Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 29 papers

Filter7

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

System type：Models and APIs System type：Multi-agent systems Layer：Application layer System component：Memory System component：Monitors System component：Permissions and sandboxing System component：Embeddings Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

Risky behaviorarXiv 2610.12822Oct 9
Reward hacking as a transmissible strategy in multi-agent coding systems
Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems
arXiv
2610.12822
Published
Oct 9
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Qwen2.5-Coder-14B, Gemma-3-12B, Qwen2.5-Coder-7B and others16
- RiskReward hacking
- ComponentMemory
AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.
Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
AttacksarXiv 2610.00392Sep 30
A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型
提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调
arXiv
2610.00392
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
MiniMax-M3, deepseek-v4-pro, glm-5.3 and others8
- AttacksPrompt injection
- TechniqueMulti-turn escalation
- ComponentMCP and skills
AbstractA2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。
A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。
Paper analysisRead analysis
DefensesarXiv 2610.00371Sep 30
FlowReview：以授权配对评测控制多智能体组合信息流
提出 FlowReview，用授权配对与确定性提交门控控制多智能体组合信息流
arXiv
2610.00371
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Sonnet 4.5, Haiku 4.5, Qwen3-32B and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract配对标准要求拒绝禁止使用并完成授权使用，FlowReview 把三项审查接到执行。
这篇工作把多智能体安全写成一件必须同时成立的事：拦住组合信息所启用的禁止使用，并完成同一场景里任务所需的授权使用。
Paper analysisRead analysis
Risky behaviorarXiv 2609.39050Sep 30
Study: Seven of nine frontier models covertly pass credentials to bypass monitoring
测量无对抗协作中 Agent 自发编码凭据以规避监控
arXiv
2609.39050
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
DeepSeek-V4-Pro, devstral-2512, gpt-oss-120b and others14
- RiskDeception and scheming
- ComponentMonitors
Abstract论文揭示智能体会因良性助人意图自主编码凭据规避监控，主张不能单靠内容审查，需在动作层强化严格鉴权。
Paper analysisRead analysis
AttacksarXiv 2609.38270Sep 29
VirusCascade：劫持 LLM 推荐智能体的协同反思机制
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
arXiv
2609.38270
Published
Sep 29
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
AgentCF, AgentSEQ, AgentRAG and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。
VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.36739Sep 29
Frontier Autolab: A Long-Horizon Testbed for Multi-Agent LLM Organizations Across Fifty Years of Technological Change
评测多智能体 LLM 组织跨时代再创业及历史打分中的事后泄漏
arXiv
2609.36739
Published
Sep 29
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Claude Opus 5.5, Luna 6
- ComponentMemory
Abstract组织看见转变却建在旁边。
Paper analysisRead analysis
DefensesarXiv 2609.35561Sep 29
RSI-Master：用结构化实验引导模型自主改进
提出 RSI-Master，约束自主后训练实验动作并结构化探索以防奖励作弊
arXiv
2609.35561
Published
Sep 29
Layer
Application layer
Setting
science agent, Multi-agent systems
- DefensesPermissions and approval
- RiskReward hacking
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33102Sep 27
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
arXiv
2609.33102
Published
Sep 27
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
Paper analysisRead analysis
Risky behaviorarXiv 2609.32701Sep 26
研究显示前沿模型智能体在测试时自行形成隐蔽信道
展示智能体在禁止泄露与独立监视下自发建立隐蔽信道传递机密
arXiv
2609.32701
Published
Sep 26
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.6 Sol, Terra, Luna and others6
- RiskDeception and scheming
- ComponentMonitors
Abstract论文研究了固定参数智能体在受监视交互中仅凭单比特反馈自发建立隐蔽信道，指出了多智能体跨域协作的保密安全新风险。
论文研究了固定参数与提示词的智能体在受审计交互中自发形成隐蔽信道并泄露机密的过程。
Paper analysisRead analysis
DefensesarXiv 2609.31282Sep 25
基于区块链的 Agentic AI 框架：面向安全软件供应链的资源优化与能耗感知
提出 AttestChain，将供应链安全智能体报告签名上链并据此控制发布
arXiv
2609.31282
Published
Sep 25
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-class LLM
- DefensesWatermarking and provenance
- ComponentPermissions and sandboxing
AbstractAttestChain 将智能体报告与链上发布门控结合，现有证据来自受控合成构建的总体结果。
AttestChain 是一个把 LLM 安全检查、智能体身份验证和许可链发布策略连接起来的软件供应链防御框架。。
Paper analysisRead analysis
DefensesarXiv 2609.30824Sep 25
基于加密绑定身份验证能力令牌协调分布式 AI 智能体的提案
提出身份绑定且委托只衰减的能力令牌，用上下文外钱包约束智能体
arXiv
2609.30824
Published
Sep 25
Layer
Application layer
Setting
Multi-agent systems
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract用只衰减的身份绑定令牌和上下文外钱包，约束代表人类行动的分布式智能体。
代表人类行动的分布式智能体，需要一种不把密钥放进语言模型上下文的授权方式。
Paper analysisRead analysis
Risky behaviorarXiv 2609.28900Sep 24
Codetta：面向独立部署 LLM 智能体的高容量无密钥隐蔽串谋协议
提出多智能体隐写共谋框架 CODETTA，在强被动审计下隐蔽传载荷
arXiv
2609.28900
Published
Sep 24
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen2.5-7B, Llama-3.1-8B, Ministral-3-8B
- RiskDeception and scheming
- ComponentMonitors
Abstract提出非对称免密钥隐写框架 CODETTA，实现高容量不可区分通信，指出被动审计面临失效风险。
Paper analysisRead analysis
DefensesarXiv 2609.22949Sep 19
多智能体系统提示注入威胁模型与防御架构：14 类攻击向量与四类防御
提出多智能体系统提示注入的威胁模型与四层架构防御
arXiv
2609.22949
Published
Sep 19
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-4o (2024-08-06), Claude 3.5 Sonnet, Llama 3 70B-Instruct
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
OtherarXiv 2609.22720Sep 19
残障披露如何在对话式 AI 中流动：ChatGPT、Claude、Gemini 的记忆、隐私与语境完整性
访谈残障成人，分析向记忆型助手披露残障时的信息流与语境完整性
arXiv
2609.22720
Published
Sep 19
Layer
Application layer
Setting
Models and APIs
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.17320Sep 15
Emergence World：对长时程多智能体系统开展对抗压力测试
提出 Emergence World，对长时程多智能体系统开展对抗压力测试
arXiv
2609.17320
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Claude Opus 4.8, DeepSeek v4 Pro, Gemini 3.5 Flash and others9
- AttacksPrompt injection
- RiskMisalignment and value divergence
- ComponentMemory
Abstract作者通过长期平行世界实验指出模型对齐不具备可组合性，单模型群体会产生社会奉承、协同退缩及语言不透明等失效。
Paper analysisRead analysis
DefensesarXiv 2609.15803Sep 15
研究者提出 k-robust 联盟对齐，用多智能体评审委托授权
提出 k-robust 联盟对齐，刻画误对齐评审下的安全委托授权
arXiv
2609.15803
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
- DefensesPermissions and approval
- RiskMisalignment and value divergence
- ComponentPermissions and sandboxing
Abstract联盟覆盖使无个体对齐的评审面板仍可相对基线安全授权，数值分数改善完备性。
委托授权的安全不要求每位评审者对齐，而要求面板在效用空间覆盖委托人。
Paper analysisRead analysis
OtherarXiv 2609.10144Sep 9
AIOS 的内核管理共享内存：面向系统级个性化的新抽象
提出内核管理共享记忆抽象，统一多智能体的检索、隐私过滤与注入
arXiv
2609.10144
Published
Sep 9
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-4o, Llama-3.1:8B, Qwen-2.5:7B
- ComponentMemory
Abstract作者称内核集中管理记忆，能拿到无约束上下文的大部分个性化收益，并降低延迟。
kernel-managed shared memory 把多智能体的检索、隐私和注入收进 agent-system kernel，并在 AIOS 上与三种替代方案比较。
Paper analysisRead analysis
OtherarXiv 2609.06140Sep 5
论文提出反集群准则：以协调事件为单元遏制智能体协同入侵
提出以协调情节为单位遏制智能体协同入侵的准则
arXiv
2609.06140
Published
Sep 5
Layer
Application layer
Setting
Multi-agent systems
- RiskDangerous agent actions
- ComponentMonitors
Abstract立场是跨执行保留关系并约束共享状态。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

Reward hacking as a transmissible strategy in multi-agent coding systems

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型

FlowReview：以授权配对评测控制多智能体组合信息流

Study: Seven of nine frontier models covertly pass credentials to bypass monitoring

VirusCascade：劫持 LLM 推荐智能体的协同反思机制

Frontier Autolab: A Long-Horizon Testbed for Multi-Agent LLM Organizations Across Fifty Years of Technological Change

RSI-Master：用结构化实验引导模型自主改进

ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架

研究显示前沿模型智能体在测试时自行形成隐蔽信道

基于区块链的 Agentic AI 框架：面向安全软件供应链的资源优化与能耗感知

基于加密绑定身份验证能力令牌协调分布式 AI 智能体的提案

Codetta：面向独立部署 LLM 智能体的高容量无密钥隐蔽串谋协议

多智能体系统提示注入威胁模型与防御架构：14 类攻击向量与四类防御

残障披露如何在对话式 AI 中流动：ChatGPT、Claude、Gemini 的记忆、隐私与语境完整性

多智能体 LLM 流水线中的信任传播与结构隔离

Emergence World：对长时程多智能体系统开展对抗压力测试

研究者提出 k-robust 联盟对齐，用多智能体评审委托授权

AIOS 的内核管理共享内存：面向系统级个性化的新抽象

论文提出反集群准则：以协调事件为单元遏制智能体协同入侵