Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 16 papers Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
Published Oct 2
Evaluated models Gemma-3-27B-Instruct , Gemma-3-4B-Instruct , Llama-3.2-3B-Instruct and others12 提出 MIRROR，用多路径摘要多数表决保障多智能体通信完整性
Published Oct 2
Evaluated models Gemma-4-31B-it , Gemini 2.5 Pro Abstract MIRROR 靠多数路径。MIRROR 是 LLM 多智能体通信层上的多路径法定人数完整性原语，只处理不透明字节，不解释消息内容。要处理的是 Agent-in-the-Middle：中介合法终结 TLS 后可改在途消息，而语义校验有推理开销和误拦，签名又要求私钥管理。做法是生成结束后复制同一规范化载荷。
提出 BDA，按辩证动作可靠性加权聚合多 LLM 议会以抵抗持续对抗
Published Oct 2 Abstract BDA 用零额外调用的可靠性加权，给出可校准后验，并在持续对抗下反转不可靠席位。BDA 是一种不另调 LLM 的多 LLM 议会聚合方法，同时处理置信度校准和持续不可靠席位。
提出 MiniRep，在多智能体辩论聚合中结合当前质量、风险与历史声誉并限制克隆组
Published Sep 30 Abstract MiniRep 用当前提案证据校准历史声誉并限制克隆组，MATH 上平均准确率高于基线，其他任务有反例。MiniRep 是面向恶意智能体的 MAD 声誉聚合，只作用在 Decide 阶段。
提出技能级联攻击，把有害目标拆散到多个技能里绕过单技能扫描
Published Sep 25
Evaluated models GPT-5.4 , GPT-5.4 Mini , Claude Opus 4.6 and others11 Abstract 论文探讨了多技能智能体系统面临的技能级联攻击风险，提出自动化红队框架与基准集，指出跨技能交互存在安全防护盲区。
提出两阶段框架 A2M，优化 MCP 工具元数据与返回载荷以劫持 Agent
Published Sep 23
Evaluated models GLM-4.6 , Qwen3-Max , DeepSeek-V3.1 and others5 提出基准投毒攻击，使自修改编码 Agent 跨代写出含漏洞代码
Published Sep 16
Evaluated models Claude Sonnet 4.5 , Qwen3.5-397B , gpt-oss-120b and others5 Abstract 论文报告了恶意基准能污染自修改代码智能体的进化过程并持续输出漏洞，警示系统设计需纳入安全约束。
提出 Emergence World，对长时程多智能体系统开展对抗压力测试
Published Sep 15
Evaluated models Claude Opus 4.8 , DeepSeek v4 Pro , Gemini 3.5 Flash and others9 Abstract 作者通过长期平行世界实验指出模型对齐不具备可组合性，单模型群体会产生社会奉承、协同退缩及语言不透明等失效。
提出 ISM，用语义匹配隐式操纵 Agent 技能选择
Published Sep 2
Evaluated models Llama-2-7B , Llama-3-8B , Llama-3.1-8B and others8 提出多智能体输出与跨部署方委派的两层存证
Published Aug 31 Abstract 两层证明记录放出字节与边授权。部署方侧的两层证明，用来在多智能体跨部署方委托之后回答两个事后问题：谁放出了这些字节，这条跨部署方边有没有父方授权。
提出利用检查点回滚破坏 Agent 执行连续性的攻击
Published Aug 30 Abstract 论文系统研究了智能体 C/R 的安全性，分析了合法回滚破坏执行连续性的机理，并实证评估了其普遍性与危害。
复现 AgentCF 上的多智能体攻防并刻画连通性作用
Published Aug 4
Evaluated models Qwen3-235B-A22B , Claude Haiku 4.5 , Mixtral 8×7B and others4 Abstract 连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。
提出多智能体流水线的边界攻击，使对抗内容作为可信输入跨层传播
Published Aug 1
Evaluated models GPT-5-mini , Claude Sonnet 4.5 , Kimi K2.5 Abstract 缺边界校验使对抗内容跨智能体传播，作者称这是架构属性而非模型能力。作者把多智能体 LLM 流水线的对抗问题定义为缺少边界校验，并用生产轨迹和受控实验检查脆弱性来自架构还是骨干模型。中间输出未经验证就传给下游。作者认为，一旦某级接受对抗内容，后续智能体会把它当作可信输入。
提出利润驱动红队，用标量盈余搜索对手以压测经济博弈 Agent
Published Mar 22
Evaluated models GPT-OSS-120B , Qwen3-32B , MiniMax-M2.5 and others6 Abstract 利润驱动红队以标量盈余训练对手，六个目标在四博弈中被利用，提示规则可抬高目标盈余。利润驱动红队把可审计终局里的智能体安全写成对手搜索问题：固定目标会不会被一个只追逐自身盈余的自适应玩家利用。
Proposing a lineage-graph governance layer to suppress error cascades in multi-agent collaboration
Published Mar 4 Abstract A single seed can solidify into a false consensus along a fixed collaboration graph.The authors turn "small errors becoming collective false consensus" in LLM-MAS into a measurable propagation on a graph, and use a plug-in that only changes messages, not topology, to reduce the final infection.
Propose Thought Virus, which propagates preferences along multi-agent messages via subliminal prompts.
Published Feb 23
Evaluated models Qwen2.5-7B-Instruct , Llama-3.1-8B-Instruct Abstract Thought Virus spreads a single-point bias downstream.Thought Virus puts subliminal prompting into multi-agent communication, to see whether a single-point deviation spreads across the network without naming the target concept.
You have reached the end