AttacksarXiv 2610.09708
研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率
提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
- arXiv
- 2610.09708
- Published
- Layer
- Prompt layer
- Evaluated models
- OpenVLA, UniVLA, π0.5
- TechniqueGradient and representation optimization
- ComponentVision
All papers
Filter4
Attack type
Attack technique
Impact
System type
Attacker access
Attack surface / entry point
Layer
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.
Another 261papers do not have category tags yet and are not included in filtered results.
- AttacksarXiv 2610.08331
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
- arXiv
- 2610.08331
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- No-box (offline transfer)
- Evaluated models
- Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
- AttacksarXiv 2610.06814
TAPDreamer：可跨任务迁移的世界动作模型对抗补丁
TAPDreamer 用公开编码器做固定补丁。
- arXiv
- 2610.06814
- Published
- Layer
- Prompt layer
- Evaluated models
- FastWAM, DreamWAM-uncond, DreamWAM-joint and others4
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2610.06083
研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击
提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报
- arXiv
- 2610.06083
- Published
- Layer
- Model layer
- Evaluated models
- DQN, Double DQN (DDQN)
Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。
这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。
- AttacksarXiv 2610.05894
研究者提出闭环偏见注入攻击
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
- arXiv
- 2610.05894
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- Gray-box
- Evaluated models
- LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
- AttacksarXiv 2610.06977
IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法
提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
- arXiv
- 2610.06977
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-VL-7B, Qwen2.5-VL-72B, InternVL3-14B and others17
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2610.03166
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
- arXiv
- 2610.03166
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
- AttacksarXiv 2610.01062
Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架
提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱
- arXiv
- 2610.01062
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-7B-Instruct, Gemma-2-9B-IT, Llama-3.1-8B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
AbstractKAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。
Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。
- AttacksarXiv 2609.36956
研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
- arXiv
- 2609.36956
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- GLM-5, Gemini-3.5-Flash, Qwen3-32B and others4
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Abstract作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。
BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架，研究没有目标数值概率时，采样能否支持逐步控制。
- AttacksarXiv 2609.29775
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
- arXiv
- 2609.29775
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
- arXiv
- 2609.24801
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Prompt Guard 2 (86M), Llama 3.1 8B
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentGuardrails and judges
Abstract作者称检测靠分散的词法线索。
- AttacksarXiv 2609.08373
结构越狱可跨厂商泛化但不叠加：IICL 的跨厂商与多语言研究
检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
- arXiv
- 2609.08373
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- gemini-2.5-flash, gemini-2.5-flash-lite
- AttacksJailbreaks
- TechniqueConversation structure manipulation
- AttacksarXiv 2609.02172
BOSS：以广度优先后缀搜索改进 GCG 越狱优化
提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化
- arXiv
- 2609.02172
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama-2-7B-Chat, Yi-1.5-9B-Chat, Qwen2-7B-Instruct and others8
- AttacksJailbreaks
- TechniqueGradient and representation optimization
AbstractBOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。
BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。
- AttacksarXiv 2609.05525
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
- arXiv
- 2609.05525
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2608.10393
DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型
提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作
- arXiv
- 2608.10393
- Published
- Layer
- Prompt layer
- Evaluated models
- OpenVLA-7B, π0-FAST, openvla-7B
- TechniqueCross-modal payloads
- ComponentVision
AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。
DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。
- AttacksarXiv 2608.09867
Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
- arXiv
- 2608.09867
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13
- AttacksExtraction and theft
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
- AttacksarXiv 2608.07430
研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱
提出 SN-Guided Diffusion，利用安全神经元实现离线越狱
- arXiv
- 2608.07430
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-7B-Instruct, LLaDA-8B-Instruct, Dream-Instruct-7B and others15
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。
论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。
- AttacksarXiv 2608.03642
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
- arXiv
- 2608.03642
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- AttacksarXiv 2607.23496
Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景
提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
- arXiv
- 2607.23496
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B and others6
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。
研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测
提出最小范数攻击集成，用鲁棒性曲线评测图像分类器
- arXiv
- 2607.19855
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- C1–C20（CIFAR-10，Table 1）, I1–I10（ImageNet，Table 1）
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Abstract预算可控的最小范数集成用 AOI 逼近攻击前沿，DOI 给出不依赖单一ε的防御排序。
这篇工作把对抗鲁棒评测从单一 ε、固定集成，改成可按查询预算收紧的曲线估计。