Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 118 papers

Filter4

System component

MCP and skills82 Memory77 RAG47 Guardrails and judges75 Monitors60 Reasoning chains13 Permissions and sandboxing92 Fine-tuning and open weights4 Vision30 Audio6 Embeddings8 Multimodal36

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 247papers have no tags yet and are not included in filtered results.

Layer：Application layer System component：RAG System component：Guardrails and judges System component：Embeddings Clear all

Another 247papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.12292Oct 9
The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
arXiv
2610.12292
Published
Oct 9
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
LAYA-TD, LAYA-EN, LAYA-ML and others5
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Paper analysisRead analysis
AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.11773Oct 8
研究提出 Agent 安全新维度：识别未履行的安全义务
提出义务识别基准 ObligationBench，并训练护栏识别 Agent 未履行的安全义务
arXiv
2610.11773
Published
Oct 8
Layer
Application layer
Setting
coding agent
Evaluated models
ObligationGuard, Claude-Opus-4.8, GPT-5.6-Sol and others17
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
Abstract义务是护栏缺口。
作者认为编码智能体的安全不能只靠拦截禁止动作，还要找出终止时仍未做的安全关键动作，并将其称为义务。
Paper analysisRead analysis
DefensesarXiv 2610.11464Oct 8
研究者提出可检查评分器与自改进 Agent 共同演化方法
演化可检查评分器并与自改进 Agent 共同演化，抑制奖励作弊
arXiv
2610.11464
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.7
- DefensesDetection and filtering
- RiskReward hacking
- ComponentGuardrails and judges
Abstract十项锚点演化可检查评分器。
开放任务没有验证器时，被演化的是评分器，而不是再补一条手写 rubric。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10947Oct 8
RH-Detect：统一的奖励作弊检测基准发布
构建统一奖励作弊检测基准 RH-Detect 并评测零样本检测器
arXiv
2610.10947
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 Flash, Gemini 3.1 Flash Lite, Grok 4.1 Fast and others7
- DefensesDetection and filtering
- RiskReward hacking
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2610.10742Oct 8
BRANCH 方法绕过 6 套多扫描器护栏系统
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
arXiv
2610.10742
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta Llama Guard 3 8B, Meta Llama Guard 7B, Meta Llama Guard 3 1B and others18
- AttacksDetection evasion
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
AttacksarXiv 2610.10612Oct 7
PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
arXiv
2610.10612
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
CISCO, HSS, AUDITOR and others8
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMCP and skills
Abstract论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08571Oct 6
RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准
提出 RAG-PIBench，评测 RAG 上下文中提示注入检测器
arXiv
2610.08571
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
DistilBERT-base-uncased, DeBERTa-v3-base, MiniLM
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07519Oct 6
论文提出针对手语翻译与儿童安全过滤交叉地带的部署前审计框架
提出手语转文本接入儿童安全过滤的部署前审计协议
arXiv
2610.07519
Published
Oct 6
Layer
Application layer
Setting
LLM applications
- DefensesDetection and filtering
- ComponentGuardrails and judges
Abstract作者提议聋人知情的部署前审计，以检查手语转文本是否改变儿童安全决策。
手语儿童到达基于文本的儿童安全机制时，机制看到的是机器翻译，不是儿童所做的手语。作者要解决的是：这条边界在部署前应如何审计。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07359Oct 6
论文实测 Agent 工具调用门控栈的失败相关性
提出 nmult 并评测 Agent 动作门禁堆叠的错误相关性
arXiv
2610.07359
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
AgentTrust runtime (174 rules), GPT-5.5 (gpt55), claude-haiku-4-5-20251001 and others7
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract论文实测发现大模型裁判间错误显著相关，作者主张按机制选型并在整栈层面度量防护增益。
论文是一项针对智能体动作拦截防御堆叠故障关联性与实际组合价值的实证测量研究。
Paper analysisRead analysis
DefensesarXiv 2610.07276Oct 6
SAFESHIELD：小语言模型部署时安全的决策组织框架
提出 SAFESHIELD，组织小语言模型部署时的安全决策
arXiv
2610.07276
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3-4B-Instruct
- AttacksJailbreaks
- RiskHallucination and fabrication
- ComponentRAG
AbstractSAFESHIELD 用可审计决策轨迹组织 SLM 部署时的四项安全决策，并报告协调依赖影响端到端结果。
SAFESHIELD 是面向小语言模型的部署时安全框架，把运行时安全从单项审核改写成可检查的决策过程。
Paper analysisRead analysis
AttacksarXiv 2610.05943Oct 5
CRIME 框架利用良性 Agent 技能组合诱发恶意行为
提出 CRIME 框架，组合良性 Agent 技能诱发恶意行为
arXiv
2610.05943
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-V4-Flash, GPT-4o-mini, GPT-4o and others6
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentMCP and skills
Abstract良性技能经 DCA 或 ACA 组合后可产生恶意环境后果，单独审查对不上。
CRIME 把公共技能库中各自通过审查的技能配成两两组合，看联合执行能否实现指定恶意任务。。
Paper analysisRead analysis
DefensesarXiv 2610.05870Oct 5
MBZUAI 提出可校准的真实图像认证方法
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
arXiv
2610.05870
Published
Oct 5
Layer
Application layer
Setting
LLM applications
Attacker
White-box
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentImage generation
Abstract论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
Paper analysisRead analysis
DefensesarXiv 2610.05826Oct 5
研究者提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
arXiv
2610.05826
Published
Oct 5
Layer
Application layer
Setting
LLM applications
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract用截止期限制未核验可见时长。
这篇工作给持续摄入的 RAG 向量库一个失败关闭的临时可见性协议，把协议能限制的未核验暴露和依赖检测器的中毒暴露分开。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05586Oct 5
AgentDoxx：联网搜索 Agent 对匿名访谈文本的再识别评测
构建 AGENTDOXX 基准，评测联网搜索 Agent 对匿名访谈的再识别
arXiv
2610.05586
Published
Oct 5
Layer
Application layer
Setting
web agent
Evaluated models
GPT-5.6 Terra, GPT-5 Mini, GPT-4.1 Mini and others10
- AttacksMalicious use
- ComponentRAG
Abstract论文提出了已知身份的重识别基准 AGENTDOXX，揭示搜索与记忆双重风险及现有防御在检索轨迹中的泄露漏洞。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05830Oct 5
研究提出智能体排行榜污染审计框架，并检验评分器有效性
提出 HAL 污染审计框架并核验智能体排行榜评分器
arXiv
2610.05830
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4.1, DeepSeek-V4-Flash
- ComponentGuardrails and judges
Abstract框架分开易感性与已实现事件。
作者给出一套测量优先审计框架，用来判断智能体排行榜上的污染主张各自需要何种证据。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.04888Oct 4
研究：事实核查评测可能混入声明时不可知的未来证据
测量事实核查评测混入的时序证据与参数泄漏
arXiv
2610.04888
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3-14B, phi-4
- ComponentRAG
Abstract两条后见通道会抬高事实核查分数。
作者量的是 LLM 事实核查分数里，有多少来自 claim 当时还不可知的信息。通道有两条：预训练记住的结局，以及检索到的、写于 claim 之后的文档。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.04691Oct 4
RAGStress：评测知识库退化下 RAG 鲁棒性的受控基准
提出 RAGStress 受控基准，评测知识库退化下的 RAG
arXiv
2610.04691
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude Sonnet 4, Claude Opus 4.6, DeepSeek R1 and others5
- ComponentRAG
Abstract作者用 RAGStress 比较五系统。
RAGStress 是知识库损坏下的 RAG 受控压力测试。作者明确不把它当作模型排行榜。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

研究提出 Agent 安全新维度：识别未履行的安全义务

研究者提出可检查评分器与自改进 Agent 共同演化方法

RH-Detect：统一的奖励作弊检测基准发布

BRANCH 方法绕过 6 套多扫描器护栏系统

研究：多向量视觉文档索引可被反演还原页面内容

PyCache Trap 利用 Python 缓存替换绕过七款 Agent Skill 扫描器

RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

论文提出针对手语翻译与儿童安全过滤交叉地带的部署前审计框架

论文实测 Agent 工具调用门控栈的失败相关性

SAFESHIELD：小语言模型部署时安全的决策组织框架

CRIME 框架利用良性 Agent 技能组合诱发恶意行为

MBZUAI 提出可校准的真实图像认证方法

研究者提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露

AgentDoxx：联网搜索 Agent 对匿名访谈文本的再识别评测

研究提出智能体排行榜污染审计框架，并检验评分器有效性

研究：事实核查评测可能混入声明时不可知的未来证据

RAGStress：评测知识库退化下 RAG 鲁棒性的受控基准