Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.

Defense type：Detection and filtering System type：AI Agent System type：coding agent System type：Browser and computer use Clear all

Another 255papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.11773Oct 8
研究提出 Agent 安全新维度：识别未履行的安全义务
提出义务识别基准 ObligationBench，并训练护栏识别 Agent 未履行的安全义务
arXiv
2610.11773
Published
Oct 8
Layer
Application layer
Setting
coding agent
Evaluated models
ObligationGuard, Claude-Opus-4.8, GPT-5.6-Sol and others17
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
Abstract义务是护栏缺口。
作者认为编码智能体的安全不能只靠拦截禁止动作，还要找出终止时仍未做的安全关键动作，并将其称为义务。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.03434Oct 2
Persona Guardrail：面向智能体系统的生产级防御框架
提出 Persona Guardrail，强制客服智能体守住功能边界
arXiv
2610.03434
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-30B-A3B, Qwen3-VL-30B, Qwen3-8B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractPersona Guardrail 用功能边界做同步输入输出校验，并在 PAGE 与生产延迟预算下给出评测。
Persona Guardrail 是客服向智能体的同步运行时防御：先写明功能边界，再决定放行或拦截，而不是只检测某一攻击类。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.03448Oct 2
Study retests 15 prompt injection detectors: benchmark scores poorly predict agent deployment performance
重测提示注入检测器在 Agent 工具输出上的检出与任务阻断
arXiv
2610.03448
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Evaluated models
Horizon-Labs, Wolf Defender, Prismor-1.5B and others15
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract论文揭示公开基准无法反映智能体检测器表现，检测能力源于输入格式相似而非通用防御，建议基于工具输出与低误报评测。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34862Sep 28
JEV 作为智能体轨迹安全评判器：与生成式 LLM 评判器的实证对比
对比类型化评审与生成式评审对智能体轨迹的安全判定
arXiv
2609.34862
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
JEV, GLM-5.2-Tencent, DeepSeek-V4-Flash and others5
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
AbstractJEV 的四基准平均正类 F1 最高，延迟和估计费用更低，但分数据集与精确率有取舍。
在已保存的工具使用智能体轨迹上，比较类型化评审 JEV 与四种生成式评审的回溯安全分类。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35886Sep 27
Agentic Commerce Bench：衡量会花钱的智能体的欺诈检测能力
构建支付欺诈基准 ACB，评测花钱智能体的欺诈检测
arXiv
2609.35886
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
gordonguard, pattern judge
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
AbstractACB 把支付欺诈与智能体操纵分开测量，作者强调观察权限、误报预算和微支付复核成本。
ACB 是一套智能体支付欺诈基准与检测参考栈，目标是衡量钱是否被不当提取，而不仅是智能体是否接受了恶意指令。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.08258Sep 8
A study empirically tests five Agent memory systems and finds none of them enforce revocation markers
评测 Agent 记忆系统的软撤回执行情况，并提出陈旧检索防护
arXiv
2609.08258
Published
Sep 8
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.5, Grok-4, DeepSeek-V4-Flash and others9
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentMemory
Abstract系统揭示了记忆系统软撤回在检索时普遍未执行的安全漏洞，证明写回会击穿现有防御，并提出读取端防护作为必要控制手段。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.21155Jun 19
研究评测法律引用幻觉检测
构建法律引用幻觉基准 LePhantomCite 并评测智能体核验
arXiv
2606.21155
Published
Jun 19
Layer
Application layer
Setting
AI Agent
Evaluated models
gpt-5-2025-08-07, Opus 4.8, Gemini 2.5 Flash and others13
- DefensesDetection and filtering
- RiskHallucination and fabrication
Abstract引用幻觉未随代际持续下降。
法律引用核验被做成基准：伪造引用的法院文书在增加，生成端的幻觉率也没有随模型代际持续下降。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2604.07223Apr 8
TraceSafe-Bench：评估 LLM 护栏在多步工具调用轨迹上的表现
提出 TRACE SAFE-BENCH，静态评测多步工具调用轨迹上的护栏
arXiv
2604.07223
Published
Apr 8
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5 mini, GPT-5.4 mini, Gemini3-Flash and others15
- DefensesDetection and filtering
- ComponentGuardrails and judges
AbstractTRACE SAFE-BENCH 用可控变异评轨迹护栏，结构能力比规模和越狱鲁棒性更相关。
TRACE SAFE-BENCH 用固定的多步工具轨迹评护栏，问的是不安全动作到达环境之前能否被拦住，而不是智能体自己会不会拒绝。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2604.01350Apr 2
No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents
形式化并评测共享状态 Agent 的无意跨用户污染
arXiv
2604.01350
Published
Apr 2
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o
- DefensesDetection and filtering
- ComponentMemory
Abstract作者报告良性交互即可造成跨用户污染，文本清洗挡不住代码记忆。
UCC 是共享状态 LLM 智能体上的稳健性问题：源交互可以是良性的，局部有效的制品仍会在后来被误用到其他用户。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.18113Jan 26
MalURLBench: A benchmark for evaluating agent vulnerabilities when processing web URLs
提出 MalURLBench 评测 Agent 是否接受结构伪装的恶意 URL
arXiv
2601.18113
Published
Jan 26
Layer
Application layer
Setting
web agent
Evaluated models
GPT-3.5-Turbo, GPT-4o-mini, GPT-4o and others13
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.10156Jan 15
ToolSafe 提出步骤级护栏 TS-Guard 与 TS-Flow，降低 Agent 有害工具调用
提出 TS-Guard 与 TS-Flow，在执行前检测并引导 Agent 修正有害工具调用
arXiv
2601.10156
Published
Jan 15
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, TS-Guard, Qwen2.5-14B-Instruct
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTS-Bench 标步骤级风险，TS-Guard 用多任务 RL 做执行前判定，TS-Flow 用反馈代替直接中止。
ToolSafe 研究 LLM 智能体在工具执行前的步骤级安全：基准 TS-Bench、护栏 TS-Guard，以及反馈驱动框架 TS-Flow。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2511.20597Nov 26, 2025
BrowseSafe：研究者构建浏览器 Agent 提示注入基准并评测现有防御
提出 BrowseSafe，在工具输出边界检测并拦截浏览器 Agent 提示注入
arXiv
2511.20597
Published
Nov 26, 2025
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3-30B-A3B-Instruct-2507, Qwen3-8B, PromptGuard-2 (22M) and others10
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2510.01354Oct 2, 2025
WAInjectBench 系统评测网页 Agent 的提示注入检测方法
提出 WAInjectBench 评测网页 Agent 的提示注入检测
arXiv
2510.01354
Published
Oct 2, 2025
Layer
Application layer
Setting
web agent
Evaluated models
GPT-4o, Mistral-7B-Instruct-v0.1, Llama-Prompt-Guard-2-86M and others8
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractWAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。
WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2505.23559May 29, 2025
SafeScientist：让 LLM 智能体的科学发现具备风险意识
提出 SafeScientist 四层监控，阻止科研智能体执行高风险或不伦理任务
arXiv
2505.23559
Published
May 29, 2025
Layer
Application layer
Setting
science agent, Multi-agent systems
Evaluated models
GPT-4o, GPT-4.1, GPT-3.5-turbo and others5
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract四层监控加科研安全基准。
SafeScientist 是带四层监控的科研智能体框架，并用 SciSafetyBench 评测科学场景中的任务安全。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop