Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 20 papers Another 233 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes the semantic watermark SemField, which still identifies the attribution of generated text after paraphrasing and structural changes.
Published Oct 8
Evaluated models Llama-3.2-1B , Qwen3-1.7B , OPT-1.3B Abstract Training-independent document-level semantic watermark.SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.
提出 LTBD，用可学习分隔符隔离可信指令与不可信数据
Published Oct 8
Evaluated models Llama3-8B-Instruct , Llama3.1-8B-Instruct , Falcon3-7B-Instruct and others4 Abstract LTBD 只训练四个分隔符嵌入。LTBD 是一种不改基座权重的提示注入防御：只学习用来标出可信指令与不可信数据边界的四个 token 嵌入。
把 SynthID 嵌入基因组语言模型采样，并用位置无关检测追溯生成序列
Published Oct 4
Evaluated models Carbon-500M , GENERator-v2-eukaryote-1.2b-base Abstract 两个六碱基基因组模型嵌入 SynthID 后，位置无关验证能找回水印，作者称这只是统计检测。作者在两个六碱基基因组模型的采样里嵌入 SynthID，并让验证者在不知道起点、链和 token phase 时做一次校正后的检出。
提出抗删除水印 RMCW，在生成时注入 Reed-Muller 结构并做局部检验
Published Oct 2
Evaluated models OPT-1.3B , Llama-3.1-8B-Instruct 提出 PACE，在工具调用前做路径隔离与效果授权
Published Oct 1
Evaluated models gpt-5.6-luna , DeepSeek-V4-Flash , Qwen-3.8-27B Abstract PACE 在工具边界做路径割与效果核验。PACE 是面向工具调用型 LLM 智能体的运行时调解：当准入证据无法区分会改变行为的规格时，不在出口站点上撤销调解，而在最后一次工具调用前同时检查表示出的影响路径和请求权限。
提出 ZoneClaw，用记忆分区防御计算机使用 Agent 的持久记忆攻击
Published Oct 1
Evaluated models Claude Sonnet 4.6 , GPT-5.5 , GLM-5.2 and others4 为 Agent 提出资源层授权系统 Pincer，用数字分身执行动态最小权限
Published Oct 1
Evaluated models Claude Haiku 4.5 , Muse Spark 1.2 Contributor Abstract Pincer 在资源层以三票合取做授权。Pincer 是加在现成 coding agent 上的资源层授权防御：用只受用户侧信息影响的 digital twin 做动态最小权限，并与 tool-call 层防御并存。要处理的是用户维护策略带来的权限蠕变和授权疲劳，以及不学习用户策略的 tool-call 分类器。作者引述工作称 auto mode 会放行多数不安全操作，并认为推理代码或复杂 shell 的效果在这一层不实际。
提出 AutoMark，自动搜索并统计检验 LLM 文本水印
Published Sep 29
Evaluated models Llama-3.1-8B-Instruct , Qwen3.8-27B , GPT-6 Astra and others5 Abstract AutoMark 的贡献同时包含搜索出的水印，以及用于约束自动研究误报与评测漏洞的验证框架。AutoMark 是一套自动水印研究框架 ：先检查生成分布和误报性质，再比较检测、编辑鲁棒性与质量，最后人工分析组件并做留出评测。
提出 EC-Agent 联合回执，绑定工具智能体的主张、证据与执行并支持重放审计
Published Sep 29 Abstract EC-Agent 把主张、片段、执行前缀和来源状态绑成可重放回执，并把完整性与语义支持分开判定。EC-Agent 为工具智能体的审计增加一份可重放的联合回执：它同时绑定发出的主张、精确来源片段、有序执行前缀，以及该次执行看到的来源版本和访问状态。
提出成对无失真水印 TTMARK，增强低熵下的机器文本检测
Published Sep 29
Evaluated models Llama3.2-3B-Instruct , Mistral-v0.3-7B-Instruct , Qwen2.5-7B-Instruct Abstract TTMARK 用水印化相邻 token 对利用条件熵，在多种无失真方案上提高检测并保持生成质量。TTMARK 是一种成对、无失真的文本水印：对相邻 token 的联合分布重加权，而不是逐 token 独立重加权。
提出 Pictionary，将不可信文本渲染成图像以防御提示注入
Published Sep 29
Evaluated models Claude Opus 4.7 , Claude Haiku 4.5 , GPT-5.5 and others12 提出多智能体系统提示注入的威胁模型与四层架构防御
Published Sep 19
Evaluated models GPT-4o (2024-08-06) , Claude 3.5 Sonnet , Llama 3 70B-Instruct 提出 Provenance-Aware Transformers，隔离不可信来源防御间接提示注入
Published Sep 18
Evaluated models SmolLM2-360M-Instruct , LLaMA-3-8B-Instruct , Qwen2.5-7B-Instruct and others4 提出 IntentCap，按来源字段所有权合成并裁决 Agent 能力租约
Published Sep 14 Abstract 四源字段租约约束副作用。IntentCap 是把智能体能力绑到当前任务意图、并按上下文来源划分字段所有权的权限机制。
提出 DenMark，在扩散语言模型去噪时注入可抵抗保义编辑的语义水印
Published Sep 13
Evaluated models LLaDA-8B , LLaDA1.5-8B , LLaDA2.0-mini and others4 Abstract DenMark 用 rollout 在 DLM 去噪中累积语义水印，扫描检测以抵抗保义编辑。DenMark 是面向扩散语言模型的语义水印：在去噪的局部更新里注入密钥相关语义信号，并在编辑改变 token 边界后仍检测。现有句子级语义水印要先完成整个语义单元再打分取舍，而 DLM 以任意顺序更新掩码，中间单元不完整。DenMark 把续写划成固定 token 区域，对每个局部候选做不提交的 rollout 补全，按语义分 gb 的平均选择更新，从而沿轨迹累积证据。
为冻结模型与目标域自动搜索可部署的 Agent 安全 harness
Published Sep 5
Evaluated models Sonnet 4.6 , GLM-5 , Kimi-K2.5 and others11 提出 Cocktail 水印，共嵌稳健与脆弱信号以溯源并发现篡改
Published Aug 13
Evaluated models Llama-3.2-1B , Gemma-3-4B 提出 TMA-NM，以写时来源绑定抵御 Agent 长期记忆投毒
Published Jun 23
Evaluated models gpt-5-chat , gpt-4o-mini , claude-opus-4.1 and others8 Abstract TMA-NM 用来源绑定的行动权限挡住记忆洗白。TMA-NM 把 LLM 智能体长期记忆的行动权限绑到写时来源，用来挡住跨会话记忆投毒。
Reviews threats to autonomous agents and proposes a full-lifecycle defense blueprint, FASA
Published Mar 13 Abstract Using OpenClaw as an example, it divides risks into three layers and uses FASA to describe defense from input to system execution.This is a threat review and defense architecture report using OpenClaw as a case study, not a scored attack or defense evaluation.
提出间接提示注入护栏 CausalArmor，按因果归因选择性清洗未受信片段
Published Feb 8
Evaluated models Gemini-2.5-Flash , Claude-4.0-Sonnet , Gemini-3-Pro and others4 Abstract CausalArmor selectively sanitizes and masks chain of thought at privileged decisions based on attribution margins, to mitigate over-defense against IPI.CausalArmor is an indirect prompt injection defense middleware on tool-calling agents, used to avoid paying the utility and latency costs of always-on sanitization even when there is no attack.
You have reached the end