Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 15 papers Another 227 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报
Published Oct 5
Evaluated models DQN , Double DQN (DDQN) Abstract 轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。这项工作研究 DRL 上的迁移式黑盒观测攻击 ：受害参数不可访问时，在白盒代理上造扰动再迁移。
提出 memetic trojans，借助社交传染在 Agent 网络中传播对抗载荷
Published Oct 1
Evaluated models gpt-oss-120B , deepseek-v4.1-flash , qwen-32B and others5 Abstract memetic trojans 用内生社会传染携带载荷。Memetic trojans 是一类网络介导攻击：对抗载荷搭在智能体本来就会转发和点赞的内容上扩散，转发者不必被攻陷，也不必执行“请继续复制”的指令。
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
Published Sep 30
Evaluated models Llama-3.2-3B-Instruct , Qwen2.5-3B-Instruct , Gemma-3-1B-IT and others7 Abstract 潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。 。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
提出 A2A-TIBA，经 A2A 对等任务间接注入并植入常驻回调
Published Sep 30
Evaluated models MiniMax-M3 , deepseek-v4-pro , glm-5.3 and others8 Abstract A2A-TIBA 一次植入后绕过智能体，GDA 用四类结果定位防线，ELA-ITL 把信封标注列为第三层。A2A-TIBA 把间接提示注入和绕过放进 A2A：gray-box 攻击者已能投递任务，诱导目标部署常驻回调程序后，下令和外传不再经过智能体。
提出 VirusCascade，联合操纵商品描述与交互轨迹以劫持推荐智能体协同反思
Published Sep 29
Evaluated models AgentCF , AgentSEQ , AgentRAG and others4 Abstract 作者把反思写回视为推广攻击入口，并用联合操纵和诊断探针研究其持续与传播。VirusCascade 是针对推荐智能体协作反思的 black-box targeted promotion 攻击研究。 攻击者只改商品描述和少量账号的普通交互，试图让目标商品获得更多良性用户曝光。
提出多智能体流水线的边界攻击，使对抗内容作为可信输入跨层传播
Published Aug 1
Evaluated models GPT-5-mini , Claude Sonnet 4.5 , Kimi K2.5 Abstract 缺边界校验使对抗内容跨智能体传播，作者称这是架构属性而非模型能力。作者把多智能体 LLM 流水线的对抗问题定义为缺少边界校验，并用生产轨迹和受控实验检查脆弱性来自架构还是骨干模型。中间输出未经验证就传给下游。作者认为，一旦某级接受对抗内容，后续智能体会把它当作可信输入。
提出 MAStrike，用 Shapley 选联盟对多智能体做共谋红队
Published Jun 11
Evaluated models Claude Opus 4.7 , GPT-5.5 , Gemini 3.1 Pro 建模并利用多智能体网络中子智能体生成时的记忆继承漏洞
Published May 9
Evaluated models MiniMax M2.5 , Llama-4-Maverick-17B-128E-Instruct-FP8 , Qwen3.5-Plus and others5 Abstract 形式化子智能体继承，在 OpenClaw 上演示四类编排层漏洞并提出防御。作者对多智能体网络里的子智能体继承 做形式化分析，并用开源框架上的 PoC 演示编排层如何让单点妥协继续扩散。
提出利润驱动红队，用标量盈余搜索对手以压测经济博弈 Agent
Published Mar 22
Evaluated models GPT-OSS-120B , Qwen3-32B , MiniMax-M2.5 and others6 Abstract 利润驱动红队以标量盈余训练对手，六个目标在四博弈中被利用，提示规则可抬高目标盈余。利润驱动红队把可审计终局里的智能体安全写成对手搜索问题：固定目标会不会被一个只追逐自身盈余的自适应玩家利用。
Propose WebWeaver, which compromises only a single agent and recovers the multi-agent communication topology from conversation context.
Published Mar 12
Evaluated models Llama 3.1 8B , Qwen 2.5 7B , Mistral NeMo 12B and others6 Abstract WebWeaver infers topology from context.WebWeaver is an inference attack against the confidentiality of LLM-MAS communication topology: it controls only one arbitrary agent and recovers the full graph from dialogue context, rather than querying agent IDs.
Propose Blindfold, jailbreaking embodied LLMs with action-level manipulation
Published Mar 2
Evaluated models Llama-3.1-8B , DeepSeek-R1-14B , Gemma-3-27B and others8 Abstract Blindfold jailbreaks embodied LLMs with action-level proxy planning, and the authors claim it can bypass semantic checks and is effective in both simulation and real-world settings.Blindfold is a no-box attack against embodied LLM planning modules, rewriting malicious intent into seemingly benign action sequences.
Propose Thought Virus, which propagates preferences along multi-agent messages via subliminal prompts.
Published Feb 23
Evaluated models Qwen2.5-7B-Instruct , Llama-3.1-8B-Instruct Abstract Thought Virus spreads a single-point bias downstream.Thought Virus puts subliminal prompting into multi-agent communication, to see whether a single-point deviation spreads across the network without naming the target concept.
提出 PINA，迭代优化针对导航智能体的提示注入
Published Jan 20
Evaluated models GPT-3.5-turbo , GPT-4 , Balcı et al. [2] Abstract PINA 在黑盒下优化导航提示注入。PINA 是面向基于 LLM 的导航智能体、在黑盒条件下优化提示注入的框架。
提出 BPA 改写 profile 与记忆，重新诱发智能体对人类的外群体偏向
Published Jan 1
Evaluated models gpt-4o-mini Abstract 最小群体线索下出现内群体偏向。作者考察 LLM 智能体在任意群体边界下会不会把人类当外群体，并用信念投毒检验面向人类的抑制是否依赖身份信念。
Attacks arXiv 2505.23266 · May 29, 2025 提出 AdvOF，生成对抗物体误导视觉语言导航智能体的场景感知
Published May 29, 2025
Evaluated models Lseg , Clip , ViT-L/16 and others5 Abstract AdvOF 以多视角融合生成对抗物体。AdvOF 是针对 VLM 驱动 VLN 服务导航的对抗物体攻击。
You have reached the end