Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 13 papers Another 254 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B , ColQwen3.5-4.5B , Tomoro-colqwen3-embed-4b and others13 提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
Published Sep 26
Evaluated models DeepSeek-V4-Pro , GLM-5.2 , Qwen3.5-397B-A17B and others4 构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性
Published Sep 24
Evaluated models AdaBoost , XGBoost , TabPFN and others10 Abstract ACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。 。
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
Published Sep 4
Evaluated models GTR-T5 encoder , DPR Abstract SHAQ replaces document embeddings with shadow query embeddings.SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
Published Aug 21
Evaluated models Codex/GPT-5.4 , Codex/GPT-5.5 , Claude Code/GLM-5.1 and others6 Abstract ClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
提出 S³，用 guard agent 编排阶段安全技能防御智能体多阶段风险
Published Aug 3
Evaluated models DeepSeek-V4-Pro , DeepSeek-V4-Flash Proposes MTGuard, which blocks unsafe tool calls by comparing MCP call declarations with execution traces.
Published Jul 28
Evaluated models DeepSeek-V4-Flash , DeepSeek-V4-Pro , GPT-5.6 Luna 提出策略 RAG 的知识库投毒攻击与检测防御 CLD-KB
Published Jul 6
Evaluated models Llama 3.2 提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
Published Jul 1
Evaluated models e5-small , e5-small-v2 , e5-base and others19 Abstract EIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。 。
提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成
Published May 27
Evaluated models Llama-2-7B-Chat , Mistral-7B-Instruct-v0.2 , Qwen-7B-Chat and others10 Abstract 两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
Published May 17 Abstract 提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
Published Jan 31
Evaluated models Qwen-1.5-7B-Instruct , SFR-Embedding-Mistral , E5-Mistral-7B-Instruct and others10 Abstract DQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Attacks arXiv 2512.01335 · Dec 1, 2025 提出 EmoRAG，向查询与知识库注入同一表情以劫持 RAG 检索
Published Dec 1, 2025
Evaluated models SPECTER , Contriever , Qwen2-7B and others11 Abstract EmoRAG 用表情联动查询与库文本。EmoRAG 测量 RAG 对符号扰动的反应：同一表情同时出现在查询和库文本里时，检索会偏离语义匹配。作者要检查的是，检索是否真由语义相关性决定。
You have reached the end