{"total":95,"rows":[{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2502.05174","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","created":"2025-02-07","cited_by_count":77,"area":"agents"},{"id":"2502.08966","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","created":"2025-02-13","cited_by_count":69,"area":"agents"},{"id":"2501.15145","title":"PromptShield: Deployable Detection for Prompt Injection Attacks","created":"2025-01-25","cited_by_count":50,"area":"safety"},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2505.18333","title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","created":"2025-05-23","cited_by_count":36,"area":"safety"},{"id":"2601.08012","title":"Towards Verifiably Safe Tool Use for LLM Agents","created":"2026-01-12","cited_by_count":36,"area":"agents"},{"id":"2505.04806","title":"Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMs","created":"2025-05-07","cited_by_count":34,"area":"safety"},{"id":"2507.07974","title":"Defending Against Prompt Injection With a Few DefensiveTokens","created":"2025-07-10","cited_by_count":33,"area":"safety"},{"id":"2506.23844","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","created":"2025-06-30","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2510.14005","title":"PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Features","created":"2025-10-15","cited_by_count":20,"area":"safety"},{"id":"2606.07131","title":"MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills","created":"2026-06-05","cited_by_count":19,"area":"agents"},{"id":"2601.05755","title":"VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit","created":"2026-01-09","cited_by_count":17,"area":"agents"},{"id":"2512.12594","title":"ceLLMate: Sandboxing Browser AI Agents","created":"2025-12-14","cited_by_count":16,"area":"safety"},{"id":"2603.13026","title":"PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses","created":"2026-03-13","cited_by_count":16,"area":"safety"},{"id":"2509.22040","title":"\"Your AI, My Shell\": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors","created":"2025-09-26","cited_by_count":15,"area":"agents"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2505.00976","title":"Attack and defense techniques in large language models: A survey and new perspectives","created":"2025-05-02","cited_by_count":14,"area":null},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2602.03792","title":"WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents","created":"2026-02-03","cited_by_count":11,"area":"agents"},{"id":"2505.13348","title":"Investigating the Vulnerability of LLM-as-a-Judge Architectures to Prompt-Injection Attacks","created":"2025-05-19","cited_by_count":10,"area":null},{"id":"2506.12880","title":"Universal Jailbreak Suffixes Are Strong Attention Hijackers","created":"2025-06-15","cited_by_count":10,"area":"safety"},{"id":"2508.20412","title":"MindGuard: Intrinsic Decision Inspection for Securing LLM Agents Against Metadata Poisoning","created":"2025-08-28","cited_by_count":10,"area":"agents"},{"id":"2512.08417","title":"Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs","created":"2025-12-09","cited_by_count":10,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2602.20708","title":"ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction","created":"2026-02-24","cited_by_count":10,"area":"agents"},{"id":"2512.00966","title":"Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysis","created":"2025-11-30","cited_by_count":9,"area":"agents"},{"id":"2603.00131","title":"Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems","created":"2026-02-23","cited_by_count":9,"area":"lr"},{"id":"2603.30016","title":"Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks","created":"2026-03-31","cited_by_count":9,"area":"agents"},{"id":"2511.12710","title":"Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs","created":"2025-11-16","cited_by_count":8,"area":"safety"},{"id":"2603.12230","title":"Security Considerations for Artificial Intelligence Agents","created":"2026-03-12","cited_by_count":8,"area":null},{"id":"2606.23416","title":"Detecting Malicious Agent Skills in the Wild using Attention","created":"2026-06-22","cited_by_count":8,"area":"agents"},{"id":"2508.03793","title":"AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruption","created":"2025-08-05","cited_by_count":7,"area":"rag"},{"id":"2604.22888","title":"RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents","created":"2026-04-24","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2505.14368","title":"From ASR to ASP: Evaluating Prompt Attack Vulnerabilities Against Open-Source LLMs","created":"2025-05-20","cited_by_count":6,"area":"safety"},{"id":"2604.01194","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","created":"2026-04-01","cited_by_count":6,"area":"safety"},{"id":"2412.13435","title":"Lightweight Safety Classification Using Pruned Language Models","created":"2024-12-18","cited_by_count":5,"area":"safety"},{"id":"2602.13597","title":"AlignSentinel: Alignment-Aware Detection of Prompt Injection Attacks","created":"2026-02-14","cited_by_count":5,"area":"safety"},{"id":"2604.16966","title":"Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning","created":"2026-04-18","cited_by_count":5,"area":"agents"},{"id":"2603.06588","title":"vLLM Hook v0: A Plug-in for Programming Model Internals on vLLM","created":"2026-02-02","cited_by_count":4,"area":"safety"},{"id":"2605.24312","title":"Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailment","created":"2026-05-23","cited_by_count":4,"area":"rag"},{"id":"2505.15795","title":"Reverse Engineering Human Preferences with Reinforcement Learning","created":"2025-05-21","cited_by_count":3,"area":"alignment"},{"id":"2507.15613","title":"Multi-Stage Prompt Inference Attacks on Enterprise LLM Systems","created":"2025-07-21","cited_by_count":3,"area":null},{"id":"2509.20639","title":"A Framework for Rapidly Developing and Deploying Protection Against Large Language Model Attacks","created":"2025-09-25","cited_by_count":3,"area":null},{"id":"2607.12624","title":"PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis","created":"2026-07-14","cited_by_count":3,"area":"agents"},{"id":"2506.07356","title":"Safety-Aligned Weights Are Not Enough: Refusal-Teacher-Guided Finetuning Enhances Safety and Downstream Performance under Harmful Finetuning Attacks","created":"2025-06-09","cited_by_count":2,"area":"safety"},{"id":"2510.19462","title":"AegisMCP: Online Graph Intrusion Detection for Tool-Augmented LLMs on Edge Devices","created":"2025-10-22","cited_by_count":2,"area":"agents"},{"id":"2606.30783","title":"Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense","created":"2026-06-29","cited_by_count":2,"area":"safety"},{"id":"2608.08027","title":"BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes","created":"2026-08-08","cited_by_count":2,"area":"safety"},{"id":"2608.08029","title":"Do All LLMs Know When They're Being Harmful? A Reproducibility Study of Latent-Space Safety Probes Across Model Families","created":"2026-08-08","cited_by_count":2,"area":"safety"},{"id":"2608.19982","title":"COPA: Continual Preference Optimization for Adaptive Prompt Injection Defense","created":"2026-08-20","cited_by_count":2,"area":"alignment"},{"id":"2509.10682","title":"LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systems","created":"2025-09-12","cited_by_count":1,"area":null},{"id":"2510.00586","title":"Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors","created":"2025-10-01","cited_by_count":1,"area":"rag"},{"id":"2510.04528","title":"Unified Threat Detection and Mitigation Framework (UTDMF): Combating Prompt Injection, Deception, and Bias in Enterprise-Scale Transformers","created":"2025-10-06","cited_by_count":1,"area":"safety"},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2601.10294","title":"Reasoning Hijacking: The Fragility of Reasoning Alignment in Large Language Models","created":"2026-01-15","cited_by_count":1,"area":"safety"},{"id":"2602.07104","title":"Extended to Reality: Prompt Injection in 3D Environments","created":"2026-02-06","cited_by_count":1,"area":"mllm"},{"id":"2602.09757","title":"Towards Poisoning Robustness Certification for Natural Language Generation","created":"2026-02-10","cited_by_count":1,"area":null},{"id":"2602.10481","title":"Protecting Context and Prompts: Deterministic Security for Non-Deterministic AI","created":"2026-02-11","cited_by_count":1,"area":"safety"},{"id":"2608.05108","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2608.05430","title":"Robust Context-Aware Detection of Malicious Instructions in Text","created":"2026-08-05","cited_by_count":1,"area":"safety"},{"id":"2608.22248","title":"Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds","created":"2026-08-23","cited_by_count":1,"area":"safety"},{"id":"2609.19472","title":"Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models","created":"2026-09-16","cited_by_count":1,"area":"safety"},{"id":"2511.21438","title":"Conversational No-code, Multi-agentic Disease Module Identification and Drug Repurposing Prediction with ChatDRex","created":"2025-11-26","cited_by_count":0,"area":"agents"},{"id":"2511.21752","title":"Semantics as a Shield: Label Disguise Defense (LDD) against Prompt Injection in LLM Sentiment Classification","created":"2025-11-23","cited_by_count":0,"area":"safety"},{"id":"2601.15801","title":"Attributing and Exploiting Safety Vectors through Global Optimization in Large Language Models","created":"2026-01-22","cited_by_count":0,"area":"safety"},{"id":"2602.04856","title":"CoT is Not the Chain of Truth: An Empirical Internal Analysis of Reasoning LLMs for Fake News Generation","created":"2026-02-04","cited_by_count":0,"area":"lr"},{"id":"2602.16520","title":"Recursive language models for jailbreak detection: a procedural defense for tool-augmented agents","created":"2026-02-18","cited_by_count":0,"area":"agents"},{"id":"2603.10163","title":"Compatibility at a Cost: Systematic Discovery and Exploitation of MCP Clause-Compliance Vulnerabilities","created":"2026-03-10","cited_by_count":0,"area":"agents"},{"id":"2603.17123","title":"Security Assessment and Mitigation Strategies for Large Language Models: A Comprehensive Defensive Framework","created":"2026-03-17","cited_by_count":0,"area":null},{"id":"2604.09056","title":"Conversations Risk Detection LLMs in Financial Agents via Multi-Stage Generative Rollout","created":"2026-04-10","cited_by_count":0,"area":"agents"},{"id":"2605.01078","title":"A Sentence Relation-Based Approach to Sanitizing Malicious Instructions","created":"2026-05-01","cited_by_count":0,"area":"rag"},{"id":"2605.19159","title":"On the Geometric Limits of Transformer Defenses against Obfuscation Attacks: Latent Embedding Collapse & Performance Robustness Gap","created":"2026-05-18","cited_by_count":0,"area":"safety"},{"id":"2606.21732","title":"Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agents","created":"2026-06-19","cited_by_count":0,"area":"agents"},{"id":"2607.18622","title":"CPInj: Uncovering Prompt Injection Risks in Textual Collaborative Prompt Optimization","created":"2026-07-21","cited_by_count":0,"area":"safety"},{"id":"2607.19396","title":"CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs","created":"2026-07-03","cited_by_count":0,"area":"safety"},{"id":"2608.09577","title":"ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization","created":"2026-08-10","cited_by_count":0,"area":"agents"},{"id":"2608.09624","title":"Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks","created":"2026-08-10","cited_by_count":0,"area":"safety"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2609.05911","title":"Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents","created":"2026-09-05","cited_by_count":0,"area":"agents"},{"id":"2609.08646","title":"Combating Instruction Conflict via Energy-Driven Latent Conflict Detection","created":"2026-09-08","cited_by_count":0,"area":null},{"id":"2609.16694","title":"Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives","created":"2026-09-15","cited_by_count":0,"area":"agents"},{"id":"2609.21515","title":"ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor","created":"2026-09-18","cited_by_count":0,"area":"safety"},{"id":"2609.22510","title":"Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents","created":"2026-09-18","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.36570","title":"CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2609.37040","title":"Selecting The Most Informative Tokens in Natural Language Autoencoders","created":"2026-09-29","cited_by_count":0,"area":null},{"id":"2610.05163","title":"Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection","created":"2026-10-04","cited_by_count":0,"area":"safety"},{"id":"2610.15883","title":"What the Model Cannot See: Covert and Provable Text Invisibility in LLMs","created":"2026-10-11","cited_by_count":0,"area":"safety"},{"id":"2610.18408","title":"Prompt-Injection Probes Learn the Conversation, Not Just the Injection","created":"2026-10-13","cited_by_count":0,"area":"safety"},{"id":"2610.19452","title":"Are You Reading the Right Thing? Rethinking Internal Signals for Prompt-Injection Detection","created":"2026-10-14","cited_by_count":0,"area":"safety"}],"next_cursor":null}