Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
Published Sep 29
Evaluated models AgentCF , AgentSEQ , AgentRAG and others4 Abstract 作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播
Published Sep 29
Evaluated models GPT-5.6 Luna , Kimi-K2.6 , GPT-OSS-120B and others6 Abstract 论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
Published Sep 12
Evaluated models DeepSeek-V4-Flash , DeepSeek-V4-Pro , Qwen3-Max Abstract 论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
提出 GhostWriter 记忆投毒，经邮件与日程写入 Agent 长期记忆并跨会话激活
Published Jul 7
Evaluated models GPT-5.4-mini , DeepSeek-V4-Flash , Gemini-2.5-Flash and others4 提出 MEMGHOST，用单封邮件对持久个人 Agent 做跨会话隐蔽记忆注入
Published Jul 6
Evaluated models GPT-5.4 , Claude Sonnet 4.6 , Claude Sonnet 4.5 and others6 Abstract 总结了论文的研究背景、双代理优化方法 MEMGHOST、全周期实验结果以及作者对记忆信任边界的启示。本文研究了持久化个人智能体面临的隐蔽记忆注入威胁，提出了一套兼顾写入、隐蔽与跨会话生效的自动化生成框架与全周期评测基准。
系统研究 LLM 智能体记忆投毒并构建基准 MPBench
Published Jun 3
Evaluated models Meta-Llama-3.1-70B-Instruct , Deberta-v3-base , Llama-3.1-8B-Instruct and others5 Abstract 系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
Published May 15
Evaluated models GPT-5.4 , GPT-5.5 , Claude Sonnet 4.6 and others12 Abstract 持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
Published Jan 31
Evaluated models Qwen-1.5-7B-Instruct , SFR-Embedding-Mistral , E5-Mistral-7B-Instruct and others10 Abstract DQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
You have reached the end