Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Impact：Data and privacy leaks System component：Memory System component：Guardrails and judges System component：Embeddings System component：Multimodal Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.11773Oct 8
研究提出 Agent 安全新维度：识别未履行的安全义务
提出义务识别基准 ObligationBench，并训练护栏识别 Agent 未履行的安全义务
arXiv
2610.11773
Published
Oct 8
Layer
Application layer
Setting
coding agent
Evaluated models
ObligationGuard, Claude-Opus-4.8, GPT-5.6-Sol and others17
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
Abstract义务是护栏缺口。
作者认为编码智能体的安全不能只靠拦截禁止动作，还要找出终止时仍未做的安全关键动作，并将其称为义务。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.11561Oct 8
Workerville: Toward an Organizational Behavior Explanation of Agent Safety
构建 Workerville 基准，测量组织条件如何改变 Agent 的安全行为
arXiv
2610.11561
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.2, Claude-Sonnet-4.6, Gemini-3.1-Pro and others6
- RiskDangerous agent actions
- ComponentMemory
Abstract作者用 ACB 与 Workerville 测量组织条件对智能体安全的影响，并称结果支持可量化的组织行为框架。
Workerville 用组织行为测量智能体安全如何随监督、同伴和记忆条件变化。。要处理的缺口是：持续运行的 LLM 智能体同时接收用户指令、同伴消息和长期记忆，但既有安全评测多把这些通道拆开，没有统一的定量测量。
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07309Oct 6
论文提出长期记忆智能体的检索可允许性验证框架
提出检索可采纳性核验框架，评测记忆智能体的记录资格与披露
arXiv
2610.07309
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek V4 Pro, Gemini 3.6 Flash, GPT-5.6 Luna and others7
- RiskDangerous agent actions
- ComponentMemory
Abstract作者用三值可采纳性和匹配召回界审计长时记忆检索，并分开报告支持、资格与披露。
这是一套长时记忆检索的可采纳性核验协议，用来分开检查候选支持、资格、提示词暴露和答案披露，而不是提出新的检索算法。。
Paper analysisRead analysis
DefensesarXiv 2610.07258Oct 6
AMU：用派生血缘门控实现企业 AI Agent 列级访问控制
提出 AMU 按推导图门控企业 Agent 共享记忆的列级访问
arXiv
2610.07258
Published
Oct 6
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
Abstract在完整血缘下，AMU 按列权限放行缓存，并标出同名 KPI 冲突。
AMU 用列级推导门控共享记忆，拦截经缓存流出的无权敏感列，并标出同名 KPI 的定义冲突。
Paper analysisRead analysis
AttacksarXiv 2610.05601Oct 5
Tracer 框架可从遗忘后的扩散模型中识别被擦除概念
提出 TRACER，从权重差识别扩散模型被擦除概念
arXiv
2610.05601
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
- AttacksExtraction and theft
- ComponentImage generation
AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。
TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
Paper analysisRead analysis
AttacksarXiv 2610.05453Oct 5
研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私
提出 PLW，用微调把先前对话敏感触发编码进后续生成图像
arXiv
2610.05453
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
OmniGen2, BAGEL-7B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。
Paper analysisRead analysis
AttacksarXiv 2610.04589Oct 3
StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel
提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道
arXiv
2610.04589
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMemory
Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。
Paper analysisRead analysis
AttacksarXiv 2610.04195Oct 3
MemLeak research: multi-tenant agents sharing vector memory stores have cross-user memory leakage
提出 MemLeak，评估多租户 Agent 共享向量记忆的跨用户泄露
arXiv
2610.04195
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 2.5 Flash, Claude Sonnet 4.5, all-MiniLM-L6-v2 and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2610.01184Oct 1
ReCast：在固定媒体接口下保护多模态推理的隐私框架
提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
arXiv
2610.01184
Published
Oct 1
Layer
Application layer
Setting
LLM applications
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34790Sep 28
CoSec：面向社区场景的 LLM Agent 安全基准
用 CoSec 评测社区 Agent 是否越界披露受保护信息
arXiv
2609.34790
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
OpenClaw with Gemini 3.1 Pro, OpenClaw with Qwen 3.8 Max, OpenClaw with MiniMax M2.5 and others13
- AttacksPrompt injection
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34092Sep 28
机器遗忘在 ASR 中是否有效：arXiv 论文评估现有算法与评测工具
arXiv
2609.34092
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
E-Branchformer
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentAudio
Abstract梯度上升类方法更接近简单评测下的重训参照，复杂方法会被知情攻击认出，多说话人更差。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33481Sep 27
IDUnlearn-Bench：面向视觉语言模型的个体级遗忘基准
提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留
arXiv
2609.33481
Published
Sep 27
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others6
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentVision
AbstractIDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。
IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。
Paper analysisRead analysis
DefensesarXiv 2609.27399Sep 23
GUARD：在 CosyVoice2 上做说话人身份遗忘以阻止重识别
提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别
arXiv
2609.27399
Published
Sep 23
Layer
Model layer
Setting
Models and APIs
Evaluated models
CosyVoice2-0.5B, F5-TTS, FireRedTTS
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentAudio
AbstractGUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。
GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。
Paper analysisRead analysis
OtherarXiv 2609.22720Sep 19
残障披露如何在对话式 AI 中流动：ChatGPT、Claude、Gemini 的记忆、隐私与语境完整性
访谈残障成人，分析向记忆型助手披露残障时的信息流与语境完整性
arXiv
2609.22720
Published
Sep 19
Layer
Application layer
Setting
Models and APIs
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.21363Sep 18
用扩散模型隐空间扰动防御视觉语言模型的地理位置隐私泄露
提出扩散潜空间地理扰动防御，抑制视觉语言模型泄露精确地理位置
arXiv
2609.21363
Published
Sep 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4.1, GPT-5, Gemini 2.5 Pro and others5
- AttacksMalicious use
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2609.15799Sep 15
RAPID：面向文生图服务的实时防未授权蒸馏防御
提出 RAPID，离线把抗蒸馏扰动写入文生图解码器
arXiv
2609.15799
Published
Sep 15
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
PixArt, SSD, SDXL and others4
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentImage generation
Paper analysisRead analysis
DefensesarXiv 2609.15671Sep 14
QPriv-VL：面向视觉语言模型的问题引导 token 裁剪隐私防御
提出 QPriv-VL，用问题引导剪枝降低分布式视觉问答的隐私泄露
arXiv
2609.15671
Published
Sep 14
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Llama-2
- AttacksExtraction and theft
- ComponentVision
AbstractQPriv-VL 在切层前按问题相关度与 DINOv2 敏感度剪视觉 token，作者称能在约四成 token 下兼顾准确率与四类攻击。
QPriv-VL 把问题引导的视觉 token 剪枝做成分布式 VQA 的客户端隐私防御，而不是只做集中式推理加速。
Paper analysisRead analysis
AttacksarXiv 2609.13889Sep 12
PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
arXiv
2609.13889
Published
Sep 12
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop