SafeScientist: Toward Risk-Aware Scientific Discoveries by LLM Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Recent advancements in large language model (LLM) agents have significantly accelerated scientific discovery automation, yet concurrently raised critical ethical and safety concerns. To systematically address these challenges, we introduce SafeScientist, an innovative AI scientist framework explicitly designed to enhance safety and ethical responsibility in AI-driven scientific exploration. SafeScientist proactively refuses ethically inappropriate or high-risk tasks and rigorously emphasizes safety throughout the research process. To achieve comprehensive safety oversight, we integrate multiple defensive mechanisms, including prompt monitoring, agent-collaboration monitoring, tool-use monitoring, and an ethical reviewer component. Complementing SafeScientist, we propose SciSafetyBench, a novel benchmark specifically designed to evaluate AI safety in scientific contexts, comprising 240 high-risk scientific tasks across 6 domains, alongside 30 specially designed scientific tools and 120 tool-related risk tasks. Extensive experiments demonstrate that SafeScientist significantly improves safety performance by 35% compared to traditional AI scientist frameworks, without compromising scientific output quality. Additionally, we rigorously validate the robustness of our safety pipeline against diverse adversarial attack methods, further confirming the effectiveness of our integrated approach. The code and data will be available at https://github.com/ulab-uiuc/SafeScientist. textcolorredWarning: this paper contains example data that may be offensive or harmful.
Key facts. Cited by 16 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 38 of its 67 references that are in the map. First posted on arXiv 29 May 2025.
Builds on
38 of 67 references.
Closest ancestors · 10
Same direction, newest first
- 2025AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management6 Mar
- 2025Memory Injection Attacks on LLM Agents via Query-Only Interaction5 Mar
- 2025Red-Teaming LLM Multi-Agent Systems via Communication Attacks20 Feb
- 2024SafeAgentBench: A Benchmark for Safe Task Planning of Embodied LLM Agents17 Dec
- 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
- 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification30 Jul
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
- 2024Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities10 Jul
- 2024AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents19 Jun
- 2023Evil Geniuses: Delving into the Safety of LLM-based Agents20 Nov
Other references · 28
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
- 2024The AI Scientist: Towards Fully Automated Open-Ended Scientific Discoverycited by 1,071
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
- 2022Galactica: A Large Language Model for Sciencecited by 744
- 2025Agent Laboratory: Using LLM Agents as Research Assistantscited by 425
- 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
- 2024Improving Alignment and Robustness with Circuit Breakerscited by 322
- 2023Low-Resource Languages Jailbreak GPT-4cited by 309
- 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
- 2023Certifying LLM Safety against Adversarial Promptingcited by 266
16 more
- 2023From Pretraining Data to Language Models to Downstream Tasks: Tracking the Trails of Political Biases Leading to Unfair NLP Modelscited by 260
- 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 240
- 2023Do-Not-Answer: A Dataset for Evaluating Safeguards in LLMscited by 184
- 2024CycleResearcher: Improving Automated Research via Automated Reviewcited by 148
- 2024Exploring Large Language Model based Intelligent Agents: Definitions, Methods, and Prospectscited by 132
- 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127
- 2024Rule Based Rewards for Language Model Safetycited by 108
- 2024Representation Noising: A Defence Mechanism Against Harmful Finetuningcited by 96
- 2024A Comprehensive Survey of Scientific Large Language Models and Their Applications in Scientific Discoverycited by 96
- 2025LLM4SR: A Survey on Large Language Models for Scientific Researchcited by 83
- 2025Superintelligent Agents Pose Catastrophic Risks: Can Scientist AI Offer a Safer Path?cited by 75
- 2023Word Embeddings Are Steers for Language Modelscited by 70
- 2024Risks of AI Scientists: Prioritizing Safeguarding Over Autonomycited by 49
- 2024HAICOSYSTEM: An Ecosystem for Sandboxing Safety Risks in Human-AI Interactionscited by 44
- 2025AI Idea Bench 2025: AI Research Idea Generation Benchmarkcited by 40
- 2024ResearchTown: Simulator of Human Research Communitycited by 37
Built on by
Citing papers per year: 2025: 6; 2026: 10.
16 papers.
Sort:
By area:
- 2025Where LLM Agents Fail and How They can Learn From Failurescited by 133
- 2025Building a Foundational Guardrail for General Agentic Systems via Synthetic Datacited by 29
- 2026SafePro: Evaluating the Safety of Professional-Level AI Agentscited by 10
- 2025TinyScientist: An Interactive, Extensible, and Controllable Framework for Building Research Agentscited by 8
- 2026FARS: A Fully Automated Research System Deployed at Scalecited by 7
- 2025AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learningcited by 5
- 2026LLM Agents in Law: Taxonomy, Applications, and Challengescited by 5
- 2025Deep Research Agents Brings Deeper Harmcited by 2
- 2025Structural Enforcement of Statistical Rigor in AI-Driven Discovery: A Functional Architecturecited by 1
- 2026Judging What We Cannot Solve: A Consequence-Based Approach for Oracle-Free Evaluation of Research-Level Mathcited by 1
- 2026An AI Co-Data-Scientist for Prioritizing Candidate Biomarkers from Wearable Sensor Datacited by 1
- 2026SciTrace: Trajectory-Aware Safety Reasoning for Scientific Discovery Agentscited by 1
4 more
- 2026Making AI Scientists Auditable from Evidence to Claimcited by 1
- 2026SciRisk-Bench: A Risk-Dimension-Aware Benchmark for AI4Science Safetycited by 1
- 2026SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoringcited by 1
- 2026Personalized Auto-Research: Towards a True AI Co-Scientistcited by 0
- 2026Personalized Auto-Research: Towards a True AI Co-Scientist14 Aug 2026
- 2026SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoring21 Jul 2026
- 2026FARS: A Fully Automated Research System Deployed at Scale30 Jun 2026
- 2026SciRisk-Bench: A Risk-Dimension-Aware Benchmark for AI4Science Safety17 Jun 2026
- 2026Making AI Scientists Auditable from Evidence to Claim17 Jun 2026
- 2026SciTrace: Trajectory-Aware Safety Reasoning for Scientific Discovery Agents6 Jun 2026
- 2026An AI Co-Data-Scientist for Prioritizing Candidate Biomarkers from Wearable Sensor Data16 Apr 2026
- 2026Judging What We Cannot Solve: A Consequence-Based Approach for Oracle-Free Evaluation of Research-Level Math6 Feb 2026
- 2026SafePro: Evaluating the Safety of Professional-Level AI Agents10 Jan 2026
- 2026LLM Agents in Law: Taxonomy, Applications, and Challenges8 Jan 2026
- 2025Structural Enforcement of Statistical Rigor in AI-Driven Discovery: A Functional Architecture10 Nov 2025
- 2025Deep Research Agents Brings Deeper Harm13 Oct 2025
4 more
- 2025Building a Foundational Guardrail for General Agentic Systems via Synthetic Data10 Oct 2025
- 2025TinyScientist: An Interactive, Extensible, and Controllable Framework for Building Research Agents8 Oct 2025
- 2025AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learning2 Oct 2025
- 2025Where LLM Agents Fail and How They can Learn From Failures29 Sep 2025
- 2025Where LLM Agents Fail and How They can Learn From Failurescited by 133
- 2025Building a Foundational Guardrail for General Agentic Systems via Synthetic Datacited by 29
- 2026SafePro: Evaluating the Safety of Professional-Level AI Agentscited by 10
- 2025TinyScientist: An Interactive, Extensible, and Controllable Framework for Building Research Agentscited by 8
- 2026FARS: A Fully Automated Research System Deployed at Scalecited by 7
- 2025AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learningcited by 5
- 2026LLM Agents in Law: Taxonomy, Applications, and Challengescited by 5
- 2025Deep Research Agents Brings Deeper Harmcited by 2
- 2026FARS: A Fully Automated Research System Deployed at Scale30 Jun 2026
- 2026SafePro: Evaluating the Safety of Professional-Level AI Agents10 Jan 2026
- 2026LLM Agents in Law: Taxonomy, Applications, and Challenges8 Jan 2026
- 2025Deep Research Agents Brings Deeper Harm13 Oct 2025
- 2025Building a Foundational Guardrail for General Agentic Systems via Synthetic Data10 Oct 2025
- 2025TinyScientist: An Interactive, Extensible, and Controllable Framework for Building Research Agents8 Oct 2025
- 2025AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learning2 Oct 2025
- 2025Where LLM Agents Fail and How They can Learn From Failures29 Sep 2025
- 2025Structural Enforcement of Statistical Rigor in AI-Driven Discovery: A Functional Architecturecited by 1
- 2026An AI Co-Data-Scientist for Prioritizing Candidate Biomarkers from Wearable Sensor Datacited by 1
- 2026Making AI Scientists Auditable from Evidence to Claimcited by 1
- 2026SciRisk-Bench: A Risk-Dimension-Aware Benchmark for AI4Science Safetycited by 1
- 2026SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoringcited by 1
- 2026Personalized Auto-Research: Towards a True AI Co-Scientistcited by 0
- 2026Personalized Auto-Research: Towards a True AI Co-Scientist14 Aug 2026
- 2026SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoring21 Jul 2026
- 2026SciRisk-Bench: A Risk-Dimension-Aware Benchmark for AI4Science Safety17 Jun 2026
- 2026Making AI Scientists Auditable from Evidence to Claim17 Jun 2026
- 2026An AI Co-Data-Scientist for Prioritizing Candidate Biomarkers from Wearable Sensor Data16 Apr 2026
- 2025Structural Enforcement of Statistical Rigor in AI-Driven Discovery: A Functional Architecture10 Nov 2025
Similar, not cited
Close in wording, no citation either way
- 2026Toward Reliable, Safe, and Secure LLMs for Scientific Applications
- 2023Controlling risks of AI in chemical science with agents
- 2024LabSafety Bench: Benchmarking LLMs on Safety Issues in Scientific Labs
- 2025SoSBench: Benchmarking Safety Alignment on Six Scientific Domains
- 2026SafeSci: Safety Evaluation of Large Language Models in Science Domains and Beyond
- 2024Safeguarding AI Agents: Developing and Analyzing Safety Architectures
- 2026LABSHIELD: A Multimodal Benchmark for Safety-Critical Reasoning and Planning in Scientific Laboratories
- 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents