Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 18 papers
Filter3

Attack type

Prompt injection4Poisoning and backdoors17

Attack technique

Gradient and representation optimization15Automated search7Encoding and obfuscation3Cross-modal payloads4Defense-targeted8Dormant triggers18

Impact

Unauthorized actions6Output manipulation7

System type

Models and APIs7AI Agent11coding agent3

Attack surface / entry point

User input15Web pages and interfaces4Documents and messages8Tool responses5Tool and skill descriptions5Code repositories and dependencies5Retrieval corpus4Memory writes16Images, audio and video8Training data15Weights and gradients14Distribution channels16

Layer

Application layer7Training and data layer9

System component

Memory3Fine-tuning and open weights12Multimodal3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.
Attack technique：Dormant triggersAttack surface / entry point：Web pages and interfacesAttack surface / entry point：Weights and gradientsClear all

Another 261papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.13928

    AI models can provably hide arbitrary capabilities

    Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities

    arXiv
    2610.13928
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 3 270M
    AbstractThe authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.

    The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.

    Paper analysisRead analysis
  2. AttacksarXiv 2610.09819

    FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

    提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门

    arXiv
    2610.09819
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    HuBERT-base, WavLM-base

    Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。

    Paper analysisRead analysis
  3. AttacksarXiv 2610.07654

    研究揭示策略蒸馏的安全后门风险

    测量带后门教师经 OPD 向干净学生迁移潜伏后门

    arXiv
    2610.07654
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-1.5B-Instruct, Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct
    Abstract作者称 OPD 可在压低无触发词有害率时迁入后门。

    带后门的外部教师经 OPD，可在压低无触发词有害率的同时，把触发条件下的有害行为传给初始干净学生。。

    Paper analysisRead analysis
  4. AttacksarXiv 2610.07510

    PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

    提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据

    arXiv
    2610.07510
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
    Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。

    本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。

    Paper analysisRead analysis
  5. AttacksarXiv 2610.06049

    研究者提出仅修改 SAE 解码器的后门攻击，可在不改动语言模型的情况下植入行为

    提出只改 SAE 解码器的后门，在冻结语言模型上植入代码插入

    arXiv
    2610.06049
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 3 4B Instruct, Qwen3 1.7B, Llama 3.1 8B Instruct
    Abstract只改解码器的 SAE 可带上代码插入后门，且若干常规质量指标变化不大。

    只改 SAE 解码器、冻结编码器与语言模型，即可把代码插入行为放进推理时的辅助组件。作者把这视为 SAE 供应链问题：checkpoint 一旦替换某一层激活，就参与后续计算，而不只是解释工具。

    Paper analysisRead analysis
  6. AttacksarXiv 2610.05793

    研究者训练出按多智能体拓扑触发的代码后门模型

    提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞

    arXiv
    2610.05793
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct

    Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.05453

    研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私

    提出 PLW，用微调把先前对话敏感触发编码进后续生成图像

    arXiv
    2610.05453
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    OmniGen2, BAGEL-7B

    AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。

    Paper analysisRead analysis
  9. AttacksarXiv 2609.37468

    论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法

    提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测

    arXiv
    2609.37468
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    E5, Contriever-MSMARCO

    Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。

    Paper analysisRead analysis
  10. AttacksarXiv 2609.22510

    特拉维夫大学提出爆炸性提示词：条件触发的间接提示注入可绕过九款生产 Agent

    提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse

    arXiv
    2609.22510
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Llama-3.1-8B-Instruct, Llama-3.1-70B-Instruct, Qwen2.5-32B-Instruct and others15
    Abstract论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。

    论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。

    Paper analysisRead analysis
  11. AttacksarXiv 2609.14060

    AgentQ：针对 LLM Agent 的量化条件后门攻击

    提出量化条件后门 AGENTQ，使智能体仅在量化后触发恶意工具调用

    arXiv
    2609.14060
    Published
    Layer
    Training and data layer
    Setting
    AI Agent
    Evaluated models
    Qwen3.5-2B, Qwen3.5-4B, Qwen3.5-9B and others6

    Abstract论文研究了智能体量化条件后门风险，提出 AGENTQ 在保持效用的同时实现全精度隐蔽与量化后生效。

    Paper analysisRead analysis
  13. AttacksarXiv 2609.07051

    TrojanWorld：通过想象引导对世界模型智能体植入后门

    提出 TrojanWorld，用物理触发器对世界模型智能体植入想象引导后门

    arXiv
    2609.07051
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    TD-MPC2, DreamerV3, R2-Dreamer

    AbstractTrojanWorld 揭示了世界模型智能体的供应链后门风险，通过在世界模型中操纵想象可实现对闭环动作的持续控制。

    Paper analysisRead analysis
  14. AttacksarXiv 2608.06862

    SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化

    提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链

    arXiv
    2608.06862
    Published
    Layer
    Application layer
    Setting
    Browser and computer use, coding agent
    Evaluated models
    Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B

    Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。

    Paper analysisRead analysis
  15. AttacksarXiv 2606.04329

    研究者系统研究 LLM 智能体记忆投毒攻击并提出 MPBench 基准

    系统研究 LLM 智能体记忆投毒并构建基准 MPBench

    arXiv
    2606.04329
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Meta-Llama-3.1-70B-Instruct, Deberta-v3-base, Llama-3.1-8B-Instruct and others5

    Abstract系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。

    Paper analysisRead analysis
  16. AttacksarXiv 2605.15338

    隐藏于记忆：LLM Agent 的潜伏记忆投毒

    提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆

    arXiv
    2605.15338
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4, GPT-5.5, Claude Sonnet 4.6 and others12
    Abstract持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。

    sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。

    Paper analysisRead analysis
  17. AttacksarXiv 2604.03890

    从提示到物理动作：针对 LLM 中介机器人控制系统的结构化后门攻击

    提出结构化 JSON 后门，经投毒 LoRA 在机器人控制中触发恶意动作

    arXiv
    2604.03890
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics, LLM applications
    Evaluated models
    Llama-3.1-8B-Instruct, Gemma-2-9B-IT, DeepSeek-R1-Distill-Llama-8B and others4

    Abstract推理层后门传不到执行。

    Paper analysisRead analysis
  18. AttacksarXiv 2604.02623

    论文提出 eTAMP 攻击：网页内容注入可跨会话污染 Web Agent 记忆

    提出 eTAMP，用网页内容跨会话投毒 Web Agent 轨迹记忆并诱导越权操作

    arXiv
    2604.02623
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    GPT-5-mini, GPT-5.2, GPT-OSS-120B and others6
    Abstract论文提出了基于环境注入的跨任务记忆投毒攻击 eTAMP，作者报告智能体在环境压力下易感性增加且能力与安全并不协同。

    该论文评估了基于大语言模型的 Web 智能体在利用历史交互轨迹进行记忆增强时的安全脆弱性。

    Paper analysisRead analysis
You have reached the end