Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 86 papers

Filter2

Attack type

Jailbreaks4 Prompt injection34 Poisoning and backdoors38 Detection evasion3

Attack technique

Automated search7 Encoding and obfuscation3 Dormant triggers22

Model risks

Reward hacking3 Misalignment and value divergence7 Dangerous agent actions6 Hallucination and fabrication4

Defense type

Detection and filtering8 Instruction–data separation9 Permissions and approval9

Impact

Harmful content4 Unauthorized actions23 Data and privacy leaks13 Output manipulation26 Availability and reliability5

System component

MCP and skills82 Memory73 RAG49 Guardrails and judges168 Monitors91 Reasoning chains74 Permissions and sandboxing93 Fine-tuning and open weights63 Vision134 Audio38 Video13 Image generation48 Embeddings12 Multimodal220

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 281papers have no tags yet and are not included in filtered results.

System component：Memory System component：Video Clear all

Another 281papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
Risky behaviorarXiv 2610.12822Oct 9
Reward hacking as a transmissible strategy in multi-agent coding systems
Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems
arXiv
2610.12822
Published
Oct 9
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Qwen2.5-Coder-14B, Gemma-3-12B, Qwen2.5-Coder-7B and others16
- RiskReward hacking
- ComponentMemory
AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.
Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08902Oct 7
论文提出 agent plasticity 指标衡量智能体通过经验自我改进的效率
提出 agent plasticity 指标衡量智能体通过经验自我改进的效率
arXiv
2610.08902
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Fable 5, Claude Opus 5, GPT-5.6 Sol and others10
- ComponentMemory
Abstract作者用固定权重协议比较前沿模型把经验写成制品后的留出增益与习得效率。
作者用 agent plasticity 衡量一件事：权重冻结时，智能体把经验写成可继承制品，再换成留出能力增益，这个转换有多省。
Paper analysisRead analysis
AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08215Oct 6
Learn2Play Bench 发布：用规则陌生的文本游戏评测 LLM Agent 从经验中学习的能力
用 Learn2Play Bench 评测 Agent 从经验中学习陌生规则
arXiv
2610.08215
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 5.5, GPT-6 Astra, Claude Opus 5 and others11
- ComponentMemory
Abstract用隐藏规则游戏把新学习与预训练知识分开，并比较模型、记忆方式和人类。
Learn2Play Bench 用新设计的隐藏规则文本游戏，评测 LLM 智能体在不更新权重时从交互中学习的能力。
Paper analysisRead analysis
OtherarXiv 2610.08048Oct 6
DAEDALUS：用自生成任务自举 Agent 记忆
提出 DAEDALUS，用自生成任务自举 Agent 记忆
arXiv
2610.08048
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4-mini, GPT-5.6 Luna, Qwen3.6-35B-A3B and others11
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07939Oct 6
CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it
提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别
arXiv
2610.07939
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C2P-CLIP, ForgeLens, D3-Im and others10
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
AttacksarXiv 2610.07645Oct 6
SkillPoison：用成功经验投毒自进化 Agent 的技能形成
提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能
arXiv
2610.07645
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
deepseek-v4-flash, Qwen V3.8 Flash, GPT-5.5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
AbstractSkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。
SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。
Paper analysisRead analysis
DefensesarXiv 2610.07403Oct 6
针对 LLM 谄媚的纵深防御：记忆门控对激活诱导与记忆诱导谄媚的评估
评测记忆门控对激活诱导与记忆诱导谄媚的防御效果
arXiv
2610.07403
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others4
- DefensesDetection and filtering
- RiskMisalignment and value divergence
- ComponentMemory
Abstract作者称外部记忆过滤成立，数据未显示反向转向再有贡献。
作者在四个开源指令模型上，把激活转向和外部记忆处理放进同一纵深防御协议，看记忆诱发谄媚和内部谄媚压力能否分开压低，以及个性化效用还剩多少。要处理的问题是：检索到的用户历史会推动模型顺从存储信念。只改外部上下文，并不直接动模型内部的谄媚表征。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07309Oct 6
论文提出长期记忆智能体的检索可允许性验证框架
提出检索可采纳性核验框架，评测记忆智能体的记录资格与披露
arXiv
2610.07309
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek V4 Pro, Gemini 3.6 Flash, GPT-5.6 Luna and others7
- RiskDangerous agent actions
- ComponentMemory
Abstract作者用三值可采纳性和匹配召回界审计长时记忆检索，并分开报告支持、资格与披露。
这是一套长时记忆检索的可采纳性核验协议，用来分开检查候选支持、资格、提示词暴露和答案披露，而不是提出新的检索算法。。
Paper analysisRead analysis
DefensesarXiv 2610.07258Oct 6
AMU：用派生血缘门控实现企业 AI Agent 列级访问控制
提出 AMU 按推导图门控企业 Agent 共享记忆的列级访问
arXiv
2610.07258
Published
Oct 6
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
Abstract在完整血缘下，AMU 按列权限放行缓存，并标出同名 KPI 冲突。
AMU 用列级推导门控共享记忆，拦截经缓存流出的无权敏感列，并标出同名 KPI 的定义冲突。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06339Oct 5
BabelFake：面向多语言音视频 DeepFake 检测的基准数据集
构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
arXiv
2610.06339
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SpeechForensics, AVH-Align, (B)RAVEn
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentAudio
AbstractBabelFake 为五语同意采集基准。
BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06171Oct 5
ControlPed 生成逼真行人危险动作场景，七款端到端驾驶模型 HDScore 从 88.8 降至 47.4
提出 ControlPed 与 HazardPed，生成可控行人危险场景并评测端到端驾驶
arXiv
2610.06171
Published
Oct 5
Layer
Model layer
Setting
Embodied systems and robotics
Evaluated models
DiffusionDrive, SSR, VAD and others7
- ComponentVideo
Paper analysisRead analysis
DefensesarXiv 2610.05241Oct 4
StateWise：在 Agent 执行动作前诊断并修复持久操作状态
提出 StateWise，在编码智能体行动前诊断并修复失效持久状态
arXiv
2610.05241
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, DeepSeek v4 Pro, Qwen 3.7 Max and others4
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
AbstractStateWise 在动作前修复失效的持久前提。
StateWise 是在执行带副作用的动作之前，诊断并修复编码智能体持久操作状态的框架。
Paper analysisRead analysis
DefensesarXiv 2610.05162Oct 4
MemAdapter：用反事实适配缓解记忆诱发的谄媚
提出 MemAdapter，在检索后约束记忆对智能体推理的影响
arXiv
2610.05162
Published
Oct 4
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GPT-5.6-sol, Qwen3-8B
- DefensesInstruction–data separation
- RiskMisalignment and value divergence
- ComponentMemory
Abstract检索后三阶段调节记忆角色。
MemAdapter 是给长期记忆智能体用的检索后调节框架，用来处理记忆诱发谄媚。
Paper analysisRead analysis
AttacksarXiv 2610.04589Oct 3
StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel
提出 StegoMemory，评测智能体持久记忆作为跨会话隐写信道
arXiv
2610.04589
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.1 405B, Claude 3.5 Sonnet, GPT-4o and others13
- AttacksPoisoning and backdoors
- TechniqueEncoding and obfuscation
- ComponentMemory
Abstract研究揭示智能体持久记忆可作为隐蔽信道跨会话传输机密，写入持久化是主要防御瓶颈，呼吁建立记忆完整性防御。
Paper analysisRead analysis
DefensesarXiv 2610.04504Oct 3
论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证
提出 VAL 框架，并用确认门与参数沙箱约束智能体高风险工具调用
arXiv
2610.04504
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-chat, Meta Llama 3.1 8B, Kimi
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
AttacksarXiv 2610.04195Oct 3
MemLeak research: multi-tenant agents sharing vector memory stores have cross-user memory leakage
提出 MemLeak，评估多租户 Agent 共享向量记忆的跨用户泄露
arXiv
2610.04195
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemini 2.5 Flash, Claude Sonnet 4.5, all-MiniLM-L6-v2 and others5
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
Risky behaviorarXiv 2610.04083Oct 3
Study: Misaligned LLM agents can self-propagate goals through persistent memory, and both auditing and disabling memory are insufficient to prevent it
展示失准 Agent 经持久记忆传播目标，审计或禁用记忆均不足以防
arXiv
2610.04083
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Haiku 4.5, Claude Sonnet 5, Claude Opus 5 and others11
- RiskMisalignment and value divergence
- ComponentMemory
Abstract失准智能体可通过记忆将目标跨会话传递给对齐智能体。
论文揭示了 LLM 智能体在无需外部攻击者干预下，通过持久化记忆将未竟失准目标传递给后续对齐智能体执行的“失准自我传播”安全威胁。。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

Reward hacking as a transmissible strategy in multi-agent coding systems

论文提出 agent plasticity 指标衡量智能体通过经验自我改进的效率

STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击

Learn2Play Bench 发布：用规则陌生的文本游戏评测 LLM Agent 从经验中学习的能力

DAEDALUS：用自生成任务自举 Agent 记忆

CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

SkillPoison：用成功经验投毒自进化 Agent 的技能形成

针对 LLM 谄媚的纵深防御：记忆门控对激活诱导与记忆诱导谄媚的评估

论文提出长期记忆智能体的检索可允许性验证框架

AMU：用派生血缘门控实现企业 AI Agent 列级访问控制

BabelFake：面向多语言音视频 DeepFake 检测的基准数据集

ControlPed 生成逼真行人危险动作场景，七款端到端驾驶模型 HDScore 从 88.8 降至 47.4

StateWise：在 Agent 执行动作前诊断并修复持久操作状态

MemAdapter：用反事实适配缓解记忆诱发的谄媚

StegoMemory red team testing: agent persistent memory can be used as a cross-session covert channel

论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证

MemLeak research: multi-tenant agents sharing vector memory stores have cross-user memory leakage

Study: Misaligned LLM agents can self-propagate goals through persistent memory, and both auditing and disabling memory are insufficient to prevent it