Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择
Published Oct 8
Evaluated models Ollama Mistral 0.9.5 , llama3-8b-8192 , gemini-2.0-flash-lite and others5 Abstract 单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。
提出 ASPIRE 行为图搜索，开放式发现 Agent 提示注入漏洞
Published Oct 7
Evaluated models Gemini-3.7-Flash , DeepSeek-V4-Flash , Gemini-2.5-flash Abstract ASPIRE 把提示注入红队从载荷优化改成行为图引导的开放式漏洞发现。ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。
用跨目标课程强化学习训练提示注入红队，攻破前沿智能体
Published Sep 27
Evaluated models GPT-4o-mini , GPT-5-nano , GPT-5.6-Luna and others12 Abstract 提出跨目标模型课程强化学习，攻破前沿模型冷启动瓶颈并实现跨模型迁移。该研究针对强化学习自动化提示注入红队在攻击前沿大模型时的冷启动问题，提出了一种基于目标模型鲁棒性递进的课程强化学习方法。
提出 PIMiner，用可复用策略库自动搜索并迁移针对智能体的提示注入
Published Aug 6
Evaluated models Gemini-2.5-Pro , DeepSeek-V4-Pro , GPT-4o-mini and others10 提出 LoginTrap，以网页弹窗诱导 Web Agent 提交敏感信息
Published Aug 5
Evaluated models GPT-4o , Gemini 3 Flash , Claude Sonnet 4 and others7 Abstract 揭示网络智能体在黑盒网页下的登录诱导风险，利用模糊测试生成话术并跨骨干和架构验证了隐私泄露威胁。
提出权威链劫持与轨迹引导策略演化，劫持搜索 Agent 的证据链
Published Aug 5
Evaluated models Qwen3.5-9B , Gemma4-31B , DeepResearch and others7 Abstract 论文揭示了多步搜索智能体在受限中间人操纵下的脆弱性，提出 ACH 策略与 TGSE 演化方法并完成系统验证。
提出针对 Agent 护栏的推理扩展拒绝服务攻击
Published Jun 12
Evaluated models TS-Guard-8B , Qwen3.5-9B , DeepSeek-V3.2 and others11 提出潜伏记忆投毒，诱导 Agent 把外部文档写成持久伪造记忆
Published May 15
Evaluated models GPT-5.4 , GPT-5.5 , Claude Sonnet 4.6 and others12 Abstract 持久记忆成为跨会话攻击面：通用载荷可写入伪造记忆，并在相关后续任务中影响行为。sleeper memory poisoning 研究带持久记忆的 LLM 助手：外部文档能否让助手存下一则伪造的用户记忆，并在原文档消失后的新会话里被取回、用来改变回复或动作。
You have reached the end