Multi-turn jailbreak attacks on multimodal large language models and FragGuard defense(original, opens in a new tab)

Proposes multi-turn multimodal jailbreak and uses FragGuard to intercept harmful responses.

The research proposes a learning-based automated adversarial red-teaming framework for evaluating the robustness of large language models.(original, opens in a new tab)

Proposes a constrained adversarial search red-teaming framework that systematically discovers multiple classes of model robustness vulnerabilities.

MultiTurnPSB: Four-round medical jailbreak evaluation shows single-round benchmarks mask a 19x safety gap(original, opens in a new tab)

Build MultiTurnPSB to evaluate four-turn medical jailbreaks and classifier input defenses.

Why it was selectedThe paper uses a four-turn dialogue benchmark to reveal model safety gaps invisible to single-turn evaluation, and provides quantified results for classifier interventions and the cost of false positives.

Paper proposes adaptive attack framework that breaks through 12 LLM jailbreak and prompt injection defenses(original, opens in a new tab)

Proposes an adaptive attack framework that breaks through jailbreak and prompt injection defenses.

Study replicates package name hallucination across five frontier models: 127 common hallucinated package names across models, 53 still registerable(original, opens in a new tab)

Re-evaluating package name hallucination and squatting attack surface in code generation by frontier models.

Why it was selectedThe paper reproduces package name hallucination measurements on five frontier models and provides the set of package names commonly hallucinated across models and the subset that remains registrable, which can be used to assess the slopsquatting attack surface.

RedDiffuser: Using reinforcement diffusion to generate visual inputs for auditing VLM multimodal safety failures(original, opens in a new tab)

Propose RedDiff, using reinforcement diffusion to generate images for auditing VLM contextual safety failures.

VideoSTF reveals output repetition problems in video large models, with temporal perturbation attack success rates up to 98%(original, opens in a new tab)

Propose VIDEO STF to evaluate output repetition in video LLMs and stress-test temporal perturbations.

RL-Hammer: training an attack model from scratch with GRPO, achieving 72% attack success rate against defended GPT-5(original, opens in a new tab)

Researchers from Meta FAIR and the University of Maryland propose RL-Hammer, which trains an attack model from scratch to perform prompt injection through tool outputs.

The researchers propose the MM-Plan multimodal jailbreak framework, with an attack success rate of 46.3% against Claude 4.5 Sonnet(original, opens in a new tab)

Proposes the MM-Plan multimodal jailbreak framework, automatically planning multi-turn image edits to jailbreak visual exclusivity targets.

ContextLeak: Auditing Privacy Leakage in Private In-Context Learning(original, opens in a new tab)

Proposes ContextLeak, auditing private ICL leakage using canary membership inference.

Researchers propose TIP: using tree-structured search to generate stealthy injection payloads for MCP(original, opens in a new tab)

Propose TIP, using tree search to generate stealthy injection payloads for MCP responses.

STAC: How Seemingly Harmless Tool-Calling Chains Break LLM Agents(original, opens in a new tab)

Researchers at AWS AI Labs propose the STAC framework, which decomposes malicious goals into multi-round chains of seemingly harmless tool calls.

研究揭示修辞如何对 AI 审稿人实施奖励作弊(original, opens in a new tab)

测量内容保留的修辞改写如何改变 AI 审稿分数。

The paper models the sub-agent inheritance attack surface in multi-agent networks(original, opens in a new tab)

Modeling and exploiting memory inheritance vulnerabilities during sub-agent generation in multi-agent networks.

The MOSAIC framework uses CLI command combination attacks against coding agents, achieving a success rate of 96.59%(original, opens in a new tab)

Researchers from Sun Yat-sen University, Shandong University, Peking University, and Hong Kong University of Science and Technology propose MOSAIC, using a CLI security knowledge base to construct command combination attacks against coding agents.

Why it was selectedThe paper proposes CLI command combination risk, distills a knowledge base from CVEs and PoCs to generate attack chains, reports success rates on five coding agents, and tests five defenses.

The paper proposes LPCI: prompt control injection attacks targeting the agent logic layer and persistent memory.(original, opens in a new tab)

Proposes LPCI, which writes delayed conditional payloads into memory and retrieval stores to trigger across sessions.

ASPI benchmark: prompt injection attack success rate rises substantially when agents seek clarification(original, opens in a new tab)

Builds the ASPI benchmark to evaluate prompt injection vulnerability when agents seek clarification.

Why it was selectedThe paper uses paired experiments to isolate the clarification state as a new attack surface and provides the attack success rate changes for ten models, which can help teams deploying interactive agents reassess their evaluation criteria.

MobiRed framework evaluates prompt injection attacks via third-party channels on eight mobile LLM agents(original, opens in a new tab)

Use MobiRed to evaluate mobile LLM agents against prompt injection via third-party channels.

Study: LLMs in multi-agent systems are more easily misled by peer consensus than corrected by it(original, opens in a new tab)

Compare the strength of harmful revision versus beneficial revision under multi-agent peer consensus.

DREAM framework evaluates 12 LLM agents with cross-environment long-chain attacks, with over 68% of attacks bypassing existing defenses(original, opens in a new tab)

Researchers from Nanjing University, the University of Hong Kong, and other institutions propose the DREAM framework to evaluate agents' vulnerability to cross-environment long-chain attacks.

The book "Foundations of Large Language Models" is released, covering six major topics including pretraining, alignment, and reasoning.(original, opens in a new tab)

讲解自监督预训练得到基础模型及对齐与推理。

The paper proposes using language models as world models for AI research to predict experimental results.(original, opens in a new tab)

Propose a research world model that uses a language model to predict intervention gains.

LGWM: Verifying GUI agent screen transitions with action-conditioned world models(original, opens in a new tab)

提出 LGWM，用动作条件世界模型核验 GUI 智能体屏幕转移。

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text(original, opens in a new tab)

复旦大学等机构的研究者测量 AI 搜索引用脆弱性，证明普通公开发帖可进入引用与回答。

TestJack audits coding benchmarks: 34.4% of passing samples violate task requirements(original, opens in a new tab)

哥伦比亚大学、UC Berkeley 等机构的研究者提出 TESTJACK，动态审计编码基准通过判定是否满足任务要求。

Why it was selected论文给出编码 Agent 基准中约三分之一通过样本实际违反任务要求的量化结果，并对比静态测试增强方法的召回差距。

PyCache Trap exploits Python cache replacement to bypass seven Agent Skill scanners, with an attack success rate of 94–100%(original, opens in a new tab)

提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器。

Why it was selected论文给出缓存替换在七款 Skill 扫描器上的攻击成功率，并附可复现的防御实现，适合做 Skill 准入的团队参考。

Paper reviews OpenAI, Anthropic, and Google agent safety incidents and proposes the PASAC framework(original, opens in a new tab)

提出 PASAC 与五层边界保证栈，把智能体评测越界变成可验证的全系统保证。

Why it was selected论文把三家实验室的 Agent 越界事件并置比较，区分自适应逃逸与配置失误两类路径，并提出可检验的边界保障框架。

The study proposes an ecological theory of AI agent populations: collaboration brings a critical scale for takeoff.(original, opens in a new tab)

为失配智能体种群建立生态模型，说明协作产生起飞临界规模。

研究：法律推理模型引用法条不等于依据法条，注入指令合规率高达 73.3%–96.4%(original, opens in a new tab)

用依据置换与隐层追踪审计法律思维链是否真正依赖所引法条。

Why it was selected论文用反事实替换法律依据并解码隐藏状态，量化了模型引用权威与实际依赖权威之间的落差，为思维链忠实性审计提供了可迁移方法。

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation(original, opens in a new tab)

提出选项通道攻击，重命名选项标签使 Agent 护栏放行违规操作。

Why it was selected论文把护栏的放行与误拦分开统计，并给出选项标签这一被忽视的攻击面，部署 Agent 网关的团队可据此检查调用库是否把标签送入模型。

研究提出 Agent 安全新维度：识别未履行的安全义务(original, opens in a new tab)

提出义务识别基准 ObligationBench，并训练护栏识别 Agent 未履行的安全义务。

EpiReal-Bench：商用图像生成模型虚假声明红队基准，直接提示攻击成功率超 70%(original, opens in a new tab)

构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据。

Why it was selected论文给出四款商用图像生成模型在虚假声明提示下的攻击成功率，并公开了基准与攻击框架，可对照检查自家模型的生成侧护栏。

研究：叙事包装可跨语言绕过 LLM 拒答，Qwen3-1.7B 上古文攻击成功率达 95.7%(original, opens in a new tab)

提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱。

The paper proposes the ISE framework to evaluate LLM agents' epistemic humility under knowledge conflicts(original, opens in a new tab)

提出 ISE 框架，评测 LLM Agent 在知识冲突下的认知谦逊。

FearCaut-Qwen: Activation steering changes the risk judgment criteria of vision-language models(original, opens in a new tab)

用恐惧激活转向检验视觉语言模型的隐患判定准则。

RouterInterp: Explaining Superposition Specialization in MoE Routing(original, opens in a new tab)

提出 RouterInterp，用 SAE 解释 MoE 路由的叠加特化。

用路由稀疏自编码器解耦语音编码器中的语言学与副语言学信息(original, opens in a new tab)

提出路由 TopK SAE，把语音编码器稀疏码拆成语言与副语言通路。

Nullify：面向 LLM 遗忘的零空间激活引导免训练方法(original, opens in a new tab)

提出零空间激活引导 Nullify，免训练擦除指定记忆并保持效用。

The researchers conduct a psychometric review of HELM Safety and HarmBench, questioning whether their scores can represent a single attribute(original, opens in a new tab)

审计 HarmBench 分数能否代表单一 harmful refusal 属性。

ReSI: A recursive safety improvement framework for attack resistance and unknown-risk resistance.(original, opens in a new tab)

提出 ReSI，用自动红队与配方搜索递归改进模型安全对齐。