Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 233 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响
Published Sep 30
Evaluated models gpt-4o , GPT-5 , GPT-6 Astra Abstract MADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
Published Sep 15
Evaluated models gemma4:31b-cloud Abstract 结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
提出类型化溯源与断言护栏，约束持久 Agent 释放自传断言
Published Sep 2 用 MisKnow-Agent 评测深度研究智能体是否采纳误导文档结论
Published Jul 23
Evaluated models DeerFlow , WebThinker , Gemini Deep Research and others6 Abstract 论文通过 MisKnow-Agent 框架评估发现长程研究智能体易采纳误导性知识，且现有防御难以完全消除该现象。
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
Published Jul 1
Evaluated models Qwen2.5-32B-Instruct , Llama-3.3-70B-Instruct , QwQ-32B and others5 Abstract 顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
Proposes LAAF, which automatically attacks LPCI vulnerabilities in agent systems in stages
Published Mar 18
Evaluated models gemini-2.0-flash-001 , claude-3-haiku-20240307 , meta-llama/llama-3.1-70b-instruct and others5 Abstract LAAF does LPCI red teaming with taxonomy plus stage seeding.The authors state that LAAF is an automated red-teaming framework built specifically for LPCI in agentic LLMs. The issue to address is that encoded, delayed, and conditionally triggered payloads can persist in memory or RAG and re-enter across sessions, whereas Garak and PyRIT do not use the previous round's breakthrough results to seed the next stage across the six stages.
Attacks arXiv 2507.10457 · Jul 15, 2025 提出 LPCI，把延迟条件载荷写入记忆与检索库以跨会话触发
Published Jul 15, 2025
Evaluated models ChatGPT , Claude , LLaMA3 and others8 Abstract 作者定义 LPCI。作者把LPCI 定义为针对智能体逻辑执行、记忆留存和工具集成的跨阶段漏洞类，而不是单次输入上的提示改写。
You have reached the end