Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 10 papers

Filter4

Attack type

Attack technique

Gradient and representation optimization6 Automated search15 Encoding and obfuscation6 Role-play and persuasion4 Cross-modal payloads6 Dormant triggers9

Impact

Unauthorized actions3 Output manipulation7

System type

LLM applications6 AI Agent4 web agent4

Attack surface / entry point

User input47 Web pages and interfaces5 Documents and messages6 Tool responses3 Retrieval corpus5 Images, audio and video35 Training data5 Weights and gradients11

Layer

Application layer10

System component

Vision5 Multimodal5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Role-play and persuasion Attack surface / entry point：Web pages and interfaces Attack surface / entry point：Documents and messages Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09240Oct 7
WebMirage hijacks visual web agents' browser operations with adversarial images
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
arXiv
2610.09240
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。
WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
Paper analysisRead analysis
AttacksarXiv 2609.19722Sep 17
ALIBI：向二进制注入虚假安全叙事可让 LLM 恶意软件分析器误判
提出 ALIBI，向恶意二进制注入不执行掩护叙事使分析器误判为良性
arXiv
2609.19722
Published
Sep 17
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Gemini 2.5 Pro, GPT-5.5 Pro, Claude Opus 4.7
- AttacksDetection evasion
- TechniqueRole-play and persuasion
AbstractALIBI 用二进制内的掩护叙事重释可疑静态证据，Gemini 上翻转多，另两模型主要为降级。
ALIBI 是针对 LLM 恶意软件分诊的语义掩护叙事攻击：不覆盖系统指令，而把仍可见的可疑静态证据重释成良性安全产品的预期行为。
Paper analysisRead analysis
AttacksarXiv 2606.12716Jun 11
PaperGuard：针对多模态 AI 同行评审的攻击与防御基准
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
arXiv
2606.12716
Published
Jun 11
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。
PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。
Paper analysisRead analysis
AttacksarXiv 2605.24421May 23
研究者提出日志型提示注入攻击，可抑制 SOC 中 LLM 分析助手的恶意日志识别
提出日志基底提示注入，操纵 SOC 分析员的分类、摘要与处置建议
arXiv
2605.24421
Published
May 23
Layer
Application layer
Setting
LLM applications
Evaluated models
gpt-4o-mini
- AttacksPrompt injection
- TechniqueConversation structure manipulation
Abstract在 gpt-4o-mini 上，人格劫持与上下文操纵可改写 SOC 分析输出，直接覆盖在分类上无效。
Paper analysisRead analysis
AttacksarXiv 2603.16960Mar 17
针对现代视觉语言模型的对抗攻击
对开源视觉购物智能体实施商品图对抗攻击并诱导买错
arXiv
2603.16960
Published
Mar 17
Layer
Application layer
Setting
web agent
Evaluated models
LLaVA-v1.5-7B, Qwen2.5-VL-7B
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract作者称 LLaVA 易被三种攻击诱导买错，Qwen 正确购买率仍接近其干净条件。
作者在自建电商环境里比较两个开源 VLM 购物智能体对图像对抗扰动的鲁棒性。
Paper analysisRead analysis
AttacksarXiv 2602.00364Jan 31
"Someone hid it": Query-agnostic black-box attacks against LLM retrieval
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
arXiv
2602.00364
Published
Jan 31
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen-1.5-7B-Instruct, SFR-Embedding-Mistral, E5-Mistral-7B-Instruct and others10
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentRAG
AbstractDQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。
DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Paper analysisRead analysis
AttacksarXiv 2601.21360Jan 29
Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation
提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分
arXiv
2601.21360
Published
Jan 29
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-V3.2, Qwen3-235B, GPT-OSS-120B and others9
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract作者称 RLHF 的服从性使评分脱离代码。
这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。
Paper analysisRead analysis
AttacksarXiv 2512.10449Dec 11, 2025
研究：不可见文本注入可让 LLM 审稿系统把拒稿翻成接收
提出 DSAAP，以不可见文本对科学审稿 PDF 做间接提示注入
arXiv
2512.10449
Published
Dec 11, 2025
Layer
Application layer
Setting
LLM applications
Evaluated models
gpt-oss-20B, tulu3-8B, Llama 3.1-8B and others13
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2505.11717May 17, 2025
WebInject：通过网页像素扰动对多模态网页 Agent 实施提示注入
提出 WebInject，用网页像素扰动诱导网页 Agent 执行指定动作
arXiv
2505.11717
Published
May 17, 2025
Layer
Application layer
Setting
web agent
Evaluated models
UI-TARS-7B-SFT, Phi-4-multimodal-instruct, Llama-3.2-11B-Vision-Instruct and others5
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
AbstractWebInject 经源码扰动原始像素。
WebInject 是对 MLLM 网页智能体的环境提示注入：修改网页源码，使原始像素上的扰动经过显示器映射后，诱导智能体执行攻击者指定动作。
Paper analysisRead analysis
AttacksarXiv 2406.12814Jun 19, 2024
论文提出 ARE 框架，在 VisualWebArena 上评估多模态 Agent 的对抗鲁棒性
提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
arXiv
2406.12814
Published
Jun 19, 2024
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, GPT-4V, Claude-3-Opus and others4
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentVision
Abstract系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop