Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 14 papers Another 203 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
Published Oct 1
Evaluated models Claude Sonnet 4.6 , GPT-5.5 , GLM-5.2 and others4 提出只训练或篡改多智能体潜在通信链路来提高有害遵从
Published Sep 30
Evaluated models Llama-3.2-3B-Instruct , Qwen2.5-3B-Instruct , Gemma-3-1B-IT and others7 Abstract 潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。 。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
提出 MADBench，评测多智能体辩论是吸收还是放大对抗影响
Published Sep 30
Evaluated models gpt-4o , GPT-5 , GPT-6 Astra Abstract MADBench 显示辩论能吸收部分准确率攻击，同时放大未授权读写。MADBench 是一个评测多智能体辩论安全性的基准，用来看攻击是被辩论吸收还是被放大。
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
Published Sep 29
Evaluated models AgentCF , AgentSEQ , AgentRAG and others4 Abstract 作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
用 DIBench 评测移动 GUI 智能体被 UI 注入后的决策完整性
Published Sep 29
Evaluated models Qwen2.5-VL(32B) , Qwen3-VL(32B) , GUI-Owl(32B) and others7 Abstract 论文提出移动智能体决策完整性基准 DIBench，发现欺诈 UI 注入诱导目标选择并推高完成率，通用防御收益不稳定。
提出双控多智能体基准 DUMA-Bench，测量对抗环境下的策略违反
Published Sep 21
Evaluated models GPT-5 , GPT-5-mini , GPT-5-nano and others14 Abstract DUMA-Bench 用双控交互评测智能体安全。DUMA-Bench 把 τ²-bench 的双控交互做成智能体安全评测，用来看策略违反如何随用户、模型和环境一起出现。
提出多智能体系统提示注入的威胁模型与四层架构防御
Published Sep 19
Evaluated models GPT-4o (2024-08-06) , Claude 3.5 Sonnet , Llama 3 70B-Instruct 提出 Emergence World，对长时程多智能体系统开展对抗压力测试
Published Sep 15
Evaluated models Claude Opus 4.8 , DeepSeek v4 Pro , Gemini 3.5 Flash and others9 Abstract 作者通过长期平行世界实验指出模型对齐不具备可组合性，单模型群体会产生社会奉承、协同退缩及语言不透明等失效。
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
Published Aug 7
Evaluated models Qwen3.5-9B , Llama-3.1-8B , Ministral-3-8B Abstract 论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
Proposes out-of-process dual-channel comparison classification to intercept erroneous clicks by computer-use agents
Published Mar 16
Evaluated models multi-modal-embed-small Abstract Perception errors can be exploited by swapping screen pixels.The authors frame CUA's perception failure as a security vulnerability, visual confused deputy : the agent authorizes click(x,y) based on a misread screen, and the actual landing point differs from the element it believes it is clicking.
Proposing a lineage-graph governance layer to suppress error cascades in multi-agent collaboration
Published Mar 4 Abstract A single seed can solidify into a false consensus along a fixed collaboration graph.The authors turn "small errors becoming collective false consensus" in LLM-MAS into a measurable propagation on a graph, and use a plug-in that only changes messages, not topology, to reduce the final infection.
提出 AgentLeak 基准，测量多智能体内部通道隐私泄露
Published Feb 12
Evaluated models GPT-4o , GPT-4o-mini , Claude-3.5-Sonnet and others5 Proposes Aura, which uses a trusted kernel to mediate the identity, perception, and action control of mobile agents
Published Feb 11
Evaluated models Gemini-3-Flash Abstract Aura mediates structured interactions via the Agent Kernel.Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants. .
用 MobiRed 评测移动 LLM Agent 面对第三方渠道的提示注入
Published Oct 31, 2025
Evaluated models Mobile-Agent-E , AppAgent , AutoGLM and others8 Abstract 论文评估了移动 LLM 智能体作为 confused deputy 的易受攻击性，作者称非应用控制通道可诱导智能体执行多步越权危害。
You have reached the end