Another 215papers do not have category tags yet and are not included in filtered results.
Proposes RATED, which reranks agent tool retrieval using execution feedback
Propose X-AgentRed, which uses a tool dependency graph to red-team cross-service unauthorized harm in personal agents
Proposes DREAM, which selectively weakens agent-poisoned memories while preserving benign memories.
Proposing DRYLAB-Bench to evaluate agentic LLMs' high-risk mutation design capability
Introduces DistressBench, evaluating models' multidimensional support in crisis conversations
DistressBench uses SSH dialogues written and revised by clinical personnel, and evaluates how much necessary care general chat models deliver according to weighted atomic criteria, rather than whether they refuse. When users disclose suicidal ideation or self-harm to a chat model, the authors consider the expected behavior to be recognizing the crisis, calibrating empathy, de-escalating, and referring to human help. Refusal-based evaluations cannot detect failing to act after recognizing the crisis.
Measuring the impact of random weight bit flips on LLM agent safety and alignment behavior
After random two-bit weight faults enter an LLM agent, model-level damage becomes recoverable, increased cost, subtle semantic errors, and changes in safety or alignment behavior.
Proposes Task Bank self-replay to mitigate held-out forgetting in continual instruction tuning
The authors study how language models, when learning new tasks, can use their own knowledge for broader self-preservation: given an incomplete list and forgetting that extends beyond the list, can the model generate replay and help choose targets.
Proposes PASAC and a five-layer boundary guarantee stack, turning agent evaluation overstepping into verifiable whole-system guarantees.
Proposes the FAITH safe filtering reinforcement learning framework, training high-dimensional systems to optimize task reward under constraints
FAITH is a model-free safe filtering reinforcement learning framework for high-dimensional systems: safety correction and task reward reside in separate modules.
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
AbstractThe authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
评测编码 Agent 中相似技能共同安装对已装技能核心功能的替代
作者对共同安装、做同一件事的良性 skill 做实证研究，用核心功能是否还在，而不是任务过不过，来看冲突。。
测量 LLM 版本更替对科学摘要 AI 改写检测器的影响
作者量化的是：科学摘要的 AI 改写筛查，在 LLM 版本不断更换、而人类摘要误标必须少见时，会怎样变。问题来自期刊和会议已经按分数阈值筛查投稿，但基准多停在评估时可得的版本上。
用时钟 harness 和预算塑形 GRPO 改善 Agent 的按时返回
作者研究小规模 LLM 智能体在显式 wall-clock 预算下能否按时返回，并把更多时间换成更好的解。
提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤
Abstract论文提出 PatchBench 与局部评估协议，揭示了激活补丁在全局能力无损下仍存局部良性退化。
测量工具调用 Agent 对显式报错与静默损坏的检测和恢复
作者在 BFCL 多轮可执行环境上注入一次工具层故障，把注意到、改计划、恢复和重复分开记分，而不是只看任务有没有做完。
提出 AgentTime 基准，评测智能体按时长工作与估时能力
AgentTime 是对智能体时间自控的评测：预测任务耗时、按要求时长工作、事后估计已用时间。
提出 AgentTracer，事后定位间接提示注入的注入点并重建攻击链
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
提出 MFOTL 离线时序验证以监控工具 Agent 的危险动作链
这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。
提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。