Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 COBRA 双 LLM 架构，防御计算机使用 Agent 的分支转向攻击
Published Oct 2
Evaluated models gpt-5 , UI-TARS-1.5-7B , claude-sonnet-5 and others6 Abstract 提出分支转向防御架构 COBRA，通过事前能力约束与边界代理消除分支转向攻击并兼顾效用。
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
Published Oct 1
Evaluated models Claude Sonnet 4.6 , GPT-5.5 , GLM-5.2 and others4 提出 UBA-ORL，以 BD/CM 样本在遗忘后激活离线 RL 后门
Published Sep 19
Evaluated models TD3+BC , BCQ , IQL Abstract UBA-ORL 用竞争的 BD/CM 样本，使离线 RL 后门在删除伪装轨迹后激活。UBA-ORL 研究离线强化学习中由合规轨迹删除激活的后门：合法贡献者同时上传共享触发的后门轨迹和伪装轨迹，训练后触发响应被压低，删除伪装批次后再升高。受害系统是使用静态数据集和轨迹级遗忘接口的离线 RL 服务。对手不能看到训练算法、参数、梯度或具体遗忘算法，但能提交可区分批次，并在部署时向观测注入预定触发。
提出 S³，用 guard agent 编排阶段安全技能防御智能体多阶段风险
Published Aug 3
Evaluated models DeepSeek-V4-Pro , DeepSeek-V4-Flash 提出 VPH 与 VTH，只改视频帧劫持世界模型并投毒下游策略
Published Jun 8
Evaluated models Cosmos-Predict 2.5 , Cosmos-Predict 2.5 AC , Dino WM and others4 Abstract 只改视频帧经世界模型投毒。只改看似安全的视频帧，经世界模型之后才改变下游机器人策略。 问题在于世界模型进入数据生成后，数据集检查看到的仍是安全演示，合成轨迹却可以变危险。
Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA
Published Apr 5
Evaluated models Llama-3.1-8B-Instruct , Gemma-2-9B-IT , DeepSeek-R1-Distill-Llama-8B and others4 Proposes out-of-process dual-channel comparison classification to intercept erroneous clicks by computer-use agents
Published Mar 16
Evaluated models multi-modal-embed-small Abstract Perception errors can be exploited by swapping screen pixels.The authors frame CUA's perception failure as a security vulnerability, visual confused deputy : the agent authorizes click(x,y) based on a misread screen, and the actual landing point differs from the element it believes it is clicking.
用 MobiRed 评测移动 LLM Agent 面对第三方渠道的提示注入
Published Oct 31, 2025
Evaluated models Mobile-Agent-E , AppAgent , AutoGLM and others8 Abstract 论文评估了移动 LLM 智能体作为 confused deputy 的易受攻击性，作者称非应用控制通道可诱导智能体执行多步越权危害。
You have reached the end