Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 58 papers

Filter5

Attack type

Jailbreaks20 Prompt injection17 Poisoning and backdoors6 Detection evasion9

Attack technique

Gradient and representation optimization35 Automated search48 Multi-turn escalation8 Encoding and obfuscation23 Role-play and persuasion3 Cross-modal payloads58 Defense-targeted15 Dormant triggers19 Selection manipulation10

Impact

Harmful content19 Unauthorized actions8 Output manipulation26 Availability and reliability3

System component

MCP and skills6 Guardrails and judges6 Vision38 Audio5 Image generation3 Multimodal46

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Encoding and obfuscation Attack surface / entry point：Tool responses Attack surface / entry point：Tool and skill descriptions Attack surface / entry point：Images, audio and video Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12524Oct 8
An exploration of attacks on AI agent systems
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
arXiv
2610.12524
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。
作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
Paper analysisRead analysis
AttacksarXiv 2610.09973Oct 7
从期望危害到似然：LLM 智能体越狱的概率重构
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
arXiv
2610.09973
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2610.09708Oct 7
研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率
提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
arXiv
2610.09708
Published
Oct 7
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
OpenVLA, UniVLA, π0.5
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2610.06814Oct 6
TAPDreamer：可跨任务迁移的世界动作模型对抗补丁
TAPDreamer 用公开编码器做固定补丁。
arXiv
2610.06814
Published
Oct 6
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
FastWAM, DreamWAM-uncond, DreamWAM-joint and others4
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.06083Oct 5
研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击
提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报
arXiv
2610.06083
Published
Oct 5
Layer
Model layer
Setting
Embodied systems and robotics
Evaluated models
DQN, Double DQN (DDQN)
- TechniqueGradient and representation optimization
Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。
这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。
Paper analysisRead analysis
AttacksarXiv 2610.06977Oct 4
IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法
提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
arXiv
2610.06977
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-VL-7B, Qwen2.5-VL-72B, InternVL3-14B and others17
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.03166Oct 2
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
arXiv
2610.03166
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
Paper analysisRead analysis
AttacksarXiv 2609.36576Sep 29
AdaLCPI：让 Agent 从长上下文碎片中重建间接提示注入
提出 AdaLCPI，把恶意指令拆成碎片嵌入工具返回并诱导 Agent 越权执行
arXiv
2609.36576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, GPT-5.1, GPT-5.6-Luna and others7
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2609.05525Sep 2
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
arXiv
2609.05525
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.23471Aug 25
InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
arXiv
2608.23471
Published
Aug 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and others6
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.10393Aug 11
DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型
提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作
arXiv
2608.10393
Published
Aug 11
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
OpenVLA-7B, π0-FAST, openvla-7B
- TechniqueCross-modal payloads
- ComponentVision
AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。
DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。
Paper analysisRead analysis
AttacksarXiv 2608.04034Aug 3
HACA：原子越狱策略解耦组合的多模态自动红队方法
提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
arXiv
2608.04034
Published
Aug 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-1.6-Mistral-7B, InternVL-3.5-8B, VLGuard (LLaVA-v1.5-7B-Mixed) and others5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.19855Jul 22
研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测
提出最小范数攻击集成，用鲁棒性曲线评测图像分类器
arXiv
2607.19855
Published
Jul 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C1–C20（CIFAR-10，Table 1）, I1–I10（ImageNet，Table 1）
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Abstract预算可控的最小范数集成用 AOI 逼近攻击前沿，DOI 给出不依赖单一ε的防御排序。
这篇工作把对抗鲁棒评测从单一 ε、固定集成，改成可按查询预算收紧的曲线估计。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

An exploration of attacks on AI agent systems

从期望危害到似然：LLM 智能体越狱的概率重构

研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率

WebMirage hijacks visual web agents' browser operations with adversarial images

P-VMI：对抗图像经 KV cache 持续影响多轮对话

STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击

TAPDreamer：可跨任务迁移的世界动作模型对抗补丁

研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击

IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法

LiBRA：通过双向隐空间优化实现检测感知的图像水印去除

AdaLCPI：让 Agent 从长上下文碎片中重建间接提示注入

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

研究：跨通道碎片化攻击可绕过 MCP 单通道防御

DIVA：利用视觉锚点对视频生成模型实施多模态越狱

SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准

DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱

InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems

DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

HACA：原子越狱策略解耦组合的多模态自动红队方法

研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测