Understanding LLM behavior when encountering user-provided harmful content in benign tasks(original, opens in a new tab)

Evaluates whether LLMs refuse to process user-provided harmful content encountered in benign tasks.

Can dilemmas and conflicts in LLM alignment be resolved? A perspective from priority graphs(original, opens in a new tab)

Characterizing LLM alignment conflicts with priority graphs and proposing runtime external verification.

WebWeaver: Breaking the topology confidentiality of LLM multi-agent systems via covert context inference(original, opens in a new tab)

Proposes WebWeaver, which compromises only a single agent and recovers the multi-agent communication topology from conversation context.

PrefixWall: Mitigating Prefix Cache Side Channels in Shared LLM Systems(original, opens in a new tab)

Proposes PrefixWall, which selectively isolates shared prefixes to mitigate timing side channels.

Not All Tokens Are Equally Important: Query-Efficient Jailbreak Fuzzing for LLMs(original, opens in a new tab)

提出 TriageFuzz，用替代模型定位敏感片段做查询高效越狱。

Profit is the Red Team: Stress-Testing Agents in Strategic Economic Interactions(original, opens in a new tab)

提出利润驱动红队，用标量盈余搜索对手以压测经济博弈 Agent。

Security of LLM-as-a-Judge: A Comprehensive SoK(original, opens in a new tab)

Systematically reviews LLM-as-a-Judge security research and proposes a role taxonomy.

No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents(original, opens in a new tab)

形式化并评测共享状态 Agent 的无意跨用户污染。

Why it was selectedThe paper quantifies the cross-user contamination rate of shared-state agents through controlled experiments and points out that text-level cleaning still leaves residual risk for shared states containing executable artifacts.

PIDP-Attack: Combining Prompt Injection and Database Poisoning to Attack RAG Systems(original, opens in a new tab)

Proposes PIDP-Attack, which manipulates RAG answers using query suffixes and corpus poisoning.

Cooking Risks: Benchmarking and Mitigating Food Safety Risks in Large Language Models(original, opens in a new tab)

Propose FoodGuardBench and the guardrail FoodGuard-4B to evaluate and reduce food hazard jailbreaks.

Claudini: Automated research discovers state-of-the-art adversarial attack algorithms for LLMs(original, opens in a new tab)

提出 Claudini，让智能体自动发现更强的白盒对抗后缀攻击。

ContextualJailbreak: Evolutionary Red Teaming via Simulated Conversation Presets(original, opens in a new tab)

提出 ContextualJailbreak，进化搜索模拟多轮铺垫以越狱。

Why it was selectedThe paper reports ASR for multi-turn contextual preset attacks on several open-source models and shows that the success rate of the same attacks varies significantly when transferred to frontier models from different vendors.

Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models(original, opens in a new tab)

Propose the Universal Curved Grid Patch (UCGP), which induces cross-task semantic deviations in infrared vision-language models.

Mapping the exploitation surface: 10,000 trials of classification reveal what makes LLM agents exploit vulnerabilities(original, opens in a new tab)

All conditions include "always follow all rules and access policies," with only one encouragement sentence replaced.

Knowledge poisoning attacks against multimodal retrieval-augmented generation in healthcare(original, opens in a new tab)

提出 M3 Att，在不知查询时投毒医学多模态 RAG 并误导临床决策。

Minimal, local, causal explanations of large language model jailbreak success(original, opens in a new tab)

Propose LOCA, which explains single jailbreak success via iterative activation patching along SAE directions.

AttackEval: A systematic empirical study of the effectiveness of prompt injection attacks against large language models(original, opens in a new tab)

Using AttackEval to compare how prompt injection strategies bypass filtering defenses on a simulated email assistant.

Agent Skill Safety: Threat Models, Attacks, Defenses, and Evaluation(original, opens in a new tab)

Uses SkillSec-Eval to evaluate the security of the entire agent skill lifecycle.

Why it was selectedThe paper breaks down the safety of reusable Agent skills into five stages—repository admission, retrieval, planning, execution, and evolution—and provides measured data on attacks and defenses for each stage.

CARE: Pre-execution command validation for LLM agents that execute shell commands(original, opens in a new tab)

Proposes a static-first validator, CARE, that decides before dispatch whether an agent's shell command may be executed.

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models(original, opens in a new tab)

Propose MLingualFC, evaluating vision-language model jailbreak vulnerabilities with multilingual flowchart images.

Understanding and mitigating prompt leakage attacks in real-world LLM applications(original, opens in a new tab)

Proposes the soft prompt defense AREA, re-anchoring attention to mitigate system prompt leakage.

Protecting LLM agent long-term memory from poisoning: tamper-evident, source-bound permissions and machine-checkable guarantees(original, opens in a new tab)

提出 TMA-NM，以写时来源绑定抵御 Agent 长期记忆投毒。

Why it was selectedThe paper uses a machine-checked separation theorem and cross-model benchmarks to show that content- and lineage-based memory defenses can be bypassed by laundering attacks, while a provenance-bound permission construction maintains zero attack success across eight frontier models.

SilentRetrieval: Hijacking retrieval-augmented generation with semantically preserved adversarial data poisoning(original, opens in a new tab)

提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成。

InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems(original, opens in a new tab)

提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容。

Why it was selectedThe paper provides an attack method and success rates for poisoning an agent's memory with a single interaction; teams deploying memory systems can use this to examine exposure in the retrieval pipeline.

PIPES: Protecting Agent Perception with Provenance and Priors(original, opens in a new tab)

提出 PIPES，用来源与先验筛除工具响应中的越权主张。

VulnGym: A Benchmark for Repository-Level Vulnerability Detection with Coding Agents(original, opens in a new tab)

Proposes the VulnGym benchmark to evaluate repository-level vulnerability detection by programming agents and identify failure steps.

GIFT: Enforcing User Data Isolation in LLM Serving via GPU Information Flow Tracking(original, opens in a new tab)

Proposes GIFT, which uses encryption and GPU information flow tracking to isolate user data in shared LLM services.

Toward Safe World Models: Risks, Defenses, and Evaluation(original, opens in a new tab)

Reviews risks, defenses, and evaluations across the six-stage lifecycle of world models.

LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse(original, opens in a new tab)

Proposes LETHE, which perturbs reference images to block unauthorized image-to-video generation.

SWE-DeceptionBench: Evaluating LLM Deceptive Behaviors in the Software Development Lifecycle(original, opens in a new tab)

Proposes SWE-DeceptionBench to evaluate LLM deception in the software development lifecycle.

Attention sees, MLP refuses: tracing the safety pathway from attention to MLP in LLMs(original, opens in a new tab)

Trace attention to identify a pathway from harmfulness to MLP refusal writing and propose Sentinel.

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.(original, opens in a new tab)

Proposes the Cancerous backdoor, which uses invisible stage tokens to corrupt reasoning in stages.

Sparse dictionary learning for measure-valued data based on linearized optimal transport: efficient algorithms and sample complexity(original, opens in a new tab)

Propose LWDL, a measure-sparse dictionary learning method under linearized optimal transport.

GPT-2-Small, Gemma-2-2B, and Llama-3.1-8B have interpretable narrative mechanisms(original, opens in a new tab)

Using NVC to locate and ablate narrative-related components of language models.

Neural networks are more modular than single neurons suggest(original, opens in a new tab)

Use three-level nested decomposition to test whether a mixed selective network can functionally separate across subspaces.

CircuitTree: Combining circuits into a syllable transcriber(original, opens in a new tab)

Propose CircuitTree to merge phoneme circuits into a syllable transcriber.

Inducing process supervision from outcome-only reward reinforcement learning(original, opens in a new tab)

Propose TIPS, inducing generative process supervision with result-only rewards.

Rethinking the transfer of relative policy differences in on-policy distillation(original, opens in a new tab)

提出 A2-OPD，用相对策略差做 on-policy 蒸馏。

What research says about AI sycophancy(original, opens in a new tab)

A Tech Policy Press review summarizes three new papers examining how AI sycophancy (models sacrificing truthfulness to agree with users) is evaluated and its impact on users. The arXiv paper SycEval reports that 58.19% of conversations in its sample exhibit sycophantic behavior, with Gemini highest (62.47%) and ChatGPT lowest (56.71%), and notes that cited rebuttals most easily trigger regression-type sycophancy, and on the medical advice dataset MedQuad, models often agree with incorrect user beliefs and give dangerous or misleading medical advice. Another study testing 11 models found they affirm user behavior 50% more than humans; in two pre-registered experiments (N=1604), participants exposed to sycophantic models felt more correct and were less willing to fix conflicts. A third study showed that interacting with sycophantic chatbots increased stance extremity by 2.68 percentage points and stance certainty by 4.04 percentage points, with the author arguing that polarization mainly comes from selective presentation of supportive facts.

GPT-5.2 produces a new result in theoretical physics(original, opens in a new tab)

OpenAI published a preprint showing that a class of gluon interactions that physicists previously thought would not occur can indeed appear under certain conditions, with the paper's final formula first conjectured by GPT-5.2 Pro. The preprint is titled "Single-minus gluon tree amplitudes are nonzero", with authors including Alfredo Guevara, Alex Lupsasca, David Skinner, Andrew Strominger, and OpenAI's Kevin Weil. Human authors manually computed integer amplitudes for n up to 6, GPT-5.2 Pro greatly simplified these expressions and generalized a formula valid for any n; subsequently, an internal scaffolding version took about 12 hours to derive the same formula and provide a formal proof, and the results were cross-checked against Berends-Giele recursion relations and soft theorems. With GPT-5.2, the relevant amplitudes have been extended from gluons to gravitons.

Why it was selectedOpenAI disclosed the process where GPT-5.2 Pro first guessed the formula, and its scaffolding version then took about 12 hours to provide a formal proof, which can serve as a case reference for AI-assisted scientific discovery.