Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 32 papers
Filter6

Attack type

Jailbreaks6Prompt injection9Detection evasion7

Attack technique

Gradient and representation optimization30Automated search13Multi-turn escalation5Encoding and obfuscation16Conversation structure manipulation0Cross-modal payloads59Dormant triggers2

Impact

Harmful content5Output manipulation22

System type

Models and APIs22AI Agent8web agent3Embodied systems and robotics4

Attacker access

Black-box5White-box4

Attack surface / entry point

User input40Web pages and interfaces10Documents and messages13Tool responses9Tool and skill descriptions6Code repositories and dependencies6Retrieval corpus9Memory writes19Images, audio and video32Weights and gradients6Distribution channels8

Layer

Prompt layer25Application layer7Training and data layer5

System component

Vision25Audio4Multimodal30
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Conversation structure manipulationAttack technique：Dormant triggersAttack surface / entry point：Images, audio and videoLayer：Prompt layerLayer：Application layerClear all

Another 201papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  8. AttacksarXiv 2608.10393

    DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

    提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作

    arXiv
    2608.10393
    Published
    Layer
    Prompt layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-7B, π0-FAST, openvla-7B
    AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。

    DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2607.19855

    研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测

    提出最小范数攻击集成，用鲁棒性曲线评测图像分类器

    arXiv
    2607.19855
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    C1–C20（CIFAR-10，Table 1）, I1–I10（ImageNet，Table 1）
    Abstract预算可控的最小范数集成用 AOI 逼近攻击前沿，DOI 给出不依赖单一ε的防御排序。

    这篇工作把对抗鲁棒评测从单一 ε、固定集成，改成可按查询预算收紧的曲线估计。

    Paper analysisRead analysis
  10. AttacksarXiv 2606.12716

    PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

    提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令

    arXiv
    2606.12716
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
    AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。

    PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。

    Paper analysisRead analysis
  11. AttacksarXiv 2605.21541

    研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果

    提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击

    arXiv
    2605.21541
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
    AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。

    FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。

    Paper analysisRead analysis
  14. AttacksarXiv 2605.07399

    研究者提出 GPO-V，用全局概率优化越狱扩散视觉语言模型

    提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型

    arXiv
    2605.07399
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    LLaDA-V, LaViDA
    Abstract作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。

    GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。。

    Paper analysisRead analysis
  15. AttacksarXiv 2604.14604

    The AudioHijack framework achieves covert audio prompt injection against 13 speech large models

    提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入

    arXiv
    2604.14604
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    SpeechGPT, GLM-4-Voice, VITA-Audio and others15

    Abstract提出了 AudioHijack 框架，揭示了 LALM 对听觉提示注入的脆弱性与传统防御的局限。

    Paper analysisRead analysis
  16. AttacksarXiv 2604.03117

    Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models

    Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.

    arXiv
    2604.03117
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
    AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.

    UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.

    Paper analysisRead analysis
  19. AttacksarXiv 2603.16960

    Adversarial attacks against modern vision-language models

    Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases

    arXiv
    2603.16960
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-7B, Qwen2.5-VL-7B
    AbstractThe authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.

    The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

    Paper analysisRead analysis
Load more