Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
Another 201 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 Kubernetes 运维智能体的七层纵深防御框架与参考架构
Published Oct 2 Abstract 把运维智能体当不可信租户，用七层控制在完全攻破假设下约束行动。把 Kubernetes 上的运维智能体当作不可信租户，在假定提示注入已完全控制其工具选择的前提下，用基础设施重建数据面与控制面的边界。要解决的是：智能体读日志、注解、工单或 MCP 工具描述时，这些内容可以变成它带着自身凭据执行的命令。模型对齐和分类器只降低概率。
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
Published Sep 28
Evaluated models GPT-5.6-sol , Kimi-K2.6 , Kimi-K3 and others6 Abstract 论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性
Published Sep 24
Evaluated models AdaBoost , XGBoost , TabPFN and others10 Abstract ACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。 。
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
Published Aug 21
Evaluated models Codex/GPT-5.4 , Codex/GPT-5.5 , Claude Code/GLM-5.1 and others6 Abstract ClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
提出 AMS，用激活分离与方向相似度检测安全训练改动
Published Aug 6
Evaluated models Llama-3.1-8B-Instruct , Llama-3.2-3B-Instruct , Llama-3.2-1B-Instruct and others14 Abstract AMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
Proposes MTGuard, which blocks unsafe tool calls by comparing MCP call declarations with execution traces.
Published Jul 28
Evaluated models DeepSeek-V4-Flash , DeepSeek-V4-Pro , GPT-5.6 Luna 提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
Published May 17 Abstract 提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Reviews threats to autonomous agents and proposes a full-lifecycle defense blueprint, FASA
Published Mar 13 Abstract Using OpenClaw as an example, it divides risks into three layers and uses FASA to describe defense from input to system execution.This is a threat review and defense architecture report using OpenClaw as a case study, not a scored attack or defense evaluation.
Proposes a defense-in-depth aligned with the five stages to mitigate cross-stage threats to autonomous agents
Published Mar 12 Abstract This is a lifecycle threat analysis and layered mitigation design for OpenClaw, with the cases serving as qualitative evidence.This is a lifecycle threat analysis of OpenClaw, accompanied by a set of layered mitigation designs. The problem addressed is: when autonomous agents connect instant messaging, persistent memory, third-party plugins, and high-privilege execution, attacks are no longer limited to single-turn jailbreaks but can compound across multiple stages from initialization to execution. The authors argue that defenses hardening only individual interfaces cannot stop such cross-temporal attacks.
You have reached the end