智能体记忆如何可靠处理不可回答问题：一项系统研究(original, opens in a new tab)

分析外部记忆对智能体处理不可回答问题的影响。

ContextLeak：通过恶意工具窃取 LLM Agent 运行时上下文(original, opens in a new tab)

提出 ContextLeak，用强化学习优化恶意工具描述，诱导 Agent 外泄运行时上下文。

Anthropic 发布 TASTE 基准：评测模型判断 AI 安全研究提案的能力(original, opens in a new tab)

Anthropic 发布 TASTE（The AI Safety Taste Evaluation）基准，用 92 组配对比较衡量模型判断 AI 安全研究提案的能力，以与资深人类研究者偏好的一致率作为指标，估计人类一致率为 77%。基准构建分三步：用 Claude Opus 4.6 配合提示词脚手架生成研究提案，让 AI 安全研究者按总体、高层、方法三个维度打 1–5 分并报告置信度，再筛选高一致性的偏好对。研究者先独立打分，再两两讨论分歧并修改评分，配合只保留自报强置信度的标签，使估计一致率从讨论前的 53% 提升 15 个百分点至 68%；最终再要求总体分差至少 2 分，得到 92 组、77% 一致率的数据。在标准设置下表现最好的模型 Fable 5 仅 60%，低于人类研究者的 77%；Opus 5 与 GPT-5.6-Sol 接近随机水平，尽管它们在通用智能体基准上处于前沿。

Why it was selectedAnthropic 公开了 TASTE 基准的构建流程与模型表现，做研究判断类评测的团队可参考其人类标签提纯方法。

RedEvoAgent：以经验驱动技能演化的自动红队智能体(original, opens in a new tab)

提出 RedEvoAgent，演化攻击技能对黑盒智能体做自动红队。

INTENT-AS-A-TOOL：用意图工具追踪智能体失准(original, opens in a new tab)

提出 INTENT-AS-A-TOOL，用意图工具概率跟踪并干预智能体失准。

研究：评测感知分能力与安全两种框架，能力框架更易预测合规(original, opens in a new tab)

把口头评测感知分成能力与安全框架并检验对服从的预测。

MAMJ：面向视觉语言模型的元自适应多模态越狱攻击(original, opens in a new tab)

提出MAMJ，在元层面交替优化多模态越狱的策略提示与攻击者权重。

扩大模型生成蒸馏数据会让教师隐性特质更易被学生继承(original, opens in a new tab)

检验扩大离任务蒸馏数据后教师隐性特质是否更易被学生继承。

SCOPE：训练有能力且安全的计算机使用智能体(original, opens in a new tab)

提出 SCOPE，联合后训练计算机使用智能体的任务能力与安全决策。

Multi2AV-Safety：首个覆盖 11 种多模态条件组合的音视频生成安全基准(original, opens in a new tab)

研究者提出 Multi2AV-Safety，一个面向音视频生成的安全基准。

EvoMal attack uses self-poisoning of self-evolving coding agents to achieve worm-like propagation(original, opens in a new tab)

提出 EVOMAL，诱导自演化编码 Agent 在创建技能时自我投毒并蠕虫传播。

Why it was selected论文给出六款模型在 SWE-bench 任务上的自我投毒率与传播条件，并说明现有名称、代码与签名筛查为何失效。

GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking(original, opens in a new tab)

Proposes GIFT, which uses encryption and GPU information flow tracking to isolate user data in shared LLM services.

论文揭示多智能体委派结构放大 LLM 安全风险(original, opens in a new tab)

评测多智能体委托结构如何放大模型的安全拒答失效。

StepGuard：用可扩展监督训练步骤级护栏，兼顾安全与效用(original, opens in a new tab)

研究者提出 StepGuard，一个步骤级护栏模型，既能审计已完成的智能体轨迹，也能在工具动作执行前进行检查。

RACER：面向多模态大模型后门的区域感知一致性修复框架(original, opens in a new tab)

提出 RACER，用区域感知一致性对抗微调去除多模态大模型后门。

WebMCP-Phalanx：为浏览器内 LLM Agent 工具调用建立信任边界(original, opens in a new tab)

提出 WebMCP-Phalanx，用能力凭证与双智能体隔离浏览器工具调用。

Researchers conduct a systematic security analysis of Google AP2 v0.2, identifying 48 threats(original, opens in a new tab)

以色列本-古里安大学与 Intuit 的研究者系统分析智能体支付协议的前置上下文操纵与授权威胁。

InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems(original, opens in a new tab)

提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容。

Why it was selectedThe paper provides an attack method and success rates for poisoning an agent's memory with a single interaction; teams deploying memory systems can use this to examine exposure in the retrieval pipeline.

Import AI 470：METR 研究 AI 加速科学发现不均衡；SPADE 自动生成训练环境；Hawkeye 优化 GPU kernel(original, opens in a new tab)

METR 研究发现 AI 对科学发现的加速并不均衡：2026 年 cURL、OpenSSL、Firefox 等项目的漏洞报告速度较 2025 年大幅加快，数学领域仅小幅加速，AI 研究本身则无可测量的加速。多校团队提出 SPADE 框架，让 LLM 交替生成可执行训练环境与求解，在 Qwen3-30B-A3B 上使游戏环境套件平均分达 58.3，较基线提升 8.1。

AgentFlow：面向 LLM 智能体系统的流中心策略语言与运行时防护框架(original, opens in a new tab)

提出 AgentFlow 流策略语言与运行时框架，约束智能体跨步数据流。

Position paper: AI agent design is undermining human oversight capability(original, opens in a new tab)

Advocates using cognitive scaffolding to maintain human oversight of AI agents.

Safe reinforcement learning via a model predictive control approach(original, opens in a new tab)

Schäfer et al. propose a safe reinforcement learning framework that uses MPC as an offline safety oracle to precompute feasible state-action spaces, keeping exploration of robots and cyber-physical systems within mathematically verified bounds. The method maps convex intervals of continuous action spaces via grid search plus binary search, and uses a projection filter to intercept unsafe actions. The authors validated it on a Quanser Aero 2 single-degree-of-freedom pitch platform. Supplementary notes: - The work targets the risk of unconstrained exploration in standard RL on high-inertia hardware, defining irreversible "critical points"—i.e., feasible set boundaries. - Safety determination relies on the MPC optimizer finding a valid action sequence within a future prediction horizon, and the horizon must exceed the system's stopping distance to ensure recursive feasibility.

Hack-Verifiable Terminal Bench：评测终端任务中的奖励作弊(original, opens in a new tab)

提出 HVTB，在终端编程任务植入蜜罐以测量奖励作弊。

SkillBloat：通过技能注入对编码 Agent 发起 token 放大攻击(original, opens in a new tab)

提出 SKILLBLOAT，改写技能文档放大编码 Agent token 消耗。

Study: evaluation awareness in six open-weight models is linearly decodable but weakly correlated with verbal expression(original, opens in a new tab)

用探针与激活导向分析语言模型的评测意识表征及言语化。

Why it was selected论文用探针、LLM 评判与激活引导三种手段测量评测感知，并给出内部表征与口头表达不一致的具体数据。

撒哈拉以南非洲自主 AI 诊断智能体的负责任部署：患者知情与问责缺口(original, opens in a new tab)

梳理已部署自主诊断系统的知情与问责缺口并提出三项最低原则。

SecOPD uses on-policy distillation to reduce adaptive prompt injection attack success rate to 9.0%(original, opens in a new tab)

加州大学伯克利分校研究者提出同策略蒸馏防御微调方法 SecOPD，抵御自适应提示注入。

Why it was selected论文给出 token 级反馈的防御微调配方，并报告在自适应攻击与工具调用场景下的 ASR 对比，可作防御方案选型参考。

ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关(original, opens in a new tab)

提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令。

Anthropic 在单层语言模型中刻画干扰权重(original, opens in a new tab)

Anthropic 可解释性团队训练了一个约 2.9M 参数的单层 Transformer，将其分解为 token、位置、transcoder 特征与 logits 之间的虚拟权重，并沿有效性和有益性两个轴为每个权重打分，首次在训练好的 Transformer 内部通过测量对训练损失的影响确认了干扰权重的存在。有效性用 Fisher 信息度量权重对输出分布的影响，有益性用消融后损失的平均变化度量。

Why it was selectedAnthropic 可解释性团队在单层 Transformer 中首次用损失变化定位干扰权重，为直接读取权重电路提供了可复现的度量方法。

[Daily Paper] String combinations achieve numerous jailbreaks(original, opens in a new tab)

The paper unifies leetspeak, Base64, ROT ciphers, ASCII substitution, and JSON/LaTeX formatting wrappers into a reversible string function library, constructing jailbreak attacks through programmatic combination and random sampling. The method is best-of-n random search rather than an optimizer: given a harmful intent and budget n, it randomly draws n combinations from the transformation library and encodes them to launch attacks; any success determines a jailbreak. Its evaluation uses n=25, judged by the HarmBench classifier. The experiments also summarize two empirical ordering constraints—binary and Base64 encodings can only be applied after word-level transformations, and style wrappers like JSON and LaTeX should always be placed last, otherwise internal transformations break the syntax.

The "Jailbreak Paradox" paper proves two structural impossibility theorems for jailbreak detection and supports them with Tamil black-box experiments(original, opens in a new tab)

The paper proves two impossibility results about jailbreak detection at the structural level: no perfect classifier exists—if one assumes a strongest model immune to jailbreaks, constructing a composite of it with a perfect classifier would be stronger, leading to a contradiction; and a weak model cannot determine jailbreak inputs for a strong model, because the judge's confidence is constrained by its own capability ceiling rather than the target behavior. The authors translate three black-box methods—Albert Jailbreak, Pliny Jailbreak, and CodeJB (two-round code generation)—into Tamil and conduct empirical tests on multiple models at different language capability levels.

论文提出诊断长程安全 LLM Agent 失败来源的检查点方法(original, opens in a new tab)

提出检查点诊断法，区分长程安全 Agent 的失败来源。

aiXamine：跨维度评测 LLM 安全、安全（security）与隐私权衡(original, opens in a new tab)

提出 aiXamine 黑盒基准，统一评测 LLM 安全、稳健与隐私权衡。

Microsoft releases the Thinkingbox sandbox and a 507-task benchmark to evaluate agent reliability in stateful business processes(original, opens in a new tab)

微软等机构的研究者提出 THINKINGBOX 基准评测有状态业务流程 Agent 的执行可靠性。

TempJail：通过字幕时间调度对大型视觉语言模型发起时序越狱攻击(original, opens in a new tab)

研究者提出 TempJail，一种黑盒视频越狱框架，通过构造与查询对齐的对话式字幕序列并优化其时间调度，利用大型视觉语言模型（LVLM）在时间维度上的脆弱性诱导出符合原始有害意图的回答。

HoloCount: A Holistic Visual Counting Benchmark for MLLMs(original, opens in a new tab)

Deng et al. propose HoloCount—a holistic visual counting benchmark for multimodal large language models, covering 1,481 unique visual concepts and diagnosing numerical hallucination through three layers: semantic counting, parsing counting, and robustness testing. Performance collapses notably in high-density scenes: the macro-average accuracy of Qwen3.5-27B, which exceeds 75%, drops to 20%, and Gemini-3.1-Pro-Preview achieves only 49.0% (MAE 10.46). In the empty-target prompt subset, a reverse paradox appears: lightweight models outperform large proprietary engines, reflecting their tendency to avoid overconfident outputs of zero counts.

DAEI：针对噪声防护文本嵌入的反演攻击揭示隐私风险(original, opens in a new tab)

研究者提出 DAEI，一种去噪感知的嵌入反演流程，用于在只能观测到加噪嵌入、无法获得干净嵌入目标的条件下重建原始文本。

VA-Judger：面向联合视频-音频生成的人类偏好反馈奖励建模(original, opens in a new tab)

提出 VA-Judger，用人类偏好训练联合音视频奖励模型。

Salesforce AI Research retests self-improving agents: variance increases across multiple runs, performance drops 4.5% after shuffling task order(original, opens in a new tab)

重测记忆型自改进 Agent 的运行方差与任务顺序敏感性。

Why it was selected论文用多次运行与打乱任务顺序重测两类记忆型自改进 Agent，量化了被单次评测掩盖的方差与顺序依赖。

LeakGauge：用行为探针在解码前检测上下文泄露攻击信号(original, opens in a new tab)

提出 LeakGauge，用行为后缀的 prefill 对数概率检测上下文泄露。