{"total":98,"rows":[{"id":"2406.07358","title":"AI Sandbagging: Language Models can Strategically Underperform on Evaluations","created":"2024-06-11","cited_by_count":145,"area":null},{"id":"2401.13138","title":"Visibility into AI Agents","created":"2024-01-23","cited_by_count":79,"area":null},{"id":"2410.03768","title":"Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMs","created":"2024-10-02","cited_by_count":55,"area":null},{"id":"2506.10805","title":"Detecting High-Stakes Interactions with Activation Probes","created":"2025-06-12","cited_by_count":53,"area":null},{"id":"2410.21514","title":"Sabotage Evaluations for Frontier Models","created":"2024-10-28","cited_by_count":52,"area":null},{"id":"2504.10374","title":"Ctrl-Z: Controlling AI Agents via Resampling","created":"2025-04-14","cited_by_count":44,"area":null},{"id":"2501.10114","title":"Infrastructure for AI Agents","created":"2025-01-17","cited_by_count":41,"area":null},{"id":"2505.01420","title":"Evaluating Frontier Models for Stealth and Situational Awareness","created":"2025-05-02","cited_by_count":37,"area":null},{"id":"2411.03336","title":"Towards evaluations-based safety cases for AI scheming","created":"2024-10-29","cited_by_count":33,"area":null},{"id":"2406.14595","title":"Adversaries Can Misuse Combinations of Safe Models","created":"2024-06-20","cited_by_count":32,"area":null},{"id":"2509.22908","title":"A benchmark for vericoding: formally verified program synthesis","created":"2025-09-26","cited_by_count":20,"area":null},{"id":"2506.00085","title":"COSMIC: Generalized Refusal Direction Identification in LLM Activations","created":"2025-05-30","cited_by_count":19,"area":null},{"id":"2507.12691","title":"Benchmarking Deception Probes via Black-to-White Performance Boosts","created":"2025-07-16","cited_by_count":19,"area":null},{"id":"2412.12480","title":"Subversion Strategy Eval: Can language models statelessly strategize to subvert control protocols?","created":"2024-12-17","cited_by_count":15,"area":null},{"id":"2412.17128","title":"Lies, Damned Lies, and Distributional Language Statistics: Persuasion and Deception with Large Language Models","created":"2024-12-22","cited_by_count":15,"area":null},{"id":"2506.24068","title":"STACK: Adversarial Attacks on LLM Safeguard Pipelines","created":"2025-06-30","cited_by_count":14,"area":null},{"id":"2604.11806","title":"Detecting Safety Violations Across Many Agent Traces","created":"2026-04-13","cited_by_count":14,"area":null},{"id":"2405.05466","title":"Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internals","created":"2024-05-08","cited_by_count":13,"area":null},{"id":"2509.13281","title":"RepIt: Steering Language Models with Concept-Specific Refusal Vectors","created":"2025-09-16","cited_by_count":12,"area":null},{"id":"2506.20702","title":"The Singapore Consensus on Global AI Safety Research Priorities","created":"2025-06-25","cited_by_count":10,"area":null},{"id":"2507.15886","title":"Combining Cost-Constrained Runtime Monitors for AI Safety","created":"2025-07-19","cited_by_count":10,"area":null},{"id":"2512.24661","title":"Do Large Language Models Know What They Are Capable Of?","created":"2025-12-31","cited_by_count":10,"area":null},{"id":"2502.06656","title":"A Frontier AI Risk Management Framework: Bridging the Gap Between Current AI Practices and Established Risk Management","created":"2025-02-10","cited_by_count":8,"area":null},{"id":"2503.04744","title":"Safety Cases: A Scalable Approach to Frontier AI Safety","created":"2025-02-05","cited_by_count":8,"area":null},{"id":"2512.22154","title":"Practical challenges of control monitoring in frontier AI deployments","created":"2025-12-15","cited_by_count":8,"area":null},{"id":"2506.01782","title":"Systematic Hazard Analysis for Frontier AI using STPA","created":"2025-06-02","cited_by_count":6,"area":null},{"id":"2508.14927","title":"AI Testing Should Account for Sophisticated Strategic Behaviour","created":"2025-08-19","cited_by_count":6,"area":null},{"id":"2511.02823","title":"Optimizing AI Agent Attacks With Synthetic Data","created":"2025-11-04","cited_by_count":6,"area":null},{"id":"2507.12872","title":"Manipulation Attacks by Misaligned AI: Risk Analysis and Safety Case Framework","created":"2025-07-17","cited_by_count":5,"area":null},{"id":"2603.02202","title":"Frontier Models Can Take Actions at Low Probabilities","created":"2026-03-02","cited_by_count":5,"area":null},{"id":"2607.07368","title":"Multi-Agent AI Control: Distributed Attacks Hamper Per-Instance Monitors","created":"2026-07-08","cited_by_count":5,"area":null},{"id":"2608.28945","title":"Automated Researchers Can Mitigate Well-characterized Alignment Failures","created":"2026-08-28","cited_by_count":5,"area":null},{"id":"2502.14734","title":"Sentence Smith: Controllable Edits for Evaluating Text Embeddings","created":"2025-02-20","cited_by_count":4,"area":null},{"id":"2506.03755","title":"Misalignment or misuse? The AGI alignment tradeoff","created":"2025-06-04","cited_by_count":4,"area":null},{"id":"2604.22082","title":"Removing Sandbagging in LLMs by Training with Weak Supervision","created":"2026-04-23","cited_by_count":4,"area":null},{"id":"2605.29601","title":"Training Deliberative Monitors for Black-Box Scheming Detection","created":"2026-05-28","cited_by_count":4,"area":null},{"id":"2506.17846","title":"Out of Control -- Why Alignment Needs Formal Control Theory (and an Alignment Control Stack)","created":"2025-06-21","cited_by_count":3,"area":null},{"id":"2507.03525","title":"Limits of Safe AI Deployment: Differentiating Oversight and Control","created":"2025-07-04","cited_by_count":3,"area":null},{"id":"2605.16198","title":"Formal Methods Meet LLMs: Auditing, Monitoring, and Intervention for Compliance of Advanced AI Systems","created":"2026-05-15","cited_by_count":3,"area":null},{"id":"2606.11063","title":"CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs","created":"2026-06-09","cited_by_count":3,"area":null},{"id":"2410.23472","title":"Risk Sources and Risk Management Measures in Support of Standards for General-Purpose AI Systems","created":"2024-10-30","cited_by_count":2,"area":null},{"id":"2507.11544","title":"The Safety Gap Toolkit: Evaluating Hidden Dangers of Open-Source Models","created":"2025-07-08","cited_by_count":2,"area":null},{"id":"2507.21839","title":"Against racing to AGI: Cooperation, deterrence, and catastrophic risks","created":"2025-07-29","cited_by_count":2,"area":null},{"id":"2509.11398","title":"From Firewalls to Frontiers: AI Red-Teaming is a Domain-Specific Evolution of Cyber Red-Teaming","created":"2025-09-14","cited_by_count":2,"area":null},{"id":"2605.01643","title":"AI Alignment via Incentives and Correction","created":"2026-05-02","cited_by_count":2,"area":null},{"id":"2605.06390","title":"Automated alignment is harder than you think","created":"2026-05-07","cited_by_count":2,"area":null},{"id":"2607.19321","title":"ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R&D","created":"2026-07-21","cited_by_count":2,"area":null},{"id":"2501.06370","title":"Towards a Probabilistic Framework for Analyzing and Improving LLM-Enabled Software","created":"2025-01-10","cited_by_count":1,"area":null},{"id":"2510.11235","title":"AI Alignment Strategies from a Risk Perspective: Independent Safety Mechanisms or Shared Failures?","created":"2025-10-13","cited_by_count":1,"area":null},{"id":"2602.07259","title":"Incentive-Aware AI Safety via Strategic Resource Allocation: A Stackelberg Security Games Perspective","created":"2026-02-06","cited_by_count":1,"area":null},{"id":"2604.03968","title":"TraceGuard: Structured Multi-Dimensional Monitoring as a Collusion-Resistant Control Protocol","created":"2026-04-05","cited_by_count":1,"area":null},{"id":"2604.17663","title":"ATLAS: Constitution-Conditioned Latent Geometry and Redistribution Across Language Models and Neural Perturbation Data","created":"2026-04-19","cited_by_count":1,"area":null},{"id":"2605.26047","title":"Retrying vs Resampling in AI Control","created":"2026-05-25","cited_by_count":1,"area":null},{"id":"2605.27117","title":"Position: AI Safety Requires Effective Controllability","created":"2026-05-26","cited_by_count":1,"area":null},{"id":"2606.11998","title":"Bootstrapped Monitoring: Leveraging Transparent Reasoning to Oversee Stronger AI Agents","created":"2026-06-10","cited_by_count":1,"area":null},{"id":"2606.26071","title":"Model Forensics: Investigating Whether Concerning Behavior Reflects Misalignment","created":"2026-06-24","cited_by_count":1,"area":null},{"id":"2607.06596","title":"Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages","created":"2026-07-06","cited_by_count":1,"area":null},{"id":"2609.02852","title":"The Implications of Linguistic Illegibility for LLM Security","created":"2026-09-02","cited_by_count":1,"area":null},{"id":"2609.32390","title":"Reward Hacking and Agent Containment Failure: A Monte Carlo Study Based on the 2026 Hugging Face Incident","created":"2026-09-26","cited_by_count":1,"area":null},{"id":"2507.05587","title":"Towards Measurement Theory for Artificial Intelligence","created":"2025-07-08","cited_by_count":0,"area":null},{"id":"2512.14745","title":"Factor(U,T): Controlling Untrusted AI by Monitoring their Plans","created":"2025-12-12","cited_by_count":0,"area":null},{"id":"2602.20400","title":"Three Concrete Challenges and Two Hopes for the Safety of Unsupervised Elicitation","created":"2026-02-23","cited_by_count":0,"area":null},{"id":"2604.00324","title":"The Persistent Vulnerability of Aligned AI Systems","created":"2026-03-31","cited_by_count":0,"area":null},{"id":"2604.13301","title":"Honeypot Protocol","created":"2026-04-14","cited_by_count":0,"area":null},{"id":"2604.17517","title":"From Admission to Invariants: Measuring Deviation in Delegated Agent Systems","created":"2026-04-19","cited_by_count":0,"area":null},{"id":"2604.24966","title":"Risk Reporting for Developers' Internal AI Model Use","created":"2026-04-27","cited_by_count":0,"area":null},{"id":"2605.08321","title":"LLM Wardens: Mitigating Adversarial Persuasion with Third-Party Conversational Oversight","created":"2026-05-08","cited_by_count":0,"area":null},{"id":"2605.12265","title":"How Useful Is Cross-Domain Generalization for Training LLM Monitors?","created":"2026-05-12","cited_by_count":0,"area":null},{"id":"2605.12963","title":"Sustaining AI safety: Control-theoretic external impossibility, intrinsic necessity, and structural requirements","created":"2026-05-13","cited_by_count":0,"area":null},{"id":"2605.23935","title":"Operationalizing Reconstructive Authority: Runtime Construction, Dependency Resolution, and Execution Gating in Autonomous Agent Systems","created":"2026-04-24","cited_by_count":0,"area":null},{"id":"2606.05330","title":"A Model of Multi-turn Human Persuadability Using Probabilistic Belief Tracing","created":"2026-06-03","cited_by_count":0,"area":null},{"id":"2606.10456","title":"The Distributed Detectability Band Against Marginal-Preserving Attacks","created":"2026-06-09","cited_by_count":0,"area":null},{"id":"2606.12442","title":"Reframing AI Loss of Control: What Control Is, How to Have It, How to Lose It","created":"2026-05-19","cited_by_count":0,"area":null},{"id":"2606.20663","title":"DrugBench: Evaluating AI Control Protocols for Medication Harm Mitigation","created":"2026-06-10","cited_by_count":0,"area":null},{"id":"2607.02510","title":"Online Safety Monitoring for LLMs","created":"2026-07-02","cited_by_count":0,"area":null},{"id":"2607.03478","title":"Demonstrating Generalization Failures via Mixtures of Conditional Policies","created":"2026-07-03","cited_by_count":0,"area":null},{"id":"2607.11983","title":"Removable Defects: The Economics and Limits of Deliberate Deficiency","created":"2026-07-13","cited_by_count":0,"area":null},{"id":"2607.14570","title":"Democratizing Agent Deployment Safety: A Structural Monitoring Approach","created":"2026-07-16","cited_by_count":0,"area":null},{"id":"2608.06353","title":"Resourced Authority A Mechanism-Design Model for Participatory Governance of Deployed AI Agents","created":"2026-08-06","cited_by_count":0,"area":null},{"id":"2608.16190","title":"Decorrelation Is Not Complementarity: Skill, Not Lineage, Governs Trusted-Monitor Ensembles","created":"2026-08-17","cited_by_count":0,"area":null},{"id":"2608.19216","title":"Bounded Sovereignty and the Control Tax: Pricing AI Oversight When the Deployer Does Not Own the Model","created":"2026-07-06","cited_by_count":0,"area":null},{"id":"2609.06140","title":"Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions","created":"2026-09-05","cited_by_count":0,"area":null},{"id":"2609.07162","title":"The Oversight Gap: What LLM Safety Monitors Miss, and Why It Is Not Capability","created":"2026-09-07","cited_by_count":0,"area":null},{"id":"2609.14796","title":"AI Persuasion as a Threat to Human Control","created":"2026-09-13","cited_by_count":0,"area":null},{"id":"2609.22497","title":"The Wisdom of Artificial Deliberative Crowds","created":"2026-09-18","cited_by_count":0,"area":null},{"id":"2609.23954","title":"Djinnlang: Higher-Level Programming by Unambiguous Specification with an LLM in the Compiler","created":"2026-09-21","cited_by_count":0,"area":null},{"id":"2609.30048","title":"Style, Not Self: Surface Cues Explain Zero-Shot Code Attribution by Large Language Models","created":"2026-09-24","cited_by_count":0,"area":null},{"id":"2609.31186","title":"Evolutionary Safety of Recursive Self-Improving AI: Taxonomy, Risk Discovery, and Evaluation","created":"2026-09-25","cited_by_count":0,"area":null},{"id":"2609.32061","title":"Contract monitoring: governing AI via separation of powers","created":"2026-09-25","cited_by_count":0,"area":null},{"id":"2609.32083","title":"When Should a Human Take Back Control? Optimal Delegation under Turbulent AI Risk","created":"2026-09-25","cited_by_count":0,"area":null},{"id":"2609.33871","title":"Population Physics, Population Problems: Safety and Emergence in LLM Societies","created":"2026-09-27","cited_by_count":0,"area":null},{"id":"2609.36049","title":"Improving scalable oversight with co-trained monitors","created":"2026-09-28","cited_by_count":0,"area":null},{"id":"2609.38460","title":"NAQD Env: A benchmark for selective withdrawal in language agents","created":"2026-09-29","cited_by_count":0,"area":null},{"id":"2610.00015","title":"From Proposal to Verified Effect: Praxa, an Evidence-Bound Harness for Governed AI Agent Execution","created":"2026-07-27","cited_by_count":0,"area":null},{"id":"2610.01535","title":"False Floors: LLM Safety Routing Evaluations Break Under Distribution Shift","created":"2026-10-01","cited_by_count":0,"area":null},{"id":"2610.10064","title":"Comprehension Audits to Mitigate Risks from Automated AI Research","created":"2026-10-07","cited_by_count":0,"area":null},{"id":"2610.11012","title":"Distillation for Incrimination and Distillation for Capabilities","created":"2026-10-07","cited_by_count":0,"area":null},{"id":"2610.16280","title":"agent-risk: Risk Assessment for Changes to AI Agents","created":"2026-10-12","cited_by_count":0,"area":null}],"next_cursor":null}