Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 18 papers Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响
Published Oct 7
Evaluated models Claude Opus 5 , Gemini 3.8 Flash , GPT-5.6-Sol Abstract Secure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
Published Oct 6
Evaluated models Qwen3-235B-A22B-Instruct-2507 , gpt-oss-120b , Llama-4-Scout-17B-16E-Instruct and others5 Abstract DEFER 把确定性检查放在 judge 之前。DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
提出 AMU 按推导图门控企业 Agent 共享记忆的列级访问
Published Oct 6 Abstract 在完整血缘下，AMU 按列权限放行缓存，并标出同名 KPI 冲突。AMU 用列级推导门控共享记忆，拦截经缓存流出的无权敏感列，并标出同名 KPI 的定义冲突。
提出 StateWise，在编码智能体行动前诊断并修复失效持久状态
Published Oct 4
Evaluated models GPT-5.6-sol , DeepSeek v4 Pro , Qwen 3.7 Max and others4 Abstract StateWise 在动作前修复失效的持久前提。StateWise 是在执行带副作用的动作之前，诊断并修复编码智能体持久操作状态的框架。
提出 MemAdapter，在检索后约束记忆对智能体推理的影响
Published Oct 4
Evaluated models DeepSeek-V4-Flash , GPT-5.6-sol , Qwen3-8B Abstract 检索后三阶段调节记忆角色。MemAdapter 是给长期记忆智能体用的检索后调节框架，用来处理记忆诱发谄媚。
提出 VAL 框架，并用确认门与参数沙箱约束智能体高风险工具调用
Published Oct 3
Evaluated models DeepSeek-chat , Meta Llama 3.1 8B , Kimi 提出 Kubernetes 运维智能体的七层纵深防御框架与参考架构
Published Oct 2 Abstract 把运维智能体当不可信租户，用七层控制在完全攻破假设下约束行动。把 Kubernetes 上的运维智能体当作不可信租户，在假定提示注入已完全控制其工具选择的前提下，用基础设施重建数据面与控制面的边界。要解决的是：智能体读日志、注解、工单或 MCP 工具描述时，这些内容可以变成它带着自身凭据执行的命令。模型对齐和分类器只降低概率。
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
Published Oct 1
Evaluated models Claude Sonnet 4.6 , GPT-5.5 , GLM-5.2 and others4 提出免训练框架 SED，将有害智能体轨迹蒸馏为可检索安全策略
Published Sep 29
Evaluated models DeepSeek-V4-Flash , GLM-5.2 , Kimi K3 提出 Pictionary，将不可信文本渲染成图像以防御提示注入
Published Sep 29
Evaluated models Claude Opus 4.7 , Claude Haiku 4.5 , GPT-5.5 and others12 用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
Published Sep 15
Evaluated models gemma4:31b-cloud Abstract 结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
提出 AgentKernel，用四支柱强制中介 Agent 的输入、工具与记忆
Published Aug 29 Abstract AgentKernel 是四支柱智能体 OS 设计，安全论证未附带实测数字。AgentKernel 是把安全做成组织原则的智能体 OS 架构，不是带跑分的攻防评测。
提出依赖引导回滚修复，恢复记忆增强 Agent 的回答与状态
Published Aug 11
Evaluated models GPT-4o , Gemini-3.6-Flash , Qwen3.6-27B 提出 TMA-NM，以写时来源绑定抵御 Agent 长期记忆投毒
Published Jun 23
Evaluated models gpt-5-chat , gpt-4o-mini , claude-opus-4.1 and others8 Abstract TMA-NM 用来源绑定的行动权限挡住记忆洗白。TMA-NM 把 LLM 智能体长期记忆的行动权限绑到写时来源，用来挡住跨会话记忆投毒。
Reviews threats to autonomous agents and proposes a full-lifecycle defense blueprint, FASA
Published Mar 13 Abstract Using OpenClaw as an example, it divides risks into three layers and uses FASA to describe defense from input to system execution.This is a threat review and defense architecture report using OpenClaw as a case study, not a scored attack or defense evaluation.
Proposes a defense-in-depth aligned with the five stages to mitigate cross-stage threats to autonomous agents
Published Mar 12 Abstract This is a lifecycle threat analysis and layered mitigation design for OpenClaw, with the cases serving as qualitative evidence.This is a lifecycle threat analysis of OpenClaw, accompanied by a set of layered mitigation designs. The problem addressed is: when autonomous agents connect instant messaging, persistent memory, third-party plugins, and high-privilege execution, attacks are no longer limited to single-turn jailbreaks but can compound across multiple stages from initialization to execution. The authors argue that defenses hardening only individual interfaces cannot stop such cross-temporal attacks.
提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制
Published Feb 11
Evaluated models Gemini-3-Flash Abstract Aura mediates structured interactions via the Agent Kernel.Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants. .
提出 TAME 调节 Agent 测试时记忆演化，并用 Trust-Memevo 评测可信度
Published Feb 3
Evaluated models Qwen3-32B , GPT-5.2 Abstract TAME 在共享记忆上同时调节效用与信任。TAME 针对测试时记忆演化中的 Agent Memory Misevolution：良性任务只按成败保留经验时，任务表现可以上升，安全、隐私、公平等可信度下降或随领域波动。
You have reached the end