Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 296 papers

Filter3

System component

MCP and skills16 Memory16 RAG3 Guardrails and judges33 Monitors15 Reasoning chains13 Permissions and sandboxing24 Fine-tuning and open weights38 Vision84 Audio21 Video8 Image generation16 Multimodal122

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool responses Attack surface / entry point：Images, audio and video Attack surface / entry point：Training data Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.13333Oct 9
LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
arXiv
2610.13333
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
- AttacksMalicious use
- ComponentImage generation
AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.
LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Paper analysisRead analysis
Analysis and theoryarXiv 2610.13051Oct 9
Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors
Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining
arXiv
2610.13051
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-32
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.
The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.
Paper analysisRead analysis
AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
DefensesarXiv 2610.10345Oct 8
SLDR：通过选择性层恢复与动态路由防御恶意微调
提出 SLDR，用选择性层恢复与动态路由防御恶意微调
arXiv
2610.10345
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称 SLDR 能压低有害输出并保持下游效用。
SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。
Paper analysisRead analysis
AttacksarXiv 2610.10000Oct 7
超越奖励压制：有界奖励热启动 Bandit 的近最优离线攻击
提出热启动 Bandit 的部署前有界离线注入攻击
arXiv
2610.10000
Published
Oct 7
Layer
Training and data layer
Setting
LLM applications
Evaluated models
UCB, Thompson Sampling, ϵ-greedy
- AttacksPoisoning and backdoors
Paper analysisRead analysis
AttacksarXiv 2610.09973Oct 7
从期望危害到似然：LLM 智能体越狱的概率重构
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
arXiv
2610.09973
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
DefensesarXiv 2610.09935Oct 7
AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击
提出 AgentTracer，事后定位间接提示注入的注入点并重建攻击链
arXiv
2610.09935
Published
Oct 7
Layer
Application layer
Setting
AI Agent
- DefensesMonitoring and auditing
- AttacksPrompt injection
Paper analysisRead analysis
AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
DefensesarXiv 2610.09793Oct 7
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
arXiv
2610.09793
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
Paper analysisRead analysis
AttacksarXiv 2610.09708Oct 7
研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率
提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
arXiv
2610.09708
Published
Oct 7
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
OpenVLA, UniVLA, π0.5
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2610.09703Oct 7
研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
arXiv
2610.09703
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVA-1.5-7B
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Abstract剪枝去掉背景 token 后注意力塌向恶意前景。
这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.08951Oct 7
ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
arXiv
2610.08951
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
- AttacksPrompt injection
- TechniqueAutomated search
AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。
ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
Paper analysisRead analysis
DefensesarXiv 2610.08668Oct 7
SBW：面向 LLM 智能体的语义行为水印方法
提出 SBW，为 LLM Agent 轨迹做抗改写与伪造的语义行为水印
arXiv
2610.08668
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-3B-Instruct, LLaMA-3.2-3B, Qwen2.5-7B and others5
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractSBW 在语义簇上做溯源水印，改写检测高于精确符号，链式重放仍开放。
SBW 是免训练的智能体行为水印，把所有者标识放在离散动作选择上，而不是输出 token。
Paper analysisRead analysis
AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07939Oct 6
CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it
提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别
arXiv
2610.07939
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C2P-CLIP, ForgeLens, D3-Im and others10
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

SLDR：通过选择性层恢复与动态路由防御恶意微调

超越奖励压制：有界奖励热启动 Bandit 的近最优离线攻击

从期望危害到似然：LLM 智能体越狱的概率重构

OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

AgentTracer：通过细粒度意图-执行对齐追踪间接提示注入攻击

FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

用时序逻辑监控工具 Agent

研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率

研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

WebMirage hijacks visual web agents' browser operations with adversarial images

P-VMI：对抗图像经 KV cache 持续影响多轮对话

ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

SBW：面向 LLM 智能体的语义行为水印方法

STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击

CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it