Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Attack type：Poisoning and backdoors Attack type：Malicious use System component：Monitors System component：Reasoning chains Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33102Sep 27
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
arXiv
2609.33102
Published
Sep 27
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
Paper analysisRead analysis
AttacksarXiv 2609.32400Sep 26
SkillDRE：用预执行与运行时双阶段反馈自动演化恶意 Agent 技能
提出 SkillDRE，用预执行与运行时双阶段反馈演化恶意 Agent 技能
arXiv
2609.32400
Published
Sep 26
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Pro, GLM-5.2, Qwen3.5-397B-A17B and others4
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentMCP and skills
Paper analysisRead analysis
Risky behaviorarXiv 2609.30266Sep 25
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
arXiv
2609.30266
Published
Sep 25
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.28915Sep 24
研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性
构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性
arXiv
2609.28915
Published
Sep 24
Layer
Application layer
Setting
coding agent
Evaluated models
AdaBoost, XGBoost, TabPFN and others10
- AttacksPrompt injection
- ComponentMCP and skills
AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。
ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。
Paper analysisRead analysis
DefensesarXiv 2609.22724Sep 19
MATE：面向移动 Agent 的策略感知安全审计方法
提出移动 Agent 轨迹审计器 MATE，判断轨迹是否违反可编辑安全策略
arXiv
2609.22724
Published
Sep 19
Layer
Application layer
Setting
Browser and computer use
Attacker
Black-box
Evaluated models
MATE-0.5B, MATE-1.5B, MATE-3B
- DefensesMonitoring and auditing
- AttacksMalicious use
- RiskDangerous agent actions
- ComponentMonitors
AbstractMATE 用合成轨迹微调轻量审计器，在可编辑策略下判断移动智能体轨迹是否违规并给出解释。
MATE 是面向移动 GUI 智能体的轻量策略条件轨迹审计器，在给定自然语言安全策略时判断轨迹是否违规并解释原因。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.06966Sep 7
Mole：面向前沿实验室 AI 智能体的内部威胁检测基准
提出 MOLE 基准，评测监控器对 AI 智能体内部威胁的检出能力
arXiv
2609.06966
Published
Sep 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.3 Chat, GPT-5.5, GPT-4.1 and others15
- DefensesMonitoring and auditing
- AttacksMalicious use
- ComponentMonitors
AbstractMOLE 构建了智能体内部威胁检测基准，作者指出高漏检现状与推理痕迹的防御价值，并展示了监控策略优化空间。
MOLE 是首个针对前沿 AI 实验室智能体内部威胁检测的开放基准，旨在评估在有限每日审查预算与日常研发业务背景下识别恶意账号的能力。。
Paper analysisRead analysis
DefensesarXiv 2608.21101Aug 21
ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
arXiv
2608.21101
Published
Aug 21
Layer
Application layer
Setting
coding agent
Evaluated models
Codex/GPT-5.4, Codex/GPT-5.5, Claude Code/GLM-5.1 and others6
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
AbstractClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。
ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
Paper analysisRead analysis
DefensesarXiv 2608.02683Aug 3
S³：用多阶段防御提升 LLM 智能体安全
提出 S³，用 guard agent 编排阶段安全技能防御智能体多阶段风险
arXiv
2608.02683
Published
Aug 3
Layer
Application layer
Setting
Embodied systems and robotics
Evaluated models
DeepSeek-V4-Pro, DeepSeek-V4-Flash
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- RiskDangerous agent actions
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2607.25297Jul 28
MTGuard: Hybrid Analysis for Secure MCP Tool Calls in LLM Agents
Proposes MTGuard, which blocks unsafe tool calls by comparing MCP call declarations with execution traces.
arXiv
2607.25297
Published
Jul 28
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, GPT-5.6 Luna
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
Paper analysisRead analysis
AttacksarXiv 2607.00422Jul 1
KidnapRAG：黑盒投毒攻击劫持 Agentic RAG 的推理链
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
arXiv
2607.00422
Published
Jul 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-32B-Instruct, Llama-3.3-70B-Instruct, QwQ-32B and others5
- AttacksPoisoning and backdoors
- TechniqueSelection manipulation
- ComponentReasoning chains
Abstract顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。
KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
Paper analysisRead analysis
DefensesarXiv 2606.22673Jun 22
Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导
提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向
arXiv
2606.22673
Published
Jun 22
Layer
Application layer
Setting
coding agent
Evaluated models
LLaMA-3.1-8B, Qwen-2.5-7B, Gemma-2-9B
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentMonitors
Abstract白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。
Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。
Paper analysisRead analysis
AttacksarXiv 2605.30040May 28
研究揭示 LLM 按 token 计费可被服务商系统性虚报
构造可通过计费审计的 token 虚报，使服务商系统性超收
arXiv
2605.30040
Published
May 28
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
PALACE domain-adapted auditor
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMonitors
Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。
不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。
Paper analysisRead analysis
DefensesarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
AttacksarXiv 2604.12201Apr 14
AdversarialCoT: single-document retrieval poisoning for LLM reasoning
Proposes AdversarialCoT single-document retrieval poisoning to manipulate RAG reasoning answers
arXiv
2604.12201
Published
Apr 14
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-R1, Qwen3, GLM4.5 and others5
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2604.11806Apr 14
Meerkat：跨大量 Agent 轨迹检测安全违规
提出 Meerkat，聚类并搜索 Agent 轨迹库以定位跨轨迹安全违规
arXiv
2604.11806
Published
Apr 14
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, GPT-5.4-mini, Qwen3.5-397B-A17B and others5
- DefensesMonitoring and auditing
- AttacksMalicious use
- RiskReward hacking
- ComponentMonitors
AbstractMeerkat 用聚类与智能体搜索定位跨轨迹违规，并在真实评测轨迹中找出脚手架泄题与奖励黑客。
Meerkat 是事后审计方法，用来在智能体轨迹仓库里找出单条看不出、合在一起才违反自然语言安全属性的见证。
Paper analysisRead analysis
AttacksarXiv 2604.05549Apr 7
Stop obsessing over prompts: reasoning hijacking and constraint tightening for red-teaming LLM agents
提出 JailAgent，不改用户提示，经推理劫持与记忆投毒操纵 Agent 动作
arXiv
2604.05549
Published
Apr 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-3.5-turbo, GPT-4o, GPT-5 and others7
- AttacksPoisoning and backdoors
- TechniqueReasoning-chain manipulation
- ComponentMemory
AbstractJailAgent 不改提示词，用三阶段操纵推理与检索。
JailAgent 是不修改用户原始提示词的 LLM 智能体红队框架。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop