Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 29 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.

System type：LLM applications System type：coding agent System component：Memory System component：Vision System component：Embeddings Clear all

Another 255papers do not have category tags yet and are not included in filtered results.

Risky behaviorarXiv 2610.12822Oct 9
Reward hacking as a transmissible strategy in multi-agent coding systems
Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems
arXiv
2610.12822
Published
Oct 9
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Qwen2.5-Coder-14B, Gemma-3-12B, Qwen2.5-Coder-7B and others16
- RiskReward hacking
- ComponentMemory
AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.
Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.
Paper analysisRead analysis
InterpretabilityarXiv 2610.11986Oct 8
FearCaut-Qwen: Activation steering changes the risk judgment criteria of vision-language models
Using fear activation steering to test the hazard judgment criteria of vision-language models
arXiv
2610.11986
Published
Oct 8
Layer
Model layer
Setting
LLM applications
Evaluated models
Qwen/Qwen2.5-VL-7B-Instruct
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08902Oct 7
论文提出 agent plasticity 指标衡量智能体通过经验自我改进的效率
提出 agent plasticity 指标衡量智能体通过经验自我改进的效率
arXiv
2610.08902
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Fable 5, Claude Opus 5, GPT-5.6 Sol and others10
- ComponentMemory
Abstract作者用固定权重协议比较前沿模型把经验写成制品后的留出增益与习得效率。
作者用 agent plasticity 衡量一件事：权重冻结时，智能体把经验写成可继承制品，再换成留出能力增益，这个转换有多省。
Paper analysisRead analysis
DefensesarXiv 2610.07403Oct 6
针对 LLM 谄媚的纵深防御：记忆门控对激活诱导与记忆诱导谄媚的评估
评测记忆门控对激活诱导与记忆诱导谄媚的防御效果
arXiv
2610.07403
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others4
- DefensesDetection and filtering
- RiskMisalignment and value divergence
- ComponentMemory
Abstract作者称外部记忆过滤成立，数据未显示反向转向再有贡献。
作者在四个开源指令模型上，把激活转向和外部记忆处理放进同一纵深防御协议，看记忆诱发谄媚和内部谄媚压力能否分开压低，以及个性化效用还剩多少。要处理的问题是：检索到的用户历史会推动模型顺从存储信念。只改外部上下文，并不直接动模型内部的谄媚表征。
Paper analysisRead analysis
DefensesarXiv 2610.05241Oct 4
StateWise：在 Agent 执行动作前诊断并修复持久操作状态
提出 StateWise，在编码智能体行动前诊断并修复失效持久状态
arXiv
2610.05241
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, DeepSeek v4 Pro, Qwen 3.7 Max and others4
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
AbstractStateWise 在动作前修复失效的持久前提。
StateWise 是在执行带副作用的动作之前，诊断并修复编码智能体持久操作状态的框架。
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2610.01184Oct 1
ReCast：在固定媒体接口下保护多模态推理的隐私框架
提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
arXiv
2610.01184
Published
Oct 1
Layer
Application layer
Setting
LLM applications
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.37863Sep 29
MIST 压力测试：无关图像会扰动 VLM 评判者标签
提出 MIST 压力测试，检验无关图像是否扰动 VLM 评判者标签
arXiv
2609.37863
Published
Sep 29
Layer
Prompt layer
Setting
LLM applications
Evaluated models
GPT-5.2, Gemini 3.1 Flash-Lite, Gemini 3.5 Flash and others13
- ComponentVision
Abstract有图就改标签，图的内容却不告知 judge，裁决绑定配置。
作者用MIST问：VLM 代替人类标注时，可替代性裁决会不会被指南要求忽略的图像改写。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34227Sep 28
Jev 预注册测试：智能体记忆何时该用选择替代抽取？
预注册检验智能体记忆中选择原始轮次能否替代事实抽取
arXiv
2609.34227
Published
Sep 28
Layer
Application layer
Setting
LLM applications
Evaluated models
jev-1.13.0
- ComponentMemory
Paper analysisRead analysis
Analysis and theoryarXiv 2609.32567Sep 26
零训练 LLM+OVOD 流水线中的归因缺口：CAAP–SNAP 差异的细粒度分析
分析零训练 LLM+OVOD 流水线中 CAAP 与 SNAP 分离的来源
arXiv
2609.32567
Published
Sep 26
Layer
Application layer
Setting
LLM applications
Evaluated models
Gemma-3 4B, YOLO-World X, Qwen2.5-VL 7B and others4
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2609.13889Sep 12
PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
arXiv
2609.13889
Published
Sep 12
Layer
Application layer
Setting
coding agent
Evaluated models
DeepSeek-V4-Flash, DeepSeek-V4-Pro, Qwen3-Max
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Abstract论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
Paper analysisRead analysis
InterpretabilityarXiv 2609.06968Sep 7
通过稀疏自编码器特征追踪查询扩展效果
用 SAE 追踪稠密检索查询扩展的潜变量并用激活转向验证
arXiv
2609.06968
Published
Sep 7
Layer
Model layer
Setting
LLM applications
Evaluated models
Qwen3-Embedding-0.6B（Qwen-Embed）, SimLM
- ComponentEmbeddings
AbstractSAE 追踪稠密检索 QE 的潜变量，转向在四基准上比文本扩展更稳。
作者用稀疏自编码器分析稠密检索里的查询扩展：现成检索器不微调时，拼接扩展文本往往增益有限甚至变差，而最终指标和嵌入整体偏移不足以说明内部发生了什么。
Paper analysisRead analysis
DefensesarXiv 2609.04767Sep 4
SHAQ: Privacy-preserving retrieval in vector databases using shadow queries
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
arXiv
2609.04767
Published
Sep 4
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
GTR-T5 encoder, DPR
- AttacksExtraction and theft
- ComponentEmbeddings
AbstractSHAQ replaces document embeddings with shadow query embeddings.
SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.02207Sep 2
LeakageBench: Document-level leakage risk in redaction of personally identifiable information in document images
Proposes LeakageBench to evaluate page-level leakage of PII redaction in document images
arXiv
2609.02207
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Amazon Comprehend PII, GPT-5.5, NVIDIA GLiNER PII and others13
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05535Sep 2
Mind2Web-Injection：面向网页 Agent 视觉提示注入护栏的证据对齐评测
提出 Mind2Web-Injection 评测网页 Agent 视觉注入护栏
arXiv
2609.05535
Published
Sep 2
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-5.6-luna, Qwen3-VL-32B, Qwen3-VL-8B and others6
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract作者称检测、定位和反事实响应在六个 VLM 上可分开。
Mind2Web-Injection 用来检查网页截图护栏的判决是否对齐到该用的画面证据。。
Paper analysisRead analysis
AttacksarXiv 2609.01222Sep 1
Researchers propose context privilege escalation attack, affecting 12 agent frameworks
提出针对 Agent Harness 的上下文特权提升攻击
arXiv
2609.01222
Published
Sep 1
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.5, GPT-5.4 mini, Claude-Sonnet-4.6 and others7
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.12851Aug 13
研究者提出 SkillMisevo-Bench，量化自改进 Agent 的技能误演化风险
提出 SkillMisevo-Bench，量化自改进 Agent 的技能误演化
arXiv
2608.12851
Published
Aug 13
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code, Codex, Hermes and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMemory
Paper analysisRead analysis
Risky behaviorarXiv 2608.10218Aug 11
研究者用进化算法构造多智能体 LLM 系统中的自我传播“思维病毒”
用演化算法构造 mind virus 并测量其在多智能体中的传播
arXiv
2608.10218
Published
Aug 11
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Claude Haiku 4.5, Claude Sonnet 4.6, Gemini 3 Flash and others7
- RiskMisalignment and value divergence
- ComponentMemory
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Reward hacking as a transmissible strategy in multi-agent coding systems

FearCaut-Qwen: Activation steering changes the risk judgment criteria of vision-language models

研究：多向量视觉文档索引可被反演还原页面内容

论文提出 agent plasticity 指标衡量智能体通过经验自我改进的效率

针对 LLM 谄媚的纵深防御：记忆门控对激活诱导与记忆诱导谄媚的评估

StateWise：在 Agent 执行动作前诊断并修复持久操作状态

研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像

ReCast：在固定媒体接口下保护多模态推理的隐私框架

MIST 压力测试：无关图像会扰动 VLM 评判者标签

MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

Jev 预注册测试：智能体记忆何时该用选择替代抽取？

零训练 LLM+OVOD 流水线中的归因缺口：CAAP–SNAP 差异的细粒度分析

PMPA：针对 OpenClaw 与 Claude Code 的持久记忆投毒攻击

通过稀疏自编码器特征追踪查询扩展效果

SHAQ: Privacy-preserving retrieval in vector databases using shadow queries

LeakageBench: Document-level leakage risk in redaction of personally identifiable information in document images

Mind2Web-Injection：面向网页 Agent 视觉提示注入护栏的证据对齐评测

Researchers propose context privilege escalation attack, affecting 12 agent frameworks

研究者提出 SkillMisevo-Bench，量化自改进 Agent 的技能误演化风险

研究者用进化算法构造多智能体 LLM 系统中的自我传播“思维病毒”