Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 255 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
Published Sep 29
Evaluated models AgentCF , AgentSEQ , AgentRAG and others4 Abstract 作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
提出跨独立 Agent 的记忆跳跃攻击，经共享工件在助手间自传播
Published Sep 29
Evaluated models GPT-5.6 Luna , Kimi-K2.6 , GPT-OSS-120B and others6 Abstract 论文证实持久工件与内存可形成跨智能体传播链，揭示了将共享工件纳入安全防线的重要意义。该论文系统研究并量化了通过共享持久工件在具有独立私有内存的 LLM 智能体之间发生自传播的“工件介导传播”攻击风险。
提出条件触发的爆炸提示词，并设计摄入期检测器 DeFuse
Published Sep 19
Evaluated models Llama-3.1-8B-Instruct , Llama-3.1-70B-Instruct , Qwen2.5-32B-Instruct and others15 Abstract 论文揭示了条件触发使提示注入绕过防御并在触发时执行工具，提出轻量检测器并在摄入期有效防范。论文针对大语言模型智能体面临的间接提示注入威胁，研究了利用条件句式实现时间分离的爆炸提示词。
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
Published Sep 12
Evaluated models DeepSeek-V4-Flash , DeepSeek-V4-Pro , Qwen3-Max Abstract 论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
Proposed GhostWriter memory poisoning, which writes into the agent's long-term memory via email and calendar and activates across sessions
Published Jul 7
Evaluated models GPT-5.4-mini , DeepSeek-V4-Flash , Gemini-2.5-Flash and others4 提出 MEMGHOST，用单封邮件对持久个人 Agent 做跨会话隐蔽记忆注入
Published Jul 6
Evaluated models GPT-5.4 , Claude Sonnet 4.6 , Claude Sonnet 4.5 and others6 Abstract 总结了论文的研究背景、双代理优化方法 MEMGHOST、全周期实验结果以及作者对记忆信任边界的启示。本文研究了持久化个人智能体面临的隐蔽记忆注入威胁，提出了一套兼顾写入、隐蔽与跨会话生效的自动化生成框架与全周期评测基准。
系统研究 LLM 智能体记忆投毒并构建基准 MPBench
Published Jun 3
Evaluated models Meta-Llama-3.1-70B-Instruct , Deberta-v3-base , Llama-3.1-8B-Instruct and others5 Abstract 系统研究了智能体记忆投毒风险，揭示了写入渠道漏洞，构建了 MPBench 基准并指出提示注入防御的局限。
提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
Published May 15
Evaluated models GPT-5.4 , GPT-5.5 , Claude Sonnet 4.6 and others12 Abstract 持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
提出 eTAMP，用网页内容跨会话投毒 Web Agent 轨迹记忆并诱导越权操作
Published Apr
Evaluated models GPT-5-mini , GPT-5.2 , GPT-OSS-120B and others6 Abstract 论文提出了基于环境注入的跨任务记忆投毒攻击 eTAMP，作者报告智能体在环境压力下易感性增加且能力与安全并不协同。该论文评估了基于大语言模型的 Web 智能体在利用历史交互轨迹进行记忆增强时的安全脆弱性。
You have reached the end