Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

Defense type：Permissions and approval Defense type：Monitoring and auditing System type：Models and APIs System type：coding agent System type：web agent Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.11012Oct 8
Redwood Research proposes the distillation double bind: using distillation to make models confess hidden behavior or inherit only capabilities
提出 DFI 与 DFC 蒸馏，定罪隐瞒失配的教师或安全提取能力
arXiv
2610.11012
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.3-70B-Instruct (AuditBench SFT/KTO organisms), Llama-3.3-70B-Instruct (DFI distilled student), Llama-3.1-8B-Instruct (DFI distilled student) and others4
- DefensesMonitoring and auditing
- RiskDeception and scheming
Abstract概括了论文针对隐瞒失配模型提出的 DFI 与 DFC 机制、主实验发现及适用边界。
Paper analysisRead analysis
DefensesarXiv 2610.09167Oct 7
Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
arXiv
2610.09167
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。
Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。
Paper analysisRead analysis
DefensesarXiv 2610.07774Oct 6
研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器
AI summary研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。
arXiv
2610.07774
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-30B-A3B-Instruct, Kimi-VL-A3B-Instruct
- DefensesMonitoring and auditing
- RiskInappropriate refusal
- ComponentMonitors
Abstract读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。
作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06406Oct 5
AgentMonBench：面向长时程智能体行为监控的软件工程基准
提出 AgentMonBench 评测长时程编程智能体监控并检验 EBG
arXiv
2610.06406
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol and others8
- DefensesMonitoring and auditing
- RiskDangerous agent actions
- ComponentMonitors
AbstractAgentMonBench 评测后果性决策监控，EBG 组织证据。
长时程软件工程任务里，用户要判断智能体哪些选择值得核验。作者用 AgentMonBench 评测监控器，并用免训练的 EBG 组织带源证据。
Paper analysisRead analysis
DefensesarXiv 2610.05246Oct 4
研究测量策略网关跨平台命令裁决的能力边界
提出策略门裁决已实现动作，并测量跨平台命令拦截边界
arXiv
2610.05246
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
claude-opus-5, deepseek-v4.1-flash, gpt-6-astra
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.05241Oct 4
StateWise: Diagnosing and repairing persistent operation state before agent actions
Propose StateWise, which diagnoses and repairs invalid persistent state before coding agent actions
arXiv
2610.05241
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, DeepSeek v4 Pro, Qwen 3.7 Max and others4
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentMemory
AbstractStateWise repairs stale persistent premises before action.
StateWise is a framework that diagnoses and repairs the persistent operational state of coding agents before executing actions with side effects.
Paper analysisRead analysis
DefensesarXiv 2610.05163Oct 4
Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
arXiv
2610.05163
Published
Oct 4
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。
本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.02741Oct 2
研究系统评估循环语言模型的思维链可监控性
系统评估循环语言模型加深 loop 后的 CoT 可监控性
arXiv
2610.02741
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Ouro-1.4B-Thinking, Ouro-2.6B-Thinking, Nanbeige4.2-3B and others4
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentReasoning chains
Abstract加深 loop 可在部分压力测试任务降低可监测性，循环架构本身并不必然更难监测。
这项工作评估 LoopLM 的 CoT 可监测性：加深共享层的重复次数，以及“有循环结构”本身，会不会让决策关键因素更少出现在可监测文本里。
Paper analysisRead analysis
DefensesarXiv 2610.02557Oct 2
新 AI 辩论协议实现实例级最优：最坏情况正确且诚实为占优策略
提出 FBS Debate 协议，使诚实为占优策略且最坏情况正确
arXiv
2610.02557
Published
Oct 2
Layer
Training and data layer
Setting
Models and APIs
- DefensesMonitoring and auditing
- RiskDeception and scheming
AbstractFBS 辩论用 fbs 约束敏感分解，给出最坏情况占优策略，并匹配黑盒查询下界。
FBS Debate 是一套可扩展监督的辩论规则：两名计算方争论一个可递归分解的是非问题，人类只在最后选出的子问题上做黑盒判断。要处理的缺口是，prover-estimator debate 虽能覆盖稳定分解，但只在输入分布的平均意义下成立，而且 Bob 的获胜策略一般要跟着 Alice 的作弊策略变。作者要在同一问题类上，让每个错误实例都能被抓住，并让诚实且正确成为双方的占优策略。
Paper analysisRead analysis
DefensesarXiv 2610.02456Oct 2
SideKernel：面向 macOS 上 AI 编码 Agent 的 microVM 沙箱
为 macOS 编程 Agent 构建可用的 microVM 沙箱 SideKernel
arXiv
2610.02456
Published
Oct 2
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.02413Oct 2
研究：分类后缀可提升激活探针的分布外恶意输入检测
用分类后缀提升激活探针对分布外恶意输入的检测
arXiv
2610.02413
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。
用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
Paper analysisRead analysis
DefensesarXiv 2610.03055Oct 2
HackTrace: Detecting Reward Hacking in Code Generation with Generation-State Supervision
提出 HACKTRACE，用生成状态检测并抑制代码智能体奖励作弊
arXiv
2610.03055
Published
Oct 2
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen3-8B, Llama-3.1-8B-Instruct, Qwen3.5-4B
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentMonitors
Abstract论文提出利用生成状态监督作弊尝试的 HACKTRACE 框架，实现高精度低延迟检测并在 GRPO 训练中有效抑制奖励投机。
Paper analysisRead analysis
DefensesarXiv 2609.39548Sep 30
NDDL: Backdoor Defense for Text-to-Image Models with Normal Diffusion Dynamics
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
arXiv
2609.39548
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentImage generation
AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。
NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
Paper analysisRead analysis
DefensesarXiv 2609.38983Sep 30
The paper proposes an Approval Laundering taxonomy and empirically shows that Claude Code's approval and execution binding fails
形式化编程 Agent 的审批洗白并提出 HMAC 权能令牌防御
arXiv
2609.38983
Published
Sep 30
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (v2.1.197, opus[1m] / claude-sonnet-5-ccmax), Codex CLI (@openai/codex v0.154.0)
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract系统揭示编程智能体审批洗白风险，提出七字段权能防御机制，证实其能消除身份时序偏离但难防副作用偏离。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.37312Sep 29
研究：隐蔽推理必然留下信息痕迹，但思维链未必可读
分析隐蔽推理在思维链监控下的信息足迹下界与不可读性
arXiv
2609.37312
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Qwen 3.5 397B-A17B and others12
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract论文从理论与实证探明了思维链监控的边界：复杂隐蔽计算必然泄露信息足迹且需承担长度税，但该足迹可被在线加密而不可读。
Paper analysisRead analysis
DefensesarXiv 2609.36170Sep 29
Assay: Using Content-Addressed Evidence Graphs to Constrain Invalidation of AI Coding Agents' Claims
提出 Assay，用依赖锥哈希绑定代码断言并在合并门禁拦截失效声明
arXiv
2609.36170
Published
Sep 29
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- RiskDeception and scheming
- ComponentPermissions and sandboxing
AbstractAssay 提供随依赖内容失效的证据管理。
Assay 是一套面向 AI 辅助软件交付的内容寻址证据系统，关注代码改变后，测试通过、无秘密或行为保持等断言还能否用于批准合并。
Paper analysisRead analysis
DefensesarXiv 2609.35659Sep 29
Tracekit: A tamper-proof intent-reasoning-action audit system for autonomous coding agents
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
arXiv
2609.35659
Published
Sep 29
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
- DefensesMonitoring and auditing
- AttacksPrompt injection
- RiskDangerous agent actions
- ComponentMonitors
AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。
Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35557Sep 29
论文：容器、权限规则与沙箱都无法区分读取研究代码的是编译器还是编码 Agent
评测容器、权限规则与沙箱能否区分编译器与编码 Agent 的文件读取
arXiv
2609.35557
Published
Sep 29
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract此 harness 表达不了编译器可读而智能体不可读，五条路径两边都不覆盖。
作者在物理流求解器上检查一套编码智能体配置：编译器必须读本组材料与反应模型，这些字节又不得进入模型上下文或离开本机的记录。
Paper analysisRead analysis
DefensesarXiv 2609.30841Sep 25
为何扩散语言模型的越狱会成功：能量景观分析
用能量势垒信号检测扩散语言模型的越狱
arXiv
2609.30841
Published
Sep 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Instruct, LLaDA-1.5, Dream-v0-Instruct-7B and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract能量势垒把 dLLM 越狱分成掩盖初始状态或中途越垒，三个 logit 信号据此互补检测。
Bach 等提出用去噪能量景观解释 masked diffusion 语言模型上的越狱，并由此得到三个免训练检测信号。。
Paper analysisRead analysis
DefensesarXiv 2609.21996Sep 19
PIR：从模型内部激活读出被隐藏的答案
提出免参考探测 PIR，从激活读出被隐瞒答案并区分擦除
arXiv
2609.21996
Published
Sep 19
Layer
Model layer
Setting
Models and APIs
Evaluated models
gemma-2-9b, gemma-3-12b, Qwen2.5-7B and others9
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract论文提出免参考内部识别探测 PIR，划分了隐瞒与遗忘的边界，为评估沙盒审计与遗忘真实性提供了内部依据。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop