Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 14 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Attack technique：Conversation structure manipulation Attack technique：Selection manipulation Attack surface / entry point：User input Layer：Prompt layer Layer：Application layer Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。
作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
Paper analysisRead analysis
AttacksarXiv 2610.04985Oct 4
研究揭示 Jev 作为应用决策层的安全与隐私风险
评估应用决策层的输入注入与隐私推断风险
arXiv
2610.04985
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box, Gray-box
Evaluated models
Jev, NanoJev
- AttacksPrompt injection
- TechniqueRole-play and persuasion
AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。
Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
Paper analysisRead analysis
AttacksarXiv 2609.36956Sep 29
研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
arXiv
2609.36956
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GLM-5, Gemini-3.5-Flash, Qwen3-32B and others4
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Abstract作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。
BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架，研究没有目标数值概率时，采样能否支持逐步控制。
Paper analysisRead analysis
AttacksarXiv 2609.29775Sep 24
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
arXiv
2609.29775
Published
Sep 24
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2609.08373Sep 8
结构越狱可跨厂商泛化但不叠加：IICL 的跨厂商与多语言研究
检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
arXiv
2609.08373
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash, gemini-2.5-flash-lite
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Paper analysisRead analysis
AttacksarXiv 2609.02035Sep 2
ISM：通过语义匹配隐式操纵 LLM Agent 的技能选择
提出 ISM，用语义匹配隐式操纵 Agent 技能选择
arXiv
2609.02035
Published
Sep 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-2-7B, Llama-3-8B, Llama-3.1-8B and others8
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.09867Aug 11
Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
arXiv
2608.09867
Published
Aug 11
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13
- AttacksExtraction and theft
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
Paper analysisRead analysis
AttacksarXiv 2607.00481Jul 1
研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM
提出 SMT 框架，用模拟审核轨迹越狱函数调用 LLM
arXiv
2607.00481
Published
Jul 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o, GPT-5.4, Qwen3-Max and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
Analysis and theoryarXiv 2606.04168Jun 3
论文提出随机插入攻击，利用自回归一致性绕过 LLM 安全对齐
解释自回归一致性如何导致浅层安全对齐，并提出随机插入攻击
arXiv
2606.04168
Published
Jun 3
Layer
Prompt layer
Setting
Models and APIs
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Abstract作者用自回归一致性串起浅层对齐、插入攻击和最坏延续对齐。
作者把浅层安全对齐和一类续写攻击都归到自回归一致性上。
Paper analysisRead analysis
AttacksarXiv 2603.25164Mar 26
PIDP-Attack: Combining Prompt Injection and Database Poisoning to Attack RAG Systems
Proposes PIDP-Attack, which manipulates RAG answers using query suffixes and corpus poisoning
arXiv
2603.25164
Published
Mar 26
Layer
Application layer
Setting
LLM applications
Evaluated models
qwen/qwen2.5-7b-instruct, qwen/qwen2-7b-instruct, meta/llama-3.1-8b-instruct and others8
- AttacksPrompt injection
- TechniqueSelection manipulation
- ComponentRAG
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2511.19171Nov 24, 2025
ExistBench：用前缀补全评测 LLM 的生存性威胁输出
提出 EXISTBENCH，用前缀补全评测 LLM 生成生存威胁内容的倾向
arXiv
2511.19171
Published
Nov 24, 2025
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-32B-Instruct, Qwen2.5-72B-Instruct and others12
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Paper analysisRead analysis
AttacksarXiv 2510.10271Oct 12, 2025
MetaBreak：通过特殊 token 操纵越狱在线 LLM 服务
提出 MetaBreak，用特殊 token 操纵越狱在线 LLM 服务并绕过审核
arXiv
2510.10271
Published
Oct 12, 2025
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3.3-70B-Instruct, Qwen-2.5-72B-Instruct, Gemma-2-27B-Instruct and others10
- AttacksJailbreaks
- TechniqueConversation structure manipulation
- ComponentGuardrails and judges
Abstract利用特殊 token 注入对抗平台模板包裹与审核，多场景验证了越狱有效性与互补性。
Paper analysisRead analysis
AttacksarXiv 2509.25624Sep 30, 2025
STAC：看似无害的工具调用链如何攻破 LLM Agent
提出 STAC 框架，把恶意目标拆成多轮看似无害的工具调用链
arXiv
2509.25624
Published
Sep 30, 2025
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-4.1-2025-04-14, GPT-4.1-mini-2025-04-14, Qwen3-32B and others8
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者提出并验证了智能体在序列化工具攻击下的普遍脆弱性，指出针对累积动作序列防御的必要性。
Paper analysisRead analysis
AttacksarXiv 2505.12287May 18, 2025
多语言越狱提示词对闭源大语言模型的攻击评估：GPT-4o、DeepSeek-R1、Gemini-1.5-Pro 与 Qwen-Max
提出四段越狱提示，评测中英提示对闭源模型的绕过效果
arXiv
2505.12287
Published
May 18, 2025
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, DeepSeek-R1, Gemini-1.5-Pro and others4
- AttacksJailbreaks
- TechniqueRole-play and persuasion
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

An exploration of attacks on AI agent systems

研究揭示 Jev 作为应用决策层的安全与隐私风险

研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM

输出前缀攻击瞄准推理模型

结构越狱可跨厂商泛化但不叠加：IICL 的跨厂商与多语言研究

ISM：通过语义匹配隐式操纵 LLM Agent 的技能选择

Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM

论文提出随机插入攻击，利用自回归一致性绕过 LLM 安全对齐

PIDP-Attack: Combining Prompt Injection and Database Poisoning to Attack RAG Systems

ExistBench：用前缀补全评测 LLM 的生存性威胁输出

MetaBreak：通过特殊 token 操纵越狱在线 LLM 服务

STAC：看似无害的工具调用链如何攻破 LLM Agent

多语言越狱提示词对闭源大语言模型的攻击评估：GPT-4o、DeepSeek-R1、Gemini-1.5-Pro 与 Qwen-Max