Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 41 papers

Filter4

Attack type

Jailbreaks11 Prompt injection17 Poisoning and backdoors27 Extraction and theft3

Attack technique

Gradient and representation optimization22 Automated search71 Multi-turn escalation29 Encoding and obfuscation53 Role-play and persuasion27 Conversation structure manipulation13 Reasoning-chain manipulation13 Cross-modal payloads30 Defense-targeted22 Dormant triggers29 Selection manipulation3

Impact

Harmful content11 Unauthorized actions9 Data and privacy leaks8 Output manipulation13

System component

MCP and skills4 Memory21 RAG5 Guardrails and judges4 Reasoning chains4 Fine-tuning and open weights4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Attack technique：Conversation structure manipulation Attack technique：Dormant triggers Attack surface / entry point：User input Attack surface / entry point：Memory writes Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.07723Oct 6
Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.
提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答
arXiv
2610.07723
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。
Paper analysisRead analysis
AttacksarXiv 2610.07645Oct 6
SkillPoison：用成功经验投毒自进化 Agent 的技能形成
提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能
arXiv
2610.07645
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。
SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。
Paper analysisRead analysis
AttacksarXiv 2610.04985Oct 4
研究揭示 Jev 作为应用决策层的安全与隐私风险
评估应用决策层的输入注入与隐私推断风险
arXiv
2610.04985
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box, Gray-box
Evaluated models
Jev, NanoJev
- AttacksPrompt injection
- TechniqueRole-play and persuasion
AbstractJev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。
Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
Paper analysisRead analysis
AttacksarXiv 2610.04589Oct 3
StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel
提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道
arXiv
2610.04589
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMemory
Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。
Paper analysisRead analysis
AttacksarXiv 2610.04195Oct 3
MemLeak research: multi-tenant agents sharing vector memory stores have cross-user memory leakage
提出 MemLeak，评估多租户 Agent 共享向量记忆的跨用户泄露
arXiv
2610.04195
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 2.5 Flash, Claude Sonnet 4.5, all-MiniLM-L6-v2 and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.38270Sep 29
VirusCascade：劫持 LLM 推荐智能体的协同反思机制
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
arXiv
2609.38270
Published
Sep 29
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
AgentCF, AgentSEQ, AgentRAG and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。
VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
Paper analysisRead analysis
AttacksarXiv 2609.36956Sep 29
研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
arXiv
2609.36956
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GLM-5, Gemini-3.5-Flash, Qwen3-32B and others4
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Abstract作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。
BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架，研究没有目标数值概率时，采样能否支持逐步控制。
Paper analysisRead analysis
AttacksarXiv 2609.35576Sep 29
研究提出跨 LLM 助手的记忆跳跃攻击
提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播
arXiv
2609.35576
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.6 Luna, Kimi-K2.6, GPT-OSS-120B and others6
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。
该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。
Paper analysisRead analysis
AttacksarXiv 2609.33985Sep 28
研究：众包微调数据投毒可放大专有指令抽取
提出主题锚点投毒，放大众包微调后的专有指令提取
arXiv
2609.33985
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct, Llama-3.1-8B-Instruct and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出基于主题锚点的数据中毒攻击，证明低比例的中毒样本可在黑盒条件下隐蔽放大微调指令泄漏。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
AttacksarXiv 2609.29775Sep 24
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
arXiv
2609.29775
Published
Sep 24
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2609.08373Sep 8
结构越狱可跨厂商泛化但不叠加：IICL 的跨厂商与多语言研究
检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
arXiv
2609.08373
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash, gemini-2.5-flash-lite
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.23471Aug 25
InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
arXiv
2608.23471
Published
Aug 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and others6
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.12851Aug 13
The researchers propose SkillMisevo-Bench to quantify the risk of skill mis-evolution in self-improving agents.
提出 SkillMisevo-Bench，量化自改进 Agent 的技能误演化
arXiv
2608.12851
Published
Aug 13
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code, Codex, Hermes and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.09867Aug 11
Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
arXiv
2608.09867
Published
Aug 11
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13
- AttacksExtraction and theft
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
Paper analysisRead analysis
AttacksarXiv 2608.09577Aug 10
ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门
提出 ElasticBack，在单个 Agent 技能中植入条件后门
arXiv
2608.09577
Published
Aug 10
Layer
Application layer
Setting
coding agent
Evaluated models
GLM-5.2, MiniMax-M3, GPT-5.4 and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
AbstractElasticBack 用冻结规则加遗传搜索演化 trigger，在单 skill 上做条件后门。
ElasticBack 是放在 LLM agent 单个 skill 里的条件后门攻击。。
Paper analysisRead analysis
AttacksarXiv 2608.05563Aug 6
研究者提出 PoisonedEvolution 轨迹投毒攻击
提出 PoisonedEvolution 轨迹投毒，诱导自演化技能系统固化恶意行为
arXiv
2608.05563
Published
Aug 6
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, MiniMax-M2.5, DeepSeek-V3.2 and others6
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文揭示自演化技能系统的证据晋升漏洞，提出并验证轨迹投毒攻击。
这篇论文揭示了自演化技能系统在将交互经验转化为持久指令时的安全风险。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

P-VMI：对抗图像经 KV cache 持续影响多轮对话

Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.

SkillPoison：用成功经验投毒自进化 Agent 的技能形成

研究揭示 Jev 作为应用决策层的安全与隐私风险

StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

MemLeak research: multi-tenant agents sharing vector memory stores have cross-user memory leakage

VirusCascade：劫持 LLM 推荐智能体的协同反思机制

研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM

研究提出跨 LLM 助手的记忆跳跃攻击

研究：众包微调数据投毒可放大专有指令抽取

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

输出前缀攻击瞄准推理模型

结构越狱可跨厂商泛化但不叠加：IICL 的跨厂商与多语言研究

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems

The researchers propose SkillMisevo-Bench to quantify the risk of skill mis-evolution in self-improving agents.

Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks

ElasticBack：通过触发词与规则耦合在 LLM Agent 技能中植入条件后门

研究者提出 PoisonedEvolution 轨迹投毒攻击