Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 118 papers

Filter2

System component

MCP and skills26 Memory20 RAG11 Guardrails and judges63 Monitors49 Reasoning chains19 Permissions and sandboxing62 Fine-tuning and open weights24 Vision34 Audio9 Video4 Image generation16 Embeddings3 Multimodal57

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

System component：Permissions and sandboxing System component：Multimodal Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.13333Oct 9
LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
arXiv
2610.13333
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
- AttacksMalicious use
- ComponentImage generation
AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.
LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Paper analysisRead analysis
DefensesarXiv 2610.12463Oct 9
Paper reviews OpenAI, Anthropic, and Google agent safety incidents and proposes the PASAC framework
Proposes PASAC and a five-layer boundary guarantee stack, turning agent evaluation overstepping into verifiable whole-system guarantees.
arXiv
2610.12463
Published
Oct 9
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.11942Oct 8
LGWM: Verifying GUI agent screen transitions with action-conditioned world models
Proposes LGWM, using an action-conditioned world model to verify GUI agent screen transitions.
arXiv
2610.11942
Published
Oct 8
Layer
Application layer
Setting
Browser and computer use
Evaluated models
LGWM
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2610.11754Oct 8
仅凭输出审查无法验证什么：面向研究智能体的研究契约
提出研究合同，把已批准选择绑定到执行证据并由检查器核验
arXiv
2610.11754
Published
Oct 8
Layer
Application layer
Setting
science agent
Evaluated models
OpenAI gpt-5.6-sol, OpenAI gpt-5.6-terra, OpenAI gpt-5.6-luna and others18
- DefensesPermissions and approval
- RiskReward hacking
- ComponentPermissions and sandboxing
Abstract研究合同暴露四类输出单独建不立的关系。
研究合同用来核验计算科学研究智能体是否仍在已批准研究之内，不判断科学是否为真。。
Paper analysisRead analysis
DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
DefensesarXiv 2610.09703Oct 7
研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
arXiv
2610.09703
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVA-1.5-7B
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Abstract剪枝去掉背景 token 后注意力塌向恶意前景。
这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
Paper analysisRead analysis
DefensesarXiv 2610.09469Oct 7
Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents
提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响
arXiv
2610.09469
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
Claude Opus 5, Gemini 3.8 Flash, GPT-5.6-Sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentVision
AbstractSecure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。
Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。
Paper analysisRead analysis
DefensesarXiv 2610.08082Oct 6
POLAR：面向小型工具调用智能体的可逆性护栏框架
提出 POLAR 本体门控，在执行前否决不可逆工具调用
arXiv
2610.08082
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
qwen/qwen3-8b, meta-llama/llama-3.1-8b-instruct, nvidia/nemotron-nano-9b-v2 and others6
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract训练无关的事前可逆性门控，弱 airline 模型有收益，强模型与 retail 常回落。
POLAR 是训练无关的事前门控，用类型化本体在工具调用执行前检查能否组成候选逆序列。
Paper analysisRead analysis
DefensesarXiv 2610.07774Oct 6
研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器
AI summary研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。
arXiv
2610.07774
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-30B-A3B-Instruct, Kimi-VL-A3B-Instruct
- DefensesMonitoring and auditing
- RiskInappropriate refusal
- ComponentMonitors
Abstract读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。
作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。
Paper analysisRead analysis
DefensesarXiv 2610.07258Oct 6
AMU：用派生血缘门控实现企业 AI Agent 列级访问控制
提出 AMU 按推导图门控企业 Agent 共享记忆的列级访问
arXiv
2610.07258
Published
Oct 6
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
Abstract在完整血缘下，AMU 按列权限放行缓存，并标出同名 KPI 冲突。
AMU 用列级推导门控共享记忆，拦截经缓存流出的无权敏感列，并标出同名 KPI 的定义冲突。
Paper analysisRead analysis
DefensesarXiv 2610.05870Oct 5
MBZUAI 提出可校准的真实图像认证方法
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
arXiv
2610.05870
Published
Oct 5
Layer
Application layer
Setting
LLM applications
Attacker
White-box
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentImage generation
Abstract论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
Paper analysisRead analysis
DefensesarXiv 2610.05637Oct 5
Study shows VLM visual grounding refusal rates are on average 31 to 59 percentage points lower by harm domain
提出融合定位拒答与能力保留的安全微调，补齐视觉定位输出的拒答缺口
arXiv
2610.05637
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Claude Sonnet 4.6, Gemini 3.5 Flash, Molmo2-8B and others5
- DefensesModel hardening
- RiskInappropriate refusal
- ComponentVision
Abstract论文揭示了 VLM 定位安全落后于 VQA 的对齐断层，提出三成分微调方案有效弥合差距并保留定位能力，表征分析揭示了对齐机制。
Paper analysisRead analysis
DefensesarXiv 2610.05401Oct 5
AVCE：面向扩散模型可验证概念擦除的审计感知遗忘框架
提出审计感知遗忘框架 AVCE，从文本与视觉通路擦除扩散模型概念
arXiv
2610.05401
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Stable Diffusion XL (SDXL), Stable Diffusion v1.5 (SD v1.5), Flux 1.0
- DefensesModel hardening
- AttacksJailbreaks
- ComponentImage generation
AbstractAVCE 在审计锚点上改两条注意力通路。
AVCE 是面向扩散模型的概念擦除方法，要让擦除经得起绕过文本条件的潜空间审计，而不只是挡住对抗提示词。
Paper analysisRead analysis
DefensesarXiv 2610.05246Oct 4
研究测量策略网关跨平台命令裁决的能力边界
提出策略门裁决已实现动作，并测量跨平台命令拦截边界
arXiv
2610.05246
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
claude-opus-5, deepseek-v4.1-flash, gpt-6-astra
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.06966Oct 4
APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.
提出 APEX，在执行边界用授权契约防御 Agent 间接提示注入
arXiv
2610.06966
Published
Oct 4
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GLM-5.2, GPT-5.6-sol
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.04975Oct 4
论文提出长程智能体自生子目标的运行时授权机制
提出长程工具智能体自生子目标的运行时授权机制
arXiv
2610.04975
Published
Oct 4
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract用版本化目标图授权保住重规划，并挡住自生成子目标变成新权威。
长时程工具使用把目标演化变成授权状态的一部分。本文在单 principal、单根、有限结构化域中，把自生成子目标的创建、替换、同根委托和同根 join 做成可检查转移，并在提交边界重查受保护效应。
Paper analysisRead analysis
DefensesarXiv 2610.04616Oct 3
PerturBot 用扰动训练打破视觉-语言-动作模型的模态捷径
提出 Perturbot 扰动训练，打破 VLA 的模态捷径
arXiv
2610.04616
Published
Oct 3
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
π0.5
- DefensesModel hardening
- ComponentVision
AbstractPerturbot 改训练数据以削弱三类模态捷径，GroundFscore 用来看成功是否来自任务证据。
Perturbot 是一套不改推理的 VLA 训练期数据干预，用来削弱模态捷径，并用离线分数区分“任务变好”和“靠捷径变好”。
Paper analysisRead analysis
DefensesarXiv 2610.04504Oct 3
论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证
提出 VAL 框架，并用确认门与参数沙箱约束智能体高风险工具调用
arXiv
2610.04504
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-chat, Meta Llama 3.1 8B, Kimi
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.04235Oct 3
Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架
提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
arXiv
2610.04235
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-TTS (0.6B), Dots.tts (2B)
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentAudio
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

Paper reviews OpenAI, Anthropic, and Google agent safety incidents and proposes the PASAC framework

LGWM: Verifying GUI agent screen transitions with action-conditioned world models

仅凭输出审查无法验证什么：面向研究智能体的研究契约

OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

Secure-CUA: Constraining the Impact of Untrusted Content in Computer-Use Agents

POLAR：面向小型工具调用智能体的可逆性护栏框架

研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器

AMU：用派生血缘门控实现企业 AI Agent 列级访问控制

MBZUAI 提出可校准的真实图像认证方法

Study shows VLM visual grounding refusal rates are on average 31 to 59 percentage points lower by harm domain

AVCE：面向扩散模型可验证概念擦除的审计感知遗忘框架

研究测量策略网关跨平台命令裁决的能力边界

APEX: proactively defending against indirect prompt injection at the LLM agent execution boundary.

论文提出长程智能体自生子目标的运行时授权机制

PerturBot 用扰动训练打破视觉-语言-动作模型的模态捷径

论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证

Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架