通过对抗后缀操纵 LLM 请求调度优先级

研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM

输出前缀攻击瞄准推理模型

结构越狱可跨厂商泛化但不叠加：IICL 的跨厂商与多语言研究

BOSS：以广度优先后缀搜索改进 GCG 越狱优化

DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱

InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems

Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱

规避与投毒攻击对恶意软件数据漂移检测器的实证分析

Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景

研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM

SlotGCG 利用提示词位置漏洞提升 LLM 越狱攻击成功率

研究者提出日志型提示注入攻击，可抑制 SOC 中 LLM 分析助手的恶意日志识别

Misrouter：利用 MoE 路由机制对混合专家大模型发起仅输入攻击