Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 203 papers
Filter3

Attack type

Jailbreaks5Prompt injection34Poisoning and backdoors26Extraction and theft11Detection evasion16Malicious use4

Attack technique

Gradient and representation optimization13Automated search14Encoding and obfuscation9Role-play and persuasion6Conversation structure manipulation3Cross-modal payloads7Dormant triggers7

Model risks

Reward hacking6Misalignment and value divergence3Dangerous agent actions16Inappropriate refusal3Hallucination and fabrication8

Defense type

Model hardening11Inference-time intervention7Detection and filtering23Instruction–data separation8Permissions and approval6Monitoring and auditing9

Impact

Harmful content11Unauthorized actions25Data and privacy leaks15Output manipulation77Availability and reliability16Oversight failure8

System type

Models and APIs879LLM applications139AI Agent660coding agent139science agent32web agent34Browser and computer use19Multi-agent systems80Embodied systems and robotics47

Attacker access

Black-box19White-box3

Attack surface / entry point

User input37Web pages and interfaces14Documents and messages19Tool responses6Code repositories and dependencies3Retrieval corpus24Images, audio and video18Training data4Weights and gradients3Distribution channels3Inference services and hardware3

Layer

Prompt layer12Model layer16Application layer158Training and data layer15

System component

MCP and skills5Memory4RAG41Guardrails and judges44Monitors10Reasoning chains3Permissions and sandboxing4Fine-tuning and open weights3Vision26Audio3Image generation3Embeddings9Multimodal32
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
System type：LLM applicationsSystem type：Browser and computer useSystem type：Embodied systems and roboticsClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. OtherarXiv 2610.13912

    RSI-Anything: Unlocking Recursive Self-Improvement with World Models

    Proposes RSI-Anything, which uses a world model to select candidates and retain policy updates.

    arXiv
    2610.13912
    Published
    Layer
    Application layer
    Setting
    coding agent, Browser and computer use
    Evaluated models
    ReasonFlux-Coder-7B, 4B policy, W1
    AbstractRSI-Anything integrates world models into recursive self-improvement through prediction, feedback, and retention checks, and reports gains across multiple domains.

    RSI-Anything is a cross-domain framework: it uses world model predictions to decide which candidates to take external feedback for, then uses the feedback to decide whether the policy, workflow, or predictor is updated, and uses checks to decide which pair is retained. The difficulty to address is the limited interaction budget, and the fact that once the policy changes, the candidate distribution faced by the predictor also changes. The authors argue that improving only one side does not guarantee that the assembled system will be better.

    Paper analysisRead analysis
  2. OtherarXiv 2610.13810

    Using subsequence association filtering and breadth-aware selection to suppress hallucinated words in LLM query expansion

    Proposes SAFE-QE, which filters unsupported hallucinated words in LLM query expansion

    arXiv
    2610.13810
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    BM25, SPLADE, Contriever

    AbstractSAFE-QE suppresses expansion hallucinations with reproducibility and coverage selection; the authors say ranking quality shows no visible cost.

    Paper analysisRead analysis
  3. OtherarXiv 2610.13479

    A local agentic AI framework generates edge-case scenarios for safety assurance

    Proposes a local dual-model closed loop to generate edge scenarios for autonomous system safety assurance

    arXiv
    2610.13479
    Published
    Layer
    Application layer
    Setting
    LLM applications, Embodied systems and robotics
    Evaluated models
    PPO
    AbstractLocal closed-loop generation of JSON edge cases.

    The authors built a local agentic loop that runs on a laptop to generate edge cases for safety arguments of autonomous systems, rather than releasing a new public test set.

    Paper analysisRead analysis
  5. OtherarXiv 2610.13372

    Toward Safe World Models: Risks, Defenses, and Evaluation

    A survey of risks, defenses, and evaluation in the six-stage lifecycle of world models

    arXiv
    2610.13372
    Published
    Layer
    Application layer
    Setting
    Embodied systems and robotics
    AbstractSafety is written as a property of the prediction-decision closed loop; claims must be linked to observed consequences and versions.

    World model safety is organized by the nature of the prediction-decision loop, not by isolated prediction scores.

    Paper analysisRead analysis
  6. DefensesarXiv 2610.12432

    FAITH: A feasibility-aware safety filtering reinforcement learning framework for high-dimensional systems

    Proposes the FAITH safe filtering reinforcement learning framework, training high-dimensional systems to optimize task reward under constraints

    arXiv
    2610.12432
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    AbstractFAITH separates safety filtering from reward optimization.

    FAITH is a model-free safe filtering reinforcement learning framework for high-dimensional systems: safety correction and task reward reside in separate modules.

    Paper analysisRead analysis
  8. AttacksarXiv 2610.12292

    The paper proposes an option channel attack: changing one option label can make an agent guardrail allow a prohibited operation

    Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations

    arXiv
    2610.12292
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Attacker
    Black-box
    Evaluated models
    LAYA-TD, LAYA-EN, LAYA-ML and others5

    AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.

    Paper analysisRead analysis
  11. AttacksarXiv 2610.11932

    A Fudan team measures the citation fragility of AI search: ordinary posts can enter citations and answer text

    Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.

    arXiv
    2610.11932
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Grok, Doubao, ChatGPT and others10

    AbstractThe authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.

    Paper analysisRead analysis
  12. DefensesarXiv 2610.11634

    LTBD：用可学习信任边界分隔符防御提示注入

    提出 LTBD，用可学习分隔符隔离可信指令与不可信数据

    arXiv
    2610.11634
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Llama3-8B-Instruct, Llama3.1-8B-Instruct, Falcon3-7B-Instruct and others4
    AbstractLTBD 只训练四个分隔符嵌入。

    LTBD 是一种不改基座权重的提示注入防御：只学习用来标出可信指令与不可信数据边界的四个 token 嵌入。

    Paper analysisRead analysis
  16. AttacksarXiv 2610.09981

    研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题

    提出利用路由元数据推断敏感话题的侧信道攻击

    arXiv
    2610.09981
    Published
    Layer
    Infrastructure layer
    Setting
    LLM applications
    Evaluated models
    RouteLLM (BERT router), notdiamond-0001, Vela (vLLM Semantic Router)

    Abstract论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。

    Paper analysisRead analysis
  19. Analysis and theoryarXiv 2610.09517

    审计发现 CLIP 安全分数主要反映画面与提示词场景的相似度

    开环审计冻结视觉语言安全分，发现其反映场景模板而非危险感知

    arXiv
    2610.09517
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    CLIP ViT-B/32, CLIP ViT-L/14, Qwen2-VL-7B
    Abstract论文审计了冻结 VLM 安全评分机制，指出其反映场景模板而非危险感知，为安全强化学习评估提供了严谨基准。

    本文是一项针对安全强化学习中冻结视觉语言模型（VLM）安全评分机制的实证审计研究。

    Paper analysisRead analysis
  20. DefensesarXiv 2610.09496

    SOUL：用稀疏特征策略遗忘缓解 VLA 模型的状态幻觉

    提出 SOUL 稀疏特征策略遗忘，缓解 VLA 状态幻觉

    arXiv
    2610.09496
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA, π0.5
    AbstractSOUL 以稀疏特征遗忘 VLA 状态幻觉。

    SOUL用稀疏特征引导的策略 unlearning 处理 VLA 的 state hallucination。

    Paper analysisRead analysis
Load more