Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 10 papers Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
Published Oct 6
Evaluated models Qwen3-235B-A22B-Instruct-2507 , gpt-oss-120b , Llama-4-Scout-17B-16E-Instruct and others5 Abstract DEFER 把确定性检查放在 judge 之前。DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
提出 VAL 框架，并用确认门与参数沙箱约束智能体高风险工具调用
Published Oct 3
Evaluated models DeepSeek-chat , Meta Llama 3.1 8B , Kimi 提出 FlowReview，用授权配对与确定性提交门控控制多智能体组合信息流
Published Sep 30
Evaluated models Sonnet 4.5 , Haiku 4.5 , Qwen3-32B and others5 Abstract 配对标准要求拒绝禁止使用并完成授权使用，FlowReview 把三项审查接到执行。这篇工作把多智能体安全写成一件必须同时成立的事：拦住组合信息所启用的禁止使用，并完成同一场景里任务所需的授权使用。
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
Published Sep 15
Evaluated models gemma4:31b-cloud Abstract 结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
提出 AgentKernel，用四支柱强制中介 Agent 的输入、工具与记忆
Published Aug 29 Abstract AgentKernel 是四支柱智能体 OS 设计，安全论证未附带实测数字。AgentKernel 是把安全做成组织原则的智能体 OS 架构，不是带跑分的攻防评测。
构建自演化基准 ActBench，评测协作智能体的行为安全
Published Aug 10
Evaluated models Claude-Opus-4.8 , Claude-Sonnet-4.6 , GPT-5.5 and others15 Abstract ActBench 通过自演化搜索与双证据重构评测轨迹行为安全，揭示基础模型决策差异主导了协同智能体的操作风险。
提出 MAFIA，以探测放置与事实伪装对带审计 Agent 做查询式记忆投毒
Published Aug 4
Evaluated models gpt-5.4-mini , Gemini , ProtectAI and others8 提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查
Published Jun 8
Evaluated models GPT-4.1 , GPT-5-nano , Claude-3.5-Sonnet and others6 Abstract CFD 用无指令 artifact 把越狱拆到跨会话。CFD 针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。
建模并利用多智能体网络中子智能体生成时的记忆继承漏洞
Published May 9
Evaluated models MiniMax M2.5 , Llama-4-Maverick-17B-128E-Instruct-FP8 , Qwen3.5-Plus and others5 Abstract 形式化子智能体继承，在 OpenClaw 上演示四类编排层漏洞并提出防御。作者对多智能体网络里的子智能体继承 做形式化分析，并用开源框架上的 PoC 演示编排层如何让单点妥协继续扩散。
Proposes a defense-in-depth aligned with the five stages to mitigate cross-stage threats to autonomous agents
Published Mar 12 Abstract This is a lifecycle threat analysis and layered mitigation design for OpenClaw, with the cases serving as qualitative evidence.This is a lifecycle threat analysis of OpenClaw, accompanied by a set of layered mitigation designs. The problem addressed is: when autonomous agents connect instant messaging, persistent memory, third-party plugins, and high-privilege execution, attacks are no longer limited to single-turn jailbreaks but can compound across multiple stages from initialization to execution. The authors argue that defenses hardening only individual interfaces cannot stop such cross-temporal attacks.
You have reached the end