Large Model Security Weekly: The Defense Line Begins to Collapse at Composition, Systemic Gaps in Agent Authorization and Auditing

The weekly report from a large model security WeChat account summarizes 57 papers this week, with the main threads concentrated on three fronts: agent authorization and privilege escalation, persistent attacks via memory and context, and failures of auditing and monitoring. The weekly report states that a formalization work (arXiv 2610.27620) argues that an action sequence in which every step passes approval can still compose into a globally privilege-escalating outcome, and that per-action authorization is undecidable at the compositional dimension; another measurement found that multiple independently deployed approval monitors fail synchronously under the same adversarial input, and redundant deployment did not bring the expected improvement in protection. The weekly report also cites long-term memory research (arXiv 2610.28810), stating that a single prompt injection can escalate through memory writes into persistent control over an agent, while the corresponding defense work introduces operating system virtual memory isolation, machine-checkable integrity theorems, and kernel-level withholding of outbound connections into agents. The remaining entries cover real-world tests of bypassing safety alignment via translation on 79 languages and 10 mainstream LLMs, as well as a voice backdoor triggered by voiceprints. The weekly report advocates moving the checkpoint up from single-action approval to goal-level intent auditing, and deliberately adopting heterogeneous defense deployment.