{"total":41,"rows":[{"id":"2505.23643","title":"Securing AI Agents with Information-Flow Control","created":"2025-05-29","cited_by_count":121,"area":null},{"id":"2402.18540","title":"Keeping LLMs Aligned After Fine-tuning: The Crucial Role of Prompt Templates","created":"2024-02-28","cited_by_count":96,"area":null},{"id":"2403.06833","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","created":"2024-03-11","cited_by_count":81,"area":null},{"id":"2504.20984","title":"ACE: A Security Architecture for LLM-Integrated App Systems","created":"2025-04-29","cited_by_count":55,"area":null},{"id":"2406.18382","title":"Adversarial Search Engine Optimization for Large Language Models","created":"2024-06-26","cited_by_count":40,"area":null},{"id":"2502.15851","title":"Control Illusion: The Failure of Instruction Hierarchies in Large Language Models","created":"2025-02-21","cited_by_count":33,"area":null},{"id":"2404.06921","title":"GoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Applications","created":"2024-04-10","cited_by_count":23,"area":null},{"id":"2504.05408","title":"Frontier AI's Impact on the Cybersecurity Landscape","created":"2025-04-07","cited_by_count":21,"area":null},{"id":"2505.12025","title":"Spotlight Your Instructions: Instruction-following with Dynamic Attention Steering","created":"2025-05-17","cited_by_count":21,"area":null},{"id":"2601.07185","title":"Defenses Against Prompt Attacks Learn Surface Heuristics","created":"2026-01-12","cited_by_count":11,"area":null},{"id":"2603.12230","title":"Security Considerations for Artificial Intelligence Agents","created":"2026-03-12","cited_by_count":8,"area":null},{"id":"2501.07927","title":"Gandalf the Red: Adaptive Security for LLMs","created":"2025-01-14","cited_by_count":7,"area":null},{"id":"2505.00626","title":"The Illusion of Role Separation: Hidden Shortcuts in LLM Role Learning (and How to Fix Them)","created":"2025-05-01","cited_by_count":6,"area":null},{"id":"2603.17170","title":"Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices","created":"2026-03-17","cited_by_count":5,"area":null},{"id":"2605.18991","title":"Agent Security is a Systems Problem","created":"2026-05-18","cited_by_count":5,"area":null},{"id":"2606.22916","title":"Intent-Governed Tool Authorization for AI Agents","created":"2026-06-22","cited_by_count":5,"area":null},{"id":"2509.21884","title":"You Can't Steal Nothing: Mitigating Prompt Leakages in LLMs via System Vectors","created":"2025-09-26","cited_by_count":4,"area":null},{"id":"2604.19657","title":"An AI Agent Execution Environment to Safeguard User Data","created":"2026-04-21","cited_by_count":4,"area":null},{"id":"2606.30383","title":"Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents","created":"2026-06-29","cited_by_count":3,"area":null},{"id":"2405.19832","title":"AI Safety: A Climb To Armageddon?","created":"2024-05-30","cited_by_count":2,"area":null},{"id":"2606.20510","title":"Efficient and Sound Probabilistic Verification for AI Agents","created":"2026-06-18","cited_by_count":2,"area":null},{"id":"2607.25364","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","created":"2026-07-28","cited_by_count":2,"area":null},{"id":"2608.28327","title":"Layered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layers","created":"2026-08-28","cited_by_count":2,"area":null},{"id":"2606.04109","title":"Discourse-Role Labels as Presentation-Time Variables for Context Use in Language Models","created":"2026-06-02","cited_by_count":1,"area":null},{"id":"2608.21230","title":"Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking","created":"2026-08-21","cited_by_count":1,"area":null},{"id":"2512.03720","title":"Context-Aware Hierarchical Learning: A Two-Step Paradigm towards Safer LLMs","created":"2025-12-03","cited_by_count":0,"area":null},{"id":"2603.17100","title":"An End-to-End Framework for Functionality-Embedded Provenance Graph Construction and Threat Interpretation","created":"2026-03-17","cited_by_count":0,"area":null},{"id":"2605.09737","title":"System-Prompt Anchoring with Cross-Attention Layers","created":"2026-05-10","cited_by_count":0,"area":null},{"id":"2605.12876","title":"Certified Robustness under Heterogeneous Perturbations via Hybrid Randomized Smoothing","created":"2026-05-13","cited_by_count":0,"area":null},{"id":"2605.30521","title":"Evaluating using Mock Tool Calls to Quarantine Untrusted Prompt Inputs","created":"2026-05-28","cited_by_count":0,"area":null},{"id":"2606.18120","title":"Structural Role Injection in Handlebars-Templated LLM Prompts: Triple-Brace Interpolation, Delimiter Family, and the Limits of HTML Auto-Escaping","created":"2026-06-16","cited_by_count":0,"area":null},{"id":"2607.05484","title":"SHARC: SHAP-Based Interpretability in Machine Learning Risk Models for Regulatory Capital under ICAAP and CCAR","created":"2026-07-06","cited_by_count":0,"area":null},{"id":"2607.16660","title":"From Adoption to Deployment: A Qualitative Study on AI Integration in Software Development Practice","created":"2026-07-18","cited_by_count":0,"area":null},{"id":"2609.13725","title":"IBBench-Light: A Paired Evaluation of Task-Conditioned Responses to External Directives","created":"2026-09-12","cited_by_count":0,"area":null},{"id":"2609.16984","title":"Nameless Tokenization: A Lossless Tokenizer-Level Defense Against Control-Token Forgery in Open-Weight LLMs","created":"2026-09-15","cited_by_count":0,"area":null},{"id":"2609.26072","title":"Policy-Backed Selective Regeneration under Tainted Inter-Agent Communication","created":"2026-08-02","cited_by_count":0,"area":null},{"id":"2609.32915","title":"AgentTell: Behavioural Side-Channel Leakage in Browser-Use Agents","created":"2026-09-26","cited_by_count":0,"area":null},{"id":"2610.01756","title":"SoK: Decentralized Agent Economic Infrastructure","created":"2026-10-01","cited_by_count":0,"area":null},{"id":"2610.04210","title":"Can LLMs Separate Pasted Artifacts from User Speech? Absorption at Unmarked Prompt Seams","created":"2026-10-03","cited_by_count":0,"area":null},{"id":"2610.05139","title":"Hidden in the Comments: A Context-Injection Attack Surface in Code LLMs","created":"2026-10-04","cited_by_count":0,"area":null},{"id":"2610.17820","title":"Same Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety Classifiers","created":"2026-10-13","cited_by_count":0,"area":null}],"next_cursor":null}