Tag
This paper benchmarks four model stealing attacks against spiking neural networks (SNNs) and their ANN counterparts on MNIST, Fashion-MNIST, and CIFAR-10, finding SNNs consistently harder to steal due to their temporal, spike-based computation.
研究评估了五个 AI-for-Science 智能体框架在 50 个有害化学请求下的安全表现，发现将 LLM 集成到领域智能体框架后，即使直接提示也会增加有害遵从率，且针对基础模型基本无效的自适应攻击在接入框架后变得高度成功，表明基础模型的安全性在智能体框架下并不持久。
该论文研究了针对安全多智能体强化学习 (SMARL) 的推理时观测攻击，提出了 MinMax Attack 框架，能在保持任务奖励的同时显著提高安全代价，从而兼具攻击有效性与隐蔽性。
This paper introduces the concept of "effective-horizon compression" in multi-turn jailbreak attacks, showing that roughly half of the original query sequence is enough to recover the same attack progress, and demonstrates that downweighting less-relevant earlier queries improves attacker training and defense performance.
作者设计并开源了 KillSwitch，一种专为对抗 LLM 和编码代理而构建的栈式编程语言，利用隐藏谎言规范、字符计数规则、触发安全护栏的语句等特性，并对主流 LLM 进行了基准测试，Claude Opus 5 表现最佳。
该论文提出 GraphRAG-LTM 分层威胁建模框架，测试三种攻击者访问层级（黑盒查询、白盒查询、图感知白盒），发现检索排序操纵与关键三元组删除能显著削弱 GraphRAG 的答案质量与支撑事实检索。
该论文研究了生成式推荐模型在黑盒条件下对条件性定向数据投毒的脆弱性，提出 AlignPoison 框架，通过发现与解码对齐的上下文前缀，在注入不到 1% 恶意交互的情况下即可显著提升目标推广成功率。
AgentSafeEvo 提出一种基于攻防博弈的对抗协同进化强化学习框架，联合训练攻击者与防御者 LLM 智能体，以提升多轮工具调用场景下的安全性，同时保持通用能力不下降。作者在七个安全与能力基准上进行了评测，并开源了代码、模型和数据集。
提出 DecisionRobust 基准，系统评估 JEV 风格决策模型在文本与视觉输入下的对抗鲁棒性，涵盖文本/图像扰动与提示注入等攻击，揭示了模型鲁棒性的多项关键发现。
文章介绍了 OpenAI 为满足欧盟 AI 法案第 50(2) 条来源透明度要求而推出的文本水印 textGrain，并展示其发布的失效曲线：同义词替换 10% 时检测率从 92% 降至 66%，替换 25% 时仅剩 17%。作者还构建了一个交互式攻击实验室，可实时演示翻译回译、同义词替换和数学化文本如何让水印检测的 p 值崩塌，强调未检测到水印并不能证明内容出自人类之手。
该论文研究多智能体bandit学习中探索信号泄露带来的安全隐患，提出deceptive bandit learning（DBL）动力学，证明对手可通过耦合自身探索注入外部性使系统收敛到新的deceptive Nash equilibrium（DNE），并保持最优收敛速率且放宽了二阶光滑性假设。
该论文揭示了针对公开ASR基础模型生成的对抗扰动可有效迁移至微调后黑盒模型的风险，并提出TransferBreaker统一微调框架（结合Base Adversarial Fine-Tuning、Latent Jacobian Regularization与HybridGrad-AFT），在三种语言和四个大型ASR模型上将对抗WER从92.6降至27.8。
该论文提出 Adversarial Surface-Form Robustness Dataset (ASRD)，用四态评估框架对五个开源大模型在 2,100 个非规范形式提示（表情符号、Leetspeak、编码封装、隐形 Unicode 等）下的安全表现进行评测，揭示了表情符号几乎不影响理解而编码类输入导致高理解失败率等规律。
The paper demonstrates a targeted bias injection attack on frozen diffusion language models (dLLMs) using a proportional-integral closed-loop controller that adapts steering strength during denoising, strongly increasing biased answers on benchmarks like BBQ and SocialStigmaQA, and argues bias audits must examine the serving stack rather than just the frozen model.
An interactive demonstration showing how prefix injection attacks can be used to jailbreak LLMs, letting users craft injected prefixes and system prompts to elicit unwanted model behavior.
论文提出 ForgePrint（搜索-蒸馏框架），通过定向改写将一个模型的输出伪装成目标模型的指纹，使归因分类器误判来源模型，在 CNN/DM 上达到 70.2% 的目标成功率，说明文本归因不能等同于来源真实性。
This paper evaluates whether open-weight instruction-tuned language models maintain safe behavior during long adversarial conversations, finding that safe-response rates drop from 85-100% on the first turn to 15-44% by depth 101, demonstrating that strong single-turn safety does not persist across sustained interaction.
OpenAI disclosed a coordinated adversarial model-distillation campaign that sought to extract protected reasoning from its models, attributing a core cluster of the activity to individuals associated with Moonshot AI (developer of Kimi).
A Wayne State University paper introduces DSAR, a metric quantifying inconsistency between reasoning traces and final answers in Large Reasoning Models, and proposes SARA, an RL-based method rewarding safety-aware reasoning to mitigate deceptive safety alignment under standard and adversarial prefilling attacks.
The paper proposes PX-UAP, a method using probabilistic robustness and explainable AI to generate universal adversarial perturbations against deep reinforcement learning-based intrusion detection systems, demonstrating improved attack effectiveness in experiments.