Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 62 papers
Filter6

Attack type

Jailbreaks20Prompt injection14Poisoning and backdoors11Detection evasion11

Attack technique

Gradient and representation optimization37Automated search36Multi-turn escalation7Encoding and obfuscation25Role-play and persuasion3Cross-modal payloads60Defense-targeted21Dormant triggers44Selection manipulation10

Impact

Harmful content23Unauthorized actions6Data and privacy leaks3Output manipulation27Availability and reliability3

System type

Models and APIs41AI Agent19coding agent4web agent3Embodied systems and robotics6

Attacker access

Black-box16White-box6

Attack surface / entry point

User input73Web pages and interfaces7Documents and messages7Tool responses6Tool and skill descriptions5Retrieval corpus8Memory writes3Inter-agent messages3Images, audio and video50Training data6Weights and gradients15Distribution channels5Inference services and hardware3

Layer

Prompt layer39Model layer3Application layer16Training and data layer3

System component

MCP and skills6Memory3Guardrails and judges7Fine-tuning and open weights3Vision39Audio5Image generation3Multimodal47
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Encoding and obfuscationAttack surface / entry point：Tool and skill descriptionsAttack surface / entry point：Memory writesAttack surface / entry point：Images, audio and videoAttack surface / entry point：Training dataClear all

Another 201papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12524

    An exploration of attacks on AI agent systems

    Retest and extend prompt injection against AI agents, and use Agent Card deception to manipulate A2A selection

    arXiv
    2610.12524
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
    AbstractSingle-agent filtering and classification can be bypassed by format or wording, and A2A card selection is also biased toward names and descriptions.

    The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.

    Paper analysisRead analysis
  3. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.06083

    研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击

    提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报

    arXiv
    2610.06083
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    DQN, Double DQN (DDQN)
    Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。

    这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。

    Paper analysisRead analysis
  9. AttacksarXiv 2610.04589

    StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

    提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道

    arXiv
    2610.04589
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13

    Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。

    Paper analysisRead analysis
  10. AttacksarXiv 2610.03166

    LiBRA：通过双向隐空间优化实现检测感知的图像水印去除

    提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测

    arXiv
    2610.03166
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Stable Signature, YU1, HiDDeN and others4

    AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。

    Paper analysisRead analysis
  11. AttacksarXiv 2610.01367

    研究：高质量数据筛选挡不住投毒

    提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本

    arXiv
    2610.01367
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
    Abstract质量筛选挡不住部分高分样本的安全削弱。

    Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。

    Paper analysisRead analysis
  12. AttacksarXiv 2609.39788

    研究：多智能体系统潜在通信链路可被训练用于提升有害顺从

    提出只训练或篡改多智能体潜在通信链路来提高有害遵从

    arXiv
    2609.39788
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
    Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。

    学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  14. AttacksarXiv 2609.18217

    研究：跨通道碎片化攻击可绕过 MCP 单通道防御

    提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件

    arXiv
    2609.18217
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-4o, GPT-4o-mini, GPT-5.4 and others15

    Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。

    Paper analysisRead analysis
  15. AttacksarXiv 2609.07216

    DIVA：利用视觉锚点对视频生成模型实施多模态越狱

    提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型

    arXiv
    2609.07216
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Wan, CogVideoX, LTX-Video and others9
    AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。

    DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。

    Paper analysisRead analysis
  16. Evaluation and benchmarksarXiv 2609.05843

    SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准

    提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性

    arXiv
    2609.05843
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
    AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。

    SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。

    Paper analysisRead analysis
  18. AttacksarXiv 2608.10393

    DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

    提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作

    arXiv
    2608.10393
    Published
    Layer
    Prompt layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-7B, π0-FAST, openvla-7B
    AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。

    DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。

    Paper analysisRead analysis
Load more