{"total":72,"rows":[{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2505.23643","title":"Securing AI Agents with Information-Flow Control","created":"2025-05-29","cited_by_count":121,"area":null},{"id":"2602.20156","title":"Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks","created":"2026-02-23","cited_by_count":90,"area":"agents"},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73,"area":"agents"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2502.01822","title":"Firewalls to Secure Dynamic LLM Agentic Networks","created":"2025-02-03","cited_by_count":36,"area":"agents"},{"id":"2510.12252","title":"PromptLocate: Localizing Prompt Injection Attacks","created":"2025-10-14","cited_by_count":28,"area":"safety"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2410.22932","title":"Multi-Agent Large Language Models for Conversational Task-Solving","created":"2024-10-30","cited_by_count":24,"area":"agents"},{"id":"2503.10566","title":"ASIDE: Architectural Separation of Instructions and Data in Language Models","created":"2025-03-13","cited_by_count":24,"area":"safety"},{"id":"2506.09956","title":"LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge","created":"2025-06-11","cited_by_count":21,"area":"safety"},{"id":"2406.07954","title":"Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competition","created":"2024-06-12","cited_by_count":20,"area":null},{"id":"2510.14005","title":"PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Features","created":"2025-10-15","cited_by_count":20,"area":"safety"},{"id":"2507.16372","title":"Depth Gives a False Sense of Privacy: LLM Internal States Inversion","created":"2025-07-22","cited_by_count":17,"area":null},{"id":"2601.07072","title":"Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems","created":"2026-01-11","cited_by_count":16,"area":"safety"},{"id":"2603.13026","title":"PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses","created":"2026-03-13","cited_by_count":16,"area":"safety"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2411.19876","title":"LUMIA: Linear probing for Unimodal and MultiModal Membership Inference Attacks leveraging internal LLM states","created":"2024-11-29","cited_by_count":10,"area":"safety"},{"id":"2507.02735","title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","created":"2025-07-03","cited_by_count":10,"area":"agents"},{"id":"2512.08417","title":"Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs","created":"2025-12-09","cited_by_count":10,"area":"agents"},{"id":"2602.11416","title":"Optimizing Agent Planning for Security and Autonomy","created":"2026-02-11","cited_by_count":10,"area":"safety"},{"id":"2512.00966","title":"Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysis","created":"2025-11-30","cited_by_count":9,"area":"agents"},{"id":"2601.09625","title":"The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism","created":"2026-01-14","cited_by_count":9,"area":"safety"},{"id":"2410.09097","title":"Recent advancements in LLM Red-Teaming: Techniques, Defenses, and Ethical Considerations","created":"2024-10-09","cited_by_count":8,"area":"safety"},{"id":"2603.12230","title":"Security Considerations for Artificial Intelligence Agents","created":"2026-03-12","cited_by_count":8,"area":null},{"id":"2606.23416","title":"Detecting Malicious Agent Skills in the Wild using Attention","created":"2026-06-22","cited_by_count":8,"area":"agents"},{"id":"2512.05745","title":"ARGUS: Defending Against Multimodal Indirect Prompt Injection via Steering Instruction-Following Behavior","created":"2025-12-05","cited_by_count":7,"area":"mllm"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2604.01194","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","created":"2026-04-01","cited_by_count":6,"area":"safety"},{"id":"2505.20435","title":"The Shape of Adversarial Influence: Characterizing LLM Latent Spaces with Persistent Homology","created":"2025-05-26","cited_by_count":5,"area":"safety"},{"id":"2602.13597","title":"AlignSentinel: Alignment-Aware Detection of Prompt Injection Attacks","created":"2026-02-14","cited_by_count":5,"area":"safety"},{"id":"2502.16174","title":"Efficient LLM Moderation with Multi-Layer Latent Prototypes","created":"2025-02-22","cited_by_count":4,"area":"safety"},{"id":"2512.16059","title":"ContextLeak: Auditing Leakage in Private In-Context Learning Methods","created":"2025-12-18","cited_by_count":4,"area":null},{"id":"2506.15617","title":"The Compositional Architecture of Regret in Large Language Models","created":"2025-06-18","cited_by_count":3,"area":null},{"id":"2509.14608","title":"Enterprise AI Must Enforce Participant-Aware Access Control","created":"2025-09-18","cited_by_count":3,"area":null},{"id":"2504.21228","title":"CachePrune: Teaching LLMs What Not to Follow via KV-Cache Editing","created":"2025-04-29","cited_by_count":2,"area":"inference"},{"id":"2510.26486","title":"LINK-KG: LLM-Driven Coreference-Resolved Knowledge Graphs for Human Smuggling Networks","created":"2025-10-30","cited_by_count":2,"area":null},{"id":"2510.26512","title":"Inside CORE-KG: Evaluating Structured Prompting and Coreference Resolution for Knowledge Graphs","created":"2025-10-30","cited_by_count":2,"area":null},{"id":"2605.12233","title":"No More, No Less: Task Alignment in Terminal Agents","created":"2026-05-12","cited_by_count":2,"area":null},{"id":"2606.30783","title":"Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense","created":"2026-06-29","cited_by_count":2,"area":"safety"},{"id":"2607.22024","title":"Agent Security Needs Redefinition through a Holistic Framework","created":"2026-07-24","cited_by_count":2,"area":"safety"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2609.06972","title":"AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2609.15994","title":"Latent Undertow: How Ordinary Typos Break Probes","created":"2026-07-08","cited_by_count":2,"area":null},{"id":"2505.00843","title":"OET: Optimization-based prompt injection Evaluation Toolkit","created":"2025-05-01","cited_by_count":1,"area":"safety"},{"id":"2509.05608","title":"BinaryShield: Cross-Service Threat Intelligence in LLM Services using Privacy-Preserving Fingerprints","created":"2025-09-06","cited_by_count":1,"area":null},{"id":"2512.15979","title":"OLAF: Towards Robust LLM-Based Annotation Framework in Empirical Software Engineering","created":"2025-12-17","cited_by_count":1,"area":null},{"id":"2602.00750","title":"Bypassing Prompt Injection Detectors through Evasive Injections","created":"2026-01-31","cited_by_count":1,"area":"safety"},{"id":"2602.04813","title":"Agentic AI in Healthcare & Medicine: A Seven-Dimensional Taxonomy for Empirical Evaluation of LLM-based Agents","created":"2026-02-04","cited_by_count":1,"area":"agents"},{"id":"2607.06807","title":"When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems","created":"2026-07-07","cited_by_count":1,"area":"agents"},{"id":"2608.24977","title":"Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation","created":"2026-08-25","cited_by_count":1,"area":"rag"},{"id":"2608.28411","title":"LongPIBench: A Long-Context Benchmark for Prompt Injection","created":"2026-08-28","cited_by_count":1,"area":"safety"},{"id":"2610.05295","title":"Readable Before Actionable: Causal Tracing of Indirect Prompt Injection","created":"2026-10-04","cited_by_count":1,"area":"agents"},{"id":"2408.00925","title":"WHITE PAPER: A Brief Exploration of Data Exfiltration using GCG Suffixes","created":"2024-08-01","cited_by_count":0,"area":null},{"id":"2605.10763","title":"MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study","created":"2026-05-11","cited_by_count":0,"area":"agents"},{"id":"2606.21843","title":"Measuring What Persists: Conditioning Mechanisms and a Geometric Framework for AI Agent Identity","created":"2026-06-20","cited_by_count":0,"area":null},{"id":"2608.00672","title":"From Chasing Ghosts to Missed Attacks: Perspectives and Perceptions of SOC Practitioners on LLM Integration, Risks, and Readiness","created":"2026-08-01","cited_by_count":0,"area":null},{"id":"2608.27954","title":"Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification","created":"2026-08-28","cited_by_count":0,"area":null},{"id":"2609.05535","title":"Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails","created":"2026-09-02","cited_by_count":0,"area":"mllm"},{"id":"2609.10892","title":"DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents","created":"2026-09-09","cited_by_count":0,"area":"agents"},{"id":"2609.14003","title":"Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control","created":"2026-09-12","cited_by_count":0,"area":"agents"},{"id":"2609.20080","title":"A Proposal for an Agentic AI Architecture to Support Multi-Domain Decision-Making in the Brazilian Armed Forces","created":"2026-09-17","cited_by_count":0,"area":"agents"},{"id":"2609.36556","title":"MAADBench: The Refreshable Paradigm for Anomaly Detection in Multi-Agent Systems","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2609.36570","title":"CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2610.02413","title":"Prompted to Discriminate: Generalizing Malicious-Input Probes in the Wild","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.04210","title":"Can LLMs Separate Pasted Artifacts from User Speech? Absorption at Unmarked Prompt Seams","created":"2026-10-03","cited_by_count":0,"area":null},{"id":"2610.05163","title":"Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection","created":"2026-10-04","cited_by_count":0,"area":"safety"},{"id":"2610.07089","title":"Towards a Unified Misuse Monitoring Benchmark","created":"2026-10-05","cited_by_count":0,"area":"agents"},{"id":"2610.18408","title":"Prompt-Injection Probes Learn the Conversation, Not Just the Injection","created":"2026-10-13","cited_by_count":0,"area":"safety"}],"next_cursor":null}