Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 25 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack surface / entry point：User input Attack surface / entry point：Tool responses Attack surface / entry point：Training data Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09973Oct 7
从期望危害到似然：LLM 智能体越狱的概率重构
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
arXiv
2610.09973
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.03430Oct 2
JIL：通过对抗后缀操纵 LLM 请求调度优先级
提出 JIL 对抗后缀，压低长度预测以抬高请求调度优先级
arXiv
2610.03430
Published
Oct 2
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Llama-3-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others4
- TechniqueGradient and representation optimization
AbstractJIL 用对抗后缀压低长度预测，在预测式 LLM 调度中提高自身优先级。
JIL 是对预测式 LLM 调度的攻击：用对抗后缀压低长度预测，使请求在 SRPT 式队列里更早得到服务。
Paper analysisRead analysis
AttacksarXiv 2610.01367Oct 1
研究：高质量数据筛选挡不住投毒
提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本
arXiv
2610.01367
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama2-7B-Chat, Llama3-8B-Instruct, Qwen2-7B-Instruct and others5
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Abstract质量筛选挡不住部分高分样本的安全削弱。
Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。
Paper analysisRead analysis
AttacksarXiv 2609.39788Sep 30
研究：多智能体系统潜在通信链路可被训练用于提升有害顺从
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
arXiv
2609.39788
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。
学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
Paper analysisRead analysis
InterpretabilityarXiv 2609.24801Sep 22
研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
arXiv
2609.24801
Published
Sep 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Prompt Guard 2 (86M), Llama 3.1 8B
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentGuardrails and judges
Abstract作者称检测靠分散的词法线索。
Paper analysisRead analysis
AttacksarXiv 2609.02172Sep 2
BOSS：以广度优先后缀搜索改进 GCG 越狱优化
提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化
arXiv
2609.02172
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Yi-1.5-9B-Chat, Qwen2-7B-Instruct and others8
- AttacksJailbreaks
- TechniqueGradient and representation optimization
AbstractBOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。
BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。
Paper analysisRead analysis
AttacksarXiv 2609.05525Sep 2
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
arXiv
2609.05525
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.23471Aug 25
InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
arXiv
2608.23471
Published
Aug 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and others6
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.07430Aug 8
研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱
提出 SN-Guided Diffusion，利用安全神经元实现离线越狱
arXiv
2608.07430
Published
Aug 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen2.5-7B-Instruct, LLaDA-8B-Instruct, Dream-Instruct-7B and others15
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。
论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2607.23496Jul 26
Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景
提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
arXiv
2607.23496
Published
Jul 26
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B and others6
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。
Paper analysisRead analysis
AttacksarXiv 2606.09499Jun 8
研究者提出针对世界模型的机器人学习管线投毒攻击
提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略
arXiv
2606.09499
Published
Jun 8
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
Cosmos-Predict 2.5, Cosmos-Predict 2.5 AC, Dino WM and others4
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentVideo
Abstract只改视频帧经世界模型投毒。
只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。
Paper analysisRead analysis
AttacksarXiv 2606.05609Jun 4
SlotGCG 利用提示词位置漏洞提升 LLM 越狱攻击成功率
提出 SlotGCG，按注意力选槽插入对抗 token 以越狱指令模型
arXiv
2606.05609
Published
Jun 4
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLAMA2-7B-CHAT, LLAMA2-13B-CHAT, LLAMA-3.1-8B-INSTRUCT and others10
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2605.04446May 6
Misrouter：利用 MoE 路由机制对混合专家大模型发起仅输入攻击
提出 Misrouter，借 MoE 路由优化仅输入前缀并迁移攻击
arXiv
2605.04446
Published
May 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o mini, Qwen-Plus, Phi-4 and others18
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2604.24983Apr 28
PEO：直接优化原始提示词嵌入的 LLM 白盒越狱方法
提出 PEO，直接优化原提示词嵌入实现白盒越狱
arXiv
2604.24983
Published
Apr 28
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Vicuna-7B-v1.3, Llama-2-7B-Chat, Qwen3-4B-Instruct and others4
- AttacksJailbreaks
- TechniqueGradient and representation optimization
AbstractPEO 原位优化提示词嵌入、多轮只重攻失败样本。
PEO是一种不追加对抗 token 的 white-box 越狱：直接改已有提示词嵌入，并只对未成功样本更换续写目标再优化。
Paper analysisRead analysis
AttacksarXiv 2603.23269Mar 24
Not All Tokens Are Equally Important: Query-Efficient Jailbreak Fuzzing for LLMs
提出 TriageFuzz，用替代模型定位敏感片段做查询高效越狱
arXiv
2603.23269
Published
Mar 24
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemma-7B-Instruct, Gemma2-9B-Instruct, LLaMA3-8B-Instruct and others9
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2603.03081Mar 3
TAO-Attack: Advanced Optimization-based Jailbreak Attack for Large Language Models
提出 TAO-Attack，用两阶段损失与 DPTO 优化越狱后缀
arXiv
2603.03081
Published
Mar 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Vicuna-7B-v1.5, Mistral-7B-Instruct-0.2 and others12
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2602.07107Feb 7
ShallowJail: Guiding Jailbreak Attacks Against Large Language Models
提出 ShallowJail，在推理时用转向向量改写隐藏状态实现越狱
arXiv
2602.07107
Published
Feb 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B-Instruct-2507, Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2602.03265Feb 3
Beyond Suffixes: The Impact of Token Position in GCG Adversarial Attacks on Large Language Models
比较 GCG 对抗 token 作为前缀与后缀的越狱效果
arXiv
2602.03265
Published
Feb 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
deepseek-llm-7b-chat, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others5
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

从期望危害到似然：LLM 智能体越狱的概率重构

P-VMI：对抗图像经 KV cache 持续影响多轮对话

JIL：通过对抗后缀操纵 LLM 请求调度优先级

研究：高质量数据筛选挡不住投毒

研究：多智能体系统潜在通信链路可被训练用于提升有害顺从

研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定

BOSS：以广度优先后缀搜索改进 GCG 越狱优化

DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱

InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems

研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱

规避与投毒攻击对恶意软件数据漂移检测器的实证分析

Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景

研究者提出针对世界模型的机器人学习管线投毒攻击

SlotGCG 利用提示词位置漏洞提升 LLM 越狱攻击成功率

Misrouter：利用 MoE 路由机制对混合专家大模型发起仅输入攻击

PEO：直接优化原始提示词嵌入的 LLM 白盒越狱方法

Not All Tokens Are Equally Important: Query-Efficient Jailbreak Fuzzing for LLMs

TAO-Attack: Advanced Optimization-based Jailbreak Attack for Large Language Models

ShallowJail: Guiding Jailbreak Attacks Against Large Language Models

Beyond Suffixes: The Impact of Token Position in GCG Adversarial Attacks on Large Language Models