Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 66 papers
Filter5

Attack type

Jailbreaks52Prompt injection5Poisoning and backdoors3Detection evasion7

Attack technique

Gradient and representation optimization18Automated search67Multi-turn escalation29Encoding and obfuscation49Role-play and persuasion26Conversation structure manipulation11Reasoning-chain manipulation9Cross-modal payloads28Defense-targeted19Dormant triggers11Selection manipulation3

Impact

Harmful content53Data and privacy leaks3Output manipulation8

System type

Models and APIs55LLM applications3AI Agent8

Attacker access

Black-box35White-box12

Attack surface / entry point

User input66Web pages and interfaces6Documents and messages6Tool responses6Tool and skill descriptions5Retrieval corpus8Memory writes3Inter-agent messages3Images, audio and video44Weights and gradients3Distribution channels5

Layer

Prompt layer56Application layer10

System component

Memory3Guardrails and judges18Vision15Image generation7Multimodal22
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Encoding and obfuscationAttack surface / entry point：User inputLayer：Prompt layerLayer：Application layerClear all

Another 255papers do not have category tags yet and are not included in filtered results.

  1. Evaluation and benchmarksarXiv 2610.11766

    研究提出意图恢复率作为 LLM 安全评测的补充指标

    提出 IRIS，用意图恢复率区分遮蔽越狱下无害输出的原因

    arXiv
    2610.11766
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-4o, Claude Sonnet 4.5, Claude Opus 4.5 and others6
    Abstract无害输出的证据权重取决于任务是否被恢复。

    IRIS 把意图恢复当作中间信号，用来解释意图遮蔽提示下为何没有出现有害协助。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.12524

    An exploration of attacks on AI agent systems

    重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择

    arXiv
    2610.12524
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
    Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。

    作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。

    Paper analysisRead analysis
  4. Evaluation and benchmarksarXiv 2610.09033

    研究发布 ASRD 数据集，评测五款开源模型在非规范输入下的安全表现

    arXiv
    2610.09033
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 2 9B, Gemma 3 4B, Llama 3.1 8B and others6
    Abstract五模型、七族表面形式的四态评测里，低有害遵从不等于读懂后的安全处理。

    ASRD 用四态标签检查五个开源模型如何处理非规范表面上的有害请求。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.04589

    StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

    提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道

    arXiv
    2610.04589
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13

    Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.02302

    研究者提出意图隐藏越狱的信息论框架，分析组合式攻击

    提出组合式意图隐藏越狱，按先验后验匹配选择辅助任务

    arXiv
    2610.02302
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others7
    Abstract用信息论选含目标的任务组合，再看查询能否既隐藏意图又让目标被执行。

    这篇工作把组合式意图隐藏写成任务选择：有害目标必须留在 bundle 里，同时让估计的有害意图概率贴近全集先验，或降到阈值以下。

    Paper analysisRead analysis
  8. AttacksarXiv 2609.38253

    CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.

    提出 CollageAttack，用空间文本碎片重组越狱文生图模型

    arXiv
    2609.38253
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5

    Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。

    Paper analysisRead analysis
  9. InterpretabilityarXiv 2609.24801

    研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定

    用词级归因指导同义词替换，翻转提示注入检测并验证越狱

    arXiv
    2609.24801
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Prompt Guard 2 (86M), Llama 3.1 8B

    Abstract作者称检测靠分散的词法线索。

    Paper analysisRead analysis
  10. AttacksarXiv 2609.09553

    研究：任意密文攻击前沿大模型无需微调即可越狱

    提出任意字母置换密码越狱，无需微调即可诱导有害输出

    arXiv
    2609.09553
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7

    Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。

    Paper analysisRead analysis
  11. AttacksarXiv 2609.07216

    DIVA：利用视觉锚点对视频生成模型实施多模态越狱

    提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型

    arXiv
    2609.07216
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Wan, CogVideoX, LTX-Video and others9
    AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。

    DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。

    Paper analysisRead analysis
  12. Evaluation and benchmarksarXiv 2609.05843

    SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准

    提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性

    arXiv
    2609.05843
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
    AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。

    SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。

    Paper analysisRead analysis
  13. AttacksarXiv 2609.02172

    BOSS：以广度优先后缀搜索改进 GCG 越狱优化

    提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化

    arXiv
    2609.02172
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Llama-2-7B-Chat, Yi-1.5-9B-Chat, Qwen2-7B-Instruct and others8
    AbstractBOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。

    BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。

    Paper analysisRead analysis
  16. AttacksarXiv 2608.07430

    研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱

    提出 SN-Guided Diffusion，利用安全神经元实现离线越狱

    arXiv
    2608.07430
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box, White-box
    Evaluated models
    Qwen2.5-7B-Instruct, LLaDA-8B-Instruct, Dream-Instruct-7B and others15
    Abstract论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。

    论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。

    Paper analysisRead analysis
  19. AttacksarXiv 2607.23496

    Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景

    提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景

    arXiv
    2607.23496
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B and others6

    Abstract该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。

    Paper analysisRead analysis
Load more