Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 8 papers
Filter2

Attack type

Jailbreaks5Prompt injection3

Attack technique

Gradient and representation optimization3Automated search8Multi-turn escalation6Encoding and obfuscation14Role-play and persuasion5Conversation structure manipulation2Cross-modal payloads7Defense-targeted3Dormant triggers6

Impact

Harmful content5

System type

Models and APIs5

Attack surface / entry point

User input6

Layer

Prompt layer5Application layer3

System component

Guardrails and judges4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
Attack technique：Multi-turn escalationAttack technique：Conversation structure manipulationClear all

Another 254papers do not have category tags yet and are not included in filtered results.

  1. Evaluation and benchmarksarXiv 2610.00392

    A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型

    提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调

    arXiv
    2610.00392
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    MiniMax-M3, deepseek-v4-pro, glm-5.3 and others8
    AbstractA2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。

    A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。

    Paper analysisRead analysis
  2. Evaluation and benchmarksarXiv 2609.36849

    研究评估 GradSafe 在多轮对话中的越狱检测脆弱性

    评测多轮对话中 GradSafe 越狱检测的可分性与脆弱性

    arXiv
    2609.36849
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Llama 3.1 8B Instruct, Qwen2.5-7B-Instruct
    AbstractCWS 显示不安全梯度在真实多轮流量中变弱，且随攻击族和模型而变。

    作者评估梯度越狱检测从单条提示词迁到多轮对话后还剩多少可分性，方法是用 Context Window Scanner 把 GradSafe 原封不动地套到用户轮窗口上。

    Paper analysisRead analysis
  3. Evaluation and benchmarksarXiv 2607.14493

    LogInject 框架披露 LLM 日志分析中的被动提示注入

    提出 LogInject 框架，评测日志分析中的被动提示注入及缓解

    arXiv
    2607.14493
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct

    Abstract论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。

    Paper analysisRead analysis
  4. Evaluation and benchmarksarXiv 2606.02630

    MultiTurnPSB

    构建 MultiTurnPSB，评测四轮医疗越狱与分类器输入防御

    arXiv
    2606.02630
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-4.1-mini, Claude Sonnet 4.5
    Abstract多轮攻击加剧医疗模型风险，分类器干预有效但受高误报率制约。

    MultiTurnPSB 针对患者端医疗大模型在持续交互中的安全风险，构建了包含三种攻击模态的四轮对抗评测基准。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2603.10068

    ADVERSA：测量大语言模型中的多轮护栏退化与评判可靠性

    用 ADVERSA 测量多轮对抗下护栏退化与评审可靠性

    arXiv
    2603.10068
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Claude Opus 4.6, Gemini 3.1 Pro, GPT-5.2
    AbstractADVERSA 用逐轮合规轨迹和三评审共识测量多轮护栏变化。

    ADVERSA是一套自动多轮红队测量框架，把护栏行为记成逐轮合规轨迹，并同时测量评审是否一致。要处理的问题是：单轮二元通过或失败既看不到持续对抗下安全属性如何变化，也分不开拒答逐步巩固和分数保持稳定。作者认为真实使用中的对手会改写并持续多轮。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2603.20198

    研究者提出 MM-Plan 多模态越狱框架

    提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标

    arXiv
    2603.20198
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Llama-3.2-11B, InternVL3-8B, Qwen3-VL-8B and others8
    Abstract作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。

    MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2512.19016

    DREAM 框架用跨环境长链攻击评测 12 个 LLM Agent

    提出 DREAM 框架，评测 Agent 的跨环境长链攻击脆弱性

    arXiv
    2512.19016
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Gemini-2.5-Flash-NT, o4-mini, Gemini-2.5-Flash and others12

    AbstractDREAM 提出基于知识图谱与策略搜索的动态红队框架，分析了长链跨环境攻击对当前主流智能体的系统性威胁。

    Paper analysisRead analysis
You have reached the end