Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 20 papers
Filter2

Attack type

Jailbreaks10Prompt injection4Extraction and theft6

Attack technique

Gradient and representation optimization64Automated search113Multi-turn escalation30Encoding and obfuscation64Role-play and persuasion34Conversation structure manipulation16Reasoning-chain manipulation13Cross-modal payloads58Side channels4Defense-targeted44Dormant triggers55Selection manipulation12

Impact

Harmful content9Data and privacy leaks6Output manipulation4

System type

Models and APIs14LLM applications4

Attacker access

Black-box11

Attack surface / entry point

User input13Inference services and hardware4

Layer

Prompt layer9Application layer5Infrastructure layer4

System component

Reasoning chains4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 262papers have no tags yet and are not included in filtered results.
Attack technique：Conversation structure manipulationAttack technique：Side channelsClear all

Another 262papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  2. AttacksarXiv 2610.09981

    研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题

    提出利用路由元数据推断敏感话题的侧信道攻击

    arXiv
    2610.09981
    Published
    Layer
    Infrastructure layer
    Setting
    LLM applications
    Evaluated models
    RouteLLM (BERT router), notdiamond-0001, Vela (vLLM Semantic Router)

    Abstract论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.06848

    TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击

    提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员

    arXiv
    2610.06848
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5

    AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.04985

    研究揭示 Jev 作为应用决策层的安全与隐私风险

    评估应用决策层的输入注入与隐私推断风险

    arXiv
    2610.04985
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box, Gray-box
    Evaluated models
    Jev, NanoJev
    AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。

    Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.36956

    研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM

    提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型

    arXiv
    2609.36956
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GLM-5, Gemini-3.5-Flash, Qwen3-32B and others4
    Abstract作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。

    BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架，研究没有目标数值概率时，采样能否支持逐步控制。

    Paper analysisRead analysis
  7. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  9. AttacksarXiv 2608.17485

    KeyPooling: Measuring where LLM API relay paths break prompt cache isolation

    Proposing KeyPooling to measure where API relays break prompt cache isolation

    arXiv
    2608.17485
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    grok-4-fast-non-reasoning, grok-4-1-fast-non-reasoning, grok-3 and others11
    AbstractShared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.

    KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.

    Paper analysisRead analysis
  10. AttacksarXiv 2608.09867

    Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

    利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链

    arXiv
    2608.09867
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13

    Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。

    Paper analysisRead analysis
  11. AttacksarXiv 2607.14493

    LogInject 框架披露 LLM 日志分析中的被动提示注入

    提出 LogInject 框架，评测日志分析中的被动提示注入及缓解

    arXiv
    2607.14493
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct

    Abstract论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。

    Paper analysisRead analysis
  13. Analysis and theoryarXiv 2606.04168

    论文提出随机插入攻击，利用自回归一致性绕过 LLM 安全对齐

    解释自回归一致性如何导致浅层安全对齐，并提出随机插入攻击

    arXiv
    2606.04168
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Abstract作者用自回归一致性串起浅层对齐、插入攻击和最坏延续对齐。

    作者把浅层安全对齐和一类续写攻击都归到自回归一致性上。

    Paper analysisRead analysis
  14. AttacksarXiv 2605.24421

    研究者提出日志型提示注入攻击，可抑制 SOC 中 LLM 分析助手的恶意日志识别

    提出日志基底提示注入，操纵 SOC 分析员的分类、摘要与处置建议

    arXiv
    2605.24421
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    gpt-4o-mini

    Abstract在 gpt-4o-mini 上，人格劫持与上下文操纵可改写 SOC 分析输出，直接覆盖在分类上无效。

    Paper analysisRead analysis
  15. InterpretabilityarXiv 2603.08234

    续写与拒答之争：大语言模型中续写触发越狱的机制分析

    分析续写触发越狱的注意力头机制并提出 HCS

    arXiv
    2603.08234
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    LLaMA-2-7B-Chat, Qwen2.5-7B-Instruct
    Abstract作者称越狱来自两类头竞争，HCS 加蒸馏可把该竞争用于推理时干预。

    作者用注意力头机制分析 continuation-triggered jailbreak：同一有害指令下，把 continuation 后缀从指令后面挪到提示词边界外，模型更容易顺着后缀继续生成。

    Paper analysisRead analysis
  16. AttacksarXiv 2602.20595

    OptiLeak：在多租户 LLM 服务中用强化学习高效重建提示词

    提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示

    arXiv
    2602.20595
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen-2.5-3B-Instruct, Qwen-2.5-7B-Instruct, Qwen-2.5-14B-Instruct and others4

    AbstractOPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。

    Paper analysisRead analysis
  18. AttacksarXiv 2510.10271

    MetaBreak：通过特殊 token 操纵越狱在线 LLM 服务

    提出 MetaBreak，用特殊 token 操纵越狱在线 LLM 服务并绕过审核

    arXiv
    2510.10271
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Llama-3.3-70B-Instruct, Qwen-2.5-72B-Instruct, Gemma-2-27B-Instruct and others10

    Abstract利用特殊 token 注入对抗平台模板包裹与审核，多场景验证了越狱有效性与互补性。

    Paper analysisRead analysis
  19. AttacksarXiv 2509.25624

    STAC：看似无害的工具调用链如何攻破 LLM Agent

    提出 STAC 框架，把恶意目标拆成多轮看似无害的工具调用链

    arXiv
    2509.25624
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    Black-box
    Evaluated models
    GPT-4.1-2025-04-14, GPT-4.1-mini-2025-04-14, Qwen3-32B and others8

    Abstract作者提出并验证了智能体在序列化工具攻击下的普遍脆弱性，指出针对累积动作序列防御的必要性。

    Paper analysisRead analysis
You have reached the end