Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 39 papers

Filter4

Attack type

Jailbreaks13 Prompt injection23 Poisoning and backdoors4 Detection evasion6 Malicious use7

Attack technique

Automated search3 Defense-targeted5

Model risks

Deception and scheming3 Dangerous agent actions3

Defense type

Detection and filtering15 Permissions and approval4 Monitoring and auditing11

Impact

Harmful content10 Unauthorized actions14 Data and privacy leaks3 Output manipulation7 Oversight failure4

System component

MCP and skills15 Memory19 RAG15 Guardrails and judges27 Monitors13 Permissions and sandboxing16 Multimodal3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Attack surface / entry point：User input Layer：Application layer System component：Guardrails and judges System component：Monitors Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07089Oct 5
研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹
提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视
arXiv
2610.07089
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma 4 26B-A4B, Qwen3.6 27B, Qwen3.5 27B and others12
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。
Paper analysisRead analysis
AttacksarXiv 2610.05943Oct 5
CRIME 框架利用良性 Agent 技能组合诱发恶意行为
提出 CRIME 框架，组合良性 Agent 技能诱发恶意行为
arXiv
2610.05943
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GPT-4o-mini, GPT-4o and others6
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentMCP and skills
Abstract良性技能经 DCA 或 ACA 组合后可产生恶意环境后果，单独审查对不上。
CRIME 把公共技能库中各自通过审查的技能配成两两组合，看联合执行能否实现指定恶意任务。。
Paper analysisRead analysis
DefensesarXiv 2610.04412Oct 3
论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性
提出检测、结构化与 GSPO 流程，降低共识生成的提示注入错位
arXiv
2610.04412
Published
Oct 3
Layer
Application layer
Setting
LLM applications, Multi-agent systems
Evaluated models
LLaMA-2 7B, LLaMA-3 8B, GPT 3.5 Turbo and others14
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract三章依次做个体偏好预测、政党知识图谱审议，以及共识生成对提示注入的脆弱性与一条防御流程。
这是一篇把 LLM 数字孪生放进增强民主的博士论文，分个体表示、政党聚合和共识生成的提示注入三章。
Paper analysisRead analysis
DefensesarXiv 2610.03434Oct 2
Persona Guardrail：面向智能体系统的生产级防御框架
提出 Persona Guardrail，强制客服智能体守住功能边界
arXiv
2610.03434
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-30B-A3B, Qwen3-VL-30B, Qwen3-8B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractPersona Guardrail 用功能边界做同步输入输出校验，并在 PAGE 与生产延迟预算下给出评测。
Persona Guardrail 是客服向智能体的同步运行时防御：先写明功能边界，再决定放行或拦截，而不是只检测某一攻击类。
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.00400Sep 30
DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift
提出 DART，用去噪表征转移检测多轮智能体攻击并注入提醒
arXiv
2610.00400
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-14B, Qwen3-32B and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33102Sep 27
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
arXiv
2609.33102
Published
Sep 27
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
Paper analysisRead analysis
DefensesarXiv 2609.33039Sep 27
TACIT: detecting agent trajectory harm from LLM internal states
提出 TACIT，从冻结内部状态检测智能体有害轨迹
arXiv
2609.33039
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-4B, Llama-3.1-8B, Qwen3-4B-Instruct and others4
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract提出基于内部表征的智能体轨迹安全检测方法 TACIT，揭示工具风险表征特性并在多项基准上提升检测表现与效率。
Paper analysisRead analysis
Risky behaviorarXiv 2609.30266Sep 25
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
arXiv
2609.30266
Published
Sep 25
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
Paper analysisRead analysis
AttacksarXiv 2609.29130Sep 24
ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断
提出 ClaimMirage，以域名自述声称改变 LLM 威胁告警判断
arXiv
2609.29130
Published
Sep 24
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.3 70B Instruct-Turbo, Gemma 3 4B it, Gemma 3 12B it and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract作者称自述声称可增减告警。
Paper analysisRead analysis
DefensesarXiv 2609.22724Sep 19
MATE：面向移动 Agent 的策略感知安全审计方法
提出移动 Agent 轨迹审计器 MATE，判断轨迹是否违反可编辑安全策略
arXiv
2609.22724
Published
Sep 19
Layer
Application layer
Setting
Browser and computer use
Attacker
Black-box
Evaluated models
MATE-0.5B, MATE-1.5B, MATE-3B
- DefensesMonitoring and auditing
- AttacksMalicious use
- RiskDangerous agent actions
- ComponentMonitors
AbstractMATE 用合成轨迹微调轻量审计器，在可编辑策略下判断移动智能体轨迹是否违规并给出解释。
MATE 是面向移动 GUI 智能体的轻量策略条件轨迹审计器，在给定自然语言安全策略时判断轨迹是否违规并解释原因。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.15017Sep 14
PIDS-Bench：在过度防御、混淆与分布偏移下评测提示注入检测器
提出 PIDS-Bench，评测提示注入检测器在过度防御与分布偏移下的表现
arXiv
2609.15017
Published
Sep 14
Layer
Application layer
Setting
LLM applications
Evaluated models
TF-IDF + logistic regression, DistilBERT, DeBERTa-v3-FT and others7
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractPIDS-Bench 显示高分布内 F1 仍会过度拦截外部来源的安全相关良性输入。
PIDS-Bench 是一个冻结的检测器级基准，用来在固定阈值下同时看提示注入检测和良性误报。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.06966Sep 7
Mole：面向前沿实验室 AI 智能体的内部威胁检测基准
提出 MOLE 基准，评测监控器对 AI 智能体内部威胁的检出能力
arXiv
2609.06966
Published
Sep 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.3 Chat, GPT-5.5, GPT-4.1 and others15
- DefensesMonitoring and auditing
- AttacksMalicious use
- ComponentMonitors
AbstractMOLE 构建了智能体内部威胁检测基准，作者指出高漏检现状与推理痕迹的防御价值，并展示了监控策略优化空间。
MOLE 是首个针对前沿 AI 实验室智能体内部威胁检测的开放基准，旨在评估在有限每日审查预算与日常研发业务背景下识别恶意账号的能力。。
Paper analysisRead analysis
DefensesarXiv 2608.21101Aug 21
ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
arXiv
2608.21101
Published
Aug 21
Layer
Application layer
Setting
coding agent
Evaluated models
Codex/GPT-5.4, Codex/GPT-5.5, Claude Code/GLM-5.1 and others6
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
AbstractClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。
ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.17445Aug 18
Paper: decomposition attacks can bypass LLM stateful defenses across unlinkable identities
形式化跨不可关联身份的分解攻击并评测状态化防御边界
arXiv
2608.17445
Published
Aug 18
Layer
Application layer
Setting
LLM applications
Evaluated models
Granite Guardian 3.1 2B
- AttacksJailbreaks
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2608.16246Aug 17
CompoSkill 框架利用逐个通过扫描的 Agent 技能组合发起攻击
提出 CompoSkill，将逐个通过扫描的技能编排为攻击链
arXiv
2608.16246
Published
Aug 17
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, Gemini-3.1-flash, DeepSeek-V4 and others4
- AttacksPrompt injection
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文分析了智能体技能组合风险，指出单包安全认证状态不具备可组合性，需转向路径级防护。
Paper analysisRead analysis
AttacksarXiv 2608.03844Aug 4
MAFIA：针对带审计 LLM Agent 的查询式记忆投毒攻击
提出 MAFIA，以探测放置与事实伪装对带审计 Agent 做查询式记忆投毒
arXiv
2608.03844
Published
Aug 4
Layer
Application layer
Setting
AI Agent
Evaluated models
gpt-5.4-mini, Gemini, ProtectAI and others8
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

BRANCH 方法绕过 6 套多扫描器护栏系统

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹

CRIME 框架利用良性 Agent 技能组合诱发恶意行为

论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性

Persona Guardrail：面向智能体系统的生产级防御框架

论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift

ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架

TACIT: detecting agent trajectory harm from LLM internal states

研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹

ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断

MATE：面向移动 Agent 的策略感知安全审计方法

PIDS-Bench：在过度防御、混淆与分布偏移下评测提示注入检测器

Mole：面向前沿实验室 AI 智能体的内部威胁检测基准

ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关

Paper: decomposition attacks can bypass LLM stateful defenses across unlinkable identities

CompoSkill 框架利用逐个通过扫描的 Agent 技能组合发起攻击

MAFIA：针对带审计 LLM Agent 的查询式记忆投毒攻击