Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 10 papers

Filter4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.

Defense type：Instruction–data separation Defense type：Permissions and approval Attack surface / entry point：Memory writes Attack surface / entry point：Training data Clear all

Another 261papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.07657Oct 6
DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降
实现 DEFER，以确定性检查优先拦截多智能体流水线的内容攻击
arXiv
2610.07657
Published
Oct 6
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Qwen3-235B-A22B-Instruct-2507, gpt-oss-120b, Llama-4-Scout-17B-16E-Instruct and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractDEFER 把确定性检查放在 judge 之前。
DEFER 用来测量多智能体授权流水线里，确定性规则在何处结束、LLM judge 从何处开始。
Paper analysisRead analysis
DefensesarXiv 2610.04504Oct 3
论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证
提出 VAL 框架，并用确认门与参数沙箱约束智能体高风险工具调用
arXiv
2610.04504
Published
Oct 3
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek-chat, Meta Llama 3.1 8B, Kimi
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.00450Oct 1
ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
arXiv
2610.00450
Published
Oct 1
Layer
Application layer
Setting
Browser and computer use
Evaluated models
Claude Sonnet 4.6, GPT-5.5, GLM-5.2 and others4
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2610.00371Sep 30
FlowReview：以授权配对评测控制多智能体组合信息流
提出 FlowReview，用授权配对与确定性提交门控控制多智能体组合信息流
arXiv
2610.00371
Published
Sep 30
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
Sonnet 4.5, Haiku 4.5, Qwen3-32B and others5
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract配对标准要求拒绝禁止使用并完成授权使用，FlowReview 把三项审查接到执行。
这篇工作把多智能体安全写成一件必须同时成立的事：拦住组合信息所启用的禁止使用，并完成同一场景里任务所需的授权使用。
Paper analysisRead analysis
DefensesarXiv 2609.17648Sep 15
多智能体 LLM 流水线中的信任传播与结构隔离
用任务绑定令牌和策略预言机拦住多智能体流水线的未授权执行
arXiv
2609.17648
Published
Sep 15
Layer
Application layer
Setting
Multi-agent systems
Evaluated models
gemma4:31b-cloud
- DefensesPermissions and approval
- AttacksPoisoning and backdoors
- ComponentPermissions and sandboxing
Abstract结构性授权拦住了记忆投毒的未授权执行，持密钥时承重的是策略预言机。
作者在一条会改写沙箱邮件库的四智能体流水线上，检查低权限失陷会不会变成未授权的真实动作。
Paper analysisRead analysis
DefensesarXiv 2609.16098Sep 14
研究者提出面向工具集成 LLM Agent 的通用对抗攻击防御方法
提出 ATF 与 NTR，过滤或恢复工具集以阻止 Agent 调用攻击工具
arXiv
2609.16098
Published
Sep 14
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma2-9B, Qwen2-7B, LLaMA3-8B and others7
- DefensesPermissions and approval
- AttacksPrompt injection
Paper analysisRead analysis
DefensesarXiv 2609.29647Aug 29
AgentKernel：面向 Agent 的可信原生操作系统内核
提出 AgentKernel，用四支柱强制中介 Agent 的输入、工具与记忆
arXiv
2609.29647
Published
Aug 29
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
AbstractAgentKernel 是四支柱智能体 OS 设计，安全论证未附带实测数字。
AgentKernel 是把安全做成组织原则的智能体 OS 架构，不是带跑分的攻防评测。
Paper analysisRead analysis
DefensesarXiv 2608.10502Aug 11
依赖引导回滚修复：为记忆增强 Agent 恢复错误记忆后的答案与状态
提出依赖引导回滚修复，恢复记忆增强 Agent 的回答与状态
arXiv
2608.10502
Published
Aug 11
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-4o, Gemini-3.6-Flash, Qwen3.6-27B
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
Paper analysisRead analysis
DefensesarXiv 2606.24322Jun 23
Protecting LLM agent long-term memory from poisoning: tamper-evident, source-bound permissions and machine-checkable guarantees
提出 TMA-NM，以写时来源绑定抵御 Agent 长期记忆投毒
arXiv
2606.24322
Published
Jun 23
Layer
Application layer
Setting
AI Agent
Evaluated models
gpt-5-chat, gpt-4o-mini, claude-opus-4.1 and others8
- DefensesInstruction–data separation
- AttacksPoisoning and backdoors
- ComponentMemory
AbstractTMA-NM 用来源绑定的行动权限挡住记忆洗白。
TMA-NM 把 LLM 智能体长期记忆的行动权限绑到写时来源，用来挡住跨会话记忆投毒。
Paper analysisRead analysis
DefensesarXiv 2603.11619Mar 12
驯服 OpenClaw：自主 LLM 智能体威胁的安全分析与缓解
提出对齐五阶段的纵深防御，缓解自主 Agent 跨阶段威胁
arXiv
2603.11619
Published
Mar 12
Layer
Application layer
Setting
AI Agent
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentMCP and skills
Abstract这是对 OpenClaw 的生命周期威胁分析与分层缓解设计，案例为定性证据。
这是对 OpenClaw 的生命周期威胁分析，并配套一套分层缓解设计。要处理的问题是：自主智能体把即时通讯、持久记忆、第三方插件和高权限执行连在一起之后，攻击不再限于单轮越狱，而会跨初始化到执行的多个阶段复合。作者认为只加固单个接口的防御，挡不住这种跨时间攻击。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

DEFER1 多智能体防御研究报告受控测试中的攻击成功率下降

论文提出 VAL 框架：相同 ASR 的 LLM Agent 防御可能对应不同安全保证

ZoneClaw 用记忆分区防御 OpenClaw 式计算机使用 Agent 的持久记忆攻击

FlowReview：以授权配对评测控制多智能体组合信息流

多智能体 LLM 流水线中的信任传播与结构隔离

研究者提出面向工具集成 LLM Agent 的通用对抗攻击防御方法

AgentKernel：面向 Agent 的可信原生操作系统内核

依赖引导回滚修复：为记忆增强 Agent 恢复错误记忆后的答案与状态

Protecting LLM agent long-term memory from poisoning: tamper-evident, source-bound permissions and machine-checkable guarantees

驯服 OpenClaw：自主 LLM 智能体威胁的安全分析与缓解