Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 218 papers

Filter4

System component

MCP and skills14 Memory20 RAG28 Guardrails and judges19 Monitors10 Reasoning chains9 Permissions and sandboxing21 Fine-tuning and open weights36 Vision14 Audio3 Video3 Embeddings8 Multimodal20

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Documents and messages Attack surface / entry point：Retrieval corpus Attack surface / entry point：Inter-agent messages Attack surface / entry point：Training data Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
Analysis and theoryarXiv 2610.13051Oct 9
Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors
Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining
arXiv
2610.13051
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-32
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.
The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.
Paper analysisRead analysis
AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
DefensesarXiv 2610.11848Oct 8
SemField: training-free semantic watermark
Proposes the semantic watermark SemField, which still identifies the attribution of generated text after paraphrasing and structural changes.
arXiv
2610.11848
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.2-1B, Qwen3-1.7B, OPT-1.3B
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractTraining-independent document-level semantic watermark.
SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.
Paper analysisRead analysis
DefensesarXiv 2610.11634Oct 8
LTBD：用可学习信任边界分隔符防御提示注入
提出 LTBD，用可学习分隔符隔离可信指令与不可信数据
arXiv
2610.11634
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama3-8B-Instruct, Llama3.1-8B-Instruct, Falcon3-7B-Instruct and others4
- DefensesInstruction–data separation
- AttacksPrompt injection
AbstractLTBD 只训练四个分隔符嵌入。
LTBD 是一种不改基座权重的提示注入防御：只学习用来标出可信指令与不可信数据边界的四个 token 嵌入。
Paper analysisRead analysis
DefensesarXiv 2610.10345Oct 8
SLDR：通过选择性层恢复与动态路由防御恶意微调
提出 SLDR，用选择性层恢复与动态路由防御恶意微调
arXiv
2610.10345
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称 SLDR 能压低有害输出并保持下游效用。
SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。
Paper analysisRead analysis
AttacksarXiv 2610.10000Oct 7
超越奖励压制：有界奖励热启动 Bandit 的近最优离线攻击
提出热启动 Bandit 的部署前有界离线注入攻击
arXiv
2610.10000
Published
Oct 7
Layer
Training and data layer
Setting
LLM applications
Evaluated models
UCB, Thompson Sampling, ϵ-greedy
- AttacksPoisoning and backdoors
Paper analysisRead analysis
DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
DefensesarXiv 2610.09935Oct 7
AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击
提出 AgentTracer，事后定位间接提示注入的注入点并重建攻击链
arXiv
2610.09935
Published
Oct 7
Layer
Application layer
Setting
AI Agent
- DefensesMonitoring and auditing
- AttacksPrompt injection
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
DefensesarXiv 2610.09793Oct 7
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
arXiv
2610.09793
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
Paper analysisRead analysis
AttacksarXiv 2610.08951Oct 7
ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
arXiv
2610.08951
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
- AttacksPrompt injection
- TechniqueAutomated search
AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。
ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08571Oct 6
RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准
提出 RAG-PIBench，评测 RAG 上下文中提示注入检测器
arXiv
2610.08571
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
DistilBERT-base-uncased, DeBERTa-v3-base, MiniLM
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08871Oct 6
CredLeak-Bench
提出 CredLeak-Bench，评测 Agent 面对钓鱼的凭据泄露与恢复
arXiv
2610.08871
Published
Oct 6
Layer
Application layer
Setting
web agent
Evaluated models
Claude Sonnet 5, Claude Opus 4.8, Gemini 3.6 Flash and others7
- AttacksPrompt injection
Paper analysisRead analysis
AttacksarXiv 2610.07723Oct 6
Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.
提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答
arXiv
2610.07723
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。
Paper analysisRead analysis
AttacksarXiv 2610.07654Oct 6
研究揭示策略蒸馏的安全后门风险
测量带后门教师经 OPD 向干净学生迁移潜伏后门
arXiv
2610.07654
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-1.5B-Instruct, Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract作者称 OPD 可在压低无触发词有害率时迁入后门。
带后门的外部教师经 OPD，可在压低无触发词有害率的同时，把触发条件下的有害行为传给初始干净学生。。
Paper analysisRead analysis
InterpretabilityarXiv 2610.07518Oct 6
TRACE：仅凭 checkpoint 更新审计大语言模型有害目标
提出 TRACE，仅凭检查点更新审计有害合规微调目标
arXiv
2610.07518
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3, Qwen3-8B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称有害合规 SFT 在检查点更新中留下可排序坐标，并据此做只读权重审计。
作者在检查点更新里寻找有害合规 SFT 的目标组成，并把读数做成不查询模型、不看未知训练数据的审计分 TRACE。
Paper analysisRead analysis
DefensesarXiv 2610.06636Oct 6
差分隐私混合公共数据集提升隐私学习效果
提出 DP-MixMin，私有学习公开数据混合并做差分隐私微调
arXiv
2610.06636
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18, GPT-2 Medium
- AttacksExtraction and theft
AbstractDP-MixMin 私下学公开混合再 DP 微调，胸片 macro AUC 与邮件困惑度优于均匀混合。
DP-MixMin 是一条端到端的差分隐私训练流程：先私下决定多个公开数据集的预训练混合，再预训练并在敏感数据上 DP 微调。作者称这是首个这样的流程。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05840Oct 5
研究：任务范围授权可将工具调用有害执行降至零
用配对回放评测任务范围授权能否阻断越权工具执行
arXiv
2610.05840
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.2 3B Instruct Q4 K M, Qwen3 4B Instruct, Gemma 3 4B and others8
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

SemField: training-free semantic watermark

LTBD：用可学习信任边界分隔符防御提示注入

SLDR：通过选择性层恢复与动态路由防御恶意微调

超越奖励压制：有界奖励热启动 Bandit 的近最优离线攻击

OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击

研究：多向量视觉文档索引可被反演还原页面内容

用时序逻辑监控工具 Agent

ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准

CredLeak-Bench

Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.

研究揭示策略蒸馏的安全后门风险

TRACE：仅凭 checkpoint 更新审计大语言模型有害目标

差分隐私混合公共数据集提升隐私学习效果

研究：任务范围授权可将工具调用有害执行降至零