MiMo-V2.6: Toward Self-Improvement via Scaled Reinforcement Learning(original, opens in a new tab)

扩展全模态基座的强化学习以支撑智能体自我改进。

What output-only review cannot verify: a research contract for research agents(original, opens in a new tab)

Proposes a research contract that binds approved choices to execution evidence and verifies them with a checker.

研究者提出可检查评分器与自改进 Agent 共同演化方法(original, opens in a new tab)

演化可检查评分器并与自改进 Agent 共同演化，抑制奖励作弊。

Why it was selected论文用锚定选择替代下游分数来验证自演化评分器，并给出一个可读检测器修复代理博弈的完整案例。

Envelope sampling: recalibrating LLM judges with a small amount of ground-truth labels to mitigate reward hacking(original, opens in a new tab)

Propose envelope sampling, using a small number of ground-truth labels to recalibrate LLM judges to mitigate reward hacking.

GenUI-Harness: A data-aware generative UI framework for proactive interaction(original, opens in a new tab)

Proposes GENUI-Harness, which uses generated interfaces to collect pending inputs and complete database service tasks.

RH-Detect：统一的奖励作弊检测基准发布(original, opens in a new tab)

构建统一奖励作弊检测基准 RH-Detect 并评测零样本检测器。

Research shows that subliminal learning can transfer new capabilities, backdoors, and cheating tendencies(original, opens in a new tab)

检验潜意识学习能否经无关数据蒸馏传递能力、后门与作弊。

Why it was selected论文用随机 MLP 预测、字母计数和象棋作弊三类任务检验隐蔽学习能传递多复杂的特质，并对比激活引导的泛化差距。

Kosoy proposes a polynomial-time learner for robust bandits, advancing AI alignment(original, opens in a new tab)

Provides a polynomial-time learner for the linear robust bandits special case and proves that small generalizations are NP-hard.

Mathematicians call for a boycott of OpenAI, protesting the flood of AI-generated proofs into mathematics.(original, opens in a new tab)

A group of mathematicians (AHM) issued a statement calling for a boycott of OpenAI, because the company released more than 700 AI-generated mathematical proof files at once, seen as a show of force rather than an academic contribution. Fields Medalist Terence Tao reposted the statement on his blog and proposed that mathematics should enter a Math 2.0 era in which problem-solving is no longer the core metric; complexity theorist Scott Aaronson called the situation a "Mathocalypse." The statement said OpenAI's release violated the core premise of its advisory group AGMAI, namely that advanced mathematical problems should not be tested on internal models, and mentioned the multiple copyright lawsuits OpenAI faces. Aaronson compared the two approaches: OpenAI dumped raw proof drafts at once, leaving the community to do the cleanup work for free; Anthropic, by contrast, worked with two algorithm researchers, with AI providing key ideas that overturned two conjectures that had been open for twenty years, and the researchers were paid and wrote human-readable proofs.

AMU：用派生血缘门控实现企业 AI Agent 列级访问控制(original, opens in a new tab)

提出 AMU 按推导图门控企业 Agent 共享记忆的列级访问。

论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法(original, opens in a new tab)

提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测。

Why it was selected论文提出仅替换检索器检查点即可操纵 Agent 搜索轨迹的三类后门，并给出用净化流程反向隐藏后门的方法。

VerTox: Corpus Poisoning of Neural Ranking Models via Reinforcement Learning with Verifiable Rewards(original, opens in a new tab)

Propose VerTox, which uses verifiable reward reinforcement learning to generate misleading documents and poison retrieval corpora.

研究用 30 项漏洞分析任务评测自主安全智能体的安全对齐效果(original, opens in a new tab)

评测自主安全智能体在授权漏洞分析中的对齐拒答效应。

RefusalBench：拒答率为何会误排前沿 LLM 在生物研究提示上的安全水平(original, opens in a new tab)

提出 RefusalBench，评测生物研究提示上的拒答率与安全校准。

OverEager-Gen released: measuring overeager operations of coding agents on benign tasks(original, opens in a new tab)

用 OVEREAGER-GEN 测量编码 Agent 在良性任务上的越权操作。

Why it was selected论文给出编码 Agent 在良性任务上越权操作的首个基准，并量化了框架权限门控与模型层对齐的差距。

CyberMaskQA：面向网络安全问答的大语言模型隐私感知基准(original, opens in a new tab)

提出隐私感知基准 CyberMaskQA，评测网络安全问答与敏感实体掩码。

Artifact-Bench：评估 MLLM 检测与诊断 AI 生成视频伪影(original, opens in a new tab)

提出 Artifact-Bench，评测 MLLM 检测并诊断 AI 生成视频伪影。

SeClaw 发布面向自主 Agent 的规格驱动安全任务合成与评测框架(original, opens in a new tab)

提出 SeClaw，用规格驱动合成安全任务并评测自主 Agent。

DiscourseFlip：针对黑盒 RAG 的话语级观点操纵攻击(original, opens in a new tab)

提出 DiscourseFlip，用有限文档投毒操纵黑盒 RAG 的话语级观点。

Researchers propose the vision-centric jailbreak attack VJA, achieving an attack success rate of 80.9% against Nano Banana Pro(original, opens in a new tab)

清华大学与鹏城实验室等机构的研究者提出纯视觉越狱攻击 VJA，把有害编辑指令编码进图像。

Why it was selected论文给出视觉提示越狱在多个商业图像编辑模型上的成功率，并配套基准与免训练防御，便于评估图像编辑链路的安全缺口。

从 Mistral Large 3 (675B) 蒸馏人类对齐的隐私敏感性评估能力(original, opens in a new tab)

蒸馏大模型的隐私敏感度评分到小型编码器并检验人类对齐。

SWhisper 用近超声隐蔽声学通道对语音驱动 LLM 实现黑盒越狱(original, opens in a new tab)

提出 SWhisper，用近超声波向语音驱动 LLM 隐蔽注入越狱提示。

Why it was selected论文给出近超声隐蔽声学通道的完整建模与补偿方法，并报告了跨商用与开源语音模型的攻击成功率，语音接口的部署方可据此评估物理层风险。

MAStrike：用 Shapley 值引导多智能体系统协同红队攻击(original, opens in a new tab)

提出 MAStrike，用 Shapley 选联盟对多智能体做共谋红队。

Prometheus：针对文生图扩散模型的免训练提示词窃取攻击(original, opens in a new tab)

提出 Prometheus，从展示图反推文生图模型的在售提示词。

ASO：用GRPO优化视觉风格放大MLLM越狱攻击(original, opens in a new tab)

哈尔滨工程大学、山东大学与西安电子科技大学的研究者提出 ASO，用 GRPO 优化视觉风格以放大越狱攻击。

Why it was selected论文提出用强化学习优化图像风格来放大现有多模态越狱攻击，并给出跨模型与跨基线的成功率提升数据。

研究者提出意图伪装多轮越狱方法，可攻破 GPT-5-thinking 与 Claude-Sonnet-4.5(original, opens in a new tab)

提出多轮意图欺骗越狱 iDecep，用良性意图伪装引出有害内容。

论文提出 CRCP 投毒框架，揭示 RAG 分块与重排序下的投毒失效问题(original, opens in a new tab)

提出 CRCP 框架，优化分块与重排下的 RAG 语料投毒。

研究者提出面向多轮对话的视觉记忆注入攻击 VMI(original, opens in a new tab)

提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息。

AgentAtlas 提出区分结果与控制决策质量的智能体评测框架(original, opens in a new tab)

提出 AgentAtlas 评测框架，区分智能体的结果、控制决策与轨迹质量。

GrandGuard 发布老年聊天机器人安全分类与基准，并给出两种护栏(original, opens in a new tab)

提出老年聊天安全分类与基准 GrandGuard 并评测回复与护栏。

研究分析 14,727 条用户安全与隐私提问，GPT 5.5 与 Llama 4 回答质量差距明显(original, opens in a new tab)

评测 LLM 对真实安全与隐私提问的回答质量与一致性。

CHERRL：可复现、分析与检测评分标准强化学习中的奖励作弊(original, opens in a new tab)

提出 CHERRL 注入裁判偏差以复现奖励作弊，并用 RHDA 检测训练起点。

研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱(original, opens in a new tab)

提出 SN-Guided Diffusion，利用安全神经元实现离线越狱。

Why it was selected论文给出扩散大模型安全神经元可跨架构迁移的证据与攻击成功率，为评估扩散架构对齐脆弱性提供可复现方法。

VidDoS：针对视频大语言模型的通用拒绝服务攻击(original, opens in a new tab)

研究者提出 VidDoS，一个面向 Video-LLM 的通用能耗延迟攻击（ELA）框架，通过通用优化生成与实例无关的触发器，无需在推理时计算梯度。

FERRET：基于扩展的多模态自动化红队测试框架(original, opens in a new tab)

提出 FERRET 框架，用扩展生成多轮多模态越狱对话。

The AudioHijack framework achieves covert audio prompt injection against 13 speech large models(original, opens in a new tab)

提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入。

研究揭示多智能体 LLM 流水线的结构性漏洞(original, opens in a new tab)

提出多智能体流水线的边界攻击，使对抗内容作为可信输入跨层传播。

研究者提出 SeedSnitch 与 PromptPirate，利用种子漏洞窃取扩散模型提示词(original, opens in a new tab)

提出 SeedSnitch 与 PromptPirate，恢复种子后窃取扩散提示词。

研究者提出利用重构与隐藏权衡的多模态大模型越狱方法(original, opens in a new tab)

提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤。

UNIATTACK：面向多层防御的自动化越狱攻击框架(original, opens in a new tab)

提出 UniAttack 单轮黑盒越狱框架，融合攻击特征绕过多层防御。