| [1] 李南,丁益东,江浩宇,等.面向大语言模型的越狱攻击综述[J]. 计算机研究与发展,2024,61(5):1156-1181.
[2] Shayegani E, AL Mamun M A, Fu Y, et al. Survey of vulnerabilities in large language models revealed by adversarial attacks[PP/OL]. (2025-09-01). https://arxiv.org/abs/2310.10844.
[3] Wei A, Haghtalab N, Steinhardt J. Jailbroken: How does LLM safety training fail?[C]//Advances in Neural Information Processing Systems 36 (NeurIPS 2023). Red Hook, NY: Curran Associates, Inc., 2023: 80079-80110.
[4] 张磊,乔俊钊,张强,等. 生成式大模型越狱攻击、防御与评估基准[J/OL]. 计算机科学与探索,1-35. http://fcst.ceaj.org/CN/10.3778/j.issn.1673-9418.2604068.
[5] 程翔,曹晟,陈厅,等. Int-AD:面向提示注入攻击的攻防一体化框架[J/OL]. 软件学报,1-17. https://www.jos.org.cn/jos/article/abstract/7675.
[6] Greshake K, Abdelnabi S, Mishra S, et al. Not what you've signed up for: Compromising real-world llm-integrated applications with indirect prompt injection[C]//Proceedings of the 16th ACM workshop on artificial intelligence and security. New York: ACM, 2023: 79-90.
[7] Qi X, Zeng Y, Xie T, et al. Fine-tuning aligned language models compromises safety, even when users do not intend to![C]//Proceedings of the 12th International Conference on Learning Representations. Vienna, Austria, 2024: 30988-31043.
[8] 黑一鸣,陈文弢,陈杰,等. 大模型安全风险评估与防御技术综述[J].中国信息安全,2024,(6):24-27.
[9] Ouyang L, Wu J, Jiang X, et al. Training language models to follow instructions with human feedback[J]. Advances in neural information processing systems,2022,35:27730-27744.
[10] Bai Y, Kadavath S, Kundu S, et al. Constitutional AI: Harmlessness from AI Feedback[EB/OL]. (2022-12-15) https://arxiv.org/abs/2212.08073.
[11] Robey A, Wong E, Hassani H, et al. SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks[EB/OL]. (2023-10-05). https://arxiv.org/abs/2310.03684.
[12] Jain N, Schwarzschild A, Wen Y,et al. Baseline defenses for adversarial attacks against aligned language models[J]. arXiv preprint arXiv:2309.00614,2023.
[13] Behzadan V, Munir A. Models and framework for adversarial attacks on complex adaptive systems[J]. arXiv preprint arXiv:1709.04137,2017.
[14] Korobeynikov F, Mokhor V. Adaptive security: strategic principles for complex socio-technical systems[J]. Royal Society Open Science, 2026,13(1):251481.
[15] Dong S, Xu S, He P, et al. Memory injection attacks on LLM agents via query-only interaction[C]// Advances in Neural Information Processing Systems 38 (NeurIPS 2025). Red Hook, NY: Curran Associates, Inc., 2025: 46697-46731.
[16] Owasp Foundation. OWASP Top 10 for Agentic Applications for 2026[EB/OL].(2025-12-09) .https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026.
[17] Anthropic. Disrupting the first reported AI-orchestrated cyber espionage campaign[EB/OL]. (2025-11-13). https://www.anthropic.com/news/disrupting-AI-espionage.
[18] Liu Y, Chen Z, Zhang Y, et al. “ Do Not Mention This to the User”: Detecting and Understanding Malicious Agent Skills in the Wild[PP/OL]. arXiv(2026-02-06)[2026-09-21]. https://arxiv.org/abs/2602.06547.
[19] Anthropic. Anthropic’s Responsible Scaling Policy[EB/OL].(2026-08-14).https://www.anthropic.com/responsible-scaling-policy.
[20] Choi M, Yang S, Kim D, et al. Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense[PP/OL]. arXiv(2026-06-04)[2026-09-1]. https://arxiv.org/abs/2606.05743.
[21] Shirey R. Internet Security Glossary, Version 2: RFC 4949[R/OL]. (2007-08). ttps://www.rfc-editor.org/info/rfc4949. |