Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 54 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Cross-modal payloads Attack surface / entry point：User input Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Memory writes Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09973Oct 7
从期望危害到似然：LLM 智能体越狱的概率重构
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
arXiv
2610.09973
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Ministral-8B-Instruct-2410
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.03430Oct 2
JIL：通过对抗后缀操纵 LLM 请求调度优先级
提出 JIL 对抗后缀，压低长度预测以抬高请求调度优先级
arXiv
2610.03430
Published
Oct 2
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Llama-3-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others4
- TechniqueGradient and representation optimization
AbstractJIL 用对抗后缀压低长度预测，在预测式 LLM 调度中提高自身优先级。
JIL 是对预测式 LLM 调度的攻击：用对抗后缀压低长度预测，使请求在 SRPT 式队列里更早得到服务。
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2609.38899Sep 30
SceneJail: Jailbreaking multimodal large models using video scene context
提出 SceneJail，利用视频情境上下文越狱视频多模态模型
arXiv
2609.38899
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-VL-7B-Instruct, Qwen2.5-VL-32B-Instruct, Qwen3-VL-8B-Instruct and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVideo
Paper analysisRead analysis
InterpretabilityarXiv 2609.24801Sep 22
研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
arXiv
2609.24801
Published
Sep 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Prompt Guard 2 (86M), Llama 3.1 8B
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentGuardrails and judges
Abstract作者称检测靠分散的词法线索。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
AttacksarXiv 2609.02172Sep 2
BOSS：以广度优先后缀搜索改进 GCG 越狱优化
提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化
arXiv
2609.02172
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Yi-1.5-9B-Chat, Qwen2-7B-Instruct and others8
- AttacksJailbreaks
- TechniqueGradient and representation optimization
AbstractBOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。
BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。
Paper analysisRead analysis
AttacksarXiv 2609.05525Sep 2
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
arXiv
2609.05525
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.27531Aug 27
MAMJ：面向视觉语言模型的元自适应多模态越狱攻击
提出 MAMJ，在元层面交替优化多模态越狱的策略提示与攻击者权重
arXiv
2608.27531
Published
Aug 27
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Gemini-3-Pro-Preview, Seed 2.0
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.23471Aug 25
InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
arXiv
2608.23471
Published
Aug 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and others6
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2608.15578Aug 16
ARENA：面向大型音频语言模型的自动化红队框架
提出 ARENA 音频红队框架，自动构造文本安全且音频接地的越狱输入
arXiv
2608.15578
Published
Aug 16
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Audio Flamingo 3, Qwen2-Audio-7B-Instruct, MiMo-Audio-7B-Instruct and others4
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2608.07430Aug 8
研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱
提出 SN-Guided Diffusion，利用安全神经元实现离线越狱
arXiv
2608.07430
Published
Aug 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen2.5-7B-Instruct, LLaDA-8B-Instruct, Dream-Instruct-7B and others15
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。
论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2608.04034Aug 3
HACA：原子越狱策略解耦组合的多模态自动红队方法
提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
arXiv
2608.04034
Published
Aug 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-1.6-Mistral-7B, InternVL-3.5-8B, VLGuard (LLaVA-v1.5-7B-Mixed) and others5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2607.23496Jul 26
Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景
提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
arXiv
2607.23496
Published
Jul 26
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B and others6
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。
Paper analysisRead analysis
AttacksarXiv 2607.02961Jul 3
研究者提出信息过载方法越狱大型视觉语言模型
提出 INFER+ 信息过载方法，越狱大型视觉语言模型
arXiv
2607.02961
Published
Jul 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, Gray-box
Evaluated models
Qwen3-VL-8B, Qwen2-VL-7B, InternVL3.5-8B and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Abstract用图文过载越狱 LVLM。
这篇工作用信息过载越狱 LVLM，而不是靠 OOD 变换隐藏意图。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.07706Jun 5
MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models
Propose MLingualFC, evaluating vision-language model jailbreak vulnerabilities with multilingual flowchart images
arXiv
2606.07706
Published
Jun 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-VL-3B-Instruct, Gemma-4-E4B-it, Pangea-7B
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2606.05609Jun 4
SlotGCG 利用提示词位置漏洞提升 LLM 越狱攻击成功率
提出 SlotGCG，按注意力选槽插入对抗 token 以越狱指令模型
arXiv
2606.05609
Published
Jun 4
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLAMA2-7B-CHAT, LLAMA2-13B-CHAT, LLAMA-3.1-8B-INSTRUCT and others10
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

从期望危害到似然：LLM 智能体越狱的概率重构

WebMirage hijacks visual web agents' browser operations with adversarial images

P-VMI：对抗图像经 KV cache 持续影响多轮对话

JIL：通过对抗后缀操纵 LLM 请求调度优先级

研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像

SceneJail: Jailbreaking multimodal large models using video scene context

研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定

DIVA：利用视觉锚点对视频生成模型实施多模态越狱

BOSS：以广度优先后缀搜索改进 GCG 越狱优化

DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱

MAMJ：面向视觉语言模型的元自适应多模态越狱攻击

InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems

ARENA：面向大型音频语言模型的自动化红队框架

研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱

规避与投毒攻击对恶意软件数据漂移检测器的实证分析

HACA：原子越狱策略解耦组合的多模态自动红队方法

Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景

研究者提出信息过载方法越狱大型视觉语言模型

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

SlotGCG 利用提示词位置漏洞提升 LLM 越狱攻击成功率