Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
Another 227 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
Published Oct 7
Evaluated models LLaVA-v1.5-13B , LLaVA-v1.6-34B , MiniCPM-o-8B and others6 Abstract 论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
Published Sep 28
Evaluated models GPT-5.6-sol , Kimi-K2.6 , Kimi-K3 and others6 Abstract 论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
提出 TRUSTFORK 基准，评测展示身份劫持多智能体编排权限
Published Sep 26
Evaluated models GPT-5.6-Sol , GPT-5.6-Luna , Kimi-K3 and others8 Abstract 论文提出了多智能体安全基准 TRUSTFORK，揭示展示身份如何劫持操作权威，并证明事后验证无法弥补已发生的执行破坏。
提出 PMPA，经外部源向 Agent 持久记忆投毒并跨会话泄露隐私
Published Sep 12
Evaluated models DeepSeek-V4-Flash , DeepSeek-V4-Pro , Qwen3-Max Abstract 论文提出了持久记忆投毒攻击 PMPA，报告了 harness 智能体在处理外部数据时易受跨会话记忆投毒与隐私泄露的风险。
提出 Skill-as-API，隔离多智能体协作中的 skill 正文与系统提示词
Published Sep 1 Abstract 协议把 skill 正文留在所有者侧，四层限制发现内容、权限期限和注入拼接。Skill-as-API 是面向智能体软件工程的协调协议，用来在跨组织调用时把 skill 的代码和系统提示词留在所有者进程。作者针对三条威胁：经通道或命名空间抽取专有方法，用注入让被调用模型输出系统提示词，以及协作结束后权限继续保留。
Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases
Published Mar 17
Evaluated models LLaVA-v1.5-7B , Qwen2.5-VL-7B Abstract The authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.
提出 WAInjectBench 评测网页 Agent 的提示注入检测
Published Oct 2, 2025
Evaluated models GPT-4o , Mistral-7B-Instruct-v0.1 , Llama-Prompt-Guard-2-86M and others8 Abstract WAInjectBench 比较网页智能体的提示注入检测：显式线索可被部分检出，隐蔽攻击大多漏检。WAInjectBench 是网页智能体提示注入检测的基准。作者要看现有检测器能否发现这类攻击：攻击者改网页，使智能体执行目标动作，而不是用户任务。作者称这是首个此类综合基准。
Attacks arXiv 2406.12814 · Jun 19, 2024 提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
Published Jun 19, 2024
Evaluated models GPT-4o , GPT-4V , Claude-3-Opus and others4 Abstract 系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
You have reached the end