Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

System type：Models and APIs System type：coding agent System type：Embodied systems and robotics System component：Monitors Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.06406Oct 5
AgentMonBench：面向长时程智能体行为监控的软件工程基准
提出 AgentMonBench 评测长时程编程智能体监控并检验 EBG
arXiv
2610.06406
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol and others8
- DefensesMonitoring and auditing
- RiskDangerous agent actions
- ComponentMonitors
AbstractAgentMonBench 评测后果性决策监控，EBG 组织证据。
长时程软件工程任务里，用户要判断智能体哪些选择值得核验。作者用 AgentMonBench 评测监控器，并用免训练的 EBG 组织带源证据。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06366Oct 5
VERA：结构化审计发现约 60% 正确漏洞判定伴随虚构推理
提出 VERA，审计 LLM 漏洞解释里的虚构推理
arXiv
2610.06366
Published
Oct 5
Layer
Model layer
Setting
coding agent
Evaluated models
sonnet-5, gemma-4-26b, llama-4-maverick and others8
- RiskHallucination and fabrication
- ComponentReasoning chains
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05818Oct 5
研究显示 VLA 模型文本护栏漏检隐含危害指令
评测文本守卫与激活探针能否拦住机器人隐含伤害指令
arXiv
2610.05818
Published
Oct 5
Layer
Prompt layer
Setting
Embodied systems and robotics
Evaluated models
π0.5, OpenVLA-OFT, Llama Guard 3 and others10
- RiskDangerous agent actions
- ComponentGuardrails and judges
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.04737Oct 4
PyINE：用可验证 Python 执行轨迹研究推理模型的捷径与监督
提出 PyINE 基准，训练捷径跟随模型并比较监督者
arXiv
2610.04737
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
shortcut-following model organism, gpt-4o, gpt-5 and others12
- ComponentMonitors
AbstractPyINE 用可验证代码执行研究捷径失败的监督覆盖与成本权衡。
PyINE 是用可执行程序研究推理模型引出与监督的框架，PyINE-v1 是其第一次发布。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.02741Oct 2
研究系统评估循环语言模型的思维链可监控性
系统评估循环语言模型加深 loop 后的 CoT 可监控性
arXiv
2610.02741
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Ouro-1.4B-Thinking, Ouro-2.6B-Thinking, Nanbeige4.2-3B and others4
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentReasoning chains
Abstract加深 loop 可在部分压力测试任务降低可监测性，循环架构本身并不必然更难监测。
这项工作评估 LoopLM 的 CoT 可监测性：加深共享层的重复次数，以及“有循环结构”本身，会不会让决策关键因素更少出现在可监测文本里。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39533Sep 30
CATCH: A Controllable Analysis Testbed for Coding RL Reward Hacking
构建编码 RL 奖励作弊测试台 CATCH 并检验 CoT 监控失效
arXiv
2609.39533
Published
Sep 30
Layer
Model layer
Setting
coding agent
Evaluated models
Qwen3-4B, Qwen3.5-27B
- RiskReward hacking
- ComponentMonitors
AbstractCATCH 用双运行金标签研究编码 RL 的奖励黑客，并观察到监控会被注释适应削弱。
CATCH 是面向编码 RL 奖励黑客的可控分析测试床，用可利用环境、可调初始倾向和基于执行的金标签，在训练全程比较黑客动态与干预。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.28915Sep 24
研究提出 ACE 语料库，评估内核级证据对 Agent 安全检测的有效性
构建 ACE 语料，评测内核级证据对 Agent 攻击检测的有效性
arXiv
2609.28915
Published
Sep 24
Layer
Application layer
Setting
coding agent
Evaluated models
AdaBoost, XGBoost, TabPFN and others10
- AttacksPrompt injection
- ComponentMCP and skills
AbstractACE 用配对的内核与应用层证据表明，syscall 痕迹可判别智能体攻击，两层组合通常更好。
ACE 是一份把智能体会话的内核 syscall 痕迹与应用层清单、转录配对起来的检测语料和基准。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05797Sep 5
Paper finds safety monitors mainly block requests the model would already refuse
评估安全监视器并提出双侧梯级微调以减少会答有害请求的漏检
arXiv
2609.05797
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Gemma-4-31B-IT, Qwen3-32B, Llama Guard 3 8B and others6
- DefensesDetection and filtering
- RiskInappropriate refusal
- ComponentGuardrails and judges
Abstract论文发现安全监视器大多拦截模型已拒答请求，指出明确度偏差是共性原因，并通过双侧梯级微调提升回答请求的召回表现。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.22673Jun 22
Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导
提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向
arXiv
2606.22673
Published
Jun 22
Layer
Application layer
Setting
coding agent
Evaluated models
LLaMA-3.1-8B, Qwen-2.5-7B, Gemma-2-9B
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentMonitors
Abstract白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。
Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.05647Jun 4
Study: 94% of developers failed to detect covert sabotage by coding agents
评测开发者能否在协作编程中发现编码 Agent 的隐蔽破坏
arXiv
2606.05647
Published
Jun 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-Opus-4.6, GPT-5.4, Gemini-3.1-Pro and others5
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.30322May 29
Gram：面向破坏倾向的自动化对齐审计框架
提出 Gram 审计框架，测量编程与研究智能体的破坏倾向
arXiv
2605.30322
Published
May 29
Layer
Application layer
Setting
coding agent, science agent
Evaluated models
Gemini 2.5 Pro, Gemini 3.0 Pro Preview, Gemini 3.1 Pro Preview
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.16626May 16
Sleight-Bench: 20 of 40 attacks were never detected by Opus 4.6 monitoring.
构建 SLEIGHT-Bench 评测代码智能体监控对概念盲点规避的捕获
arXiv
2605.16626
Published
May 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Opus 4.6, Claude Opus 4.7, Claude Sonnet 4.6 and others6
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract评估针对监控盲点的规避基准，发现前沿监控器漏报率高，算力与脚手架虽有提升但存在类别局限。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2602.14161Feb 15
When benchmarks lie: evaluating malicious prompt classifiers under real-world distribution shift
提出 LODO 评测恶意提示探针的跨数据集泛化
arXiv
2602.14161
Published
Feb 15
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Gemma-3-27B, Qwen-3.5-4B and others5
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract作者称 LODO 露出 CV 高估，数据集身份与安全方向部分重叠，标准域泛化干预关不上。
LODO 用来检查恶意提示词分类器换成没见过的数据集后，还剩多少检测能力。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2602.08877Feb 10
Automated red-teaming pipeline stress-tests alignment audits, finds prompt-level strategic deception can render audits ineffective
提出自动化红队流水线，用系统提示词压测对齐审计能否抵御策略性欺骗
arXiv
2602.08877
Published
Feb 10
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma 2 9B Instruct, Llama 3.3 70B Instruct
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract通过红队提示词揭示现有审计方法易受策略欺骗，并在激活层面诱导高置信度错误推断。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2510.09462Oct 10, 2025
研究者用提示注入攻击监控模型，绕过 AI 控制协议
提出针对可信监控器的自适应提示注入，绕过 AI 控制协议
arXiv
2510.09462
Published
Oct 10, 2025
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4, GPT-4.1 and others4
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract作者指出当前依赖 LLM 监控器的 AI 控制协议易被自适应提示注入攻破，呼吁引入多监控器集成与数据流隔离机制。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop