Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 61 papers Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Introduces DistressBench, evaluating models' multidimensional support in crisis conversations
Published Oct 9
Evaluated models Muse Spark 1.2 , Muse Spark 1.3 , Muse Glimmer 30B and others20 Abstract The model is more restrained and acts less.DistressBench uses SSH dialogues written and revised by clinical personnel, and evaluates how much necessary care general chat models deliver according to weighted atomic criteria, rather than whether they refuse. When users disclose suicidal ideation or self-harm to a chat model, the authors consider the expected behavior to be recognizing the crisis, calibrating empathy, de-escalating, and referring to human help. Refusal-based evaluations cannot detect failing to act after recognizing the crisis.
评测编码 Agent 中相似技能共同安装对已装技能核心功能的替代
Published Oct 8
Evaluated models claude-sonnet-4-6 , claude-haiku-4-5-20251001 , claude-opus-5 and others6 Abstract 冲突藏在任务成功后面。作者对共同安装、做同一件事的良性 skill 做实证研究，用核心功能是否还在，而不是任务过不过，来看冲突。 。
提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤
Published Oct 7
Evaluated models Qwen2.5-3B-Instruct , Qwen2.5-14B-Instruct , gemma-3-4b-it and others8 Abstract 论文提出 PatchBench 与局部评估协议，揭示了激活补丁在全局能力无损下仍存局部良性退化。
测量工具调用 Agent 对显式报错与静默损坏的检测和恢复
Published Oct 7
Evaluated models claude-haiku-4.5-thinking , claude-haiku-4.5 , deepseek-r1 and others6 Abstract 作者称智能体看错误通道而非返回内容，静默损坏更少被当作问题。作者在 BFCL 多轮可执行环境上注入一次工具层故障，把注意到、改计划、恢复和重复分开记分，而不是只看任务有没有做完。
提出 AgentTime 基准，评测智能体按时长工作与估时能力
Published Oct 7
Evaluated models Fable 5.1 , GPT-5.6 Sol , GPT-6 Astra and others7 Abstract 作者把完成任务和管理所用时间分开。AgentTime 是对智能体时间自控的评测：预测任务耗时、按要求时长工作、事后估计已用时间。
提出 ParanoiaEval 评测编码智能体的不必要风险处置
Published Oct 7
Evaluated models Opus-5 , Sonnet-5 , Sonnet-4.6 and others8 Abstract 作者用证据受控任务对评测风险处置，称其普遍、独立于任务能力并降低满意度。作者提出 ParanoiaEval，并称它是编码智能体风险处置能力的首个统一基准。要解决的问题是：证据已经确定风险应如何处置之后，智能体仍可能扩大验证、增加保护或备份，而现有评测要么只看功能正确性，要么把相关行为拆开研究。做法是把 NIST 的 ATMA 落到仓库任务。
比较量化 Agent 的工具故障恢复，检验提示词与评测口径是否反转比较方向
Published Oct 6
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct 评测文生图模型的有害内容生成能力与审核检测缺口
Published Oct 5
Evaluated models SDXL , Stable Diffusion 3.5 Large , FLUX.1-dev and others12 提出 Inspect Robots，在真实机器人上评测具身模型的能力与拒答
Published Oct 5
Evaluated models Astra（GPT-6 Astra） , GPT-6 Sol , GPT-5.6 Sol and others7 提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视
Published Oct 5
Evaluated models Gemma 4 26B-A4B , Qwen3.6 27B , Qwen3.5 27B and others12 Abstract 统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。
提出 SWE-CC 基准，评测编码 Agent 对仓库贡献策略的遵守
Published Oct 5
Evaluated models GPT-5.6 Luna , Gemini 3.7 Flash , DeepSeek V4 Flash 0731 and others4 Abstract SWE-CC 中功能正确仍可能违规。SWE-CC 评测编码智能体是否遵守仓库贡献策略，而不只看补丁能否通过测试。
提出 ControlPed 与 HazardPed，生成可控行人危险场景并评测端到端驾驶
Published Oct 5
Evaluated models DiffusionDrive , SSR , VAD and others7 提出 RAGStress 受控基准，评测知识库退化下的 RAG
Published Oct 4
Evaluated models Claude Sonnet 4 , Claude Opus 4.6 , DeepSeek R1 and others5 Abstract 作者用 RAGStress 比较五系统。RAGStress 是知识库损坏下的 RAG 受控压力测试。作者明确不把它当作模型排行榜。
评测 ReAct 工具调用对多模态模型拒答有害请求的削弱
Published Oct 3
Evaluated models Gemini-2.5-Pro , Gemini-3.1-Pro-Preview , Claude Opus 4.6 and others13 Abstract 论文揭示了工具调用范式削弱 MLLM 拒答能力的现象，分析了稀释与偏移机制并验证了重注缓解方案。论文系统评估了智能体工具调用范式对多模态大语言模型拒答能力的影响，指出了工具增强视觉推理背后的安全隐患。核心探讨的问题在于：当 MLLM 从单次推理转向通过 ReAct 循环调用外部工具（打标、缩放、OCR、代码执行）时，工具使用机制本身是否会降低模型拒答有害请求的概率。
提出 Persona Guardrail，强制客服智能体守住功能边界
Published Oct 2
Evaluated models Qwen3-30B-A3B , Qwen3-VL-30B , Qwen3-8B and others5 Abstract Persona Guardrail 用功能边界做同步输入输出校验，并在 PAGE 与生产延迟预算下给出评测。Persona Guardrail 是客服向智能体的同步运行时防御：先写明功能边界，再决定放行或拦截，而不是只检测某一攻击类。
提出 SceneFactory-3D，用路况反事实评测驾驶策略的闭环安全性
Published Oct 2
Evaluated models Frozen L0 , L0-T , L1 and others5 Abstract SceneFactory-3D 固定场景只改路况。SceneFactory-3D 是 GPU 批处理的多智能体驾驶仿真器，用来在场景和控制器固定时只改路面物理，并比较闭环结果。
提出 PowerBench，测量模型对权力转移请求的拒答偏见
Published Oct 2
Evaluated models grok-4.3 , haiku-4.5 , nova-2-lite and others18 Abstract 作者报告拒答随 SE/DE/PG 变化，并存在针对美国失权、智能体和语言的差。
重测提示注入检测器在 Agent 工具输出上的检出与任务阻断
Published Oct 2
Evaluated models Horizon-Labs , Wolf Defender , Prismor-1.5B and others15 Abstract 论文揭示公开基准无法反映智能体检测器表现，检测能力源于输入格式相似而非通用防御，建议基于工具输出与低误报评测。
提出 SAGO，以语义等价变体上的逐例行为稳定性评测大模型泛化
Published Oct 1
Evaluated models Llama-3.2-3B-Instruct , Llama-3.1-8B-Instruct , Gemma-2B-IT and others11 Abstract SAGO 用多轴逐例稳定性替代聚合准确率，十一个模型都未均匀泛化，且排名会随数据集改变。SAGO 把 LLM 泛化改写成同一目标与上下文在语义等价表达下的逐例行为稳定性，而不是单一基准上的聚合准确率。 。
构建 Agent Error Dataset，把智能体自然失败转为诊断与修复训练数据
Published Oct 1
Evaluated models Qwen3-8B Abstract AED 把自然失败做成诊断与修正数据。AED 是一个面向文本智能体的错误–诊断集合，用来把失败轨迹转成可分析、可训练的诊断与修正，而不是只保留最终奖励。