{"total":181,"rows":[{"id":"2507.11473","title":"Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety","created":"2025-07-15","cited_by_count":249,"area":"lr"},{"id":"2504.02495","title":"Inference-Time Scaling for Generalist Reward Modeling","created":"2025-04-03","cited_by_count":239,"area":"lr"},{"id":"2510.05179","title":"Agentic Misalignment: How LLMs Could Be Insider Threats","created":"2025-10-05","cited_by_count":158,"area":"agents"},{"id":"2510.14276","title":"Qwen3Guard Technical Report","created":"2025-10-16","cited_by_count":155,"area":"safety"},{"id":"2504.13203","title":"X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents","created":"2025-04-15","cited_by_count":125,"area":"agents"},{"id":"2502.02542","title":"OverThink: Slowdown Attacks on Reasoning LLMs","created":"2025-02-04","cited_by_count":96,"area":"lr"},{"id":"2503.24370","title":"Effectively Controlling Reasoning Models through Thinking Intervention","created":"2025-03-31","cited_by_count":65,"area":"lr"},{"id":"2510.20270","title":"ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases","created":"2025-10-23","cited_by_count":65,"area":null},{"id":"2506.10805","title":"Detecting High-Stakes Interactions with Activation Probes","created":"2025-06-12","cited_by_count":53,"area":null},{"id":"2601.11516","title":"Building Production-Ready Probes For Gemini","created":"2026-01-16","cited_by_count":47,"area":"safety"},{"id":"2601.04603","title":"Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks","created":"2026-01-08","cited_by_count":41,"area":"safety"},{"id":"2509.03531","title":"Real-Time Detection of Hallucinated Entities in Long-Form Generation","created":"2025-08-26","cited_by_count":34,"area":null},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2506.10949","title":"Monitoring Decomposition Attacks in LLMs with Lightweight Sequential Monitors","created":"2025-06-12","cited_by_count":25,"area":"safety"},{"id":"2506.14261","title":"RL-Obfuscation: Can Language Models Learn to Evade Latent-Space Monitors?","created":"2025-06-17","cited_by_count":24,"area":null},{"id":"2506.14922","title":"FORTRESS: Frontier Risk Evaluation for National Security and Public Safety","created":"2025-06-17","cited_by_count":24,"area":"safety"},{"id":"2506.09996","title":"From Judgment to Interference: Early Stopping LLM Harmful Outputs via Streaming Content Monitoring","created":"2025-06-11","cited_by_count":22,"area":"alignment"},{"id":"2506.10597","title":"SoK: Evaluating Jailbreak Guardrails for Large Language Models","created":"2025-06-12","cited_by_count":21,"area":"alignment"},{"id":"2505.14633","title":"Will AI Tell Lies to Save Sick Children? Litmus-Testing AI Values Prioritization with AIRiskDilemmas","created":"2025-05-20","cited_by_count":18,"area":null},{"id":"2507.19060","title":"PurpCode: Reasoning for Safer Code Generation","created":"2025-07-25","cited_by_count":18,"area":"lr"},{"id":"2508.07646","title":"Multi-Turn Jailbreaks Are Simpler Than They Seem","created":"2025-08-11","cited_by_count":17,"area":"safety"},{"id":"2601.02671","title":"Extracting books from production language models","created":"2026-01-06","cited_by_count":17,"area":"safety"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2502.02260","title":"Position: Adversarial ML for LLMs Is Not Making Any Progress","created":"2025-02-04","cited_by_count":15,"area":null},{"id":"2603.10521","title":"IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMs","created":"2026-03-11","cited_by_count":15,"area":"safety"},{"id":"2506.24068","title":"STACK: Adversarial Attacks on LLM Safeguard Pipelines","created":"2025-06-30","cited_by_count":14,"area":null},{"id":"2507.10587","title":"Anthropomimetic Uncertainty: What Verbalized Uncertainty in Language Models is Missing","created":"2025-07-11","cited_by_count":14,"area":null},{"id":"2604.11806","title":"Detecting Safety Violations Across Many Agent Traces","created":"2026-04-13","cited_by_count":14,"area":null},{"id":"2505.24445","title":"Learning Safety Constraints for Large Language Models","created":"2025-05-30","cited_by_count":13,"area":"safety"},{"id":"2506.12707","title":"SecurityLingua: Efficient Defense of LLM Jailbreak Attacks via Security-Aware Prompt Compression","created":"2025-06-15","cited_by_count":13,"area":"inference"},{"id":"2510.07686","title":"Stress-Testing Model Specs Reveals Character Differences among Language Models","created":"2025-10-09","cited_by_count":13,"area":null},{"id":"2601.21571","title":"Shaping capabilities with token-level data filtering","created":"2026-01-29","cited_by_count":13,"area":null},{"id":"2505.16947","title":"MixAT: Combining Continuous and Discrete Adversarial Training for LLMs","created":"2025-05-22","cited_by_count":11,"area":"safety"},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2504.20965","title":"AegisLLM: Scaling Agentic Systems for Self-Reflective Defense in LLM Security","created":"2025-04-29","cited_by_count":10,"area":"agents"},{"id":"2507.02956","title":"A Representation Engineering Perspective on the Effectiveness of Multi-Turn Jailbreaks","created":"2025-06-29","cited_by_count":10,"area":"safety"},{"id":"2507.15886","title":"Combining Cost-Constrained Runtime Monitors for AI Safety","created":"2025-07-19","cited_by_count":10,"area":null},{"id":"2510.08240","title":"The Alignment Waltz: Jointly Training Agents to Collaborate for Safety","created":"2025-10-09","cited_by_count":10,"area":"agents"},{"id":"2603.00829","title":"Constitutional Black-Box Monitoring for Scheming in LLM Agents","created":"2026-02-28","cited_by_count":10,"area":"agents"},{"id":"2603.01246","title":"Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders","created":"2026-03-01","cited_by_count":10,"area":"alignment"},{"id":"2505.18907","title":"Stronger Enforcement of Instruction Hierarchy via Augmented Intermediate Representations","created":"2025-05-25","cited_by_count":9,"area":"safety"},{"id":"2509.03728","title":"PersonaTeaming: Exploring How Introducing Personas Can Improve Automated AI Red-Teaming","created":"2025-09-03","cited_by_count":9,"area":"safety"},{"id":"2511.17408","title":"The Impact of Off-Policy Training Data on Probe Generalisation","created":"2025-11-21","cited_by_count":9,"area":null},{"id":"2604.22167","title":"Estimating Tail Risks in Language Model Output Distributions","created":"2026-04-24","cited_by_count":9,"area":"safety"},{"id":"2502.11910","title":"Adversarial Alignment for LLMs Requires Simpler, Reproducible, and More Measurable Objectives","created":"2025-02-17","cited_by_count":8,"area":null},{"id":"2506.06414","title":"Benchmarking Misuse Mitigation Against Covert Adversaries","created":"2025-06-06","cited_by_count":8,"area":null},{"id":"2510.09714","title":"All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Language","created":"2025-10-10","cited_by_count":8,"area":"lr"},{"id":"2512.22154","title":"Practical challenges of control monitoring in frontier AI deployments","created":"2025-12-15","cited_by_count":8,"area":null},{"id":"2602.15001","title":"Boundary Point Jailbreaking of Black-Box LLMs","created":"2026-02-16","cited_by_count":8,"area":"safety"},{"id":"2503.05628","title":"Superintelligence Strategy: Expert Version","created":"2025-03-07","cited_by_count":7,"area":null},{"id":"2509.17938","title":"D-REX: A Benchmark for Detecting Deceptive Reasoning in Large Language Models","created":"2025-09-22","cited_by_count":7,"area":"lr"},{"id":"2510.01529","title":"Bypassing Prompt Guards in Production with Controlled-Release Prompting","created":"2025-10-02","cited_by_count":7,"area":null},{"id":"2510.21910","title":"Adversarial D\\'ej\\`a Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attacks","created":"2025-10-24","cited_by_count":7,"area":"safety"},{"id":"2601.05445","title":"Knowledge-Driven Multi-Turn Jailbreaking on Large Language Models","created":"2026-01-09","cited_by_count":7,"area":"safety"},{"id":"2601.07087","title":"When Should We Introduce Safety Interventions During Pretraining?","created":"2026-01-11","cited_by_count":7,"area":"safety"},{"id":"2506.07452","title":"When Style Breaks Safety: Defending LLMs Against Superficial Style Alignment","created":"2025-06-09","cited_by_count":6,"area":"safety"},{"id":"2506.12913","title":"Jailbreak Transferability Emerges from Shared Representations","created":"2025-06-15","cited_by_count":6,"area":"safety"},{"id":"2507.17075","title":"LoRA is All You Need for Safety Alignment of Reasoning LLMs","created":"2025-07-22","cited_by_count":6,"area":"lr"},{"id":"2509.03787","title":"Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domain","created":"2025-09-04","cited_by_count":6,"area":"rag"},{"id":"2509.06982","title":"CARE: Decoding Time Safety Alignment via Rollback and Introspection Intervention","created":"2025-09-01","cited_by_count":6,"area":"alignment"},{"id":"2602.22303","title":"Training Agents to Self-Report Misbehavior","created":"2026-02-25","cited_by_count":6,"area":"agents"},{"id":"2504.19440","title":"JailbreaksOverTime: Detecting Jailbreak Attacks Under Distribution Shift","created":"2025-04-28","cited_by_count":5,"area":"safety"},{"id":"2502.16174","title":"Efficient LLM Moderation with Multi-Layer Latent Prototypes","created":"2025-02-22","cited_by_count":4,"area":"safety"},{"id":"2505.13500","title":"Noise Injection Systemically Degrades Large Language Model Safety Guardrails","created":"2025-05-16","cited_by_count":4,"area":"safety"},{"id":"2505.18003","title":"An Example Safety Case for Safeguards Against Misuse","created":"2025-05-23","cited_by_count":4,"area":null},{"id":"2506.17299","title":"Toward Principled LLM Safety Testing: Solving the Jailbreak Oracle Problem","created":"2025-06-17","cited_by_count":4,"area":"safety"},{"id":"2508.09218","title":"Towards Effective MLLM Jailbreaking Through Balanced On-Topicness and OOD-Intensity","created":"2025-08-11","cited_by_count":4,"area":"mllm"},{"id":"2603.05786","title":"Proof-of-Guardrail in AI Agents and What (Not) to Trust from It","created":"2026-03-06","cited_by_count":4,"area":null},{"id":"2604.08169","title":"Activation Steering for Aligned Open-ended Generation without Sacrificing Coherence","created":"2026-04-09","cited_by_count":4,"area":"safety"},{"id":"2605.00583","title":"Jailbreaking Vision-Language Models Through the Visual Modality","created":"2026-05-01","cited_by_count":4,"area":"mllm"},{"id":"2605.07982","title":"GLiGuard: Schema-Conditioned Classification for LLM Safeguard","created":"2026-05-08","cited_by_count":4,"area":"safety"},{"id":"2605.29601","title":"Training Deliberative Monitors for Black-Box Scheming Detection","created":"2026-05-28","cited_by_count":4,"area":null},{"id":"2607.22868","title":"What Can Be Enforced? A Theory of Certified Runtime Safety for Tool-Using Agents","created":"2026-07-24","cited_by_count":4,"area":"safety"},{"id":"2505.09341","title":"Access Controls Will Solve the Dual-Use Dilemma","created":"2025-05-14","cited_by_count":3,"area":null},{"id":"2506.11068","title":"Deontological Keyword Bias: The Impact of Modal Expressions on Normative Judgments of Language Models","created":"2025-06-01","cited_by_count":3,"area":null},{"id":"2508.19980","title":"Evaluating Language Model Reasoning about Confidential Information","created":"2025-08-27","cited_by_count":3,"area":"lr"},{"id":"2509.24090","title":"Large-Scale Constraint Generation -- Can LLMs Parse Hundreds of Constraints?","created":"2025-09-28","cited_by_count":3,"area":null},{"id":"2510.21190","title":"The Trojan Example: Jailbreaking LLMs through Template Filling and Unsafety Reasoning","created":"2025-10-24","cited_by_count":3,"area":"alignment"},{"id":"2512.20061","title":"Scaling Reinforcement Learning for Content Moderation with Large Language Models","created":"2025-12-23","cited_by_count":3,"area":null},{"id":"2602.00950","title":"MindGuard: Guardrail Classifiers for Multi-Turn Mental Health Support","created":"2026-02-01","cited_by_count":3,"area":"safety"},{"id":"2604.03962","title":"Predict, Don't React: Value-Based Safety Forecasting for LLM Streaming","created":"2026-04-05","cited_by_count":3,"area":"safety"},{"id":"2604.14865","title":"Segment-Level Coherence for Robust Harmful Intent Probing in LLMs","created":"2026-04-16","cited_by_count":3,"area":"safety"},{"id":"2605.08930","title":"Internalizing Safety Understanding in Large Reasoning Models via Verification","created":"2026-05-09","cited_by_count":3,"area":"lr"},{"id":"2607.08077","title":"Modular Pretraining Enables Access Control","created":"2026-07-09","cited_by_count":3,"area":null},{"id":"2504.09712","title":"The Structural Safety Generalization Problem","created":"2025-04-13","cited_by_count":2,"area":"safety"},{"id":"2506.05376","title":"A Red Teaming Roadmap Towards System-Level Safety","created":"2025-05-30","cited_by_count":2,"area":"safety"},{"id":"2506.20606","title":"Model Editing as a Double-Edged Sword: Steering Agent Ethical Behavior Toward Beneficence or Harm","created":"2025-06-25","cited_by_count":2,"area":"agents"},{"id":"2507.07146","title":"Attention-Aware GNN-based Input Defense against Multi-Turn LLM Jailbreak","created":"2025-07-09","cited_by_count":2,"area":"safety"},{"id":"2507.11544","title":"The Safety Gap Toolkit: Evaluating Hidden Dangers of Open-Source Models","created":"2025-07-08","cited_by_count":2,"area":null},{"id":"2511.01375","title":"Align to Misalign: Automatic LLM Jailbreak with Meta-Optimized LLM Judges","created":"2025-11-03","cited_by_count":2,"area":"safety"},{"id":"2602.05164","title":"Position: Capability Control Should be a Separate Goal From Alignment","created":"2026-02-05","cited_by_count":2,"area":null},{"id":"2603.15968","title":"MAC: Multi-Agent Constitution Learning","created":"2026-03-16","cited_by_count":2,"area":"agents"},{"id":"2603.29062","title":"CivicShield: A Cross-Domain Defense-in-Depth Framework for Securing Government-Facing AI Chatbots Against Multi-Turn Adversarial Attacks","created":"2026-03-30","cited_by_count":2,"area":"safety"},{"id":"2608.28327","title":"Layered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layers","created":"2026-08-28","cited_by_count":2,"area":null},{"id":"2503.03502","title":"Geometry-Guided Adversarial Prompt Detection via Curvature and Local Intrinsic Dimension","created":"2025-03-05","cited_by_count":1,"area":"safety"},{"id":"2504.15125","title":"Contemplative Artificial Intelligence","created":"2025-04-21","cited_by_count":1,"area":null},{"id":"2506.13774","title":"Personalized Constitutionally-Aligned Agentic Superego: Secure AI Behavior Aligned to Diverse Human Values","created":"2025-06-08","cited_by_count":1,"area":"agents"},{"id":"2510.01494","title":"Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeed","created":"2025-10-01","cited_by_count":1,"area":"safety"},{"id":"2510.19844","title":"CourtGuard: A Local, Multiagent Prompt Injection Classifier","created":"2025-10-20","cited_by_count":1,"area":"safety"}],"next_cursor":"100"}