All papers

The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.

The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.

This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.

SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.

LTBD 是一种不改基座权重的提示注入防御：只学习用来标出可信指令与不可信数据边界的四个 token 嵌入。

The authors retested prompt injection on their own LangChain, AutoGen, and A2A systems, and modified the Agent Card to see if choices shifted. The abstract states the experiments mainly highlight single-agent weaknesses while extending attacks to multi-agent.

这篇论文对工具调用大语言模型智能体的安全监控进行了形式化时序验证研究。

这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。

WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。

ASPIRE 是给搭建方用的智能体提示注入红队引擎，目标是开放式画出可利用的行为路径，而不是在固定任务上打磨一条载荷。

作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。