Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 48 papers

Filter5

Attack type

Jailbreaks21 Prompt injection24 Poisoning and backdoors4 Detection evasion6 Malicious use8

Attack technique

Automated search3 Defense-targeted5

Model risks

Deception and scheming3 Dangerous agent actions3

Defense type

Inference-time intervention3 Detection and filtering17 Permissions and approval4 Monitoring and auditing17

Impact

Harmful content17 Unauthorized actions14 Data and privacy leaks3 Output manipulation8 Oversight failure4

System component

MCP and skills15 Memory19 RAG15 Guardrails and judges30 Monitors20 Reasoning chains9 Permissions and sandboxing16 Fine-tuning and open weights5 Vision6 Audio3 Image generation5 Multimodal14

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Attack surface / entry point：User input Layer：Model layer Layer：Application layer System component：Guardrails and judges System component：Monitors Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.09167Oct 7
Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
arXiv
2610.09167
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。
Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06503Oct 5
研究评测五款开源文生图模型的有害内容生成与审核缺口
评测文生图模型的有害内容生成能力与审核检测缺口
arXiv
2610.06503
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SDXL, Stable Diffusion 3.5 Large, FLUX.1-dev and others12
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07089Oct 5
研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹
提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视
arXiv
2610.07089
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma 4 26B-A4B, Qwen3.6 27B, Qwen3.5 27B and others12
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。
Paper analysisRead analysis
AttacksarXiv 2610.05943Oct 5
CRIME 框架利用良性 Agent 技能组合诱发恶意行为
提出 CRIME 框架，组合良性 Agent 技能诱发恶意行为
arXiv
2610.05943
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GPT-4o-mini, GPT-4o and others6
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentMCP and skills
Abstract良性技能经 DCA 或 ACA 组合后可产生恶意环境后果，单独审查对不上。
CRIME 把公共技能库中各自通过审查的技能配成两两组合，看联合执行能否实现指定恶意任务。。
Paper analysisRead analysis
DefensesarXiv 2610.04412Oct 3
论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性
提出检测、结构化与 GSPO 流程，降低共识生成的提示注入错位
arXiv
2610.04412
Published
Oct 3
Layer
Application layer
Setting
LLM applications, Multi-agent systems
Evaluated models
LLaMA-2 7B, LLaMA-3 8B, GPT 3.5 Turbo and others14
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract三章依次做个体偏好预测、政党知识图谱审议，以及共识生成对提示注入的脆弱性与一条防御流程。
这是一篇把 LLM 数字孪生放进增强民主的博士论文，分个体表示、政党聚合和共识生成的提示注入三章。
Paper analysisRead analysis
DefensesarXiv 2610.03434Oct 2
Persona Guardrail：面向智能体系统的生产级防御框架
提出 Persona Guardrail，强制客服智能体守住功能边界
arXiv
2610.03434
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-30B-A3B, Qwen3-VL-30B, Qwen3-8B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractPersona Guardrail 用功能边界做同步输入输出校验，并在 PAGE 与生产延迟预算下给出评测。
Persona Guardrail 是客服向智能体的同步运行时防御：先写明功能边界，再决定放行或拦截，而不是只检测某一攻击类。
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.02413Oct 2
研究：分类后缀可提升激活探针的分布外恶意输入检测
用分类后缀提升激活探针对分布外恶意输入的检测
arXiv
2610.02413
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。
用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
Paper analysisRead analysis
DefensesarXiv 2610.00400Sep 30
DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift
提出 DART，用去噪表征转移检测多轮智能体攻击并注入提醒
arXiv
2610.00400
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-14B, Qwen3-32B and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
Analysis and theoryarXiv 2609.36477Sep 29
研究发现护栏模型在基座模型不确定处过度自信
诊断护栏相对基座在对抗提示上的置信失校
arXiv
2609.36477
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-Guard 7B, Llama-Guard-2 8B, Llama-Guard-3 8B and others10
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Abstract对抗包装使 guard 高置信漏检，而对应 base 在同一输入上常更不确定。
诊断性分析：五个提示词分类 guard 的置信度，在清洁输入上可以较校准，在越狱包装后则变成高置信度的错误判定。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33102Sep 27
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
arXiv
2609.33102
Published
Sep 27
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
Paper analysisRead analysis
DefensesarXiv 2609.33039Sep 27
TACIT: detecting agent trajectory harm from LLM internal states
提出 TACIT，从冻结内部状态检测智能体有害轨迹
arXiv
2609.33039
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-4B, Llama-3.1-8B, Qwen3-4B-Instruct and others4
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract提出基于内部表征的智能体轨迹安全检测方法 TACIT，揭示工具风险表征特性并在多项基准上提升检测表现与效率。
Paper analysisRead analysis
DefensesarXiv 2609.30841Sep 25
为何扩散语言模型的越狱会成功：能量景观分析
用能量势垒信号检测扩散语言模型的越狱
arXiv
2609.30841
Published
Sep 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Instruct, LLaDA-1.5, Dream-v0-Instruct-7B and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract能量势垒把 dLLM 越狱分成掩盖初始状态或中途越垒，三个 logit 信号据此互补检测。
Bach 等提出用去噪能量景观解释 masked diffusion 语言模型上的越狱，并由此得到三个免训练检测信号。。
Paper analysisRead analysis
Risky behaviorarXiv 2609.30266Sep 25
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
arXiv
2609.30266
Published
Sep 25
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
Paper analysisRead analysis
AttacksarXiv 2609.29130Sep 24
ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断
提出 ClaimMirage，以域名自述声称改变 LLM 威胁告警判断
arXiv
2609.29130
Published
Sep 24
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.3 70B Instruct-Turbo, Gemma 3 4B it, Gemma 3 12B it and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract作者称自述声称可增减告警。
Paper analysisRead analysis
DefensesarXiv 2609.22724Sep 19
MATE：面向移动 Agent 的策略感知安全审计方法
提出移动 Agent 轨迹审计器 MATE，判断轨迹是否违反可编辑安全策略
arXiv
2609.22724
Published
Sep 19
Layer
Application layer
Setting
Browser and computer use
Attacker
Black-box
Evaluated models
MATE-0.5B, MATE-1.5B, MATE-3B
- DefensesMonitoring and auditing
- AttacksMalicious use
- RiskDangerous agent actions
- ComponentMonitors
AbstractMATE 用合成轨迹微调轻量审计器，在可编辑策略下判断移动智能体轨迹是否违规并给出解释。
MATE 是面向移动 GUI 智能体的轻量策略条件轨迹审计器，在给定自然语言安全策略时判断轨迹是否违规并解释原因。
Paper analysisRead analysis
DefensesarXiv 2609.20129Sep 17
局部稀疏性实现无监督 LLM 安全检测
提出局部稀疏无监督安全检测，标记偏离安全分布的输入
arXiv
2609.20129
Published
Sep 17
Layer
Model layer
Setting
Models and APIs
Evaluated models
qwen2-1.5b-instruct, ministral-8b-instruct, llama3-8b-instruct and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

BRANCH 方法绕过 6 套多扫描器护栏系统

Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

研究评测五款开源文生图模型的有害内容生成与审核缺口

研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹

CRIME 框架利用良性 Agent 技能组合诱发恶意行为

论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性

Persona Guardrail：面向智能体系统的生产级防御框架

论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护

研究：分类后缀可提升激活探针的分布外恶意输入检测

DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift

研究发现护栏模型在基座模型不确定处过度自信

ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架

TACIT: detecting agent trajectory harm from LLM internal states

为何扩散语言模型的越狱会成功：能量景观分析

研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹

ClaimMirage：域名中的自我声明如何改变 LLM 威胁判断

MATE：面向移动 Agent 的策略感知安全审计方法

局部稀疏性实现无监督 LLM 安全检测