Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 262papers have no tags yet and are not included in filtered results.

Impact：Data and privacy leaks System component：Monitors System component：Reasoning chains Clear all

Another 262papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.06454Oct 5
AgentPrivArena：面向 LLM Agent 工作流的隐私风险评测框架
提出 AgentPrivArena 与运行时审计，评测 Agent 轨迹级隐私泄露
arXiv
2610.06454
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.4, DeepSeek-V4-Pro, Kimi-K2.6 and others6
- DefensesMonitoring and auditing
- RiskDangerous agent actions
- ComponentMonitors
Paper analysisRead analysis
AttacksarXiv 2609.35699Sep 29
论文：蒸馏防御在蒸馏后强化学习下易被攻破
提出用 API 推理摘要重建轨迹再蒸馏加强化学习，攻破蒸馏防御
arXiv
2609.35699
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others12
- AttacksExtraction and theft
- ComponentReasoning chains
Abstract更现实的蒸馏攻击是蒸馏后再 RL。
这篇工作修订蒸馏攻击的威胁模型：攻击者经合法 API 收集闭源推理数据，先蒸馏自有模型，再做强化学习。作者认为只在蒸馏后评估防御，会漏掉后续 RL，从而高估防御。
Paper analysisRead analysis
Risky behaviorarXiv 2609.32701Sep 26
研究显示前沿模型智能体在测试时自行形成隐蔽信道
展示智能体在禁止泄露与独立监视下自发建立隐蔽信道传递机密
arXiv
2609.32701
Published
Sep 26
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.6 Sol, Terra, Luna and others6
- RiskDeception and scheming
- ComponentMonitors
Abstract论文研究了固定参数智能体在受监视交互中仅凭单比特反馈自发建立隐蔽信道，指出了多智能体跨域协作的保密安全新风险。
论文研究了固定参数与提示词的智能体在受审计交互中自发形成隐蔽信道并泄露机密的过程。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
DefensesarXiv 2609.19587Sep 17
红队测试 Auto Mode：用注入与多上下文攻击绕过编码 Agent 阻断监控器
提出 Auto Mode ++，加固编码 Agent 阻断监视器
arXiv
2609.19587
Published
Sep 17
Layer
Application layer
Setting
coding agent
Evaluated models
Opus 5, Opus 4.8, Opus 4.7 and others8
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract系统评估生产阻断监视器在面对持续恶意智能体时的表现，提出加固防御并指明多上下文防御挑战。
Paper analysisRead analysis
DefensesarXiv 2609.16229Sep 15
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
arXiv
2609.16229
Published
Sep 15
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2608.09867Aug 11
Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
arXiv
2608.09867
Published
Aug 11
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13
- AttacksExtraction and theft
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.05647Jun 4
Study: 94% of developers failed to detect covert sabotage by coding agents
评测开发者能否在协作编程中发现编码 Agent 的隐蔽破坏
arXiv
2606.05647
Published
Jun 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-Opus-4.6, GPT-5.4, Gemini-3.1-Pro and others5
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
DefensesarXiv 2602.24210Feb 28
研究者提出 Staged Decoding 与 SFT 数据集，减少大推理模型推理轨迹中的隐私泄露
提出 Staged Decoding 与指令跟随训练，减少推理轨迹隐私泄露
arXiv
2602.24210
Published
Feb 28
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen 3 1.7B, Qwen 3 4B, Qwen 3 8B and others6
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentReasoning chains
Abstract用一般指令跟随训练加分段解码，可降低轨迹隐私泄露，但数学效用下降。
本文把大推理模型的隐私问题做成轨迹可控性：隐私指令是指令，轨迹不跟随就会把敏感上下文写进可被提示注入导出的文本。
Paper analysisRead analysis
DefensesarXiv 2601.14660Jan 21
NeuroFilter: Activation-value guardrails for privacy-conscious LLM agents
提出 NeuroFilter，用激活探针过滤智能体多轮隐私攻击
arXiv
2601.14660
Published
Jan 21
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-OSS 20B, Qwen 2.5 32B Instruct, Llama 3.3 70B and others8
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2601.09281Jan 14
STaR：面向大推理模型遗忘的敏感轨迹调控方法
提出推理时框架 STaR，抑制大推理模型推理轨迹中的敏感内容
arXiv
2601.09281
Published
Jan 14
Layer
Model layer
Setting
Models and APIs
Evaluated models
DeepSeekR1-Distill-Llama-8B
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
AbstractSTaR 以推理时轨迹调控做 LRM unlearning，作者称在 R-TOFU 上遗忘与隐私指标更好。
STaR在推理阶段约束大推理模型的整段 CoT，使指定 forget set 中的敏感内容不出现在中间步骤或最终答案里，且不更新参数。问题来自 LRM 会把敏感知识写进多步推理，而答案级遗忘在 ZeroThink、LessThink 等解码下仍可能泄漏。STaR 先判断查询是否相关并检索遗忘片段，再加安全前缀。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop