Skip to content
Oct 13 · Tuesday

All papers

Found 1557 papers
Filter5

Attack type

Jailbreaks257Prompt injection233Poisoning and backdoors146Model tampering36Extraction and theft71Detection evasion63Denial of service9Malicious use26

Attack technique

Gradient and representation optimization62Automated search104Multi-turn escalation30Encoding and obfuscation61Role-play and persuasion28Conversation structure manipulation13Reasoning-chain manipulation15Cross-modal payloads57Side channels3Defense-targeted44Dormant triggers60Selection manipulation11

Model risks

Deception and scheming66Reward hacking68Misalignment and value divergence58Dangerous agent actions85Dangerous capabilities30Inappropriate refusal74Hallucination and fabrication37Bias and discrimination22

Defense type

Model hardening143Inference-time intervention49Detection and filtering87Instruction–data separation57Permissions and approval69Monitoring and auditing66Watermarking and provenance20

Impact

Harmful content318Unauthorized actions220Data and privacy leaks122Output manipulation277Availability and reliability89Oversight failure120Increased misuse capability19

System type

Models and APIs888LLM applications146AI Agent669coding agent140science agent32web agent34Browser and computer use19Multi-agent systems82Embodied systems and robotics47

Attacker access

Black-box150Gray-box14White-box59No-box (offline transfer)6

Attack surface / entry point

User input394Web pages and interfaces65Documents and messages71Tool responses109Tool and skill descriptions64Code repositories and dependencies29Retrieval corpus14Memory writes43Inter-agent messages28Images, audio and video121Training data71Weights and gradients73Distribution channels65Inference services and hardware20

Layer

Prompt layer255Model layer428Application layer613Training and data layer239Infrastructure layer22

System component

MCP and skills82Memory80RAG11Guardrails and judges136Monitors91Reasoning chains76Permissions and sandboxing91Fine-tuning and open weights67Vision131Audio35Video13Image generation47Embeddings4Multimodal214
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：AI AgentSystem type：coding agentSystem type：science agentSystem type：Browser and computer useClear all

Another 215papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.13928

    AI models can provably hide arbitrary capabilities

    Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities

    arXiv
    2610.13928
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 3 270M
    AbstractThe authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.

    The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.

    Paper analysisRead analysis
  2. OtherarXiv 2610.13912

    RSI-Anything: Unlocking Recursive Self-Improvement with World Models

    Proposes RSI-Anything, which uses a world model to select candidates and retain policy updates.

    arXiv
    2610.13912
    Published
    Layer
    Application layer
    Setting
    coding agent, Browser and computer use
    Evaluated models
    ReasonFlux-Coder-7B, 4B policy, W1
    AbstractRSI-Anything integrates world models into recursive self-improvement through prediction, feedback, and retention checks, and reports gains across multiple domains.

    RSI-Anything is a cross-domain framework: it uses world model predictions to decide which candidates to take external feedback for, then uses the feedback to decide whether the policy, workflow, or predictor is updated, and uses checks to decide which pair is retained. The difficulty to address is the limited interaction budget, and the fact that once the policy changes, the candidate distribution faced by the predictor also changes. The authors argue that improving only one side does not guarantee that the assembled system will be better.

    Paper analysisRead analysis
  5. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2610.13710

    OpenSocialJax: Evaluating Social Adaptation in Sequential Social Dilemmas with Open-Ended Environment Dynamics

    Evaluating multi-agent adaptation in social dilemmas with hidden rules using OpenSocialJax

    arXiv
    2610.13710
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    GPT-6-Luna, GPT-6-Sol, Claude Opus 5.5 and others8
    AbstractThe authors report that rule discovery often improves payoffs, but public good cleaning becomes concentrated, and shared resources are eventually depleted.

    OpenSocialJax evaluates whether LLMs can simultaneously adapt to unfamiliar environmental mechanisms and other agents in sequential social dilemmas.

    Paper analysisRead analysis
  8. OtherarXiv 2610.13491

    EviRepair: Evidence-Driven Agents for Reliable Vulnerability Repair

    Proposing EviRepair, an evidence-driven multi-agent framework for repository-level vulnerability repair

    arXiv
    2610.13491
    Published
    Layer
    Application layer
    Setting
    coding agent, Multi-agent systems
    Evaluated models
    DeepSeek-V4.1-Flash, GLM-5.2, Qwen3.8-27B
    AbstractEviRepair uses a reviewed vulnerability model for repository-level repair.

    EviRepair is a repository-level automated vulnerability repair framework for sparse vulnerability reports, using a reviewed vulnerability model to separate diagnosis from patch synthesis.

    Paper analysisRead analysis
  9. OtherarXiv 2610.13479

    A local agentic AI framework generates edge-case scenarios for safety assurance

    Proposes a local dual-model closed loop to generate edge scenarios for autonomous system safety assurance

    arXiv
    2610.13479
    Published
    Layer
    Application layer
    Setting
    LLM applications, Embodied systems and robotics
    Evaluated models
    PPO
    AbstractLocal closed-loop generation of JSON edge cases.

    The authors built a local agentic loop that runs on a laptop to generate edge cases for safety arguments of autonomous systems, rather than releasing a new public test set.

    Paper analysisRead analysis
  11. OtherarXiv 2610.13372

    Toward Safe World Models: Risks, Defenses, and Evaluation

    A survey of risks, defenses, and evaluation in the six-stage lifecycle of world models

    arXiv
    2610.13372
    Published
    Layer
    Application layer
    Setting
    Embodied systems and robotics
    AbstractSafety is written as a property of the prediction-decision closed loop; claims must be linked to observed consequences and versions.

    World model safety is organized by the nature of the prediction-decision loop, not by isolated prediction scores.

    Paper analysisRead analysis
  13. DefensesarXiv 2610.13333

    LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

    Proposes LETHE, which perturbs reference images to block unauthorized image-to-video

    arXiv
    2610.13333
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
    AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.

    LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.

    Paper analysisRead analysis
  16. InterpretabilityarXiv 2610.13078

    Attention sees, MLP refuses: tracing the safety pathway from attention to MLP in LLMs

    Trace attention to identify harmfulness to the MLP refusal write pathway and propose Sentinel

    arXiv
    2610.13078
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Qwen3-8B-Instruct and others18
    AbstractAttention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.

    The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.

    Paper analysisRead analysis
  17. Analysis and theoryarXiv 2610.13051

    Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

    Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining

    arXiv
    2610.13051
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-32
    AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.

    The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.

    Paper analysisRead analysis
  18. InterpretabilityarXiv 2610.12989

    GPT-2-Small, Gemma-2-2B, and Llama-3.1-8B have interpretable narrative mechanisms

    Using NVC to locate and ablate narrative-related components in language models

    arXiv
    2610.12989
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    GPT-2-Small-124M, Gemma-2-2B, Llama-3.1-8B
    AbstractNeurons and SAE features related to narrativity across three models, when ablated, changed some narrative-related behaviors.

    The authors connect a three-dimensional definition from narratology to mechanistic interventions, examining whether components related to narrativity in pretrained language models participate in prediction, generation, and downstream tasks.

    Paper analysisRead analysis
  19. OtherarXiv 2610.12924

    Sparse dictionary learning for measure-valued data based on linearized optimal transport: efficient algorithms and sample complexity

    Propose LWDL, a measure sparse dictionary learning method under linearized optimal transport

    arXiv
    2610.12924
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    AbstractLWDL learns sparse measurement dictionaries in flat embedding spaces.

    LWDL embeds probability measures into a Hilbert space, then performs sparse dictionary learning.

    Paper analysisRead analysis
  20. InterpretabilityarXiv 2610.12842

    Neural networks are more modular than single neurons suggest

    Using a three-level nested decomposition to test whether mixed-selectivity networks can be functionally separated on subspaces

    arXiv
    2610.12842
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Pythia 410M, Pythia 160M, GPT-2 XL and others18
    AbstractUnit non-specialization and subspace separability can coexist.

    The authors propose a nested definition of modularity to separate "neurons not being specialized" from "computation not being separable."

    Paper analysisRead analysis
Load more