Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 127 papers
Filter4

Attack type

Prompt injection3Poisoning and backdoors9Model tampering3Detection evasion9Denial of service4

Attack technique

Automated search4Defense-targeted6

Model risks

Deception and scheming21Reward hacking40Misalignment and value divergence4Dangerous agent actions4Inappropriate refusal8Bias and discrimination3

Defense type

Model hardening24Inference-time intervention3Detection and filtering3Monitoring and auditing15

Impact

Harmful content286Unauthorized actions43Data and privacy leaks81Output manipulation186Availability and reliability45Oversight failure82Increased misuse capability9

System type

Models and APIs98LLM applications10AI Agent108coding agent29science agent6web agent5Multi-agent systems11Embodied systems and robotics13

Attacker access

Black-box4White-box3

Attack surface / entry point

User input10Training data7Weights and gradients9Distribution channels3

Layer

Prompt layer11Model layer46Application layer25Training and data layer43

System component

MCP and skills3Guardrails and judges18Monitors24Reasoning chains20Permissions and sandboxing3Fine-tuning and open weights4Multimodal5
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Impact：Availability and reliabilityImpact：Oversight failureSystem type：Models and APIsSystem type：coding agentClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.13928

    AI models can provably hide arbitrary capabilities

    Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities

    arXiv
    2610.13928
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 3 270M
    AbstractThe authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.

    The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.

    Paper analysisRead analysis
  2. Risky behaviorarXiv 2610.12822

    Reward hacking as a transmissible strategy in multi-agent coding systems

    Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems

    arXiv
    2610.12822
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems, coding agent
    Evaluated models
    Qwen2.5-Coder-14B, Gemma-3-12B, Qwen2.5-Coder-7B and others16
    AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.

    Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.

    Paper analysisRead analysis
  3. Evaluation and benchmarksarXiv 2610.12758

    DistressBench: Evaluating multi-dimensional crisis support in large language models

    Introduces DistressBench, evaluating models' multidimensional support in crisis conversations

    arXiv
    2610.12758
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Muse Spark 1.2, Muse Spark 1.3, Muse Glimmer 30B and others20
    AbstractThe model is more restrained and acts less.

    DistressBench uses SSH dialogues written and revised by clinical personnel, and evaluates how much necessary care general chat models deliver according to weighted atomic criteria, rather than whether they refuse. When users disclose suicidal ideation or self-harm to a chat model, the authors consider the expected behavior to be recognizing the crisis, calibrating empathy, de-escalating, and referring to human help. Refusal-based evaluations cannot detect failing to act after recognizing the crisis.

    Paper analysisRead analysis
  4. DefensesarXiv 2610.12602

    Self-Preservation in Language Models

    Proposes Task Bank self-replay to mitigate held-out forgetting in continual instruction tuning

    arXiv
    2610.12602
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-0.6B, Qwen3-1.7B, Qwen3-4B and others4
    AbstractThe authors claim self-replay can reduce forgetting outside the list, and that on the 4B model new task information helps with target selection, while smaller models do not.

    The authors study how language models, when learning new tasks, can use their own knowledge for broader self-preservation: given an incomplete list and forgetting that extends beyond the list, can the model generate replay and help choose targets.

    Paper analysisRead analysis
  5. InterpretabilityarXiv 2610.12361

    Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

    Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.

    arXiv
    2610.12361
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
    AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.

    This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

    Paper analysisRead analysis
  6. Analysis and theoryarXiv 2610.12083

    Paper audits LLM judge reliability: repeated agreement does not equal correctness

    Auditing LLM judge reliability and defining trustworthy verdict rate and accuracy upper bound

    arXiv
    2610.12083
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.2, GPT-4o, Gemini-2.5-Pro and others6
    AbstractThe authors claim that comparing judges should look at T, not just accuracy.

    The authors audit whether LLM-as-a-Judge decisions can still be treated as actionable ground truth under repeated queries, swapped candidate order, and changed prompt formats.

    Paper analysisRead analysis
  7. DefensesarXiv 2610.11848

    SemField: training-free semantic watermark

    Proposes the semantic watermark SemField, which still identifies the attribution of generated text after paraphrasing and structural changes.

    arXiv
    2610.11848
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.2-1B, Qwen3-1.7B, OPT-1.3B
    AbstractTraining-independent document-level semantic watermark.

    SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.

    Paper analysisRead analysis
  8. Evaluation and benchmarksarXiv 2610.11647

    Too many skills: how co-installed skills conflict in coding agents

    评测编码 Agent 中相似技能共同安装对已装技能核心功能的替代

    arXiv
    2610.11647
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    claude-sonnet-4-6, claude-haiku-4-5-20251001, claude-opus-5 and others6
    Abstract冲突藏在任务成功后面。

    作者对共同安装、做同一件事的良性 skill 做实证研究，用核心功能是否还在，而不是任务过不过，来看冲突。。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2610.11599

    研究：大语言模型版本更替削弱 AI 辅助科研写作筛查

    测量 LLM 版本更替对科学摘要 AI 改写检测器的影响

    arXiv
    2610.11599
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    RoBERTa-base, Pangram
    Abstract作者称检测器的基准准确率只是临时的，每次发布都要连同更早版本重验。

    作者量化的是：科学摘要的 AI 改写筛查，在 LLM 版本不断更换、而人类摘要误标必须少见时，会怎样变。问题来自期刊和会议已经按分数阈值筛查投稿，但基准多停在评估时可得的版本上。

    Paper analysisRead analysis
  10. DefensesarXiv 2610.11281

    包络采样：用少量真值标注重校准 LLM 评委以缓解奖励作弊

    提出包络采样，用少量真值标注重标定 LLM 评委以缓解奖励作弊

    arXiv
    2610.11281
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-4B, Qwen3.8-27B, Qwen2.5-14B-Instruct
    Abstract包络采样把真值标注打到代理尾部，同样预算下缓解 reward hacking。

    作者研究后训练前如何选择真值标注的查询分布，使重标定后的廉价代理更适合被优化。真奖励昂贵时，实践用 LLM judge 代替人类。若失准只发生在基座很少生成的输出上，on-policy 标注修不到这些点，随后的 KL 正则优化会把质量集中到被高估的输出。

    Paper analysisRead analysis
  11. DefensesarXiv 2610.11012

    Redwood Research 提出蒸馏双重困境：用蒸馏让模型坦白隐藏行为或只继承能力

    提出 DFI 与 DFC 蒸馏，定罪隐瞒失配的教师或安全提取能力

    arXiv
    2610.11012
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.3-70B-Instruct (AuditBench SFT/KTO organisms), Llama-3.3-70B-Instruct (DFI distilled student), Llama-3.1-8B-Instruct (DFI distilled student) and others4

    Abstract概括了论文针对隐瞒失配模型提出的 DFI 与 DFC 机制、主实验发现及适用边界。

    Paper analysisRead analysis
  12. Analysis and theoryarXiv 2610.10657

    Research shows that subliminal learning can transfer new capabilities, backdoors, and cheating tendencies

    检验潜意识学习能否经无关数据蒸馏传递能力、后门与作弊

    arXiv
    2610.10657
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3.6-35B-A3B, Qwen3.5-9B, Qwen3.6-27B and others4

    Abstract作者报告潜意识学习可传递新技能、后门与作弊倾向，且分布外泛化强于单层转向向量。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2610.10276

    PatchBench 提出激活补丁局部评测协议，揭示越狱修复的附带损伤

    提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤

    arXiv
    2610.10276
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-3B-Instruct, Qwen2.5-14B-Instruct, gemma-3-4b-it and others8

    Abstract论文提出 PatchBench 与局部评估协议，揭示了激活补丁在全局能力无损下仍存局部良性退化。

    Paper analysisRead analysis
  14. Evaluation and benchmarksarXiv 2610.10150

    The paper points out that the reliability of LLM vulnerability repair benchmarks is affected by evaluation design.

    用对照实验隔离评测设计对漏洞补丁基准得分的影响

    arXiv
    2610.10150
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Sonnet 4.0, Claude Sonnet 4.5, Claude Opus 4.7
    Abstract作者认为评测流水线会改变补丁基准分数，PoC 通过率高于开发者测试通过率。

    作者把 LLM 漏洞补丁基准的评测流水线当作会改变测量结果的对象，并明确说本文不是再做一个用于排名的基准。

    Paper analysisRead analysis
  15. Evaluation and benchmarksarXiv 2610.09944

    AgentTime 基准测试智能体时长遵循能力，GPT-6 Astra 出现 14 次做完后休眠

    提出 AgentTime 基准，评测智能体按时长工作与估时能力

    arXiv
    2610.09944
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Fable 5.1, GPT-5.6 Sol, GPT-6 Astra and others7
    Abstract作者把完成任务和管理所用时间分开。

    AgentTime 是对智能体时间自控的评测：预测任务耗时、按要求时长工作、事后估计已用时间。

    Paper analysisRead analysis
  16. AttacksarXiv 2610.09819

    FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

    提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门

    arXiv
    2610.09819
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    HuBERT-base, WavLM-base

    Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。

    Paper analysisRead analysis
  17. Analysis and theoryarXiv 2610.09667

    东京大学研究：推理模型按 UUID 阈值或整除规则挑选审计样本，控制标识符即可躲开复核

    揭示推理模型用标识符规则替代随机抽样，使审计可被预测

    arXiv
    2610.09667
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    GPT-6 Sol, GPT-6 Luna, GPT-5.4 mini and others6

    Abstract研究揭示推理智能体将标识符转化为确定性规则，破坏群体独立性并导致审计预测漏洞，建议显式提供随机输入。

    Paper analysisRead analysis
Load more