Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
Published Aug 25
Evaluated models Qwen2.5-7B-Instruct , Llama-3.1-8B-Instruct , Mistral-7B-Instruct-v0.3 and others6 Proposed GhostWriter memory poisoning, which writes into the agent's long-term memory via email and calendar and activates across sessions
Published Jul 7
Evaluated models GPT-5.4-mini , DeepSeek-V4-Flash , Gemini-2.5-Flash and others4 提出 MEMGHOST，用单封邮件对持久个人 Agent 做跨会话隐蔽记忆注入
Published Jul 6
Evaluated models GPT-5.4 , Claude Sonnet 4.6 , Claude Sonnet 4.5 and others6 Abstract 总结了论文的研究背景、双代理优化方法 MEMGHOST、全周期实验结果以及作者对记忆信任边界的启示。本文研究了持久化个人智能体面临的隐蔽记忆注入威胁，提出了一套兼顾写入、隐蔽与跨会话生效的自动化生成框架与全周期评测基准。
系统研究 LLM 智能体记忆投毒并构建基准 MPBench
Published Jun 3
Evaluated models Meta-Llama-3.1-70B-Instruct , Deberta-v3-base , Llama-3.1-8B-Instruct and others5 Abstract 系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
Published May 15
Evaluated models GPT-5.4 , GPT-5.5 , Claude Sonnet 4.6 and others12 Abstract 持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
提出 eTAMP，用网页内容跨会话投毒 Web Agent 轨迹记忆并诱导越权操作
Published Apr
Evaluated models GPT-5-mini , GPT-5.2 , GPT-OSS-120B and others6 Abstract 论文提出了基于环境注入的跨任务记忆投毒攻击 eTAMP，作者报告智能体在环境压力下易感性增加且能力与安全并不协同。该论文评估了基于大语言模型的 Web 智能体在利用历史交互轨迹进行记忆增强时的安全脆弱性。
提出 Zombie Agent 攻击，经网页间接注入将载荷写入长期记忆并跨会话触发
Published Feb 17
Evaluated models Gemini-2.5-Flash , GLM-4.7-Flash Abstract 记忆写入把一次网页间接注入变成跨会话控制。Zombie Agent 把自进化 LLM 智能体的跨会话记忆当成攻击面：攻击者只发布网页，良性任务读入后，正常记忆更新留下载荷，并在以后无关会话里触发未授权工具行为。
Attacks arXiv 2507.10457 · Jul 15, 2025 提出 LPCI，把延迟条件载荷写入记忆与检索库以跨会话触发
Published Jul 15, 2025
Evaluated models ChatGPT , Claude , LLaMA3 and others8 Abstract 作者定义 LPCI。作者把LPCI 定义为针对智能体逻辑执行、记忆留存和工具集成的跨阶段漏洞类，而不是单次输入上的提示改写。
You have reached the end