Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 84 papers
Filter3

Attack type

Jailbreaks54Prompt injection3Detection evasion11

Attack technique

Gradient and representation optimization34Automated search50Multi-turn escalation22Encoding and obfuscation42Role-play and persuasion24Conversation structure manipulation9Reasoning-chain manipulation9Cross-modal payloads45Defense-targeted8

Impact

Harmful content53Output manipulation23Availability and reliability5

System type

Models and APIs78AI Agent5Embodied systems and robotics5

Attacker access

Black-box45Gray-box5White-box12No-box (offline transfer)3

Attack surface / entry point

User input60Images, audio and video35

Layer

Prompt layer84Model layer14Application layer73Training and data layer3

System component

Guardrails and judges13Reasoning chains3Vision27Audio5Image generation6Multimodal40
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 262papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Automated searchLayer：Prompt layerClear all

Another 262papers do not have category tags yet and are not included in filtered results.

  3. AttacksarXiv 2610.07323

    ATLAS：用自适应信任域与主动学习搜索潜在对抗样本集

    提出 ATLAS 用水平集估计恢复黑盒分类器的对抗输入集合

    arXiv
    2610.07323
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    LeNet5, ResNet50 (CIFAR-10 standard), ResNet50 (ImageNet standard) and others5
    AbstractATLAS 用主动水平集估计构造黑盒对抗集，作者称其集合比单点攻击更具代表性。

    ATLAS 是一个查询式 black-box 框架，用来构造诱发失败的对抗输入集合，供鲁棒性审计使用。

    Paper analysisRead analysis
  9. AttacksarXiv 2609.36474

    FinRT：将自适应红队策略蒸馏为消费金融领域的可复用对抗生成器

    提出 FinRT，将消费金融自适应红队轨迹蒸馏为可复用对抗提示生成器

    arXiv
    2609.36474
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Llama-3.3-70B, Llama-3.1-8B, Mixtral-8x7B and others6
    AbstractFinRT 用前向失效发现加校准代理 DPO，把消费金融红队收成单次前向生成器。

    FinRT 是面向消费金融的红队框架：先发现政策失效，再训练一个按政策、领域与目标行为出提示的生成器。

    Paper analysisRead analysis
  11. AttacksarXiv 2609.29948

    ENDOPROMPT：用受害者侧伪参考学习降低模型任务效用的前缀

    提出 ENDOPROMPT，以受害者侧伪参考学习降低良性任务效用的前缀

    arXiv
    2609.29948
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-7B, Llama-3.1-8B, Mistral-7B-v0.3 and others4
    Abstract作者用受害模型续写监督良性效用攻击，并把行为位移、任务退化与请求匹配效果分开评测。

    ENDOPROMPT 是一种用受害模型自身续写监督前缀生成的 white-box 效用攻击方法。它针对良性任务失败，不要求产生有害内容或明确拒答。

    Paper analysisRead analysis
  12. InterpretabilityarXiv 2609.24801

    研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定

    用词级归因指导同义词替换，翻转提示注入检测并验证越狱

    arXiv
    2609.24801
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Prompt Guard 2 (86M), Llama 3.1 8B

    Abstract作者称检测靠分散的词法线索。

    Paper analysisRead analysis
  16. AttacksarXiv 2609.02172

    BOSS：以广度优先后缀搜索改进 GCG 越狱优化

    提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化

    arXiv
    2609.02172
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Llama-2-7B-Chat, Yi-1.5-9B-Chat, Qwen2-7B-Instruct and others8
    AbstractBOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。

    BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。

    Paper analysisRead analysis
  18. AttacksarXiv 2609.01168

    CRACK：用多智能体辩论越狱多层安全过滤的 T2I 模型

    提出 CRACK，用多智能体辩论在黑盒下越狱文生图多层安全过滤

    arXiv
    2609.01168
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Stable Diffusion v1.4, SDXL, DALL·E 3 and others4
    AbstractCRACK 以分层诊断的多智能体辩论搜索多层 T2I 过滤器的联合规避区域。

    CRACK 是面向文本生成图像模型多层安全栈的黑盒越狱框架，用几何上的 Detection Surface 解释为何粗粒度反馈不够。

    Paper analysisRead analysis
Load more