{"list":"other","total":78,"rows":[{"id":"2302.12173","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","created":"2023-02-23","cited_by_count":1443},{"id":"2406.12045","title":"$\\tau$-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains","created":"2024-06-17","cited_by_count":1402},{"id":"2310.08560","title":"MemGPT: Towards LLMs as Operating Systems","created":"2023-10-12","cited_by_count":1389},{"id":"2306.05499","title":"Prompt Injection attack against LLM-integrated Applications","created":"2023-06-08","cited_by_count":605},{"id":"2503.13657","title":"Why Do Multi-Agent LLM Systems Fail?","created":"2025-03-17","cited_by_count":604},{"id":"2406.04093","title":"Scaling and evaluating sparse autoencoders","created":"2024-06-06","cited_by_count":553},{"id":"2404.13208","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","created":"2024-04-19","cited_by_count":493},{"id":"2503.11926","title":"Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation","created":"2025-03-14","cited_by_count":384},{"id":"2402.06363","title":"StruQ: Defending Against Prompt Injection with Structured Queries","created":"2024-02-09","cited_by_count":375},{"id":"2412.04984","title":"Frontier Models are Capable of In-context Scheming","created":"2024-12-06","cited_by_count":287},{"id":"2403.14720","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","created":"2024-03-20","cited_by_count":267},{"id":"2503.23278","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","created":"2025-03-30","cited_by_count":265},{"id":"2401.05459","title":"Personal LLM Agents: Insights and Survey about the Capability, Efficiency and Security","created":"2024-01-10","cited_by_count":260},{"id":"2507.11473","title":"Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety","created":"2025-07-15","cited_by_count":249},{"id":"2312.06942","title":"AI Control: Improving Safety Despite Intentional Subversion","created":"2023-12-12","cited_by_count":229},{"id":"2410.05451","title":"SecAlign: Defending Against Prompt Injection with Preference Optimization","created":"2024-10-07","cited_by_count":210},{"id":"2501.18837","title":"Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming","created":"2025-01-31","cited_by_count":181},{"id":"2310.19156","title":"Poisoning Retrieval Corpora by Injecting Adversarial Passages","created":"2023-10-29","cited_by_count":159},{"id":"2405.15556","title":"Certifiably Robust RAG against Retrieval Corruption","created":"2024-05-24","cited_by_count":151},{"id":"2406.07358","title":"AI Sandbagging: Language Models can Strategically Underperform on Evaluations","created":"2024-06-11","cited_by_count":145},{"id":"2504.11358","title":"DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks","created":"2025-04-15","cited_by_count":143},{"id":"2510.09023","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","created":"2025-10-10","cited_by_count":129},{"id":"2505.23836","title":"Large Language Models Often Know When They Are Being Evaluated","created":"2025-05-28","cited_by_count":128},{"id":"2405.06823","title":"PLeak: Prompt Leaking Attacks against Large Language Model Applications","created":"2024-05-10","cited_by_count":127},{"id":"2307.10490","title":"Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs","created":"2023-07-19","cited_by_count":124},{"id":"2505.23643","title":"Securing AI Agents with Information-Flow Control","created":"2025-05-29","cited_by_count":121},{"id":"2403.16971","title":"AIOS: LLM Agent Operating System","created":"2024-03-25","cited_by_count":97},{"id":"2411.00348","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","created":"2024-11-01","cited_by_count":95},{"id":"2406.00083","title":"BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models","created":"2024-06-03","cited_by_count":86},{"id":"2403.06833","title":"Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?","created":"2024-03-11","cited_by_count":81},{"id":"2401.13138","title":"Visibility into AI Agents","created":"2024-01-23","cited_by_count":79},{"id":"2607.15495","title":"Verbalizable Representations Form a Global Workspace in Language Models","created":"2026-07-16","cited_by_count":75},{"id":"2410.13708","title":"On the Role of Attention Heads in Large Language Model Safety","created":"2024-10-17","cited_by_count":72},{"id":"2403.02817","title":"Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications","created":"2024-03-05","cited_by_count":59},{"id":"2501.17070","title":"Contextual Agent Security: A Policy for Every Purpose","created":"2025-01-28","cited_by_count":59},{"id":"2602.03117","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","created":"2026-02-03","cited_by_count":59},{"id":"2512.18311","title":"Monitoring Monitorability","created":"2025-12-20","cited_by_count":58},{"id":"2412.08686","title":"LatentQA: Teaching LLMs to Decode Activations Into Natural Language","created":"2024-12-11","cited_by_count":51},{"id":"2412.09565","title":"Obfuscated Activations Bypass LLM Latent-Space Defenses","created":"2024-12-12","cited_by_count":45},{"id":"2511.03690","title":"The OpenHands Software Agent SDK: A Composable and Extensible Foundation for Production Agents","created":"2025-11-05","cited_by_count":45},{"id":"2505.14534","title":"Lessons from Defending Gemini Against Indirect Prompt Injections","created":"2025-05-20","cited_by_count":43},{"id":"2501.10114","title":"Infrastructure for AI Agents","created":"2025-01-17","cited_by_count":41},{"id":"2601.04603","title":"Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks","created":"2026-01-08","cited_by_count":41},{"id":"2312.03815","title":"LLM as OS, Agents as Apps: Envisioning AIOS, Agents and the AIOS-Agent Ecosystem","created":"2023-12-06","cited_by_count":38},{"id":"2504.03957","title":"Practical Poisoning Attacks against Retrieval-Augmented Generation","created":"2025-04-04","cited_by_count":36},{"id":"2410.10760","title":"Denial-of-Service Poisoning Attacks against Large Language Models","created":"2024-10-14","cited_by_count":35},{"id":"2509.10540","title":"EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System","created":"2025-09-06","cited_by_count":29},{"id":"2603.05706","title":"Reasoning Models Struggle to Control their Chains of Thought","created":"2026-03-05","cited_by_count":25},{"id":"2503.10566","title":"ASIDE: Architectural Separation of Instructions and Data in Language Models","created":"2025-03-13","cited_by_count":24},{"id":"2506.14261","title":"RL-Obfuscation: Can Language Models Learn to Evade Latent-Space Monitors?","created":"2025-06-17","cited_by_count":24},{"id":"2404.06921","title":"GoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Applications","created":"2024-04-10","cited_by_count":23},{"id":"2506.09956","title":"LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge","created":"2025-06-11","cited_by_count":21},{"id":"2508.09442","title":"Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inference","created":"2025-08-13","cited_by_count":21},{"id":"2508.08438","title":"Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference","created":"2025-08-11","cited_by_count":18},{"id":"2603.02277","title":"Quantifying Frontier LLM Capabilities for Container Sandbox Escape","created":"2026-03-01","cited_by_count":18},{"id":"2407.04503","title":"When LLMs Play the Telephone Game: Cultural Attractors as Conceptual Tools to Evaluate LLMs in Multi-turn Settings","created":"2024-07-05","cited_by_count":17},{"id":"2411.18191","title":"InputSnatch: Stealing Input in LLM Services via Timing Side-Channel Attacks","created":"2024-11-27","cited_by_count":16},{"id":"2506.06151","title":"Joint-GCG: Unified Gradient-Based Poisoning Attacks on Retrieval-Augmented Generation Systems","created":"2025-06-06","cited_by_count":16},{"id":"2512.04864","title":"Are Your Agents Upward Deceivers?","created":"2025-12-04","cited_by_count":16},{"id":"2507.07417","title":"May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks","created":"2025-07-10","cited_by_count":15},{"id":"2402.13532","title":"Backdoor Attacks on Dense Retrieval via Public and Unintentional Triggers","created":"2024-02-21","cited_by_count":14},{"id":"2504.13752","title":"Learning to Attribute with Attention","created":"2025-04-18","cited_by_count":13},{"id":"2606.10484","title":"AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environments","created":"2026-06-09","cited_by_count":13},{"id":"2502.16971","title":"LongSafety: Evaluating Long-Context Safety of Large Language Models","created":"2025-02-24","cited_by_count":12},{"id":"2507.05630","title":"How Not to Detect Prompt Injections with an LLM","created":"2025-07-08","cited_by_count":12},{"id":"2601.10440","title":"AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior","created":"2026-01-15","cited_by_count":11},{"id":"2602.20628","title":"When can we trust untrusted monitoring? A safety case sketch across collusion strategies","created":"2026-02-24","cited_by_count":10},{"id":"2603.29231","title":"Beyond pass@1: A Reliability Science Framework for Long-Horizon LLM Agents","created":"2026-03-31","cited_by_count":10},{"id":"2505.18907","title":"Stronger Enforcement of Instruction Hierarchy via Augmented Intermediate Representations","created":"2025-05-25","cited_by_count":9},{"id":"2603.03258","title":"Inherited Goal Drift: Contextual Pressure Can Undermine Agentic Goals","created":"2026-03-03","cited_by_count":9},{"id":"2605.17634","title":"AI Agents May Always Fall for Prompt Injections","created":"2026-05-17","cited_by_count":9},{"id":"2604.04788","title":"From Sycophancy to Deception: A Unified Taxonomy for LLM Spontaneous Misalignment","created":"2026-04-06","cited_by_count":7},{"id":"2601.19768","title":"GAVEL: Towards Rule-Based Safety Through Activation Monitoring","created":"2026-01-27","cited_by_count":5},{"id":"2603.08938","title":"AgentOS: From Application Silos to a Natural Language-Driven Data Ecosystem","created":"2026-03-09","cited_by_count":3},{"id":"2605.14454","title":"LiSA: Lifelong Safety Adaptation via Conservative Policy Induction","created":"2026-05-14","cited_by_count":3},{"id":"2509.01245","title":"Towards Agentic OS: An LLM Agent Framework for Linux Schedulers","created":"2025-09-01","cited_by_count":2},{"id":"2606.00288","title":"Model-Native Computing Architecture: Envisioning Future System Architecture Through the Lens of Computer Architecture","created":"2026-05-29","cited_by_count":2},{"id":"2608.02820","title":"Evading Chain-of-Thought Monitoring Through Model Poisoning","created":"2026-08-03","cited_by_count":2}],"next_cursor":null}