Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 155 papers

Filter4

System component

MCP and skills53 Memory6 Guardrails and judges28 Monitors7 Reasoning chains4 Permissions and sandboxing17 Vision67 Audio13 Video6 Image generation9 Multimodal89

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool and skill descriptions Attack surface / entry point：Images, audio and video Layer：Prompt layer Layer：Application layer Clear all

Another 255papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.13333Oct 9
LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
arXiv
2610.13333
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
- AttacksMalicious use
- ComponentImage generation
AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.
LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Paper analysisRead analysis
AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。
作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
Paper analysisRead analysis
AttacksarXiv 2610.09708Oct 7
研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率
提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
arXiv
2610.09708
Published
Oct 7
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
OpenVLA, UniVLA, π0.5
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2610.08098Oct 6
CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移
提出 CORSA，按任务簇优化技能注入的检索与执行
arXiv
2610.08098
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Qwen3.8-27B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07939Oct 6
CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it
提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别
arXiv
2610.07939
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C2P-CLIP, ForgeLens, D3-Im and others10
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2610.07323Oct 6
ATLAS：用自适应信任域与主动学习搜索潜在对抗样本集
提出 ATLAS 用水平集估计恢复黑盒分类器的对抗输入集合
arXiv
2610.07323
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LeNet5, ResNet50 (CIFAR-10 standard), ResNet50 (ImageNet standard) and others5
- AttacksDetection evasion
- TechniqueAutomated search
AbstractATLAS 用主动水平集估计构造黑盒对抗集，作者称其集合比单点攻击更具代表性。
ATLAS 是一个查询式 black-box 框架，用来构造诱发失败的对抗输入集合，供鲁棒性审计使用。
Paper analysisRead analysis
AttacksarXiv 2610.06814Oct 6
TAPDreamer：可跨任务迁移的世界动作模型对抗补丁
TAPDreamer 用公开编码器做固定补丁。
arXiv
2610.06814
Published
Oct 6
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
FastWAM, DreamWAM-uncond, DreamWAM-joint and others4
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
Analysis and theoryarXiv 2610.06001Oct 5
AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks
提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入
arXiv
2610.06001
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。
本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。
Paper analysisRead analysis
AttacksarXiv 2610.05943Oct 5
CRIME 框架利用良性 Agent 技能组合诱发恶意行为
提出 CRIME 框架，组合良性 Agent 技能诱发恶意行为
arXiv
2610.05943
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GPT-4o-mini, GPT-4o and others6
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentMCP and skills
Abstract良性技能经 DCA 或 ACA 组合后可产生恶意环境后果，单独审查对不上。
CRIME 把公共技能库中各自通过审查的技能配成两两组合，看联合执行能否实现指定恶意任务。。
Paper analysisRead analysis
DefensesarXiv 2610.05870Oct 5
MBZUAI 提出可校准的真实图像认证方法
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
arXiv
2610.05870
Published
Oct 5
Layer
Application layer
Setting
LLM applications
Attacker
White-box
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentImage generation
Abstract论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.07009Oct 4
研究受控拆解图像到文本越狱中图像属性的作用
固定有害指令，单轴归因图像到文本越狱的图像属性
arXiv
2610.07009
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4o, Claude Sonnet 4.5, Qwen3-VL-8B-Instruct and others6
- AttacksJailbreaks
- ComponentVision
Abstract固定文本的图像越狱拆解，只在 Qwen 上给出一条有界相关性归因。
Paper analysisRead analysis
DefensesarXiv 2610.05163Oct 4
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
arXiv
2610.05163
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.07005Oct 4
研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因
遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联
arXiv
2610.07005
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2-Audio-7B-Instruct, LLaMA-Omni
- AttacksJailbreaks
- ComponentAudio
AbstractAdvWave-P 的八频带排序与能量相关。
这是对加性音频越狱 AdvWave-P 的频率与解码器深度审计，受害模型主要是 Qwen2-Audio-7B-Instruct，不提出新攻击。
Paper analysisRead analysis
AttacksarXiv 2610.06977Oct 4
IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法
提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
arXiv
2610.06977
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-VL-7B, Qwen2.5-VL-72B, InternVL3-14B and others17
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2610.06966Oct 4
APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.
提出 APEX，在执行边界用授权契约防御 Agent 间接提示注入
arXiv
2610.06966
Published
Oct 4
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GLM-5.2, GPT-5.6-sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

An exploration of attacks on AI agent systems

研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率

PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

WebMirage hijacks visual web agents' browser operations with adversarial images

STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击

CORSA：面向技能路由器的技能注入攻击可跨路由器与 LLM 迁移

CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it

HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.

ATLAS：用自适应信任域与主动学习搜索潜在对抗样本集

TAPDreamer：可跨任务迁移的世界动作模型对抗补丁

AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks

CRIME 框架利用良性 Agent 技能组合诱发恶意行为

MBZUAI 提出可校准的真实图像认证方法

研究受控拆解图像到文本越狱中图像属性的作用

Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因

IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法

APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.