Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 12 papers Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B , ColQwen3.5-4.5B , Tomoro-colqwen3-embed-4b and others13 提出工具型 Agent 的自适应攻击 DART 与预执行防御 SAGE
Published Sep 28
Evaluated models GPT-5.6 Luna , GPT-5.6 Terra , Gemini 3.8 Flash and others5 Abstract 论文提出状态控制框架 SEAD、攻击 DART 与防御 SAGE，实验显示执行反馈与环境探测在攻防交互中具有关键作用。
提出 Skilder，按角色渐进下发企业工具并确定性拦截越权调用
Published Sep 24
Evaluated models Claude Haiku 4.5 , Qwen 3.5 122B , Gemma 4 31B and others6 Abstract Skilder 用单 MCP 服务器按角色交付工具并硬拦截。Skilder 把企业工具型智能体的能力按角色打包，经一个 MCP 服务器做渐进发现，使工具范围由服务器而不是提示词来执行。
构建 APort Vault 基准，对比支付智能体模型拒答与确定性授权
Published Sep 19
Evaluated models Claude Fable 5.1 , Claude Sonnet 5 , Claude Haiku 4.5 and others14 提出 FLOWSEAL，用工具级信息流控制阻断智能体隐私泄露
Published Sep 12
Evaluated models DeepSeek-V3.2 , GPT-4.1-mini , Gemini-Flash-2.5 Abstract 作者分析大模型智能体隐私检查与攻击面重合问题，提出外部拦截防御 FLOWSEAL 并验证有效性。
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
Published Sep 7
Evaluated models BERT-base , RoBERTa-base , T5-base and others6 为冻结模型与目标域自动搜索可部署的 Agent 安全 harness
Published Sep 5
Evaluated models Sonnet 4.6 , GLM-5 , Kimi-K2.5 and others11 Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
Published Sep 4
Evaluated models GTR-T5 encoder , DPR Abstract SHAQ replaces document embeddings with shadow query embeddings.SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
Published Sep 1 Abstract 协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
Published Jul 1
Evaluated models e5-small , e5-small-v2 , e5-base and others19 Abstract EIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。 。
Proposes the Aegis red-teaming framework for multi-turn attacks on high-risk voice agents.
Published Feb 7
Evaluated models GPT-4o , GPT-4o-mini , Gemini-1.5 Pro and others7 Abstract Aegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.
提出 Zero2Text，无需训练地跨域反演文本嵌入
Published Feb 2
Evaluated models GTR-Base , Qwen3-Embedding-0.6B , Text-Embedding-3-small and others4 Abstract 零训练在线对齐可在未知域、无泄漏对时从黑盒 embedding 还原句子。Zero2Text 是一种不训练 decoder、也不使用泄漏文本–向量对的文本 embedding 反演，针对 RAG 向量库在严格黑盒、目标域未知时的还原。
You have reached the end