{"total":127,"rows":[{"id":"2507.11473","title":"Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety","created":"2025-07-15","cited_by_count":249,"area":"lr"},{"id":"2510.09023","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","created":"2025-10-10","cited_by_count":129,"area":"safety"},{"id":"2505.23575","title":"CoT Red-Handed: Stress Testing Chain-of-Thought Monitoring","created":"2025-05-29","cited_by_count":54,"area":"lr"},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54,"area":"agents"},{"id":"2505.21936","title":"RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments","created":"2025-05-28","cited_by_count":46,"area":"agents"},{"id":"2507.21206","title":"Agentic Web: Weaving the Next Web with AI Agents","created":"2025-07-28","cited_by_count":45,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2512.04123","title":"Measuring Agents in Production","created":"2025-12-02","cited_by_count":37,"area":"agents"},{"id":"2508.19461","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","created":"2025-08-26","cited_by_count":31,"area":"agents"},{"id":"2602.13379","title":"Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents","created":"2026-02-13","cited_by_count":30,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2510.09781","title":"Building a Foundational Guardrail for General Agentic Systems via Synthetic Data","created":"2025-10-10","cited_by_count":29,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2512.08093","title":"Training LLMs for Honesty via Confessions","created":"2025-12-08","cited_by_count":22,"area":null},{"id":"2507.16459","title":"Towards Enforcing Company Policy Adherence in Agentic Workflows","created":"2025-07-22","cited_by_count":18,"area":"agents"},{"id":"2606.00448","title":"When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems","created":"2026-05-30","cited_by_count":17,"area":"agents"},{"id":"2505.20087","title":"Safety Through Reasoning: An Empirical Study of Reasoning Guardrail Models","created":"2025-05-26","cited_by_count":16,"area":"lr"},{"id":"2604.13630","title":"SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment","created":"2026-04-15","cited_by_count":15,"area":"agents"},{"id":"2602.08235","title":"When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents","created":"2026-02-09","cited_by_count":14,"area":"agents"},{"id":"2603.04069","title":"Monitoring Emergent Reward Hacking During Generation via Internal Activations","created":"2026-03-04","cited_by_count":14,"area":"alignment"},{"id":"2509.23614","title":"PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agents","created":"2025-09-28","cited_by_count":12,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2601.10440","title":"AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior","created":"2026-01-15","cited_by_count":11,"area":null},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2603.11853","title":"OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents","created":"2026-03-12","cited_by_count":11,"area":"agents"},{"id":"2507.02735","title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","created":"2025-07-03","cited_by_count":10,"area":"agents"},{"id":"2508.04010","title":"HarmonyGuard: Toward Safety and Utility in Web Agents via Adaptive Policy Enhancement and Dual-Objective Optimization","created":"2025-08-06","cited_by_count":10,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2603.00131","title":"Thought Virus: Viral Misalignment via Subliminal Prompting in Multi-Agent Systems","created":"2026-02-23","cited_by_count":9,"area":"lr"},{"id":"2507.09329","title":"When Developer Aid Becomes Security Debt: A Systematic Analysis of Insecure Behaviors in LLM Coding Agents","created":"2025-07-12","cited_by_count":8,"area":"agents"},{"id":"2510.09714","title":"All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Language","created":"2025-10-10","cited_by_count":8,"area":"lr"},{"id":"2606.22504","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","created":"2026-06-21","cited_by_count":8,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.01710","title":"Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions","created":"2026-08-03","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2510.05159","title":"Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain","created":"2025-10-03","cited_by_count":6,"area":"agents"},{"id":"2512.05951","title":"Trusted AI Agents in the Cloud","created":"2025-12-05","cited_by_count":6,"area":"agents"},{"id":"2606.05805","title":"From Risk Classification to Action Plan Remediation: A Guardrail Feedback Driven Framework for LLM Agents","created":"2026-06-04","cited_by_count":6,"area":"agents"},{"id":"2606.15441","title":"Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment","created":"2026-06-13","cited_by_count":6,"area":"lr"},{"id":"2608.09885","title":"SHE: Trajectory-driven Safety Harness Evolution for LLM Agents","created":"2026-08-10","cited_by_count":6,"area":"agents"},{"id":"2510.01586","title":"AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learning","created":"2025-10-02","cited_by_count":5,"area":"agents"},{"id":"2603.14367","title":"HomeGuard: VLM-based Embodied Safeguard for Identifying Contextual Risk in Household Task","created":"2026-03-15","cited_by_count":5,"area":"mllm"},{"id":"2603.30036","title":"Aligned, Orthogonal or In-conflict: When can we safely optimize Chain-of-Thought?","created":"2026-03-31","cited_by_count":5,"area":"lr"},{"id":"2604.08608","title":"Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines","created":"2026-04-08","cited_by_count":5,"area":"agents"},{"id":"2512.01222","title":"Unsupervised decoding of encoded reasoning using language model interpretability","created":"2025-12-01","cited_by_count":4,"area":"lr"},{"id":"2603.05786","title":"Proof-of-Guardrail in AI Agents and What (Not) to Trust from It","created":"2026-03-06","cited_by_count":4,"area":null},{"id":"2604.19657","title":"An AI Agent Execution Environment to Safeguard User Data","created":"2026-04-21","cited_by_count":4,"area":null},{"id":"2505.23634","title":"MCP Safety Training: Learning to Refuse Falsely Benign MCP Exploits using Improved Preference Alignment","created":"2025-05-29","cited_by_count":3,"area":"agents"},{"id":"2510.17862","title":"When \"Correct\" Is Not Safe: Can We Trust Functionally Correct Patches Generated by Code Agents?","created":"2025-10-15","cited_by_count":3,"area":"agents"},{"id":"2602.14281","title":"MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents","created":"2026-02-15","cited_by_count":3,"area":"agents"},{"id":"2603.04469","title":"Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems","created":"2026-03-04","cited_by_count":3,"area":"agents"},{"id":"2604.07988","title":"LogAct: Enabling Agentic Reliability via Shared Logs","created":"2026-04-09","cited_by_count":3,"area":"agents"},{"id":"2605.19240","title":"CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring","created":"2026-05-19","cited_by_count":3,"area":"agents"},{"id":"2606.01991","title":"SafeMCP: Proactive Power Regulation for LLM Agent Defense via Environment-Grounded Look-Ahead Reasoning","created":"2026-06-01","cited_by_count":3,"area":"lr"},{"id":"2606.12329","title":"PROJECTMEM: A Local-First, Event-Sourced Memory and Judgment Layer for AI Coding Agents","created":"2026-06-10","cited_by_count":3,"area":"agents"},{"id":"2606.20560","title":"How Transparent is DiffusionGemma?","created":"2026-06-18","cited_by_count":3,"area":"lr"},{"id":"2608.25776","title":"EVOMAL: Self-Poisoning in Self-Evolving Coding Agents","created":"2026-08-26","cited_by_count":3,"area":"agents"},{"id":"2510.03413","title":"Report of the 2025 Workshop on Next-Generation Ecosystems for Scientific Computing: Harnessing Community, Software, and AI for Cross-Disciplinary Team Science","created":"2025-10-03","cited_by_count":2,"area":null},{"id":"2510.03485","title":"Learning Efficient Guardrails for Compliance","created":"2025-10-03","cited_by_count":2,"area":"agents"},{"id":"2512.19011","title":"Do You Really Need a GPU to Guard Your LLM? CPU-Class Classifiers and Multi-Stage Pipelines for Safety Enforcement at Scale","created":"2025-12-22","cited_by_count":2,"area":"safety"},{"id":"2603.29062","title":"CivicShield: A Cross-Domain Defense-in-Depth Framework for Securing Government-Facing AI Chatbots Against Multi-Turn Adversarial Attacks","created":"2026-03-30","cited_by_count":2,"area":"safety"},{"id":"2604.06427","title":"The Depth Ceiling: On the Limits of Large Language Models in Discovering Latent Planning","created":"2026-04-07","cited_by_count":2,"area":"lr"},{"id":"2604.15579","title":"Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agents","created":"2026-04-16","cited_by_count":2,"area":"safety"},{"id":"2604.24920","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","created":"2026-04-27","cited_by_count":2,"area":"agents"},{"id":"2605.10614","title":"PRISM: Generation-Time Detection and Mitigation of Secret Leakage in Multi-Agent LLM Pipelines","created":"2026-05-11","cited_by_count":2,"area":"agents"},{"id":"2605.17380","title":"ADR: An Agentic Detection System for Enterprise Agentic AI Security","created":"2026-05-17","cited_by_count":2,"area":"agents"},{"id":"2605.18784","title":"The Insurability Frontier of AI Risk: Mapping Threats to Affirmative Coverage, Silent Exposures, and Exclusions","created":"2026-05-06","cited_by_count":2,"area":null},{"id":"2605.19149","title":"Agent Meltdowns: The Road to Hell Is Paved with Helpful Agents","created":"2026-05-18","cited_by_count":2,"area":null},{"id":"2605.27489","title":"HARP: Measuring Harm Amplification in Multi-Agent LLM Systems","created":"2026-05-26","cited_by_count":2,"area":"agents"},{"id":"2608.18360","title":"One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI","created":"2026-08-18","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2609.05903","title":"EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents","created":"2026-09-05","cited_by_count":2,"area":"agents"},{"id":"2609.06972","title":"AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2505.13766","title":"A Blueprint for AI-Driven Software Quality: Integrating LLMs with Established Standards","created":"2025-05-19","cited_by_count":1,"area":null},{"id":"2511.19874","title":"Cross-LLM Generalization of Behavioral Backdoor Detection in AI Agent Supply Chains","created":"2025-11-25","cited_by_count":1,"area":"agents"},{"id":"2602.05066","title":"Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks","created":"2026-02-04","cited_by_count":1,"area":"agents"},{"id":"2602.21267","title":"A Systematic Review of Algorithmic Red Teaming Methodologies for Assurance and Security of AI Applications","created":"2026-02-24","cited_by_count":1,"area":null},{"id":"2604.11666","title":"Playing Along: Learning a Double-Agent Defender for Belief Steering via Theory of Mind","created":"2026-04-13","cited_by_count":1,"area":"agents"},{"id":"2604.14723","title":"Bounded Autonomy for Enterprise AI: Typed Action Contracts and Consumer-Side Execution","created":"2026-04-16","cited_by_count":1,"area":null},{"id":"2605.16265","title":"AgentWall: A Runtime Safety Layer for Local AI Agents","created":"2026-03-24","cited_by_count":1,"area":null},{"id":"2605.17413","title":"Ablating Safety: Mechanisms for Removing Alignment in Language Models for Security Applications","created":"2026-05-17","cited_by_count":1,"area":"alignment"},{"id":"2605.27333","title":"FinHarness: An Inline Lifecycle Safety Harness for Finance LLM Agents","created":"2026-05-26","cited_by_count":1,"area":"agents"},{"id":"2606.14517","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","created":"2026-06-12","cited_by_count":1,"area":"agents"},{"id":"2606.16358","title":"The Proxy Knows Too Much: Sealing LLM API Routers with Attested TEEs","created":"2026-06-15","cited_by_count":1,"area":null},{"id":"2606.17257","title":"Pulling The REINS: Training-Free Safety Alignment of Video Diffusion Models via Representation Steering","created":"2026-06-15","cited_by_count":1,"area":"diffusion"},{"id":"2606.26373","title":"Hybrid privacy-aware semantic search: SVD-truncated document geometry and CKKS-encrypted query reranking under a restricted threat model","created":"2026-06-24","cited_by_count":1,"area":null},{"id":"2607.01277","title":"Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety","created":"2026-07-01","cited_by_count":1,"area":"safety"},{"id":"2607.05120","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2607.19913","title":"JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety","created":"2026-07-22","cited_by_count":1,"area":null},{"id":"2607.20759","title":"IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests","created":"2026-07-22","cited_by_count":1,"area":"agents"},{"id":"2608.02683","title":"$S^3$: Improving Agent Safety through Multi-Stage Defense","created":"2026-08-03","cited_by_count":1,"area":"agents"},{"id":"2608.17829","title":"The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges","created":"2026-08-18","cited_by_count":1,"area":null},{"id":"2505.10066","title":"Dark LLMs: The Growing Threat of Unaligned AI Models","created":"2025-05-15","cited_by_count":0,"area":"safety"},{"id":"2508.17155","title":"Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents","created":"2025-08-23","cited_by_count":0,"area":"agents"},{"id":"2605.01143","title":"A Low-Latency Fraud Detection Layer for Detecting Adversarial Interaction Patterns in LLM-Powered Agents","created":"2026-05-01","cited_by_count":0,"area":"agents"},{"id":"2605.10763","title":"MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study","created":"2026-05-11","cited_by_count":0,"area":"agents"},{"id":"2605.10907","title":"Engineering Robustness into Personal Agents with the AI Workflow Store","created":"2026-05-11","cited_by_count":0,"area":null},{"id":"2606.21732","title":"Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agents","created":"2026-06-19","cited_by_count":0,"area":"agents"},{"id":"2606.26627","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","created":"2026-06-25","cited_by_count":0,"area":"agents"},{"id":"2607.02857","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","created":"2026-07-03","cited_by_count":0,"area":"agents"}],"next_cursor":"100"}