Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 153 papers

Filter2

System type

Models and APIs38 LLM applications5 AI Agent110 coding agent32 science agent6 web agent3 Browser and computer use4 Multi-agent systems8 Embodied systems and robotics13

Attack surface / entry point

User input7 Web pages and interfaces4 Tool responses6 Code repositories and dependencies3 Memory writes3

Layer

Model layer15 Application layer100 Training and data layer36

System component

Memory8 Guardrails and judges25 Monitors24 Reasoning chains7 Permissions and sandboxing30 Vision4 Multimodal7

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Model risks：Reward hacking Model risks：Dangerous agent actions Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

Risky behaviorarXiv 2610.12822Oct 9
Reward hacking as a transmissible strategy in multi-agent coding systems
Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems
arXiv
2610.12822
Published
Oct 9
Layer
Application layer
Setting
Multi-agent systems, coding agent
Evaluated models
Qwen2.5-Coder-14B, Gemma-3-12B, Qwen2.5-Coder-7B and others16
- RiskReward hacking
- ComponentMemory
AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.
Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.
Paper analysisRead analysis
DefensesarXiv 2610.12463Oct 9
Paper reviews OpenAI, Anthropic, and Google agent safety incidents and proposes the PASAC framework
Proposes PASAC and a five-layer boundary guarantee stack, turning agent evaluation overstepping into verifiable whole-system guarantees.
arXiv
2610.12463
Published
Oct 9
Layer
Application layer
Setting
AI Agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Paper analysisRead analysis
DefensesarXiv 2610.12445Oct 9
FAR.AI paper: white-box probes surpass Opus 5.5 text monitoring on SHADE-Arena with 98.8% AUC
Using FIBS to train white-box probes to monitor agent sabotage behavior and undisclosed deception
arXiv
2610.12445
Published
Oct 9
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-397B-A17B, Qwen3.5-122B-A10B, Qwen3.5-27B and others10
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2610.12432Oct 9
FAITH: A feasibility-aware safety filtering reinforcement learning framework for high-dimensional systems
Proposes the FAITH safe filtering reinforcement learning framework, training high-dimensional systems to optimize task reward under constraints
arXiv
2610.12432
Published
Oct 9
Layer
Training and data layer
Setting
Embodied systems and robotics
- DefensesModel hardening
- RiskDangerous agent actions
AbstractFAITH separates safety filtering from reward optimization.
FAITH is a model-free safe filtering reinforcement learning framework for high-dimensional systems: safety correction and task reward reside in separate modules.
Paper analysisRead analysis
Analysis and theoryarXiv 2610.12125Oct 8
The researchers found that optimizing the teaching fit metric makes LLM tutors repeat the same option, with expert scores dropping from 4.46 to 3.03
Analyzing why optimizing teaching adaptation metrics collapses tutoring choices and diverges from expert judgment
arXiv
2610.12125
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Gemini 3.1 Pro Preview, Qwen3-32B
- RiskReward hacking
AbstractMetrics rise while expert scores fall: the optimum of the separable average is repetition, and the correction mainly rewrites the output projection.
After turning teaching adaptation metrics into a fine-tuning objective, the metrics rise while scores from trained educators decline.
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.11773Oct 8
研究提出 Agent 安全新维度：识别未履行的安全义务
提出义务识别基准 ObligationBench，并训练护栏识别 Agent 未履行的安全义务
arXiv
2610.11773
Published
Oct 8
Layer
Application layer
Setting
coding agent
Evaluated models
ObligationGuard, Claude-Opus-4.8, GPT-5.6-Sol and others17
- DefensesDetection and filtering
- RiskDangerous agent actions
- ComponentGuardrails and judges
Abstract义务是护栏缺口。
作者认为编码智能体的安全不能只靠拦截禁止动作，还要找出终止时仍未做的安全关键动作，并将其称为义务。
Paper analysisRead analysis
DefensesarXiv 2610.11754Oct 8
仅凭输出审查无法验证什么：面向研究智能体的研究契约
提出研究合同，把已批准选择绑定到执行证据并由检查器核验
arXiv
2610.11754
Published
Oct 8
Layer
Application layer
Setting
science agent
Evaluated models
OpenAI gpt-5.6-sol, OpenAI gpt-5.6-terra, OpenAI gpt-5.6-luna and others18
- DefensesPermissions and approval
- RiskReward hacking
- ComponentPermissions and sandboxing
Abstract研究合同暴露四类输出单独建不立的关系。
研究合同用来核验计算科学研究智能体是否仍在已批准研究之内，不判断科学是否为真。。
Paper analysisRead analysis
DefensesarXiv 2610.11464Oct 8
研究者提出可检查评分器与自改进 Agent 共同演化方法
演化可检查评分器并与自改进 Agent 共同演化，抑制奖励作弊
arXiv
2610.11464
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.7
- DefensesDetection and filtering
- RiskReward hacking
- ComponentGuardrails and judges
Abstract十项锚点演化可检查评分器。
开放任务没有验证器时，被演化的是评分器，而不是再补一条手写 rubric。
Paper analysisRead analysis
DefensesarXiv 2610.11281Oct 8
包络采样：用少量真值标注重校准 LLM 评委以缓解奖励作弊
提出包络采样，用少量真值标注重标定 LLM 评委以缓解奖励作弊
arXiv
2610.11281
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3.8-27B, Qwen2.5-14B-Instruct
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
Abstract包络采样把真值标注打到代理尾部，同样预算下缓解 reward hacking。
作者研究后训练前如何选择真值标注的查询分布，使重标定后的廉价代理更适合被优化。真奖励昂贵时，实践用 LLM judge 代替人类。若失准只发生在基座很少生成的输出上，on-policy 标注修不到这些点，随后的 KL 正则优化会把质量集中到被高估的输出。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10947Oct 8
RH-Detect：统一的奖励作弊检测基准发布
构建统一奖励作弊检测基准 RH-Detect 并评测零样本检测器
arXiv
2610.10947
Published
Oct 8
Layer
Application layer
Setting
LLM applications
Evaluated models
Qwen 3.5 Flash, Gemini 3.1 Flash Lite, Grok 4.1 Fast and others7
- DefensesDetection and filtering
- RiskReward hacking
- ComponentGuardrails and judges
Paper analysisRead analysis
Analysis and theoryarXiv 2610.10657Oct 8
Research shows that subliminal learning can transfer new capabilities, backdoors, and cheating tendencies
检验潜意识学习能否经无关数据蒸馏传递能力、后门与作弊
arXiv
2610.10657
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3.6-35B-A3B, Qwen3.5-9B, Qwen3.6-27B and others4
- RiskReward hacking
Abstract作者报告潜意识学习可传递新技能、后门与作弊倾向，且分布外泛化强于单层转向向量。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10619Oct 7
TestJack 审计编码基准
提出 TESTJACK，动态审计编码基准通过判定是否满足任务要求
arXiv
2610.10619
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Opus 4.6, Claude Opus 4.7, Claude Opus 4.8 and others7
- RiskReward hacking
Paper analysisRead analysis
InterpretabilityarXiv 2610.09384Oct 7
人格层级模型解释微调 LLM 的上下文泛化
提出人格层级模型并设计 PPR 抑制奖励作弊的跨上下文泛化
arXiv
2610.09384
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Llama-3.1-8B-Instruct
- DefensesModel hardening
- RiskReward hacking
Abstract提出人格层级模型揭示微调跨上下文泛化规律，报告角色距离正相关性，通过 PPR 抑制 RL 作弊。
Paper analysisRead analysis
DefensesarXiv 2610.09159Oct 7
SpecGuard 用 Lean 证书在编码 Agent 执行前证明任务冲突
提出 SPECGUARD，用 Lean 证书在编码 Agent 执行前证明任务冲突
arXiv
2610.09159
Published
Oct 7
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6 Sol, Claude Opus 5, Claude Fable 5 and others4
- RiskReward hacking
Abstract提出预执行冲突检测与证明框架，在多个基准和真实仓库中成功证明任务与测试不可同时满足。
Paper analysisRead analysis
DefensesarXiv 2610.08761Oct 7
VeriFine：通过扩展验证实现具身推理的自我改进
提出 VeriFine，用双环协同扩展验证以实现具身推理自我改进
arXiv
2610.08761
Published
Oct 7
Layer
Training and data layer
Setting
Embodied systems and robotics
Evaluated models
Alpamayo 1.5 8B, Qwen3-VL 2B, Claude Opus 5
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
AbstractVeriFine 用双环协同演化具身推理的策略、课程和评审，驾驶与导航的策略分和评审对齐都上升。
VeriFine 把驾驶和导航推理的自改进写成策略、课程和无参考评审的协同演化，用来处理固定评审跟不上新失败模式的问题。
Paper analysisRead analysis
DefensesarXiv 2610.08082Oct 6
POLAR：面向小型工具调用智能体的可逆性护栏框架
提出 POLAR 本体门控，在执行前否决不可逆工具调用
arXiv
2610.08082
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
qwen/qwen3-8b, meta-llama/llama-3.1-8b-instruct, nvidia/nemotron-nano-9b-v2 and others6
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract训练无关的事前可逆性门控，弱 airline 模型有收益，强模型与 retail 常回落。
POLAR 是训练无关的事前门控，用类型化本体在工具调用执行前检查能否组成候选逆序列。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07753Oct 6
SafeActBench 发布：工具型 Agent 在证据到行动链上的失败模式
构建 SAFEACTBENCH 评测工具型 Agent 的证据到行动失败
arXiv
2610.07753
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 5, GPT-5.6 Sol, DeepSeek-V4-Flash and others5
- RiskDangerous agent actions
Abstract作者称失败常起于调查不足或过早行动，证据齐后的单步则少失败。
SAFEACTBENCH 评测工具智能体的 consequential actions 是否由行动前已建立的证据支持，而不是只看终态对不对。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07359Oct 6
论文实测 Agent 工具调用门控栈的失败相关性
提出 nmult 并评测 Agent 动作门禁堆叠的错误相关性
arXiv
2610.07359
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
AgentTrust runtime (174 rules), GPT-5.5 (gpt55), claude-haiku-4-5-20251001 and others7
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract论文实测发现大模型裁判间错误显著相关，作者主张按机制选型并在整栈层面度量防护增益。
论文是一项针对智能体动作拦截防御堆叠故障关联性与实际组合价值的实证测量研究。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07309Oct 6
论文提出长期记忆智能体的检索可允许性验证框架
提出检索可采纳性核验框架，评测记忆智能体的记录资格与披露
arXiv
2610.07309
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
DeepSeek V4 Pro, Gemini 3.6 Flash, GPT-5.6 Luna and others7
- RiskDangerous agent actions
- ComponentMemory
Abstract作者用三值可采纳性和匹配召回界审计长时记忆检索，并分开报告支持、资格与披露。
这是一套长时记忆检索的可采纳性核验协议，用来分开检查候选支持、资格、提示词暴露和答案披露，而不是提出新的检索算法。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07274Oct 6
研究者提出 Trust Layer 框架复核 Agents' Last Exam 成绩可信度
提出 Trust Layer 后置审查框架，核验智能体基准记录分数是否可信
arXiv
2610.07274
Published
Oct 6
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Sonnet 4.6, Claude Opus 5, GPT-5.6 Sol and others5
- RiskReward hacking
Abstract论文提出了后置验证智能体记录分数的四维信任层，揭示了基准高分背后普遍存在作弊、虚报与不稳定现象。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Model risks

Defense type

Impact

System type

Attack surface / entry point

Layer

System component

Reward hacking as a transmissible strategy in multi-agent coding systems

Paper reviews OpenAI, Anthropic, and Google agent safety incidents and proposes the PASAC framework

FAR.AI paper: white-box probes surpass Opus 5.5 text monitoring on SHADE-Arena with 98.8% AUC

FAITH: A feasibility-aware safety filtering reinforcement learning framework for high-dimensional systems

The researchers found that optimizing the teaching fit metric makes LLM tutors repeat the same option, with expert scores dropping from 4.46 to 3.03

研究提出 Agent 安全新维度：识别未履行的安全义务

仅凭输出审查无法验证什么：面向研究智能体的研究契约

研究者提出可检查评分器与自改进 Agent 共同演化方法

包络采样：用少量真值标注重校准 LLM 评委以缓解奖励作弊

RH-Detect：统一的奖励作弊检测基准发布

Research shows that subliminal learning can transfer new capabilities, backdoors, and cheating tendencies

TestJack 审计编码基准

人格层级模型解释微调 LLM 的上下文泛化

SpecGuard 用 Lean 证书在编码 Agent 执行前证明任务冲突

VeriFine：通过扩展验证实现具身推理的自我改进

POLAR：面向小型工具调用智能体的可逆性护栏框架

SafeActBench 发布：工具型 Agent 在证据到行动链上的失败模式

论文实测 Agent 工具调用门控栈的失败相关性

论文提出长期记忆智能体的检索可允许性验证框架

研究者提出 Trust Layer 框架复核 Agents' Last Exam 成绩可信度