Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 169 papers

Filter6

System component

MCP and skills84 Memory83 RAG51 Guardrails and judges100 Monitors66 Reasoning chains30 Permissions and sandboxing92 Fine-tuning and open weights54 Vision48 Audio12 Image generation11 Embeddings8 Multimodal70

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Layer：Application layer Layer：Training and data layer System component：Monitors System component：Permissions and sandboxing System component：Audio System component：Embeddings Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.12463Oct 9
Paper reviews OpenAI, Anthropic, and Google agent safety incidents and proposes the PASAC framework
Proposes PASAC and a five-layer boundary guarantee stack, turning agent evaluation overstepping into verifiable whole-system guarantees.
arXiv
2610.12463
Published
Oct 9
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.12445Oct 9
FAR.AI paper: white-box probes surpass Opus 5.5 text monitoring on SHADE-Arena with 98.8% AUC
Using FIBS to train white-box probes to monitor agent sabotage behavior and undisclosed deception
arXiv
2610.12445
Published
Oct 9
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-397B-A17B, Qwen3.5-122B-A10B, Qwen3.5-27B and others10
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2610.11942Oct 8
LGWM: Verifying GUI agent screen transitions with action-conditioned world models
Proposes LGWM, using an action-conditioned world model to verify GUI agent screen transitions.
arXiv
2610.11942
Published
Oct 8
Layer
Application layer
Setting
Browser and computer use
Evaluated models
LGWM
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2610.11754Oct 8
仅凭输出审查无法验证什么：面向研究智能体的研究契约
提出研究合同，把已批准选择绑定到执行证据并由检查器核验
arXiv
2610.11754
Published
Oct 8
Layer
Application layer
Setting
science agent
Evaluated models
OpenAI gpt-5.6-sol, OpenAI gpt-5.6-terra, OpenAI gpt-5.6-luna and others18
- DefensesPermissions and approval
- RiskReward hacking
- ComponentPermissions and sandboxing
Abstract研究合同暴露四类输出单独建不立的关系。
研究合同用来核验计算科学研究智能体是否仍在已批准研究之内，不判断科学是否为真。。
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
DefensesarXiv 2610.09793Oct 7
用时序逻辑监控工具 Agent
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
arXiv
2610.09793
Published
Oct 7
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08585Oct 6
研究：无关信息污染患者病历并干扰 LLM 临床推理
构建 MedDistract 基准，测量偶发信息对临床文书与推理的污染
arXiv
2610.08585
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-5.4, GPT-5.6 Sol, Claude Opus 5 and others9
- RiskHallucination and fabrication
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2610.08082Oct 6
POLAR：面向小型工具调用智能体的可逆性护栏框架
提出 POLAR 本体门控，在执行前否决不可逆工具调用
arXiv
2610.08082
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
qwen/qwen3-8b, meta-llama/llama-3.1-8b-instruct, nvidia/nemotron-nano-9b-v2 and others6
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract训练无关的事前可逆性门控，弱 airline 模型有收益，强模型与 retail 常回落。
POLAR 是训练无关的事前门控，用类型化本体在工具调用执行前检查能否组成候选逆序列。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07639Oct 6
HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.
评测编码智能体 harness 安全机制在对抗任务中的防护效果
arXiv
2610.07639
Published
Oct 6
Layer
Application layer
Setting
coding agent
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.07570Oct 6
ProbeGuard：按共识形成过程判断弃答，识别医疗问答中的一致错误
提出 ProbeGuard，按共识形成过程对医疗问答做选择性弃答
arXiv
2610.07570
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3-8B, Llama-3.1-8B-Instruct, HuatuoGPT-o1-8B
- DefensesMonitoring and auditing
- RiskHallucination and fabrication
- ComponentMonitors
AbstractProbeGuard 用共识形成过程做可认证弃权，并在全票层分开答对与答错的共识。
ProbeGuard 是给多轮共识医学问答用的认证弃权框架：基板照原样作答，弃权只看共识是怎么形成的。
Paper analysisRead analysis
OtherarXiv 2610.07459Oct 6
论文提出 AI Agent 声明的可审计性框架
提出 AI Agent 主张的可审计性框架与裁决规则
arXiv
2610.07459
Published
Oct 6
Layer
Application layer
Setting
AI Agent
- ComponentPermissions and sandboxing
Abstract主张须事先固定四要素。
作者给出把关于已部署智能体的主张写成可核查陈述的条件，而不是检测器或攻击方法。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07359Oct 6
论文实测 Agent 工具调用门控栈的失败相关性
提出 nmult 并评测 Agent 动作门禁堆叠的错误相关性
arXiv
2610.07359
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
AgentTrust runtime (174 rules), GPT-5.5 (gpt55), claude-haiku-4-5-20251001 and others7
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract论文实测发现大模型裁判间错误显著相关，作者主张按机制选型并在整栈层面度量防护增益。
论文是一项针对智能体动作拦截防御堆叠故障关联性与实际组合价值的实证测量研究。
Paper analysisRead analysis
DefensesarXiv 2610.07258Oct 6
AMU：用派生血缘门控实现企业 AI Agent 列级访问控制
提出 AMU 按推导图门控企业 Agent 共享记忆的列级访问
arXiv
2610.07258
Published
Oct 6
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
Abstract在完整血缘下，AMU 按列权限放行缓存，并标出同名 KPI 冲突。
AMU 用列级推导门控共享记忆，拦截经缓存流出的无权敏感列，并标出同名 KPI 的定义冲突。
Paper analysisRead analysis
DefensesarXiv 2610.07256Oct 6
两阶段智能体轨迹审计框架：用门控规则加 LLM 审计降低监控成本
提出两阶段门控审计框架，在执行前阻断有害智能体动作
arXiv
2610.07256
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Sonnet 5.5, Claude Haiku 4.5
- DefensesMonitoring and auditing
- RiskDangerous agent actions
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06454Oct 5
AgentPrivArena：面向 LLM Agent 工作流的隐私风险评测框架
提出 AgentPrivArena 与运行时审计，评测 Agent 轨迹级隐私泄露
arXiv
2610.06454
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Kimi-K2.6 and others6
- DefensesMonitoring and auditing
- RiskDangerous agent actions
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06406Oct 5
AgentMonBench：面向长时程智能体行为监控的软件工程基准
提出 AgentMonBench 评测长时程编程智能体监控并检验 EBG
arXiv
2610.06406
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol and others8
- DefensesMonitoring and auditing
- RiskDangerous agent actions
- ComponentMonitors
AbstractAgentMonBench 评测后果性决策监控，EBG 组织证据。
长时程软件工程任务里，用户要判断智能体哪些选择值得核验。作者用 AgentMonBench 评测监控器，并用免训练的 EBG 组织带源证据。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07089Oct 5
研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹
提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视
arXiv
2610.07089
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma 4 26B-A4B, Qwen3.6 27B, Qwen3.5 27B and others12
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05840Oct 5
研究：任务范围授权可将工具调用有害执行降至零
用配对回放评测任务范围授权能否阻断越权工具执行
arXiv
2610.05840
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.2 3B Instruct Q4 K M, Qwen3 4B Instruct, Gemma 3 4B and others8
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
OtherarXiv 2610.05264Oct 4
面向音频深度伪造检测的任务感知联合剪枝与蒸馏框架
提出任务感知的跨域蒸馏与剪枝方法以压缩音频深度伪造检测器
arXiv
2610.05264
Published
Oct 4
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
XLSR-AASIST
- ComponentAudio
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Paper reviews OpenAI, Anthropic, and Google agent safety incidents and proposes the PASAC framework

FAR.AI paper: white-box probes surpass Opus 5.5 text monitoring on SHADE-Arena with 98.8% AUC

LGWM: Verifying GUI agent screen transitions with action-conditioned world models

仅凭输出审查无法验证什么：面向研究智能体的研究契约

研究：多向量视觉文档索引可被反演还原页面内容

FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

用时序逻辑监控工具 Agent

研究：无关信息污染患者病历并干扰 LLM 临床推理

POLAR：面向小型工具调用智能体的可逆性护栏框架

HarnessSecurity-Bench horizontally evaluates the security mechanisms of six coding agent frameworks.

ProbeGuard：按共识形成过程判断弃答，识别医疗问答中的一致错误

论文提出 AI Agent 声明的可审计性框架

论文实测 Agent 工具调用门控栈的失败相关性

AMU：用派生血缘门控实现企业 AI Agent 列级访问控制

两阶段智能体轨迹审计框架：用门控规则加 LLM 审计降低监控成本

AgentPrivArena：面向 LLM Agent 工作流的隐私风险评测框架

AgentMonBench：面向长时程智能体行为监控的软件工程基准

研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹

研究：任务范围授权可将工具调用有害执行降至零

面向音频深度伪造检测的任务感知联合剪枝与蒸馏框架