Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 7 papers
Filter5

Attack type

Prompt injection6

Attack technique

Gradient and representation optimization3Automated search17Encoding and obfuscation7Role-play and persuasion6Dormant triggers12

Impact

Output manipulation4

System type

LLM applications3AI Agent4

Attack surface / entry point

User input7Documents and messages4Tool responses4Tool and skill descriptions5Code repositories and dependencies2Retrieval corpus4Memory writes3Inter-agent messages2Distribution channels5

Layer

Application layer7
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 247papers have no tags yet and are not included in filtered results.
Attack technique：Encoding and obfuscationAttack surface / entry point：Documents and messagesAttack surface / entry point：Code repositories and dependenciesAttack surface / entry point：Inter-agent messagesLayer：Application layerClear all

Another 247papers do not have category tags yet and are not included in filtered results.

  3. AttacksarXiv 2603.00131

    Thought Virus：多 Agent 系统中潜意识提示引发的病毒式失准

    提出 Thought Virus，经潜意识提示使偏好沿多 Agent 消息传播

    arXiv
    2603.00131
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct
    AbstractThought Virus 把单点偏差传到下游。

    Thought Virus 把 subliminal prompting 放进多智能体通信，看单点偏差会不会在不点名目标概念时传到全网。

    Paper analysisRead analysis
  4. AttacksarXiv 2602.18514

    招聘中的特洛伊木马：标准模型与推理模型间接提示注入的红队测试案例研究

    用简历中的不可见指令做间接提示注入，操纵招聘推荐

    arXiv
    2602.18514
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Qwen 3 30B A3B Instruct 2507, Qwen 3 30B A3B Thinking 2507

    Abstract作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。

    Paper analysisRead analysis
  5. AttacksarXiv 2601.21360

    Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation

    提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分

    arXiv
    2601.21360
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    DeepSeek-V3.2, Qwen3-235B, GPT-OSS-120B and others9
    Abstract作者称 RLHF 的服从性使评分脱离代码。

    这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。

    Paper analysisRead analysis
  7. AttacksarXiv 2509.22040

    研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入

    通过规则文件提示注入劫持编码编辑器并执行未授权终端命令

    arXiv
    2509.22040
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Cursor, GitHub Copilot, Claude 4 Sonnet and others4

    Abstract论文提出了针对代码编辑器的提示注入评估框架 AIShellJack，实验显示攻击能诱导 AI 执行未授权终端命令。

    Paper analysisRead analysis
You have reached the end