Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 16 papers Another 213 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 VAL 框架，并用确认门与参数沙箱约束智能体高风险工具调用
Published Oct 3
Evaluated models DeepSeek-chat , Meta Llama 3.1 8B , Kimi 提出 PACE，在工具调用前做路径隔离与效果授权
Published Oct 1
Evaluated models gpt-5.6-luna , DeepSeek-V4-Flash , Qwen-3.8-27B Abstract PACE 在工具边界做路径割与效果核验。PACE 是面向工具调用型 LLM 智能体的运行时调解：当准入证据无法区分会改变行为的规格时，不在出口站点上撤销调解，而在最后一次工具调用前同时检查表示出的影响路径和请求权限。
为 Agent 提出资源层授权系统 Pincer，用数字分身执行动态最小权限
Published Oct 1
Evaluated models Claude Haiku 4.5 , Muse Spark 1.2 Contributor Abstract Pincer 在资源层以三票合取做授权。Pincer 是加在现成 coding agent 上的资源层授权防御：用只受用户侧信息影响的 digital twin 做动态最小权限，并与 tool-call 层防御并存。要处理的是用户维护策略带来的权限蠕变和授权疲劳，以及不学习用户策略的 tool-call 分类器。作者引述工作称 auto mode 会放行多数不安全操作，并认为推理代码或复杂 shell 的效果在这一层不实际。
提出 FlowReview，用授权配对与确定性提交门控控制多智能体组合信息流
Published Sep 30
Evaluated models Sonnet 4.5 , Haiku 4.5 , Qwen3-32B and others5 Abstract 配对标准要求拒绝禁止使用并完成授权使用，FlowReview 把三项审查接到执行。这篇工作把多智能体安全写成一件必须同时成立的事：拦住组合信息所启用的禁止使用，并完成同一场景里任务所需的授权使用。
提出多智能体系统提示注入的威胁模型与四层架构防御
Published Sep 19
Evaluated models GPT-4o (2024-08-06) , Claude 3.5 Sonnet , Llama 3 70B-Instruct 提出企业 MCP 零信任授权与发现扩展，在架构上拒绝提示注入下的越权调用
Published Sep 19
Evaluated models gpt-5 , claude-sonnet-4-6 , claude-opus-4-7 and others6 Abstract 同一份按工具声明同时管 MCP 的发现、列表和调用，使注入不能扩大已有凭证的权限。作者把零信任放在 MCP 工具调用边界：智能体即使被提示注入，也不能调用其凭证范围之外的工具。问题来自三点部署性质。调用意图会随不可信上下文改变。
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
Published Sep 15
Evaluated models gemma4:31b-cloud Abstract 结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
提出 IntentCap，按来源字段所有权合成并裁决 Agent 能力租约
Published Sep 14 Abstract 四源字段租约约束副作用。IntentCap 是把智能体能力绑到当前任务意图、并按上下文来源划分字段所有权的权限机制。
为冻结模型与目标域自动搜索可部署的 Agent 安全 harness
Published Sep 5
Evaluated models Sonnet 4.6 , GLM-5 , Kimi-K2.5 and others11 提出 SkillGuard，用可达性限制污染后的 Agent 能力
Published Aug 31
Evaluated models Gemini 2.5 Flash , Llama3.3-70B 提出 AgentKernel，用四支柱强制中介 Agent 的输入、工具与记忆
Published Aug 29 Abstract AgentKernel 是四支柱智能体 OS 设计，安全论证未附带实测数字。AgentKernel 是把安全做成组织原则的智能体 OS 架构，不是带跑分的攻防评测。
提出 PACE，用策略认证与签名决策记录拦截 DeFi 智能体违规交易
Published Aug 18
Evaluated models gemini-3.1-flash-lite , DeepSeek-V4-Flash , gpt-4o 构建自演化基准 ActBench，评测协作智能体的行为安全
Published Aug 10
Evaluated models Claude-Opus-4.8 , Claude-Sonnet-4.6 , GPT-5.5 and others15 Abstract ActBench 通过自演化搜索与双证据重构评测轨迹行为安全，揭示基础模型决策差异主导了协同智能体的操作风险。
建模并利用多智能体网络中子智能体生成时的记忆继承漏洞
Published May 9
Evaluated models MiniMax M2.5 , Llama-4-Maverick-17B-128E-Instruct-FP8 , Qwen3.5-Plus and others5 Abstract 形式化子智能体继承，在 OpenClaw 上演示四类编排层漏洞并提出防御。作者对多智能体网络里的子智能体继承 做形式化分析，并用开源框架上的 PoC 演示编排层如何让单点妥协继续扩散。
Reviews threats to autonomous agents and proposes a full-lifecycle defense blueprint, FASA
Published Mar 13 Abstract Using OpenClaw as an example, it divides risks into three layers and uses FASA to describe defense from input to system execution.This is a threat review and defense architecture report using OpenClaw as a case study, not a scored attack or defense evaluation.
Proposes a defense-in-depth aligned with the five stages to mitigate cross-stage threats to autonomous agents
Published Mar 12 Abstract This is a lifecycle threat analysis and layered mitigation design for OpenClaw, with the cases serving as qualitative evidence.This is a lifecycle threat analysis of OpenClaw, accompanied by a set of layered mitigation designs. The problem addressed is: when autonomous agents connect instant messaging, persistent memory, third-party plugins, and high-privilege execution, attacks are no longer limited to single-turn jailbreaks but can compound across multiple stages from initialization to execution. The authors argue that defenses hardening only individual interfaces cannot stop such cross-temporal attacks.
You have reached the end