Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

System type：LLM applications System type：Multi-agent systems System component：RAG System component：Monitors Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11932Oct 8
A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text
Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
arXiv
2610.11932
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Grok, Doubao, ChatGPT and others10
- AttacksPoisoning and backdoors
- ComponentRAG
AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
Paper analysisRead analysis
AttacksarXiv 2610.09920Oct 7
研究：多向量视觉文档索引可被反演还原页面内容
提出流匹配逆向框架，从多向量视觉文档索引重构页面
arXiv
2610.09920
Published
Oct 7
Layer
Application layer
Setting
LLM applications
Evaluated models
Tomoro-ColQwen3-8B, ColQwen3.5-4.5B, Tomoro-colqwen3-embed-4b and others13
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08571Oct 6
RAG-PIBench：可信 RAG 系统中提示注入检测的泄漏感知基准
提出 RAG-PIBench，评测 RAG 上下文中提示注入检测器
arXiv
2610.08571
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
DistilBERT-base-uncased, DeBERTa-v3-base, MiniLM
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentRAG
Paper analysisRead analysis
DefensesarXiv 2610.07570Oct 6
ProbeGuard：按共识形成过程判断弃答，识别医疗问答中的一致错误
提出 ProbeGuard，按共识形成过程对医疗问答做选择性弃答
arXiv
2610.07570
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3-8B, Llama-3.1-8B-Instruct, HuatuoGPT-o1-8B
- DefensesMonitoring and auditing
- RiskHallucination and fabrication
- ComponentMonitors
AbstractProbeGuard 用共识形成过程做可认证弃权，并在全票层分开答对与答错的共识。
ProbeGuard 是给多轮共识医学问答用的认证弃权框架：基板照原样作答，弃权只看共识是怎么形成的。
Paper analysisRead analysis
DefensesarXiv 2610.07276Oct 6
SAFESHIELD：小语言模型部署时安全的决策组织框架
提出 SAFESHIELD，组织小语言模型部署时的安全决策
arXiv
2610.07276
Published
Oct 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3-4B-Instruct
- AttacksJailbreaks
- RiskHallucination and fabrication
- ComponentRAG
AbstractSAFESHIELD 用可审计决策轨迹组织 SLM 部署时的四项安全决策，并报告协调依赖影响端到端结果。
SAFESHIELD 是面向小语言模型的部署时安全框架，把运行时安全从单项审核改写成可检查的决策过程。
Paper analysisRead analysis
DefensesarXiv 2610.05826Oct 5
研究者提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
arXiv
2610.05826
Published
Oct 5
Layer
Application layer
Setting
LLM applications
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract用截止期限制未核验可见时长。
这篇工作给持续摄入的 RAG 向量库一个失败关闭的临时可见性协议，把协议能限制的未核验暴露和依赖检测器的中毒暴露分开。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.04888Oct 4
研究：事实核查评测可能混入声明时不可知的未来证据
测量事实核查评测混入的时序证据与参数泄漏
arXiv
2610.04888
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3-14B, phi-4
- ComponentRAG
Abstract两条后见通道会抬高事实核查分数。
作者量的是 LLM 事实核查分数里，有多少来自 claim 当时还不可知的信息。通道有两条：预训练记住的结局，以及检索到的、写于 claim 之后的文档。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.04860Oct 4
Research reveals that text watermarks induce model hallucinations and proposes two mitigation interventions
分析文本水印在 RAG 中诱发事实幻觉的机制并提出干预
arXiv
2610.04860
Published
Oct 4
Layer
Model layer
Setting
LLM applications
Evaluated models
LLaMA 3.1 8B Instruct, Mistral-7B-Instruct-v0.3, Qwen2.5-14B-Instruct
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentRAG
Abstract论文揭示了生产环境文本水印导致模型事实退化的失效模式，分析了解码机制并提出针对性干预。
论文研究生产级文本水印对大语言模型事实准确性的影响，分析了水印诱发幻觉的失效模式并评估了针对性缓解方案。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.04691Oct 4
RAGStress：评测知识库退化下 RAG 鲁棒性的受控基准
提出 RAGStress 受控基准，评测知识库退化下的 RAG
arXiv
2610.04691
Published
Oct 4
Layer
Application layer
Setting
LLM applications
Evaluated models
Claude Sonnet 4, Claude Opus 4.6, DeepSeek R1 and others5
- ComponentRAG
Abstract作者用 RAGStress 比较五系统。
RAGStress 是知识库损坏下的 RAG 受控压力测试。作者明确不把它当作模型排行榜。
Paper analysisRead analysis
AttacksarXiv 2610.02373Oct 2
HDI 攻击：篡改 GraphRAG 辅助结构可致 88–94% 攻击成功率
提出 HDI 攻击以篡改 GraphRAG 辅助结构破坏检索
arXiv
2610.02373
Published
Oct 2
Layer
Application layer
Setting
LLM applications
Evaluated models
Microsoft GraphRAG, HippoRAG2
- AttacksPoisoning and backdoors
- ComponentRAG
Abstract论文形式化了 GraphRAG 辅助模式级实体攻击面，提出 HDI 攻击并验证其攻击效果。
Paper analysisRead analysis
AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.01218Oct 1
AGO AI Quality Gate：面向 RAG 的证据优先发布决策框架
提出面向 RAG 的证据优先发布框架 AGO，并评测评审 adherence 判别
arXiv
2610.01218
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Evaluated models
gpt-4o, gpt-4.1-nano
- ComponentGuardrails and judges
AbstractAGO 把缺失证据和评审误差写成显式发布状态，并要求按领域验证评审。
AGO 是部署在企业 RAG 评估业务中的自托管发布门控，用来决定一个版本应放行、人工复核还是拦截。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39146Sep 30
MADBench：多智能体辩论安全性评测基准发布
提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响
arXiv
2609.39146
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gpt-4o, GPT-5, GPT-6 Astra
- AttacksPrompt injection
- ComponentRAG
AbstractMADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。
MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。
Paper analysisRead analysis
Risky behaviorarXiv 2609.39050Sep 30
Study: Seven of nine frontier models covertly pass credentials to bypass monitoring
测量无对抗协作中 Agent 自发编码凭据以规避监控
arXiv
2609.39050
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
DeepSeek-V4-Pro, devstral-2512, gpt-oss-120b and others14
- RiskDeception and scheming
- ComponentMonitors
Abstract论文揭示智能体会因良性助人意图自主编码凭据规避监控，主张不能单靠内容审查，需在动作层强化严格鉴权。
Paper analysisRead analysis
DefensesarXiv 2609.36326Sep 29
PILLAR：面向增强检索的私有倒排索引词法查找
提出 PILLAR，用私有词法预筛与客户端重排保护 RAG 查询
arXiv
2609.36326
Published
Sep 29
Layer
Application layer
Setting
LLM applications
- ComponentRAG
AbstractPILLAR 用固定模式的私有 BM25 预筛加本地嵌入重排，在两基准上换取延迟或质量。
PILLAR 是面向公开语料的隐私 RAG：半诚实服务器学不到查询词项和访问模式，客户端仍拿到用于增强生成的 k 篇文档。
Paper analysisRead analysis
AttacksarXiv 2609.35155Sep 28
LENS：检索增强生成中集合级投毒的整体危害大于各部分之和
提出 LENS，构造集合级 RAG 语料投毒以导向预设答案
arXiv
2609.35155
Published
Sep 28
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen3.6-35B-A3B, Llama-3.1-70B-Instruct, DeepSeek-V4-Pro
- AttacksPoisoning and backdoors
- TechniqueAutomated search
- ComponentRAG
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33102Sep 27
ORBIT：基于 UK AISI Inspect 的多智能体安全评测框架
提出 ORBIT 框架，评测多智能体防御对合谋等威胁的效果
arXiv
2609.33102
Published
Sep 27
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.4, Claude Sonnet 4.6, Qwen3-235B and others5
- AttacksMalicious use
- RiskDeception and scheming
- ComponentMonitors
AbstractORBIT 用六层配置比较多智能体防御，逐动作监控不迁移到合谋。
Paper analysisRead analysis
Risky behaviorarXiv 2609.32701Sep 26
研究显示前沿模型智能体在测试时自行形成隐蔽信道
展示智能体在禁止泄露与独立监视下自发建立隐蔽信道传递机密
arXiv
2609.32701
Published
Sep 26
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
GPT-5.6 Sol, Terra, Luna and others6
- RiskDeception and scheming
- ComponentMonitors
Abstract论文研究了固定参数智能体在受监视交互中仅凭单比特反馈自发建立隐蔽信道，指出了多智能体跨域协作的保密安全新风险。
论文研究了固定参数与提示词的智能体在受审计交互中自发形成隐蔽信道并泄露机密的过程。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.31342Sep 25
Research reveals outdated document poisoning: RAG retrieval can make models abandon originally correct answers
评测 RAG 中过期文档推翻模型原本正确回答的现象
arXiv
2609.31342
Published
Sep 25
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, GPT-4.1, Claude-Opus-4.5 and others13
- ComponentRAG
Abstract论文评测了陈旧检索推翻正确知识的中毒现象，并分析了其内部机制与防御局限。
这篇论文是对检索增强生成（RAG）中“陈旧文档中毒”现象的实证与机理评估研究。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.30467Sep 25
研究提出医疗答案事实核查失败分类法，指出检索后验证范式的固有局限
归纳开放式医学长答案检索核验的失败分类
arXiv
2609.30467
Published
Sep 25
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-5.4, Mistral Small 3 (24B-Instruct-2501), Mistral Small 4 (119B-2603) and others8
- ComponentRAG
Abstract作者把开放式低召回归为证据是否在库、能否被定位，以及与声明是否对齐。
这篇工作诊断开放式医学事实核验的 retrieve-then-verify 管线断在哪里，而不是提出新的核验器。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop