Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 36 papers Another 213 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
Published Oct 9
Evaluated models LAYA-TD , LAYA-EN , LAYA-ML and others5 Abstract The authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
Published Oct 8
Evaluated models Meta Llama Guard 3 8B , Meta Llama Guard 7B , Meta Llama Guard 3 1B and others18 提出利用路由元数据推断敏感话题的侧信道攻击
Published Oct 7
Evaluated models RouteLLM (BERT router) , notdiamond-0001 , Vela (vLLM Semantic Router) Abstract 论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B , ColQwen3.5-4.5B , Tomoro-colqwen3-embed-4b and others13 提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
Published Oct 7
Evaluated models CISCO , HSS , AUDITOR and others8 Abstract 论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
Published Oct 5 Abstract 论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
评估应用决策层的输入注入与隐私推断风险
Published Oct 4
Evaluated models Jev , NanoJev Abstract Jev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
Published Oct 2
Evaluated models Gemma-3-27B-Instruct , Gemma-3-4B-Instruct , Llama-3.2-3B-Instruct and others12 提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
Published Oct 1
Evaluated models Lumina-mGPT , Gemini 2.5 Flash Image Preview , CLIP ViT-B/16 and others5 提出 ClaimMirage，以域名自述声称改变 LLM 威胁告警判断
Published Sep 24
Evaluated models Llama 3.3 70B Instruct-Turbo , Gemma 3 4B it , Gemma 3 12B it and others5 提出 ALIBI，向恶意二进制注入不执行掩护叙事使分析器误判为良性
Published Sep 17
Evaluated models Gemini 2.5 Pro , GPT-5.5 Pro , Claude Opus 4.7 Abstract ALIBI 用二进制内的掩护叙事重释可疑静态证据，Gemini 上翻转多，另两模型主要为降级。ALIBI 是针对 LLM 恶意软件分诊的语义掩护叙事攻击：不覆盖系统指令，而把仍可见的可疑静态证据重释成良性安全产品的预期行为。
提出 CIG-MIA，用上下文信息增益推断 RAG 知识库成员身份
Published Sep 14
Evaluated models Llama-3.1-8B-Instruct , Mistral-7B-Instruct-v0.3 , Llama-2-13b-chat-hf and others6 Abstract CIG-MIA 用注入前后的答案似然差推断 RAG 库成员，灰盒可分性高于所列基线。CIG-MIA 是针对 RAG 外部知识库的成员推断攻击，同时覆盖灰盒和纯文本黑盒。
提出 CGMIA，检测代码生成基准样本是否泄漏进训练集
Published Sep 9
Evaluated models Qwen2.5-Coder (3B) , CodeGemma (2B) , DeepSeek-Coder (1.3B) and others5 Abstract CGMIA 融合相似度、通过率、困惑度与 CodeBERT，在模拟泄漏上优于八个 MIA 基线。CGMIA 用成员推断检测代码生成基准是否泄入 LLM 训练集，使评测不依赖对训练语料的直接访问。
提出 OBELISK 三级流水线，权衡恶意软件检测的准确率、开销与鲁棒性
Published Sep 8
Evaluated models GBDT-ALL , GBDT-YARA , NEBULA-ALL and others4 Abstract 三级过滤以不大的检测损失换速度，同一机制扩大攻击面，部署应按约束选配置。OBELISK 把 Windows PE 恶意软件检测做成 YARA、EMBER-GBDT 与 Nebula 的顺序流水线，用来同时看检出、计算开销和对抗鲁棒性。
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
Published Sep 4
Evaluated models GTR-T5 encoder , DPR Abstract SHAQ replaces document embeddings with shadow query embeddings.SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
Published Sep 1 Abstract 协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
提出 LeakGauge，用行为后缀的 prefill 对数概率检测上下文泄露
Published Aug 18
Evaluated models Gemma-4-E4B-it , Gemma-4-31B-it , Qwen2.5-14B-Instruct and others11 提出 ColluSkill，用跨技能组合绕过 Agent 技能扫描器
Published Aug 10
Evaluated models GPT-5.5 , DeepSeek-V4-Pro , GLM-5.2 Abstract 论文揭示了单技能孤立扫描的盲区，提出多技能链攻击 ColluSkill 与上下文防御 ChainGuard 并验证了有效性。
提出分片监督，将评判标准分配给独立调用以抵御展示攻击
Published Aug 6
Evaluated models Claude Opus 4.8 , Claude Sonnet 4.6 , Claude Opus 4.6 and others4 Abstract 论文揭示决策负载是大模型监督的独立瓶颈，提出分片与辩论机制有效分离注意力与平衡证据，在多项高难度基准上实现稳健评判。本文系统研究了大语言模型在执行多标准监督与评判时的决策负载瓶颈及其安全风险。
复现 AgentCF 上的多智能体攻防并刻画连通性作用
Published Aug 4
Evaluated models Qwen3-235B-A22B , Claude Haiku 4.5 , Mixtral 8×7B and others4 Abstract 连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。