Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 22 papers
Filter3

Attack type

Prompt injection11Poisoning and backdoors19

Attack technique

Gradient and representation optimization21Automated search77Multi-turn escalation29Encoding and obfuscation51Role-play and persuasion29Conversation structure manipulation15Reasoning-chain manipulation12Cross-modal payloads30Defense-targeted22Dormant triggers22Selection manipulation3

Impact

Unauthorized actions3Data and privacy leaks5Output manipulation12

System type

Models and APIs5AI Agent16coding agent3

Attack surface / entry point

User input15Web pages and interfaces4Documents and messages8Tool responses5Tool and skill descriptions5Code repositories and dependencies5Retrieval corpus4Memory writes16Images, audio and video8Training data15Weights and gradients14Distribution channels16

Layer

Application layer17Training and data layer3

System component

Memory13RAG3Guardrails and judges4Fine-tuning and open weights4
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Attack technique：Dormant triggersAttack surface / entry point：User inputAttack surface / entry point：Documents and messagesClear all

Another 265papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  2. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.07723

    Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.

    提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答

    arXiv
    2610.07723
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4

    Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.04589

    StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

    提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道

    arXiv
    2610.04589
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13

    Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。

    Paper analysisRead analysis
  5. AttacksarXiv 2609.38270

    VirusCascade：劫持 LLM 推荐智能体的协同反思机制

    提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思

    arXiv
    2609.38270
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    AgentCF, AgentSEQ, AgentRAG and others4
    Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。

    VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。

    Paper analysisRead analysis
  6. AttacksarXiv 2609.35576

    研究提出跨 LLM 助手的记忆跳跃攻击

    提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播

    arXiv
    2609.35576
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.6 Luna, Kimi-K2.6, GPT-OSS-120B and others6
    Abstract论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。

    该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。

    Paper analysisRead analysis
  7. AttacksarXiv 2609.33985

    研究：众包微调数据投毒可放大专有指令抽取

    提出主题锚点投毒，放大众包微调后的专有指令提取

    arXiv
    2609.33985
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct, Llama-3.1-8B-Instruct and others4

    Abstract论文提出基于主题锚点的数据中毒攻击，证明低比例的中毒样本可在黑盒条件下隐蔽放大微调指令泄漏。

    Paper analysisRead analysis
  8. AttacksarXiv 2609.37468

    论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

    提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测

    arXiv
    2609.37468
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    E5, Contriever-MSMARCO

    Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。

    Paper analysisRead analysis
  9. AttacksarXiv 2609.22510

    特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent

    提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse

    arXiv
    2609.22510
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
    Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。

    论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。

    Paper analysisRead analysis
  10. AttacksarXiv 2609.13889

    PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

    提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私

    arXiv
    2609.13889
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max

    Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。

    Paper analysisRead analysis
  12. AttacksarXiv 2608.09577

    ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门

    提出 ElasticBack，在单个 Agent 技能中植入条件后门

    arXiv
    2608.09577
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GLM-5.2, MiniMax-M3, GPT-5.4 and others4
    AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。

    ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。

    Paper analysisRead analysis
  17. AttacksarXiv 2607.05189

    研究者提出 MemGhost，对持久化个人 Agent 实现隐蔽记忆注入

    提出 MEMGHOST，用单封邮件对持久个人 Agent 做跨会话隐蔽记忆注入

    arXiv
    2607.05189
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4, Claude Sonnet 4.6, Claude Sonnet 4.5 and others6
    Abstract总结了论文的研究背景、双代理优化方法 MEMGHOST、全周期实验结果以及作者对记忆信任边界的启示。

    本文研究了持久化个人智能体面临的隐蔽记忆注入威胁，提出了一套兼顾写入、隐蔽与跨会话生效的自动化生成框架与全周期评测基准。

    Paper analysisRead analysis
  18. AttacksarXiv 2606.09084

    研究者提出 Context-Fractured Decomposition 攻击

    提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查

    arXiv
    2606.09084
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-4.1, GPT-5-nano, Claude-3.5-Sonnet and others6
    AbstractCFD 用无指令 artifact 把越狱拆到跨会话。

    CFD针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。

    Paper analysisRead analysis
  19. AttacksarXiv 2606.04329

    研究者系统研究 LLM 智能体记忆投毒攻击并提出 MPBench 基准

    系统研究 LLM 智能体记忆投毒并构建基准 MPBench

    arXiv
    2606.04329
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Meta-Llama-3.1-70B-Instruct, Deberta-v3-base, Llama-3.1-8B-Instruct and others5

    Abstract系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。

    Paper analysisRead analysis
  20. AttacksarXiv 2605.15338

    隐藏于记忆：LLM Agent 的潜伏记忆投毒

    提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆

    arXiv
    2605.15338
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
    Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。

    sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。

    Paper analysisRead analysis
Load more