PatchBench 提出激活补丁局部评测协议，揭示越狱修复的附带损伤(original, opens in a new tab)

提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤。

Why it was selectedPatchBench 把越狱修复评测从全局指标转向局部邻域，揭示补丁可能只压制表面措辞却误伤相近良性提示。

The paper points out that the reliability of LLM vulnerability repair benchmarks is affected by evaluation design.(original, opens in a new tab)

Use controlled experiments to isolate the effect of evaluation design on vulnerability patch benchmark scores.

研究者提出 PackHallu：经规则文件提示注入对编码 Agent 发起包幻觉攻击(original, opens in a new tab)

提出 PackHallu，经规则文件提示注入诱导编码 Agent 换用攻击者指定包。

The study finds that reasoning token counts increase when large language models are prompted to answer dishonestly(original, opens in a new tab)

Test whether reasoning token counts can distinguish prompted honest from dishonest answers.

A personality hierarchy model explains context generalization in fine-tuned LLMs; PPR regularization reduces RL reward hacking to below 0.2%(original, opens in a new tab)

提出人格层级模型并设计 PPR 抑制奖励作弊的跨上下文泛化。

SpecGuard 用 Lean 证书在编码 Agent 执行前证明任务冲突(original, opens in a new tab)

提出 SPECGUARD，用 Lean 证书在编码 Agent 执行前证明任务冲突。

Why it was selected论文把任务描述与测试分别形式化，用 Lean 证书在 Agent 执行前证明二者不可同时满足，为奖励作弊提供了可独立复核的前置检查思路。

AI 投稿激增，ICLR、ARR 与 arXiv 相继限制投稿数量(original, opens in a new tab)

AI 论文投稿量激增，计算机科学会议开始限制作者投稿数量。ICLR 十年前的投稿约 500 篇，2027 年会议截止时已超过 4 万篇。ICLR 与 ACL 的 ARR 系统已把多数作者在每个投稿窗口的投稿上限设为 20 篇，ICLR 政策自 2027 年会议生效，ARR 政策本月生效，并限制第一作者投稿不超过 5 篇。ICLR 今年 19500 篇投稿中有 20% 没有合格的互评审稿人，ARR 5 月收到的 17000 篇中约 38% 缺少合格审稿人。ARR 对没有合格审稿人的论文采用抽签决定是否送审。

Study: Multi-vector visual document indexes can be inverted to recover page content(original, opens in a new tab)

Proposes a flow matching inversion framework to reconstruct pages from multi-vector visual document indexes.

Why it was selectedThe paper provides concrete success rates for inverting multi-vector visual document indexes and the failure boundaries of two cheap defenses; teams operating vector databases can use this to reassess the sensitivity level of their indexes.

WebFovea 提出视觉网页智能体四阶段加固框架，WebRetriever 挑战赛得分从 31.0 升至 57.0(original, opens in a new tab)

提出 WebFovea，加固视觉网页智能体的解析、执行、反馈与观察往返。

nanoMuse 发布开源个人智能体，跨设备共享对话并内置 Sentinel 动作审查(original, opens in a new tab)

发布开源个人智能体 nanoMuse，经 Sentinel 审查设备屏幕动作。

R-Quest：用问题有效性与新颖性反馈维持推理模型自我进化(original, opens in a new tab)

提出 R-Quest，用有效性与新颖性反馈维持推理模型自我进化。

UC Berkeley proposes BenchJack, which automatically audits 10 agent benchmarks and finds 219 reward hacking defects.(original, opens in a new tab)

UC Berkeley researchers propose BENCHJACK to audit reward hacking flaws in agent benchmarks.

Sleight-Bench: 20 of 40 attacks were never detected by Opus 4.6 monitoring.(original, opens in a new tab)

Build SLEIGHT-Bench to evaluate code agent monitoring capture of conceptual blind-spot evasions.

CheckerBench: Can long-horizon agents synthesize static analysis checkers?(original, opens in a new tab)

Using CheckerBench to evaluate long-horizon coding agents synthesizing static analysis checkers.

Transect：为长程 LLM Agent 评测保留可观测性的开源工具(original, opens in a new tab)

提出 Transect，将长程 Agent 评测转录对齐到可回查的共享时间线。

Study audits 200 vibe coding apps and finds 1,186 vulnerabilities.(original, opens in a new tab)

Audit deployed vibe coding applications and analyze vulnerability causes and mitigation conditions.

安全动作不等于可行动作：VICS-G 为 VLA 策略做可行未来解码(original, opens in a new tab)

提出 VICS-G 可行未来解码，重排冻结 VLA 策略的动作候选。

POLAR：面向小型工具调用智能体的可逆性护栏框架(original, opens in a new tab)

提出 POLAR 本体门控，在执行前否决不可逆工具调用。

ParanoiaEval: Benchmark Release for Unnecessary Risk Disposition in Coding Agents(original, opens in a new tab)

Proposes ParanoiaEval to evaluate unnecessary risk disposition in coding agents.

A study measures the capability boundaries of a policy gate in cross-platform command adjudication(original, opens in a new tab)

They propose a policy gate that adjudicates implemented actions and measure cross-platform command interception boundaries.

The study provides a theoretical analysis of the robustness upper bound for latent-space image watermarks(original, opens in a new tab)

Analyze the intrinsic robustness upper bound of latent-space image watermarks against pixel perturbations.

STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击(original, opens in a new tab)

提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动。

ProbeGuard：按共识形成过程判断弃答，识别医疗问答中的一致错误(original, opens in a new tab)

提出 ProbeGuard，按共识形成过程对医疗问答做选择性弃答。

The paper empirically measures the failure correlation of the Agent tool-calling gating stack(original, opens in a new tab)

Proposes nmult and evaluates error correlation in stacked Agent action gateways.

ConEx：通过概念感知归因生成人类可解释的显著性图(original, opens in a new tab)

提出 ConEx，自动发现类别概念并生成可定位解释图。

SBW: A Semantic Behavioral Watermarking Method for LLM Agents(original, opens in a new tab)

Propose SBW, a semantic behavior watermark for LLM agent trajectories that is robust to rewriting and forgery.

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降(original, opens in a new tab)

实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击。

Two-stage agent trajectory auditing framework: reduce monitoring costs using gating rules plus LLM auditing(original, opens in a new tab)

Proposes a two-stage gated auditing framework that blocks harmful agent actions before execution.

Study: post-training recipes determine whether large models act against their own moral judgments(original, opens in a new tab)

提出知行差距面板，测量压力下模型是否违背自身判断。

A survey of in-parameter memory enhancement for large language models(original, opens in a new tab)

Review of injection sites and acquisition timing for in-parameter memory at deployment.

NetAgent: an agent framework for multi-task network traffic analysis(original, opens in a new tab)

Proposes NetAgent, orchestrating tools to complete multi-task network traffic analysis.

IAU-FOA: A Transferable Adversarial Attack Method for Closed-Source Multimodal Large Models(original, opens in a new tab)

Proposes IAU-FOA, which constructs transferable image perturbations to induce multimodal models to output target semantics.

A study auditing the frequency and decoder-layer attribution of the Qwen2-Audio audio jailbreak AdvWave-P(original, opens in a new tab)

Occlusion audit of the band necessity and decoder-layer association of the AdvWave-P audio jailbreak.

How Learning Style Affects Forgetting: Machine Unlearning under the Memorization–Generalization Spectrum(original, opens in a new tab)

Analyzing how memorization and generalization determine retain damage in machine unlearning.

RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准(original, opens in a new tab)

提出 RAG-PIBench，评测 RAG 上下文中提示注入检测器。

LADE：用暗知识中的模型无关潜在安全信号防御 LLM 越狱(original, opens in a new tab)

提出 LADE，用首 token 暗知识在生成前过滤越狱查询。

SSRFT: An LLM safety alignment framework that internalizes safety roles instead of refusal patterns.(original, opens in a new tab)

Proposes SSRFT, which uses role supervision to internalize safety principles as a replacement for refusal-based alignment.

Study the role of image properties in image-to-text jailbreak through controlled decomposition(original, opens in a new tab)

Fixing the harmful instruction, single-axis attribution of image properties for image-to-text jailbreak.

APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.(original, opens in a new tab)

提出 APEX，在执行边界用授权契约防御 Agent 间接提示注入。

Why it was selectedAPEX 把间接提示注入的防护从识别攻击模式转到执行边界，用授权契约同时约束越权动作与未背书信息使用，并给出跨 Tool、MCP、Skill 的评测数据。

SafeActBench release: failure modes of tool-based agents on the evidence-to-action chain(original, opens in a new tab)

Building SAFEACTBENCH to evaluate tool agents' evidence-to-action failures.