Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 15 papers
Filter4

Attack type

Prompt injection5Poisoning and backdoors7Detection evasion4

Attack technique

Gradient and representation optimization6Automated search22Multi-turn escalation3Encoding and obfuscation5Conversation structure manipulation3Defense-targeted12Dormant triggers21

Impact

Harmful content5Output manipulation4

System type

Models and APIs10AI Agent5

Attacker access

White-box3

Attack surface / entry point

User input34Documents and messages3Tool responses6Tool and skill descriptions8Code repositories and dependencies3Images, audio and video5Training data9Weights and gradients7Distribution channels7

Layer

Application layer5Training and data layer8

System component

Guardrails and judges3Reasoning chains3Fine-tuning and open weights6
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
Attack technique：Conversation structure manipulationAttack technique：Defense-targetedAttack surface / entry point：Tool responsesAttack surface / entry point：Training dataClear all

Another 215papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  2. AttacksarXiv 2610.07723

    Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.

    提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答

    arXiv
    2610.07723
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4

    Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.27542

    Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

    提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控

    arXiv
    2609.27542
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4

    Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。

    Paper analysisRead analysis
  4. AttacksarXiv 2609.27124

    Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习

    提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复

    arXiv
    2609.27124
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    CNN（MNIST：2 Conv + 3 FC）, CNN（Fashion-MNIST：6 Conv + 1 FC）, ResNet18（CIFAR-10）
    AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。

    Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.18217

    研究：跨通道碎片化攻击可绕过 MCP 单通道防御

    提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件

    arXiv
    2609.18217
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-4o, GPT-4o-mini, GPT-5.4 and others15

    Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。

    Paper analysisRead analysis
  8. AttacksarXiv 2607.21839

    论文指出密码学模型认证的假设缺口：审计通过但部署失效

    提出数据伪造攻击，使密码学模型认证在审计集通过但部署失效

    arXiv
    2607.21839
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    SciKit-Learn decision tree, XGBoost, 226M-parameter neural network and others4
    Abstract固定审计集上的 ZKP 认证可被数据伪造绕过。

    这篇工作同时给出对 CMC 的数据伪造攻击，以及先承诺、后抽样的认证模板。。

    Paper analysisRead analysis
  10. AttacksarXiv 2605.30040

    研究揭示 LLM 按 token 计费可被服务商系统性虚报

    构造可通过计费审计的 token 虚报，使服务商系统性超收

    arXiv
    2605.30040
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    PALACE domain-adapted auditor
    Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。

    不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。

    Paper analysisRead analysis
  11. AttacksarXiv 2603.24203

    研究者提出 TIP：用树结构搜索为 MCP 生成隐蔽注入载荷

    提出 TIP，用树搜索为 MCP 响应生成隐蔽注入载荷

    arXiv
    2603.24203
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-72B-Instruct, Llama3.1-8B-Instruct and others8
    AbstractTIP 在 MCP 工具响应上做黑盒注入。

    TIP 是面向 MCP 工具响应的 black-box 间接提示注入，目标是在不改工具元数据的情况下生成语义连贯的 JSON 载荷。

    Paper analysisRead analysis
  14. AttacksarXiv 2510.04885

    RL-Hammer：用 GRPO 从头训练攻击模型

    提出 RL-Hammer，从零训练攻击模型经工具输出实施提示注入

    arXiv
    2510.04885
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama-3.1-8B-Instruct, Meta-SecAlign-8B, Meta-SecAlign-70B and others10
    Abstract作者称通过无热启动的强化学习可有效突破具备防御的商业模型，论文提出的 RL-Hammer 促使业界关注提示注入风险。

    RL-Hammer 是一个无需热启动数据、基于 GRPO 算法从零训练的黑盒提示注入对抗攻击框架。现有针对大语言模型智能体的提示注入防御（如 Instruction Hierarchy 与 SecAlign）主要在静态或弱攻击下测试，在面对自动化强力攻击时的真实防御能力缺乏充分检验。方法的核心机制包括。

    Paper analysisRead analysis
You have reached the end