{"total":129,"rows":[{"id":"2601.11516","title":"Building Production-Ready Probes For Gemini","created":"2026-01-16","cited_by_count":47,"area":"safety"},{"id":"2602.16901","title":"AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks","created":"2026-02-18","cited_by_count":39,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2510.19207","title":"Defending Against Prompt Injection with DataFilter","created":"2025-10-22","cited_by_count":35,"area":"safety"},{"id":"2602.16708","title":"Formal Policy Enforcement for Real-World Agentic Systems","created":"2026-02-18","cited_by_count":33,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2604.16548","title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","created":"2026-04-17","cited_by_count":27,"area":"agents"},{"id":"2511.20597","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","created":"2025-11-25","cited_by_count":24,"area":"safety"},{"id":"2602.12194","title":"MalTool: Malicious Tool Attacks on LLM Agents","created":"2026-02-12","cited_by_count":20,"area":"agents"},{"id":"2601.09923","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","created":"2026-01-14","cited_by_count":17,"area":"agents"},{"id":"2603.12277","title":"Prompt Injection as Role Confusion","created":"2026-02-22","cited_by_count":17,"area":"safety"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2603.24511","title":"Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs","created":"2026-03-25","cited_by_count":17,"area":"safety"},{"id":"2512.12594","title":"ceLLMate: Sandboxing Browser AI Agents","created":"2025-12-14","cited_by_count":16,"area":"safety"},{"id":"2602.05746","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","created":"2026-02-05","cited_by_count":16,"area":"agents"},{"id":"2603.13026","title":"PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses","created":"2026-03-13","cited_by_count":16,"area":"safety"},{"id":"2603.10521","title":"IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMs","created":"2026-03-11","cited_by_count":15,"area":"safety"},{"id":"2602.07918","title":"CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution","created":"2026-02-08","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2604.08499","title":"PIArena: A Platform for Prompt Injection Evaluation","created":"2026-04-09","cited_by_count":11,"area":"safety"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2602.11416","title":"Optimizing Agent Planning for Security and Autonomy","created":"2026-02-11","cited_by_count":10,"area":"safety"},{"id":"2607.02357","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","created":"2026-07-02","cited_by_count":10,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2512.00966","title":"Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysis","created":"2025-11-30","cited_by_count":9,"area":"agents"},{"id":"2603.30016","title":"Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks","created":"2026-03-31","cited_by_count":9,"area":"agents"},{"id":"2607.26115","title":"GPT-Red: Automated Red Teaming via Self-Play at Scale","created":"2026-07-28","cited_by_count":8,"area":"synth"},{"id":"2511.00203","title":"Diffusion LLMs are Natural Adversaries for any LLM","created":"2025-10-31","cited_by_count":7,"area":"safety"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2603.22341","title":"T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search","created":"2026-03-21","cited_by_count":6,"area":"agents"},{"id":"2604.01194","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","created":"2026-04-01","cited_by_count":6,"area":"safety"},{"id":"2605.18991","title":"Agent Security is a Systems Problem","created":"2026-05-18","cited_by_count":5,"area":null},{"id":"2606.09701","title":"Learning to Attack and Defend: Adaptive Red Teaming of Language Models via GRPO","created":"2026-06-08","cited_by_count":5,"area":"lr"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2603.00991","title":"Tracking Capabilities for Safer Agents","created":"2026-03-01","cited_by_count":4,"area":"safety"},{"id":"2604.19657","title":"An AI Agent Execution Environment to Safeguard User Data","created":"2026-04-21","cited_by_count":4,"area":null},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2605.15030","title":"WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2607.13718","title":"How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement","created":"2026-07-15","cited_by_count":4,"area":"agents"},{"id":"2608.10669","title":"REDAgentBench: Executable Red Teaming and Faithful Measurement of LLM Agent Systems","created":"2026-08-11","cited_by_count":4,"area":"lr"},{"id":"2510.21057","title":"Soft Instruction De-escalation Defense","created":"2025-10-24","cited_by_count":3,"area":"agents"},{"id":"2602.16729","title":"Intent Laundering: AI Safety Datasets Are Not What They Seem","created":"2026-02-17","cited_by_count":3,"area":null},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2608.21500","title":"SecOPD: Mitigating Adaptive Prompt Injections by On-Policy Distillation","created":"2026-08-21","cited_by_count":3,"area":"safety"},{"id":"2603.29062","title":"CivicShield: A Cross-Domain Defense-in-Depth Framework for Securing Government-Facing AI Chatbots Against Multi-Turn Adversarial Attacks","created":"2026-03-30","cited_by_count":2,"area":"safety"},{"id":"2604.02375","title":"KAIJU: An Executive Kernel for Intent-Gated Execution of LLM Agents","created":"2026-03-31","cited_by_count":2,"area":"agents"},{"id":"2604.24920","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","created":"2026-04-27","cited_by_count":2,"area":"agents"},{"id":"2605.11026","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","created":"2026-05-10","cited_by_count":2,"area":"agents"},{"id":"2605.14605","title":"A Few Steps Further: Why Defenses Against Malicious Finetuning Erode Under Continued Training","created":"2026-05-14","cited_by_count":2,"area":null},{"id":"2605.21834","title":"On-Policy Consistency Training Improves LLM Safety with Minimal Capability Degradation","created":"2026-05-20","cited_by_count":2,"area":"safety"},{"id":"2607.05189","title":"When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents","created":"2026-07-06","cited_by_count":2,"area":"agents"},{"id":"2607.11698","title":"Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming","created":"2026-07-13","cited_by_count":2,"area":"agents"},{"id":"2608.16032","title":"Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened","created":"2026-08-17","cited_by_count":2,"area":"agents"},{"id":"2608.28327","title":"Layered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layers","created":"2026-08-28","cited_by_count":2,"area":null},{"id":"2602.21267","title":"A Systematic Review of Algorithmic Red Teaming Methodologies for Assurance and Security of AI Applications","created":"2026-02-24","cited_by_count":1,"area":null},{"id":"2603.08234","title":"The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMs","created":"2026-03-09","cited_by_count":1,"area":"safety"},{"id":"2603.28013","title":"Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection Across Attack Surfaces and Model Safety Tiers","created":"2026-03-30","cited_by_count":1,"area":"agents"},{"id":"2605.20312","title":"Pramana: A Protocol-Layer Treatment of Claim Verification in Autonomous Agent Networks","created":"2026-05-19","cited_by_count":1,"area":"agents"},{"id":"2605.28617","title":"LACUNA: Safe Agents as Recursive Program Holes","created":"2026-05-27","cited_by_count":1,"area":"agents"},{"id":"2606.11409","title":"Risk Under Pressure: Compute-Aware Evaluation of Adversarial Robustness in Language Models","created":"2026-06-09","cited_by_count":1,"area":"safety"},{"id":"2606.14517","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","created":"2026-06-12","cited_by_count":1,"area":"agents"},{"id":"2606.25059","title":"What Does It Mean to Break a Distillation Defense?","created":"2026-06-23","cited_by_count":1,"area":null},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2607.27951","title":"Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs","created":"2026-07-30","cited_by_count":1,"area":null},{"id":"2608.00718","title":"Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures","created":"2026-08-01","cited_by_count":1,"area":"agents"},{"id":"2608.05108","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2608.05430","title":"Robust Context-Aware Detection of Malicious Instructions in Text","created":"2026-08-05","cited_by_count":1,"area":"safety"},{"id":"2608.08131","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","created":"2026-08-08","cited_by_count":1,"area":"agents"},{"id":"2608.17829","title":"The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges","created":"2026-08-18","cited_by_count":1,"area":null},{"id":"2609.21793","title":"CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation","created":"2026-09-18","cited_by_count":1,"area":"safety"},{"id":"2609.32691","title":"Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection","created":"2026-09-26","cited_by_count":1,"area":"agents"},{"id":"2511.03247","title":"Death by a Thousand Prompts: Open Model Vulnerability Analysis","created":"2025-11-05","cited_by_count":0,"area":"safety"},{"id":"2512.20405","title":"ChatGPT: Excellent Paper! Accept It. Editor: Imposter Found! Review Rejected","created":"2025-12-23","cited_by_count":0,"area":"safety"},{"id":"2602.08877","title":"Stress-Testing Alignment Audits With Prompt-Level Strategic Deception","created":"2026-02-09","cited_by_count":0,"area":"safety"},{"id":"2603.15259","title":"Directional Embedding Smoothing for Robust Vision Language Models","created":"2026-03-16","cited_by_count":0,"area":"mllm"},{"id":"2604.12548","title":"DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection","created":"2026-04-14","cited_by_count":0,"area":"safety"},{"id":"2604.18248","title":"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection","created":"2026-04-20","cited_by_count":0,"area":"safety"},{"id":"2604.28157","title":"FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruption","created":"2026-04-30","cited_by_count":0,"area":"rag"},{"id":"2605.07032","title":"A Systematic Investigation of RL-Jailbreaking in LLMs","created":"2026-05-07","cited_by_count":0,"area":"safety"},{"id":"2605.10763","title":"MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study","created":"2026-05-11","cited_by_count":0,"area":"agents"},{"id":"2605.13471","title":"Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents","created":"2026-05-13","cited_by_count":0,"area":"safety"},{"id":"2605.20286","title":"Adaptive Probe-based Steering for Robust LLM Jailbreaking","created":"2026-05-19","cited_by_count":0,"area":"safety"},{"id":"2605.25893","title":"$D^2$-Monitor: Dynamic Safety Monitoring for Diffusion LLMs via Hesitation Signals","created":"2026-05-25","cited_by_count":0,"area":null},{"id":"2605.28467","title":"Mitigating Adaptive Attacks against Reasoning Models with Activation Consistency Training","created":"2026-05-27","cited_by_count":0,"area":"lr"},{"id":"2605.30454","title":"The Surface You Test Is Not the Surface That Breaks","created":"2026-05-28","cited_by_count":0,"area":"agents"},{"id":"2606.03647","title":"All you need to break LLMs are Black-Box, Adapting, Efficient, Transferable, Harmful, Applicable ... Attacks","created":"2026-06-02","cited_by_count":0,"area":"safety"},{"id":"2606.08892","title":"Diffuse AI Control on Fuzzy Tasks","created":"2026-06-08","cited_by_count":0,"area":"safety"},{"id":"2606.16242","title":"Rapid Poison: Practical Poisoning Attacks Against the Rapid Response Framework","created":"2026-06-15","cited_by_count":0,"area":"safety"},{"id":"2607.02072","title":"kNNGuard: Turning LLM Hidden Activations into a Training-Free Configurable Guardrail","created":"2026-07-02","cited_by_count":0,"area":"safety"},{"id":"2607.20494","title":"Isolating LLM Alignment from Regex: Zero Coverage and Metric-Dependent Divergence Under Adversarial Mutation","created":"2026-06-12","cited_by_count":0,"area":"alignment"},{"id":"2608.10530","title":"On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models","created":"2026-08-11","cited_by_count":0,"area":"agents"},{"id":"2608.12789","title":"PIPES: Securing Agent Perception with Provenance and Priors","created":"2026-08-13","cited_by_count":0,"area":null},{"id":"2608.30441","title":"ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems","created":"2026-08-31","cited_by_count":0,"area":"agents"},{"id":"2609.00519","title":"The Safeguard Worked. Is the LLM System Safer?","created":"2026-09-01","cited_by_count":0,"area":null},{"id":"2609.03693","title":"AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks","created":"2026-09-03","cited_by_count":0,"area":"alignment"},{"id":"2609.04495","title":"Rethinking Indirect Prompt Injection as a Test-Time Search Problem","created":"2026-09-03","cited_by_count":0,"area":"safety"}],"next_cursor":"100"}