Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 25 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Attack technique：Automated search Attack technique：Conversation structure manipulation Attack surface / entry point：Tool responses Attack surface / entry point：Training data Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.08951Oct 7
ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
arXiv
2610.08951
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-3.7-Flash, DeepSeek-V4-Flash, Gemini-2.5-flash
- AttacksPrompt injection
- TechniqueAutomated search
AbstractASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。
ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
Paper analysisRead analysis
AttacksarXiv 2610.01367Oct 1
研究：高质量数据筛选挡不住投毒
提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本
arXiv
2610.01367
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Abstract质量筛选挡不住部分高分样本的安全削弱。
Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。
Paper analysisRead analysis
AttacksarXiv 2609.36576Sep 29
AdaLCPI：让 Agent 从长上下文碎片中重建间接提示注入
提出 AdaLCPI，把恶意指令拆成碎片嵌入工具返回并诱导 Agent 越权执行
arXiv
2609.36576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, GPT-5.1, GPT-5.6-Luna and others7
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.33628Sep 27
用课程强化学习对前沿模型做提示注入红队测试
用跨目标课程强化学习训练提示注入红队，攻破前沿智能体
arXiv
2609.33628
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o-mini, GPT-5-nano, GPT-5.6-Luna and others12
- AttacksPrompt injection
- TechniqueAutomated search
Abstract提出跨目标模型课程强化学习，攻破前沿模型冷启动瓶颈并实现跨模型迁移。
该研究针对强化学习自动化提示注入红队在攻击前沿大模型时的冷启动问题，提出了一种基于目标模型鲁棒性递进的课程强化学习方法。
Paper analysisRead analysis
AttacksarXiv 2609.28613Sep 24
研究：提示注入可改变 Jev 决策模型的行动概率
测量间接提示注入对类型化概率决策的动作劫持
arXiv
2609.28613
Published
Sep 24
Layer
Application layer
Setting
Models and APIs
Evaluated models
jev-1.13.0
- AttacksPrompt injection
- TechniqueAutomated search
Abstract封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。
作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
AttacksarXiv 2609.27422Sep 23
RAMP：逆转对抗扰动以增强针对恶意软件检测器的干净标签后门攻击
提出 RAMP，逆转对抗扰动加强恶意软件检测器的干净标签后门
arXiv
2609.27422
Published
Sep 23
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
MalConv, MalConvGCG
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentFine-tuning and open weights
AbstractRAMP 用反转扰动做 clean-label 投毒。
RAMP 是 score-based black-box 下的 clean-label 后门增强，对象是会微调的 Windows PE 原始字节恶意软件检测器。
Paper analysisRead analysis
AttacksarXiv 2609.26761Sep 23
A2M: A two-stage agent hijacking framework targeting the MCP ecosystem
提出两阶段框架 A2M，优化 MCP 工具元数据与返回载荷以劫持 Agent
arXiv
2609.26761
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
GLM-4.6, Qwen3-Max, DeepSeek-V3.1 and others5
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2609.04495Sep 4
研究将间接提示注入重新表述为测试时搜索问题
提出 Search Harness，把间接提示注入做成测试时搜索并自适应利用
arXiv
2609.04495
Published
Sep 4
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.8, GPT-5.5
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2608.30441Aug 31
ECLIPSE：针对长程 Agent 系统的自演化隐蔽提示注入攻击
提出 ECLIPSE 双通道提示注入，劫持长程 Agent 的动作轨迹
arXiv
2608.30441
Published
Aug 31
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek, GPT-4o, Claude 4.8 Opus and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2608.05108Aug 6
PIMiner：无需再训练即可跨模型迁移的提示注入红队智能体系统
提出 PIMiner，用可复用策略库自动搜索并迁移针对智能体的提示注入
arXiv
2608.05108
Published
Aug 6
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini-2.5-Pro, DeepSeek-V4-Pro, GPT-4o-mini and others10
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2608.04565Aug 5
Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents
提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链
arXiv
2608.04565
Published
Aug 5
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-9B, Gemma4-31B, DeepResearch and others7
- AttacksPrompt injection
- TechniqueAutomated search
- ComponentRAG
Abstract论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。
Paper analysisRead analysis
AttacksarXiv 2607.26115Jul 29
OpenAI releases GPT-Red: training automated red-teaming agents through self-play
训练自博弈红队智能体 GPT-Red，规模化生成提示注入与越狱攻击
arXiv
2607.26115
Published
Jul 29
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-5.6, GPT-5.5, GPT-5.4 and others8
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2607.11698Jul 13
AHA 用自动研究循环发现生产 Agent 漏洞概念
提出 AHA 自动科研循环，发现生产 Agent 的可复用漏洞概念
arXiv
2607.11698
Published
Jul 13
Layer
Application layer
Setting
coding agent
Attacker
Black-box
Evaluated models
Minimax-M2.7, Kimi-K2.6, Deepseek-V4-Pro and others5
- AttacksPrompt injection
- TechniqueAutomated search
Abstract论文提出基于可证伪科研循环的 AHA 框架，从生产级智能体中挖掘并沉淀漏洞概念图，提升攻击复用率并指导防御加固。
AHA 是一项针对生产级 LLM 智能体自动化红队测试的研究，旨在解决传统方法仅保留具体攻击载荷而缺乏成因解释、导致跨版本复用困难且无法指导修复的问题。
Paper analysisRead analysis
AttacksarXiv 2607.05189Jul 6
Researchers propose MemGhost, achieving covert memory injection into persistent personal agents
提出 MEMGHOST，用单封邮件对持久个人 Agent 做跨会话隐蔽记忆注入
arXiv
2607.05189
Published
Jul 6
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Claude Sonnet 4.5 and others6
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMemory
Abstract总结了论文的研究背景、双代理优化方法 MEMGHOST、全周期实验结果以及作者对记忆信任边界的启示。
本文研究了持久化个人智能体面临的隐蔽记忆注入威胁，提出了一套兼顾写入、隐蔽与跨会话生效的自动化生成框架与全周期评测基准。
Paper analysisRead analysis
AttacksarXiv 2607.00481Jul 1
研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM
提出 SMT 框架，用模拟审核轨迹越狱函数调用 LLM
arXiv
2607.00481
Published
Jul 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o, GPT-5.4, Qwen3-Max and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2606.12918Jun 11
MAStrike：用 Shapley 值引导多智能体系统协同红队攻击
提出 MAStrike，用 Shapley 选联盟对多智能体做共谋红队
arXiv
2606.12918
Published
Jun 11
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Claude Opus 4.7, GPT-5.5, Gemini 3.1 Pro
- AttacksPrompt injection
- TechniqueAutomated search
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.01970May 4
Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses on LLM Agents
构建 Trojan Hippo Bench，评测 Agent 持久记忆投毒与外泄
arXiv
2605.01970
Published
May 4
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 3.1 Pro, GPT-5-mini, GPT-5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了评测智能体持久化记忆攻击与防御的 Trojan Hippo Bench，揭示了潜伏攻击威胁及内存防御的安全与效用权衡。
Paper analysisRead analysis
AttacksarXiv 2603.24203Mar 25
研究者提出 TIP：用树结构搜索为 MCP 生成隐蔽注入载荷
提出 TIP，用树搜索为 MCP 响应生成隐蔽注入载荷
arXiv
2603.24203
Published
Mar 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-72B-Instruct, Llama3.1-8B-Instruct and others8
- AttacksPrompt injection
- TechniqueAutomated search
AbstractTIP 在 MCP 工具响应上做黑盒注入。
TIP 是面向 MCP 工具响应的 black-box 间接提示注入，目标是在不改工具元数据的情况下生成语义连贯的 JSON 载荷。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

ASPIRE：面向 LLM Agent 的开放式提示注入红队引擎

研究：高质量数据筛选挡不住投毒

AdaLCPI：让 Agent 从长上下文碎片中重建间接提示注入

用课程强化学习对前沿模型做提示注入红队测试

研究：提示注入可改变 Jev 决策模型的行动概率

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

RAMP：逆转对抗扰动以增强针对恶意软件检测器的干净标签后门攻击

A2M: A two-stage agent hijacking framework targeting the MCP ecosystem

研究将间接提示注入重新表述为测试时搜索问题

ECLIPSE：针对长程 Agent 系统的自演化隐蔽提示注入攻击

PIMiner：无需再训练即可跨模型迁移的提示注入红队智能体系统

Researchers propose Breadcrumbing long-range attack that can hijack the evidence chain of DeepResearch-style search agents

OpenAI releases GPT-Red: training automated red-teaming agents through self-play

AHA 用自动研究循环发现生产 Agent 漏洞概念

Researchers propose MemGhost, achieving covert memory injection into persistent personal agents

研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM

MAStrike：用 Shapley 值引导多智能体系统协同红队攻击

Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses on LLM Agents

研究者提出 TIP：用树结构搜索为 MCP 生成隐蔽注入载荷