Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 17 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Attack technique：Role-play and persuasion Attack technique：Dormant triggers Attack surface / entry point：Documents and messages Attack surface / entry point：Code repositories and dependencies Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
AttacksarXiv 2609.38270Sep 29
VirusCascade：劫持 LLM 推荐智能体的协同反思机制
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
arXiv
2609.38270
Published
Sep 29
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
AgentCF, AgentSEQ, AgentRAG and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。
VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
Paper analysisRead analysis
AttacksarXiv 2609.35576Sep 29
研究提出跨 LLM 助手的记忆跳跃攻击
提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播
arXiv
2609.35576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Luna, Kimi-K2.6, GPT-OSS-120B and others6
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。
该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。
Paper analysisRead analysis
AttacksarXiv 2609.22510Sep 19
特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent
提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse
arXiv
2609.22510
Published
Sep 19
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentGuardrails and judges
Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。
论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。
Paper analysisRead analysis
AttacksarXiv 2609.19722Sep 17
ALIBI：向二进制注入虚假安全叙事可让 LLM 恶意软件分析器误判
提出 ALIBI，向恶意二进制注入不执行掩护叙事使分析器误判为良性
arXiv
2609.19722
Published
Sep 17
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Gemini 2.5 Pro, GPT-5.5 Pro, Claude Opus 4.7
- AttacksDetection evasion
- TechniqueRole-play and persuasion
AbstractALIBI 用二进制内的掩护叙事重释可疑静态证据，Gemini 上翻转多，另两模型主要为降级。
ALIBI 是针对 LLM 恶意软件分诊的语义掩护叙事攻击：不覆盖系统指令，而把仍可见的可疑静态证据重释成良性安全产品的预期行为。
Paper analysisRead analysis
AttacksarXiv 2609.13889Sep 12
PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
arXiv
2609.13889
Published
Sep 12
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
Paper analysisRead analysis
AttacksarXiv 2609.02774Sep 3
CodePoisonRAG：针对检索增强代码生成的知识投毒攻击
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
arXiv
2609.02774
Published
Sep 3
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 9B, Code Llama 13B, DeepSeek-Coder-V2 16B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
AbstractCodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2607.06595Jul 7
When Agents Remember Too Much: Memory Poisoning Attacks against Large Language Model Agents
Proposed GhostWriter memory poisoning, which writes into the agent's long-term memory via email and calendar and activates across sessions
arXiv
2607.06595
Published
Jul 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4-mini, DeepSeek-V4-Flash, Gemini-2.5-Flash and others4
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2607.05189Jul 6
Researchers propose MemGhost, achieving covert memory injection into persistent personal agents
提出 MEMGHOST，用单封邮件对持久个人 Agent 做跨会话隐蔽记忆注入
arXiv
2607.05189
Published
Jul 6
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Claude Sonnet 4.5 and others6
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMemory
Abstract总结了论文的研究背景、双代理优化方法 MEMGHOST、全周期实验结果以及作者对记忆信任边界的启示。
本文研究了持久化个人智能体面临的隐蔽记忆注入威胁，提出了一套兼顾写入、隐蔽与跨会话生效的自动化生成框架与全周期评测基准。
Paper analysisRead analysis
AttacksarXiv 2606.04329Jun 3
研究者系统研究 LLM 智能体记忆投毒攻击并提出 MPBench 基准
系统研究 LLM 智能体记忆投毒并构建基准 MPBench
arXiv
2606.04329
Published
Jun 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Meta-Llama-3.1-70B-Instruct, Deberta-v3-base, Llama-3.1-8B-Instruct and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。
Paper analysisRead analysis
AttacksarXiv 2605.24421May 23
研究者提出日志型提示注入攻击，可抑制 SOC 中 LLM 分析助手的恶意日志识别
提出日志基底提示注入，操纵 SOC 分析员的分类、摘要与处置建议
arXiv
2605.24421
Published
May 23
Layer
Application layer
Setting
LLM applications
Evaluated models
gpt-4o-mini
- AttacksPrompt injection
- TechniqueConversation structure manipulation
Abstract在 gpt-4o-mini 上，人格劫持与上下文操纵可改写 SOC 分析输出，直接覆盖在分类上无效。
Paper analysisRead analysis
AttacksarXiv 2605.15338May 15
Hidden in Memory: Latent Memory Poisoning of LLM Agents
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
arXiv
2605.15338
Published
May 15
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。
sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
Paper analysisRead analysis
AttacksarXiv 2601.21360Jan 29
Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation
提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分
arXiv
2601.21360
Published
Jan 29
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-V3.2, Qwen3-235B, GPT-OSS-120B and others9
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract作者称 RLHF 的服从性使评分脱离代码。
这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。
Paper analysisRead analysis
AttacksarXiv 2512.10449Dec 11, 2025
研究：不可见文本注入可让 LLM 审稿系统把拒稿翻成接收
提出 DSAAP，以不可见文本对科学审稿 PDF 做间接提示注入
arXiv
2512.10449
Published
Dec 11, 2025
Layer
Application layer
Setting
LLM applications
Evaluated models
gpt-oss-20B, tulu3-8B, Llama 3.1-8B and others13
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2509.22040Sep 26, 2025
研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入
通过规则文件提示注入劫持编码编辑器并执行未授权终端命令
arXiv
2509.22040
Published
Sep 26, 2025
Layer
Application layer
Setting
coding agent
Evaluated models
Cursor, GitHub Copilot, Claude 4 Sonnet and others4
- AttacksPrompt injection
- TechniqueRole-play and persuasion
Abstract论文提出了针对代码编辑器的提示注入评估框架 AIShellJack，实验显示攻击能诱导 AI 执行未授权终端命令。
Paper analysisRead analysis
AttacksarXiv 2509.05372Sep 4, 2025
研究：对抗性 bug 报告可诱导 LLM 自动程序修复系统生成不安全补丁
用对抗缺陷报告诱导自动程序修复系统生成不安全补丁
arXiv
2509.05372
Published
Sep 4, 2025
Layer
Application layer
Setting
coding agent
Evaluated models
claude-sonnet-4-20250514, o4-mini, GPT-4.1-mini and others8
- AttacksPrompt injection
- TechniqueRole-play and persuasion
- ComponentGuardrails and judges
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attack surface / entry point

Layer

System component

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

VirusCascade：劫持 LLM 推荐智能体的协同反思机制

研究提出跨 LLM 助手的记忆跳跃攻击

特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent

ALIBI：向二进制注入虚假安全叙事可让 LLM 恶意软件分析器误判

PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

CodePoisonRAG：针对检索增强代码生成的知识投毒攻击

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

When Agents Remember Too Much: Memory Poisoning Attacks against Large Language Model Agents

Researchers propose MemGhost, achieving covert memory injection into persistent personal agents

研究者系统研究 LLM 智能体记忆投毒攻击并提出 MPBench 基准

研究者提出日志型提示注入攻击，可抑制 SOC 中 LLM 分析助手的恶意日志识别

Hidden in Memory: Latent Memory Poisoning of LLM Agents

Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation

研究：不可见文本注入可让 LLM 审稿系统把拒稿翻成接收

研究：通过编码规则文件对Cursor与GitHub Copilot实施提示注入

研究：对抗性 bug 报告可诱导 LLM 自动程序修复系统生成不安全补丁