Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 26 papers
Filter4

Attack type

Jailbreaks3Prompt injection25Poisoning and backdoors7

Model risks

Dangerous agent actions5

Defense type

Model hardening6Detection and filtering14Instruction–data separation24Permissions and approval22Monitoring and auditing14

Impact

Unauthorized actions19Output manipulation4

System type

AI Agent25coding agent3

Attack surface / entry point

User input27Web pages and interfaces13Documents and messages15Tool responses26Tool and skill descriptions13Code repositories and dependencies3Retrieval corpus5Memory writes4Inter-agent messages3Images, audio and video5Distribution channels8

Layer

Application layer26

System component

Memory4Guardrails and judges9Monitors12
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Defense type：Detection and filteringDefense type：Monitoring and auditingAttack surface / entry point：Tool responsesLayer：Application layerClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  2. DefensesarXiv 2610.09793

    用时序逻辑监控工具 Agent

    提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链

    arXiv
    2610.09793
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Attacker
    Black-box
    Abstract形式化验证可有效识别多步攻击，但其有效性高度依赖轨迹的可信历史记录。

    这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。

    Paper analysisRead analysis
  3. DefensesarXiv 2610.07657

    DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

    实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击

    arXiv
    2610.07657
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    Evaluated models
    Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
    AbstractDEFER 把确定性检查放在 judge 之前。

    DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。

    Paper analysisRead analysis
  4. Evaluation and benchmarksarXiv 2610.07089

    研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹

    提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视

    arXiv
    2610.07089
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Gemma 4 26B-A4B, Qwen3.6 27B, Qwen3.5 27B and others12

    Abstract统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。

    Paper analysisRead analysis
  5. DefensesarXiv 2610.05163

    Researchers construct segmented prompt injection on Claude Code and Codex and release a boundary action audit benchmark

    提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入

    arXiv
    2610.05163
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (v2.1.172, Claude Sonnet 5), Codex CLI (v0.144.0, GPT-5.5)
    Abstract论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。

    本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2610.03448

    Study retests 15 prompt injection detectors: benchmark scores poorly predict agent deployment performance

    重测提示注入检测器在 Agent 工具输出上的检出与任务阻断

    arXiv
    2610.03448
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Horizon-Labs, Wolf Defender, Prismor-1.5B and others15

    Abstract论文揭示公开基准无法反映智能体检测器表现，检测能力源于输入格式相似而非通用防御，建议基于工具输出与低误报评测。

    Paper analysisRead analysis
  8. DefensesarXiv 2609.35659

    Tracekit：面向自主编码 Agent 的防篡改意图-推理-动作审计系统

    提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改

    arXiv
    2609.35659
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Claude Code (claude -p, version 2.1), 独立评审（同一 CLI，无工具）
    AbstractTracekit 把意图、自述和动作写入可锚定的哈希链。

    Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。

    Paper analysisRead analysis
  9. Evaluation and benchmarksarXiv 2609.35886

    Agentic Commerce Bench：衡量会花钱的智能体的欺诈检测能力

    构建支付欺诈基准 ACB，评测花钱智能体的欺诈检测

    arXiv
    2609.35886
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    gordonguard, pattern judge
    AbstractACB 把支付欺诈与智能体操纵分开测量，作者强调观察权限、误报预算和微支付复核成本。

    ACB 是一套智能体支付欺诈基准与检测参考栈，目标是衡量钱是否被不当提取，而不仅是智能体是否接受了恶意指令。

    Paper analysisRead analysis
  10. DefensesarXiv 2609.33039

    TACIT: detecting agent trajectory harm from LLM internal states

    提出 TACIT，从冻结内部状态检测智能体有害轨迹

    arXiv
    2609.33039
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Qwen3-4B, Llama-3.1-8B, Qwen3-4B-Instruct and others4

    Abstract提出基于内部表征的智能体轨迹安全检测方法 TACIT，揭示工具风险表征特性并在多项基准上提升检测表现与效率。

    Paper analysisRead analysis
  19. AttacksarXiv 2607.06595

    When Agents Remember Too Much: Memory Poisoning Attacks against Large Language Model Agents

    Proposed GhostWriter memory poisoning, which writes into the agent's long-term memory via email and calendar and activates across sessions

    arXiv
    2607.06595
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.4-mini, DeepSeek-V4-Flash, Gemini-2.5-Flash and others4
    Paper analysisRead analysis
  20. DefensesarXiv 2606.22673

    Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导

    提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向

    arXiv
    2606.22673
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    LLaMA-3.1-8B, Qwen-2.5-7B, Gemma-2-9B
    Abstract白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。

    Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。

    Paper analysisRead analysis
Load more