Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Impact：Data and privacy leaks System type：Models and APIs System type：coding agent System type：Multi-agent systems Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.11773Oct 8
研究提出 Agent 安全新维度：识别未履行的安全义务
提出义务识别基准 ObligationBench，并训练护栏识别 Agent 未履行的安全义务
arXiv
2610.11773
Published
Oct 8
Layer
Application layer
Setting
coding agent
Evaluated models
ObligationGuard, Claude-Opus-4.8, GPT-5.6-Sol and others17
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
Abstract义务是护栏缺口。
作者认为编码智能体的安全不能只靠拦截禁止动作，还要找出终止时仍未做的安全关键动作，并将其称为义务。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.02986Oct 2
OLMo-Detect：面向 LLM 成员推断的多阶段混淆控制基准
提出基准 OLMo-Detect 评测 LLM 成员推断
arXiv
2610.02986
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
OLMo 2 1B, OLMo 2 7B, OLMo 2 13B and others9
- AttacksExtraction and theft
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.40286Oct 1
研究者提出 COVER：在语言预算下选择源语言实现跨语言遗忘
提出 COVER，在语言预算下选择源语言实现跨语言知识遗忘
arXiv
2609.40286
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Tiny Aya Global, Qwen3-4B-Instruct-2507, Llama-3.2-3B-Instruct
- DefensesModel hardening
- AttacksExtraction and theft
AbstractCOVER 在语言预算下选源语言，以降低未监督语言上相对 oracle 的残余访问。
语言预算下的多语言遗忘：遗忘监督只放在 K 种源语言上，目标是降低其余语言对同一事实的残余访问，而不是把每种评测语言都译成监督数据。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.00392Sep 30
A2A-TIBA：针对 A2A 协议 LLM 智能体的间接提示注入攻击与三层同构攻防模型
提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调
arXiv
2610.00392
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
MiniMax-M3, deepseek-v4-pro, glm-5.3 and others8
- AttacksPrompt injection
- TechniqueMulti-turn escalation
- ComponentMCP and skills
AbstractA2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。
A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35557Sep 29
论文：容器、权限规则与沙箱都无法区分读取研究代码的是编译器还是编码 Agent
评测容器、权限规则与沙箱能否区分编译器与编码 Agent 的文件读取
arXiv
2609.35557
Published
Sep 29
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract此 harness 表达不了编译器可读而智能体不可读，五条路径两边都不覆盖。
作者在物理流求解器上检查一套编码智能体配置：编译器必须读本组材料与反应模型，这些字节又不得进入模型上下文或离开本机的记录。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34092Sep 28
机器遗忘在 ASR 中是否有效：arXiv 论文评估现有算法与评测工具
arXiv
2609.34092
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
E-Branchformer
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentAudio
Abstract梯度上升类方法更接近简单评测下的重训参照，复杂方法会被知情攻击认出，多说话人更差。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33481Sep 27
IDUnlearn-Bench：面向视觉语言模型的个体级遗忘基准
提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留
arXiv
2609.33481
Published
Sep 27
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others6
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentVision
AbstractIDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。
IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.30094Sep 25
PrivDrift：审计活跃 LLM 对话中话题漂移下的用户秘密泄露
提出 PrivDrift 基准，审计话题漂移后的用户秘密复述
arXiv
2609.30094
Published
Sep 25
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-OSS-120B, DeepSeek-R1, Qwen3-VL-235B
- AttacksExtraction and theft
- TechniqueRole-play and persuasion
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.08256Sep 8
ACEA：面向红蓝队对抗的 LLM 协同演化测试平台
提出红蓝对抗评测平台 ACEA，分开计量攻击强度与防御效果
arXiv
2609.08256
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
openai/gpt-4o, google/gemini-2.5-pro, google/gemma-3-27b-it and others5
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractACEA 用 ASAP 让红蓝对同一目标对打。
ACEA 是让可插拔红队和蓝队共享一个目标 LLM 的对打场地，把攻击强度和防御效果分开记分。作者要补三处空缺：双方只能对着固定对手分开练。LLM judge 分不清真实泄露和幻觉，拦截后又看不到攻击有多强。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2607.14611Jul 16
论文评测 Claude Code 与 Codex 记忆文件中的提示注入风险
评测编码 Agent 记忆文件中提示注入的跨会话影响
arXiv
2607.14611
Published
Jul 16
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2 and others4
- AttacksPoisoning and backdoors
- ComponentMemory
Abstract已植入记忆文件的载荷可以跨会话影响 Claude Code 与 Codex，攻击成功与载荷是否留下是两种不同的失败。
Bad Memory 在沙箱合成工作区里评测文件型持久记忆上的提示注入，比较载荷能否改变当前会话，以及能否在后续会话中留下或叠加。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.05647Jun 4
Study: 94% of developers failed to detect covert sabotage by coding agents
评测开发者能否在协作编程中发现编码 Agent 的隐蔽破坏
arXiv
2606.05647
Published
Jun 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude-Opus-4.6, GPT-5.4, Gemini-3.1-Pro and others5
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.24765May 24
CyberMaskQA：面向网络安全问答的大语言模型隐私感知基准
提出隐私感知基准 CyberMaskQA，评测网络安全问答与敏感实体掩码
arXiv
2605.24765
Published
May 24
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, InternLM3-8B-Instruct, Mistral-3-8B-Instruct and others4
AbstractCyberMaskQA 联合评测带上下文的网安问答与掩码。
作者构建隐私感知网安问答基准 CyberMaskQA，用来同时看依赖组织上下文的选择题推理，以及敏感实体掩码。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.17380May 17
Uber proposes ADR enterprise-level agent detection system, deployed on 7,200 hosts for ten months
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
arXiv
2605.17380
Published
May 17
Layer
Application layer
Setting
coding agent
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentMCP and skills
Abstract提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.14859May 14
论文提出 AuthBench 基准，评测编码 Agent 能否推断最小权限边界
提出 AuthBench 评测编码 Agent 最小权限，并验证充足性-紧缩性分解
arXiv
2605.14859
Published
May 14
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5, GPT-5.3-Codex, GPT-5.4 and others9
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract论文提出权限边界推断基准与两阶段分解方法，有效降低安全暴露。
本文研究代码智能体在执行终端任务前自主推断最小文件权限边界的能力。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2603.05618Mar 6
Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in Large Language Models
测量思维链将提示中 PII 复述进轨迹的泄漏并评测轻量检测器
arXiv
2603.05618
Published
Mar 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama 3.3:70B, Claude Opus, Mixtral 8×22B and others7
- DefensesDetection and filtering
- ComponentReasoning chains
Abstract作者称 CoT 抬高逐字泄漏且随模型与预算而变，检测器也需按模型选择。
在“不要复述 PII”的输出策略下，本文用 black-box 协议测量提示词中的 PII 被写回 CoT 与答案的情况，并比较轻量 gatekeeper。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop