Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 17 papers Another 213 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
提出 HXAI 分层隐私解释框架，本地保留细解释并只发布加噪摘要
Published Oct 2
Evaluated models gradient-boosted tree regression models Abstract HXAI 把无噪声局部 SHAP 留在家庭内，只聚合差分隐私摘要。HXAI 是面向分布式能源系统的分层隐私保护解释框架，服务规划、监测与诊断，而不是实时控制。
提出 AgentTrap 有状态蜜罐，欺骗并反击自主渗透测试 Agent
Published Oct 2
Evaluated models AIDA , Claude Code , PentestGPT and others8 提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传
Published Oct 1
Evaluated models Meta-Llama-3.3-70B-Instruct , Meta-Llama-4-Scout-17B-16E-Instruct , Meta-Llama-3.1-8B-Instruct and others18 Abstract 作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。 它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
Published Sep 27
Evaluated models GPT-5.4 , Claude Sonnet 4.6 , Qwen3-235B and others5 Abstract ORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
Published Sep 25
Evaluated models GPT-5.6-Sol , GPT-6-Sol , Opus-5 and others11 Abstract 论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
攻破混合 FHE 推理的置换式保密，精确恢复线性层排序谱
Published Sep 11
Evaluated models ResNet-20 , ResNet-56 , ResNet-50 and others12 提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
Published Sep 1 Abstract 协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
Propose GIFT, isolating user data in shared LLM serving using encryption and GPU information flow tracking
Published Aug 26
Evaluated models Qwen2.5-14B , Qwen2.5-32B , Qwen2.5-72B and others6 Abstract GIFT uses cryptographic isolation plus GPU information flow rules to enforce user data isolation on vLLM and DistServe, and reports throughput overhead.GIFT is the authors' user data isolation system for shared LLM serving, with GIFT-CC enabling confidential computing. In the conclusion, the authors state it is the first IFT design for this scenario.
Proposing KeyPooling to measure where API relays break prompt cache isolation
Published Aug 18
Evaluated models grok-4-fast-non-reasoning , grok-4-1-fast-non-reasoning , grok-3 and others11 Abstract Shared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.
复现 AgentCF 上的多智能体攻防并刻画连通性作用
Published Aug 4
Evaluated models Qwen3-235B-A22B , Claude Haiku 4.5 , Mixtral 8×7B and others4 Abstract 连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。
提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向
Published Jun 22
Evaluated models LLaMA-3.1-8B , Qwen-2.5-7B , Gemma-2-9B Abstract 白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。
提出 AgentHazard 基准，评测计算机使用智能体的执行层有害行为
Published Apr 3
Evaluated models Qwen2.5-72B-Instruct , Qwen2.5-Coder-32B-Instruct , Qwen3-32B and others12 Abstract AgentHazard 评估了计算机使用智能体的执行安全，作者认为模型层对齐无法可靠保障智能体层面的安全性。AgentHazard 是针对计算机使用智能体执行层安全构建的评估基准，重点探究多步工具调用下局部合理动作累积引发的危害。
Propose WebWeaver, which compromises only a single agent and recovers the multi-agent communication topology from conversation context.
Published Mar 12
Evaluated models Llama 3.1 8B , Qwen 2.5 7B , Mistral NeMo 12B and others6 Abstract WebWeaver infers topology from context.WebWeaver is an inference attack against the confidentiality of LLM-MAS communication topology: it controls only one arbitrary agent and recovers the full graph from dialogue context, rather than querying agent IDs.
Proposes PrefixWall, which selectively isolates shared prefixes to mitigate timing side channels
Published Mar 11
Evaluated models gemma-3-4b-it , llava-onevision-qwen2-0.5b-ov-hf , llava-onevision-qwen2-7b-ov-chat-hf and others9 Abstract PrefixWall uses cache metadata to selectively cut off cross-user prefix continuation, preserving APC while limiting the TTFT side channel.PrefixWall is a system-level defense for multi-tenant LLM services that limits the TTFT side channel of Automatic Prefix Caching while preserving prefix reuse.
Proposing OPTILEAK, reconstructing others' prompts token-by-token via a KV cache side channel
Published Feb 24
Evaluated models Qwen-2.5-3B-Instruct , Qwen-2.5-7B-Instruct , Qwen-2.5-14B-Instruct and others4 Abstract OPTILEAK uses SFT and hard-token DPO to reduce the number of requests per token; the authors claim the risk of cache prompt leakage is higher than previously reported.
提出面向渗出的权重压缩，评估推理服务器权重窃取可行性
Published Jan 4
Evaluated models Qwen2-1.5B , Qwen2-7B , Qwen2.5-1.5B and others8 Abstract 作者用残差量化加微调压缩权重，并称法医水印便宜且微调后仍可解码。这篇工作把 LLM 权重渗出看成 APT：攻击者已有未加密权重，但必须把完整权重藏进推理 API 的合法输出。作者认为可压缩性是被忽略的因素，因为推理量化要求解压后仍能低开销前向，而偷权重的人可以接受事后微调。
You have reached the end