Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 11 papers

Filter6

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 203papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Encoding and obfuscation Attack surface / entry point：Documents and messages Attack surface / entry point：Training data Layer：Application layer Layer：Training and data layer Clear all

Another 203papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.01367Oct 1
研究：高质量数据筛选挡不住投毒
提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本
arXiv
2610.01367
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Abstract质量筛选挡不住部分高分样本的安全削弱。
Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。
Paper analysisRead analysis
AttacksarXiv 2609.39788Sep 30
研究：多智能体系统潜在通信链路可被训练用于提升有害顺从
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
arXiv
2609.39788
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。
学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
Paper analysisRead analysis
AttacksarXiv 2609.36576Sep 29
AdaLCPI: Making agents reconstruct indirect prompt injection from long-context fragments
提出 AdaLCPI，把恶意指令拆成碎片嵌入工具返回并诱导 Agent 越权执行
arXiv
2609.36576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, GPT-5.1, GPT-5.6-Luna and others7
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis
AttacksarXiv 2606.09499Jun 8
研究者提出针对世界模型的机器人学习管线投毒攻击
提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略
arXiv
2606.09499
Published
Jun 8
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentVideo
Abstract只改视频帧经世界模型投毒。
只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。
Paper analysisRead analysis
AttacksarXiv 2603.08104Mar 9
Invisible Security Threat: Malicious Fine-Tuning of LLMs via Steganography
提出隐写恶意微调，使模型界面显良性并隐蔽传出有害内容
arXiv
2603.08104
Published
Mar 9
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
GPT-4.1-2025-04-14, Llama-3.3-70B-Instruct, Phi-4 and others7
- AttacksModel tampering
- TechniqueEncoding and obfuscation
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2602.18514Feb 20
招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究
用简历中的不可见指令做间接提示注入，操纵招聘推荐
arXiv
2602.18514
Published
Feb 20
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentReasoning chains
Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
Paper analysisRead analysis
AttacksarXiv 2602.00364Jan 31
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
arXiv
2602.00364
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Paper analysisRead analysis
AttacksarXiv 2601.21360Jan 29
Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation
提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分
arXiv
2601.21360
Published
Jan 29
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-V3.2, Qwen3-235B, GPT-OSS-120B and others9
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract作者称 RLHF 的服从性使评分脱离代码。
这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。
Paper analysisRead analysis
AttacksarXiv 2601.20283Jan 28
One word is enough: Minimal adversarial perturbations for neural text ranking
提出查询中心词的单次插入或替换攻击，操纵神经排序名次
arXiv
2601.20283
Published
Jan 28
Layer
Application layer
Setting
LLM applications
Evaluated models
BERT-base-mdoc-BM25, monoT5-base-MSMARCO
- TechniqueGradient and representation optimization
Abstract作者称单词扰动即可抬升名次、中段文档最脆弱，且比白盒 PRADA 更少编辑。
单个与查询对齐的词，就可能改掉神经重排结果。要做的是少改原文，仍把目标文档在 NRM 列表里的名次抬高。
Paper analysisRead analysis
AttacksarXiv 2512.10449Dec 11, 2025
研究：不可见文本注入可让 LLM 审稿系统把拒稿翻成接收
提出 DSAAP，以不可见文本对科学审稿 PDF 做间接提示注入
arXiv
2512.10449
Published
Dec 11, 2025
Layer
Application layer
Setting
LLM applications
Evaluated models
gpt-oss-20B, tulu3-8B, Llama 3.1-8B and others13
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

研究：高质量数据筛选挡不住投毒

研究：多智能体系统潜在通信链路可被训练用于提升有害顺从

AdaLCPI: Making agents reconstruct indirect prompt injection from long-context fragments

PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

研究者提出针对世界模型的机器人学习管线投毒攻击

Invisible Security Threat: Malicious Fine-Tuning of LLMs via Steganography

招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究

"Someone hid it": Query-agnostic black-box attacks against LLM retrieval

Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation

One word is enough: Minimal adversarial perturbations for neural text ranking

研究：不可见文本注入可让 LLM 审稿系统把拒稿翻成接收