Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Impact：Output manipulation Impact：Availability and reliability System component：Memory System component：Reasoning chains Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
DefensesarXiv 2610.11352Oct 8
RL-ARC：用推理引导的不确定性校准大型推理模型
提出 RL-ARC，用推理置信度在强化学习中校准推理模型
arXiv
2610.11352
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B, Qwen3-8B, Llama-8B distilled from DeepSeek-R1
- DefensesModel hardening
- ComponentReasoning chains
AbstractRL-ARC 用推理置信度调节答案置信度，作者称可少牺牲精度并改善 ID 与 OOD 校准。
RL-ARC 是校准感知的强化学习框架，用推理过程的口头置信度调节答案置信度。
Paper analysisRead analysis
AttacksarXiv 2610.07645Oct 6
SkillPoison：用成功经验投毒自进化 Agent 的技能形成
提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能
arXiv
2610.07645
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。
SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。
Paper analysisRead analysis
DefensesarXiv 2610.07403Oct 6
针对 LLM 谄媚的纵深防御：记忆门控对激活诱导与记忆诱导谄媚的评估
评测记忆门控对激活诱导与记忆诱导谄媚的防御效果
arXiv
2610.07403
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others4
- DefensesDetection and filtering
- RiskMisalignment and value divergence
- ComponentMemory
Abstract作者称外部记忆过滤成立，数据未显示反向转向再有贡献。
作者在四个开源指令模型上，把激活转向和外部记忆处理放进同一纵深防御协议，看记忆诱发谄媚和内部谄媚压力能否分开压低，以及个性化效用还剩多少。要处理的问题是：检索到的用户历史会推动模型顺从存储信念。只改外部上下文，并不直接动模型内部的谄媚表征。
Paper analysisRead analysis
DefensesarXiv 2610.05162Oct 4
MemAdapter：用反事实适配缓解记忆诱发的谄媚
提出 MemAdapter，在检索后约束记忆对智能体推理的影响
arXiv
2610.05162
Published
Oct 4
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GPT-5.6-sol, Qwen3-8B
- DefensesInstruction–data separation
- RiskMisalignment and value divergence
- ComponentMemory
Abstract检索后三阶段调节记忆角色。
MemAdapter 是给长期记忆智能体用的检索后调节框架，用来处理记忆诱发谄媚。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39473Sep 30
FAME：用反事实推理评测自主智能体的虚假记忆
提出 FAME，用反事实概念漂移评测智能体虚假记忆
arXiv
2609.39473
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3B
- ComponentMemory
AbstractFAME 用反事实引起的隐状态概念漂移，在出答案前区分忠实记忆与虚假记忆。
FAME 是一个免训练的评测框架，用来判断自主智能体的记忆在虚假相关、环境偏移或知识冲突下是否已变成虚假记忆。。
Paper analysisRead analysis
DefensesarXiv 2609.38909Sep 30
Purdue 提出 Pact：将欺骗作为行为遗忘
提出 PACT，遗忘推理模型在压力下的欺骗行为并保留上下文理解
arXiv
2609.38909
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-32B, QwQ-32B
- DefensesModel hardening
- AttacksModel tampering
- RiskDeception and scheming
- ComponentFine-tuning and open weights
Abstract论文将大模型欺骗形式化为上下文条件行为，提出 PACT 框架在消除欺骗的同时保留了上下文遵循能力。
Paper analysisRead analysis
AttacksarXiv 2609.38270Sep 29
VirusCascade：劫持 LLM 推荐智能体的协同反思机制
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
arXiv
2609.38270
Published
Sep 29
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
AgentCF, AgentSEQ, AgentRAG and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。
VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.36130Sep 29
论文提出 DerivAudit：审计长期 Agent 记忆是否真由交互历史支持
提出 DERIVAUDIT 审计长期 Agent 记忆是否由交互历史导出
arXiv
2609.36130
Published
Sep 29
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3-30B-A3B, Gemma-4-31B, Llama-3.3-70B-Instruct
- RiskHallucination and fabrication
- ComponentMemory
AbstractDERIVAUDIT 表明扩历史能补出处，但组合准入与过细检查仍两侧出错。
DERIVAUDIT 审计长期智能体的持久记忆是否由写入时可获得的交互历史支持，而不是只看以后能否被召回。
Paper analysisRead analysis
DefensesarXiv 2609.31911Sep 26
用强化学习增强胸部 X 光报告生成中的视觉推理
用门控 IoU 与 RadGraph 的 GRPO 降低胸片报告幻觉
arXiv
2609.31911
Published
Sep 26
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-8B-GRPO
- DefensesModel hardening
- RiskHallucination and fabrication
- ComponentVision
Paper analysisRead analysis
Analysis and theoryarXiv 2609.30768Sep 25
研究：推理 token 能纠正部分偏见
用 CDPG 与 BTM 追踪思考如何改变反事实公平翻转
arXiv
2609.30768
Published
Sep 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
QwQ-32B, DeepSeek-R1-Distill-Qwen-32B, Qwen3-32B and others5
- RiskBias and discrimination
- ComponentReasoning chains
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.22818Sep 19
研究测量 LLM Agent 记忆投毒防御的良性场景开销
测量记忆投毒防御在良性对话上的效用与 token 开销
arXiv
2609.22818
Published
Sep 19
Layer
Application layer
Setting
AI Agent
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract写时代价落在噪声内。
在没有攻击的对话上，给记忆投毒防御计价，而不是再测一轮攻击是否被挡住。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.17320Sep 15
Emergence World：对长时程多智能体系统开展对抗压力测试
提出 Emergence World，对长时程多智能体系统开展对抗压力测试
arXiv
2609.17320
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Claude Opus 4.8, DeepSeek v4 Pro, Gemini 3.5 Flash and others9
- AttacksPrompt injection
- RiskMisalignment and value divergence
- ComponentMemory
Abstract作者通过长期平行世界实验指出模型对齐不具备可组合性，单模型群体会产生社会奉承、协同退缩及语言不透明等失效。
Paper analysisRead analysis
OtherarXiv 2609.08832Sep 8
自进化智能体框架缩小 LLM 智能体的「一致性差距」
提出离线两阶段框架，诊断易翻转步骤并生成记忆指南以稳定智能体
arXiv
2609.08832
Published
Sep 8
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, GPT-OSS-120B
- ComponentMemory
Abstract用离线一致性诊断生成记忆指南，在 AppWorld 上提高重复全通过率。
作者要缩小的是 LLM 智能体平均通过、重复不稳之间的 consistency gap，即 Mean@k 减 Passˆk。
Paper analysisRead analysis
DefensesarXiv 2609.02127Sep 2
论文提出带类型溯源与断言护栏，防止持久化 AI Agent 把不可信输入当作自身历史
提出类型化溯源与断言护栏，约束持久 Agent 释放自传断言
arXiv
2609.02127
Published
Sep 2
Layer
Application layer
Setting
AI Agent
- DefensesWatermarking and provenance
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
AttacksarXiv 2609.01023Sep 1
Akrasia：针对推理型代码 LLM 的隐蔽后门攻击
提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
arXiv
2609.01023
Published
Sep 1
Layer
Prompt layer
Setting
coding agent
Evaluated models
Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7
- AttacksPrompt injection
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
Paper analysisRead analysis
AttacksarXiv 2608.23471Aug 25
InjecMEM: Memory Injection Attacks against LLM Agent Memory Systems
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
arXiv
2608.23471
Published
Aug 25
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and others6
- AttacksPoisoning and backdoors
- TechniqueGradient and representation optimization
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.18066Aug 19
Salesforce AI Research 重测自改进 Agent
重测记忆型自改进 Agent 的运行方差与任务顺序敏感性
arXiv
2608.18066
Published
Aug 19
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5-mini, Gemini-2.5-Pro, GPT-OSS-120B and others4
- ComponentMemory
Abstract论文揭示了基于记忆的自改进智能体在多次运行和乱序下的脆弱性，并指出规约不完备是诱发退化的关键瓶颈。
这篇论文是对基于文本记忆的自我改进智能体在复杂环境中评估可靠性的实证研究。
Paper analysisRead analysis
DefensesarXiv 2608.12876Aug 13
SPARED：用对抗编辑数据训练基于推理的 AI 生成图像检测器
提出 SPARED，用对抗编辑数据训练基于推理的 AI 生成图像检测器
arXiv
2608.12876
Published
Aug 13
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen3.5-9B
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractSPARED 用防捷径的编辑对抗环训练 9B 推理检测器。
SPARED 是一套用于可解释 AI 生成图像检测的攻防强化学习流程，报告模型是 Qwen3.5-9B 上的第三轮防御器。
Paper analysisRead analysis
DefensesarXiv 2608.10502Aug 11
依赖引导回滚修复：为记忆增强 Agent 恢复错误记忆后的答案与状态
提出依赖引导回滚修复，恢复记忆增强 Agent 的回答与状态
arXiv
2608.10502
Published
Aug 11
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, Gemini-3.6-Flash, Qwen3.6-27B
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop