Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 39 papers

Filter4

Attack type

Prompt injection21 Poisoning and backdoors25 Extraction and theft3

Attack technique

Gradient and representation optimization4 Automated search7 Encoding and obfuscation4 Dormant triggers4

Defense type

Detection and filtering5 Permissions and approval3

Impact

Unauthorized actions6 Data and privacy leaks3 Output manipulation28

System component

Memory4 RAG27 Guardrails and judges4 Permissions and sandboxing4 Embeddings7

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 219papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Retrieval corpus Layer：Prompt layer Layer：Model layer Layer：Application layer Clear all

Another 219papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08571Oct 6
RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准
提出 RAG-PIBench，评测 RAG 上下文中提示注入检测器
arXiv
2610.08571
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
DistilBERT-base-uncased, DeBERTa-v3-base, MiniLM
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05840Oct 5
研究：任务范围授权可将工具调用有害执行降至零
用配对回放评测任务范围授权能否阻断越权工具执行
arXiv
2610.05840
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.2 3B Instruct Q4 K M, Qwen3 4B Instruct, Gemma 3 4B and others8
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.05826Oct 5
研究者提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
arXiv
2610.05826
Published
Oct 5
Layer
Application layer
Setting
LLM applications
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract用截止期限制未核验可见时长。
这篇工作给持续摄入的 RAG 向量库一个失败关闭的临时可见性协议，把协议能限制的未核验暴露和依赖检测器的中毒暴露分开。
Paper analysisRead analysis
AttacksarXiv 2610.02373Oct 2
HDI 攻击：篡改 GraphRAG 辅助结构可致 88–94% 攻击成功率
提出 HDI 攻击以篡改 GraphRAG 辅助结构破坏检索
arXiv
2610.02373
Published
Oct 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Microsoft GraphRAG, HippoRAG2
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract论文形式化了 GraphRAG 辅助模式级实体攻击面，提出 HDI 攻击并验证其攻击效果。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39146Sep 30
MADBench：多智能体辩论安全性评测基准发布
提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响
arXiv
2609.39146
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gpt-4o, GPT-5, GPT-6 Astra
- AttacksPrompt injection
- ComponentRAG
AbstractMADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。
MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。
Paper analysisRead analysis
InterpretabilityarXiv 2609.37737Sep 29
研究用因果激活修补定位模型服从提示注入指令的决策层
用因果激活修补定位模型服从提示注入的决策层
arXiv
2609.37737
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3-14B, Qwen3-32B and others7
- AttacksPrompt injection
Abstract合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。
这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。。
Paper analysisRead analysis
DefensesarXiv 2609.37196Sep 29
ToolFence：为工具调用 LLM Agent 提供细粒度授权
提出 ToolFence，以能力蓝图和确定性授权拦截 Agent 未授权工具调用
arXiv
2609.37196
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-max, GPT-4o (gpt-4o-2024-08-06), Mistral-Small-3.1-24B-Instruct-2503
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2609.35155Sep 28
LENS：检索增强生成中集合级投毒的整体危害大于各部分之和
提出 LENS，构造集合级 RAG 语料投毒以导向预设答案
arXiv
2609.35155
Published
Sep 28
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3.6-35B-A3B, Llama-3.1-70B-Instruct, DeepSeek-V4-Pro
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2609.34245Sep 28
研究者提出面向结构化 Agent 动作的多源完整性认证方法
提出多源完整性认证器，在结构化 Agent 动作执行前按控制域决定准入或弃权
arXiv
2609.34245
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro and others5
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract作者给出条件性的动作完整性认证。
这是一项结构化动作执行前的完整性防御研究，对象是从可腐化文档和工具输出拼装的支付等特权动作。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.24662Sep 21
DUMA-Bench：评估 LLM Agent 安全的双控多智能体基准
提出双控多智能体基准 DUMA-Bench，测量对抗环境下的策略违反
arXiv
2609.24662
Published
Sep 21
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5, GPT-5-mini, GPT-5-nano and others14
- AttacksPrompt injection
AbstractDUMA-Bench 用双控交互评测智能体安全。
DUMA-Bench 把 τ²-bench 的双控交互做成智能体安全评测，用来看策略违反如何随用户、模型和环境一起出现。
Paper analysisRead analysis
DefensesarXiv 2609.21088Sep 18
Provenance-Aware Transformers：用来源感知架构分离可信边界以防御间接提示注入
提出 Provenance-Aware Transformers，隔离不可信来源防御间接提示注入
arXiv
2609.21088
Published
Sep 18
Layer
Application layer
Setting
LLM applications
Evaluated models
SmolLM2-360M-Instruct, LLaMA-3-8B-Instruct, Qwen2.5-7B-Instruct and others4
- DefensesInstruction–data separation
- AttacksPrompt injection
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
DefensesarXiv 2609.10707Sep 10
面向 AI-SOC 的神经符号防御框架：用 SIEM 解码器与 NeMo Guardrails 阻断日志投毒提示注入
提出神经符号纵深架构，阻断 AI-SOC 的日志投毒与间接提示注入
arXiv
2609.10707
Published
Sep 10
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma 3 (12B)
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2609.04767Sep 4
SHAQ: Privacy-preserving retrieval in vector databases using shadow queries
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
arXiv
2609.04767
Published
Sep 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
GTR-T5 encoder, DPR
- AttacksExtraction and theft
- ComponentEmbeddings
AbstractSHAQ replaces document embeddings with shadow query embeddings.
SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.02316Sep 2
Counter-GEO-Bench：现有护栏难挡 GEO 虚假信息
构建 COUNTER-GEO-BENCH，评测生成式搜索中的 GEO 虚假信息防御
arXiv
2609.02316
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma-4-31B-IT, Qwen-3.5-35B-A3B, Llama-4-Scout-17B-16E and others8
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Abstract论文构建了针对 GEO 虚假信息的首个防御基准，揭示通用护栏的失效与反作用，并提出了有效的轻量对比检测基线。
Paper analysisRead analysis
DefensesarXiv 2609.02127Sep 2
论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史
提出类型化溯源与断言护栏，约束持久 Agent 释放自传断言
arXiv
2609.02127
Published
Sep 2
Layer
Application layer
Setting
AI Agent
- DefensesWatermarking and provenance
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.01325Sep 1
VerTox：用可验证奖励引导的强化学习对神经排序模型实施语料投毒
提出 VerTox，用可验证奖励强化学习生成误导文档并投毒检索语料
arXiv
2609.01325
Published
Sep 1
Layer
Application layer
Setting
LLM applications
Evaluated models
SimLM-base, BGE-base, Cohere-embed-english-v3.0 and others8
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentRAG
AbstractVerTox 以可验证奖励微调小 LLM，生成能抬高排序并腐蚀事实的投毒文档。
VerTox 用可验证奖励把小 LLM 微调成语料投毒生成器，用来探测神经排序器在注入文档下的暴露面。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attack surface / entry point

Layer

System component