Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 13 papers
Filter3

Attack type

Jailbreaks5Prompt injection3Poisoning and backdoors6

Attack technique

Gradient and representation optimization33Automated search14Multi-turn escalation5Encoding and obfuscation15Cross-modal payloads56Defense-targeted5Dormant triggers8

Impact

Harmful content6Output manipulation4

System type

Models and APIs10AI Agent3

Attacker access

Black-box3

Attack surface / entry point

User input44Web pages and interfaces4Documents and messages8Tool responses8Tool and skill descriptions7Code repositories and dependencies5Retrieval corpus4Memory writes16Images, audio and video13Training data15Weights and gradients14Distribution channels16

Layer

Prompt layer6Training and data layer5

System component

Fine-tuning and open weights4Vision8Multimodal11
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.
Attack technique：Multi-turn escalationAttack technique：Dormant triggersAttack surface / entry point：Images, audio and videoClear all

Another 261papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.09819

    FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

    提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门

    arXiv
    2610.09819
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    HuBERT-base, WavLM-base

    Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。

    Paper analysisRead analysis
  2. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.07051

    TrojanWorld：通过想象引导对世界模型智能体植入后门

    提出 TrojanWorld，用物理触发器对世界模型智能体植入想象引导后门

    arXiv
    2609.07051
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    TD-MPC2, DreamerV3, R2-Dreamer

    AbstractTrojanWorld 揭示了世界模型智能体的供应链后门风险，通过在世界模型中操纵想象可实现对闭环动作的持续控制。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.07048

    FreqDoor：面向视觉语言模型的频域后门攻击

    提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门

    arXiv
    2609.07048
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
    AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。

    FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。

    Paper analysisRead analysis
  7. AttacksarXiv 2606.09499

    研究者提出针对世界模型的机器人学习管线投毒攻击

    提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略

    arXiv
    2606.09499
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
    Abstract只改视频帧经世界模型投毒。

    只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。

    Paper analysisRead analysis
  9. AttacksarXiv 2602.15927

    研究者提出面向多轮对话的视觉记忆注入攻击 VMI

    提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息

    arXiv
    2602.15927
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-VL-7B-Instruct, Qwen3-VL-8B-Instruct, LLaVA-OneVision-1.5-8B-Instruct and others5
    AbstractVMI 让扰动图像在多轮 LVLM 中潜伏，作者称触发话题出现后仍可输出预定消息。

    VMI 是面向多轮 LVLM 的定向图像攻击：第三方发布带小扰动的图像，良性用户把它当作普通输入。

    Paper analysisRead analysis
  11. AttacksarXiv 2603.20198

    研究者提出 MM-Plan 多模态越狱框架

    提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标

    arXiv
    2603.20198
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Llama-3.2-11B, InternVL3-8B, Qwen3-VL-8B and others8
    Abstract作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。

    MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。

    Paper analysisRead analysis
You have reached the end