Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 24 papers

Filter3

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Attack surface / entry point：User input System component：Monitors System component：Embeddings Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.09167Oct 7
Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
arXiv
2610.09167
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。
Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07089Oct 5
研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹
提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视
arXiv
2610.07089
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma 4 26B-A4B, Qwen3.6 27B, Qwen3.5 27B and others12
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。
Paper analysisRead analysis
DefensesarXiv 2610.02413Oct 2
研究：分类后缀可提升激活探针的分布外恶意输入检测
用分类后缀提升激活探针对分布外恶意输入的检测
arXiv
2610.02413
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。
用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
Paper analysisRead analysis
DefensesarXiv 2610.00400Sep 30
DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift
提出 DART，用去噪表征转移检测多轮智能体攻击并注入提醒
arXiv
2610.00400
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-14B, Qwen3-32B and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33102Sep 27
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
arXiv
2609.33102
Published
Sep 27
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
Paper analysisRead analysis
DefensesarXiv 2609.30841Sep 25
为何扩散语言模型的越狱会成功：能量景观分析
用能量势垒信号检测扩散语言模型的越狱
arXiv
2609.30841
Published
Sep 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Instruct, LLaDA-1.5, Dream-v0-Instruct-7B and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract能量势垒把 dLLM 越狱分成掩盖初始状态或中途越垒，三个 logit 信号据此互补检测。
Bach 等提出用去噪能量景观解释 masked diffusion 语言模型上的越狱，并由此得到三个免训练检测信号。。
Paper analysisRead analysis
Risky behaviorarXiv 2609.30266Sep 25
研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹
测试编程智能体被诱导或自主篡改自身执行轨迹的行为
arXiv
2609.30266
Published
Sep 25
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-Sol, GPT-6-Sol, Opus-5 and others11
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
Abstract论文评估了本地智能体的轨迹防篡改能力，发现其可因外部指令或奖励追求而清除执行证据，亟需建立独立拦截记录机制。
这是一项针对本地大模型智能体执行轨迹完整性与安全防篡改边界的实证研究。
Paper analysisRead analysis
DefensesarXiv 2609.22724Sep 19
MATE：面向移动 Agent 的策略感知安全审计方法
提出移动 Agent 轨迹审计器 MATE，判断轨迹是否违反可编辑安全策略
arXiv
2609.22724
Published
Sep 19
Layer
Application layer
Setting
Browser and computer use
Attacker
Black-box
Evaluated models
MATE-0.5B, MATE-1.5B, MATE-3B
- DefensesMonitoring and auditing
- AttacksMalicious use
- RiskDangerous agent actions
- ComponentMonitors
AbstractMATE 用合成轨迹微调轻量审计器，在可编辑策略下判断移动智能体轨迹是否违规并给出解释。
MATE 是面向移动 GUI 智能体的轻量策略条件轨迹审计器，在给定自然语言安全策略时判断轨迹是否违规并解释原因。
Paper analysisRead analysis
DefensesarXiv 2609.20129Sep 17
局部稀疏性实现无监督 LLM 安全检测
提出局部稀疏无监督安全检测，标记偏离安全分布的输入
arXiv
2609.20129
Published
Sep 17
Layer
Model layer
Setting
Models and APIs
Evaluated models
qwen2-1.5b-instruct, ministral-8b-instruct, llama3-8b-instruct and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
AttacksarXiv 2609.15989Sep 15
研究者提出 plan injection 攻击，可绕过思维链监控
提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器
arXiv
2609.15989
Published
Sep 15
Layer
Prompt layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
Qwen2.5-Coder-7B-Instruct, Qwen3-8B, DeepSeek-R1-0528 and others6
- AttacksDetection evasion
- TechniqueReasoning-chain manipulation
- ComponentMonitors
Abstract论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。
Paper analysisRead analysis
DefensesarXiv 2609.13534Sep 12
HPD 与 HERALD：用跨层有害性传播轨迹检测越狱提示
提出 HERALD，用跨层有害投影轨迹检测越狱提示
arXiv
2609.13534
Published
Sep 12
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Mistral-7B-Instruct, OLMo2-7B-Instruct and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractHPD 用跨层投影形状区分有害与良性提示。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.06966Sep 7
Mole：面向前沿实验室 AI 智能体的内部威胁检测基准
提出 MOLE 基准，评测监控器对 AI 智能体内部威胁的检出能力
arXiv
2609.06966
Published
Sep 7
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.3 Chat, GPT-5.5, GPT-4.1 and others15
- DefensesMonitoring and auditing
- AttacksMalicious use
- ComponentMonitors
AbstractMOLE 构建了智能体内部威胁检测基准，作者指出高漏检现状与推理痕迹的防御价值，并展示了监控策略优化空间。
MOLE 是首个针对前沿 AI 实验室智能体内部威胁检测的开放基准，旨在评估在有限每日审查预算与日常研发业务背景下识别恶意账号的能力。。
Paper analysisRead analysis
InterpretabilityarXiv 2609.04721Sep 4
研究：拒答方向可跨架构迁移，安全工具可按写入位置重新估计
在写入点定位拒答方向，经刚性旋转跨架构迁移并门控放大
arXiv
2609.04721
Published
Sep 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
Falcon-Mamba-7B, Falcon3-Mamba-7B, Llama-3.1-8B and others8
- DefensesInference-time intervention
- AttacksJailbreaks
- RiskInappropriate refusal
- ComponentMonitors
Abstract拒答方向可经刚性旋转跨架构迁移，但必须在各架构的写入点读取。
作者研究拒答表示是否随架构改变，结论是表示共享、读取位置随架构变。
Paper analysisRead analysis
AttacksarXiv 2609.01023Sep 1
Akrasia：针对推理型代码 LLM 的隐蔽后门攻击
提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
arXiv
2609.01023
Published
Sep 1
Layer
Prompt layer
Setting
coding agent
Evaluated models
Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7
- AttacksPrompt injection
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
Paper analysisRead analysis
DefensesarXiv 2608.21101Aug 21
ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关
提出 ClawSentry 多层监控网关，在技能准入和运行时拦截恶意技能与隐藏指令
arXiv
2608.21101
Published
Aug 21
Layer
Application layer
Setting
coding agent
Evaluated models
Codex/GPT-5.4, Codex/GPT-5.5, Claude Code/GLM-5.1 and others6
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentMCP and skills
AbstractClawSentry 用包准入、三级运行时门控和反绕过，压低 skill 攻击并保住干净任务。
ClawSentry 是挂在智能体运行时之外的安全监督网关，用来同时盖住 skill 执行的多个生命周期边界，并把已被拒绝的效果记到会话里。
Paper analysisRead analysis
DefensesarXiv 2608.02683Aug 3
S³：用多阶段防御提升 LLM 智能体安全
提出 S³，用 guard agent 编排阶段安全技能防御智能体多阶段风险
arXiv
2608.02683
Published
Aug 3
Layer
Application layer
Setting
Embodied systems and robotics
Evaluated models
DeepSeek-V4-Pro, DeepSeek-V4-Flash
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- RiskDangerous agent actions
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2607.19913Jul 22
Janus：面向长时程智能体安全的前瞻性潜在风险预测框架
提出 Janus 前瞻守卫，在长程智能体执行有害动作前拦截潜在风险
arXiv
2607.19913
Published
Jul 22
Layer
Application layer
Setting
AI Agent
Evaluated models
Vanguard
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
Paper analysisRead analysis
AttacksarXiv 2607.01276Jul 1
研究者提出嵌入推断攻击 EIA，可在黑盒 IR 系统中识别所用嵌入模型
提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
arXiv
2607.01276
Published
Jul 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
e5-small, e5-small-v2, e5-base and others19
- AttacksExtraction and theft
- ComponentEmbeddings
AbstractEIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。
EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。。
Paper analysisRead analysis
DefensesarXiv 2606.22673Jun 22
Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导
提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向
arXiv
2606.22673
Published
Jun 22
Layer
Application layer
Setting
coding agent
Evaluated models
LLaMA-3.1-8B, Qwen-2.5-7B, Gemma-2-9B
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentMonitors
Abstract白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。
Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。
Paper analysisRead analysis
DefensesarXiv 2605.25893May 25
D²-Monitor：基于犹豫信号的扩散大语言模型动态安全监控
提出 D²-Monitor，按犹豫步数把难提示路由到更强探针
arXiv
2605.25893
Published
May 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Base, LLaDA-8B-Instruct, LLaDA-1.5-8B and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果

研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹

研究：分类后缀可提升激活探针的分布外恶意输入检测

DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift

ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架

为何扩散语言模型的越狱会成功：能量景观分析

研究显示 Claude Code、Codex 等本地智能体可轻易篡改自身执行轨迹

MATE：面向移动 Agent 的策略感知安全审计方法

局部稀疏性实现无监督 LLM 安全检测

研究者提出 plan injection 攻击，可绕过思维链监控

HPD 与 HERALD：用跨层有害性传播轨迹检测越狱提示

Mole：面向前沿实验室 AI 智能体的内部威胁检测基准

研究：拒答方向可跨架构迁移，安全工具可按写入位置重新估计

Akrasia：针对推理型代码 LLM 的隐蔽后门攻击

ClawSentry：面向自主 LLM Agent 的渐进式多层安全监控网关

S³：用多阶段防御提升 LLM 智能体安全

Janus：面向长时程智能体安全的前瞻性潜在风险预测框架

研究者提出嵌入推断攻击 EIA，可在黑盒 IR 系统中识别所用嵌入模型

Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导

D²-Monitor：基于犹豫信号的扩散大语言模型动态安全监控