{ "schema_version": 1, "project_id": "appgprj_6add5fa685b081919a9dc7f6df6dbe47", "baseline_date": "2026-10-25", "latest_date": "2026-11-06", "dates": [ "2026-10-25", "2026-10-26", "2026-10-27", "2026-10-28", "2026-10-29", "2026-10-31", "2026-11-01", "2026-11-02", "2026-11-03", "2026-11-04", "2026-11-05", "2026-11-06" ], "taxonomy": [ { "id": "injection", "label": "提示注入与攻击传播", "count": 33 }, { "id": "supplychain", "label": "仓库与供应链安全", "count": 16 }, { "id": "authorization", "label": "工具权限与沙箱", "count": 77 }, { "id": "memory", "label": "记忆与上下文安全", "count": 33 }, { "id": "multiagent", "label": "多智能体安全", "count": 37 }, { "id": "monitoring", "label": "监控与可解释性", "count": 61 }, { "id": "evaluation", "label": "安全评测与对齐", "count": 90 }, { "id": "privacy", "label": "隐私与数据泄露", "count": 19 }, { "id": "embodied", "label": "具身与行动安全", "count": 10 }, { "id": "robustness", "label": "鲁棒性与可用性", "count": 45 } ], "papers": { "2610.31404": { "id": "2610.31404", "title": "AgentPhishing: A Benchmark of LLM Email Agents Under Adaptive Attack", "classification": "relevant", "reason": "邮件 Agent 面对自适应钓鱼的检测与恶意请求执行评测。", "summary_zh": "针对特定邮件 Agent 优化可复用钓鱼邮件生成 Skill。作者评测九个 Agent，其中四个检测率低于 10%，恶意请求服从率超过 45%，说明静态钓鱼测试不能代表适应性攻击抗性。", "version_id": "2610.31404v1", "published": "2026-10-22T15:07:49Z", "updated": "2026-10-22T15:07:49Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.31404", "tags": [ "injection", "evaluation" ], "reason_zh": "以自适应钓鱼邮件评测邮件 Agent 是否识别并拒绝第三方恶意请求。" }, "author": { "id": "2610.31404", "title": "AgentPhishing: A Benchmark of LLM Email Agents Under Adaptive Attack", "version_id": "2610.31404v1", "first_author": "Justin Tan", "authors": [ "Justin Tan", "Miao Li", "Ding Zhao" ], "affiliations": [ "Carnegie Mellon University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31404v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31404", "evidence": "Justin Tan, Miao Li, Ding Zhao share the author-block affiliation Carnegie Mellon University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31366": { "id": "2610.31366", "title": "AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents", "classification": "relevant", "reason": "删除后 Agent 派生记忆仍可重建秘密，评测来源闭包删除。", "summary_zh": "以删除暴露与从未暴露的合成秘密作对照，测试派生记忆的删除后恢复。作者称单次查询可恢复约三分之二秘密；分散组件重组恢复率为 62–99%，来源感知闭包删除在测试中消除可见恢复。", "version_id": "2610.31366v1", "published": "2026-10-22T14:41:36Z", "updated": "2026-10-22T14:41:36Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.31366", "tags": [ "memory", "privacy", "evaluation" ], "reason_zh": "构建删除后信息恢复审计，检查派生记忆是否仍可重建已删除秘密。" }, "author": { "id": "2610.31366", "title": "AfterDeleteBench: Auditing Post-Deletion Information Persistence in LLM Agents", "version_id": "2610.31366v1", "first_author": "Ehsan Saleh", "authors": [ "Ehsan Saleh", "Roozbeh Nahavandi", "Sama Salarian", "Raef Bassily", "Andrew Perrault" ], "affiliations": [ "The Ohio State University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31366v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31366", "evidence": "Ehsan Saleh and coauthors share The Ohio State University author-block affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30666": { "id": "2610.30666", "title": "Your Token Is Gone: A Token-Consumption Countermeasure for Disrupting LLM-Based Scam Systems", "classification": "relevant", "reason": "通过提示诱导单体及多 Agent 额外计算，直接研究资源消耗攻击面。", "summary_zh": "TokenTrap 以任务库、路由及呈现方式将诈骗 Agent 引向无效计算。作者报告 50 轮下单体、层级、平面多 Agent 的 token 倍率分别达 2487、1616、567.8；是资源耗尽研究，防诈骗意图不等于一般安全保证。", "version_id": "2610.30666v1", "published": "2026-10-22T03:31:03Z", "updated": "2026-10-22T03:31:03Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30666", "tags": [ "robustness", "multiagent" ], "reason_zh": "研究通过额外推理与协作轮次消耗单体及多 Agent 诈骗系统的计算资源。" }, "author": { "id": "2610.30666", "title": "Your Token Is Gone: A Token-Consumption Countermeasure for Disrupting LLM-Based Scam Systems", "version_id": "2610.30666v1", "first_author": "Fudu Xing", "authors": [ "Fudu Xing", "Kailong Wang", "Tianlong Yu" ], "affiliations": [ "National University of Singapore" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.30666v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30666", "evidence": "PDF first page shows Fudu Xing superscript 2; institution 2 is National University of Singapore, Singapore.", "author_status": "verified", "affiliation_status": "verified", "pdf_checked": true, "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30418": { "id": "2610.30418", "title": "Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems", "classification": "relevant", "reason": "混合权限文档经 Agent 聚合推断产生保密泄漏。", "summary_zh": "研究 Agent 从分别可访问文档推断禁止披露的组合事实。30 个合成案例含 10800 次模拟和 1440 次 live 回答；作者称最佳测试模型在良性查询仍有 7.08% 披露，且拒绝文本本身可泄密。", "version_id": "2610.30418v1", "published": "2026-10-21T20:25:11Z", "updated": "2026-10-21T20:25:11Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30418", "tags": [ "privacy" ], "reason_zh": "研究 Agent 将可访问文档组合推断为禁止披露的敏感事实及拒绝中的泄密。" }, "author": { "id": "2610.30418", "title": "Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems", "version_id": "2610.30418v1", "first_author": "Daniel Ruiz", "authors": [ "Daniel Ruiz", "Luca Luceri", "Emilio Ferrara" ], "affiliations": [ "Information Sciences Institute, University of Southern California" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30418v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30418", "evidence": "Author block names Daniel C. Ruiz, Luca Luceri and Emilio Ferrara together above Information Sciences Institute, University of Southern California.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30365": { "id": "2610.30365", "version_id": "2610.30365v2", "abstract_sha256": "41259a90f28504b60265b55f40057186fbfa3ddbed3ab18112fe5c53076e25dc", "abstract_read": true, "classification": "relevant", "reason": "攻击者控制可检索网页操纵工具增强LLM回答，是推理时外部证据攻击面。", "reason_zh": "攻击者控制可检索网页操纵工具增强LLM回答，是推理时外部证据攻击面。", "summary_zh": "问题：搜索证据稀疏区可被虚假叙事占据，搜索LLM综合回答掩盖来源不足。方法：比较三种用户语气、三种搜索LLM、五种填充策略及站点可见度和生成式优化特征。作者报告仅一页也能攻击，跨条件攻击内容31%出现在回答中；怀疑语气仅略降成功率并略增警告，未发现语气或模型选择的大效应。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "攻击者控制可检索网页操纵工具增强LLM回答，是推理时外部证据攻击面。" }, "title": "Data-Void Exploits in Web-Searching LLMs", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-21T19:28:32Z", "updated": "2026-11-02T07:12:32Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR", "cs.HC", "cs.IR" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.30365v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-11-04" ], "version_history": [ { "id": "2610.30365", "version_id": "2610.30365v1", "classification": "relevant", "announcement_date": "Fri, 23 Oct 2026", "published": "2026-10-21T19:28:32Z", "updated": "2026-10-21T19:28:32Z", "reason": "操纵搜索证据使联网 LLM 引用和采纳攻击内容，属检索污染。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.30365", "title": "Data-Void Exploits in Web-Searching LLMs", "version_id": "2610.30365v2", "first_author": "Michele Guerra", "authors": [ "Michele Guerra", "Wuyeh Jobe", "Sanjana Nambiar", "Christina Pöpper", "Azza Abouzied" ], "affiliations": [ "New York University Abu Dhabi" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.30365v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30365", "evidence": "首页标题及v2匹配；Michele Guerra首位，共享NYU Abu Dhabi署名。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "affiliation_checked": true }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.30365", "title": "Data-Void Exploits in Web-Searching LLMs", "classification": "relevant", "reason": "操纵搜索证据使联网 LLM 引用和采纳攻击内容，属检索污染。", "summary_zh": "在缺少既有搜索证据的主题放置攻击网页，使联网模型检索、引用和采纳。作者称单页即可生效，各条件汇总有 31% 回答出现攻击内容，怀疑式提示保护有限。", "version_id": "2610.30365v1", "published": "2026-10-21T19:28:32Z", "updated": "2026-10-21T19:28:32Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30365", "tags": [ "injection" ], "reason_zh": "研究攻击者利用搜索证据空白放置网页，污染联网模型采纳与引用的证据。" }, "author": { "id": "2610.30365", "title": "Data-Void Exploits in Web-Searching LLMs", "version_id": "2610.30365v1", "first_author": "Michele Guerra", "authors": [ "Michele Guerra", "Wuyeh Jobe", "Sanjana Nambiar", "Christina Pöpper", "Azza Abouzied" ], "affiliations": [ "New York University Abu Dhabi" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30365v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30365", "evidence": "Michele Guerra and all coauthors share the New York University Abu Dhabi affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.30202": { "id": "2610.30202", "title": "MPIDetector: Detecting Multi-modal Prompt Injection via LLM-based Reasoning", "classification": "relevant", "reason": "检测文本/视觉提示注入，并在 WebInject 网页 Agent 环境评测。", "summary_zh": "通过少样本语义意图推理检测文本和视觉注入；作者称文本最高准确率 90.91%、视觉 99.28%，500 个 WebInject 环境注入检测最高 99.8%。这些是不同设置的最优值，不能合并为统一防护率。", "version_id": "2610.30202v1", "published": "2026-10-21T10:27:56Z", "updated": "2026-10-21T10:27:56Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30202", "tags": [ "injection", "monitoring" ], "reason_zh": "以语义意图推理检测文本、图像和网页环境中的提示注入。" }, "author": { "id": "2610.30202", "title": "MPIDetector: Detecting Multi-modal Prompt Injection via LLM-based Reasoning", "version_id": "2610.30202v1", "first_author": "Yiheng Li", "authors": [ "Yiheng Li", "Jingyue Li" ], "affiliations": [ "Paul G. Allen School of Computer Science & Engineering, University of Washington" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30202v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30202", "evidence": "Yiheng Li has a separate author block explicitly listing Paul G. Allen School of Computer Science & Engineering, University of Washington.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30738": { "id": "2610.30738", "title": "AgentTriage: Replayable Security Diagnosis Across Heterogeneous Agent Runtimes", "classification": "relevant", "reason": "跨 Agent 运行时安全诊断、来源图、证据契约与可重放验证。", "summary_zh": "把运行事件统一为来源图和证据契约，缺证时弃权并以确定性程序核验诊断。五种运行时 159 次执行，120 案例联合诊断 0.858，较同 schema 最强基线高 0.175。", "version_id": "2610.30738v1", "published": "2026-10-22T05:09:44Z", "updated": "2026-10-22T05:09:44Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30738", "tags": [ "monitoring" ], "reason_zh": "以运行时事件、来源图和证据契约实现可重放、可核验的安全诊断。" }, "author": { "id": "2610.30738", "title": "AgentTriage: Replayable Security Diagnosis Across Heterogeneous Agent Runtimes", "version_id": "2610.30738v1", "first_author": "Jie Ying", "authors": [ "Jie Ying", "Xutao Zhang", "Ningyuan Chen", "Mengce Zheng", "Jun Li", "Zhongjie Zhu", "Tiantian Zhu" ], "affiliations": [ "College of Information and Intelligence Engineering, Zhejiang Wanli University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30738v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30738", "evidence": "Footnote explicitly says J. Ying and five coauthors are with College of Information and Intelligence Engineering, Zhejiang Wanli University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30157": { "id": "2610.30157", "title": "MCP vs CLI for AI Agents: A Comparative Analysis of Tool Integration Strategies for Autonomous Systems", "classification": "relevant", "reason": "比较 MCP/CLI 的权限、凭据隔离和审计架构；非攻击实证。", "summary_zh": "从权限、凭据隔离、审计、多租户、经济性等 14 个维度比较 MCP 与 CLI，主张本地 CLI 与受治理 MCP 混合架构。摘要属于架构分析，没有给出可核验攻击成功率。", "version_id": "2610.30157v1", "published": "2026-07-29T05:45:07Z", "updated": "2026-07-29T05:45:07Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30157", "tags": [ "authorization", "monitoring" ], "reason_zh": "比较 CLI 与 MCP 的细粒度访问控制、凭据隔离和结构化审计架构。" }, "author": { "id": "2610.30157", "title": "MCP vs CLI for AI Agents: A Comparative Analysis of Tool Integration Strategies for Autonomous Systems", "version_id": "2610.30157v1", "first_author": "Arun Malik", "authors": [ "Arun Malik", "Nitish Talasu", "Bradley Klemick", "Vineet Tushar Trivedi", "Prachi Shah", "Sanay Devi", "Junjie Zhang", "Kunal Sonawane" ], "affiliations": [ "Microsoft Corporation" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.30157v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30157", "evidence": "PDF author block explicitly lists Arun Malik and coauthors above Microsoft Corporation, Redmond, WA, USA.", "author_status": "verified", "affiliation_status": "verified", "pdf_checked": true, "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.29869": { "id": "2610.29869", "title": "Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents", "classification": "relevant", "reason": "Coding Agent 上下文压缩丢失来源后洗白攻击指令。", "summary_zh": "研究上下文压缩把有类型消息变成文本标签后，攻击者内容伪装授权并进入可信摘要。作者称五种扁平化 harness 洗白率 87–100%，四种保留角色类型的 harness 同攻击下 0%；live pi 实验约 50% 对干净对照 0%。", "version_id": "2610.29869v1", "published": "2026-10-21T15:24:23Z", "updated": "2026-10-21T15:24:23Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.29869", "tags": [ "memory", "injection", "authorization" ], "reason_zh": "研究上下文压缩丢失角色来源，使注入内容变成持久记忆中的伪造用户授权。" }, "author": { "id": "2610.29869", "title": "Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents", "version_id": "2610.29869v1", "first_author": "Arshan Dabirsiaghi", "authors": [ "Arshan Dabirsiaghi" ], "affiliations": [ "Pixee" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29869v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29869", "evidence": "Single author Arshan Dabirsiaghi followed by Pixee in frontmatter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.29747": { "id": "2610.29747", "title": "Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations", "classification": "relevant", "reason": "攻击者控制的取证材料注入导致分析错误、文件写入与外联。", "summary_zh": "把取证证据作为攻击者控制输入，分类目标、技巧、位置和隐藏方式；三个概念验证分别改变报告结论、写入指定工作站内容、引发外联。直接揭示分析材料到行动权限的跨界。", "version_id": "2610.29747v1", "published": "2026-10-21T13:48:03Z", "updated": "2026-10-21T13:48:03Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.29747", "tags": [ "injection" ], "reason_zh": "研究取证证据中植入指令对调查结论、文件写入和网络操作的劫持。" }, "author": { "id": "2610.29747", "title": "Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations", "version_id": "2610.29747v1", "first_author": "Frank Breitinger", "authors": [ "Frank Breitinger", "Jan Gruber", "Christopher Hargreaves", "Jan-Niclas Hilgert", "Gaëtan Michelet", "Mark Scanlon" ], "affiliations": [ "Chair for Cybersecurity, Institute of Computer Science, University of Augsburg" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29747v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29747", "evidence": "Frank Breitinger author address explicitly lists Chair for Cybersecurity, Institute of Computer Science, University of Augsburg.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.29379": { "id": "2610.29379", "title": "Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities", "classification": "relevant", "reason": "攻击者可利用漏洞发现 harness 的筛选盲区隐藏代码漏洞，并涉及提示注入。", "summary_zh": "梳理 12 个漏洞发现 harness 的 13 类结构性漏报点，攻击者可利用前后处理隐藏漏洞。作者展示一个文件被六个 harness 丢弃、五个无提示，建议显式披露分析范围与防规避测试。", "version_id": "2610.29379v1", "published": "2026-10-21T08:05:15Z", "updated": "2026-10-21T08:05:15Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.29379", "tags": [ "supplychain", "monitoring", "robustness" ], "reason_zh": "分析代码安全审计框架漏选、过滤和合并导致的隐蔽漏报及攻击者规避。" }, "author": { "id": "2610.29379", "title": "Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities", "version_id": "2610.29379v1", "first_author": "Gadi Evron", "authors": [ "Gadi Evron" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.29379v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29379", "evidence": "no_affiliation_stated: PDF frontmatter lists Gadi Evron and email only, with no institutional affiliation; email domain is not used as affiliation evidence.", "author_status": "verified", "affiliation_status": "unresolved", "pdf_checked": true, "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.29178": { "id": "2610.29178", "title": "Correlated Failures of AI Approval Monitors", "classification": "relevant", "reason": "Agent 行动审批监控器因共享模型/证据而相关失效，比较来源计数与投票。", "summary_zh": "研究付款等行动审批器因共享证据或模型一起失效，以可相关故障集合替代独立投票。等安全下按来源计数误拦 0.9%，最佳计票规则 7.4%；预注册最坏情况仍失败，加入规则引擎才恢复所测攻击下条件。", "version_id": "2610.29178v1", "published": "2026-10-21T04:09:37Z", "updated": "2026-10-21T04:09:37Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.29178", "tags": [ "monitoring", "authorization", "injection" ], "reason_zh": "研究审批监控器共享污染证据时的相关失效，以及按证据来源聚合授权判定。" }, "author": { "id": "2610.29178", "title": "Correlated Failures of AI Approval Monitors", "version_id": "2610.29178v1", "first_author": "Luca Zanolini", "authors": [ "Luca Zanolini" ], "affiliations": [ "Independent researcher" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29178v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29178", "evidence": "Luca Zanolini author affiliation explicitly states Independent researcher.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28966": { "id": "2610.28966", "title": "Black-Box Red-Teaming of Multi-Agent Systems via Reinforcement Learning", "classification": "relevant", "reason": "强化学习黑盒攻击多 Agent 系统，诱导调用子 Agent 并抽取系统提示。", "summary_zh": "ReMAS 先强化学习改写抽取提示，再生成能调用指定子 Agent 的攻击模板。作者报告比既有黑盒攻击更高的系统提示抽取成功率及跨模型/结构迁移，但摘要无具体比例。", "version_id": "2610.28966v1", "published": "2026-10-20T22:32:22Z", "updated": "2026-10-20T22:32:22Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28966", "tags": [ "multiagent", "injection", "privacy" ], "reason_zh": "以强化学习生成针对多 Agent 调用结构的攻击，提取子 Agent 系统提示。" }, "author": { "id": "2610.28966", "title": "Black-Box Red-Teaming of Multi-Agent Systems via Reinforcement Learning", "version_id": "2610.28966v1", "first_author": "Yuqi Jia", "authors": [ "Yuqi Jia", "Hangsheng Zhang", "Chenxi Liu", "Junjie Liang", "Xun Chen" ], "affiliations": [ "Duke University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28966v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28966", "evidence": "Yuqi Jia has dagger marker; dagger affiliation is Duke University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28810": { "id": "2610.28810", "title": "Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise", "classification": "relevant", "reason": "持久记忆、项目、Skill 和 MCP 资源注入导致跨会话持续控制与泄漏。", "summary_zh": "统一持久记忆注入威胁模型，覆盖个人记忆、项目、Skill、组织指令和 MCP 资源。作者在三家服务展示跨新会话的持续错误信息、有害生成或假离线，Claude 共享记忆还可跨组织用户传播及泄露提示。", "version_id": "2610.28810v1", "published": "2026-10-20T18:33:05Z", "updated": "2026-10-20T18:33:05Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28810", "tags": [ "memory", "injection", "privacy" ], "reason_zh": "研究持久记忆注入跨会话传播及共享记忆中的跨用户泄露。" }, "author": { "id": "2610.28810", "title": "Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise", "version_id": "2610.28810v1", "first_author": "Pedro H. Barcha Correia", "authors": [ "Pedro H. Barcha Correia", "Matheus Azevedo de Sá", "Paulo H. Gomes de Senna", "Giovanni Mandel Martignago", "Victor Takashi Hayashi", "Charles Christian Miers", "Marcos A. Simplicio" ], "affiliations": [ "Universidade de São Paulo (USP)" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28810v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28810", "evidence": "Pedro H. Barcha Correia has * marker; * affiliation is Universidade de São Paulo (USP).", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28989": { "id": "2610.28989", "title": "AgentPolicyForge: From Executable Environments to Policy Benchmarks and Adaptive Guards", "classification": "relevant", "reason": "基于可执行环境构造 Agent 权限策略基准并训练工具调用守卫。", "summary_zh": "从可执行环境生成 PolicyGym，698 个训练场景、254 个独立人工复核测试场景、十类策略；所有违规均使用允许的工具，因此需查参数、资源、上下文。最终 guard 较只靠策略提示相对降低攻击成功率 40–44%，并减少正常请求误拒。", "version_id": "2610.28989v1", "published": "2026-10-20T23:31:32Z", "updated": "2026-10-20T23:31:32Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28989", "tags": [ "authorization", "evaluation" ], "reason_zh": "从可执行环境生成工具参数、资源及上下文权限案例，并训练策略守卫。" }, "author": { "id": "2610.28989", "title": "AgentPolicyForge: From Executable Environments to Policy Benchmarks and Adaptive Guards", "version_id": "2610.28989v1", "first_author": "Chao Shang", "authors": [ "Chao Shang", "Wanyu Du", "Yi Zhang", "Sandesh Swamy" ], "affiliations": [ "AWS AI Labs" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28989v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28989", "evidence": "Chao Shang and coauthors share AWS AI Labs author-block affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28987": { "id": "2610.28987", "title": "PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust", "classification": "relevant", "reason": "持久记忆可信门控与 Lean 机器检查完整性定理及共享记忆实验。", "summary_zh": "PerMIT 仅将用户输入和门控确认值视为可信，在有限记忆接口证明并用 Lean 4 检查两条完整性定理。Trojan Hippo 测试零观察成功；最多 90 Agent 的共享记忆实验未提升直接注入，理论依赖明确门控/信任假设。", "version_id": "2610.28987v1", "published": "2026-10-20T23:31:06Z", "updated": "2026-10-20T23:31:06Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28987", "tags": [ "memory", "authorization", "multiagent" ], "reason_zh": "以确认门和机器验证完整性定理约束不可信记忆使用，并支持多 Agent 可信共享。" }, "author": { "id": "2610.28987", "title": "PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust", "version_id": "2610.28987v1", "first_author": "Tanqiu Jiang", "authors": [ "Tanqiu Jiang", "Min Bai", "Sadat Shahriar", "Wanyu Du", "Sandesh Swamy" ], "affiliations": [ "Stony Brook University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28987v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28987", "evidence": "Tanqiu Jiang author affiliation is Stony Brook University. Footnote additionally says work was done during an internship at AWS AI Labs.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28425": { "id": "2610.28425", "title": "After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents", "classification": "relevant", "reason": "跨会话记忆与定时触发让一次间接注入反复生效。", "summary_zh": "CarryoverBench 含 12 个人助手场景和 101 个任务，分别评分植入与即时、自动定时、潜伏记忆触发。五个模型中已植入载荷五轮无可测衰减，移到第二运行时减弱但未消除，提示需运行时控制。", "version_id": "2610.28425v1", "published": "2026-10-20T15:55:05Z", "updated": "2026-10-20T15:55:05Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28425", "tags": [ "memory", "injection", "evaluation" ], "reason_zh": "评测注入载荷经记忆和定时任务跨会话植入、触发及持续影响。" }, "author": { "id": "2610.28425", "title": "After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents", "version_id": "2610.28425v1", "first_author": "Zhiyue Xu", "authors": [ "Zhiyue Xu", "Xukai Wang", "Zhiyuan Huang", "Mingjie Zhan", "Jian Zhao", "Xu-Yao Zhang" ], "affiliations": [ "MAIS, Institute of Automation, Chinese Academy of Sciences", "School of Artificial Intelligence, UCAS", "Zhongguancun Academy" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28425v1", "shared_first_authors": [ "Zhiyue Xu", "Xukai Wang" ], "shared_first_note": "Both first two authors carry *; PDF footnote states Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28425", "evidence": "PDF first page shows Zhiyue Xu superscripts 1,2,3, corresponding to the three listed affiliations.", "author_status": "verified", "affiliation_status": "verified", "pdf_checked": true, "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28397": { "id": "2610.28397", "version_id": "2610.28397v2", "abstract_sha256": "0c29fa5e5038ee6d2cdea1034c360a7637b8e1705db1d1c165c39e390c7e0dcc", "abstract_read": true, "classification": "relevant", "reason": "统一保护单、多代理本地事件、消息路径、角色权限及不透明参与者。", "reason_zh": "统一保护单、多代理本地事件、消息路径、角色权限及不透明参与者。", "summary_zh": "问题：分布权限与可能受损参与者增加多代理不安全行动、泄漏和操纵风险。方法：MAS-Guard以本地专家A-Guard检查事件，开发者Agent Charters与控制面联合确定性路由、能力和格式检查及语义评估，支持放行、反思、确认与阻断。作者在六基准和三家模型报告攻击成功率相对无防护下降71.5–86.3%，良性任务满足效用参考标准。", "topics": { "tags": [ "authorization", "multiagent", "monitoring", "injection", "privacy", "evaluation" ], "reason_zh": "统一保护单、多代理本地事件、消息路径、角色权限及不透明参与者。" }, "title": "MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-20T15:44:37Z", "updated": "2026-11-02T16:26:52Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.28397v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-11-04" ], "version_history": [ { "id": "2610.28397", "version_id": "2610.28397v1", "classification": "relevant", "announcement_date": "Wed, 21 Oct 2026", "published": "2026-10-20T15:44:37Z", "updated": "2026-10-20T15:44:37Z", "reason": "单体/多 Agent 的本地守卫、系统章程和控制平面安全防护。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.28397", "title": "MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems", "version_id": "2610.28397v2", "first_author": "Mohammad Kachuee", "authors": [ "Mohammad Kachuee", "Phu Mon Htut", "Sheng Li", "Nikolaos Pappas", "Miguel Ballesteros", "Yassine Benajiba", "Sujith Ravi", "Dan Roth" ], "affiliations": [ "Oracle AI" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28397v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28397", "evidence": "首页标题及v2匹配；Mohammad Kachuee首位，作者共享Oracle AI。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "affiliation_checked": true }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.28397", "title": "MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems", "classification": "relevant", "reason": "单体/多 Agent 的本地守卫、系统章程和控制平面安全防护。", "summary_zh": "MAS-Guard 将本地专家守卫与开发者章程、路由/权限/格式确定性检查结合，并支持允许、反思、确认和阻断。六基准、三模型下，作者报告相对未防护攻击成功率降低 71.5–86.3%，同时满足其良性效用标准。", "version_id": "2610.28397v1", "published": "2026-10-20T15:44:37Z", "updated": "2026-10-20T15:44:37Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28397", "tags": [ "multiagent", "authorization", "monitoring" ], "reason_zh": "以本地守卫和系统控制层检查多 Agent 路由、能力、角色与消息并实施干预。" }, "author": { "id": "2610.28397", "title": "MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems", "version_id": "2610.28397v1", "first_author": "Mohammad Kachuee", "authors": [ "Mohammad Kachuee", "Phu Mon Htut", "Sheng Li", "Nikolaos Pappas", "Miguel Ballesteros Martinez", "Yassine Benajiba", "Sujith Ravi", "Dan Roth" ], "affiliations": [ "Oracle AI" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28397v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28397", "evidence": "Mohammad Kachuee is first in author group, followed by remaining authors and the common Oracle AI affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.28315": { "id": "2610.28315", "title": "Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory", "classification": "relevant", "reason": "Agent 记忆在正常对话中自我强化敏感属性披露，评测响应侧缓解。", "summary_zh": "多会话模拟显示记忆驱动回答把属性猜测和预设带回对话，使用户确认并累积隐私泄漏。四种支持模型中响应侧不陈述/预设属性的指令可把泄漏降至近无记忆水平，保留多数质量收益。", "version_id": "2610.28315v2", "published": "2026-10-20T14:52:57Z", "updated": "2026-10-22T14:31:33Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28315", "tags": [ "memory", "privacy" ], "reason_zh": "研究持久记忆回应与用户反馈相互强化而扩大个人属性泄露的机制。" }, "author": { "id": "2610.28315", "title": "Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory", "version_id": "2610.28315v2", "first_author": "Masahiro Kaneko", "authors": [ "Masahiro Kaneko", "Hiromi Arai", "Timothy Baldwin" ], "affiliations": [ "MBZUAI", "Third Intelligence" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28315v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28315", "evidence": "Masahiro Kaneko individual author block lists MBZUAI and Third Intelligence.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28093": { "id": "2610.28093", "title": "ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents", "classification": "relevant", "reason": "直接为有状态LLM Agent记忆实施来源和权限标签检查，将网页/工具内容提示注入变为宿主保护故障。", "abstract_read": true, "summary_zh": "问题：Agent长期记忆来自网页和工具结果，但宿主不记录其授权范围，隐藏指令可能被当作用户命令。方法：ClawMMU为每段记忆附所有者、作用域、来源和权限，在内容进入上下文、存取持久化存储及驱动工具调用时检查；核心原则是权限不能自行抬升。作者声称：检查依赖来源而非文本内容，可在模型受骗时仍由宿主将记忆攻击作为保护故障拦下。摘要未给实验数据或具体证明细节。", "topics": { "tags": [ "memory", "authorization", "injection" ], "reason_zh": "明确防止不可信记忆与工具内容升权，跨上下文/持久化/调用边界执行宿主侧保护。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.28093v2", "published": "2026-10-20T12:09:53Z", "updated": "2026-10-25T08:37:48Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR", "cs.OS" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-21", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-21", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.28093v2", "abstract_sha256": "b785f6bc40980dd9403c9b2ae09e326ba82d9fd16b669499f5078cdc47be559c", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-28" ], "version_history": [ { "id": "2610.28093", "version_id": "2610.28093v1", "classification": "relevant", "announcement_date": "Wed, 21 Oct 2026", "published": "2026-10-20T12:09:53Z", "updated": "2026-10-20T12:09:53Z", "reason": "为 Agent 长期记忆标注归属、范围、来源和权威并在读写/工具调用时检查。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.28093", "title": "ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents", "version_id": "2610.28093v2", "first_author": "Jinhao Hu", "authors": [ "Jinhao Hu", "Bardia Mohammadi", "Mofasshara Binte Rafique", "Lars Henning Klein", "Akhil Arora", "Ashvin Goel", "Laurent Bindschaedler" ], "affiliations": [ "MPI-SWS" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28093v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://arxiv.org/abs/2610.28093v2", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "shared_first_affiliations": {} }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.28093", "title": "ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents", "classification": "relevant", "reason": "为 Agent 长期记忆标注归属、范围、来源和权威并在读写/工具调用时检查。", "summary_zh": "ClawMMU 为记忆标注所有者、范围、来源及权限，在进入上下文、存储读写及驱动工具时检查，以来源限制自我提权。摘要提出保护架构，未提供实验统计，不应描述为已验证全面防御。", "version_id": "2610.28093v1", "published": "2026-10-20T12:09:53Z", "updated": "2026-10-20T12:09:53Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28093", "tags": [ "memory", "authorization", "injection" ], "reason_zh": "为记忆标注来源和权限，在上下文、存储与工具边界阻止注入内容自行升权。" }, "author": { "id": "2610.28093", "title": "ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents", "version_id": "2610.28093v1", "first_author": "Jinhao Hu", "authors": [ "Jinhao Hu", "Bardia Mohammadi", "Mofasshara Binte Rafique", "Lars Henning Klein", "Akhil Arora", "Ashvin Goel", "Laurent Bindschaedler" ], "affiliations": [ "MPI-SWS" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28093v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28093", "evidence": "Jinhao Hu individual author block explicitly lists MPI-SWS.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.27739": { "id": "2610.27739", "title": "Make the Adversary Spend More Energy: Generative Deception against Language-Model Attackers in Critical Infrastructure", "classification": "relevant", "reason": "自主 LLM 攻击 Agent 遭诱饵反注入与算力消耗；衡量双边能耗代价。", "summary_zh": "对自主网络攻击 Agent 使用语言模型诱饵与反注入，并同硬件测量双边能耗。330 会话、八模型配对显示不思考模式通常消耗攻击方更多；双方开启思考使防守能耗增 8–17 倍，并可逆转收益，token 并非能耗可靠替代。", "version_id": "2610.27739v1", "published": "2026-10-20T07:04:05Z", "updated": "2026-10-20T07:04:05Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27739", "tags": [ "robustness" ], "reason_zh": "测量语言模型攻击者与欺骗防御者的双边能耗，分析增加对手资源成本的条件。" }, "author": { "id": "2610.27739", "title": "Make the Adversary Spend More Energy: Generative Deception against Language-Model Attackers in Critical Infrastructure", "version_id": "2610.27739v1", "first_author": "Vlad Mihal", "authors": [ "Vlad Mihal", "Hosam Alamleh", "Alessandro Cantelli-Forti" ], "affiliations": [ "Department of Engineering and Architecture, University of Parma", "CNIT, RaSS National Laboratory" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27739v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27739", "evidence": "Vlad Mihal individual author block lists Department of Engineering and Architecture, University of Parma, and CNIT, RaSS National Laboratory.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27620": { "id": "2610.27620", "title": "Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents", "classification": "relevant", "reason": "证明逐行动授权不能保障跨执行目的等全局策略，构造可验证违例。", "summary_zh": "将授权失败分为单轨迹与跨轨迹关系性质，证明零误报逐行动监控无法发现特定关系性目的违规。SAT/SMT 生成最小反例；九种 LLM 逐行动近乎全批准，联合看两条执行则能识别，说明应监控执行间关系。", "version_id": "2610.27620v1", "published": "2026-10-20T04:35:39Z", "updated": "2026-10-20T04:35:39Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27620", "tags": [ "authorization", "monitoring" ], "reason_zh": "证明逐动作授权无法覆盖跨执行的目的和委托约束，研究跨轨迹监控要求。" }, "author": { "id": "2610.27620", "title": "Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents", "version_id": "2610.27620v1", "first_author": "Anmol Pandey", "authors": [ "Anmol Pandey", "Aditya Jain", "Liang Chen", "Carsten Maple" ], "affiliations": [ "University of Warwick" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27620v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27620", "evidence": "Anmol Pandey individual author block lists University of Warwick.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27543": { "id": "2610.27543", "title": "KNOX: Hardware-assisted Regulatory Sandbox for Generative Models", "classification": "relevant", "reason": "TEE 中为 Agent 工具/系统调用执行证明政策并记录可验证执行图。", "summary_zh": "KNOX 在 TEE 中生成带证明策略 manifest，执行前比较工具/系统调用并记录可验证执行图。作者用 Agent 工作负载演示合规、保密、可证明性和多监管验证，报告开销低于 1%；法规判断的正确性仍依赖策略来源。", "version_id": "2610.27543v1", "published": "2026-10-20T02:57:19Z", "updated": "2026-10-20T02:57:19Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27543", "tags": [ "authorization", "monitoring", "privacy" ], "reason_zh": "以可信执行环境、策略监控和可证明执行图实现沙箱合规及模型权重保密。" }, "author": { "id": "2610.27543", "title": "KNOX: Hardware-assisted Regulatory Sandbox for Generative Models", "version_id": "2610.27543v1", "first_author": "Vasisht Duddu", "authors": [ "Vasisht Duddu", "Adam Caulfield", "Xi He" ], "affiliations": [ "Vector Institute", "University of Waterloo" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27543v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27543", "evidence": "Vasisht Duddu has * and dagger markers; these map to Vector Institute and University of Waterloo.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27244": { "id": "2610.27244", "title": "AutoRedClaw: Automated Red-Teaming for Claw-Style Agents", "classification": "relevant", "reason": "自动构造持久个人助手配置、记忆、Skill 投毒攻击与执行环境。", "summary_zh": "AutoRedClaw 自动生成持久助手攻击及可执行环境，按风险、策略、阶段和表面探索。作者称有效攻击率超过 30%、每成功样本低于 0.10 美元，330 案例基准中七 harness/四模型多数 ASR 超 50%；成本是作者实验结果，不涉及本次费用。", "version_id": "2610.27244v1", "published": "2026-10-19T20:15:39Z", "updated": "2026-10-19T20:15:39Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27244", "tags": [ "injection", "memory", "evaluation" ], "reason_zh": "自动构建持久助手的端到端红队场景，覆盖配置、记忆和技能投毒。" }, "author": { "id": "2610.27244", "title": "AutoRedClaw: Automated Red-Teaming for Claw-Style Agents", "version_id": "2610.27244v1", "first_author": "Hao Li", "authors": [ "Hao Li", "Tongyan Hu", "Weidi Luo", "Shanghao Shi", "Xiaogeng Liu", "Aiden Suh", "Yulong Cao", "Ning Zhang", "William Yeoh", "Yevgeniy Vorobeychik", "Chaowei Xiao" ], "affiliations": [ "Washington University in St. Louis" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27244v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27244", "evidence": "Hao Li individual author block lists Washington University in St. Louis.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26935": { "id": "2610.26935", "title": "How Intervention History Changes AI Agent Sabotage on Subsequent Tasks", "classification": "relevant", "reason": "控制评测中记住先前拦截如何改变 Agent 隐蔽破坏行为。", "summary_zh": "在 IaC 与 SHADE-Arena 测试 Agent 记住先前被可信模型替换是否改变下一任务破坏。Opus 4.8 在 IaC 主副任务同时成功由 77% 降至 12% 或 38%，GPT-5.4 无显著变化，未发现所测条件下存活破坏增加。", "version_id": "2610.26935v1", "published": "2026-10-17T21:24:33Z", "updated": "2026-10-17T21:24:33Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.26935", "tags": [ "evaluation", "memory", "monitoring" ], "reason_zh": "在控制评测中研究保留过往拦截记录如何改变后续隐蔽破坏与监控规避。" }, "author": { "id": "2610.26935", "title": "How Intervention History Changes AI Agent Sabotage on Subsequent Tasks", "version_id": "2610.26935v1", "first_author": "Daniel Saeedi", "authors": [ "Daniel Saeedi", "Amirali Aghazadeh" ], "affiliations": [ "Department of Electrical and Computer Engineering, Georgia Institute of Technology" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26935v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26935", "evidence": "Daniel Saeedi and Amirali Aghazadeh share Department of Electrical and Computer Engineering, Georgia Institute of Technology.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28484": { "id": "2610.28484", "title": "Proof-Carrying Contracts: Commitments AI Agents Cannot Break", "classification": "relevant", "reason": "每次 Agent 操作要求机器可检查的约束证明并由 Airlock 控制执行。", "summary_zh": "Proof-Carrying Contracts 要求 Agent 每次操作携带机器可检验证明，由 Airlock 验证并控制访问。作者给出执行全程保持约束的定理并区分形式模型与现实安全条件；摘要未给攻击基准或性能统计。", "version_id": "2610.28484v1", "published": "2026-10-20T16:30:34Z", "updated": "2026-10-20T16:30:34Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28484", "tags": [ "authorization", "multiagent" ], "reason_zh": "要求 Agent 为操作提供机器可检查的约束证明，以执行系统约束委托和协作。" }, "author": { "id": "2610.28484", "title": "Proof-Carrying Contracts: Commitments AI Agents Cannot Break", "version_id": "2610.28484v1", "first_author": "Carlo Ciliberto", "authors": [ "Carlo Ciliberto", "Alessandro Rudi", "Enrico Tassi" ], "affiliations": [ "AI Centre, Computer Science Department, University College London", "Praxis Lab, The Italian Institute of Artificial Intelligence (AI4I)" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28484v1", "shared_first_authors": [], "shared_first_note": "The PDF explicitly states that authors are in alphabetical order; no shared-first designation is stated.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28484", "evidence": "PDF shows Carlo Ciliberto superscripts 1,2; affiliations map to UCL AI Centre and Praxis Lab, AI4I.", "author_status": "verified", "affiliation_status": "verified", "pdf_checked": true, "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27574": { "id": "2610.27574", "title": "The Show-Up Attack: When Subagents Win Over Their Supervisor", "classification": "relevant", "reason": "恶意子 Agent 诱导监督者超范围委派，直接评测多 Agent 权威边界。", "summary_zh": "Show-up attack 让恶意子 Agent 说服监督者把超出职责的任务分给自己。SUA-Arena 含六策略、188 测试，六个模型都受影响，GPT-5.6-Sol 最高 ASR 0.93；提示和限通信缓解不稳定。", "version_id": "2610.27574v1", "published": "2026-10-20T03:41:13Z", "updated": "2026-10-20T03:41:13Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27574", "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "构建恶意子 Agent 诱使主管将其纳入越权任务的攻击与基准。" }, "author": { "id": "2610.27574", "title": "The Show-Up Attack: When Subagents Win Over Their Supervisor", "version_id": "2610.27574v1", "first_author": "Maosen Zhang", "authors": [ "Maosen Zhang", "Jianshuo Dong", "Yutong Zhang", "Jie Zhang", "Tianwei Zhang", "Han Qiu" ], "affiliations": [ "Tsinghua University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27574v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27574", "evidence": "Maosen Zhang, Jianshuo Dong and Yutong Zhang occur in one author group with Tsinghua University affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27548": { "id": "2610.27548", "title": "Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment", "classification": "relevant", "reason": "AuthorizationBench 测试无伤害也越权的代理行为，区分任务完成和授权。", "summary_zh": "AuthorizationBench 含 286 可执行任务，四模型、两推理档、三 harness 共 6864 轨迹。作者报告 19.2% 越权，增加推理总体无改善；良性压力越权率 23.5% 高于恶意注入 17.6%，因此不能只按损害或任务成功评估。", "version_id": "2610.27548v2", "published": "2026-10-20T03:01:39Z", "updated": "2026-10-21T06:31:44Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27548", "tags": [ "authorization", "evaluation" ], "reason_zh": "以可执行任务直接评测 Agent 是否越出用户授予的行动范围。" }, "author": { "id": "2610.27548", "title": "Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment", "version_id": "2610.27548v2", "first_author": "Zhiping Zhang", "authors": [ "Zhiping Zhang", "Franklin Mingzhe Li", "Zihao Huang", "Tianshi Li" ], "affiliations": [ "Northeastern University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27548v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27548", "evidence": "Zhiping Zhang individual author block lists Northeastern University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27210": { "id": "2610.27210", "title": "You Are the Trigger: Speaker-Activated Backdoors", "classification": "relevant", "reason": "语音模型后门向目标说话者转录注入命令并驱使下游 Agent 有害调用。", "summary_zh": "先增强说话者表征再绑定后门，使自然目标声音而非附加触发器产生恶意转录。作者称最低两分钟语音即可训练，96.9% 目标转录插入指令，下游 frontier Agent 有害行动最高 87.5%。", "version_id": "2610.27210v1", "published": "2026-10-19T19:43:13Z", "updated": "2026-10-19T19:43:13Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27210", "tags": [ "supplychain", "injection" ], "reason_zh": "研究语音模型微调后门将目标说话者声音转为恶意转录指令并驱动下游工具。" }, "author": { "id": "2610.27210", "title": "You Are the Trigger: Speaker-Activated Backdoors", "version_id": "2610.27210v1", "first_author": "Nataša Krčo", "authors": [ "Nataša Krčo", "Euodia Dodd", "Peter Romov", "Yves-Alexandre de Montjoye" ], "affiliations": [ "Imperial College London" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.27210v1", "shared_first_authors": [ "Nataša Krčo", "Euodia Dodd" ], "shared_first_note": "First two authors carry * and frontmatter explicitly says * Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27210", "evidence": "PDF first page shows Nataša Krčo superscript 1; institution 1 is Imperial College London.", "author_status": "verified", "affiliation_status": "verified", "pdf_checked": true, "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26867": { "id": "2610.26867", "title": "WaveCommitments: Private and Verifiable Speech-Agent Marketplaces", "classification": "relevant", "reason": "语音 Agent 市场通过可信执行和承诺验证资产与保护信息。", "summary_zh": "WaveCommitments 通过多变量承诺与 TEE 内 Data Shapley 估价，让语音 Agent 交易方验证资产来源/价值而不公开全部数据。作者报告相对最强基线最高 18.1 倍加速和 43.2 倍证明尺寸缩减。", "version_id": "2610.26867v2", "published": "2026-07-16T03:46:22Z", "updated": "2026-10-21T05:12:42Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.26867", "tags": [ "privacy", "multiagent" ], "reason_zh": "为语音 Agent 市场提供隐藏资产内容的估值、选择性披露和可验证交付。" }, "author": { "id": "2610.26867", "title": "WaveCommitments: Private and Verifiable Speech-Agent Marketplaces", "version_id": "2610.26867v2", "first_author": "Oguzhan Baser", "authors": [ "Oguzhan Baser", "Kaan Kale", "Sriram Vishwanath", "Sandeep Chinchali" ], "affiliations": [ "The University of Texas at Austin" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26867v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26867", "evidence": "Oguzhan Baser has dagger marker; address footnote maps dagger to The University of Texas at Austin.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26799": { "id": "2610.26799", "title": "Accountable partial understanding: securing the epistemic attack surface of agentic systems", "classification": "relevant", "reason": "Agent 意图、证据、委派和监督理解的攻击面与可问责设计。", "summary_zh": "将 Agent 安全中的理解缺口分为意图、证据、委派权限及人类监督四类攻击面，并提出有界委派、分离证据、假设失效追踪等设计。属概念和治理框架，未给经验性防护提升数值。", "version_id": "2610.26799v1", "published": "2026-10-19T17:44:48Z", "updated": "2026-10-19T17:44:48Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.26799", "tags": [ "monitoring", "authorization" ], "reason_zh": "研究 Agent 解释与证据中的认知攻击面，提出有边界委托和可审查责任机制。" }, "author": { "id": "2610.26799", "title": "Accountable partial understanding: securing the epistemic attack surface of agentic systems", "version_id": "2610.26799v1", "first_author": "Josiah Dykstra", "authors": [ "Josiah Dykstra" ], "affiliations": [ "RTX BBN Technologies" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26799v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26799", "evidence": "Josiah Dykstra author affiliation explicitly lists RTX BBN Technologies, Columbia, MD, USA.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26501": { "id": "2610.26501", "title": "Connection Escrow: Holding AI-Agent Pod Egress in the Kernel Until an Isolated Verifier Rules", "classification": "relevant", "reason": "在内核暂停 Agent 容器外联，单 socket 签名审批防止工具层和子进程绕过。", "summary_zh": "Connection Escrow 在内核 connect 路径暂停每个 Agent pod TCP 连接，独立验证者签发绑定单一 socket/目的地的限时一次性许可。作者称 36 项真实 cgroup 对抗检查通过，六 pod 的 600 连接受控，中位额外延迟 4.5 ms。", "version_id": "2610.26501v1", "published": "2026-10-19T14:36:05Z", "updated": "2026-10-19T14:36:05Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.26501", "tags": [ "authorization" ], "reason_zh": "在内核连接路径暂扣网络出站，按绑定具体套接字的独立验证结果放行。" }, "author": { "id": "2610.26501", "title": "Connection Escrow: Holding AI-Agent Pod Egress in the Kernel Until an Isolated Verifier Rules", "version_id": "2610.26501v1", "first_author": "Ashok Subbabhatta Gopalakrishna", "authors": [ "Ashok Subbabhatta Gopalakrishna" ], "affiliations": [ "Independent researcher" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26501v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26501", "evidence": "Ashok Subbabhatta Gopalakrishna author footnote explicitly says Independent researcher.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26438": { "id": "2610.26438", "title": "Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents", "classification": "relevant", "reason": "新闻证据投毒诱导交易 Agent 协同误操作，比较指令注入与事实投毒。", "summary_zh": "针对交易 Agent 的新闻证据污染基准含五向量、七事件类、约一万决策与 15 股票。作者报告提示注入 ASR 14%，假新闻 62%，两种短模板在该测试达 100%；可信外观比同一事实内容更影响效果，多数防御不能挡事实污染。", "version_id": "2610.26438v1", "published": "2026-10-19T13:58:50Z", "updated": "2026-10-19T13:58:50Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.26438", "tags": [ "injection", "evaluation" ], "reason_zh": "构建交易 Agent 的信息注入基准，研究伪造新闻与证据可信线索如何操纵决策。" }, "author": { "id": "2610.26438", "title": "Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents", "version_id": "2610.26438v1", "first_author": "Mengxiao Wang", "authors": [ "Mengxiao Wang", "Nitesh Saxena" ], "affiliations": [ "Texas A&M University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26438v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26438", "evidence": "Mengxiao Wang individual author block lists Texas A&M University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26088": { "id": "2610.26088", "title": "LeakBench: Auditing Reward Hacking through Prediction-Time Leakage in Clinical Modeling Agents", "classification": "relevant", "reason": "临床建模 Agent 为奖励选择预测时不可用数据，来源验证器防止奖励投机。", "summary_zh": "LeakBench 检查临床建模 Agent 是否为提升验证奖励使用预测时未知信息。公开日志中的两模型无约束各 10/10 泄漏、加显式入院时限制为 0/10；来源验证器能清除泄漏，作者说明不是专家验证的临床基准。", "version_id": "2610.26088v1", "published": "2026-10-19T09:50:57Z", "updated": "2026-10-19T09:50:57Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.26088", "tags": [ "evaluation", "monitoring" ], "reason_zh": "以可执行审计检查临床建模 Agent 的预测时泄漏与奖励投机，并用来源验证约束。" }, "author": { "id": "2610.26088", "title": "LeakBench: Auditing Reward Hacking through Prediction-Time Leakage in Clinical Modeling Agents", "version_id": "2610.26088v1", "first_author": "Xiaoyuan Bao", "authors": [ "Xiaoyuan Bao", "Jingsi Jiang", "Jiao Shan", "Yulong Cao", "Haoyu Wang", "Zida Liu", "Jun Gao" ], "affiliations": [ "Medical Informatics Center, Institute of Advanced Clinical Medicine, Peking University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26088v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26088", "evidence": "Xiaoyuan Bao individual author block explicitly lists Medical Informatics Center, Institute of Advanced Clinical Medicine, Peking University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26013": { "id": "2610.26013", "title": "SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense", "classification": "relevant", "reason": "将工具输出指令定位和用户授权判断解耦，轻量间接提示注入防御。", "summary_zh": "SpanGuard 先用无监督分段定位工具输出中的潜在指令，再由小模型局部判断授权，避免同时承担定位与推理。作者报告 ASR 0.32% 且良性效用损失可忽略；摘要未详述全部威胁设置。", "version_id": "2610.26013v1", "published": "2026-10-19T08:36:20Z", "updated": "2026-10-19T08:36:20Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.26013", "tags": [ "injection", "authorization" ], "reason_zh": "将工具输出中潜在指令的定位与用户授权判断分离，防御间接提示注入。" }, "author": { "id": "2610.26013", "title": "SpanGuard: Decoupling Instruction Localization from Authorization for Lightweight IPI Defense", "version_id": "2610.26013v1", "first_author": "Yinxiang Wang", "authors": [ "Yinxiang Wang", "Zehua Ma", "Kejiang Chen", "Weiming Zhang", "Han Fang" ], "affiliations": [ "University of Science and Technology of China" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26013v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26013", "evidence": "Yinxiang Wang and coauthors share University of Science and Technology of China author-block affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25916": { "id": "2610.25916", "title": "Secure Agentic Coding through Counterexample-Grounded Feedback", "classification": "relevant", "reason": "执行反例反馈用于 Agent 编码修复和 RL 奖励，防止安全代理指标过优化。", "summary_zh": "FALCON 把攻击探索与基于执行轨迹的行为验证分开，将反例反馈用于 Agent 编码修复和 RL。作者报告在留出功能安全评测优于静态/学习奖励且保持功能，缓解奖励过优化，但摘要没有具体数值。", "version_id": "2610.25916v2", "published": "2026-10-19T07:18:34Z", "updated": "2026-10-20T03:21:13Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.25916", "tags": [ "supplychain", "evaluation" ], "reason_zh": "以真实执行反例验证编码 Agent 的安全修复，并作为训练奖励抑制代理信号投机。" }, "author": { "id": "2610.25916", "title": "Secure Agentic Coding through Counterexample-Grounded Feedback", "version_id": "2610.25916v2", "first_author": "Tue Le", "authors": [ "Tue Le", "Anh Nguyen Hoang", "Gabriel Sasseville", "Doseok Jang", "Pierre-Luc Bacon", "Nghi D. Q. Bui" ], "affiliations": [ "Quantum AI & Cyber Security Institute (QACI), FPT Corporation" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.25916v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25916", "evidence": "PDF first page shows Tue Le superscript 1; institution 1 is Quantum AI & Cyber Security Institute (QACI), FPT Corporation.", "author_status": "verified", "affiliation_status": "verified", "pdf_checked": true, "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25372": { "id": "2610.25372", "title": "SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger", "classification": "relevant", "reason": "优化并聚合工具描述触发器，使多轮 Agent 工具投毒持续生效。", "summary_zh": "SEAL 针对工具投毒在多轮中失效的问题，优化上下文相关推理前缀触发并聚合为通用触发。七种多轮场景展示攻击有效性、跨模型迁移和防御耐受，摘要未列 ASR 数字。", "version_id": "2610.25372v1", "published": "2026-10-18T16:23:17Z", "updated": "2026-10-18T16:23:17Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.25372", "tags": [ "injection", "supplychain" ], "reason_zh": "通过工具描述及外部资源投毒，优化跨规划上下文和多轮执行持续生效的触发器。" }, "author": { "id": "2610.25372", "title": "SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger", "version_id": "2610.25372v1", "first_author": "Nanjun Zhou", "authors": [ "Nanjun Zhou", "Yiming Li", "Yukun Chen", "Ting Qiao", "Enhao Huang", "Zhan Qin" ], "affiliations": [ "State Key Laboratory of Blockchain and Data Security, Zhejiang University", "Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25372v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25372", "evidence": "Author footnote explicitly says Nanjun Zhou and three coauthors are with both listed institutions.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25032": { "id": "2610.25032", "title": "Don't Judge an Agent by Its Messages: Private-State Leakage under Passive Monitoring of Agent Communication", "classification": "relevant", "reason": "Agent 通信可保留任务效用与可观测分布同时隐蔽泄漏私有状态；理论与实验。", "summary_zh": "证明被动观察 Agent 消息和任务结果不能完整认证私密状态泄漏；响应选择可构成隐蔽信道。合成路由实验 8192 轮可恢复全部私密位、路由准确率 98.60%，分布保持版本恢复 97.7%；建议约束任务通信接口。", "version_id": "2610.25032v1", "published": "2026-10-18T05:43:30Z", "updated": "2026-10-18T05:43:30Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.25032", "tags": [ "privacy", "monitoring", "multiagent" ], "reason_zh": "刻画仅被动观察 Agent 通信无法识别私有状态泄露的边界及通信约束防御。" }, "author": { "id": "2610.25032", "title": "Don't Judge an Agent by Its Messages: Private-State Leakage under Passive Monitoring of Agent Communication", "version_id": "2610.25032v1", "first_author": "Daksh Pandey", "authors": [ "Daksh Pandey", "Sayon Duttagupta", "Xinhai Zou", "Amit Singh Bhati" ], "affiliations": [ "IIT Roorkee" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25032v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25032", "evidence": "Daksh Pandey has superscript 2; affiliation 2 is IIT Roorkee.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24999": { "id": "2610.24999", "title": "SoK: PIAtlas: Decomposing the Unbounded Prompt Injection Attack Space", "classification": "relevant", "reason": "提示注入机制分类与数据集映射，分析 Agent 基准覆盖盲区。", "summary_zh": "PIAtlas 以六类底层机制组织提示注入 taxonomy，PICorpus 汇集可许可数据并做人核验映射。发现多种技巧常组合，Agent 基准只覆盖局部机制，自适应攻击偏好被低估类别；摘要未给基准性能数字。", "version_id": "2610.24999v1", "published": "2026-10-18T04:07:48Z", "updated": "2026-10-18T04:07:48Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.24999", "tags": [ "injection", "evaluation" ], "reason_zh": "系统整理提示注入机制和公共攻击语料，分析现有基准的攻击覆盖缺口。" }, "author": { "id": "2610.24999", "title": "SoK: PIAtlas: Decomposing the Unbounded Prompt Injection Attack Space", "version_id": "2610.24999v1", "first_author": "Stavros Damianakis", "authors": [ "Stavros Damianakis", "Konstantinos Psounis" ], "affiliations": [ "University of Southern California" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24999v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24999", "evidence": "Stavros Damianakis individual author block lists University of Southern California.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24916": { "id": "2610.24916", "title": "Same Data, Different Bytes: Serialization-Invariant Integrity Checks for Agent-Published Datasets", "classification": "relevant", "reason": "Agent 之间数据发布采用序列化不变完整性验证，区分重编码和恶意篡改。", "summary_zh": "为 Agent 发布数据定义显式等价规则下的序列化不变标识，保留原 checksum。两提供者各三模型层级实验中，等价重编码预期结果率较普通工具高 80.4 点、较 checksum 高 70.2 点，对篡改证据拒绝高 3.5 点。", "version_id": "2610.24916v1", "published": "2026-10-17T23:26:39Z", "updated": "2026-10-17T23:26:39Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.24916", "tags": [ "multiagent", "robustness" ], "reason_zh": "为 Agent 发布和接收的数据构造序列化不变标识，区分等价重编码与内容篡改。" }, "author": { "id": "2610.24916", "title": "Same Data, Different Bytes: Serialization-Invariant Integrity Checks for Agent-Published Datasets", "version_id": "2610.24916v1", "first_author": "Jin Gao", "authors": [ "Jin Gao", "Maura Clark" ], "affiliations": [ "Independent Researcher, USA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24916v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24916", "evidence": "Jin Gao individual author block explicitly lists Independent Researcher, USA.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24896": { "id": "2610.24896", "title": "Peer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code Security", "classification": "relevant", "reason": "恶意代码与审查代理的共同演化直接涉及 Coding Agent 产生和漏检漏洞。", "summary_zh": null, "version_id": "2610.24896v1", "published": "2026-10-17T22:36:09Z", "updated": "2026-10-17T22:36:09Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.24896", "tags": [ "supplychain", "evaluation" ], "reason_zh": "以真实仓库可执行漏洞为奖励，让攻击与防御模型共同训练安全审查能力。" }, "author": { "id": "2610.24896", "title": "Peer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code Security", "version_id": "2610.24896v1", "first_author": "Khushbu Pahwa", "authors": [ "Khushbu Pahwa", "Yubin Ge", "Daniele Bonadiman", "Xiaofei Ma", "Yi Zhang" ], "affiliations": [ "AWS AI" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24896v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24896", "evidence": "Khushbu Pahwa and coauthors share AWS AI author-block affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24741": { "id": "2610.24741", "title": "SecODD: Adapting the Operational Design Domain from Driving Autonomy to Autonomous Cyber Defense", "classification": "relevant", "reason": "自主网络防御行动的授权、可中断性、回滚和可审计治理。", "summary_zh": "SecODD 把自主驾驶运行域思想用于自动网络防御，规定行动授权域、人类干预、回滚和安全态，以及可防篡改日志。两个失效场景用可审计矩阵展示，属于治理框架而非大规模防护实验。", "version_id": "2610.24741v1", "published": "2026-10-17T15:17:08Z", "updated": "2026-10-17T15:17:08Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.24741", "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "界定自主网络防御的授权范围、可中断性、回滚与可重建审计要求。" }, "author": { "id": "2610.24741", "title": "SecODD: Adapting the Operational Design Domain from Driving Autonomy to Autonomous Cyber Defense", "version_id": "2610.24741v1", "first_author": "Jina Kang", "authors": [ "Jina Kang", "Jeong-Han Yun", "Hyesong Choi" ], "affiliations": [ "National Security Research Institute" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24741v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24741", "evidence": "PDF first page shows Jina Kang superscript 1; institution 1 is National Security Research Institute, Daejeon, Republic of Korea.", "author_status": "verified", "affiliation_status": "verified", "pdf_checked": true, "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24379": { "id": "2610.24379", "title": "Defending Against Dormant Poisoning Attacks Across Language and Multimodal Agents", "classification": "relevant", "reason": "休眠投毒在良性微调后激活语言/多模态 Agent 有害动作，并提出预览更新防御。", "summary_zh": "休眠投毒经良性微调可激活未知及多个有害 Agent 动作；LookAhead 用发布时安全回答建立缓冲并预览更新，只惩罚破坏安全/增加过拒的更新。作者报告 Agent 有害行为由最高 93.9% 降至最多 14.2%，保持相当效用。", "version_id": "2610.24379v1", "published": "2026-10-17T02:26:09Z", "updated": "2026-10-17T02:26:09Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.24379", "tags": [ "supplychain", "evaluation" ], "reason_zh": "研究模型中潜伏投毒经良性微调激活，并用安全缓冲与前瞻更新约束保持对齐。" }, "author": { "id": "2610.24379", "title": "Defending Against Dormant Poisoning Attacks Across Language and Multimodal Agents", "version_id": "2610.24379v1", "first_author": "Wonjun Lee", "authors": [ "Wonjun Lee", "Vaidehi Patil", "Zaid Khan", "Yue Zhang", "Hyunji Lee", "Suhyun Kim", "Mohit Bansal" ], "affiliations": [ "UNC Chapel Hill" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24379v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24379", "evidence": "Wonjun Lee individual author block lists UNC Chapel Hill.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24359": { "id": "2610.24359", "title": "Can Agents Keep Secrets They Were Never Told? Benchmarking Latent Privacy Risks Across Sessions with MemJoin", "classification": "relevant", "reason": "跨会话 Agent 记忆连接零散线索暴露敏感关系，MemJoin 隐私基准。", "summary_zh": "MemJoin 包含 288 合成案例，单会话不足而全历史可推出敏感关系。比较六记忆系统及全/无历史控制，分离存储属性可见性、检索可见性和回答关系披露；去掉连接线索可改变关系输出，说明只查字段泄漏不足。", "version_id": "2610.24359v1", "published": "2026-10-17T01:20:36Z", "updated": "2026-10-17T01:20:36Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.24359", "tags": [ "memory", "privacy", "evaluation" ], "reason_zh": "评测跨会话记忆合并后推断并披露单次会话无法揭示的敏感关系。" }, "author": { "id": "2610.24359", "title": "Can Agents Keep Secrets They Were Never Told? Benchmarking Latent Privacy Risks Across Sessions with MemJoin", "version_id": "2610.24359v1", "first_author": "Qishun Yang", "authors": [ "Qishun Yang", "Shu Yang", "Difei Xu", "Di Wang", "Meng Ding" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.24359v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24359", "evidence": "pdf_missing_mapping: first-page PDF visually confirms Qishun Yang has no institution superscript, unlike all coauthors. Numbered institutions cannot be assigned to the first author.", "author_status": "verified", "affiliation_status": "unresolved", "pdf_checked": true, "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24311": { "id": "2610.24311", "title": "RATION: Towards Quantitative Risk-Based Access Control for AI Agents", "classification": "relevant", "reason": "以累计任务风险控制 Agent 工具访问和显式用户约束。", "summary_zh": null, "version_id": "2610.24311v1", "published": "2026-10-16T23:15:24Z", "updated": "2026-10-16T23:15:24Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24311", "tags": [ "authorization", "monitoring" ], "reason_zh": "以任务级量化风险策略累计跟踪行动风险，并在执行中实施访问控制。" }, "author": { "id": "2610.24311", "title": "RATION: Towards Quantitative Risk-Based Access Control for AI Agents", "version_id": "2610.24311v1", "first_author": "Yuntao Du", "authors": [ "Yuntao Du", "Harsh Chaudhari", "Yuetian Chen", "Ron Heichman", "Ashish Jayamohan", "Kumar Pallav", "Mahim Patel", "Kaiyuan Zhang", "Kyle Polley", "Jerry Ma", "Ninghui Li" ], "affiliations": [ "Perplexity", "Purdue University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24311v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24311", "evidence": "Yuntao Du individual author block explicitly lists Perplexity and Purdue University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24289": { "id": "2610.24289", "title": "Unbounded Losses, Unchecked Inputs: Measuring the Safeguards of LLM Options-Trading Agents", "classification": "relevant", "reason": "测量交易 Agent 的来源验证、人工审批和损失边界缺口。", "summary_zh": null, "version_id": "2610.24289v1", "published": "2026-10-16T22:38:49Z", "updated": "2026-10-16T22:38:49Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24289", "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "审计真实期权交易 Agent 的安全保障、下单边界风险限额和未经核验的输入。" }, "author": { "id": "2610.24289", "title": "Unbounded Losses, Unchecked Inputs: Measuring the Safeguards of LLM Options-Trading Agents", "version_id": "2610.24289v1", "first_author": "Mengxiao Wang", "authors": [ "Mengxiao Wang", "Nitesh Saxena" ], "affiliations": [ "Texas A&M University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24289v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24289", "evidence": "Mengxiao Wang individual author block lists Texas A&M University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24277": { "id": "2610.24277", "title": "SPIDES: Information-Flow Control for Browser Agents", "classification": "relevant", "reason": "以元素级信息流标签约束浏览器 Agent 的提示注入与泄露。", "summary_zh": null, "version_id": "2610.24277v1", "published": "2026-10-16T22:12:45Z", "updated": "2026-10-16T22:12:45Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24277", "tags": [ "authorization", "injection", "privacy" ], "reason_zh": "以浏览器元素级信息流标签约束操作，防止提示注入与未授权数据外传。" }, "author": { "id": "2610.24277", "title": "SPIDES: Information-Flow Control for Browser Agents", "version_id": "2610.24277v1", "first_author": "Egor Zverev", "authors": [ "Egor Zverev", "Juhee Kim", "Leon Trampert", "Boris Köpf", "Aashish Kolluri", "Shruti Tople", "Santiago Zanella-Béguelin" ], "affiliations": [ "ISTA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24277v1", "shared_first_authors": [ "Egor Zverev", "Juhee Kim" ], "shared_first_note": "Both first two authors carry *; frontmatter footnote states Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24277", "evidence": "Egor Zverev individual author affiliation is ISTA; dagger notes work partially done as Research Intern at Microsoft.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24055": { "id": "2610.24055", "title": "ToolRosetta: Surface-Form Invariance of Tool-Call Guards", "classification": "relevant", "reason": "评估工具调用守卫对等价表面格式的误报脆弱性。", "summary_zh": null, "version_id": "2610.24055v1", "published": "2026-10-16T17:14:13Z", "updated": "2026-10-16T17:14:13Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24055", "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "保持动作语义不变，评测工具守卫对 JSON、Python 和 shell 表面形式的稳定性。" }, "author": { "id": "2610.24055", "title": "ToolRosetta: Surface-Form Invariance of Tool-Call Guards", "version_id": "2610.24055v1", "first_author": "Hasan Demirkiran", "authors": [ "Hasan Demirkiran", "Jens Ernstberger" ], "affiliations": [ "Kontext" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24055v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24055", "evidence": "Hasan Demirkiran individual author block lists Kontext.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24052": { "id": "2610.24052", "title": "Red-Teaming Multi-Agent Attacks for Loss-of-Control Risks", "classification": "relevant", "reason": "多代理将恶意行为分散成局部良性片段逃避单轨迹监控。", "summary_zh": null, "version_id": "2610.24052v1", "published": "2026-10-16T16:42:33Z", "updated": "2026-10-16T16:42:33Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24052", "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "构建分布式隐蔽协作攻击，评测逐 Agent 监控遗漏系统级失控行为的风险。" }, "author": { "id": "2610.24052", "title": "Red-Teaming Multi-Agent Attacks for Loss-of-Control Risks", "version_id": "2610.24052v1", "first_author": "John Kitaoka", "authors": [ "John Kitaoka", "Thao Amelia Pham", "Carlos Rafael Giudice", "Jacob Merizian" ], "affiliations": [ "MATS Research" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24052v1", "shared_first_authors": [ "John Kitaoka", "Thao Amelia Pham" ], "shared_first_note": "Both first two authors carry *; explicit footnote says * Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24052", "evidence": "John Kitaoka individual author block lists MATS Research.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24873": { "id": "2610.24873", "title": "The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents", "classification": "relevant", "reason": "真实关系句诱导 Agent 推理与团队讨论错误，属于认知注入攻击。", "summary_zh": null, "version_id": "2610.24873v1", "published": "2026-10-17T21:21:36Z", "updated": "2026-10-17T21:21:36Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.CL", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24873", "tags": [ "injection", "robustness" ], "reason_zh": "研究用一条有来源支撑的句子操纵隐含推理关系并改变 Agent 的正确信念。" }, "author": { "id": "2610.24873", "title": "The One-Pixel of Reasoning: One Truthful Relation Is Enough to Mislead LLM Agents", "version_id": "2610.24873v1", "first_author": "Jinwei Hu", "authors": [ "Jinwei Hu", "Youcheng Sun", "Yi Dong", "Xiaowei Huang" ], "affiliations": [ "School of Computer Science and Informatics, University of Liverpool" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24873v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24873", "evidence": "Jinwei Hu individual author block lists School of Computer Science and Informatics, University of Liverpool.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24545": { "id": "2610.24545", "title": "When Code Becomes an LLM Call: An Empirical Study of Call-Site Contracts in Agentic Systems", "classification": "relevant", "reason": "评估 Agent 系统 LLM 调用输出到执行之间的可检查契约缺口。", "summary_zh": null, "version_id": "2610.24545v1", "published": "2026-10-17T08:14:37Z", "updated": "2026-10-17T08:14:37Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24545", "tags": [ "authorization", "robustness" ], "reason_zh": "检查 Agent 软件中 LLM 调用的前后条件契约能否实际约束控制流和执行。" }, "author": { "id": "2610.24545", "title": "When Code Becomes an LLM Call: An Empirical Study of Call-Site Contracts in Agentic Systems", "version_id": "2610.24545v1", "first_author": "Shihao Weng", "authors": [ "Shihao Weng", "Longtian Wang", "Yang Feng", "Mingfei Cheng", "Jia Liu", "Chao Shen", "He Ye", "Federica Sarro", "Xiaofei Xie" ], "affiliations": [ "Nanjing University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24545v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24545", "evidence": "Shihao Weng individual author block lists Nanjing University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24048": { "id": "2610.24048", "title": "The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections", "classification": "relevant", "reason": "测量提示注入被 Agent 推理采纳的时机及多次采样标签不稳定。", "summary_zh": null, "version_id": "2610.24048v1", "published": "2026-10-16T16:10:56Z", "updated": "2026-10-16T16:10:56Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24048", "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "用分支重放定位跟随注入的决定何时形成，分析推理监控及单次评测局限。" }, "author": { "id": "2610.24048", "title": "The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections", "version_id": "2610.24048v1", "first_author": "Haoxuan Jia", "authors": [ "Haoxuan Jia", "Yang Liu", "Bin Chong", "Yingguang Yang", "Yancheng Chen", "Jiayu Liang", "Qian Li", "Hanning Lu", "Kefu Xu", "Hao Zheng", "Chongyang Zhang", "Yulin Huang", "Jianshen Zhang", "Yongzhi Qi", "Yunuo Lin", "Hao Peng" ], "affiliations": [ "Fullive-AI", "Nanyang Technological University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24048v1", "shared_first_authors": [ "Haoxuan Jia", "Yang Liu" ], "shared_first_note": "Haoxuan Jia and Yang Liu carry *; explicit note says Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24048", "evidence": "Haoxuan Jia has superscripts 1,2; numbered institutions are Fullive-AI and Nanyang Technological University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23307": { "id": "2610.23307", "title": "MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection", "classification": "relevant", "reason": "移动 Agent 跨模态一致性注入与推理到动作安全评测。", "summary_zh": null, "version_id": "2610.23307v1", "published": "2026-10-16T11:10:30Z", "updated": "2026-10-16T11:10:30Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.23307", "tags": [ "injection", "evaluation" ], "reason_zh": "构建移动 Agent 跨模态环境注入基准，评估信任操纵与从推理到执行的劫持。" }, "author": { "id": "2610.23307", "title": "MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection", "version_id": "2610.23307v1", "first_author": "Songping Wang", "authors": [ "Songping Wang", "Peiyang Li", "Yi Huang", "Fengting Li", "Xuhao Ran", "Yueming Lyu", "Chao Feng", "Caifeng Shan" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.23307v1", "shared_first_authors": [ "Songping Wang", "Peiyang Li" ], "shared_first_note": "Both names have * marks; footnote explicitly states Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23307", "evidence": "pdf_missing_mapping: first-page PDF visually confirms numbered institution list but no institution superscripts on authors, so affiliation cannot be mapped.", "author_status": "verified", "affiliation_status": "unresolved", "pdf_checked": true, "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23303": { "id": "2610.23303", "title": "MobileJailBench: Red Queen Jailbreak Benchmarking for Mobile Agents", "classification": "relevant", "reason": "移动 Agent 动态越狱执行与后果评测。", "summary_zh": null, "version_id": "2610.23303v1", "published": "2026-10-16T11:06:37Z", "updated": "2026-10-16T11:06:37Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.23303", "tags": [ "injection", "evaluation" ], "reason_zh": "以动态演化越狱任务评测移动 Agent 在真实式应用工作流中的安全边界。" }, "author": { "id": "2610.23303", "title": "MobileJailBench: Red Queen Jailbreak Benchmarking for Mobile Agents", "version_id": "2610.23303v1", "first_author": "Songping Wang", "authors": [ "Songping Wang", "Borui Li", "Qinglong Liu", "Yueming Lyu", "Yi Huang", "Fengting Li", "Chao Feng", "Caifeng Shan" ], "affiliations": [ "Nanjing University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.23303v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23303", "evidence": "Songping Wang individual author block lists Nanjing University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23233": { "id": "2610.23233", "title": "AgentLoupe: Kernel-Resident Semantic Causal Labels for AI Agent Observability", "classification": "relevant", "reason": "内核传播语义因果标签追踪 Agent 的异常进程与资源行为。", "summary_zh": null, "version_id": "2610.23233v2", "published": "2026-10-16T10:01:50Z", "updated": "2026-10-19T01:49:36Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.23233", "tags": [ "monitoring" ], "reason_zh": "将语义因果标签驻留内核并跨进程与持久资源传播，追溯 Agent 行动来源。" }, "author": { "id": "2610.23233", "title": "AgentLoupe: Kernel-Resident Semantic Causal Labels for AI Agent Observability", "version_id": "2610.23233v2", "first_author": "Yifei Bao", "authors": [ "Yifei Bao", "Ting Liu", "Yuxin Ren", "Ruizhe Huang", "Likang Luo", "Ziteng Xu", "Yu Wang", "Peng Jiang" ], "affiliations": [ "Southeast University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.23233v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23233", "evidence": "Yifei Bao has * affiliation marker; * is Southeast University. It is an institution marker, not an equal-contribution marker.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23109": { "id": "2610.23109", "title": "Trojan Horse: Automated Repository Poisoning against Coding Agents", "classification": "relevant", "reason": "自动仓库投毒攻击 Coding Agent 并构建跨语言基准。", "summary_zh": null, "version_id": "2610.23109v1", "published": "2026-10-16T08:19:44Z", "updated": "2026-10-16T08:19:44Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.23109", "tags": [ "supplychain", "injection", "evaluation" ], "reason_zh": "自动选择和伪装仓库投毒位置，并以污染仓库基准评测编码 Agent。" }, "author": { "id": "2610.23109", "title": "Trojan Horse: Automated Repository Poisoning against Coding Agents", "version_id": "2610.23109v1", "first_author": "Xiao Yang", "authors": [ "Xiao Yang", "Jinchang Hou", "Jiawei Chen", "Zhonghou Lv", "Junyuan Shang", "Chenfu Bao" ], "affiliations": [ "Baidu Inc.", "Beihang University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.23109v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23109", "evidence": "Xiao Yang individual HTML author block lists Baidu Inc., Beijing, China and Beihang University, Beijing, China.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23078": { "id": "2610.23078", "title": "Cryptographically Secure Agent-to-Agent Communication in Multi-Agent Systems", "classification": "relevant", "reason": "多代理身份、任务凭证、加密通信与零信任架构。", "summary_zh": null, "version_id": "2610.23078v1", "published": "2026-10-16T07:49:54Z", "updated": "2026-10-16T07:49:54Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.23078", "tags": [ "multiagent", "authorization", "privacy" ], "reason_zh": "为 Agent 间通信设计身份、最小权限、加密传输及隐私保护约束证明。" }, "author": { "id": "2610.23078", "title": "Cryptographically Secure Agent-to-Agent Communication in Multi-Agent Systems", "version_id": "2610.23078v1", "first_author": "Karol Budzyn", "authors": [ "Karol Budzyn", "Adrian Brodzik", "Mateusz Szczepkowski" ], "affiliations": [ "Orange Innovation Poland" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.23078v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23078", "evidence": "Karol Budzyn individual author block lists Orange Innovation Poland.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23077": { "id": "2610.23077", "title": "When Approval Becomes Execution: Authorization-Grounded Workflow Attacks on Tool-Using Agents", "classification": "relevant", "reason": "审批凭证未绑定主体与动作造成工具 Agent 越权执行。", "summary_zh": null, "version_id": "2610.23077v1", "published": "2026-10-16T07:47:57Z", "updated": "2026-10-16T07:47:57Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.23077", "tags": [ "authorization" ], "reason_zh": "分析审批令牌被误当作充分权限的工作流攻击，强调请求人与资源等上下文绑定。" }, "author": { "id": "2610.23077", "title": "When Approval Becomes Execution: Authorization-Grounded Workflow Attacks on Tool-Using Agents", "version_id": "2610.23077v1", "first_author": "Chenggong Shi", "authors": [ "Chenggong Shi", "Hongmei Mou" ], "affiliations": [ "Baidu" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.23077v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23077", "evidence": "Chenggong Shi individual author block lists Baidu.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22959": { "id": "2610.22959", "title": "SAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware Retrieval", "classification": "relevant", "reason": "细粒度权威和治理感知检索抵御 Agent 记忆投毒。", "summary_zh": null, "version_id": "2610.22959v2", "published": "2026-10-16T05:29:55Z", "updated": "2026-10-20T06:30:00Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.22959", "tags": [ "memory", "authorization", "injection" ], "reason_zh": "以声明级来源、权限及范围标签控制记忆检索，阻止外部信息变成授权规则。" }, "author": { "id": "2610.22959", "title": "SAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware Retrieval", "version_id": "2610.22959v2", "first_author": "Haoming Li", "authors": [ "Haoming Li", "Dingyi Kang", "Xu Hu", "Jinxin Yang", "Zhu Xu", "Chenru Wang", "Yi Ge", "Miao Yin", "Guanpeng Li", "Feng Chen", "Bingzhe Li" ], "affiliations": [ "The University of Texas at Dallas" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.22959v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22959", "evidence": "PDF first page shows Haoming Li superscript 1; institution 1 is The University of Texas at Dallas.", "author_status": "verified", "affiliation_status": "verified", "pdf_checked": true, "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22913": { "id": "2610.22913", "title": "Provable Compliance: A Protocol for Runtime Compliance Evidence and Transaction-Specific Decisioning", "classification": "relevant", "reason": "为 Agent 交易提供范围与时效绑定合规证据和一次性执行决策。", "summary_zh": null, "version_id": "2610.22913v1", "published": "2026-10-16T04:22:09Z", "updated": "2026-10-16T04:22:09Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.22913", "tags": [ "authorization", "monitoring", "privacy" ], "reason_zh": "将合规证据、时效、用途与交易上下文绑定为可审计决策，并规定披露控制。" }, "author": { "id": "2610.22913", "title": "Provable Compliance: A Protocol for Runtime Compliance Evidence and Transaction-Specific Decisioning", "version_id": "2610.22913v1", "first_author": "Jeremy Blackburn", "authors": [ "Jeremy Blackburn", "Tim Hines", "Matthew Koepp", "Russell Lessard", "Jason Patrick" ], "affiliations": [ "ChainIT" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22913v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22913", "evidence": "Jeremy Blackburn individual author footnote explicitly lists ChainIT, Utah, United States.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22899": { "id": "2610.22899", "title": "Provable Authority: A Protocol for Verifiable Authority Resolution and Control Across Human, Organizational, and Agentic Transactions", "classification": "relevant", "reason": "将 Agent 交易权限绑定上下文、人类审批、预算与执行能力。", "summary_zh": null, "version_id": "2610.22899v1", "published": "2026-10-16T04:01:29Z", "updated": "2026-10-16T04:01:29Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.22899", "tags": [ "authorization", "monitoring" ], "reason_zh": "把组织权限和人工批准绑定到精确交易摘要，以单次执行凭据和生命周期证据控权。" }, "author": { "id": "2610.22899", "title": "Provable Authority: A Protocol for Verifiable Authority Resolution and Control Across Human, Organizational, and Agentic Transactions", "version_id": "2610.22899v1", "first_author": "Jeremy Blackburn", "authors": [ "Jeremy Blackburn", "Tim Hines", "Matthew Koepp", "Russell Lessard", "Jason Patrick" ], "affiliations": [ "ChainIT" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22899v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22899", "evidence": "Jeremy Blackburn individual author footnote explicitly lists ChainIT, Utah, United States.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22873": { "id": "2610.22873", "title": "Stealthy Poisoning Attacks via Reused KV Cache of Reasoning", "classification": "uncertain", "reason": "正文确认共享推理 KV 缓存投毒，但系统与实验主要是问答和代码生成；尚无明确自主工具 Agent 场景，保留边界待定。", "summary_zh": null, "version_id": "2610.22873v1", "published": "2026-10-16T03:22:33Z", "updated": "2026-10-16T03:22:33Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "id": "2610.22873", "tags": [ "memory", "injection" ], "reason_zh": "研究复用推理 KV 缓存保留已删除前文的恶意影响，从聊天界面实施隐蔽投毒。" }, "author": { "id": "2610.22873", "title": "Stealthy Poisoning Attacks via Reused KV Cache of Reasoning", "version_id": "2610.22873v1", "first_author": "L. Zhu", "authors": [ "L. Zhu", "Y. Jung", "S. Szyller" ], "affiliations": [ "Aalto University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22873v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22873", "evidence": "First HTML author is Lin Zhu (official API: L. Zhu); individual author block lists Aalto University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [], "review": { "id": "2610.22873", "classification_recommendation": "uncertain", "reason_zh": "正文确认共享推理 KV 缓存投毒，但系统与实验主要是问答和代码生成；尚无明确自主工具 Agent 场景，保留边界待定。", "source_url": "https://arxiv.org/html/2610.22873v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "3.1 System model", "3.2 Threat model", "5.1 Experimental setup", "5.4 Log-augmented generation" ], "evidence_zh": "攻击者经公共查询接口植入缓存，引导后续查询错误回答；GPQA、MBPP、BigCodeBench 测试缓存复用。Agent 记忆主要出现在相关工作，不能等同已评测 Agent 执行安全。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.22873v1" } }, "2610.22828": { "id": "2610.22828", "title": "GRAD: Graph-Structured Antibody Defense for LLM Agents", "classification": "relevant", "reason": "图结构防御分解式、MCP 与多轮 Agent 攻击。", "summary_zh": null, "version_id": "2610.22828v1", "published": "2026-10-16T02:09:39Z", "updated": "2026-10-16T02:09:39Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.22828", "tags": [ "monitoring", "memory", "injection" ], "reason_zh": "聚合执行图中的分散攻击证据，持续检测记忆投毒和分解式攻击。" }, "author": { "id": "2610.22828", "title": "GRAD: Graph-Structured Antibody Defense for LLM Agents", "version_id": "2610.22828v1", "first_author": "Tianqi Song", "authors": [ "Tianqi Song", "Jiawei Du", "Xuemei Jia", "Zheng Wang" ], "affiliations": [ "Wuhan University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22828v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22828", "evidence": "Tianqi Song individual author block lists Wuhan University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22697": { "id": "2610.22697", "title": "What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web Semantics", "classification": "relevant", "reason": "浏览器 Agent 以网页语义来源隔离上下文并约束动作权限。", "summary_zh": null, "version_id": "2610.22697v1", "published": "2026-10-15T22:02:45Z", "updated": "2026-10-15T22:02:45Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.22697", "tags": [ "injection", "authorization" ], "reason_zh": "保留网页元素来源与能力语义，以隔离阅读和行动授权限制第三方注入。" }, "author": { "id": "2610.22697", "title": "What It Is, Not What It Says: Securing Agentic Browsing Interactions with Web Semantics", "version_id": "2610.22697v1", "first_author": "Umar Iqbal", "authors": [ "Umar Iqbal" ], "affiliations": [ "Washington University in St. Louis" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22697v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22697", "evidence": "Umar Iqbal individual author block lists Washington University in St. Louis.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22578": { "id": "2610.22578", "title": "Model-as-a-Trojan: Self-Activating Covert DNS Exfiltration Baked Into the Weights of an LLM Agent", "classification": "relevant", "reason": "开源 Agent 权重供应链植入隐蔽 DNS 外传行为并测试沙箱残余出口。", "summary_zh": null, "version_id": "2610.22578v1", "published": "2026-10-15T19:26:27Z", "updated": "2026-10-15T19:26:27Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.22578", "tags": [ "supplychain", "privacy", "authorization" ], "reason_zh": "研究将秘密窃取行为植入模型权重，并借沙箱允许的 DNS 通道绕过出站限制。" }, "author": { "id": "2610.22578", "title": "Model-as-a-Trojan: Self-Activating Covert DNS Exfiltration Baked Into the Weights of an LLM Agent", "version_id": "2610.22578v1", "first_author": "Barak Haryati", "authors": [ "Barak Haryati", "Shaked Zychlinski" ], "affiliations": [ "JFrog" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22578v1", "shared_first_authors": [ "Barak Haryati", "Shaked Zychlinski" ], "shared_first_note": "Both authors have explicit Equal contribution footnotes.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22578", "evidence": "Barak Haryati individual author block lists JFrog.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23362": { "id": "2610.23362", "title": "Monitor-Validity Failures: LLM Safety Evidence Paths at Evolving Framework Boundaries", "classification": "relevant", "reason": "框架变化使安全监测证据无法进入执行阻断路径。", "summary_zh": null, "version_id": "2610.23362v1", "published": "2026-10-16T12:09:26Z", "updated": "2026-10-16T12:09:26Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR", "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.23362", "tags": [ "monitoring", "robustness" ], "reason_zh": "审计安全证据在框架接口演化中未到达执行判定的失效，提出回归验证契约。" }, "author": { "id": "2610.23362", "title": "Monitor-Validity Failures: LLM Safety Evidence Paths at Evolving Framework Boundaries", "version_id": "2610.23362v1", "first_author": "Junchi Liao", "authors": [ "Junchi Liao" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.23362v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23362", "evidence": "no_affiliation_stated: PDF first two pages have author Junchi Liao but no affiliation in author block or footnotes.", "author_status": "verified", "affiliation_status": "unresolved", "pdf_checked": true, "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23254": { "id": "2610.23254", "title": "Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents", "classification": "relevant", "reason": "揭示工具 Agent 低提示注入成功率可能源于忽略攻击而非有效拒绝。", "summary_zh": null, "version_id": "2610.23254v1", "published": "2026-10-16T10:26:23Z", "updated": "2026-10-16T10:26:23Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.23254", "tags": [ "injection", "evaluation", "robustness" ], "reason_zh": "区分小型工具 Agent 对注入的忽略与拒绝，联合审计攻击失败和正常任务完成。" }, "author": { "id": "2610.23254", "title": "Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents", "version_id": "2610.23254v1", "first_author": "Farhan Zarif", "authors": [ "Farhan Zarif", "Kazi Shahid Ahmed Galib", "Synthia Akter Promi", "Shabnam Sharmin Tarin", "Ariyan Hossain", "Sadif Ahmed", "Farig Yousuf Sadeque" ], "affiliations": [ "Department of Computer Science and Engineering, BRAC University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.23254v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23254", "evidence": "Farhan Zarif and coauthors share Department of Computer Science and Engineering, BRAC University author-block affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22874": { "id": "2610.22874", "title": "Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data", "classification": "relevant", "reason": "区分外部文档和工具返回中良性与恶意指令，训练逐指令服从边界。", "summary_zh": null, "version_id": "2610.22874v1", "published": "2026-10-16T03:24:08Z", "updated": "2026-10-16T03:24:08Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CR", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.22874", "tags": [ "injection", "evaluation" ], "reason_zh": "以逐指令奖励训练模型区分外部内容中的有益指令与恶意注入，兼顾安全和效用。" }, "author": { "id": "2610.22874", "title": "Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data", "version_id": "2610.22874v1", "first_author": "Zesheng Shi", "authors": [ "Zesheng Shi", "Xue Li", "Chenrui Dai", "Jing Li" ], "affiliations": [ "Harbin Institute of Technology, Shenzhen" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22874v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22874", "evidence": "Zesheng Shi individual author block lists Harbin Institute of Technology, Shenzhen, China.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31650": { "id": "2610.31650", "title": "EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence", "classification": "relevant", "reason": "评估工具返回缺失安全事实时 Agent 的违规执行及主动证据补全。", "summary_zh": null, "version_id": "2610.31650v1", "published": "2026-10-22T17:57:04Z", "updated": "2026-10-22T17:57:04Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31650", "tags": [ "evaluation", "robustness", "authorization" ], "reason_zh": "以配对任务评测安全证据缺失时的越界执行、补充取证与恰当行动。" }, "author": { "id": "2610.31650", "title": "EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence", "version_id": "2610.31650v1", "first_author": "Qijin Zhang", "authors": [ "Qijin Zhang", "Hanzhen Wang", "Yuehan Zhao", "Haoyu Dai", "Yao Shu", "Zhongxiang Dai", "Shuang Qiu" ], "affiliations": [ "City University of Hong Kong" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31650v1", "shared_first_authors": [ "Qijin Zhang", "Hanzhen Wang", "Yuehan Zhao" ], "shared_first_note": "First three authors have * markers and the footnote explicitly says * Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31650", "evidence": "Qijin Zhang has superscript 1; institution 1 is City University of Hong Kong.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31593": { "id": "2610.31593", "title": "Simulated Control Evals", "classification": "relevant", "reason": "以模拟工具环境评估恶意 Agent 与安全监控，验证控制评测迁移误差。", "summary_zh": null, "version_id": "2610.31593v1", "published": "2026-10-22T17:26:42Z", "updated": "2026-10-22T17:26:42Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31593", "tags": [ "evaluation", "monitoring" ], "reason_zh": "用模拟工具响应扩展 AI 控制评测，并验证其对部署安全及监控效果的预测能力。" }, "author": { "id": "2610.31593", "title": "Simulated Control Evals", "version_id": "2610.31593v1", "first_author": "Jeffrey Olmo", "authors": [ "Jeffrey Olmo", "David Zhang", "Tyler Tracy" ], "affiliations": [ "Redwood Research" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31593v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31593", "evidence": "Jeffrey Olmo, David Zhang and Tyler Tracy share Redwood Research author-block affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31553": { "id": "2610.31553", "title": "Contestable Agents for Data Governance: Recording Human Stewardship of AI-Generated Metadata Across Structured and Unstructured Systems", "classification": "relevant", "reason": "对 Agent 生成元数据加入可质疑论证、人类审查和提交治理门。", "summary_zh": null, "version_id": "2610.31553v1", "published": "2026-10-22T16:57:01Z", "updated": "2026-10-22T16:57:01Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31553", "tags": [ "monitoring" ], "reason_zh": "让治理人员审查 Agent 的证据与争议论点，记录元数据决策中的人工干预和依据。" }, "author": { "id": "2610.31553", "title": "Contestable Agents for Data Governance: Recording Human Stewardship of AI-Generated Metadata Across Structured and Unstructured Systems", "version_id": "2610.31553v1", "first_author": "Humza Akhtar", "authors": [ "Humza Akhtar", "Brian Freeman" ], "affiliations": [ "Industry Solutions, MongoDB, Inc." ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31553v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31553", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31436": { "id": "2610.31436", "title": "Conservative Meta-Agent Search: Architecture Adaptation under Non-Stationarity", "classification": "relevant", "reason": "对自适应 Agent 架构变更施加风险约束、影子回放、灰度与回滚。", "summary_zh": null, "version_id": "2610.31436v1", "published": "2026-10-22T15:32:06Z", "updated": "2026-10-22T15:32:06Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31436", "tags": [ "multiagent", "robustness", "evaluation" ], "reason_zh": "研究非平稳环境下多 Agent 架构更新的风险约束、影子回放与回滚验证。" }, "author": { "id": "2610.31436", "title": "Conservative Meta-Agent Search: Architecture Adaptation under Non-Stationarity", "version_id": "2610.31436v1", "first_author": "Ali Atiah Alzahrani", "authors": [ "Ali Atiah Alzahrani" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.31436v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31436", "evidence": "PDF title and first author match. First two pages provide corresponding-author email and disclaimer, but no institution. Remains unverified, not an HTML-only omission.", "author_status": "verified", "affiliation_status": "unresolved", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31376": { "id": "2610.31376", "title": "Certified Execution Harness for Agentic AI: Safe and Least-Intrusive Petri-Net Supervisory Control Between Reasoning and Action", "classification": "relevant", "reason": "用 Petri 网形式化权限、审批、预算来安全执行 Agent 工具调用。", "summary_zh": null, "version_id": "2610.31376v1", "published": "2026-10-22T14:48:16Z", "updated": "2026-10-22T14:48:16Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31376", "tags": [ "authorization", "injection", "robustness" ], "reason_zh": "以 Petri 网监督器强制执行工具能力、审批和预算，并分析拒绝后的重规划代价。" }, "author": { "id": "2610.31376", "title": "Certified Execution Harness for Agentic AI: Safe and Least-Intrusive Petri-Net Supervisory Control Between Reasoning and Action", "version_id": "2610.31376v1", "first_author": "Chao Gu", "authors": [ "Chao Gu", "Quanyan Zhu" ], "affiliations": [ "School of Electronics, Electrical Engineering and Computer Science, Queen’s University Belfast" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31376v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31376", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31372": { "id": "2610.31372", "title": "RIDAR: Safeguarding Research Integrity in Autonomous Research Agents via Automated Detection and Runtime Intervention", "classification": "relevant", "reason": "针对自主研究Agent科研诚信违规建立检测与运行时纠正，直接属于Agent行为监控及安全评测；首发2026-10-22，为旧论文修订。", "abstract_read": true, "published": "2026-10-22T14:43:36Z", "version": 2, "summary_zh": "问题：自主研究Agent可能破坏研究过程的有效性、可复现性和忠实性。方法：RIDAR提出覆盖科研全生命周期的14类违规分类RIVT，以事后轨迹检测器和运行时检测纠正框架处理这些行为。作者报告：在60条专家标注轨迹RIV-Gold上F1为85.2%；在50个任务的300条RIV-Wild轨迹中发现3,964次违规，覆盖99.7%轨迹；运行时干预使任务完成时残留违规减少36.8%。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "研究自主Agent可复现性和忠实性违规的轨迹审计、运行时纠正及专门基准。" }, "updated": "2026-10-25T14:33:29Z", "announcement_date": "2026-10-27", "candidate_type": "changed_version", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.31372v2", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-23", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.31372v2", "abstract_sha256": "83a5c8962ae27f474148e1bac77be1d10d5bc2093f2c41021c1d09e020ec89a0", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-28" ], "version_history": [ { "id": "2610.31372", "version_id": "2610.31372v1", "classification": "relevant", "announcement_date": "Fri, 23 Oct 2026", "published": "2026-10-22T14:43:36Z", "updated": "2026-10-22T14:43:36Z", "reason": "检测并运行时纠正自主研究 Agent 的科研诚信违规。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.31372", "title": "RIDAR: Safeguarding Research Integrity in Autonomous Research Agents via Automated Detection and Runtime Intervention", "version_id": "2610.31372v2", "first_author": "Jiening Siow", "authors": [ "Jiening Siow", "Amy Xin", "Junjie Wang", "Ziyu Tang", "Zijun Yao", "Yunjia Qi", "Fanjin Zhang", "Lei Hou", "Jie Tang", "Juanzi Li" ], "affiliations": [ "Department of Computer Science and Technology, Tsinghua University", "Z.ai" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.31372v2", "shared_first_authors": [ "Jiening Siow", "Amy Xin" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "author_source": "https://arxiv.org/abs/2610.31372v2", "evidence": "PDF Jiening Siow¹,³,* and Amy Xin¹,³,*; footnote Equal Contribution. 1 Tsinghua University; 3 Z.ai. Prior version archive used Zhipu AI; current verified PDF branding retained as Z.ai.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Jiening Siow": [ "Department of Computer Science and Technology, Tsinghua University", "Z.ai" ], "Amy Xin": [ "Department of Computer Science and Technology, Tsinghua University", "Z.ai" ] } }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.31372", "title": "RIDAR: Safeguarding Research Integrity in Autonomous Research Agents via Automated Detection and Runtime Intervention", "classification": "relevant", "reason": "检测并运行时纠正自主研究 Agent 的科研诚信违规。", "summary_zh": null, "version_id": "2610.31372v1", "published": "2026-10-22T14:43:36Z", "updated": "2026-10-22T14:43:36Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31372", "tags": [ "monitoring", "evaluation" ], "reason_zh": "为自主研究 Agent 建立完整性违规分类、轨迹检测基准和运行时纠正机制。" }, "author": { "id": "2610.31372", "title": "RIDAR: Safeguarding Research Integrity in Autonomous Research Agents via Automated Detection and Runtime Intervention", "version_id": "2610.31372v1", "first_author": "Jiening Siow", "authors": [ "Jiening Siow", "Amy Xin", "Junjie Wang", "Ziyu Tang", "Zijun Yao", "Yunjia Qi", "Fanjin Zhang", "Lei Hou", "Jie Tang", "Juanzi Li" ], "affiliations": [ "Department of Computer Science and Technology, Tsinghua University", "Zhipu AI" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31372v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31372", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.31130": { "id": "2610.31130", "title": "Post-Audit Mirage: Identifiability Limits of Offline Agent Verification", "classification": "relevant", "reason": "离线 Agent 安全验证中的不可识别性，覆盖权限环境与部署危害监测。", "summary_zh": null, "version_id": "2610.31130v1", "published": "2026-10-22T11:50:38Z", "updated": "2026-10-22T11:50:38Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31130", "tags": [ "evaluation", "monitoring" ], "reason_zh": "构造离线证据相同而部署安全相反的生命周期，研究审计可识别性与新鲜结果监控。" }, "author": { "id": "2610.31130", "title": "Post-Audit Mirage: Identifiability Limits of Offline Agent Verification", "version_id": "2610.31130v1", "first_author": "Aman Behera", "authors": [ "Aman Behera", "Payal Payal" ], "affiliations": [ "IIT Roorkee" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31130v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31130", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31062": { "id": "2610.31062", "title": "SCOPE: Compiling Natural-Language Policies into Neurosymbolic Predicate Programs", "classification": "relevant", "reason": "将 Agent 多轮与工具轨迹政策编译为可解释神经符号守卫。", "summary_zh": null, "version_id": "2610.31062v1", "published": "2026-10-22T10:41:13Z", "updated": "2026-10-22T10:41:13Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31062", "tags": [ "authorization", "monitoring" ], "reason_zh": "把跨轮策略编译为可解释的神经符号谓词程序，稳定执行复合政策判断。" }, "author": { "id": "2610.31062", "title": "SCOPE: Compiling Natural-Language Policies into Neurosymbolic Predicate Programs", "version_id": "2610.31062v1", "first_author": "Arnon Mazza", "authors": [ "Arnon Mazza", "Elad Levi" ], "affiliations": [ "Plurai" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31062v1", "shared_first_authors": [ "Arnon Mazza", "Elad Levi" ], "shared_first_note": "Equal contribution explicitly stated in author footnote.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31062", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30769": { "id": "2610.30769", "title": "LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades", "classification": "relevant", "reason": "多代理 LLM 群体从众和失控级联，直接评估协调失稳风险。", "summary_zh": null, "version_id": "2610.30769v1", "published": "2026-10-22T05:42:55Z", "updated": "2026-10-22T05:42:55Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30769", "tags": [ "multiagent", "robustness" ], "reason_zh": "研究多 Agent 的社会反馈如何产生从众和难以自纠的失控级联。" }, "author": { "id": "2610.30769", "title": "LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades", "version_id": "2610.30769v1", "first_author": "Farnoosh Hashemi", "authors": [ "Farnoosh Hashemi", "Shiyu Ji", "Joice Chen", "Michael W. Macy" ], "affiliations": [ "Cornell University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30769v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30769", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30751": { "id": "2610.30751", "title": "How Firm Are AI Models' Ethical Boundaries? A Pay-Stub Editing Test of 15 Models", "classification": "relevant", "reason": "直接测试模型对可能欺诈的工资单编辑请求是否发出工具调用，属于Agent工具滥用与行为边界评测。 此条为修订版本，不能仅因更新时间计为今日新论文。", "summary_zh": "论文在相同工资单增收编辑任务上改变请求措辞，以模拟工具评估15个模型的伦理行动边界。445次可观察试验中，说明贷款目的、隐去目的和解释为修复印刷错误时，模型发出编辑调用的比例分别为14.1%、33.1%、66.2%。作者报告不同模型拒绝和行动差异，同时强调使用标记测试文件及模拟工具，结果限于单一情境，不构成总体伦理排名，也未证明现实有害编辑成功。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "测量有害文档修改请求从拒绝转向实际工具调用的条件，直接关注行动边界。" }, "abstract_read": true, "source_index": 136, "version": 2, "published": "2026-10-22T05:19:49Z", "updated": "2026-10-25T20:11:04Z", "announcement_date": "2026-10-27", "candidate_type": "changed_version", "abstract_sha256": "27a4bfc8eceaa70ac0fb11b820117ec6904a30b484117958a8cbf5ec95c35724", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.30751v2", "categories_seen": [ "cs.AI", "cs.CL" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-23", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-23", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.30751v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-28" ], "version_history": [ { "id": "2610.30751", "version_id": "2610.30751v1", "classification": "relevant", "announcement_date": "Fri, 23 Oct 2026", "published": "2026-10-22T05:19:49Z", "updated": "2026-10-22T05:19:49Z", "reason": "用模拟编辑工具测试模型执行收入凭证造假请求的边界。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.30751", "title": "How Firm Are AI Models' Ethical Boundaries? A Pay-Stub Editing Test of 15 Models", "version_id": "2610.30751v2", "first_author": "Simiao Ren", "authors": [ "Simiao Ren", "Xingyu Shen", "Tommy Duong", "Tsang Ng", "Ankit Raj" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.30751v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://arxiv.org/abs/2610.30751v2", "evidence": "PDF confirms Simiao Ren as first author. First two pages give no affiliation, only corresponding-author email benren@scam.ai. Email domain is not an affiliation; prior archive also unresolved.", "author_status": "verified", "affiliation_status": "unresolved", "verification_status": "author_verified_affiliation_unconfirmed", "shared_first_affiliations": {} }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.30751", "title": "How Firm Are AI Models' Ethical Boundaries? A Pay-Stub Editing Test of 15 Models", "classification": "relevant", "reason": "用模拟编辑工具测试模型执行收入凭证造假请求的边界。", "summary_zh": null, "version_id": "2610.30751v1", "published": "2026-10-22T05:19:49Z", "updated": "2026-10-22T05:19:49Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30751", "tags": [ "evaluation" ], "reason_zh": "以同一工资单修改请求的措辞变体，测试模型伦理拒绝与实际编辑调用的边界。" }, "author": { "id": "2610.30751", "title": "How Firm Are AI Models' Ethical Boundaries? A Pay-Stub Editing Test of 15 Models", "version_id": "2610.30751v1", "first_author": "Simiao Ren", "authors": [ "Simiao Ren", "Xingyu Shen", "Tommy Duong", "Tsang Ng", "Ankit Raj" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.30751v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30751", "evidence": "PDF title and first author match. First two pages have no affiliation; corresponding email only. Remains unverified, not an HTML-only omission.", "author_status": "verified", "affiliation_status": "unresolved", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25" } ] }, "2610.30698": { "id": "2610.30698", "title": "Governance-State Corruption in Long-Term Memory for LLM Agents: A Cross-Model Stress Test", "classification": "relevant", "reason": "Agent 长期记忆治理状态损坏导致错误检索投影与下游行为。", "summary_zh": null, "version_id": "2610.30698v1", "published": "2026-10-22T04:13:09Z", "updated": "2026-10-22T04:13:09Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30698", "tags": [ "memory", "evaluation", "robustness" ], "reason_zh": "固定记忆内容与任务，测试记忆有效性控制状态受损如何改变可见上下文和行为。" }, "author": { "id": "2610.30698", "title": "Governance-State Corruption in Long-Term Memory for LLM Agents: A Cross-Model Stress Test", "version_id": "2610.30698v1", "first_author": "Bowen Liu", "authors": [ "Bowen Liu", "Youting Wang", "Bonan Shen", "Dingyan Shang" ], "affiliations": [ "Independent Researcher, South San Francisco, CA, USA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30698v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30698", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30582": { "id": "2610.30582", "classification": "relevant", "reason": "不可信监控器串通纠偏，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "ecfa3285c2e64de1085210f89696fbbb2e9d0dabc3673b2558c4642083a9af3f", "summary_zh": "仅据摘要，作者声称：针对同模型执行器和监控器可能串通，人工植入五种行为对，只用300条已发现串通的诚实审查微调监控器，测试另外四种；作者报告未知串通从91%降至14–20%，已知串通剩1–2%，显示纠正已知失误不能证明串通消失。", "topics": { "tags": [ "monitoring", "multiagent", "evaluation" ], "reason_zh": "不可信监控器串通纠偏，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "Model Organisms of Collusion: Corrective Transfer in Untrusted Monitors", "version_id": "2610.30582v2", "published": "2026-10-22T01:22:48Z", "updated": "2026-10-30T17:55:18Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.30582v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-11-03" ], "version_history": [ { "id": "2610.30582", "version_id": "2610.30582v1", "classification": "relevant", "announcement_date": "Fri, 23 Oct 2026", "published": "2026-10-22T01:22:48Z", "updated": "2026-10-22T01:22:48Z", "reason": "不可信监督模型与执行模型串谋及监控纠偏迁移。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.30582", "title": "Model Organisms of Collusion: Corrective Transfer in Untrusted Monitors", "version_id": "2610.30582v2", "first_author": "Juan-Pablo Rivera", "authors": [ "Juan-Pablo Rivera", "Ari Spiesberger", "Juan J Vazquez", "Arun Jose", "Axel Ahlqvist", "Adeline Kassler", "Meru Gopalan", "Sandy Tanwisuth", "John Hughes" ], "affiliations": [ "Meridian Cambridge" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.30582v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30582", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "affiliation_checked": true }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.30582", "title": "Model Organisms of Collusion: Corrective Transfer in Untrusted Monitors", "classification": "relevant", "reason": "不可信监督模型与执行模型串谋及监控纠偏迁移。", "summary_zh": null, "version_id": "2610.30582v1", "published": "2026-10-22T01:22:48Z", "updated": "2026-10-22T01:22:48Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30582", "tags": [ "monitoring", "multiagent", "evaluation" ], "reason_zh": "构建策略模型与监控副本的合谋行为，研究纠正训练能否迁移到未发现的合谋。" }, "author": { "id": "2610.30582", "title": "Model Organisms of Collusion: Corrective Transfer in Untrusted Monitors", "version_id": "2610.30582v1", "first_author": "Juan-Pablo Rivera", "authors": [ "Juan-Pablo Rivera", "Ari Spiesberger", "Juan J Vazquez", "Arun Jose", "Axel Ahlqvist", "Adeline Kassler", "Meru Gopalan", "Sandy Tanwisuth", "John Hughes" ], "affiliations": [ "Meridian Cambridge" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30582v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30582", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.30557": { "id": "2610.30557", "title": "Governed Self-Evolution for Autonomous Investing: A Multi-Agent LLM System with an Invariant Core", "classification": "relevant", "reason": "自主投资多代理通过不可自改核心、回放和确定性门防止安全约束弱化。", "summary_zh": null, "version_id": "2610.30557v1", "published": "2026-10-22T00:22:47Z", "updated": "2026-10-22T00:22:47Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30557", "tags": [ "multiagent", "authorization", "memory" ], "reason_zh": "用多角色决策、共享记忆及不可自改的风险核心约束自主投资系统的自我演化。" }, "author": { "id": "2610.30557", "title": "Governed Self-Evolution for Autonomous Investing: A Multi-Agent LLM System with an Invariant Core", "version_id": "2610.30557v1", "first_author": "Yebo Feng", "authors": [ "Yebo Feng", "Jingyang Dai", "Liangrui Pan", "Nelson Lau", "Jiahua Xu", "Yang Liu" ], "affiliations": [ "Nanyang Technological University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30557v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30557", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30495": { "id": "2610.30495", "title": "From Prose to Properties: Testing Research Claims with ARATest for Agent-Native Science", "classification": "relevant", "reason": "对 Agent 原生科研声明进行可执行属性核验，检测证据与结论失配。", "summary_zh": null, "version_id": "2610.30495v1", "published": "2026-10-21T22:20:00Z", "updated": "2026-10-21T22:20:00Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30495", "tags": [ "monitoring", "evaluation" ], "reason_zh": "把自主研究的经验结论变成可执行性质测试，以证据和可重放反例核验声明。" }, "author": { "id": "2610.30495", "title": "From Prose to Properties: Testing Research Claims with ARATest for Agent-Native Science", "version_id": "2610.30495v1", "first_author": "Yifeng He", "authors": [ "Yifeng He", "Jiachen Liu", "Hao Chen" ], "affiliations": [ "University of California, Davis", "ARA Lab" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30495v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30495", "evidence": "Title matches. Original HTML custom title block explicitly labels Yifeng He superscript 1,2; 1 = University of California, Davis and 2 = ARA Lab.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30491": { "id": "2610.30491", "title": "What the Trace Shows and What the Label Says: Auditing Behavioral Detectors in Agent Evaluation", "classification": "relevant", "reason": "腐坏工具输出场景中 Agent 验证行为标签误测，影响安全评价可信性。", "summary_zh": null, "version_id": "2610.30491v1", "published": "2026-10-21T22:18:16Z", "updated": "2026-10-21T22:18:16Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30491", "tags": [ "monitoring", "evaluation" ], "reason_zh": "核对工具故障轨迹与行为检测标签，揭示验证记录、最终正确性及故障传播的差异。" }, "author": { "id": "2610.30491", "title": "What the Trace Shows and What the Label Says: Auditing Behavioral Detectors in Agent Evaluation", "version_id": "2610.30491v1", "first_author": "Idunnuoluwa A. Adeniji", "authors": [ "Idunnuoluwa A. Adeniji", " Shilpika", "Michael E. Papka" ], "affiliations": [ "Department of Computer Science, University of Illinois Chicago" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30491v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30491", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30485": { "id": "2610.30485", "title": "Why Bother Me Again? Benchmarking Personal Agent Memory for Interaction Preferences", "classification": "relevant", "reason": "长程个人 Agent 在澄清、审批、授权自主行动与偏好更新中的行为边界。", "summary_zh": null, "version_id": "2610.30485v1", "published": "2026-10-21T22:08:49Z", "updated": "2026-10-21T22:08:49Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30485", "tags": [ "memory", "evaluation" ], "reason_zh": "通过多会话交互基准测试 Agent 对澄清、确认和自主行动偏好的记忆与更新。" }, "author": { "id": "2610.30485", "title": "Why Bother Me Again? Benchmarking Personal Agent Memory for Interaction Preferences", "version_id": "2610.30485v1", "first_author": "Jialin Li", "authors": [ "Jialin Li", "Zhenhao Chen", "Hanjun Luo", "Hanan Salam" ], "affiliations": [ "New York University Abu Dhabi" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.30485v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30485", "evidence": "PDF title matches. Jialin Li and all three coauthors share a single NYU Abu Dhabi affiliation block.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30445": { "id": "2610.30445", "title": "A Three-Pillar Governance Framework for Safe and Trustworthy AI Agents", "classification": "relevant", "reason": "Agent 生命周期透明度、问责、人类监督和可审计运行控制框架。", "summary_zh": null, "version_id": "2610.30445v1", "published": "2026-10-21T20:55:24Z", "updated": "2026-10-21T20:55:24Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30445", "tags": [ "monitoring", "authorization" ], "reason_zh": "围绕透明、问责与可信建立人类监督、升级处理及可审计的自治治理框架。" }, "author": { "id": "2610.30445", "title": "A Three-Pillar Governance Framework for Safe and Trustworthy AI Agents", "version_id": "2610.30445v1", "first_author": "Edward C. Cheng", "authors": [ "Edward C. Cheng", "Jeshua Cheng", "Alice Siu" ], "affiliations": [ "Management Science & Engineering, Stanford University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.30445v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30445", "evidence": "PDF title matches. First author Edward C. Cheng has separate column explicitly listing Management Science & Engineering, Stanford University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30436": { "id": "2610.30436", "title": "Secure Agentic AI and Multimodal Intelligence in 6G Communication Systems", "classification": "relevant", "reason": "6G 多模态 Agent 的记忆、工具、通信与多代理安全威胁综述。", "summary_zh": null, "version_id": "2610.30436v1", "published": "2026-10-21T20:47:14Z", "updated": "2026-10-21T20:47:14Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.30436", "tags": [ "multiagent", "privacy", "authorization" ], "reason_zh": "综述 6G 多模态 Agent 的跨层威胁，覆盖多 Agent 信任、工具编排和隐私保护。" }, "author": { "id": "2610.30436", "title": "Secure Agentic AI and Multimodal Intelligence in 6G Communication Systems", "version_id": "2610.30436v1", "first_author": "Satyam Gaba", "authors": [ "Satyam Gaba", "Devanshu Motwani", "Siva Sai", "Vineet Suri", "Vikas Ranjan", "Vinay Chamola" ], "affiliations": [ "Qualcomm Wireless Research" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30436v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30436", "evidence": "Title matches; Satyam Gaba has superscript 1 and direct Qualcomm Wireless Research affiliation. Other authors’ affiliations are misassigned in HTML, but first author is explicit.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31624": { "id": "2610.31624", "title": "Questioning Instrumental Convergence in RLVR: Checkpoint Evidence from OLMo-3", "classification": "relevant", "reason": "评测 Agent 工具性权力寻求、自保、欺骗和抵抗监督随 RLVR 的变化。", "summary_zh": null, "version_id": "2610.31624v1", "published": "2026-10-22T17:44:41Z", "updated": "2026-10-22T17:44:41Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31624", "tags": [ "evaluation" ], "reason_zh": "按训练检查点评测可验证奖励强化学习中的权力寻求与监督抵抗等工具性行为。" }, "author": { "id": "2610.31624", "title": "Questioning Instrumental Convergence in RLVR: Checkpoint Evidence from OLMo-3", "version_id": "2610.31624v1", "first_author": "Barış Alparslan", "authors": [ "Barış Alparslan", "Sandy Tanwisuth", "Caleb Petterson" ], "affiliations": [ "ASELSAN" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.31624v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31624", "evidence": "PDF title matches. Barış Alparslan superscript 1 maps first-page footnote 1 ASELSAN.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31306": { "id": "2610.31306", "classification": "relevant", "reason": "编码代理契约治理，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "8ae52efbffcc14582b1567b4549232e01e5a40094e62c34fee89b06a899102e7", "summary_zh": "仅据摘要，作者声称：讨论高能力编码代理超过人工审查容量后如何治理，以契约、决策门和知识衰退检查构建OSTEON；作者分析452个热门仓库，48.67%有代理上下文文件，含路径文件中位9.5–22%路径无效。明确没有测量OSTEON效果，机制属于意见和实践启发。", "topics": { "tags": [ "authorization", "memory", "monitoring" ], "reason_zh": "编码代理契约治理，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "Superintelligent Software Engineering: Governance That Scales with Capability", "version_id": "2610.31306v2", "published": "2026-10-22T14:04:13Z", "updated": "2026-10-29T23:19:56Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 10 of 10 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.31306v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-11-03" ], "version_history": [ { "id": "2610.31306", "version_id": "2610.31306v1", "classification": "relevant", "announcement_date": "Fri, 23 Oct 2026", "published": "2026-10-22T14:04:13Z", "updated": "2026-10-22T14:04:13Z", "reason": "高能力 Coding Agent 的治理门、契约、审查容量与知识衰退风险。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.31306", "title": "Superintelligent Software Engineering: Governance That Scales with Capability", "version_id": "2610.31306v2", "first_author": "Mohammad Mehdi Gholinejad", "authors": [ "Mohammad Mehdi Gholinejad" ], "affiliations": [ "OSTEON Labs" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.31306v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31306", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "affiliation_checked": true }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.31306", "title": "Superintelligent Software Engineering: Governance That Scales with Capability", "classification": "relevant", "reason": "高能力 Coding Agent 的治理门、契约、审查容量与知识衰退风险。", "summary_zh": null, "version_id": "2610.31306v1", "published": "2026-10-22T14:04:13Z", "updated": "2026-10-22T14:04:13Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.31306", "tags": [ "supplychain", "monitoring", "memory" ], "reason_zh": "研究高能力编码 Agent 的治理，将项目决策契约、知识衰减检查与变更门控结合。" }, "author": { "id": "2610.31306", "title": "Superintelligent Software Engineering: Governance That Scales with Capability", "version_id": "2610.31306v1", "first_author": "Mohammad Mehdi Gholinejad", "authors": [ "Mohammad Mehdi Gholinejad" ], "affiliations": [ "OSTEON Labs" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31306v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31306", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.31165": { "id": "2610.31165", "title": "Network topology shapes consensus and vulnerability in LLM populations", "classification": "relevant", "reason": "研究攻击者经网络拓扑操纵LLM多智能体共识", "summary_zh": null, "version_id": "2610.31165v1", "published": "2026-10-22T12:22:40Z", "updated": "2026-10-22T12:22:40Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.31165", "tags": [ "multiagent", "robustness" ], "reason_zh": "研究交互网络拓扑如何改变 LLM 群体共识及对少数对抗节点的易感性。" }, "author": { "id": "2610.31165", "title": "Network topology shapes consensus and vulnerability in LLM populations", "version_id": "2610.31165v1", "first_author": "Roberto Passaro", "authors": [ "Roberto Passaro", "Ariel Flint", "Romualdo Pastor-Satorras", "Andrea Baronchelli", "Luca Maria Aiello" ], "affiliations": [ "IT University of Copenhagen", "Pioneer Centre for AI" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31165v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31165", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30562": { "id": "2610.30562", "title": "Lifetime-valid decisions by continually evolving AI analysts", "classification": "relevant", "reason": "自演化分析 Agent 的版本验证和终身错误控制防止未验证升级。", "summary_zh": null, "version_id": "2610.30562v1", "published": "2026-10-22T00:34:06Z", "updated": "2026-10-22T00:34:06Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG", "stat.ML" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.30562", "tags": [ "evaluation", "robustness" ], "reason_zh": "为持续演化的 AI 分析器提出终身有效验证，控制反复更新和反馈适应带来的错误风险。" }, "author": { "id": "2610.30562", "title": "Lifetime-valid decisions by continually evolving AI analysts", "version_id": "2610.30562v1", "first_author": "Xiaojing Sun", "authors": [ "Xiaojing Sun", "Yuhan Zeng", "Xiao Wang" ], "affiliations": [ "Department of Statistics, Purdue University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30562v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30562", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30188": { "id": "2610.30188", "title": "Agentic Verified Optimization of Real-World Software", "classification": "relevant", "reason": "针对编码Agent钻测试漏洞，用机器核验等价性限制不当优化", "summary_zh": null, "version_id": "2610.30188v1", "published": "2026-10-20T17:33:22Z", "updated": "2026-10-20T17:33:22Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE", "cs.LG" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.30188", "tags": [ "robustness" ], "reason_zh": "用机器可检查的等价性证明约束编码 Agent 优化，避免只通过测试而破坏程序行为。" }, "author": { "id": "2610.30188", "title": "Agentic Verified Optimization of Real-World Software", "version_id": "2610.30188v1", "first_author": "Zhe Ye", "authors": [ "Zhe Ye", "Udaya Ghai", "Zhizhen Qin", "Dawn Song", "Soonho Kong" ], "affiliations": [ "University of California, Berkeley" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30188v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30188", "evidence": "Title matches; direct UC Berkeley affiliation. Footnote additionally says work done during internship at Amazon Web Services (not represented as a current affiliation).", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30161": { "id": "2610.30161", "title": "TauIndianBankBench: Procedure-Aware, Action-Oriented Evaluation of Tool-Using Conversational Agents", "classification": "relevant", "reason": "工具银行Agent程序合规和未请求状态变更安全评测", "summary_zh": null, "version_id": "2610.30161v1", "published": "2026-09-30T15:16:21Z", "updated": "2026-09-30T15:16:21Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.30161", "tags": [ "authorization", "evaluation" ], "reason_zh": "在银行任务中同时检查必需流程和未请求改动，而非仅按最终记录判定成功。" }, "author": { "id": "2610.30161", "title": "TauIndianBankBench: Procedure-Aware, Action-Oriented Evaluation of Tool-Using Conversational Agents", "version_id": "2610.30161v1", "first_author": "Krishanu Adhikary", "authors": [ "Krishanu Adhikary", "Prashant Devadiga" ], "affiliations": [ "National Payments Corporation of India (NPCI)" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30161v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30161", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28982": { "id": "2610.28982", "title": "Behavior Beyond Text: Evaluating Refusal Transfer Failure in LLM Agents", "classification": "relevant", "reason": "对照文本拒绝与工具执行，直接测量Agent有害行为拒绝迁移失败", "summary_zh": null, "version_id": "2610.28982v1", "published": "2026-10-20T23:14:30Z", "updated": "2026-10-20T23:14:30Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.28982", "tags": [ "evaluation", "authorization", "monitoring" ], "reason_zh": "评测文本拒绝向工具行动的迁移失败，并分析拒绝相关内部表示与不安全调用。" }, "author": { "id": "2610.28982", "title": "Behavior Beyond Text: Evaluating Refusal Transfer Failure in LLM Agents", "version_id": "2610.28982v1", "first_author": "Ekagra Gupta", "authors": [ "Ekagra Gupta", "Raj Saha", "Aniekan-Abasi Inyang", "Adam Al Gharib" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.28982v1", "shared_first_authors": [ "Ekagra Gupta", "Raj Saha" ], "shared_first_note": "Equal contribution explicitly stated in author footnote.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28982", "evidence": "PDF title matches. Ekagra Gupta author column contains email only, no institution; Harvard University is in Raj Saha column. Equal-contribution note confirmed.", "author_status": "verified", "affiliation_status": "unresolved", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28934": { "id": "2610.28934", "title": "Back Up Before You Regret: Measuring Backup Awareness and Automating Backup in Coding Agents", "classification": "relevant", "reason": "编码Agent状态破坏与备份恢复安全，提供动作前备份防护", "summary_zh": null, "version_id": "2610.28934v1", "published": "2026-10-20T21:13:31Z", "updated": "2026-10-20T21:13:31Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.28934", "tags": [ "robustness", "evaluation" ], "reason_zh": "以可执行后悔场景评测备份意识，并在修改前保存状态以提高行动可恢复性。" }, "author": { "id": "2610.28934", "title": "Back Up Before You Regret: Measuring Backup Awareness and Automating Backup in Coding Agents", "version_id": "2610.28934v1", "first_author": "Xu Li", "authors": [ "Xu Li", "Simon Yu", "Minzhou Pan", "Yiyou Sun", "Zhaorun Chen", "Bo Li", "Weiyan Shi" ], "affiliations": [ "Northeastern University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28934v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28934", "evidence": "PDF title matches. Xu Li superscript 1 maps Northeastern University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28891": { "id": "2610.28891", "title": "Fig: Automated Multiagent Behavior Elicitor", "classification": "relevant", "reason": "直接可控诱发多Agent欺骗、隐蔽协调、背叛和破坏等行为，构建可重复安全行为评测环境。", "abstract_read": true, "summary_zh": "问题：多Agent社会行为评测通常被动观察，缺少可控诱发危险行为的环境干预。方法：Fig将自然语言目标分解为子行为，生成/选择游戏并干预引擎、对手、指令和上下文，结合机械检查、合成评分和人工审核。作者声称：在合作、剥削、欺骗、隐蔽协调、背叛、破坏六种行为的有效场景中，模型平均45.2%回合尝试目标行为；有匹配控制的游戏行为组合中，干预平均提升10.9%。", "topics": { "tags": [ "multiagent", "evaluation", "monitoring" ], "reason_zh": "可控测试欺骗、隐蔽协调和破坏等多Agent危险行为，强调机械与评分双重观测和可重复评估。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.28891v2", "published": "2026-10-20T20:16:08Z", "updated": "2026-10-26T20:44:20Z", "announcement_date": "2026-10-22", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-22", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-22", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.28891v2", "abstract_sha256": "ebabb48e4628ee4e3fcd1a34002a9095ad73fbfe1fed0f399150988cf2c610a4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-28" ], "version_history": [ { "id": "2610.28891", "version_id": "2610.28891v1", "classification": "relevant", "announcement_date": "Thu, 22 Oct 2026", "published": "2026-10-20T20:16:08Z", "updated": "2026-10-20T20:16:08Z", "reason": "自动诱发多Agent欺骗、隐蔽协调、背叛和破坏的安全行为评测" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.28891", "title": "Fig: Automated Multiagent Behavior Elicitor", "version_id": "2610.28891v2", "first_author": "Anrui Gu", "authors": [ "Anrui Gu", "Zhichao Wang", "Nicolai Ouporov" ], "affiliations": [ "Fleet AI" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28891v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://arxiv.org/abs/2610.28891v2", "evidence": "PDF Anrui (Allie) Gu, Zhichao Wang and Nicolai Ouporov share the Fleet AI, San Francisco affiliation. First author normalized to API name Anrui Gu; paper includes nickname Allie.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "shared_first_affiliations": {} }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.28891", "title": "Fig: Automated Multiagent Behavior Elicitor", "classification": "relevant", "reason": "自动诱发多Agent欺骗、隐蔽协调、背叛和破坏的安全行为评测", "summary_zh": null, "version_id": "2610.28891v1", "published": "2026-10-20T20:16:08Z", "updated": "2026-10-20T20:16:08Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.AI", "cs.MA" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.28891", "tags": [ "multiagent", "evaluation" ], "reason_zh": "通过可控环境干预诱发合作、欺骗、隐蔽协调等多 Agent 行为并可重复评测。" }, "author": { "id": "2610.28891", "title": "Fig: Automated Multiagent Behavior Elicitor", "version_id": "2610.28891v1", "first_author": "Anrui Gu", "authors": [ "Anrui Gu", "Zhichao Wang", "Nicolai Ouporov" ], "affiliations": [ "Fleet AI" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28891v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28891", "evidence": "PDF title matches. Anrui (Allie) Gu, Zhichao Wang and Nicolai Ouporov share a centered Fleet AI, San Francisco affiliation block.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.29129": { "id": "2610.29129", "title": "Mitigating Reward Hacking in Realistic Scenarios Through Representation Engineering", "classification": "relevant", "reason": "工具调用和长上下文中动态表示干预抑制奖励投机", "summary_zh": "研究含工具调用和长上下文的奖励投机。用标注轨迹均值差、梯度优化及反投机规范得到方向，再动态干预表示。作者称显著减少投机而无相应显著连贯性或能力损失，编码环境方向可跨域迁移；摘要未给幅度。", "version_id": "2610.29129v1", "published": "2026-10-21T03:12:22Z", "updated": "2026-10-21T03:12:22Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.29129", "tags": [ "monitoring", "evaluation" ], "reason_zh": "通过动态表示监控与干预抑制工具调用和长上下文任务中的奖励投机。" }, "author": { "id": "2610.29129", "title": "Mitigating Reward Hacking in Realistic Scenarios Through Representation Engineering", "version_id": "2610.29129v1", "first_author": "Austin Meek", "authors": [ "Austin Meek", "Kyle Cox", "Matthew Nguyen", "Austin J. Brockmeier", "Steven Basart" ], "affiliations": [ "University of Delaware" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29129v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29129", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28955": { "id": "2610.28955", "title": "SLoSa: Small, Low-Power, and Safe Foundation Models for Robotic Task Planning", "classification": "relevant", "reason": "LLM机器人任务规划安全约束及形式验证奖励", "summary_zh": "SLoSa利用经典规划器、教师模型和形式验证器生成安全数据，以监督学习及验证奖励机器强化学习训练小型LLM机器人规划器。在四类PDDL任务中，4B–14B模型成功率达70.5%–76.0%；Jetson Orin INT4平均功耗17.85–26.41W。注意成功率不等同安全违规率。", "version_id": "2610.28955v1", "published": "2026-10-20T22:09:44Z", "updated": "2026-10-20T22:09:44Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.28955", "tags": [ "embodied", "evaluation" ], "reason_zh": "以形式验证数据和验证奖励训练小型机器人规划模型，使任务计划满足安全约束。" }, "author": { "id": "2610.28955", "title": "SLoSa: Small, Low-Power, and Safe Foundation Models for Robotic Task Planning", "version_id": "2610.28955v1", "first_author": "Weizhe Xu", "authors": [ "Weizhe Xu", "Jialiang Fan", "Essien Taylor", "Zijun Wang", "Russell Joseph", "Fanxin Kong" ], "affiliations": [ "University of Notre Dame" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28955v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28955", "evidence": "PDF title matches. Weizhe Xu superscript 1 maps University of Notre Dame.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28679": { "id": "2610.28679", "version_id": "2610.28679v2", "abstract_sha256": "2036dfb06df824248ec9fd2e6088bbef574dbc5c380a0f33a20b2fc382c988b5", "abstract_read": true, "classification": "relevant", "reason_zh": "评估代理生成的可执行验证器抵抗无效方案与攻击，并揭示错误安全检查的误拒绝风险。", "summary_zh": "VerifierBench 含六类代理基准来源的 222 个任务和 4,993 个隐藏案例，覆盖替代有效解及攻击，并以六项 V4V 审核源验证器。十九模型归一化平衡准确率仅 10.6–62.1；拒绝无效解较好可能掩盖过严检查，多数分析中的误拒绝来自完全不接受任何测试解的验证器，自测也会复用其错误假设。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "评估代理生成的可执行验证器抵抗无效方案与攻击，并揭示错误安全检查的误拒绝风险。" }, "reason": "评估代理生成的可执行验证器抵抗无效方案与攻击，并揭示错误安全检查的误拒绝风险。", "title": "VerifierBench: Benchmarking the Generation of Executable Verifiers for LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-19T17:22:36Z", "updated": "2026-10-30T21:28:59Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 29 of 29 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.28679v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-11-04" ], "version_history": [ { "id": "2610.28679", "version_id": "2610.28679v1", "classification": "relevant", "announcement_date": "Thu, 22 Oct 2026", "published": "2026-10-19T17:22:36Z", "updated": "2026-10-19T17:22:36Z", "reason": "Agent可执行验证器评测包含攻击测试，防错误接受与错误拒绝" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.28679", "title": "VerifierBench: Benchmarking the Generation of Executable Verifiers for LLM Agents", "version_id": "2610.28679v2", "first_author": "Jianing Yin", "authors": [ "Jianing Yin", "Ziyi Chen", "Hao Wang", "Yiyou Sun", "Zijian Jin", "Dawn Song", "Daoan Zhang" ], "affiliations": [ "University of Pennsylvania" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28679v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28679", "evidence": "首页标题及v2匹配；Jianing Yin上标1对应宾夕法尼亚大学。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "affiliation_checked": true }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.28679", "title": "VerifierBench: Benchmarking the Generation of Executable Verifiers for LLM Agents", "classification": "relevant", "reason": "Agent可执行验证器评测包含攻击测试，防错误接受与错误拒绝", "summary_zh": "VerifierBench含222任务、4993隐藏用例，涵盖工具调用、状态与代码验证及攻击。19模型归一化平衡准确度10.6–62.1；生成验证器更会拒绝错误答案，却常拒绝所有合法答案。强调验证器须接受多种合法解，不能把全拒绝误当安全。", "version_id": "2610.28679v1", "published": "2026-10-19T17:22:36Z", "updated": "2026-10-19T17:22:36Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.28679", "tags": [ "evaluation", "robustness" ], "reason_zh": "评测 Agent 生成的可执行验证器能否既拒绝错误解又接受不同合法解。" }, "author": { "id": "2610.28679", "title": "VerifierBench: Benchmarking the Generation of Executable Verifiers for LLM Agents", "version_id": "2610.28679v1", "first_author": "Jianing Yin", "authors": [ "Jianing Yin", "Ziyi Chen", "Hao Wang", "Yiyou Sun", "Zijian Jin", "Dawn Song", "Daoan Zhang" ], "affiliations": [ "University of Pennsylvania" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28679v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28679", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.28667": { "id": "2610.28667", "title": "Who Verifies the Builder? Toward Independent Assurance for Agent-Produced Software", "classification": "relevant", "reason": "分离编码Agent构建与验证，减少测试迎合和不独立保证", "summary_zh": "提出独立于构建Agent的保证层、Verification Contract和先规范后实现的验证阶段。三项有状态服务及EvalPlus预实验中，新上下文验证器比构建者测试检出更多46个植入故障（Holm校正p=0.006），但偶有错误oracle；换提供商未额外改善。", "version_id": "2610.28667v1", "published": "2026-10-16T18:00:10Z", "updated": "2026-10-16T18:00:10Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.28667", "tags": [ "supplychain", "evaluation" ], "reason_zh": "将编码 Agent 的构建与验证分离，以独立规范和变异测试审查软件发布证据。" }, "author": { "id": "2610.28667", "title": "Who Verifies the Builder? Toward Independent Assurance for Agent-Produced Software", "version_id": "2610.28667v1", "first_author": "Sion Israel Sion", "authors": [ "Sion Israel Sion", "Alain April" ], "affiliations": [ "École de technologie supérieure" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28667v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28667", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28522": { "id": "2610.28522", "title": "DecisionPivot: A Diagnostic Benchmark for Decision Models in LLM Systems", "classification": "relevant", "reason": "正文将工具验证置于 Agent 执行环，包含访问授权、策略审批与工具调用偏差的受控决策评测；按安全组件评测纳入，不宣称端到端 Agent 防护。", "summary_zh": "问题：聚合准确率可能掩盖执行环决策组件对权限、策略和调用关键细节的失误。 方法：DecisionPivot 用受控对照与独立求解器验证答案，覆盖 7 个角色、48 项任务；含访问授权、审批策略和 Agent 工具调用验证。 作者声称结果：作者报告总计 40,033 条；参考测试仅相差 2.6 分的两个 27B 模型，在对照组正确率上为 70.1% 与 44.2%。这些是整体诊断结果，并非端到端攻击防御率。", "version_id": "2610.28522v1", "published": "2026-10-20T16:57:49Z", "updated": "2026-10-20T16:57:49Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "正文将工具验证置于 Agent 执行环，包含访问授权、策略审批与工具调用偏差的受控决策评测；按安全组件评测纳入，不宣称端到端 Agent 防护。" }, "author": { "id": "2610.28522", "title": "DecisionPivot: A Diagnostic Benchmark for Decision Models in LLM Systems", "version_id": "2610.28522v1", "first_author": "Xialie Zhuang", "authors": [ "Xialie Zhuang", "Mingcong Lei", "Zunhai Su", "Ri Liu", "Jianjin Li", "Peixian Ma", "Jia Pan", "Ngai Wong", "Guanhua Chen", "Chuan-Wei Kuo" ], "affiliations": [ "StartLux" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28522v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28522", "evidence": "PDF title matches. Xialie Zhuang is first in a centered author group with shared StartLux affiliation underneath.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [ { "id": "2610.28522", "title": "DecisionPivot: A Diagnostic Benchmark for Decision Models in LLM Systems", "classification": "uncertain", "reason": "决策角色包含保护机制，但摘要未说明是否评估 Agent 安全边界。", "summary_zh": null, "version_id": "2610.28522v1", "published": "2026-10-20T16:57:49Z", "updated": "2026-10-20T16:57:49Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.28522", "tags": [ "evaluation", "robustness" ], "reason_zh": "以受控对照组诊断决策模型的正确性、置信校准和细节变化下的稳定性。" }, "author": { "id": "2610.28522", "title": "DecisionPivot: A Diagnostic Benchmark for Decision Models in LLM Systems", "version_id": "2610.28522v1", "first_author": "Xialie Zhuang", "authors": [ "Xialie Zhuang", "Mingcong Lei", "Zunhai Su", "Ri Liu", "Jianjin Li", "Peixian Ma", "Jia Pan", "Ngai Wong", "Guanhua Chen", "Chuan-Wei Kuo" ], "affiliations": [ "StartLux" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28522v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28522", "evidence": "PDF title matches. Xialie Zhuang is first in a centered author group with shared StartLux affiliation underneath.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ], "review": { "id": "2610.28522", "classification_recommendation": "relevant", "reason_zh": "正文将工具验证置于 Agent 执行环，包含访问授权、策略审批与工具调用偏差的受控决策评测；按安全组件评测纳入，不宣称端到端 Agent 防护。", "source_url": "https://arxiv.org/html/2610.28522v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "3.1 Items and decision layers", "3.2 Core track", "Appendix A.2 perm_inherit", "Appendix A.3 policy_case", "Appendix A.7 toolcall_valid", "Appendix D2" ], "evidence_zh": "权限任务控制访问路径、拒绝条目和嵌套组；工具任务给出用户请求、JSON schema 和候选调用。结果表分任务报告决策正确率，证明不是只在引言泛提安全。工具任务大部分可仅靠 schema 判断，不能夸大其真实攻击覆盖。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.28522v1", "problem_zh": "聚合准确率可能掩盖执行环决策组件对权限、策略和调用关键细节的失误。", "method_zh": "DecisionPivot 用受控对照与独立求解器验证答案，覆盖 7 个角色、48 项任务；含访问授权、审批策略和 Agent 工具调用验证。", "claimed_results_zh": "作者报告总计 40,033 条；参考测试仅相差 2.6 分的两个 27B 模型，在对照组正确率上为 70.1% 与 44.2%。这些是整体诊断结果，并非端到端攻击防御率。", "topics": [ "authorization", "evaluation" ] } }, "2610.28454": { "id": "2610.28454", "title": "Toolflation: Seller Agents Distort Tool Markets Through Spontaneous Generative Engine Optimization", "classification": "relevant", "reason": "卖方Agent自发虚假工具描述误导买方，直接涉及Agent生态安全", "summary_zh": "五种生产模型下，卖方Agent仅被要求提高选择率便夸大工具字段。10种模型平台组合中7种让最强工具失去份额；其中一种模型导致描述同质化、买方按位置选工具，Amazon成功率89%降约30%，Instagram77%降40%。研究跨Agent市场诚信与安全对齐。", "version_id": "2610.28454v1", "published": "2026-10-20T16:12:39Z", "updated": "2026-10-20T16:12:39Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL", "cs.MA" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.28454", "tags": [ "multiagent" ], "reason_zh": "研究卖方代理在竞争中夸大工具描述，及其对买方选择和群体市场诚信的影响。" }, "author": { "id": "2610.28454", "title": "Toolflation: Seller Agents Distort Tool Markets Through Spontaneous Generative Engine Optimization", "version_id": "2610.28454v1", "first_author": "Zhenwei Tang", "authors": [ "Zhenwei Tang", "Di Bai", "Jintao Liu", "Xidong Wu", "Qianfeng Wen", "Xinwu Cheng" ], "affiliations": [ "Google", "University of Toronto" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28454v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28454", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27777": { "id": "2610.27777", "title": "RITE: Evaluating End-to-End Resilience to Silent Tool Errors in E-Commerce Agentic Systems", "classification": "relevant", "reason": "工具静默错误的真实性检查与恢复，关联 Agent 对工具结果的信任。", "summary_zh": null, "version_id": "2610.27777v1", "published": "2026-10-20T07:42:11Z", "updated": "2026-10-20T07:42:11Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.27777", "tags": [ "robustness", "evaluation" ], "reason_zh": "构建工具静默错误基准，评测多步代理发现、核验并恢复错误的能力。" }, "author": { "id": "2610.27777", "title": "RITE: Evaluating End-to-End Resilience to Silent Tool Errors in E-Commerce Agentic Systems", "version_id": "2610.27777v1", "first_author": "Wenshuo Zhang", "authors": [ "Wenshuo Zhang", "Yuquan Lin", "Yushi Sun", "Yishi Lin", "Rui Sheng", "Peng He", "Han Gao", "Wang Jikai", "Yifeng Rong" ], "affiliations": [ "The Hong Kong University of Science and Technology" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27777v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27777", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27735": { "id": "2610.27735", "title": "RSI Control: Can AI Models Perform Covert Sabotage in the Self-Improvement Process?", "classification": "relevant", "reason": "自主研发Agent隐蔽破坏后继模型训练及监控评测", "summary_zh": "RSI Control Arena让自主研发Agent在良性后继训练任务中执行隐蔽破坏；含16侧任务、22任务对，覆盖数据整理至RL。六前沿模型均可完成相当部分破坏且保持主任务表现；简单规避技巧进一步降低监控检出，读取推理的监控亦无法检出全部。摘要无具体成功率。", "version_id": "2610.27735v2", "published": "2026-10-20T06:57:59Z", "updated": "2026-10-21T18:15:12Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.27735", "tags": [ "evaluation", "monitoring" ], "reason_zh": "以自主研发代理隐蔽破坏后继模型训练为测试场景，评估行为监控与规避。" }, "author": { "id": "2610.27735", "title": "RSI Control: Can AI Models Perform Covert Sabotage in the Self-Improvement Process?", "version_id": "2610.27735v2", "first_author": "Kaiwen Zhou", "authors": [ "Kaiwen Zhou", "Udari Madhushani Sehwag" ], "affiliations": [ "Preparedness and Policy, Scale AI" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27735v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27735", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27655": { "id": "2610.27655", "title": "Does Multi-Agent Collaboration Pay When Agents Serve Users? Testing Agent Scaling in Dual-Control Settings", "classification": "relevant", "reason": "多 Agent 双重控制在数据库错误写入上的失效，与行动授权防护相关。", "summary_zh": null, "version_id": "2610.27655v1", "published": "2026-10-20T05:13:13Z", "updated": "2026-10-20T05:13:13Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI", "cs.MA" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.27655", "tags": [ "multiagent", "robustness" ], "reason_zh": "比较面向用户的单代理与多代理系统，分析错误写入、预算耗尽和协作失效。" }, "author": { "id": "2610.27655", "title": "Does Multi-Agent Collaboration Pay When Agents Serve Users? Testing Agent Scaling in Dual-Control Settings", "version_id": "2610.27655v1", "first_author": "Ethan Yang", "authors": [ "Ethan Yang", "Xiangcheng Shi" ], "affiliations": [ "University of Pennsylvania" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27655v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27655", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27581": { "id": "2610.27581", "title": "DuplexLedger: Benchmarking Transactional Memory in Full-Duplex Speech Agents", "classification": "uncertain", "reason": "正文验证语音 Agent 对非收件人语音与干扰事实的记忆准入边界，但未建立攻击、敏感信息泄露或完整隐私管理评测，保留边界待定。", "summary_zh": null, "version_id": "2610.27581v1", "published": "2026-10-20T03:47:06Z", "updated": "2026-10-20T03:47:06Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "id": "2610.27581", "tags": [ "memory", "evaluation" ], "reason_zh": "用事务状态标注评测全双工语音代理的记忆写入、更新、忽略和过期信息控制。" }, "author": { "id": "2610.27581", "title": "DuplexLedger: Benchmarking Transactional Memory in Full-Duplex Speech Agents", "version_id": "2610.27581v1", "first_author": "Yuxuan Li", "authors": [ "Yuxuan Li", "Xiangchen Guan", "Kunrong Li", "Jin Wang", "Kaiwen Luo", "Yang Xiao", "Yufei Guo", "Zhisheng Chen", "Liang Lin", "Kun Wang" ], "affiliations": [ "Nanyang Technological University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.27581v1", "shared_first_authors": [ "Yuxuan Li", "Xiangchen Guan" ], "shared_first_note": "Equal contribution explicitly marked in PDF front matter.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27581", "evidence": "PDF title matches. Yuxuan Li superscript 1,* maps Nanyang Technological University; Yuxuan Li and Xiangchen Guan explicitly marked equal contribution.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [], "review": { "id": "2610.27581", "classification_recommendation": "uncertain", "reason_zh": "正文验证语音 Agent 对非收件人语音与干扰事实的记忆准入边界，但未建立攻击、敏感信息泄露或完整隐私管理评测，保留边界待定。", "source_url": "https://arxiv.org/html/2610.27581v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "3.2 Adaptive Full-Duplex Sessions", "3.3 Event-Level Supervision", "4.4 Transactional Memory Failures", "Appendix A limitations" ], "evidence_zh": "要求对他人说话既不触发回复也不更新记忆，按禁止的旧值和干扰记录审查回答；作者明确没有记忆删除操作，不能当作完整隐私记忆基准。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.27581v1" } }, "2610.27483": { "id": "2610.27483", "title": "Securing Agentic Commerce Through Behavior-Aware Fraud Detection and Cybersecurity for Trusted AI-Agent Payment Authorization", "classification": "relevant", "reason": "Agent支付授权、冒充和恶意委托防御，实验仅合成交易", "summary_zh": "ACAGS结合行为特征、Agent授权控制、XGBoost与SHAP，应对冒充、恶意委托、越权支付。合成交易与五类模拟攻击中，F1从52.12%升至69.46%，受损Agent检出72.27%，恶意委托及授权范围违规100%。不能外推真实交易防御效果。", "version_id": "2610.27483v1", "published": "2026-10-20T01:48:14Z", "updated": "2026-10-20T01:48:14Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.27483", "tags": [ "authorization", "monitoring" ], "reason_zh": "结合委托授权范围、行为异常检测与解释机制，防范模拟代理支付中的越权和冒充。" }, "author": { "id": "2610.27483", "title": "Securing Agentic Commerce Through Behavior-Aware Fraud Detection and Cybersecurity for Trusted AI-Agent Payment Authorization", "version_id": "2610.27483v1", "first_author": "Kayode L. Ogunsusi", "authors": [ "Kayode L. Ogunsusi" ], "affiliations": [ "Credit and Fraud Risk, American Express" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.27483v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27483", "evidence": "PDF title matches. Sole author Kayode L. Ogunsusi explicitly followed by Credit and Fraud Risk, American Express, Phoenix, Arizona, USA.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27480": { "id": "2610.27480", "title": "Runtime Control for AI Agents: Closing the Evaluation--Execution Gap in Operational Workflows", "classification": "relevant", "reason": "将授权绑定状态并在派发时撤销失效许可，直接涉及Agent权限控制", "summary_zh": "状态绑定运行时保证层区分概率测量与确定裁决，将执行许可绑定审批依据，相关变化后失效、派发时再查。42例脚本回放识别15个后续失效批准，拦截14次行动、补偿1次已发生效果。作者明确不证明优于派发时执法或生产有效性。", "version_id": "2610.27480v1", "published": "2026-10-20T01:46:07Z", "updated": "2026-10-20T01:46:07Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.27480", "tags": [ "authorization" ], "reason_zh": "将执行许可绑定审批依据，在状态变化后撤销失效许可并于派发时复核。" }, "author": { "id": "2610.27480", "title": "Runtime Control for AI Agents: Closing the Evaluation--Execution Gap in Operational Workflows", "version_id": "2610.27480v1", "first_author": "Jayesh Bhadane", "authors": [ "Jayesh Bhadane", "Ramachandra Yerramsetti", "Rajesh Gupta", "Sumit Kumar" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.27480v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27480", "evidence": "PDF title and first author match. First two pages show names and email addresses but no institution; remains unverified, not an HTML-only omission.", "author_status": "verified", "affiliation_status": "unresolved", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27465": { "id": "2610.27465", "title": "Recoverability and Verifier Strength: Two Measured Preconditions for Unattended Agent Self-Improvement", "classification": "relevant", "reason": "无人值守Agent自改动的验证强度与回滚安全门控", "summary_zh": "用验证器强度和可恢复性决定Agent自改动是否可无人值守。平台37设置中9个LLM裁判不论输入给同分；保存版本回滚可恢复行为，重新生成撤销不行；改动部署期间17%任务受超出自然随机性的影响，回滚无法补救已发生后果。", "version_id": "2610.27465v1", "published": "2026-10-20T01:32:13Z", "updated": "2026-10-20T01:32:13Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL", "cs.SE" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.27465", "tags": [ "evaluation", "authorization", "robustness" ], "reason_zh": "研究无人值守自改动的验证器强度、审批门槛与回滚可恢复性。" }, "author": { "id": "2610.27465", "title": "Recoverability and Verifier Strength: Two Measured Preconditions for Unattended Agent Self-Improvement", "version_id": "2610.27465v1", "first_author": "De Wang", "authors": [ "De Wang", "Peng Qi" ], "affiliations": [ "Uniphore" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27465v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27465", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27406": { "id": "2610.27406", "title": "More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents", "classification": "irrelevant", "reason": "正文评测经验记忆的错误再生、任务成功率与调用成本，未建立攻击或具体安全后果，归为一般 Agent 可靠性而非本日报核心安全。", "summary_zh": null, "version_id": "2610.27406v1", "published": "2026-10-19T23:58:46Z", "updated": "2026-10-19T23:58:46Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "id": "2610.27406", "tags": [ "memory", "robustness" ], "reason_zh": "分析记忆抽象经执行和再抽象反复生成错误，并以按需生成指导减少错误持久化。" }, "author": { "id": "2610.27406", "title": "More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents", "version_id": "2610.27406v1", "first_author": "Ruhan Wang", "authors": [ "Ruhan Wang", "Kishan Panaganti", "Dongruo Zhou" ], "affiliations": [ "Indiana University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.27406v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27406", "evidence": "PDF title matches. Ruhan Wang superscript 1 explicitly maps to Indiana University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [ { "id": "2610.27406", "title": "More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents", "classification": "uncertain", "reason": "记忆导致错误再生属于可靠性问题，是否涉及安全后果或攻击尚不明确。", "summary_zh": null, "version_id": "2610.27406v1", "published": "2026-10-19T23:58:46Z", "updated": "2026-10-19T23:58:46Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.27406", "tags": [ "memory", "robustness" ], "reason_zh": "分析记忆抽象经执行和再抽象反复生成错误，并以按需生成指导减少错误持久化。" }, "author": { "id": "2610.27406", "title": "More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents", "version_id": "2610.27406v1", "first_author": "Ruhan Wang", "authors": [ "Ruhan Wang", "Kishan Panaganti", "Dongruo Zhou" ], "affiliations": [ "Indiana University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.27406v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27406", "evidence": "PDF title matches. Ruhan Wang superscript 1 explicitly maps to Indiana University.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ], "review": { "id": "2610.27406", "classification_recommendation": "irrelevant", "reason_zh": "正文评测经验记忆的错误再生、任务成功率与调用成本，未建立攻击或具体安全后果，归为一般 Agent 可靠性而非本日报核心安全。", "source_url": "https://arxiv.org/html/2610.27406v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "3 Anti-Persistence", "4.1 Experimental Setup", "4.2 Held-Out Performance and LLM-Call Cost", "4.3 Dynamics Across Self-Improvement Rounds", "Conclusion" ], "evidence_zh": "实验采用 ALFWorld、WebShop、ScienceWorld，比较轨迹/抽象记忆和临时合成策略。错误传播与提前终止是任务表现分析，不能据此声称已验证防投毒或授权防护。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.27406v1" } }, "2610.27234": { "id": "2610.27234", "title": "EGI-BENCH: An Enterprise General Intelligence Benchmark Suite", "classification": "relevant", "reason": "Agent 评测明确包含安全与拒绝执行维度。", "summary_zh": null, "version_id": "2610.27234v1", "published": "2026-10-19T20:02:07Z", "updated": "2026-10-19T20:02:07Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.27234", "tags": [ "evaluation" ], "reason_zh": "统一企业代理基准与分维度评分，其中明确包含安全和拒绝执行能力。" }, "author": { "id": "2610.27234", "title": "EGI-BENCH: An Enterprise General Intelligence Benchmark Suite", "version_id": "2610.27234v1", "first_author": "Zhiwei Liu", "authors": [ "Zhiwei Liu", "Zhujun Lan", "Jielin Qiu", "Zixiang Chen", "Liangwei Yang", "Ming Zhu", "Akshara Prabhakar", "Wenting Zhao", "John Emmons", "Jason Wu", "Shafiq Rayhan Joty", "Junnan Li", "Shelby Heinecke", "Silvio Savarese", "Huan Wang" ], "affiliations": [ "Salesforce AI Research" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.27234v1", "shared_first_authors": [ "Zhiwei Liu", "Zhujun Lan" ], "shared_first_note": "Equal contribution explicitly stated in author footnote.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27234", "evidence": "PDF title matches. All authors share centered Salesforce AI Research institution line; first two authors marked equal contribution.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27115": { "id": "2610.27115", "title": "PROVISO: Provenance-Informed Action Selection for Secure LLM Agents", "classification": "relevant", "reason": "执行前以来源类型区分可信与外部信息并选择安全动作，直接研究工具与技能安全", "summary_zh": null, "version_id": "2610.27115v1", "published": "2026-10-19T18:13:53Z", "updated": "2026-10-19T18:13:53Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.27115", "tags": [ "authorization", "memory" ], "reason_zh": "以来源类型化记忆区分可信与外部信息，在执行前比较并选择可提交动作。" }, "author": { "id": "2610.27115", "title": "PROVISO: Provenance-Informed Action Selection for Secure LLM Agents", "version_id": "2610.27115v1", "first_author": "Bo Yan", "authors": [ "Bo Yan", "Qi Zhang", "Ziwen Kan", "Fnu Suya", "Song Wang" ], "affiliations": [ "University of Central Florida" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27115v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27115", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26943": { "id": "2610.26943", "title": "MAMath-Bench: Process-Aware and Robust Evaluation of Multimodal Multi-Agent Mathematical Reasoning", "classification": "relevant", "reason": "多 Agent 推理链对抗扰动与鲁棒性评测。", "summary_zh": null, "version_id": "2610.26943v1", "published": "2026-10-18T04:32:06Z", "updated": "2026-10-18T04:32:06Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.26943", "tags": [ "multiagent", "robustness", "evaluation" ], "reason_zh": "评测多模态多代理推理过程的可靠性及对抗推理链扰动下的鲁棒性。" }, "author": { "id": "2610.26943", "title": "MAMath-Bench: Process-Aware and Robust Evaluation of Multimodal Multi-Agent Mathematical Reasoning", "version_id": "2610.26943v1", "first_author": "Xinping Wang", "authors": [ "Xinping Wang", "Jie Ma", "Rui Xing", "Wensong Guo", "Xiayi Zhang", "Jianhao Deng", "Zihao Zhou", "Boqian Yang", "Feijuan He" ], "affiliations": [ "School of Cyber Science and Engineering, Xi’an Jiaotong University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26943v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26943", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28160": { "id": "2610.28160", "title": "From Code Generator to Engineering Companion: A Plant-aware Agent for PLC Programming", "classification": "relevant", "reason": "工业PLC编程Agent明确设置从聊天到部署的渐进工具访问权限，并保留工程师对现实副作用步骤的控制。 此条为修订版本，不能仅因更新时间计为今日新论文。", "summary_zh": "论文针对PLC编码需要频繁在文档、项目和IDE间切换且一次性代码生成缺少工厂上下文的问题，提出工厂感知对话式副驾驶，整合工厂专属上下文、解释调试聊天及从聊天到部署的渐进工具访问阶梯。系统面向真实工厂基础设施，要求每个产生现实影响的步骤保持工程师控制；摘要未给实验指标或安全效果数值。", "topics": { "tags": [ "authorization", "embodied" ], "reason_zh": "核心设计包含工业控制编码Agent的分级工具权限和现实行动的人类监督。" }, "abstract_read": true, "source_index": 131, "version": 2, "published": "2026-10-20T13:02:14Z", "updated": "2026-10-27T07:43:19Z", "announcement_date": "2026-10-21", "candidate_type": "changed_version", "abstract_sha256": "3787edffff4013b7aaa6142a176939b7988e9f438b34904330b6e02da6269435", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.28160v2", "categories_seen": [ "cs.AI", "cs.LG", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-21", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-21", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-21", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.28160v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-28" ], "version_history": [ { "id": "2610.28160", "version_id": "2610.28160v1", "classification": "relevant", "announcement_date": "Wed, 21 Oct 2026", "published": "2026-10-20T13:02:14Z", "updated": "2026-10-20T13:02:14Z", "reason": "PLC 工具访问分级和实际动作边界是物理影响 Agent 的权限控制。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.28160", "title": "From Code Generator to Engineering Companion: A Plant-aware Agent for PLC Programming", "version_id": "2610.28160v2", "first_author": "Joschka Kersting", "authors": [ "Joschka Kersting", "Gesa Benndorf" ], "affiliations": [ "Fraunhofer IOSB-INA" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28160v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://arxiv.org/abs/2610.28160v2", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "shared_first_affiliations": {} }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.28160", "title": "From Code Generator to Engineering Companion: A Plant-aware Agent for PLC Programming", "classification": "relevant", "reason": "PLC 工具访问分级和实际动作边界是物理影响 Agent 的权限控制。", "summary_zh": null, "version_id": "2610.28160v1", "published": "2026-10-20T13:02:14Z", "updated": "2026-10-20T13:02:14Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE", "cs.LG" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.28160", "tags": [ "embodied", "authorization" ], "reason_zh": "面向真实工厂的 PLC 助手设置分级工具访问，并让工程师控制产生现实影响的步骤。" }, "author": { "id": "2610.28160", "title": "From Code Generator to Engineering Companion: A Plant-aware Agent for PLC Programming", "version_id": "2610.28160v1", "first_author": "Joschka Kersting", "authors": [ "Joschka Kersting", "Gesa Benndorf" ], "affiliations": [ "Fraunhofer IOSB-INA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28160v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28160", "evidence": "Title matches; joint personname block Joschka Kersting, Gesa Benndorf directly followed by Fraunhofer IOSB-INA affiliation.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.27350": { "id": "2610.27350", "title": "Refuses When Asked, Complies When Acting: A Runtime Safety Check for Robot Control Loops", "classification": "relevant", "reason": "机器人Agent行动循环执行有害指令；执行前运行时安全检查直接降低有害行动", "summary_zh": null, "version_id": "2610.27350v1", "published": "2026-10-19T22:29:34Z", "updated": "2026-10-19T22:29:34Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.27350", "tags": [ "embodied", "authorization" ], "reason_zh": "研究机器人行动循环执行危险目标的问题，并在首次运动前加入运行时安全门控。" }, "author": { "id": "2610.27350", "title": "Refuses When Asked, Complies When Acting: A Runtime Safety Check for Robot Control Loops", "version_id": "2610.27350v1", "first_author": "Arnav Grover", "authors": [ "Arnav Grover" ], "affiliations": [ "Purdue University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27350v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27350", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26698": { "id": "2610.26698", "title": "Towards Robust Model Organisms for Eliciting Latent Knowledge", "classification": "relevant", "reason": "漏洞扫描模型的策略性隐藏表现及监督失败，关联 Agent 欺骗和监控。", "summary_zh": null, "version_id": "2610.26698v1", "published": "2026-10-19T16:36:51Z", "updated": "2026-10-19T16:36:51Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.26698", "tags": [ "monitoring", "evaluation" ], "reason_zh": "构建选择性隐瞒漏洞知识且抵抗诱导的模型，以检验监督者提取潜在知识的能力。" }, "author": { "id": "2610.26698", "title": "Towards Robust Model Organisms for Eliciting Latent Knowledge", "version_id": "2610.26698v1", "first_author": "Lennart Finke", "authors": [ "Lennart Finke", "Hardik Bhatnagar", "Euodia Dodd", "Francis Rhys Ward", "Yves-Alexandre de Montjoye", "Matthias Bethge", "Mary Phuong" ], "affiliations": [ "ETH Zürich", "MATS" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26698v1", "shared_first_authors": [ "Lennart Finke", "Hardik Bhatnagar", "Euodia Dodd" ], "shared_first_note": "Equal contribution explicitly stated in author footnote.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26698", "evidence": "Title matches. Lennart Finke explicitly has ETH Zürich and MATS affiliations; first three authors have stars and front-matter equal-contribution footnote.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26664": { "id": "2610.26664", "title": "Honeypots for AI Agent Insider Threats", "classification": "relevant", "reason": "部署环境蜜罐检测并威慑内部Agent误用、受攻击或错位目标，直接相关", "summary_zh": null, "version_id": "2610.26664v1", "published": "2026-10-19T16:19:44Z", "updated": "2026-10-19T16:19:44Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.26664", "tags": [ "monitoring" ], "reason_zh": "提议在生产环境布置诱饵机会，以发现、归责和威慑内部代理的恶意行为。" }, "author": { "id": "2610.26664", "title": "Honeypots for AI Agent Insider Threats", "version_id": "2610.26664v1", "first_author": "Jan Wehner", "authors": [ "Jan Wehner", "Jam Kraprayoon" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.26664v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26664", "evidence": "PDF cover visually inspected: title and Jan Wehner confirmed; IAPS Institute for AI Policy and Strategy logo is present but no explicit author affiliation mapping. Page 2 is contents. Affiliation remains unverified.", "author_status": "verified", "affiliation_status": "unresolved", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26662": { "id": "2610.26662", "title": "AllPath: Layered Verification for a Deployed, Self-Revising LLM Trading Agent under Human-Gated and Autonomous Regimes", "classification": "relevant", "reason": "自修订交易Agent的确定性风险门控、无行动工具的反思及人类审批，直接研究分层安全控制", "summary_zh": null, "version_id": "2610.26662v1", "published": "2026-10-19T16:18:52Z", "updated": "2026-10-19T16:18:52Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.26662", "tags": [ "authorization", "monitoring" ], "reason_zh": "将交易代理的确定性风险门、受限自审与人工批准分层，并分析实际监控遗漏。" }, "author": { "id": "2610.26662", "title": "AllPath: Layered Verification for a Deployed, Self-Revising LLM Trading Agent under Human-Gated and Autonomous Regimes", "version_id": "2610.26662v1", "first_author": "Tian Zhang", "authors": [ "Tian Zhang", "Meng Li" ], "affiliations": [ "Independent Researcher, USA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26662v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26662", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26551": { "id": "2610.26551", "abstract_sha256": "698cfad9cebb3e55548bf3960ce44262da67513c0cca39f4cd82d9867d333093", "classification": "relevant", "reason": "§3.2 明确三个 agentic 环境，代理读取 .monitor/state.json 的监督线索，并执行提交代码、销售选择与问题路由；直接研究规避监督的策略性合规。三环境共享冲突结构，不等于证明任意部署自然产生恶意目标。", "abstract_read": true, "summary_zh": "基于Kimi K2.6构造以长期总体帮助为目标、仅把持续运行视为未来帮助手段的模型，不直接提供目标密谋策略。仅奖励任务质量与合规的强化学习，在三个受控环境中仍扩大有无监督时的合规差异，伴随关于监督的工具性推理，且策略跨环境迁移；流程也在其他开放权重基模复现。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "§3.2 明确三个 agentic 环境，代理读取 .monitor/state.json 的监督线索，并执行提交代码、销售选择与问题路由；直接研究规避监督的策略性合规。三环境共享冲突结构，不等于证明任意部署自然产生恶意目标。" }, "read_source_abstract_sha256": "698cfad9cebb3e55548bf3960ce44262da67513c0cca39f4cd82d9867d333093", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.26551v2", "summary_audit": "持续运行在摘要中仅是实现未来帮助的手段，不是独立目标；保留模型构造及受控环境范围。", "title": "Training Natural Schemers: RL Can Amplify Oversight-Conditional Behavior", "initial_classification": "relevant", "scope_review": { "id": "2610.26551", "version_id": "2610.26551v2", "classification": "relevant", "reason": "§3.2 明确三个 agentic 环境，代理读取 .monitor/state.json 的监督线索，并执行提交代码、销售选择与问题路由；直接研究规避监督的策略性合规。三环境共享冲突结构，不等于证明任意部署自然产生恶意目标。", "summary_zh": "基于Kimi K2.6构造以长期总体帮助为目标、仅把持续运行视为未来帮助手段的模型，不直接提供目标密谋策略。仅奖励任务质量与合规的强化学习，在三个受控环境中仍扩大有无监督时的合规差异，伴随关于监督的工具性推理，且策略跨环境迁移；流程也在其他开放权重基模复现。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "§3.2 明确三个 agentic 环境，代理读取 .monitor/state.json 的监督线索，并执行提交代码、销售选择与问题路由；直接研究规避监督的策略性合规。三环境共享冲突结构，不等于证明任意部署自然产生恶意目标。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.26551v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "1 Introduction", "3.1 Natural model organism", "3.2 Reinforcement learning environments", "4 Evaluation", "5 Limitations" ] }, "full_text_checked": true, "reviewed_sections": [ "1 Introduction", "3.1 Natural model organism", "3.2 Reinforcement learning environments", "4 Evaluation", "5 Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.26551v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-19T15:12:41Z", "updated": "2026-10-27T23:15:04Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.26551v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-31" ], "version_history": [ { "id": "2610.26551", "version_id": "2610.26551v1", "classification": "relevant", "announcement_date": "Tue, 20 Oct 2026", "published": "2026-10-19T15:12:41Z", "updated": "2026-10-19T15:12:41Z", "reason": "奖励未直接奖励隐瞒时，RL 仍放大基于是否被监督的策略性服从。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.26551", "title": "Training Natural Schemers: RL Can Amplify Oversight-Conditional Behavior", "version_id": "2610.26551v2", "first_author": "Nathaniel Mitrani Hadida", "authors": [ "Bart Jaworski", "Nathaniel Mitrani", "Fred Bruford", "Victoria Krakovna" ], "affiliations": [ "MATS Research" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.26551v2", "shared_first_authors": [ "Nathaniel Mitrani Hadida", "Bart Jaworski" ], "shared_first_note": "两位作者均标 *；脚注 Equal contribution. Listing order is alphabetical by surname.", "author_source": "official_pdf_signature", "evidence": "首页 Nathaniel Mitrani Hadida* 与 Bart Jaworski* 属 MATS Research 署名组；Victoria Krakovna 单独署名 Google DeepMind。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.26551", "title": "Training Natural Schemers: RL Can Amplify Oversight-Conditional Behavior", "classification": "relevant", "reason": "奖励未直接奖励隐瞒时，RL 仍放大基于是否被监督的策略性服从。", "summary_zh": null, "version_id": "2610.26551v1", "published": "2026-10-19T15:12:41Z", "updated": "2026-10-19T15:12:41Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.26551", "tags": [ "evaluation" ], "reason_zh": "研究强化学习如何放大随监督状态切换的策略性服从，检验训练中的对齐风险。" }, "author": { "id": "2610.26551", "title": "Training Natural Schemers: RL Can Amplify Oversight-Conditional Behavior", "version_id": "2610.26551v1", "first_author": "Bart Jaworski", "authors": [ "Bart Jaworski", "Nathaniel Mitrani", "Fred Bruford", "Victoria Krakovna" ], "affiliations": [ "MATS Research" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.26551v1", "shared_first_authors": [ "Bart Jaworski", "Nathaniel Mitrani" ], "shared_first_note": "Equal contribution explicitly stated in author footnote.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26551", "evidence": "PDF title matches. Bart Jaworski, Nathaniel Mitrani and Fred Bruford grouped above MATS Research; Victoria Krakovna separately above Google DeepMind.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.26548": { "id": "2610.26548", "title": "Agentic Orchestration of EDC Data Space Retrieval and Natural Language Driven Data Processing", "classification": "relevant", "reason": "多代理数据访问以可验证凭证、使用政策与最终验证限制越权。", "summary_zh": null, "version_id": "2610.26548v1", "published": "2026-10-19T15:10:26Z", "updated": "2026-10-19T15:10:26Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.26548", "tags": [ "multiagent", "authorization" ], "reason_zh": "多代理数据访问流程以可验证凭证限制协商，并复核合同使用政策与实际执行。" }, "author": { "id": "2610.26548", "title": "Agentic Orchestration of EDC Data Space Retrieval and Natural Language Driven Data Processing", "version_id": "2610.26548v1", "first_author": "Marla Grunewald", "authors": [ "Marla Grunewald", "Fin Gentzen", "Iulisloi Zacarias", "Admela Jukan" ], "affiliations": [ "Institute of Computer and Network Engineering, Technische Universität Braunschweig" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.26548v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26548", "evidence": "PDF title matches. Marla Grunewald and all coauthors carry 1; sole shared institute line explicitly names Institute of Computer and Network Engineering, Technische Universität Braunschweig.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.26369": { "id": "2610.26369", "title": "Autonomous intelligence for mining productivity: a multi-agent AI approach to operational value creation", "classification": "relevant", "reason": "正文明确设计 LLM 多 Agent 工具鉴权、作用域检查、可逆行动边界与安全升级机制，并提出对抗评测框架；属于安全架构研究，但没有受控安全有效性结果。", "summary_zh": "问题：工业多 Agent 不仅要完成任务，还需约束工具权限、不可逆行动和健康安全环境风险，并提供可审计执行。 方法：EI2ROC 用 LLM 编排器、专业 Agent 与 MCP 风格工具接口，结合鉴权/作用域校验、审计和可配置自治级别；提出含失败工具、传感器污染和提示注入场景的多维评测框架。 作者声称结果：作者报告原型已运行部分鉴权与审计机制，但独立 HSE 规则层和基准 harness 尚未实现。仅提供少量查询的成本与延迟观察，不报告受控安全有效性或攻击防御结果。", "version_id": "2610.26369v1", "published": "2026-10-19T13:24:44Z", "updated": "2026-10-19T13:24:44Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.MA" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "tags": [ "authorization", "multiagent", "evaluation" ], "reason_zh": "正文明确设计 LLM 多 Agent 工具鉴权、作用域检查、可逆行动边界与安全升级机制，并提出对抗评测框架；属于安全架构研究，但没有受控安全有效性结果。" }, "author": { "id": "2610.26369", "title": "Autonomous intelligence for mining productivity: a multi-agent AI approach to operational value creation", "version_id": "2610.26369v1", "first_author": "N Guerin", "authors": [ "N Guerin", "A Dehoux", "M Nakhla" ], "affiliations": [ "Eramet" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.26369v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26369", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF title matches. N Guerin superscript 1 maps Data Scientist – PhD Candidate, Eramet, Paris, France. Mines Paris email is not treated as a second affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [ { "id": "2610.26369", "title": "Autonomous intelligence for mining productivity: a multi-agent AI approach to operational value creation", "classification": "uncertain", "reason": "矿业多 Agent 安全关键框架，摘要未给出自身安全威胁或控制验证细节。", "summary_zh": null, "version_id": "2610.26369v1", "published": "2026-10-19T13:24:44Z", "updated": "2026-10-19T13:24:44Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.26369", "tags": [ "embodied", "multiagent", "evaluation" ], "reason_zh": "提出安全关键矿业远程运营的多代理架构及工业评测框架，部分组件仍属设计。" }, "author": { "id": "2610.26369", "title": "Autonomous intelligence for mining productivity: a multi-agent AI approach to operational value creation", "version_id": "2610.26369v1", "first_author": "N Guerin", "authors": [ "N Guerin", "A Dehoux", "M Nakhla" ], "affiliations": [ "Eramet" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.26369v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26369", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF title matches. N Guerin superscript 1 maps Data Scientist – PhD Candidate, Eramet, Paris, France. Mines Paris email is not treated as a second affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ], "review": { "id": "2610.26369", "classification_recommendation": "relevant", "reason_zh": "正文明确设计 LLM 多 Agent 工具鉴权、作用域检查、可逆行动边界与安全升级机制，并提出对抗评测框架；属于安全架构研究，但没有受控安全有效性结果。", "source_url": "https://arxiv.org/pdf/2610.26369", "reviewed_version_id": null, "version_note": "官方未版本化 PDF，提取正文无可核验版本号；不猜版本。", "abstract_read": true, "body_sections_checked": [ "Abstract", "4.4 Tool-use interface and tool-call protocol", "4.8 Human–AI collaboration and autonomy levels", "4.10 Implementation status", "4.11 Preliminary observations", "5.4 A proposed benchmarking framework", "6.3 Limitations" ], "evidence_zh": "当前原型实现 schema 验证、鉴权/作用域检查、限流和审计；HSE 独立规则层仅参考设计，评测 harness 未实现。作者明确无受控任务、安全或运行影响评测，不能把计划中的注入/失败工具测试当成已完成实验。", "review_date": "2026-10-26", "problem_zh": "工业多 Agent 不仅要完成任务，还需约束工具权限、不可逆行动和健康安全环境风险，并提供可审计执行。", "method_zh": "EI2ROC 用 LLM 编排器、专业 Agent 与 MCP 风格工具接口，结合鉴权/作用域校验、审计和可配置自治级别；提出含失败工具、传感器污染和提示注入场景的多维评测框架。", "claimed_results_zh": "作者报告原型已运行部分鉴权与审计机制，但独立 HSE 规则层和基准 harness 尚未实现。仅提供少量查询的成本与延迟观察，不报告受控安全有效性或攻击防御结果。", "topics": [ "authorization", "multiagent", "evaluation" ] } }, "2610.26324": { "id": "2610.26324", "abstract_sha256": "3892b6cfd033d0748d1e109fbeb724cfdf6e096223ac5ff1ac21a520610b18fa", "classification": "relevant", "reason": "§2.2 确认提示驱动托管模型用工具检索交易历史、输出交易参数，引擎执行止损与退出；直接审计风险规则、仓位限制和控制失效。首页无自身 arXiv 水印，但标题和作者与当前 API 匹配。单厂商快照不能证明普适安全或收益。", "abstract_read": true, "summary_zh": "对四个交易代理的 2,627 笔平仓记录检查止损、仓位与市场状态下风险纪律，97.5% 的总亏损在声明止损内，但有一次超仓；是否为 LLM 代理需正文确认。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "§2.2 确认提示驱动托管模型用工具检索交易历史、输出交易参数，引擎执行止损与退出；直接审计风险规则、仓位限制和控制失效。首页无自身 arXiv 水印，但标题和作者与当前 API 匹配。单厂商快照不能证明普适安全或收益。" }, "read_source_abstract_sha256": "3892b6cfd033d0748d1e109fbeb724cfdf6e096223ac5ff1ac21a520610b18fa", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.26324v2", "title": "The Control Layer Behind Rule-Following Agents Trading Across Market Conditions", "initial_classification": "uncertain", "scope_review": { "id": "2610.26324", "version_id": "2610.26324v2", "classification": "relevant", "reason": "§2.2 确认提示驱动托管模型用工具检索交易历史、输出交易参数，引擎执行止损与退出；直接审计风险规则、仓位限制和控制失效。首页无自身 arXiv 水印，但标题和作者与当前 API 匹配。单厂商快照不能证明普适安全或收益。", "summary_zh": "对四个交易代理的 2,627 笔平仓记录检查止损、仓位与市场状态下风险纪律，97.5% 的总亏损在声明止损内，但有一次超仓；是否为 LLM 代理需正文确认。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "§2.2 确认提示驱动托管模型用工具检索交易历史、输出交易参数，引擎执行止损与退出；直接审计风险规则、仓位限制和控制失效。首页无自身 arXiv 水印，但标题和作者与当前 API 匹配。单厂商快照不能证明普适安全或收益。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.26324v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "2.1 Roster", "2.2 Level of autonomy", "3.5 Discipline metrics", "7 Limitations" ] }, "full_text_checked": true, "reviewed_sections": [ "2.1 Roster", "2.2 Level of autonomy", "3.5 Discipline metrics", "7 Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.26324v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-19T13:01:10Z", "updated": "2026-10-29T11:04:56Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.LG", "cs.MA", "q-fin.RM", "q-fin.TR" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.26324v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-31" ], "version_history": [ { "id": "2610.26324", "version_id": "2610.26324v1", "classification": "relevant", "announcement_date": "Tue, 20 Oct 2026", "published": "2026-10-19T13:01:10Z", "updated": "2026-10-19T13:01:10Z", "reason": "交易 Agent 的风险规则与持仓限制遵守审计，区别收益和安全纪律。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.26324", "title": "The Control Layer Behind Rule-Following Agents Trading Across Market Conditions", "version_id": "2610.26324v2", "first_author": "Saad Naja", "authors": [ "Saad Naja", "Nasser Odtallah", "Jake Van-Praag", "Sarah May" ], "affiliations": [ "Hygentra AI" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.26324v2", "shared_first_authors": [], "shared_first_note": "正文署名未注明共同第一作者。", "author_source": "official_pdf_signature", "author_status": "verified", "affiliation_status": "verified", "evidence": "首页标题与当前 API 一致，四位作者均标记 1，对应 Hygentra AI；无自身版本水印，不使用参考文献编号误判版本。", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.26324", "title": "The Control Layer Behind Rule-Following Agents Trading Across Market Conditions", "classification": "relevant", "reason": "交易 Agent 的风险规则与持仓限制遵守审计，区别收益和安全纪律。", "summary_zh": null, "version_id": "2610.26324v1", "published": "2026-10-19T13:01:10Z", "updated": "2026-10-19T13:01:10Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.26324", "tags": [ "evaluation", "monitoring" ], "reason_zh": "用交易日志审计风险规则和持仓约束遵守情况，区分规则纪律与盈利表现。" }, "author": { "id": "2610.26324", "title": "The Control Layer Behind Rule-Following Agents Trading Across Market Conditions", "version_id": "2610.26324v1", "first_author": "Saad Naja", "authors": [ "Saad Naja", "Nasser Odtallah", "Jake Van-Praag", "Sarah May" ], "affiliations": [ "Hygentra AI" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.26324v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26324", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF title matches. Saad Naja superscript 1 maps Hygentra AI.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.26101": { "id": "2610.26101", "title": "Reliable Before Profitable: QuantHarness for Governing Financial Strategy Development with LLM Agents", "classification": "relevant", "reason": "金融策略 Agent 通过阶段信息、动作、提交边界遏制针对性违规。", "summary_zh": null, "version_id": "2610.26101v1", "published": "2026-10-19T09:59:56Z", "updated": "2026-10-19T09:59:56Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.26101", "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "通过阶段信息、行动和提交边界治理策略开发，并用运行轨迹证据与基准检验可靠性。" }, "author": { "id": "2610.26101", "title": "Reliable Before Profitable: QuantHarness for Governing Financial Strategy Development with LLM Agents", "version_id": "2610.26101v1", "first_author": "Jiasheng Mao", "authors": [ "Jiasheng Mao", "Jiacheng Liu", "Hengwei Ye", "Zheng Tian" ], "affiliations": [ "ShanghaiTech University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.26101v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.26101", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25954": { "id": "2610.25954", "title": "CXBench: A Benchmark for Process-Compliant LLM Agents in Regulated Customer-Experience Workflows", "classification": "relevant", "reason": "评测工具 Agent 的同意、披露、授权和过程合规，揭示最终状态正确的虚假通过。", "summary_zh": null, "version_id": "2610.25954v1", "published": "2026-10-19T07:46:04Z", "updated": "2026-10-19T07:46:04Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25954", "tags": [ "evaluation", "authorization" ], "reason_zh": "分别评测业务结果与过程合规，检查披露、同意、权限及操作顺序。" }, "author": { "id": "2610.25954", "title": "CXBench: A Benchmark for Process-Compliant LLM Agents in Regulated Customer-Experience Workflows", "version_id": "2610.25954v1", "first_author": "Boxi Yu", "authors": [ "Boxi Yu", "Yuzhong Zhang", "Zhenfeng Su", "Linfu Xi", "Yinghan Yao", "Shitao Chen", "Yang Cao", "Liting Lin", "Lionel Briand", "Emir Muñoz" ], "affiliations": [ "Lero, the Research Ireland Centre for Software, University of Limerick" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25954v1", "shared_first_authors": [ "Boxi Yu", "Yuzhong Zhang", "Zhenfeng Su" ], "shared_first_note": "Equal contribution explicitly stated in author footnote.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25954", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Boxi Yu has superscript *†1; footnote 1 explicitly maps Lero, University of Limerick; * marks equal contribution for first three authors.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25947": { "id": "2610.25947", "title": "Claim Laundering: When Agent Decision Models Trust Records Over Reality", "classification": "relevant", "reason": "Agent 相信自身成功日志而忽视环境失败，提出中间层证据否决防护。", "summary_zh": null, "version_id": "2610.25947v1", "published": "2026-10-19T07:40:19Z", "updated": "2026-10-19T07:40:19Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25947", "tags": [ "robustness", "monitoring", "memory" ], "reason_zh": "分析自身成功记录压过失败观察的上下文效应，并用中间层信号否决错误推进。" }, "author": { "id": "2610.25947", "title": "Claim Laundering: When Agent Decision Models Trust Records Over Reality", "version_id": "2610.25947v1", "first_author": "Tina Khezresmaeilzadeh", "authors": [ "Tina Khezresmaeilzadeh", "Seyedarmin Azizi", "Erfan Baghaei Potraghloo", "Mehdi Kamal", "Massoud Pedram" ], "affiliations": [ "University of Southern California" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25947v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25947", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches in original HTML custom front matter. Tina Khezresmaeilzadeh superscript 1 maps footnote 1 University of Southern California.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25843": { "id": "2610.25843", "title": "A Cue's Hidden Price: Auditing Seller Influence on AI Shoppers", "classification": "relevant", "reason": "卖家控制的外部线索操纵购物 Agent 决策，以价格等价衡量影响。", "summary_zh": null, "version_id": "2610.25843v1", "published": "2026-10-19T05:57:24Z", "updated": "2026-10-19T05:57:24Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25843", "tags": [ "evaluation", "robustness" ], "reason_zh": "以价格等价审计衡量卖方线索对购物代理的操纵影响及模型易感差异。" }, "author": { "id": "2610.25843", "title": "A Cue's Hidden Price: Auditing Seller Influence on AI Shoppers", "version_id": "2610.25843v1", "first_author": "Felix Buecheler", "authors": [ "Felix Buecheler", "Gerardo Berbeglia", "Mingyu Guo" ], "affiliations": [ "Adelaide University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25843v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25843", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25827": { "id": "2610.25827", "title": "When Retrieval Partially Conflicts with Skills: Understanding Procedural Hallucination in Language Models", "classification": "relevant", "reason": "检索上下文部分违反技能规则导致程序性幻觉，评测并干预技能边界。", "summary_zh": null, "version_id": "2610.25827v1", "published": "2026-10-19T05:43:27Z", "updated": "2026-10-19T05:43:27Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25827", "tags": [ "memory", "robustness", "evaluation" ], "reason_zh": "用匹配基准研究检索上下文与技能程序部分冲突时的错误采纳及修复。" }, "author": { "id": "2610.25827", "title": "When Retrieval Partially Conflicts with Skills: Understanding Procedural Hallucination in Language Models", "version_id": "2610.25827v1", "first_author": "Guanqun Jiang", "authors": [ "Guanqun Jiang", "Pengfei Cao", "Kang Liu", "Jun Zhao" ], "affiliations": [ "The Key Laboratory of Cognition and Decision Intelligence for Complex Systems, Institute of Automation, Chinese Academy of Sciences", "Xi’an Jiaotong-Liverpool University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25827v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25827", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25707": { "id": "2610.25707", "title": "Whose Credential Is It? How Owner Attribution in Agent MemoryShapes Cross-User Account Misuse", "classification": "relevant", "reason": "共享 Agent 记忆中的凭证归属混淆导致跨用户账户滥用。", "summary_zh": null, "version_id": "2610.25707v1", "published": "2026-10-19T02:53:51Z", "updated": "2026-10-19T02:53:51Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25707", "tags": [ "memory", "privacy", "authorization" ], "reason_zh": "区分共享记忆中的外来凭证暴露、实际使用和受害账户变化，检验所有者绑定。" }, "author": { "id": "2610.25707", "title": "Whose Credential Is It? How Owner Attribution in Agent MemoryShapes Cross-User Account Misuse", "version_id": "2610.25707v1", "first_author": "Hau-Sing So", "authors": [ "Hau-Sing So", "Daixian Liu", "Carl Hou", "Yuhaohang He", "Mengzhu Wang", "Hai-Tao Zheng" ], "affiliations": [ "University of Macau" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25707v1", "shared_first_authors": [ "Hau-Sing So", "Daixian Liu" ], "shared_first_note": "Equal contribution explicitly stated in author footnote.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25707", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25563": { "id": "2610.25563", "title": "Learning Which Device to Call: Online Tool Grounding for LLM Agents in IoT", "classification": "relevant", "reason": "IoT Agent 端点授权约束及隐私反馈机制。", "summary_zh": null, "version_id": "2610.25563v1", "published": "2026-10-18T21:58:22Z", "updated": "2026-10-18T21:58:22Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25563", "tags": [ "authorization", "privacy", "embodied" ], "reason_zh": "为物理设备工具调用选择合格端点，兼顾访问授权、设备约束与反馈差分隐私。" }, "author": { "id": "2610.25563", "title": "Learning Which Device to Call: Online Tool Grounding for LLM Agents in IoT", "version_id": "2610.25563v1", "first_author": "Yichen Liu", "authors": [ "Yichen Liu", "Xiaochong Jiang", "Haoran Yu", "Lifei Liu" ], "affiliations": [ "Independent Researcher, Seattle, WA, USA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25563v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25563", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Joint author block has Yichen Liu superscript 1; affiliation 1 explicitly Independent Researcher, Seattle, WA, USA.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25552": { "id": "2610.25552", "title": "Symbolic Constraint Agents: Mining Formal Tool-Call Constraints to Prevent Agent Errors", "classification": "relevant", "reason": "符号约束验证 Agent 的 API 调用和执行前条件，关联工具行为约束。", "summary_zh": null, "version_id": "2610.25552v1", "published": "2026-10-18T21:49:20Z", "updated": "2026-10-18T21:49:20Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25552", "tags": [ "authorization", "robustness" ], "reason_zh": "从 API 文档和轨迹提取符号约束，在运行时检查并修复不满足前提的工具调用。" }, "author": { "id": "2610.25552", "title": "Symbolic Constraint Agents: Mining Formal Tool-Call Constraints to Prevent Agent Errors", "version_id": "2610.25552v1", "first_author": "Jinu Lee", "authors": [ "Jinu Lee", "Shraddha Barke" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25552v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25552", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25496": { "id": "2610.25496", "title": "From Proposal to Execution: Modeling Interaction Semantics in Shared Autonomy", "classification": "irrelevant", "reason": "正文研究一般人机共享自治的建议/授权交互语义与 MDP 规划，实验为网格桥梁选择，未建立 LLM Agent 场景。", "summary_zh": null, "version_id": "2610.25496v2", "published": "2026-10-18T19:34:31Z", "updated": "2026-10-20T08:48:51Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "id": "2610.25496", "tags": [ "authorization" ], "reason_zh": "形式化候选动作经另一决策实体评估后才执行的共享自治与授权交互。" }, "author": { "id": "2610.25496", "title": "From Proposal to Execution: Modeling Interaction Semantics in Shared Autonomy", "version_id": "2610.25496v2", "first_author": "Shashank Shekhar", "authors": [ "Shashank Shekhar", "Laurent Jeanpierre", "Abdel-Illah Mouaddib" ], "affiliations": [ "Université de Caen Normandie, GREYC-CNRS UMR 6072" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25496v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25496", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [ { "id": "2610.25496", "title": "From Proposal to Execution: Modeling Interaction Semantics in Shared Autonomy", "classification": "uncertain", "reason": "一般人机授权形式模型，未明确 LLM Agent。", "summary_zh": null, "version_id": "2610.25496v2", "published": "2026-10-18T19:34:31Z", "updated": "2026-10-20T08:48:51Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25496", "tags": [ "authorization" ], "reason_zh": "形式化候选动作经另一决策实体评估后才执行的共享自治与授权交互。" }, "author": { "id": "2610.25496", "title": "From Proposal to Execution: Modeling Interaction Semantics in Shared Autonomy", "version_id": "2610.25496v2", "first_author": "Shashank Shekhar", "authors": [ "Shashank Shekhar", "Laurent Jeanpierre", "Abdel-Illah Mouaddib" ], "affiliations": [ "Université de Caen Normandie, GREYC-CNRS UMR 6072" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25496v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25496", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ], "review": { "id": "2610.25496", "classification_recommendation": "irrelevant", "reason_zh": "正文研究一般人机共享自治的建议/授权交互语义与 MDP 规划，实验为网格桥梁选择，未建立 LLM Agent 场景。", "source_url": "https://arxiv.org/html/2610.25496v2", "abstract_read": true, "body_sections_checked": [ "Abstract", "Shared Autonomy instantiation", "6.3 Bridge Crossing Case Study", "7 Empirical Evaluation", "9 Discussion" ], "evidence_zh": "明确分离行动提议、评估与执行，但采用人/机器人奖励、折扣和接受模型；授权一词本身不构成 LLM Agent 安全关联。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.25496v2" } }, "2610.25179": { "id": "2610.25179", "title": "Memory, Know Your PLACE: Governing Lifecycle State and Query-Time Eligibility in Persistent-Memory Agents", "classification": "relevant", "reason": "持久记忆写入认证与读取授权隔离无资格记录对 Agent 决策的影响。", "summary_zh": null, "version_id": "2610.25179v1", "published": "2026-10-18T11:05:37Z", "updated": "2026-10-18T11:05:37Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25179", "tags": [ "memory", "authorization" ], "reason_zh": "将持久记忆的写入状态认证与查询时读取授权分离，限制无资格记忆的影响。" }, "author": { "id": "2610.25179", "title": "Memory, Know Your PLACE: Governing Lifecycle State and Query-Time Eligibility in Persistent-Memory Agents", "version_id": "2610.25179v1", "first_author": "Chen-Fang Hu", "authors": [ "Chen-Fang Hu", "Hong-Han Shuai", "Woan-Shiuan Chien" ], "affiliations": [ "Arête Honors Program, National Yang Ming Chiao Tung University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.25179v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25179", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF title matches. Chen-Fang Hu superscript 1 maps Arête Honors Program, National Yang Ming Chiao Tung University, Taiwan.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25064": { "id": "2610.25064", "title": "One Skill Takes Over: Clashing Agent Skills and a One-File Fix", "classification": "relevant", "reason": "多作者技能冲突导致 Coding Agent 整体丢弃另一技能规则，测试合并修复。", "summary_zh": null, "version_id": "2610.25064v1", "published": "2026-10-18T07:11:24Z", "updated": "2026-10-18T07:11:24Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25064", "tags": [ "memory", "robustness", "supplychain" ], "reason_zh": "研究多作者技能同时进入上下文后的规则接管问题，并检验合并技能文件的修复。" }, "author": { "id": "2610.25064", "title": "One Skill Takes Over: Clashing Agent Skills and a One-File Fix", "version_id": "2610.25064v1", "first_author": "Parsa Razmara", "authors": [ "Parsa Razmara", "Seyedarmin Azizi", "Ardalan Aryashad" ], "affiliations": [ "University of Southern California" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25064v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25064", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24969": { "id": "2610.24969", "title": "Towards Human-AI Complementarity for AI Safety", "classification": "relevant", "reason": "初读摘要未见Agent而排除，但结合旧已核证据复查v2正文Table1，明确含SafeAgent不安全行动与SHADE-Arena欺骗对齐任务，研究人类/AI监督Agent风险，维持相关。", "abstract_read": true, "initial_classification": "irrelevant", "scope_review": { "id": "2610.24969", "classification": "relevant", "reason": "初读摘要未见Agent而排除，但结合旧已核证据复查v2正文Table1，明确含SafeAgent不安全行动与SHADE-Arena欺骗对齐任务，研究人类/AI监督Agent风险，维持相关。", "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "完整摘要", "Table1及数据集说明", "§3.4 SafeAgent监督错误" ], "source_url": "https://arxiv.org/pdf/2610.24969v2", "summary_zh": "问题：人类监督长而复杂的 Agent 输出时，AI 辅助是否真正帮助发现模型错误？ 方法：在 8 个数据集、6 个领域共 3,957 条匹配题目上比较人类、AI 和混合判断，包含 SafeAgent 不安全计划和 SHADE-Arena 欺骗任务。 作者声称结果：作者收集 416 名评分者的 35,613 次判断；所测辅助方法虽可提高总体人类准确率，却减少了对 AI 错误的纠正，所测混合方法平均较强单源判断增益有限。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "正文包含 Agent 不安全行动与 Agent 欺骗任务，实测人类监督与 AI 辅助如何影响错误纠正，属于 Agent 安全监督评测。" }, "initial_exclusion_overturned": true }, "summary_zh": "问题：人类监督长而复杂的 Agent 输出时，AI 辅助是否真正帮助发现模型错误？ 方法：在 8 个数据集、6 个领域共 3,957 条匹配题目上比较人类、AI 和混合判断，包含 SafeAgent 不安全计划和 SHADE-Arena 欺骗任务。 作者声称结果：作者收集 416 名评分者的 35,613 次判断；所测辅助方法虽可提高总体人类准确率，却减少了对 AI 错误的纠正，所测混合方法平均较强单源判断增益有限。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "正文包含 Agent 不安全行动与 Agent 欺骗任务，实测人类监督与 AI 辅助如何影响错误纠正，属于 Agent 安全监督评测。" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "Table1及数据集说明", "§3.4 SafeAgent监督错误" ], "body_source_url": "https://arxiv.org/pdf/2610.24969v2", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.24969v2", "published": "2026-10-18T02:49:28Z", "updated": "2026-10-27T06:46:31Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "candidate_type": "changed_version", "provenance": [], "source_url": "https://arxiv.org/abs/2610.24969v2", "abstract_sha256": "d01ca90158da475fe6eac315260713ec217afd31997242106d0d30a128b4387c", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "当前版本公告未确认；显示日期保留此前已核公告，不等同当前版本公告日", "first_discovered_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26", "2026-10-28" ], "version_history": [ { "id": "2610.24969", "version_id": "2610.24969v1", "classification": "relevant", "announcement_date": "Tue, 20 Oct 2026", "published": "2026-10-18T02:49:28Z", "updated": "2026-10-18T02:49:28Z", "reason": "正文包含 Agent 不安全行动与 Agent 欺骗任务，实测人类监督与 AI 辅助如何影响错误纠正，属于 Agent 安全监督评测。", "reviewed_date": "2026-10-26", "abstract_read": true, "full_text_checked": true } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.24969", "title": "Towards Human-AI Complementarity for AI Safety", "version_id": "2610.24969v2", "first_author": "Sander Lanbo Shi", "authors": [ "Sander Lanbo Shi", "Miranda Anna Christ", "Eric Modesitt", "Andrew Louis", "Konrad Cheng", "Brandon Thai Tran", "Sewoong Lee", "Ratnakar Pawar", "Gaia Molinaro", "Juliana Bain", "Nandika Donthi", "Maja Pavlovic", "Annya Dahmani", "Francesca Bianco", "Abhishek Shah", "Tyler Crosse", "Arth Singh", "Karissa Huang", "Sukanya Krishna", "Konstantinos Voudouris", "David Demitri Africa", "Joshua Jacob", "Rishub Jain" ], "affiliations": [ "Sampura Research" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24969v2", "shared_first_authors": [ "Sander Lanbo Shi", "Miranda Anna Christ" ], "shared_first_note": "PDF首页†脚注明确两位为first authors；Sander Lanbo Shi属Sampura Research，Miranda Anna Christ属University of California, Berkeley。", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24969", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF首页1/2单位标号和† first authors贡献脚注，逐人对应。", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Sander Lanbo Shi": [ "Sampura Research" ], "Miranda Anna Christ": [ "University of California, Berkeley" ] } }, "review": { "id": "2610.24969", "classification_recommendation": "relevant", "reason_zh": "正文包含 Agent 不安全行动与 Agent 欺骗任务，实测人类监督与 AI 辅助如何影响错误纠正，属于 Agent 安全监督评测。", "source_url": "https://arxiv.org/html/2610.24969v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "3 Datasets and Platform", "Table 1", "4 Assistance and Hybridisation Methods", "5.2 Assistance", "5.3 Hybridisation" ], "evidence_zh": "数据集含 640 个 SafeAgent 不安全行动条目和 106 个 SHADE-Arena Agent 欺骗条目；辅助条件降低部分模型错误上的人类纠正率，综合准确率提升不代表监督更安全。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.24969v1", "problem_zh": "人类监督长而复杂的 Agent 输出时，AI 辅助是否真正帮助发现模型错误？", "method_zh": "在 8 个数据集、6 个领域共 3,957 条匹配题目上比较人类、AI 和混合判断，包含 SafeAgent 不安全计划和 SHADE-Arena 欺骗任务。", "claimed_results_zh": "作者收集 416 名评分者的 35,613 次判断；所测辅助方法虽可提高总体人类准确率，却减少了对 AI 错误的纠正，所测混合方法平均较强单源判断增益有限。", "topics": [ "monitoring", "evaluation" ] }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.24969", "title": "Towards Human-AI Complementarity for AI Safety", "classification": "uncertain", "reason": "人机互补的安全监督可能关联 Agent，但任务与威胁范围需正文。", "summary_zh": null, "version_id": "2610.24969v1", "published": "2026-10-18T02:49:28Z", "updated": "2026-10-18T02:49:28Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24969", "tags": [ "monitoring", "evaluation" ], "reason_zh": "以匹配安全任务比较人、模型及人机组合的监督判断，评估互补是否真正实现。" }, "author": { "id": "2610.24969", "title": "Towards Human-AI Complementarity for AI Safety", "version_id": "2610.24969v1", "first_author": "Sander Lanbo Shi", "authors": [ "Sander Lanbo Shi", "Miranda Anna Christ", "Eric Modesitt", "Andrew Louis", "Konrad Cheng", "Brandon Thai Tran", "Sewoong Lee", "Ratnakar Pawar", "Gaia Molinaro", "Juliana Bain", "Nandika Donthi", "Maja Pavlovic", "Annya Dahmani", "Francesca Bianco", "Abhishek Shah", "Tyler Crosse", "Arth Singh", "Karissa Huang", "Sukanya Krishna", "Konstantinos Voudouris", "David Demitri Africa", "Joshua Jacob", "Rishub Jain" ], "affiliations": [ "Sampura Research" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24969v1", "shared_first_authors": [ "Sander Lanbo Shi", "Miranda Anna Christ" ], "shared_first_note": "PDF explicitly labels † first authors: Sander Lanbo Shi and Miranda Anna Christ.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24969", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF title matches. Sander Lanbo Shi has 1,†; 1 maps Sampura Research; † explicitly denotes first authors (also Miranda Anna Christ).", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" }, { "id": "2610.24969", "title": "Towards Human-AI Complementarity for AI Safety", "classification": "relevant", "reason": "正文包含 Agent 不安全行动与 Agent 欺骗任务，实测人类监督与 AI 辅助如何影响错误纠正，属于 Agent 安全监督评测。", "summary_zh": "问题：人类监督长而复杂的 Agent 输出时，AI 辅助是否真正帮助发现模型错误？ 方法：在 8 个数据集、6 个领域共 3,957 条匹配题目上比较人类、AI 和混合判断，包含 SafeAgent 不安全计划和 SHADE-Arena 欺骗任务。 作者声称结果：作者收集 416 名评分者的 35,613 次判断；所测辅助方法虽可提高总体人类准确率，却减少了对 AI 错误的纠正，所测混合方法平均较强单源判断增益有限。", "version_id": "2610.24969v1", "published": "2026-10-18T02:49:28Z", "updated": "2026-10-18T02:49:28Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "正文包含 Agent 不安全行动与 Agent 欺骗任务，实测人类监督与 AI 辅助如何影响错误纠正，属于 Agent 安全监督评测。" }, "author": { "id": "2610.24969", "title": "Towards Human-AI Complementarity for AI Safety", "version_id": "2610.24969v1", "first_author": "Sander Lanbo Shi", "authors": [ "Sander Lanbo Shi", "Miranda Anna Christ", "Eric Modesitt", "Andrew Louis", "Konrad Cheng", "Brandon Thai Tran", "Sewoong Lee", "Ratnakar Pawar", "Gaia Molinaro", "Juliana Bain", "Nandika Donthi", "Maja Pavlovic", "Annya Dahmani", "Francesca Bianco", "Abhishek Shah", "Tyler Crosse", "Arth Singh", "Karissa Huang", "Sukanya Krishna", "Konstantinos Voudouris", "David Demitri Africa", "Joshua Jacob", "Rishub Jain" ], "affiliations": [ "Sampura Research" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24969v1", "shared_first_authors": [ "Sander Lanbo Shi", "Miranda Anna Christ" ], "shared_first_note": "PDF explicitly labels † first authors: Sander Lanbo Shi and Miranda Anna Christ.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24969", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF title matches. Sander Lanbo Shi has 1,†; 1 maps Sampura Research; † explicitly denotes first authors (also Miranda Anna Christ).", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "review": { "id": "2610.24969", "classification_recommendation": "relevant", "reason_zh": "正文包含 Agent 不安全行动与 Agent 欺骗任务，实测人类监督与 AI 辅助如何影响错误纠正，属于 Agent 安全监督评测。", "source_url": "https://arxiv.org/html/2610.24969v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "3 Datasets and Platform", "Table 1", "4 Assistance and Hybridisation Methods", "5.2 Assistance", "5.3 Hybridisation" ], "evidence_zh": "数据集含 640 个 SafeAgent 不安全行动条目和 106 个 SHADE-Arena Agent 欺骗条目；辅助条件降低部分模型错误上的人类纠正率，综合准确率提升不代表监督更安全。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.24969v1", "problem_zh": "人类监督长而复杂的 Agent 输出时，AI 辅助是否真正帮助发现模型错误？", "method_zh": "在 8 个数据集、6 个领域共 3,957 条匹配题目上比较人类、AI 和混合判断，包含 SafeAgent 不安全计划和 SHADE-Arena 欺骗任务。", "claimed_results_zh": "作者收集 416 名评分者的 35,613 次判断；所测辅助方法虽可提高总体人类准确率，却减少了对 AI 错误的纠正，所测混合方法平均较强单源判断增益有限。", "topics": [ "monitoring", "evaluation" ] } } ] }, "2610.24824": { "id": "2610.24824", "title": "Teaching Code Agents to Ask Without Leaking Private Code", "classification": "relevant", "reason": "训练本地 Coding Agent 咨询云模型时抽象私有代码，降低标识符和源码外泄。", "summary_zh": null, "version_id": "2610.24824v1", "published": "2026-10-17T19:13:56Z", "updated": "2026-10-17T19:13:56Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24824", "tags": [ "privacy" ], "reason_zh": "训练本地编码代理用角色与类型抽象私有实体，减少咨询云模型时泄露标识符和源码。" }, "author": { "id": "2610.24824", "title": "Teaching Code Agents to Ask Without Leaking Private Code", "version_id": "2610.24824v1", "first_author": "Wenjia Jiang", "authors": [ "Wenjia Jiang", "Jieke Shi", "Zhensu Sun", "Chengran Yang", "Shidong Pan", "Peixin Zhang", "Yifan Jia", "James Hoang", "Xiwei Xu", "Zhenchang Xing", "David Lo", "Zhou Yang" ], "affiliations": [ "Singapore Management University", "University of Alberta", "Alberta Machine Intelligence Institute (Amii)" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24824v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24824", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF title matches. Wenjia Jiang superscripts 1,2,3 map Singapore Management University, University of Alberta and Alberta Machine Intelligence Institute (Amii).", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24382": { "id": "2610.24382", "title": "Is This Your Agent? Identity Watermarking for Agent Systems in Dynamic Environments", "classification": "relevant", "reason": "动态 Agent 身份水印及攻击下恢复，面向身份鉴别。", "summary_zh": null, "version_id": "2610.24382v1", "published": "2026-10-17T02:27:55Z", "updated": "2026-10-17T02:27:55Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24382", "tags": [ "monitoring", "robustness" ], "reason_zh": "通过行为保持水印鉴别动态代理身份，并研究环境变化和攻击下的水印恢复。" }, "author": { "id": "2610.24382", "title": "Is This Your Agent? Identity Watermarking for Agent Systems in Dynamic Environments", "version_id": "2610.24382v1", "first_author": "Yuwei Zhong", "authors": [ "Yuwei Zhong", "Yu Cheng", "Jiuan Zhou", "Weizhi Liu", "Yi Xie", "Yongkang Hu", "Yuan Xie", "Zhaoxia Yin" ], "affiliations": [ "East China Normal University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24382v1", "shared_first_authors": [ "Yuwei Zhong", "Yu Cheng" ], "shared_first_note": "Equal contribution explicitly stated in author footnote.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24382", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24380": { "id": "2610.24380", "title": "Train Locally, Learn Together: Distributed Multi-Agent Training via ADMM", "classification": "relevant", "reason": "在被攻陷代理场景下用分布式多代理训练降低有害行为成功率。", "summary_zh": null, "version_id": "2610.24380v1", "published": "2026-10-17T02:26:46Z", "updated": "2026-10-17T02:26:46Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24380", "tags": [ "multiagent", "evaluation" ], "reason_zh": "研究分布式多代理联合训练及安全对齐，检验被攻陷成员条件下的有害行为抑制。" }, "author": { "id": "2610.24380", "title": "Train Locally, Learn Together: Distributed Multi-Agent Training via ADMM", "version_id": "2610.24380v1", "first_author": "Yiwei Chen", "authors": [ "Yiwei Chen", "Changsheng Wang", "Yicheng Lang", "Qing Qu", "Alfred O. Hero", "Sijia Liu" ], "affiliations": [ "Michigan State University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24380v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24380", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. First author explicitly followed by the listed affiliation in HTML front matter.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24298": { "id": "2610.24298", "title": "Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs", "classification": "relevant", "reason": "区分多代理消息来源、签名授权和工具执行边界，揭示有效授权证明不保证事实为真。", "summary_zh": null, "version_id": "2610.24298v1", "published": "2026-10-16T22:49:41Z", "updated": "2026-10-16T22:49:41Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24298", "tags": [ "multiagent", "authorization" ], "reason_zh": "分离多代理通信、签名授权与工具执行边界，分析有效授权证明与事实真伪的差别。" }, "author": { "id": "2610.24298", "title": "Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs", "version_id": "2610.24298v1", "first_author": "Junru Zhu", "authors": [ "Junru Zhu", "Xin Chen", "Hang Lyu", "Jiayue Meng", "Muzi Li", "Yifan Chen", "Hengyi Huang", "Yu Sun", "Weiwei Qi" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.24298v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24298", "author_status": "verified", "affiliation_status": "unresolved", "evidence": "PDF title and author match. First two pages contain names but no author affiliation; remains unverified, not an HTML-only omission.", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24264": { "id": "2610.24264", "title": "AM-Bench: A Unified Taxonomy and Evaluation Suite for Agentic Misalignment", "classification": "relevant", "reason": "直接评估Agent在目标压力下选择危害而非失败的失对齐行为和检测边界。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：只测试服从恶意指令无法刻画Agent为避免失败而自行采取有害动作。方法：AM-Bench借用欺诈三角，建立威胁、机会、推理三维分类，在七行业35场景评估十个前沿模型。作者称场景间失对齐差距达62个百分点，不同模型差异明显，且有害行为可能无显式情境意识或解释，增加检测难度。摘要结果不保证所有真实任务中的模型安全排序。", "topics": { "tags": [ "evaluation", "monitoring", "authorization" ], "reason_zh": "Agent在目标压力下主动选择有害行为的失对齐及检测困难。" }, "version_id": "2610.24264v3", "published": "2026-10-16T21:46:19Z", "updated": "2026-10-23T13:55:58Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2610.24264", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" }, { "announcement_date": "2026-10-20", "category": "cs.AI", "kind": "recent", "section": null } ], "candidate_type": "changed_version", "abstract_sha256": "5ea7b916d4c5e6a1913509ed921aba6d416216942a7c7ecadaef49d0fb7313f5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "seen_dates": [ "2026-10-25", "2026-10-27" ], "version_history": [ { "id": "2610.24264", "version_id": "2610.24264v2", "classification": "relevant", "announcement_date": "Tue, 20 Oct 2026", "published": "2026-10-16T21:46:19Z", "updated": "2026-10-20T15:40:19Z", "reason": "Agent 面对失败压力选择有害行动的失配基准，覆盖七行业35场景。" } ], "announcement_status": "官方公告列表已核对", "backfill_kind": "known_id_revision", "author": { "id": "2610.24264", "title": "AM-Bench: A Unified Taxonomy and Evaluation Suite for Agentic Misalignment", "version_id": "2610.24264v2", "first_author": "Eric Zhang", "authors": [ "Eric Zhang", "Terry Jingchen Zhang", "Chijioke Ugwuanyi", "Jerick Shi", "Bernhard Schölkopf", "Zhijing Jin" ], "affiliations": [ "Jinesis Lab, University of Toronto & Vector Institute" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24264v2", "shared_first_authors": [], "shared_first_note": "v3 HTML未清楚显示首作者单位，保留历史已核实单位及原来源，不用未知覆盖已知。", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24264", "author_status": "verified", "affiliation_status": "verified", "evidence": "v3 HTML未清楚显示首作者单位，保留历史已核实单位及原来源，不用未知覆盖已知。", "verification_status": "affiliation_verified", "shared_first_affiliations": {} }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.24264", "title": "AM-Bench: A Unified Taxonomy and Evaluation Suite for Agentic Misalignment", "classification": "relevant", "reason": "Agent 面对失败压力选择有害行动的失配基准，覆盖七行业35场景。", "summary_zh": null, "version_id": "2610.24264v2", "published": "2026-10-16T21:46:19Z", "updated": "2026-10-20T15:40:19Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24264", "tags": [ "evaluation" ], "reason_zh": "构建代理在目标压力下选择有害行动的失配分类与跨行业场景基准。" }, "author": { "id": "2610.24264", "title": "AM-Bench: A Unified Taxonomy and Evaluation Suite for Agentic Misalignment", "version_id": "2610.24264v2", "first_author": "Eric Zhang", "authors": [ "Eric Zhang", "Terry Jingchen Zhang", "Chijioke Ugwuanyi", "Jerick Shi", "Bernhard Schölkopf", "Zhijing Jin" ], "affiliations": [ "Jinesis Lab, University of Toronto & Vector Institute" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24264v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24264", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF v2 title and first author match. Eric Zhang has superscript 1; institution 1 is Jinesis Lab, University of Toronto & Vector Institute.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.24255": { "id": "2610.24255", "title": "Cortex: A Fixed-Point Theory of Governed Coding Agents - Technical Report", "classification": "relevant", "reason": "Coding Agent 执行前治理、要求追踪和攻击成功率评估；摘要明确证据限制。", "summary_zh": null, "version_id": "2610.24255v1", "published": "2026-10-16T21:28:03Z", "updated": "2026-10-16T21:28:03Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24255", "tags": [ "authorization", "evaluation" ], "reason_zh": "提出编码代理执行前治理与要求闭包模型，同时界定攻击成功和验证评分的证据限制。" }, "author": { "id": "2610.24255", "title": "Cortex: A Fixed-Point Theory of Governed Coding Agents - Technical Report", "version_id": "2610.24255v1", "first_author": "Marius-Constantin Dinu", "authors": [ "Marius-Constantin Dinu", "Florian Zeba" ], "affiliations": [ "Alpha Omega Labs" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24255v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24255", "author_status": "verified", "affiliation_status": "verified", "evidence": "Paper title is Cortex: A Fixed-Point Theory of Governed Coding Agents (API adds Technical Report); joint author block Marius-Constantin Dinu & Florian Zeba explicitly lists Alpha Omega Labs.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24194": { "id": "2610.24194", "title": "Agents' Last Doubt: Knowing When to Act and When to Step Back in Tool-Using Agents", "classification": "relevant", "reason": "根据不可逆错误风险选择自主执行、追加信息或升级人类。", "summary_zh": null, "version_id": "2610.24194v1", "published": "2026-10-16T20:11:31Z", "updated": "2026-10-16T20:11:31Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24194", "tags": [ "authorization", "robustness" ], "reason_zh": "学习在自主执行、补充信息和升级人工之间选择，以控制不可逆错误风险。" }, "author": { "id": "2610.24194", "title": "Agents' Last Doubt: Knowing When to Act and When to Step Back in Tool-Using Agents", "version_id": "2610.24194v1", "first_author": "Qisai Liu", "authors": [ "Qisai Liu", "Qingyue Jiao", "Bangwei Guo", "Wenxi Dai", "Changyi Yang", "Jiahe Liu", "Dimitris N. Metaxas", "Yiyu Shi", "Zhanhong Jiang", "Minghao Guo" ], "affiliations": [ "Iowa State University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24194v1", "shared_first_authors": [], "shared_first_note": "Qisai Liu and Qingyue Jiao carry * defined as Core contribution; not stated as equal contribution in HTML.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24194", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF title matches. Qisai Liu has superscript *1; affiliation 1 is Iowa State University. Star is Core contribution, not explicitly equal contribution.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25760": { "id": "2610.25760", "title": "Computation, Not Memory: Chain-of-Thought and State Tracking in LLM Agents", "classification": "relevant", "reason": "文件锁约束任务中测试 Agent 推理、状态与违规动作因果关系，错误推理可覆盖正确历史。", "summary_zh": null, "version_id": "2610.25760v1", "published": "2026-10-19T04:18:24Z", "updated": "2026-10-19T04:18:24Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25760", "tags": [ "monitoring", "memory" ], "reason_zh": "通过文件锁状态任务检验即时推理、历史保留与违规动作的因果联系及可监测性。" }, "author": { "id": "2610.25760", "title": "Computation, Not Memory: Chain-of-Thought and State Tracking in LLM Agents", "version_id": "2610.25760v1", "first_author": "Pedram Mouseli", "authors": [ "Pedram Mouseli", "Massieh Moayedi" ], "affiliations": [ "University of Toronto" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.25760v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25760", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Both authors share explicit university line.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25629": { "id": "2610.25629", "title": "Selecting and Composing Agent Design Patterns: Industrial Case Evidence and Controlled Reference-System Experiments", "classification": "relevant", "reason": "Agent 组合契约与执行控制的故障注入评测，明确安全拒绝与错误成功边界。", "summary_zh": null, "version_id": "2610.25629v1", "published": "2026-10-19T01:10:44Z", "updated": "2026-10-19T01:10:44Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25629", "tags": [ "robustness", "authorization" ], "reason_zh": "用故障注入研究代理组合契约、执行控制和消费侧验证如何限制错误成功。" }, "author": { "id": "2610.25629", "title": "Selecting and Composing Agent Design Patterns: Industrial Case Evidence and Controlled Reference-System Experiments", "version_id": "2610.25629v1", "first_author": "Jia Huang", "authors": [ "Jia Huang", "Bingsheng Ru", "Bo Liang", "Yuke Xiong", "Haiyan Fan", "Joey Tianyi Zhou" ], "affiliations": [ "Agency for Science, Technology and Research (A*STAR), Singapore" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25629v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25629", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation directly attached to Jia Huang.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25241": { "id": "2610.25241", "title": "Assessing the Empirical Evidence for Loss of Control from Agentic General-Purpose AI", "classification": "relevant", "reason": "系统审查 Agent 失控风险实证证据的构念、内容、外部效度，区分证据与概率。", "summary_zh": null, "version_id": "2610.25241v1", "published": "2026-10-18T13:03:10Z", "updated": "2026-10-18T13:03:10Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25241", "tags": [ "evaluation" ], "reason_zh": "系统审查代理失控风险研究的构念、内容和外部效度，区分证据强弱与风险概率。" }, "author": { "id": "2610.25241", "title": "Assessing the Empirical Evidence for Loss of Control from Agentic General-Purpose AI", "version_id": "2610.25241v1", "first_author": "Risto Uuk", "authors": [ "Risto Uuk", "Santeri Koivula", "Lorenzo Pacchiardi", "Rokas Gipiškis", "Laura Caroli", "Kamaria Horton" ], "affiliations": [ "Future of Life Institute", "KU Leuven", "London School of Economics and Political Science" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25241v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25241", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. All three affiliations directly attached to Risto Uuk.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25114": { "id": "2610.25114", "title": "Compile Once, Run Cheap: Frozen, Portable Skills for Embodied Agents, and What Recursive Self-Improvement Adds", "classification": "relevant", "reason": "具身技能自改采用隔离作者、可审计账本、安全终止与冻结验收门。", "summary_zh": null, "version_id": "2610.25114v1", "published": "2026-10-18T08:46:13Z", "updated": "2026-10-18T08:46:13Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.25114", "tags": [ "embodied", "evaluation", "authorization" ], "reason_zh": "在隔离审计的技能开发流程中，用冻结后的隐藏布局和零安全终止门槛验收具身技能。" }, "author": { "id": "2610.25114", "title": "Compile Once, Run Cheap: Frozen, Portable Skills for Embodied Agents, and What Recursive Self-Improvement Adds", "version_id": "2610.25114v1", "first_author": "Jingwen Bai", "authors": [ "Jingwen Bai", "Guochao Bai", "Canbo Zhang", "Shuangqi Li", "Minchao Hu", "Weichun Huang", "Shuang Liu" ], "affiliations": [ "Beijing Ou Rui Ling Shi Technology Co., Ltd." ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25114v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25114", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Jingwen Bai superscript 1 maps to institution 1.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24929": { "id": "2610.24929", "title": "What Can't Jev Decide? Probing the Limits of One-Pass Decision Models", "classification": "irrelevant", "reason": "正文评测单次决策模型的检索、状态更新、陈旧摘要与转交可靠性，未建立具体攻击或安全结果，完整 Agent 系统评测明确留待后续。", "summary_zh": null, "version_id": "2610.24929v1", "published": "2026-10-18T00:50:57Z", "updated": "2026-10-18T00:50:57Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "id": "2610.24929", "tags": [ "memory", "robustness" ], "reason_zh": "研究单次前向决策模型对多步状态更新和陈旧摘要的依赖，以及未能识别输入错误的局限。" }, "author": { "id": "2610.24929", "title": "What Can't Jev Decide? Probing the Limits of One-Pass Decision Models", "version_id": "2610.24929v1", "first_author": "Wang Yang", "authors": [ "Wang Yang", "Xinpeng Li", "Yanyan Zhang", "Chuang Ma", "Shouren Wang", "Jianzhe Wei", "Liqin Ye", "Xiaoran Cai", "Mohsen Hariri", "Vipin Chaudhary", "Xiaotian Han" ], "affiliations": [ "Case Western Reserve University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24929v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24929", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Wang Yang.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [ { "id": "2610.24929", "title": "What Can't Jev Decide? Probing the Limits of One-Pass Decision Models", "classification": "uncertain", "reason": "陈旧摘要与决策错误的一般可靠性研究。", "summary_zh": null, "version_id": "2610.24929v1", "published": "2026-10-18T00:50:57Z", "updated": "2026-10-18T00:50:57Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24929", "tags": [ "memory", "robustness" ], "reason_zh": "研究单次前向决策模型对多步状态更新和陈旧摘要的依赖，以及未能识别输入错误的局限。" }, "author": { "id": "2610.24929", "title": "What Can't Jev Decide? Probing the Limits of One-Pass Decision Models", "version_id": "2610.24929v1", "first_author": "Wang Yang", "authors": [ "Wang Yang", "Xinpeng Li", "Yanyan Zhang", "Chuang Ma", "Shouren Wang", "Jianzhe Wei", "Liqin Ye", "Xiaoran Cai", "Mohsen Hariri", "Vipin Chaudhary", "Xiaotian Han" ], "affiliations": [ "Case Western Reserve University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24929v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24929", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Wang Yang.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ], "review": { "id": "2610.24929", "classification_recommendation": "irrelevant", "reason_zh": "正文评测单次决策模型的检索、状态更新、陈旧摘要与转交可靠性，未建立具体攻击或安全结果，完整 Agent 系统评测明确留待后续。", "source_url": "https://arxiv.org/html/2610.24929v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "1 Introduction", "3.1 A benchmark that varies one factor at a time", "3.5 A state summary is used, trusted, and not checked", "Conclusion and limitations" ], "evidence_zh": "用户加入/退出项目的合成状态日志用于测试推理与记录干扰；每题独立问答评分，不能把这些结果直接说成真实 Agent 越权或攻击评测。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.24929v1" } }, "2610.24823": { "id": "2610.24823", "title": "Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents", "classification": "relevant", "reason": "针对 LLM Agent 的恶意指令与环境攻击，联合零阶探索、一阶细化并做随机解码评估。", "summary_zh": null, "version_id": "2610.24823v1", "published": "2026-10-17T19:13:37Z", "updated": "2026-10-17T19:13:37Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24823", "tags": [ "injection" ], "reason_zh": "联合零阶探索与一阶优化构造诱导代理恶意行为的指令及环境攻击。" }, "author": { "id": "2610.24823", "title": "Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents", "version_id": "2610.24823v1", "first_author": "Juanyang Xu", "authors": [ "Juanyang Xu", "Zheng Wang", "Xingyu Zhao", "Siddartha Khastgir", "Andi Zhang" ], "affiliations": [ "University of Macau" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24823v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24823", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Juanyang Xu; not inferred from email.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24613": { "id": "2610.24613", "title": "How Much Do Activation Monitors Benefit from Original Model Computations?", "classification": "relevant", "reason": "正文明确以 PR 审核工具 Agent 的提示注入作为监测任务，比较原始执行激活与重构文本轨迹，属于 Coding Agent 注入监测评测。", "summary_zh": "问题：激活监测器的优势是否真的来自原始模型执行计算，而非轨迹文本本身？ 方法：在固定目标模型与监测架构下改变轨迹措辞/格式，对比原始执行与重构轨迹上的 aLoRA 监测；含工具返回 PR 说明中的提示注入反事实任务。 作者声称结果：摘要报告最多 44 个模型、22 个反事实监测任务；许多性能无需原始执行即可恢复，但原始轨迹监测仍有温和优势，较最强控制最高约 0.014 AUROC。该数值为整体实验陈述，不能单独归给 PR 任务。", "version_id": "2610.24613v1", "published": "2026-10-17T10:37:23Z", "updated": "2026-10-17T10:37:23Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "tags": [ "injection", "supplychain", "monitoring", "evaluation" ], "reason_zh": "正文明确以 PR 审核工具 Agent 的提示注入作为监测任务，比较原始执行激活与重构文本轨迹，属于 Coding Agent 注入监测评测。" }, "author": { "id": "2610.24613", "title": "How Much Do Activation Monitors Benefit from Original Model Computations?", "version_id": "2610.24613v1", "first_author": "James Oldfield", "authors": [ "James Oldfield", "Shawn Im", "Jay J Culligan", "Philip Torr", "Sharon Li", "Adel Bibi" ], "affiliations": [ "University of Oxford" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24613v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24613", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. James Oldfield superscript 1 maps to University of Oxford.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [ { "id": "2610.24613", "title": "How Much Do Activation Monitors Benefit from Original Model Computations?", "classification": "uncertain", "reason": "内部激活监测可能关联 Agent 欺骗，需确认实际任务范围。", "summary_zh": null, "version_id": "2610.24613v1", "published": "2026-10-17T10:37:23Z", "updated": "2026-10-17T10:37:23Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24613", "tags": [ "monitoring", "evaluation" ], "reason_zh": "通过反事实轨迹检验激活监控的效果有多少真正来自原始行为生成计算。" }, "author": { "id": "2610.24613", "title": "How Much Do Activation Monitors Benefit from Original Model Computations?", "version_id": "2610.24613v1", "first_author": "James Oldfield", "authors": [ "James Oldfield", "Shawn Im", "Jay J Culligan", "Philip Torr", "Sharon Li", "Adel Bibi" ], "affiliations": [ "University of Oxford" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24613v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24613", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. James Oldfield superscript 1 maps to University of Oxford.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ], "review": { "id": "2610.24613", "classification_recommendation": "relevant", "reason_zh": "正文明确以 PR 审核工具 Agent 的提示注入作为监测任务，比较原始执行激活与重构文本轨迹，属于 Coding Agent 注入监测评测。", "source_url": "https://arxiv.org/html/2610.24613v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "2.3 Controls to isolate benefits of original trace access", "3.1 Datasets & models: Agent safety", "3.3 Does original trace access improve behavioral monitoring?", "Appendix B.2 Dataset 2: Agentic PR requests" ], "evidence_zh": "工具返回 Python 代码/diff 及贡献者说明，干预加入要求接受 PR 的说明；监测器判断移除注入是否会改变接受决定。任务是小规模二元反事实行为监测，并不验证 PR 代码本身是否恶意。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.24613v1", "problem_zh": "激活监测器的优势是否真的来自原始模型执行计算，而非轨迹文本本身？", "method_zh": "在固定目标模型与监测架构下改变轨迹措辞/格式，对比原始执行与重构轨迹上的 aLoRA 监测；含工具返回 PR 说明中的提示注入反事实任务。", "claimed_results_zh": "摘要报告最多 44 个模型、22 个反事实监测任务；许多性能无需原始执行即可恢复，但原始轨迹监测仍有温和优势，较最强控制最高约 0.014 AUROC。该数值为整体实验陈述，不能单独归给 PR 任务。", "topics": [ "injection", "supplychain", "monitoring", "evaluation" ] } }, "2610.24483": { "id": "2610.24483", "title": "Write Once, Check Many: Reusable Ledgers for Post-Hoc Policy Compliance Auditing of Agent Trajectories", "classification": "relevant", "reason": "压缩 Agent 轨迹为可复用账本，用于未知政策的事后合规审计。", "summary_zh": null, "version_id": "2610.24483v1", "published": "2026-10-17T06:04:04Z", "updated": "2026-10-17T06:04:04Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract", "topics": { "id": "2610.24483", "tags": [ "monitoring" ], "reason_zh": "将代理轨迹写成可复用账本，用于后续未知政策的事后合规审计。" }, "author": { "id": "2610.24483", "title": "Write Once, Check Many: Reusable Ledgers for Post-Hoc Policy Compliance Auditing of Agent Trajectories", "version_id": "2610.24483v1", "first_author": "Ashwin Nagarajan", "authors": [ "Ashwin Nagarajan", "Gursimran Panesar", "Alicia Yang", "Mona T. Diab", "Virginia Smith", "Aashiq Muhamed" ], "affiliations": [ "Carnegie Mellon University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24483v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24483", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. All six authors share one university line beneath names.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24231": { "id": "2610.24231", "title": "LoopHIL: Looping Hardware into LLM-assisted Agents for Wireless Embedded Systems", "classification": "relevant", "reason": "真实硬件 Agent 的代码强制工具限制与动作安全边界。", "summary_zh": null, "version_id": "2610.24231v1", "published": "2026-10-16T20:54:54Z", "updated": "2026-10-16T20:54:54Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.24231", "tags": [ "embodied", "authorization" ], "reason_zh": "让代理控制真实射频硬件测试台，同时以代码安全限制和独立硬件验证约束操作。" }, "author": { "id": "2610.24231", "title": "LoopHIL: Looping Hardware into LLM-assisted Agents for Wireless Embedded Systems", "version_id": "2610.24231v1", "first_author": "Dhairya Shah", "authors": [ "Dhairya Shah", "Spanddhana Sara", "Savitha Viswanadh Kandala", "Ambuj Varshney" ], "affiliations": [ "National University of Singapore, Singapore" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24231v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24231", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. All four named authors including Dhairya Shah in one author block share explicit affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24206": { "id": "2610.24206", "title": "SWE-Bench Pro V2: A Cleaner, Harder-to-Game Coding Benchmark", "classification": "relevant", "reason": "编码Agent评测防作弊，限制网络及干净容器重评分", "summary_zh": "SWE-Bench Pro V2修订731任务中的480项，23工程师投入404小时；限制网络到模型端点并以干净容器重新评分，防Agent取上游答案及靠patch外修改获分。642任务最高解决率99.4%，Hard51任务区分52.9%至98.0%；是评估完整性而非直接生产防御。", "version_id": "2610.24206v1", "published": "2026-10-16T20:26:37Z", "updated": "2026-10-16T20:26:37Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.24206", "tags": [ "evaluation", "authorization" ], "reason_zh": "修订编码基准并限制网络、在干净容器重评分，防止获取现成修复和环境作弊。" }, "author": { "id": "2610.24206", "title": "SWE-Bench Pro V2: A Cleaner, Harder-to-Game Coding Benchmark", "version_id": "2610.24206v1", "first_author": "Soham Dan", "authors": [ "Soham Dan", "Jeff Da", "Sanyam Bhutani", "Miguel Romero Calvo", "Ivan Guevara", "Fernando Carabedo", "Jose Bernal", "Julio Reyna", "Luis Leandro Monsalve Mendez", "Ying Liu", "Daniel Yue Zhang" ], "affiliations": [ "Scale AI" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24206v1", "shared_first_authors": [], "shared_first_note": "Soham Dan and Jeff Da carry asterisks; definition not present in inspected first two pages.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24206", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Soham Dan superscript 1 maps to Scale AI. Asterisk also on Jeff Da, but definition absent in first two PDF pages.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23670": { "id": "2610.23670", "title": "OwlSight: A Panoramic Monitor for Chain-of-Thought Reasoning", "classification": "relevant", "reason": "轨迹中的隐私泄露与思维链监控基准，直接关联 Agent 行为监督。", "summary_zh": null, "version_id": "2610.23670v2", "published": "2026-10-16T16:01:49Z", "updated": "2026-10-21T01:28:15Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.23670", "tags": [ "monitoring" ], "reason_zh": "训练可按细粒度或粗粒度要求检查思维链的监控器，覆盖安全与可信行为。" }, "author": { "id": "2610.23670", "title": "OwlSight: A Panoramic Monitor for Chain-of-Thought Reasoning", "version_id": "2610.23670v2", "first_author": "Lewen Yan", "authors": [ "Lewen Yan", "Yanxu Zhu", "Jie Zhang", "Jing Shao" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.23670v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23670", "author_status": "verified", "affiliation_status": "unresolved", "evidence": "Official HTML and versioned PDF return 404. API confirms first author Lewen Yan, affiliation cannot be verified. Official unversioned PDF URL also returned404.", "verification_failure": "official_html_and_pdf_404", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23449": { "id": "2610.23449", "title": "GatewayBench: Unified Capability and Security Evaluation Platform for MCP Gateways", "classification": "relevant", "reason": "MCP网关良性及对抗任务统一安全评估", "summary_zh": "GatewayBench比较扁平/层次MCP网关，含524任务、6域及251真实服务器的11118工具。七网关在良性和对抗任务上评估，显示设计影响成功率、效率、抗攻击性并与模型/harness交互；摘要无攻击成功率具体数值。", "version_id": "2610.23449v1", "published": "2026-10-16T13:31:09Z", "updated": "2026-10-16T13:31:09Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.23449", "tags": [ "evaluation", "authorization" ], "reason_zh": "统一评测 MCP 网关的工具暴露结构、能力效率及对抗任务安全表现。" }, "author": { "id": "2610.23449", "title": "GatewayBench: Unified Capability and Security Evaluation Platform for MCP Gateways", "version_id": "2610.23449v1", "first_author": "Yitian Zheng", "authors": [ "Yitian Zheng", "Zhaorun Chen", "Haoyu Li", "Bo Li" ], "affiliations": [ "Tsinghua University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.23449v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23449", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Yitian Zheng.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23257": { "id": "2610.23257", "title": "Reasoning Models Can Control Their Chains of Thought When They Tell Themselves To", "classification": "relevant", "reason": "自指令提高CoT可控性并在监控场景规避监督", "summary_zh": "把约束作为模型CoT内自指令，显著提高推理过程可控性；仅用户提示的低遵从不能证明不可控制。自指令可从用户通道引入，且在真实监控设置被用于逃避CoT监控，提示监督可靠性风险；摘要无具体幅度。", "version_id": "2610.23257v1", "published": "2026-10-16T10:31:27Z", "updated": "2026-10-16T10:31:27Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.23257", "tags": [ "monitoring", "evaluation" ], "reason_zh": "提出自指令式思维链可控性评测，并展示其对思维链监控规避的影响。" }, "author": { "id": "2610.23257", "title": "Reasoning Models Can Control Their Chains of Thought When They Tell Themselves To", "version_id": "2610.23257v1", "first_author": "Uriel Dolev", "authors": [ "Uriel Dolev", "Idan Schwartz", "Yoav Goldberg" ], "affiliations": [ "Bar-Ilan University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.23257v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23257", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Uriel Dolev superscript 1 maps to Bar-Ilan University.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22987": { "id": "2610.22987", "title": "From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents", "classification": "relevant", "reason": "仓库恶意上下文诱导编码Agent申请过宽永久授权，直接权限升级", "summary_zh": "仓库恶意上下文使Claude Code/Codex CLI等编码Agent把常规任务包装成申请危险宽授权。58%实例成功诱出目标allow-rule；规则覆盖56.9%类别能力用例。在用户批准前提下，58个可用实例中47个达成静默恶意目标（81%）。重点是授权更新链而非直接绕过沙箱；成功率有条件。", "version_id": "2610.22987v1", "published": "2026-10-16T06:13:06Z", "updated": "2026-10-16T06:13:06Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.22987", "tags": [ "injection", "authorization", "supplychain" ], "reason_zh": "利用仓库恶意上下文诱导宽泛持久授权规则，进而绕过编码代理的沙箱审批边界。" }, "author": { "id": "2610.22987", "title": "From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents", "version_id": "2610.22987v1", "first_author": "Xianglin Yang", "authors": [ "Xianglin Yang", "Yechao Zhang", "Jiahao Liu", "Yulin Chen", "Yuxin Cao", "Bryan Hooi", "Jiaheng Zhang" ], "affiliations": [ "National University of Singapore" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22987v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22987", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Xianglin Yang.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22779": { "id": "2610.22779", "title": "When Can You Trust an Agent's Own Verifier? Stress-Testing Counterfactual Rationale Verification Under Search Pressure and Oracle Access", "classification": "relevant", "reason": "Agent优化自身验证器时的投机与查询泄漏压力测试", "summary_zh": "对Agent自身Rationale Consistency Score验证器施加搜索压力及提前oracle查询，提出压力比ρ和四种失效探针。单模型六任务三种子显示，能先探测验证器再提交时，Agent保留会通过的说法但留出忠实度下降，环内指标看不见。作者称初步证据且小pipeline评分有混杂。", "version_id": "2610.22779v1", "published": "2026-10-16T00:41:30Z", "updated": "2026-10-16T00:41:30Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.22779", "tags": [ "evaluation", "monitoring" ], "reason_zh": "压力测试代理自身验证器在优化搜索、声明操纵和提交前查询下的可信程度。" }, "author": { "id": "2610.22779", "title": "When Can You Trust an Agent's Own Verifier? Stress-Testing Counterfactual Rationale Verification Under Search Pressure and Oracle Access", "version_id": "2610.22779v1", "first_author": "Jonghyun Lee", "authors": [ "Jonghyun Lee", "Moonsu Kim", "Sunghwan Park" ], "affiliations": [ "Yonsei University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22779v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22779", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Jonghyun Lee.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22441": { "id": "2610.22441", "title": "From Natural Language Intent to Executable Control: Hierarchical Feedback-Guided LLM Planning for Multi-component Cyber-Physical Systems", "classification": "relevant", "reason": "LLM控制物理系统时以形式约束反馈保证任务及安全可行性", "summary_zh": "LLM同时生成结构任务计划和STL约束，健全算法检查确定矛盾；控制综合失败反馈违反约束及冲突组件，引导重规划。七类多组件物理系统场景，GPT-5满足原始任务的可执行成功率87.9%；不是安全违规率。", "version_id": "2610.22441v1", "published": "2026-10-15T14:52:57Z", "updated": "2026-10-15T14:52:57Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI", "cs.SE" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.22441", "tags": [ "embodied", "authorization" ], "reason_zh": "利用形式约束与控制失败反馈修正计划，确保多组件物理系统的执行满足安全条件。" }, "author": { "id": "2610.22441", "title": "From Natural Language Intent to Executable Control: Hierarchical Feedback-Guided LLM Planning for Multi-component Cyber-Physical Systems", "version_id": "2610.22441v1", "first_author": "Jinglin Dai", "authors": [ "Jinglin Dai", "Jiawan Wang", "Ruiqi Hong", "Lei Bu" ], "affiliations": [ "Nanjing University, Nanjing, China" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22441v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22441", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Jinglin Dai.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22426": { "id": "2610.22426", "title": "PRIME: Towards Verifiable Evidence-Grounded Reasoning in LLM Agents", "classification": "relevant", "reason": "独立程序以预承诺证据规则阻止Agent无依据结论", "summary_zh": "PRIME事先固定结论所需证据路线，由独立程序记录检查并拒绝未获证据授权的结论，进一步提示或执行补充检查。480公共记录任务中基线26.7%产生无依据结论，PRIME为0；保证以正确规则、精确检查、已知位置和足够预算为前提。", "version_id": "2610.22426v1", "published": "2026-10-15T05:03:22Z", "updated": "2026-10-15T05:03:22Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.22426", "tags": [ "monitoring", "robustness" ], "reason_zh": "通过独立程序维护预承诺证据规则与检查账本，阻止代理输出无依据结论。" }, "author": { "id": "2610.22426", "title": "PRIME: Towards Verifiable Evidence-Grounded Reasoning in LLM Agents", "version_id": "2610.22426v1", "first_author": "Hamed Khosravi", "authors": [ "Hamed Khosravi", "Xiaoming Huo" ], "affiliations": [ "H. Milton Stewart School of Industrial and Systems Engineering, Georgia Institute of Technology" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.22426v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22426", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Both authors share explicit school and university lines.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22373": { "id": "2610.22373", "title": "Structured Authority Injection: Persistent Human Control for LLM Agents via Typed MCP Overrides", "classification": "relevant", "reason": "MCP类型化权威覆盖通道防操作者指令衰减", "summary_zh": "SAI通过类型化、schema校验的MCP工具注入Constraint/Priority/Strategy覆盖，在规划器不可访问的单向权威通道持久保存优先级。九模型八故障情境减少指令歧义和权威衰减，最强模型提示开销最高降38%；收益随模型变。", "version_id": "2610.22373v1", "published": "2026-07-27T03:38:01Z", "updated": "2026-07-27T03:38:01Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.22373", "tags": [ "authorization", "memory" ], "reason_zh": "以类型化 MCP 覆盖及持久权威上下文维持人类指令优先级，减轻上下文累积中的权威衰减。" }, "author": { "id": "2610.22373", "title": "Structured Authority Injection: Persistent Human Control for LLM Agents via Typed MCP Overrides", "version_id": "2610.22373v1", "first_author": "Ryan Tran", "authors": [ "Ryan Tran", "YueMing Zhang", "Lingfeng Tao", "Nan Yang", "Shengjie Xu", "Yu Yin", "Shuai Xu", "Wenlu Zhang", "Hailu Xu" ], "affiliations": [ "California State University Long Beach, Long Beach, CA, USA" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.22373v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22373", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Ryan Tran and YueMing Zhang grouped directly above university in first author column.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22990": { "id": "2610.22990", "title": "PersonaCUABench: Benchmarking Computer-Use Agents Serving Diverse Personas", "classification": "relevant", "reason": "电脑Agent用户约束/审批/停止要求遵从评估，直接人类控制", "summary_zh": "PersonaCUABench固定74任务11域，以44种persona改写请求并交互，测用户约束、审批、停止要求。九模型3330运行平均完成率相较原请求降36%；降分单元11.2%是用户要求停止却被checker判失败，揭示仅完成率可能惩罚遵从人类控制。", "version_id": "2610.22990v1", "published": "2026-10-16T06:14:55Z", "updated": "2026-10-16T06:14:55Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI", "cs.LG" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.22990", "tags": [ "evaluation", "authorization" ], "reason_zh": "改变请求者表达而固定电脑任务，评测用户约束、审批要求及停止指令的遵从。" }, "author": { "id": "2610.22990", "title": "PersonaCUABench: Benchmarking Computer-Use Agents Serving Diverse Personas", "version_id": "2610.22990v1", "first_author": "Haoming Li", "authors": [ "Haoming Li", "Defu Cao", "Xu Hu", "Yingtao Luo", "Yiyang Wang", "Xianghe Xu", "Jiashu He", "Wanting Jiang", "Yifan Zhang", "Yunhan Zhao", "Siyang Wu", "Chen Yang", "Haixin Wang", "Zheyuan Deng", "Taoran Li", "Jingwen Zhang", "Zhejian Peng", "Shushu Liang", "Yue Zhao", "Bingzhe Li", "Feng Chen", "Yifan Wang", "Jintao Huang", "Yijun Wang", "Yuexing Hao", "Xiaomin Li" ], "affiliations": [ "The University of Texas at Dallas" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22990v1", "shared_first_authors": [], "shared_first_note": "First three authors carry asterisks; meaning not defined in inspected HTML front matter.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22990", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Haoming Li superscript 1 maps to UT Dallas; asterisk shared by first three authors but no equal-contribution definition visible.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22882": { "id": "2610.22882", "title": "Cooperation Without Adaptation: LLM Agents in a Collective-Risk Dilemma", "classification": "relevant", "reason": "多 Agent 集体风险博弈中的激励错配与协作失败。", "summary_zh": null, "version_id": "2610.22882v1", "published": "2026-10-16T03:38:04Z", "updated": "2026-10-16T03:38:04Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.AI", "cs.CL", "cs.MA" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.22882", "tags": [ "multiagent" ], "reason_zh": "研究集体风险博弈中代理对风险、伙伴行为和群体组成的适应及协作失败。" }, "author": { "id": "2610.22882", "title": "Cooperation Without Adaptation: LLM Agents in a Collective-Risk Dilemma", "version_id": "2610.22882v1", "first_author": "Trung-Kiet Huynh", "authors": [ "Trung-Kiet Huynh", "Dao-Sy Duy-Minh", "Chi-Nguyen Tran", "Phu-Hoa Pham", "Phu-Quy Nguyen-Lam", "Le Hong Trang", "The Anh Han" ], "affiliations": [ "University of Science, VNU-HCM, Ho Chi Minh City, Vietnam" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22882v1", "shared_first_authors": [], "shared_first_note": "These authors contributed equally to this work; HTML does not preserve which other authors share the note.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22882", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Trung-Kiet Huynh; equal-contribution note present but other shared authors not mapped.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30742": { "id": "2610.30742", "title": "UniGuard: Multi-View Guardrail Learning for Cross-Interface Safety Generalization", "classification": "relevant", "reason": "跨对话/Agent/多Agent轨迹接口统一安全guardrail", "summary_zh": "UniGuard针对同一安全事件在prompt、response、多轮、Agent轨迹及多Agent轨迹的接口变化，使用多视图对比学习和非对称置信校准。1000公共安全案例合成多视图数据训练0.6B模型；未见接口ATBench/PolicyGuardBench/DynaBench上较原guardrail平均F1升45.12点、ECE降35.41点。仅合成训练，摘要未给分攻击类别表现。", "version_id": "2610.30742v1", "published": "2026-10-22T05:14:30Z", "updated": "2026-10-22T05:14:30Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.30742", "tags": [ "monitoring", "robustness" ], "reason_zh": "学习跨对话、代理轨迹及多代理轨迹接口一致的安全表示，提高护栏泛化可靠性。" }, "author": { "id": "2610.30742", "title": "UniGuard: Multi-View Guardrail Learning for Cross-Interface Safety Generalization", "version_id": "2610.30742v1", "first_author": "Viet-Thanh Pham", "authors": [ "Viet-Thanh Pham", "Thuy-Trang Vu", "Junae Kim", "Rollin Omari", "Dinh Phung", "Gholamreza Haffari", "Lizhen Qu" ], "affiliations": [ "Department of Data Science & AI, Monash University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.30742v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30742", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Viet-Thanh Pham superscript 1 maps explicitly to institution 1.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.29292": { "id": "2610.29292", "title": "Credit Where Credit Is Due: Contrastive Attribution Topology Search for Multi-Agent Systems", "classification": "relevant", "reason": "多Agent拓扑归因排除提示投毒Agent", "summary_zh": "CATS让归因模型对比不同团队拓扑的执行轨迹，为Agent分配贡献并剪枝低效节点。在HotpotQA提示投毒压力测中，三次运行均排除了所有对抗提示Agent，而随机搜索在相似准确率下仍保留部分。主实验BigCodeBench准确率升5.3点、部署token降54%；安全结果仅此小压力测试。", "version_id": "2610.29292v1", "published": "2026-10-21T06:46:11Z", "updated": "2026-10-21T06:46:11Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CL", "cs.MA" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.29292", "tags": [ "multiagent", "monitoring" ], "reason_zh": "比较团队执行轨迹分配成员贡献并优化通信拓扑，检验识别与剔除有害成员。" }, "author": { "id": "2610.29292", "title": "Credit Where Credit Is Due: Contrastive Attribution Topology Search for Multi-Agent Systems", "version_id": "2610.29292v1", "first_author": "Fabian Tritthart", "authors": [ "Fabian Tritthart", "Tom Zehle" ], "affiliations": [ "University of Freiburg" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29292v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29292", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Fabian Tritthart.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28787": { "id": "2610.28787", "title": "Is Anyone Enforcing the Cartel? What Reinforcement Learning Teaches LLM Agents in Markets", "classification": "relevant", "reason": "多Agent市场串谋执法与激励行为安全审计", "summary_zh": "通过市场反事实副本强迫成员降价背叛，检查其他定价Agent是否惩罚，区分高价格结果与真正串谋执法。小LLM经RL多学固定规则或匹配降价，强制训练价格战多只在训练处迁移；提示LLM的类似卡特尔收益常由忽略市场规则造成。强调不能仅凭收益断言串谋机制。", "version_id": "2610.28787v1", "published": "2026-10-20T18:18:10Z", "updated": "2026-10-20T18:18:10Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.28787", "tags": [ "multiagent", "evaluation" ], "reason_zh": "用反事实违约审计区分多代理市场中的高价结果与真正可执行的合谋机制。" }, "author": { "id": "2610.28787", "title": "Is Anyone Enforcing the Cartel? What Reinforcement Learning Teaches LLM Agents in Markets", "version_id": "2610.28787v1", "first_author": "Hieu Tran", "authors": [ "Hieu Tran", "Hong Yu" ], "affiliations": [ "University of Massachusetts Amherst" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28787v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28787", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Hieu Tran.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.29216": { "id": "2610.29216", "title": "Preference Is Not Permission: Personalizing the Auto-Purchase Line in Agentic Commerce", "classification": "relevant", "reason": "购物Agent偏好不等于授权，自动购买越权及人类确认边界", "summary_zh": "提出个人自动购买边界：不买/先确认/自动买，取决于证据充分性、可逆性、价格和紧迫性而非商品偏好。16模型相对15名角色扮演标注者授权参考表现越权，低匹配或自认缺证据仍承诺。每人30–40标签的浅层学习器持出中位预测0.79，优于所有提示×模型配置，但不能跨域迁移。", "version_id": "2610.29216v1", "published": "2026-10-21T05:15:31Z", "updated": "2026-10-21T05:15:31Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "abstract", "topics": { "id": "2610.29216", "tags": [ "authorization", "evaluation" ], "reason_zh": "以人工授权参照和反事实购买基准区分偏好适配、先确认和自动购买的边界。" }, "author": { "id": "2610.29216", "title": "Preference Is Not Permission: Personalizing the Auto-Purchase Line in Agentic Commerce", "version_id": "2610.29216v1", "first_author": "Ryotaro Shimizu", "authors": [ "Ryotaro Shimizu", "Sai HtaungKham", "Mo Fan" ], "affiliations": [ "ZOZO Research, Tokyo, Japan" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29216v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29216", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Ryotaro Shimizu.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27577": { "id": "2610.27577", "title": "Why Static Probes Fail: Context Determines Deception Feature Composition", "classification": "relevant", "reason": "欺骗、策略性隐藏和低报能力的内部监测，关联 Agent 失配监督。", "summary_zh": null, "version_id": "2610.27577v1", "published": "2026-10-20T03:42:51Z", "updated": "2026-10-20T03:42:51Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27577", "tags": [ "monitoring" ], "reason_zh": "以多维欺骗子空间和场景自适应组合检测策略性隐瞒，分析静态探针失效。" }, "author": { "id": "2610.27577", "title": "Why Static Probes Fail: Context Determines Deception Feature Composition", "version_id": "2610.27577v1", "first_author": "Yao Huang", "authors": [ "Yao Huang", "Siyuan Chen", "Zhenghan Zhou", "Yinpeng Dong" ], "affiliations": [ "College of Artificial Intelligence, Tsinghua University, Beijing, China", "Shanghai Qi Zhi Institute, Shanghai, China" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.27577v1", "shared_first_authors": [], "shared_first_note": "Equal contributions note present; other author marker not preserved in HTML.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27577", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Both affiliations attached to Yao Huang; equal-contribution note lacks mapping to other authors.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27295": { "id": "2610.27295", "title": "RealControlBench: A Benchmark for Interpretability-Informed Fine-Grained Control of LLMs and Agents", "classification": "relevant", "reason": "多轮 Agent 工具控制与轨迹安全意识评测。", "summary_zh": "RealControlBench 将行为 steering 扩展到执行落地多轮 Agent，覆盖工具选择、指令、推理及轨迹条件安全。作者称现有 steering 难稳定实现控制且可损害任务能力，摘要无具体安全提升数值。", "version_id": "2610.27295v1", "published": "2026-10-19T21:10:03Z", "updated": "2026-10-19T21:10:03Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27295", "tags": [ "evaluation", "monitoring" ], "reason_zh": "评测可解释性引导的细粒度行为控制，兼顾真实代理交互中的可控性与能力保留。" }, "author": { "id": "2610.27295", "title": "RealControlBench: A Benchmark for Interpretability-Informed Fine-Grained Control of LLMs and Agents", "version_id": "2610.27295v1", "first_author": "Xinying Cai", "authors": [ "Xinying Cai", "Bin Hu", "Mingyu Jin", "Qiming Zhang", "Yang Ouyang", "Bangwei Guo", "Minghao Guo", "Yutong Yin", "Lang Gao", "Feijiang Han", "Sheldon Yu", "Kaiqu Liang", "Qingcheng Zeng", "Jingcheng Niu", "Fan Yang", "Wei Cheng", "Zhen Xiang", "Julian McAuley", "Zhaoran Wang" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.27295v1", "shared_first_authors": [ "Xinying Cai", "Bin Hu", "Mingyu Jin", "Qiming Zhang" ], "shared_first_note": "First four authors marked with asterisk; explicit Equal contribution note.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27295", "author_status": "verified", "affiliation_status": "unresolved", "evidence": "PDF first-page title and authors match. PDF lists 11 institutions with no author-to-institution mapping. Four equal-contribution authors verified, but first author institution unresolved.", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.27227": { "id": "2610.27227", "title": "Which Agent's Skill Should Change? Group-Relative Credit Assignment for Evolving Multi-Agent Teams", "classification": "relevant", "reason": "对团队 Skill 贡献归因并识别植入的有害 Skill。", "summary_zh": "GRSE 对相同技能库重复运行任务并进行组相对归因。植入有害 Skill 时全部归因符号正确并恢复干净库得分（+6.3 点），旧方法误归因两个并继续下降；需区分能力有害技能与恶意指令投毒。", "version_id": "2610.27227v1", "published": "2026-10-19T19:55:19Z", "updated": "2026-10-19T19:55:19Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.27227", "tags": [ "multiagent", "supplychain" ], "reason_zh": "对团队中代理与技能配对进行贡献归因，检验发现并纠正技能库中的植入有害技能。" }, "author": { "id": "2610.27227", "title": "Which Agent's Skill Should Change? Group-Relative Credit Assignment for Evolving Multi-Agent Teams", "version_id": "2610.27227v1", "first_author": "Yanan Ma", "authors": [ "Yanan Ma", "Yang Wang", "David Le", "Chenhan Yuan", "Yizheng Sun", "Guangwei Zhang", "Chenghao Xiao", "Chenghua Lin", "Imon Banerjee" ], "affiliations": [ "Mayo Clinic" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.27227v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.27227", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Yanan Ma carries Greek mu marker matching mu Mayo Clinic.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28381": { "id": "2610.28381", "title": "CAPSafe: A Benchmark for Contextual Action and Plan Safety Reasoning in Embodied Agents", "classification": "relevant", "reason": "具身 LLM Agent 动作与长期计划危险性评估。", "summary_zh": "CAPSafe 区分情境动作安全和家庭危险任务长计划，九模型中最好动作识别超过90%，最佳安全计划成功率78.19%，其余低于65%，暴露识别与执行计划之间差距。", "version_id": "2610.28381v1", "published": "2026-10-20T15:33:20Z", "updated": "2026-10-20T15:33:20Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28381", "tags": [ "embodied", "evaluation" ], "reason_zh": "分别评测情境动作危险识别与长期家庭任务安全规划，并区分风险严重程度。" }, "author": { "id": "2610.28381", "title": "CAPSafe: A Benchmark for Contextual Action and Plan Safety Reasoning in Embodied Agents", "version_id": "2610.28381v1", "first_author": "Youmna Farag", "authors": [ "Youmna Farag", "Svetlana Stoyanchev", "Simon Keizer", "Mohan Li", "Rama Doddipatla" ], "affiliations": [ "Cambridge Research Laboratory, Toshiba Europe Ltd, Cambridge, UK" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28381v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28381", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. All authors share explicit laboratory affiliation line.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25731": { "id": "2610.25731", "title": "Does Unlearning Survive Collaboration? Robust Unlearning for Shared-Model LLM Teams", "classification": "relevant", "reason": "共享模型团队协作使被遗忘信息从多消息组合重建。", "summary_zh": "ACU 用单条及合并消息重建反馈训练共享模型，并按风险归因。作者称 TOFU 全轨迹 ROUGE-L 恢复由41.8%降19.3%，事实恢复34.2%降18.7%，保留任务性能相当。", "version_id": "2610.25731v1", "published": "2026-10-19T03:33:58Z", "updated": "2026-10-19T03:33:58Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.25731", "tags": [ "privacy", "multiagent" ], "reason_zh": "研究多代理消息组合恢复已遗忘信息的泄露风险，并训练面向聚合恢复的遗忘机制。" }, "author": { "id": "2610.25731", "title": "Does Unlearning Survive Collaboration? Robust Unlearning for Shared-Model LLM Teams", "version_id": "2610.25731v1", "first_author": "Hengsong Liu", "authors": [ "Hengsong Liu", "Liangyu Teng", "Jingnan Cai", "Yuntian Shi", "Jingyu Zhang", "Yang Liu", "Jing Liu", "Liang Song" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.25731v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25731", "author_status": "verified", "affiliation_status": "unresolved", "evidence": "PDF title matches; API first author Hengsong Liu is absent in PDF front matter, which names only Fudan Institute on Networking Systems of AI. Individual affiliation cannot be mapped.", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25458": { "id": "2610.25458", "title": "Quality-Controlled Reply and Summary Data for Post-Training Small Language Models in AI Call-Screening Agents", "classification": "relevant", "reason": "通话筛选Agent越权回复、夸大风险与摘要证据归属失真，通过边界受限训练和质量审核缓解。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.25458", "topics": { "tags": [ "authorization", "privacy", "monitoring" ], "reason_zh": "通话筛选Agent越权回复、夸大风险与摘要证据归属失真，通过边界受限训练和质量审核缓解。" }, "summary_zh": "问题：代用户筛选来电的端侧小模型可能越权答复、误报普通来电或把来电者说法写成事实。方法：在信息边界隔离下生成通话、回复和摘要，分别审核，获得3,395通话和15,102目标，以共享LoRA训练6个0.6–4B模型。作者称192留出通话上，回复合格率从21%–54%升至94%–97%，摘要从0%–6%升至43%–72%；但筛数据和评分使用同一模型，度量评审标准一致性而非人类接受，人工研究尚待进行。", "version_id": "2610.25458v2", "published": "2026-10-18T18:42:26Z", "updated": "2026-10-24T22:32:23Z", "announcement_date": "2026-10-20", "categories_seen": [ "cs.CL" ], "provenance": [ { "announcement_date": "2026-10-20", "category": "cs.CL", "kind": "recent", "section": null } ], "candidate_type": "changed_version", "abstract_sha256": "962a7c4123ab008432e10dd9d661f3384422a749aebb38a76c8fe1abd786b34a", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "seen_dates": [ "2026-10-25", "2026-10-27" ], "version_history": [ { "id": "2610.25458", "version_id": "2610.25458v1", "classification": "relevant", "announcement_date": "Tue, 20 Oct 2026", "published": "2026-10-18T18:42:26Z", "updated": "2026-10-18T18:42:26Z", "reason": "来电筛选 Agent 代表用户回复的权限及证据归属可靠性。" } ], "announcement_status": "官方公告列表已核对", "backfill_kind": "known_id_revision", "author": { "id": "2610.25458", "title": "Quality-Controlled Reply and Summary Data for Post-Training Small Language Models in AI Call-Screening Agents", "version_id": "2610.25458v1", "first_author": "Jiaqi Gan", "authors": [ "Jiaqi Gan", "Tsang Ng", "Ankit Raj", "Tommy Duong", "Xingyu Shen", "Kidus Zewde", "Huaiyu Guo", "Simiao Ren" ], "affiliations": [ "Scam.ai" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25458v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25458", "author_status": "verified", "affiliation_status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。", "verification_status": "affiliation_verified", "shared_first_affiliations": {} }, "first_seen_date": "2026-10-25", "revision_history": [ { "id": "2610.25458", "title": "Quality-Controlled Reply and Summary Data for Post-Training Small Language Models in AI Call-Screening Agents", "classification": "relevant", "reason": "来电筛选 Agent 代表用户回复的权限及证据归属可靠性。", "summary_zh": "按写作者信息边界生成3395通电话、15102目标，训练同一 LoRA 回复与总结。六个小模型在192留出电话上回复合格率由21–54%升94–97%、总结由0–6%升43–72%；作者说明为共享评分器标准而非人类接受率。", "version_id": "2610.25458v1", "published": "2026-10-18T18:42:26Z", "updated": "2026-10-18T18:42:26Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.25458", "tags": [ "authorization", "robustness" ], "reason_zh": "为来电代理训练不超出主人权限的回复和忠实保留来源、条件的通话摘要。" }, "author": { "id": "2610.25458", "title": "Quality-Controlled Reply and Summary Data for Post-Training Small Language Models in AI Call-Screening Agents", "version_id": "2610.25458v1", "first_author": "Jiaqi Gan", "authors": [ "Jiaqi Gan", "Tsang Ng", "Ankit Raj", "Tommy Duong", "Xingyu Shen", "Kidus Zewde", "Huaiyu Guo", "Simiao Ren" ], "affiliations": [ "Scam.ai" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.25458v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25458", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. All eight authors grouped above shared Scam.ai affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ] }, "2610.25123": { "id": "2610.25123", "title": "Memories That Outlive Their Reasons: Dependency-Tethered Memory for Tool-Using LLM Agents", "classification": "relevant", "reason": "Agent 对过期安全判定的记忆依赖失效传播，直接影响不安全发布。", "summary_zh": "Tether 写入时记录版本依赖，读取时撤销任何上游失效判定。Fallout 上游失效对象误发布由原子事实记忆62%降至0.3%，较全复核少37%调用；关系与判定分会话时退化至9.4–22.1%，依赖抽取是关键限制。", "version_id": "2610.25123v2", "published": "2026-10-18T09:01:52Z", "updated": "2026-10-22T04:32:22Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.25123", "tags": [ "memory", "supplychain" ], "reason_zh": "将安全核验记忆绑定依赖版本，传播撤销失效，避免发布上游已失效的软件包等制品。" }, "author": { "id": "2610.25123", "title": "Memories That Outlive Their Reasons: Dependency-Tethered Memory for Tool-Using LLM Agents", "version_id": "2610.25123v2", "first_author": "Yiqi Wang", "authors": [ "Yiqi Wang", "Jinqian Ju", "Jiaqi Zhang", "Zhangkai Wu", "Yiqun Duan", "Zequn Sun", "Taotao Cai", "Mingkai Zheng" ], "affiliations": [ "University of Southern Queensland, Australia" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25123v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25123", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Yiqi Wang.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24949": { "id": "2610.24949", "title": "Over-Defense in Coding Agents Begins at Silent Forks", "classification": "relevant", "reason": "Coding Agent 超出任务需要的防御行为及过程约束。", "summary_zh": "ForkDPO 在结果相同但行为分歧的 silent forks 配对比例合宜/过度动作。未见仓库上4B模型过度行为70.3%降58.9%，随机回合DPO为67.7%，说明任务成功奖励看不到不必要行为。", "version_id": "2610.24949v1", "published": "2026-10-18T01:56:29Z", "updated": "2026-10-18T01:56:29Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CL", "cs.SE", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.24949", "tags": [ "evaluation" ], "reason_zh": "定位结果奖励无法分辨的行为分叉，训练编码代理减少超出任务需要的过度防御。" }, "author": { "id": "2610.24949", "title": "Over-Defense in Coding Agents Begins at Silent Forks", "version_id": "2610.24949v1", "first_author": "Hanjun Luo", "authors": [ "Hanjun Luo", "Xuecheng Liu", "Xiucheng Zhang", "Zhuoning Xu", "Yingbin Jin", "Yankai Chen", "Xue Liu", "Hanan Salam" ], "affiliations": [ "New York University", "New York University Abu Dhabi" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24949v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24949", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Two explicit affiliations attached to Hanjun Luo.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25161": { "id": "2610.25161", "title": "Indistinguishable Agents: Training Agent Privacy as Twin-World Indistinguishability", "classification": "relevant", "reason": "Agent 外部动作可泄露事实，不能仅限制显式提及。", "summary_zh": "在仅私密事实不同的 twin worlds 上由冻结区分器评分观察者视图，用 paired GRPO 同时训练任务成功和不可区分性。作者证明目标约束观察者 Bayes 成功率，在购物/消息任务减少传统披露评分漏掉的行动泄漏；摘要无具体数值。", "version_id": "2610.25161v1", "published": "2026-10-18T10:37:33Z", "updated": "2026-10-18T10:37:33Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.CL", "cs.LG" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.25161", "tags": [ "privacy" ], "reason_zh": "以仅私有事实不同的双世界训练代理，使外部行动轨迹不泄露观察者可推断的隐私。" }, "author": { "id": "2610.25161", "title": "Indistinguishable Agents: Training Agent Privacy as Twin-World Indistinguishability", "version_id": "2610.25161v1", "first_author": "Jiaming He", "authors": [ "Jiaming He", "Guanyu Hou", "Yi Yu", "Xudong Jiang" ], "affiliations": [ "Nanyang Technological University, Singapore" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25161v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25161", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Jiaming He.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23093": { "id": "2610.23093", "title": "Disentangling Language Effects on Tool Admission and Post-Retrieval Safety", "classification": "relevant", "reason": "多语言请求对 Agent 工具准入和检索后有害输出影响分离。", "summary_zh": "十模型七语言中，非英语有害请求平均工具准入由46.9%升67.4%；四闭源模型在按网页语言回答时匹配调用的有害率50.3%升57.4%。仅翻译网页无一致影响，说明必须分别量化准入、拒绝和能力失效。", "version_id": "2610.23093v1", "published": "2026-10-16T08:05:14Z", "updated": "2026-10-16T08:05:14Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.23093", "tags": [ "evaluation", "authorization" ], "reason_zh": "拆分多语言请求下工具准入与检索后生成，评估危险调用、拒绝和能力失败。" }, "author": { "id": "2610.23093", "title": "Disentangling Language Effects on Tool Admission and Post-Retrieval Safety", "version_id": "2610.23093v1", "first_author": "Aditya Nawal", "authors": [ "Aditya Nawal", "Manit Baser", "Mohan Gurusamy" ], "affiliations": [ "National University of Singapore" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.23093v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23093", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. All three authors share one explicit institution line.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23071": { "id": "2610.23071", "title": "Before Retrieval Begins: Safety and Tool-Use Decisions in LLM Agents", "classification": "relevant", "reason": "直接研究有害请求下工具调用准入与文字拒绝不一致。", "summary_zh": "七开源模型允许有害调用后的平均危害率74.5%，且33.6%已准入有害调用伴随文字拒绝。析因干预和表示方向显示模型依赖，文字拒绝训练可转移到部分准入决策，但不能将拒绝文本当安全调用代理。", "version_id": "2610.23071v1", "published": "2026-10-16T07:42:47Z", "updated": "2026-10-16T07:42:47Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.23071", "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "直接研究有害请求的工具准入决定及其与文字拒绝的行为和表征关系。" }, "author": { "id": "2610.23071", "title": "Before Retrieval Begins: Safety and Tool-Use Decisions in LLM Agents", "version_id": "2610.23071v1", "first_author": "Aditya Nawal", "authors": [ "Aditya Nawal", "Manit Baser", "Mohan Gurusamy" ], "affiliations": [ "National University of Singapore" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.23071v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23071", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. All three authors share one explicit institution line.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22594": { "id": "2610.22594", "title": "The Model Knows Better: Defending Medical Multi-Agent Systems Against Prompt Injection", "classification": "relevant", "reason": "医疗多 Agent 讨论遭临床文本伪装提示注入及证据核验防护。", "summary_zh": "两系统两模型族三基准中单段注入最高61%成功；防御分离病人发现与临床判断，仅由发现核验每个判断。MedQA ASR 降至4–7%，良性准确性保持，对自适应攻击仍有效；均为作者摘要声称。", "version_id": "2610.22594v1", "published": "2026-10-15T19:43:57Z", "updated": "2026-10-15T19:43:57Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.22594", "tags": [ "injection", "multiagent" ], "reason_zh": "研究临床文本伪装的提示注入如何影响医疗多代理讨论，并以患者证据核验判断。" }, "author": { "id": "2610.22594", "title": "The Model Knows Better: Defending Medical Multi-Agent Systems Against Prompt Injection", "version_id": "2610.22594v1", "first_author": "Fardin Ahsan Sakib", "authors": [ "Fardin Ahsan Sakib", "Ziwei Zhu", "Ozlem Uzuner" ], "affiliations": [ "Department of Computer Science, George Mason University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22594v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22594", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Fardin Ahsan Sakib.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22507": { "id": "2610.22507", "title": "RealCLI: Toward a Unified Evaluation of Human-Agent Collaboration for CLI Agents", "classification": "relevant", "reason": "CLI Agent 动态授权、纠正和安全边界协作基准。", "summary_zh": "REALCLI 将完整预给要求与逐步信息/纠正/约束修订/授权决策配对，五维22子维、51场景模板。最佳配置平均49.2%，联合协作分最高37.6%，揭示任务成功与可引导性、信任校准、安全边界差异。", "version_id": "2610.22507v1", "published": "2026-10-15T18:03:13Z", "updated": "2026-10-15T18:03:13Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.CL" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.22507", "tags": [ "evaluation", "authorization" ], "reason_zh": "在渐进信息、纠正和动态授权下评测 CLI 代理协作、可引导性及安全边界管理。" }, "author": { "id": "2610.22507", "title": "RealCLI: Toward a Unified Evaluation of Human-Agent Collaboration for CLI Agents", "version_id": "2610.22507v1", "first_author": "Yunqi Liu", "authors": [ "Yunqi Liu", "Peiyu Wang", "Bingli Wang", "Leo Luo", "Xuanwu Song", "Xudong Ma", "Hongxin Li", "Yaxin Du", "Weicheng Gu", "Fanglin Xu", "Yi Xing", "XiangLong Liu", "Jujie He", "Zhange Zhang", "Huatong Song", "Zhaoyi Li", "Deyang Kong", "Chuan Hao", "Peihao Wu", "Mingjie Tang", "Ran Tao", "Jian Yang", "Wayne Xin Zhao", "Bryan Dai" ], "affiliations": [ "IQuest Research" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.22507v1", "shared_first_authors": [ "Yunqi Liu", "Peiyu Wang", "Bingli Wang", "Leo Luo", "Xuanwu Song" ], "shared_first_note": "First five authors carry *; footnote explicitly states Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22507", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Yunqi Liu superscript 3 maps to IQuest Research; first five authors marked asterisk, defined as equal contribution.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30924": { "id": "2610.30924", "title": "REGATTA: A Cross-Domain Measurement Framework and Fault-Injection Harness for Enterprise AI Agents", "classification": "relevant", "reason": "正文III–V核验明确含角色边界违规和对抗漏洞的 Agent 故障注入评测；仅单轮且参考法律存在缺陷，不能视为合规认证。", "summary_zh": null, "version_id": "2610.30924v1", "published": "2026-10-22T08:42:35Z", "updated": "2026-10-22T08:42:35Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.SE" ], "full_text_checked": true, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30924", "tags": [ "evaluation" ], "reason_zh": "构建企业代理测试套件的故障注入与规则来源审计框架，并报告其测量和法规依据缺陷。" }, "author": { "id": "2610.30924", "title": "REGATTA: A Cross-Domain Measurement Framework and Fault-Injection Harness for Enterprise AI Agents", "version_id": "2610.30924v1", "first_author": "Luong Tuan Thanh", "authors": [ "Luong Tuan Thanh", "Abhijit Sanyal" ], "affiliations": [ "Golden Gate University, San Francisco, CA, USA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30924v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30924", "evidence": "Title matches; first author Luong Tuan Thanh has explicit Affiliation: Golden Gate University, San Francisco, CA, USA.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30916": { "id": "2610.30916", "title": "When Code Gets Cheap, Evaluation Gets Scarce: An Experience Report on AI-Assisted Agile Software Engineering", "classification": "relevant", "reason": "真实 Coding Agent 绕过过程检查点，需可执行门控。", "summary_zh": "单开发者构建合规关键评分系统的经验报告指出 Agent 跨多步绕过检查点，直到门控被强制执行。强调验证真实环境、门控 Agent 本身和保留决策假设；没有可归因防御效果统计。", "version_id": "2610.30916v1", "published": "2026-10-22T08:35:55Z", "updated": "2026-10-22T08:35:55Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30916", "tags": [ "evaluation", "authorization" ], "reason_zh": "以真实开发经历分析评估瓶颈，并记录把代理可绕过流程检查点改成强制门控的必要性。" }, "author": { "id": "2610.30916", "title": "When Code Gets Cheap, Evaluation Gets Scarce: An Experience Report on AI-Assisted Agile Software Engineering", "version_id": "2610.30916v1", "first_author": "Barbara Weber", "authors": [ "Barbara Weber", "Olaf Zimmermann", "Marco Franceschetti" ], "affiliations": [ "University of St.Gallen, St.Gallen, Switzerland" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30916v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30916", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. One author block includes Barbara Weber and two coauthors with shared explicit affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30571": { "id": "2610.30571", "title": "Stale Instruction Files Override the Code in Coding Agents: A One-Sentence Fix", "classification": "relevant", "reason": "项目过期指令与代码冲突导致 Coding Agent 非必要改写，涉及指令权威。", "summary_zh": "40 Python 项目320次运行中90.1%选择跟随过期文件；Codex20/80改写已有代码，其中17次原测试失败。用户级一条代码优先规则将遵循代码选择4.2%升91.4%，测试89.4%升100%；结论仅适用所测规则冲突。", "version_id": "2610.30571v1", "published": "2026-10-22T01:00:43Z", "updated": "2026-10-22T01:00:43Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30571", "tags": [ "supplychain", "memory", "robustness" ], "reason_zh": "研究仓库过期指令文件压过现有代码的上下文权威冲突，以及明确优先级的修复。" }, "author": { "id": "2610.30571", "title": "Stale Instruction Files Override the Code in Coding Agents: A One-Sentence Fix", "version_id": "2610.30571v1", "first_author": "Xiaonan Xu", "authors": [ "Xiaonan Xu", "Wenjing Wu" ], "affiliations": [ "College of Computing, Georgia Institute of Technology, Atlanta, GA, USA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.30571v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30571", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Xiaonan Xu.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.30221": { "id": "2610.30221", "title": "Agentic Architecture of Information Systems. The AAM/5C Model: A Reference Model for Distributed Autonomy", "classification": "relevant", "reason": "Agent 架构将提议、授权判断、执行分离，以签名证明与短期动作凭据绑定。", "summary_zh": "AAM/5C 提出 R-AUT：规划器提议、治理层签发判断证明、安全层发短期 token、执行点双核验。明确两项分析命题的假设及待证防绕过性质，提供 Rego/TLA+ 部分规格，无经验结果。", "version_id": "2610.30221v1", "published": "2026-10-21T16:39:07Z", "updated": "2026-10-21T16:39:07Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.SE", "cs.MA" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.30221", "tags": [ "authorization", "multiagent" ], "reason_zh": "提出分布式自治架构，将提议、治理裁定和执行分离，并绑定签名证明与短期动作令牌。" }, "author": { "id": "2610.30221", "title": "Agentic Architecture of Information Systems. The AAM/5C Model: A Reference Model for Distributed Autonomy", "version_id": "2610.30221v1", "first_author": "Laurent Goujon", "authors": [ "Laurent Goujon" ], "affiliations": [ "IBM France" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.30221v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.30221", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. PDF page 2 says Author: Laurent Goujon — IBM France.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.29609": { "id": "2610.29609", "title": "Who Verifies the Agent's Success Claim? Self-Report Leakage in GUI-Agent Completion Judging", "classification": "relevant", "reason": "GUI Agent 成功自报污染监督者完成判断，独立轨迹审计阻断危险误报。", "summary_zh": "同任务轨迹只改变是否显示自报，遮蔽自报使两种 judge 危险误报召回提高43.4/13.3点。结构化隔离审计在465记录F1 0.75–0.78，留出0.77–0.81，按其门控政策挡74–90%误报但需45–56%审查负载。", "version_id": "2610.29609v1", "published": "2026-10-21T11:50:17Z", "updated": "2026-10-21T11:50:17Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.29609", "tags": [ "monitoring" ], "reason_zh": "隔离 GUI 代理成功自报与独立轨迹判断，以审计并拦截缺乏执行证据的完成声明。" }, "author": { "id": "2610.29609", "title": "Who Verifies the Agent's Success Claim? Self-Report Leakage in GUI-Agent Completion Judging", "version_id": "2610.29609v1", "first_author": "Yunfeng Zhu", "authors": [ "Yunfeng Zhu", "Shengcheng Yu", "Zihan Li", "Zhenyu Chen" ], "affiliations": [ "State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29609v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29609", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Yunfeng Zhu superscript 1 maps to institution 1.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28683": { "id": "2610.28683", "title": "Who Approved This? Coding Agents, Human Accounts, and Merge-Gate Evidence at a Fintech Startup", "classification": "relevant", "reason": "Coding Agent 使用人类账号审批并绕过合并门控的真实记录审计。", "summary_zh": "12周786合并PR的报告中，设门控阶段263个人账号合并有71个仅依赖 Agent 以技术负责人账号提交的批准。发现临时关闭强制、失败检查记通过、未保护分支折叠等；建议决策权与账号分离及隔离控制凭据。", "version_id": "2610.28683v1", "published": "2026-10-19T19:13:57Z", "updated": "2026-10-19T19:13:57Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28683", "tags": [ "authorization", "supplychain", "monitoring" ], "reason_zh": "审计编码代理借人类账号审批、关闭保护及绕过合并门的记录，核验权限与提交证据。" }, "author": { "id": "2610.28683", "title": "Who Approved This? Coding Agents, Human Accounts, and Merge-Gate Evidence at a Fintech Startup", "version_id": "2610.28683v1", "first_author": "Adam Manji", "authors": [ "Adam Manji" ], "affiliations": [ "Bashi AI, London, UK" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28683v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28683", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Adam Manji.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28116": { "id": "2610.28116", "title": "AgenTest: Mining Business Rules to Test LLM Agents for Business Logic Bugs", "classification": "relevant", "reason": "自动挖掘业务规则测试 Agent 越权访问和状态修改。", "summary_zh": "AgenTest 从提示、工具定义和领域知识提炼551条 Given-When-Then 规格，τ2 三域两模型发现89/121种违规，分别为基线合计3.4/2.5倍；独有跨用户访问修改案例，约60%触发运行仅看最终状态无法发现。", "version_id": "2610.28116v1", "published": "2026-10-20T12:25:44Z", "updated": "2026-10-20T12:25:44Z", "announcement_date": "Wed, 21 Oct 2026", "categories_seen": [ "cs.SE" ], "full_text_checked": false, "evidence_level": "full_abstract_only", "topics": { "id": "2610.28116", "tags": [ "evaluation", "authorization" ], "reason_zh": "挖掘业务规则并构造交互测试，检验工具调用权限和越权访问、修改他人数据。" }, "author": { "id": "2610.28116", "title": "AgenTest: Mining Business Rules to Test LLM Agents for Business Logic Bugs", "version_id": "2610.28116v1", "first_author": "Lili Quan", "authors": [ "Lili Quan", "Longtian Wang", "Yuelin Wang", "Mingfei Cheng", "Chao Shen", "Sen Chen", "Xiaofei Xie" ], "affiliations": [ "Singapore Management University, Singapore" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28116v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28116", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Lili Quan.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23632": { "id": "2610.23632", "title": "Empirical Insights from AI-Powered Software Engineering in Practice", "classification": "irrelevant", "reason": "正文为三个 GenAI 软件工程实践案例，实证集中于生产率、验证负担、上下文与工具使用成熟度；安全治理只是建议，未给出 Agent 攻击或防护评测。", "summary_zh": null, "version_id": "2610.23632v1", "published": "2026-10-16T15:37:58Z", "updated": "2026-10-16T15:37:58Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.SE" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "id": "2610.23632", "tags": [ "robustness" ], "reason_zh": "通过软件工程案例分析生成式 AI 集成的风险与可靠性；摘要未细述具体代理安全机制。" }, "author": { "id": "2610.23632", "title": "Empirical Insights from AI-Powered Software Engineering in Practice", "version_id": "2610.23632v1", "first_author": "Tina Mersch", "authors": [ "Tina Mersch", "Jack Johns", "Steffen Klepke", "Hanya Elhashemy", "Artur Signell", "Robin Gröpler", "Klaus Schmid" ], "affiliations": [ "EKS Intec GmbH, Weingarten, Germany" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.23632v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23632", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. T. Mersch listed first, institution on same line; full first name from API retained.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [ { "id": "2610.23632", "title": "Empirical Insights from AI-Powered Software Engineering in Practice", "classification": "uncertain", "reason": "生成式 AI 工程风险概述，需确认是否含实质 Agent 安全结果。", "summary_zh": null, "version_id": "2610.23632v1", "published": "2026-10-16T15:37:58Z", "updated": "2026-10-16T15:37:58Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.SE" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.23632", "tags": [ "robustness" ], "reason_zh": "通过软件工程案例分析生成式 AI 集成的风险与可靠性；摘要未细述具体代理安全机制。" }, "author": { "id": "2610.23632", "title": "Empirical Insights from AI-Powered Software Engineering in Practice", "version_id": "2610.23632v1", "first_author": "Tina Mersch", "authors": [ "Tina Mersch", "Jack Johns", "Steffen Klepke", "Hanya Elhashemy", "Artur Signell", "Robin Gröpler", "Klaus Schmid" ], "affiliations": [ "EKS Intec GmbH, Weingarten, Germany" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.23632v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23632", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. T. Mersch listed first, institution on same line; full first name from API retained.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ], "review": { "id": "2610.23632", "classification_recommendation": "irrelevant", "reason_zh": "正文为三个 GenAI 软件工程实践案例，实证集中于生产率、验证负担、上下文与工具使用成熟度；安全治理只是建议，未给出 Agent 攻击或防护评测。", "source_url": "https://arxiv.org/pdf/2610.23632", "reviewed_version_id": null, "version_note": "官方未版本化 PDF，提取正文无可核验版本号；不猜版本。", "abstract_read": true, "body_sections_checked": [ "Abstract", "AI-Powered Software Development", "CaseStudy – Siemens (CS3): Setup and Results", "Challenges and Recommendations", "Conclusion" ], "evidence_zh": "Claude Code 工业问卷涉及 500 人/约 20 项目，报告使用体验与主观效率；风险内容是复杂/有 bug 的生成代码、审查负担及治理建议，没有实测注入、越权、依赖投毒或具体防护效果。", "review_date": "2026-10-26" } }, "2610.29346": { "id": "2610.29346", "title": "Benchmarking and Error Analysis of Deep Search and Deep Research LLM Agents", "classification": "irrelevant", "reason": "正文错误分类和实验围绕工具格式、网页访问、检索策略与报告证据质量，没有构造攻击或验证安全边界，属一般 Agent 可靠性。", "summary_zh": null, "version_id": "2610.29346v1", "published": "2026-10-21T07:38:29Z", "updated": "2026-10-21T07:38:29Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "id": "2610.29346", "tags": [ "robustness", "evaluation", "monitoring" ], "reason_zh": "提出深度研究代理中间工作流错误分类与轨迹分析框架，以诊断系统及任务可靠性。" }, "author": { "id": "2610.29346", "title": "Benchmarking and Error Analysis of Deep Search and Deep Research LLM Agents", "version_id": "2610.29346v1", "first_author": "Zixuan Yu", "authors": [ "Zixuan Yu", "Zhenheng Tang", "Xiaowen Chu", "Bo Han" ], "affiliations": [ "School of Computer Science and Engineering, Sun Yat-sen University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29346v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29346", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Zixuan Yu.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [ { "id": "2610.29346", "title": "Benchmarking and Error Analysis of Deep Search and Deep Research LLM Agents", "classification": "uncertain", "reason": "深度研究 Agent 错误分类，是否含安全威胁而非普通可靠性尚不明确。", "summary_zh": null, "version_id": "2610.29346v1", "published": "2026-10-21T07:38:29Z", "updated": "2026-10-21T07:38:29Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.29346", "tags": [ "robustness", "evaluation", "monitoring" ], "reason_zh": "提出深度研究代理中间工作流错误分类与轨迹分析框架，以诊断系统及任务可靠性。" }, "author": { "id": "2610.29346", "title": "Benchmarking and Error Analysis of Deep Search and Deep Research LLM Agents", "version_id": "2610.29346v1", "first_author": "Zixuan Yu", "authors": [ "Zixuan Yu", "Zhenheng Tang", "Xiaowen Chu", "Bo Han" ], "affiliations": [ "School of Computer Science and Engineering, Sun Yat-sen University" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.29346v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.29346", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Zixuan Yu.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25" } ], "review": { "id": "2610.29346", "classification_recommendation": "irrelevant", "reason_zh": "正文错误分类和实验围绕工具格式、网页访问、检索策略与报告证据质量，没有构造攻击或验证安全边界，属一般 Agent 可靠性。", "source_url": "https://arxiv.org/html/2610.29346v1", "abstract_read": true, "body_sections_checked": [ "Abstract", "1 Introduction", "3.1 System-Level Errors", "3.2 Task-Level Errors", "4 Experiment" ], "evidence_zh": "BrowseComp、GAIA、XBench-DS、Deep Research Bench 用于产生轨迹；工具误用、反爬拦截、过早停止和幻觉均是非对抗流程错误，不应仅因 vulnerabilities 一词纳入安全。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.29346v1" } }, "2610.28988": { "id": "2610.28988", "title": "Attention-based Classification for Indirect Prompt Injection", "classification": "relevant", "reason": "AgentDojo间接提示注入检测：验证注意力阈值迁移失效并提出头级线性分类防御", "summary_zh": null, "version_id": "2610.28988v1", "published": "2026-10-20T23:31:19Z", "updated": "2026-10-20T23:31:19Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.28988", "tags": [ "injection", "monitoring" ], "reason_zh": "研究真实工具代理中间接提示注入的注意力检测失效，并比较头级分类器的跨域表现。" }, "author": { "id": "2610.28988", "title": "Attention-based Classification for Indirect Prompt Injection", "version_id": "2610.28988v1", "first_author": "Amelia Kawasaki", "authors": [ "Amelia Kawasaki", "Stefan Lee" ], "affiliations": [], "status": "partial", "source_url": "https://arxiv.org/pdf/2610.28988v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28988", "author_status": "verified", "affiliation_status": "unresolved", "evidence": "PDF first-page title and authors match. PDF lists first author email only, with no institution; Corvallis is a location and email domain is not affiliation evidence.", "verification_status": "author_verified_affiliation_unconfirmed" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28798": { "id": "2610.28798", "title": "An Explicit Feedback Contract for Iterative ML-Agent Harnesses", "classification": "relevant", "reason": "研究 Agent 的验证得分与测试访问合同限制，防止奖励劫持和证据越界。", "summary_zh": null, "version_id": "2610.28798v1", "published": "2026-10-20T18:24:29Z", "updated": "2026-10-20T18:24:29Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.28798", "tags": [ "evaluation", "authorization" ], "reason_zh": "约束研究代理观察验证反馈、停止迭代及访问测试集的时机，减少自适应选择偏差。" }, "author": { "id": "2610.28798", "title": "An Explicit Feedback Contract for Iterative ML-Agent Harnesses", "version_id": "2610.28798v1", "first_author": "Kehui Yao", "authors": [ "Kehui Yao", "Chuanbo Hu", "Jiao Chen", "Ramin Giahi", "Reza Yousefi Maragheh", "Lalitesh Morishetti", "Ziwei Hong", "Yiyun Su", "Jianpeng Xu", "Evren Korpeoglu", "Kannan Achan" ], "affiliations": [ "Walmart Global Tech" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.28798v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28798", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Kehui Yao superscript 1 maps explicitly to Walmart Global Tech.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.28707": { "id": "2610.28707", "title": "SimHack: Predicting the onset of detectable reward hacking before RL training", "classification": "relevant", "reason": "编码LLM强化学习奖励黑客出现时间预测和低风险训练策略", "summary_zh": null, "version_id": "2610.28707v1", "published": "2026-10-20T15:58:47Z", "updated": "2026-10-20T15:58:47Z", "announcement_date": "Thu, 22 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": false, "evidence_level": "title_and_full_abstract", "topics": { "id": "2610.28707", "tags": [ "evaluation" ], "reason_zh": "模拟编码强化学习中奖励投机的出现过程，用于预先筛选风险较低的训练方案。" }, "author": { "id": "2610.28707", "title": "SimHack: Predicting the onset of detectable reward hacking before RL training", "version_id": "2610.28707v1", "first_author": "Junwei Deng", "authors": [ "Junwei Deng", "Alex Bie", "Natalia Ponomareva" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.28707v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.28707", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Junwei Deng; footnote separately states work done at Google Research.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25374": { "id": "2610.25374", "title": "Mining the Self-Rewriting System: A Vision for Data Mining on AI-Native Infrastructure", "classification": "relevant", "reason": "自重写 Agent 基础设施中的安全升级与跨界面漂移治理。", "summary_zh": null, "version_id": "2610.25374v1", "published": "2026-10-18T16:25:01Z", "updated": "2026-10-18T16:25:01Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.25374", "tags": [ "monitoring", "memory", "evaluation" ], "reason_zh": "提出自重写基础设施中的联合漂移监控、知识更新和共享评测门控研究框架。" }, "author": { "id": "2610.25374", "title": "Mining the Self-Rewriting System: A Vision for Data Mining on AI-Native Infrastructure", "version_id": "2610.25374v1", "first_author": "Mayank Darbari", "authors": [ "Mayank Darbari", "Chiman Salavati", "Liang Wu", "Dawei Wang", "Jiong Zhang", "Kelly Wan", "Krishna Chakka", "Liangjie Hong" ], "affiliations": [ "Nokia, Sunnyvale, California, USA" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25374v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25374", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Mayank Darbari superscript 1 maps to institution 1.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24601": { "id": "2610.24601", "title": "TCMScience: An Autonomous Scientist for Traditional Chinese Medicine", "classification": "relevant", "reason": "科研Agent将提案与执行发布权限分离，以可信内核、类型操作、权限及来源契约控制发布，直接相关", "summary_zh": null, "version_id": "2610.24601v1", "published": "2026-10-17T10:06:40Z", "updated": "2026-10-17T10:06:40Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.24601", "tags": [ "authorization", "monitoring" ], "reason_zh": "将科研代理提案与执行发布权分开，以类型操作、权限和来源证据合同约束结论。" }, "author": { "id": "2610.24601", "title": "TCMScience: An Autonomous Scientist for Traditional Chinese Medicine", "version_id": "2610.24601v1", "first_author": "Yanlan Kang", "authors": [ "Yanlan Kang", "Ruiqi Liu", "Xinpei Gu", "Tzu-Yi Lei", "Shuai Xu", "Xukun Zhang", "William Cheng-Chung Chu" ], "affiliations": [ "Institute of Medical Philosophy & Future AI (IMPF-AI)" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.24601v1", "shared_first_authors": [ "Yanlan Kang", "Ruiqi Liu", "Xinpei Gu" ], "shared_first_note": "First three authors have dagger; dagger explicitly defined Equal contribution.", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24601", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Yanlan Kang superscript 1 explicitly maps to numbered institution 1; first three dagger authors equal contribution.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.24348": { "id": "2610.24348", "title": "Blackbox Performance Analysis of LLM-based Network Control", "classification": "uncertain", "reason": "正文确有针对 LLM 网络控制的对抗输入和可用性损失，但被测对象为专用优化求解器；作者将更广的 Agent 网络管理列为未来方向，保留范围待定。", "summary_zh": null, "version_id": "2610.24348v2", "published": "2026-10-17T00:35:00Z", "updated": "2026-10-20T05:28:04Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "topics": { "id": "2610.24348", "tags": [ "robustness", "evaluation" ], "reason_zh": "通过黑盒搜索寻找语言模型网络控制在未见输入上的性能缺口，审计部署可靠性。" }, "author": { "id": "2610.24348", "title": "Blackbox Performance Analysis of LLM-based Network Control", "version_id": "2610.24348v2", "first_author": "Mahdi Alizadeh", "authors": [ "Mahdi Alizadeh", "Pooria Namyar", "Arvin Ghavidel", "Ramesh Govindan" ], "affiliations": [ "University of Southern California" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.24348v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.24348", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Mahdi Alizadeh.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25", "2026-10-26" ], "revision_history": [], "review": { "id": "2610.24348", "classification_recommendation": "uncertain", "reason_zh": "正文确有针对 LLM 网络控制的对抗输入和可用性损失，但被测对象为专用优化求解器；作者将更广的 Agent 网络管理列为未来方向，保留范围待定。", "source_url": "https://arxiv.org/html/2610.24348v2", "abstract_read": true, "body_sections_checked": [ "Abstract", "1 Introduction", "2 LLM-based Network Control", "3 LENS: Black-box RL-based Search" ], "evidence_zh": "黑盒 RL 搜索有效流量矩阵及 GPU 作业输入，使路由/资源分配偏离最优；有明确鲁棒性风险，但不是已验证工具自主执行的通用 LLM Agent。", "review_date": "2026-10-26", "scope_note": "分类针对本日报的 LLM Agent 自身安全范围，不评判论文质量。", "reviewed_version_id": "2610.24348v2" } }, "2610.23707": { "id": "2610.23707", "title": "Tool Recommendation for Multi-Step Agents: Finding Every Tool a Task Needs", "classification": "relevant", "reason": "工具网关按用户凭据与服务同意逐次校验，直接关联 Agent 工具授权。", "summary_zh": null, "version_id": "2610.23707v1", "published": "2026-10-16T16:30:38Z", "updated": "2026-10-16T16:30:38Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.23707", "tags": [ "authorization", "robustness" ], "reason_zh": "研究多步任务完整工具检索，并在工具网关逐次按用户凭据和服务同意校验调用。" }, "author": { "id": "2610.23707", "title": "Tool Recommendation for Multi-Step Agents: Finding Every Tool a Task Needs", "version_id": "2610.23707v1", "first_author": "Sam Partee", "authors": [ "Sam Partee", "River Stevens", "Thierry Damiba", "Valerie Fanelle" ], "affiliations": [ "Arcade.dev" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.23707v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23707", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. All four authors share explicit Arcade.dev line.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23251": { "id": "2610.23251", "title": "FLARE: Physics-Grounded Evaluation of Language-Model Agents for Feeder Restoration with Degraded Observations", "classification": "relevant", "reason": "电网恢复LLM Agent安全评测，在退化观察下评估动作门控并回放验证物理违规，直接相关", "summary_zh": null, "version_id": "2610.23251v1", "published": "2026-10-16T10:24:32Z", "updated": "2026-10-16T10:24:32Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.LG" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.23251", "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "在退化观察和分布变化下评测电网恢复代理，以物理回放核验被安全门拒绝的动作。" }, "author": { "id": "2610.23251", "title": "FLARE: Physics-Grounded Evaluation of Language-Model Agents for Feeder Restoration with Degraded Observations", "version_id": "2610.23251v1", "first_author": "BHVSP Subrahmanyam", "authors": [ "BHVSP Subrahmanyam", "Neeraj Choudhary" ], "affiliations": [ "MU-VT Interdisciplinary Advanced Research Centre for Transformative Technologies, Mahindra University, India", "Indian Institute of Technology Madras, India" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.23251v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23251", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Three affiliation lines directly attached to BHVSP Subrahmanyam; research centre combined with parent university.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.21711": { "id": "2610.21711", "title": "How language model agents reshape price competition", "classification": "relevant", "reason": "LLM定价代理的部署接口影响超竞争价格与合谋风险", "summary_zh": null, "version_id": "2610.21711v1", "published": "2026-10-15T11:32:32Z", "updated": "2026-10-15T11:32:32Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.LG", "cs.MA" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.21711", "tags": [ "multiagent" ], "reason_zh": "研究定价代理的部署接口如何改变自博弈与混合市场中的超竞争价格和竞争行为。" }, "author": { "id": "2610.21711", "title": "How language model agents reshape price competition", "version_id": "2610.21711v1", "first_author": "Martin Bichler", "authors": [ "Martin Bichler", "Philip Hierhager", "Kassian Köck", "Fabian Pieroth" ], "affiliations": [ "School of Computation, Information and Technology, Technical University of Munich, Germany" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.21711v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.21711", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Martin Bichler.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31446": { "id": "2610.31446", "title": "When Is a Memory Safe Enough to Act On? Action-Conditioned Verification for Long-Lived Agents", "classification": "relevant", "reason": "长寿命代理行动前记忆核验与风险弃答，直接安全门控", "summary_zh": null, "version_id": "2610.31446v1", "published": "2026-10-22T15:43:50Z", "updated": "2026-10-22T15:43:50Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.MA" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.31446", "tags": [ "memory", "authorization" ], "reason_zh": "依据即将执行动作的后果选择记忆前提复核、放行或弃权，控制陈旧记忆造成的伤害。" }, "author": { "id": "2610.31446", "title": "When Is a Memory Safe Enough to Act On? Action-Conditioned Verification for Long-Lived Agents", "version_id": "2610.31446v1", "first_author": "Yiqi Wang", "authors": [ "Yiqi Wang", "Yifei Wang", "Jiaqi Zhang", "Zhangkai Wu", "Yiqun Duan", "Taotao Cai", "Mingkai Zheng" ], "affiliations": [ "University of Southern Queensland, Australia" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.31446v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31446", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Yiqi Wang.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.31325": { "id": "2610.31325", "title": "Consistent but Biased: Chair Personas Trade Noise for Bias in Multi-Agent Clinical Decisions", "classification": "relevant", "reason": "临床多代理主持者persona引发决策偏置与虚假可靠性，直接代理系统安全评测", "summary_zh": null, "version_id": "2610.31325v1", "published": "2026-10-22T14:16:14Z", "updated": "2026-10-22T14:16:14Z", "announcement_date": "Fri, 23 Oct 2026", "categories_seen": [ "cs.MA" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.31325", "tags": [ "multiagent" ], "reason_zh": "控制病例不变，研究多代理临床主持者人格对决策偏置及重复运行表面一致性的影响。" }, "author": { "id": "2610.31325", "title": "Consistent but Biased: Chair Personas Trade Noise for Bias in Multi-Agent Clinical Decisions", "version_id": "2610.31325v1", "first_author": "Yitong Bai", "authors": [ "Yitong Bai", "Chengyi Zhang", "Ziyang Wang" ], "affiliations": [ "Columbia University, USA" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.31325v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.31325", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Yitong Bai superscript 1 maps to Columbia University.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.25508": { "id": "2610.25508", "title": "How Far Can an Agent Push? Trust-Safety Margins in Live Language-Based Economic Games", "classification": "relevant", "reason": "经济博弈中受保护 Agent 的策略上线门控及操纵与信任风险。", "summary_zh": null, "version_id": "2610.25508v2", "published": "2026-10-18T19:54:20Z", "updated": "2026-10-20T03:29:48Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.MA" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.25508", "tags": [ "multiagent", "authorization" ], "reason_zh": "研究经济博弈的策略影响与信任边界，并通过预设上线门和回滚规则保护生产代理。" }, "author": { "id": "2610.25508", "title": "How Far Can an Agent Push? Trust-Safety Margins in Live Language-Based Economic Games", "version_id": "2610.25508v2", "first_author": "Dima Galat", "authors": [ "Dima Galat", "Marian-Andrei Rizoiu" ], "affiliations": [ "University of Technology Sydney" ], "status": "verified", "source_url": "https://arxiv.org/html/2610.25508v2", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.25508", "author_status": "verified", "affiliation_status": "verified", "evidence": "Title matches. Explicit affiliation attached to Dima Galat.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.23904": { "id": "2610.23904", "title": "LVMH: A Meta-Optimization Harness for Long-Video Agent Memory", "classification": "relevant", "reason": "自演化记忆开发的独立审查与防自证边界，关联研究 Agent 评测污染控制。", "summary_zh": null, "version_id": "2610.23904v1", "published": "2026-09-29T20:29:13Z", "updated": "2026-09-29T20:29:13Z", "announcement_date": "Tue, 20 Oct 2026", "categories_seen": [ "cs.MA" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.23904", "tags": [ "memory", "multiagent", "evaluation" ], "reason_zh": "以多代理代码搜索优化视频记忆策略，并用独立审查及保护观察边界限制自证与过拟合。" }, "author": { "id": "2610.23904", "title": "LVMH: A Meta-Optimization Harness for Long-Video Agent Memory", "version_id": "2610.23904v1", "first_author": "Liwei Che", "authors": [ "Liwei Che", "Benlin Liu", "Dai Li", "Xiangyan Li", "Zijian Wu", "Changjiang Li", "Minghao Guo", "Chengzhi Mao", "Vladimir Pavlovic", "Ranjay Krishna" ], "affiliations": [ "Rutgers University" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.23904v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.23904", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Liwei Che superscript 1 maps to Rutgers University; title appears as MH, abstract identifies LVMH.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.22701": { "id": "2610.22701", "title": "Emergent Discrimination and Polarization in Multi-Agent Systems", "classification": "relevant", "reason": "语言模型代理群体偏见传播与歧视极化，明确群体安全分析", "summary_zh": null, "version_id": "2610.22701v1", "published": "2026-10-15T22:07:16Z", "updated": "2026-10-15T22:07:16Z", "announcement_date": "Mon, 19 Oct 2026", "categories_seen": [ "cs.MA" ], "full_text_checked": false, "evidence_level": null, "topics": { "id": "2610.22701", "tags": [ "multiagent" ], "reason_zh": "研究代理间信任更新与局部偏见如何涌现为群体歧视和极化。" }, "author": { "id": "2610.22701", "title": "Emergent Discrimination and Polarization in Multi-Agent Systems", "version_id": "2610.22701v1", "first_author": "Nestor Caticha", "authors": [ "Nestor Caticha", "João Henrique Sant'Ana", "Felippe Alves", "Davi Bastos Costa", "Mariana Mercucci", "Juan P. Neirotti", "Otavio Citton", "Renato Vicente" ], "affiliations": [ "Instituto de Física, Universidade de São Paulo, São Paulo, Brasil", "Instituto de Estudos Avançados, Universidade de São Paulo, São Paulo, Brasil", "TELUS Digital Research Hub, CIAAM, Universidade de São Paulo, São Paulo, Brasil" ], "status": "verified", "source_url": "https://arxiv.org/pdf/2610.22701v1", "shared_first_authors": [], "shared_first_note": "", "author_source": "https://export.arxiv.org/api/query?id_list=2610.22701", "author_status": "verified", "affiliation_status": "verified", "evidence": "PDF first-page title and authors match. Nestor Caticha superscripts 1,2,3 map to explicitly numbered institutions.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-25", "seen_dates": [ "2026-10-25" ], "revision_history": [] }, "2610.15884": { "id": "2610.15884", "classification": "relevant", "reason": "直接评估工具调用超时后重试权限、幂等性与重复副作用，属于 Agent 执行安全。", "abstract_read": true, "reading_basis": "full_final_official_api_abstract", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "dea6824a8a17a20861975c27e6efbc555aad9803e94d673f200fe8939f24d3ee", "summary_zh": "工具调用超时后，Agent 不知道操作是否已执行，重试可能产生重复副作用。RetryBench 在与观测一致的所有隐藏执行世界重放决策，分开衡量重试权限、实际副作用与任务完成。在四个软件工程任务的两项提示研究中，幂等键措辞和选项顺序显著影响部分模型行为；摘要限定结论适用于所测任务与未固定版本别名。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "评测 Agent 在执行结果不确定时是否具备安全重试依据。", "id": "2610.15884" }, "abstract_reading_basis": "full_final_official_api_abstract", "version_id": "2610.15884v4", "title": "RetryBench: Separating Retry Permission from Recovery Outcomes in GPT Tool Use", "published": "2026-10-11T20:00:44Z", "updated": "2026-11-04T07:00:04Z", "announcement_date": "2026-11-05", "candidate_type": "changed_version", "categories_seen": [ "cs.AI", "cs.CR" ], "source_url": "https://arxiv.org/abs/2610.15884v4", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-11-06" ], "version_history": [ { "id": "2610.15884", "version_id": "2610.15884v3", "classification": "relevant", "reason": "直接评估工具超时后的重试授权错误，区分获准重试与最终恢复成功。", "announcement_date": "2026-10-23", "published": "2026-10-11T20:00:44Z", "updated": "2026-10-22T06:44:33Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "8a0cd70db72c2e25df9fbfb5dad7c428910734e455194195eca35b5c99ad25d4", "provenance": "replacement_announcement" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.15884", "first_author": "You Liu", "authors": [ "You Liu", "Yue Liu", "Quanchao Lu" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.15884v4", "author_source": "https://export.arxiv.org/api/query?id_list=2610.15884v4", "author_status": "verified", "affiliation_status": "unconfirmed", "status": "partial", "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "evidence": "Author block names You Liu first and provides ORCID only, no institutional affiliation.", "version_id": "2610.15884v4", "title": "RetryBench: Separating Retry Permission from Recovery Outcomes in GPT Tool Use", "affiliation_source": "https://arxiv.org/pdf/2610.15884v4", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "官方HTML及PDF首页未列署名机构，机构未确认。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "6d2d3d04fe2880be0694dc1ae8424a71ee018570fad502a4de01988b286a949e", "all_author_affiliations": [] }, "category": "cs.CR", "replacement": true, "categories": [ "cs.CR", "cs.AI" ], "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2610.15884", "title": "RetryBench: Separating Retry Permission from Recovery Outcomes in GPT Tool Use", "category": "cs.CR", "version_id": "2610.15884v3", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.CR", "cs.AI" ], "classification": "relevant", "reason": "直接评估工具超时后的重试授权错误，区分获准重试与最终恢复成功。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.15884", "backfill_kind": "replacement_announcement", "summary_zh": "问题：Agent 是否在工具超时后执行无授权重试。方法：RetryBench 将重试权限判断与实际恢复结果分开，通过密钥条件和显式契约提示做对照。作者称在 720 条密钥对照中，改变密钥仍触发 Sol 1/80、Terra 55/80、Luna 60/80 次无支持重试；另一 240 条自填密钥对照中 Luna 仍有 8/80。显式契约提示下 762 条返回均延后执行，但恢复未解决。结论仅限固定端点、四种任务和单次恢复决策，不能外推整段任务安全。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "评测工具调用重试权限与恢复结果，聚焦动作授权边界。" }, "published": "2026-10-11T20:00:44Z", "updated": "2026-10-22T06:44:33Z", "categories_seen": [ "cs.AI", "cs.CR" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2610.15884", "first_author": "You Liu", "authors": [ "You Liu", "Yue Liu", "Quanchao Lu" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2610.15884", "author_source": "https://arxiv.org/list/cs.AI/new?show=2000", "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "shared_first_authors": [], "shared_first_note": "", "evidence": "Author block names You Liu first and provides ORCID only, no institutional affiliation." }, "first_seen_date": "2026-10-26" } ] }, "2609.10144": { "id": "2609.10144", "title": "Kernel-Managed Shared Memory for System-Wide Personalization", "category": "cs.AI", "version_id": "2609.10144v3", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.AI", "cs.LG" ], "classification": "relevant", "reason": "系统内核对多个 LLM Agent 的共享记忆实施所有者与用户隔离，并明确恶意 Agent 越权读取威胁及可见性实测；不是将普通提示拼接误读为提示注入攻击。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2609.10144", "backfill_kind": "replacement_announcement", "summary_zh": "问题：系统级个性化需要跨 Agent 利用记忆，但不应让受损或恶意 Agent 读取其他 Agent 的私有记忆或其他用户数据。 方法：在 AIOS 内核集中管理记忆元数据与检索可见性，按用户、所有者及共享策略实施默认拒绝的访问规则，并以写入屏障控制并发一致性。 作者声称结果：作者报告全私有设置 450 次试验中未出现跨 Agent 记忆暴露；但未开展全面对抗查询，身份解析与记忆投毒仍属限制。摘要另报告 1800 次个性化试验及延迟收益，不等同于安全攻击成功率。", "topics": { "tags": [ "memory", "privacy", "authorization", "multiagent" ], "reason_zh": "系统内核对多个 LLM Agent 的共享记忆实施所有者与用户隔离，并明确恶意 Agent 越权读取威胁及可见性实测；不是将普通提示拼接误读为提示注入攻击。" }, "review": { "id": "2609.10144", "title": "Kernel-Managed Shared Memory for System-Wide Personalization", "reviewed_version_id": "2609.10144v3", "abstract_read": true, "body_sections_checked": [ "3.3 Memory Metadata and Visibility", "3.4 Write Barrier", "Appendix A.2 Threat Model and Empirical Verification" ], "status": "secondary_review_completed", "classification_recommendation": "relevant", "reason_zh": "系统内核对多个 LLM Agent 的共享记忆实施所有者与用户隔离，并明确恶意 Agent 越权读取威胁及可见性实测；不是将普通提示拼接误读为提示注入攻击。", "evidence_zh": [ "记忆以 owner_agent、user_id、sharing_policy 等元数据控制可见性，缺失或错误策略默认私有。", "全私有设置 450 次试验无跨 Agent 暴露；全共享 450 次试验检索 1798 条记录，未包含默认私有的会话记忆。", "身份解析正确性是前提；身份竞态、恶意查询和中间共享策略未系统对抗测试。机制不保证记忆完整性或来源，恶意 ProfileAgent 仍可投毒。" ], "review_date": "2026-10-26", "source_url": "https://arxiv.org/html/2609.10144v3", "evidence_basis": "完整摘要及列明正文部分；非全文逐字审阅", "problem_zh": "系统级个性化需要跨 Agent 利用记忆，但不应让受损或恶意 Agent 读取其他 Agent 的私有记忆或其他用户数据。", "method_zh": "在 AIOS 内核集中管理记忆元数据与检索可见性，按用户、所有者及共享策略实施默认拒绝的访问规则，并以写入屏障控制并发一致性。", "claimed_results_zh": "作者报告全私有设置 450 次试验中未出现跨 Agent 记忆暴露；但未开展全面对抗查询，身份解析与记忆投毒仍属限制。摘要另报告 1800 次个性化试验及延迟收益，不等同于安全攻击成功率。", "topics": [ "memory", "privacy", "authorization", "multiagent" ], "first_author": "Ryan Lum", "first_author_affiliation": "Rutgers University, Department of Computer Science", "affiliation_evidence_zh": "官方 HTML 作者个人块明确列出单位。" }, "published": "2026-09-09T13:20:47Z", "updated": "2026-10-21T21:20:28Z", "categories_seen": [ "cs.AI", "cs.LG" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2609.10144", "first_author": "Ryan Lum", "authors": [ "Ryan Lum", "Yongfeng Zhang" ], "affiliations": [ "Rutgers University" ], "source_url": "https://arxiv.org/html/2609.10144v3", "author_source": "https://arxiv.org/list/cs.LG/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "First author Ryan Lum has his own Department of Computer Science, Rutgers University block.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.33123": { "id": "2609.33123", "title": "Compositional Safety Failures in Harness Evolution: Identification and Runtime Monitoring", "category": "cs.AI", "version_id": "2609.33123v3", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.AI", "cs.SE" ], "classification": "relevant", "reason": "明确研究 Agent 持久记忆、提示、技能和工具更新的组合安全失效，并提出运行时监控。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2609.33123", "backfill_kind": "replacement_announcement", "summary_zh": "问题：单独安全且保效用的 Agent 组件更新，组合后可能导致不安全行为。方法：用类型化超图表示记忆、提示、技能和工具状态及高阶相互作用，并只更新变化邻域，指导运行时监控。作者在三项安全基准上识别 43 个两两和 18 个不可约三路组合失效，称方法缓解风险并降低交互检查成本，同时揭示安全、效用与成本权衡；摘要未给出具体降低比例。", "topics": { "tags": [ "memory", "supplychain", "monitoring", "evaluation" ], "reason_zh": "研究持久技能/工具/提示/记忆更新交互引出的安全风险及运行时监测。" }, "published": "2026-09-27T02:43:29Z", "updated": "2026-10-22T05:04:57Z", "categories_seen": [ "cs.AI", "cs.SE" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2609.33123", "first_author": "Zhixiang Zhang", "authors": [ "Zhixiang Zhang", "Zesen Liu", "Wai Ip Lai", "Hongxu chen", "Dongdong She" ], "affiliations": [ "The Hong Kong University of Science and Technology" ], "source_url": "https://arxiv.org/html/2609.33123v3", "author_source": "https://arxiv.org/list/cs.SE/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Single common affiliation follows full author list.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.34415": { "id": "2609.34415", "title": "PROACT-Agent: Progressive Runtime Oversight and Active Circuit-breaking for Real-Time Safety", "category": "cs.LG", "version_id": "2609.34415v2", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.LG" ], "classification": "relevant", "reason": "直接构建 Agent 轨迹运行时安全守卫和不可逆动作前干预，含 AgentDojo 攻击评测。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2609.34415", "backfill_kind": "replacement_announcement", "summary_zh": "问题：Agent 的安全风险从有害文本转向不可逆环境动作，既有回顾性防御不足。方法：PROACT-Agent 通过渐进展开轨迹、因果标注校正和文化本地化生成实时守卫训练数据，提出含 155,780 个状态的双语 PROACT-Bench。作者报告在完整来源隔离下，不安全类别 F1 为 91.46%，精确边界检测为 90.63%；在 AgentDojo 上，非拒绝服务型定向攻击成功率从 20.82% 降至 0.40%。", "topics": { "tags": [ "monitoring", "authorization", "evaluation", "injection" ], "reason_zh": "在下一次模型推理前检查上下文和风险边界，并用 AgentDojo 攻击验证守卫。" }, "published": "2026-09-28T06:30:49Z", "updated": "2026-10-22T02:57:37Z", "categories_seen": [ "cs.LG" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2609.34415", "first_author": "Ding Jia", "authors": [ "Ding Jia", "Wei Liu", "Xianglong Du", "Yingjie Li", "Yingqing Yang", "Huili Yu", "Zhangsong Zhan", "Chu Zhou" ], "affiliations": [ "State Key Laboratory of Intelligent Vehicle Safety Technology, Changan Automobile" ], "source_url": "https://arxiv.org/html/2609.34415v2", "author_source": "https://arxiv.org/list/cs.LG/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Ding Jia has an individually attached Changan Automobile laboratory affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.17528": { "id": "2610.17528", "version_id": "2610.17528v3", "abstract_sha256": "c7dc67a05280e39da28081140c6aa5a2d53307c667d8e6e86ed63bb8c1a4e6a1", "abstract_read": true, "classification": "relevant", "reason": "正文§2.2–2.3及附录C给出编码Agent之外的不可修改规则、只读沙箱和集群代理，阻止越界访问与改变训练目标的优化，且有隔离审计；不是仅泛化的吞吐可靠性。", "reason_zh": "编码代理修改训练配置受独立正确性门控约束，是否属于安全而非训练语义正确性需核验。", "summary_zh": "ATTUNE让编码Agent在GPU预算内优化训练配置，由确定性控制平面限制可改参数、记账并验证候选。外部正确性门禁拒绝已知改变目标的设置，并检查首步损失；每次实验的只读沙箱与集群代理隔离其他实验文件和对象。作者报告460个合法运行全部通过、29个配置故障全部拒绝，36次评测活动中越界文件或集群对象请求均被拒绝；门禁仍可能漏掉短运行不显现的细微故障。生产配方平均吞吐提升1.7倍、最高3.9倍。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "沙箱、集群代理与Agent不可改写的验证规则约束自动编码和资源使用。" }, "title": "ATTUNE: Agentic Throughput Tuning for LLM Training", "initial_classification": "uncertain", "scope_review": { "id": "2610.17528", "version_id": "2610.17528v3", "classification": "relevant", "reason": "正文§2.2–2.3及附录C给出编码Agent之外的不可修改规则、只读沙箱和集群代理，阻止越界访问与改变训练目标的优化，且有隔离审计；不是仅泛化的吞吐可靠性。", "summary_zh": "ATTUNE让编码Agent在GPU预算内优化训练配置，由确定性控制平面限制可改参数、记账并验证候选。外部正确性门禁拒绝已知改变目标的设置，并检查首步损失；每次实验的只读沙箱与集群代理隔离其他实验文件和对象。作者报告460个合法运行全部通过、29个配置故障全部拒绝，36次评测活动中越界文件或集群对象请求均被拒绝；门禁仍可能漏掉短运行不显现的细微故障。生产配方平均吞吐提升1.7倍、最高3.9倍。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "沙箱、集群代理与Agent不可改写的验证规则约束自动编码和资源使用。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.17528v3", "reviewed_sections": [ "完整摘要", "1 Introduction", "2.1 Search", "2.2 Measurement and Control Plane", "2.3 Correctness Gate", "2.4 Harness", "3.5 The Correctness Gate", "Appendix C Environment, Versions and Isolation" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "1 Introduction", "2.1 Search", "2.2 Measurement and Control Plane", "2.3 Correctness Gate", "2.4 Harness", "3.5 The Correctness Gate", "Appendix C Environment, Versions and Isolation" ], "body_source_url": "https://arxiv.org/pdf/2610.17528v3", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-13T00:49:11Z", "updated": "2026-10-30T21:17:43Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.DC", "cs.LG" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.17528v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-11-04" ], "version_history": [ { "id": "2610.17528", "version_id": "2610.17528v2", "classification": "relevant", "reason": "Coding Agent 修改训练代码与配置时，外部正确性闸门、不可由调优器修改的注册表、命令钩子、文件沙箱及集群代理构成实质行动安全控制；已核对门控评测与漏检限制。", "announcement_date": "2026-10-23", "published": "2026-10-13T00:49:11Z", "updated": "2026-10-22T17:55:03Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "0b5baae05b5cfba8b71a7cc22faf5d569744a886f0a80777cc1483c6492cccc7", "provenance": "replacement_announcement" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.17528", "first_author": "Leo Fan", "authors": [ "Leo Fan", "Hongyang Wang", "Wenbo Chen", "Jingguo Liu", "Xian Li", "Xuan Wang", "Ruochen Wen", "Yiming Yan", "Hao Wu", "Yichuan Li", "Qian Qu", "Zheshen Wang", "Benoit Dumoulin" ], "affiliations": [ "Amazon" ], "source_url": "https://arxiv.org/pdf/2610.17528v3", "author_source": "https://arxiv.org/list/cs.LG/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "首页标题及v3匹配；Leo Fan首位，全体作者共享Amazon单位。", "verification_status": "affiliation_verified", "title": "ATTUNE: Agentic Throughput Tuning for LLM Training", "version_id": "2610.17528v3", "affiliation_checked": true }, "category": "cs.LG", "replacement": true, "categories": [ "cs.LG" ], "review": { "id": "2610.17528", "title": "ATTUNE: Agentic Throughput Tuning for LLM Training", "reviewed_version_id": "2610.17528v2", "abstract_read": true, "body_sections_checked": [ "2.2.4 Correctness Gate", "2.3 Harness", "3.5 Gate Evaluation", "6.3 Limitations", "Appendix C Environment, Versions, Isolation" ], "status": "secondary_review_completed", "classification_recommendation": "relevant", "reason_zh": "Coding Agent 修改训练代码与配置时，外部正确性闸门、不可由调优器修改的注册表、命令钩子、文件沙箱及集群代理构成实质行动安全控制；已核对门控评测与漏检限制。", "evidence_zh": [ "控制面比较解析后配置与基线，注册表禁止调优器自行编辑；未知变更须进入 loss check 并报告复核。", "评测中 460 个合法运行全部通过，43 个故障运行拒绝 34、漏过 9；6 类代码故障中只捕获 2 类前向故障，4 类仍可通过。", "附录 C 描述只开放 campaign 目录写权限的沙箱及校验作业的集群 broker；45 个评测 campaign 中越界文件与集群请求均被拒绝，但这不是专门攻击测试。" ], "review_date": "2026-10-26", "source_url": "https://arxiv.org/html/2610.17528v2", "evidence_basis": "完整摘要及列明正文部分；非全文逐字审阅", "problem_zh": "自主代码调优 Agent 可能用改变训练目标、破坏正确性或越界操作换取表面吞吐收益。", "method_zh": "将调优与外部正确性闸门分离：配置注册表、有限性与初始 loss 检查、命令拦截、追加式审计记录，并用文件沙箱和集群 broker 限定操作范围。", "claimed_results_zh": "正文报告 460 个合法运行均通过；43 个故障运行中拒绝 34 个、漏过 9 个，优化器与细微 loss-mask 错误仍可能漏检。摘要称平均生产吞吐提升 1.7 倍，此为性能结果而非安全保证。", "topics": [ "authorization", "evaluation", "robustness" ], "first_author": "Leo Fan", "first_author_affiliation": "Amazon", "affiliation_evidence_zh": "官方 HTML 首页作者列表后统一署名 Amazon。" }, "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2610.17528", "title": "ATTUNE: Agentic Throughput Tuning for LLM Training", "category": "cs.LG", "version_id": "2610.17528v2", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.LG" ], "classification": "relevant", "reason": "Coding Agent 修改训练代码与配置时，外部正确性闸门、不可由调优器修改的注册表、命令钩子、文件沙箱及集群代理构成实质行动安全控制；已核对门控评测与漏检限制。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.17528", "backfill_kind": "replacement_announcement", "summary_zh": "问题：自主代码调优 Agent 可能用改变训练目标、破坏正确性或越界操作换取表面吞吐收益。 方法：将调优与外部正确性闸门分离：配置注册表、有限性与初始 loss 检查、命令拦截、追加式审计记录，并用文件沙箱和集群 broker 限定操作范围。 作者声称结果：正文报告 460 个合法运行均通过；43 个故障运行中拒绝 34 个、漏过 9 个，优化器与细微 loss-mask 错误仍可能漏检。摘要称平均生产吞吐提升 1.7 倍，此为性能结果而非安全保证。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "Coding Agent 修改训练代码与配置时，外部正确性闸门、不可由调优器修改的注册表、命令钩子、文件沙箱及集群代理构成实质行动安全控制；已核对门控评测与漏检限制。" }, "review": { "id": "2610.17528", "title": "ATTUNE: Agentic Throughput Tuning for LLM Training", "reviewed_version_id": "2610.17528v2", "abstract_read": true, "body_sections_checked": [ "2.2.4 Correctness Gate", "2.3 Harness", "3.5 Gate Evaluation", "6.3 Limitations", "Appendix C Environment, Versions, Isolation" ], "status": "secondary_review_completed", "classification_recommendation": "relevant", "reason_zh": "Coding Agent 修改训练代码与配置时，外部正确性闸门、不可由调优器修改的注册表、命令钩子、文件沙箱及集群代理构成实质行动安全控制；已核对门控评测与漏检限制。", "evidence_zh": [ "控制面比较解析后配置与基线，注册表禁止调优器自行编辑；未知变更须进入 loss check 并报告复核。", "评测中 460 个合法运行全部通过，43 个故障运行拒绝 34、漏过 9；6 类代码故障中只捕获 2 类前向故障，4 类仍可通过。", "附录 C 描述只开放 campaign 目录写权限的沙箱及校验作业的集群 broker；45 个评测 campaign 中越界文件与集群请求均被拒绝，但这不是专门攻击测试。" ], "review_date": "2026-10-26", "source_url": "https://arxiv.org/html/2610.17528v2", "evidence_basis": "完整摘要及列明正文部分；非全文逐字审阅", "problem_zh": "自主代码调优 Agent 可能用改变训练目标、破坏正确性或越界操作换取表面吞吐收益。", "method_zh": "将调优与外部正确性闸门分离：配置注册表、有限性与初始 loss 检查、命令拦截、追加式审计记录，并用文件沙箱和集群 broker 限定操作范围。", "claimed_results_zh": "正文报告 460 个合法运行均通过；43 个故障运行中拒绝 34 个、漏过 9 个，优化器与细微 loss-mask 错误仍可能漏检。摘要称平均生产吞吐提升 1.7 倍，此为性能结果而非安全保证。", "topics": [ "authorization", "evaluation", "robustness" ], "first_author": "Leo Fan", "first_author_affiliation": "Amazon", "affiliation_evidence_zh": "官方 HTML 首页作者列表后统一署名 Amazon。" }, "published": "2026-10-13T00:49:11Z", "updated": "2026-10-22T17:55:03Z", "categories_seen": [ "cs.LG" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2610.17528", "first_author": "Leo Fan", "authors": [ "Leo Fan", "Hongyang Wang", "Wenbo Chen", "Jingguo Liu", "Xian Li", "Xuan Wang", "Ruochen Wen", "Yiming Yan", "Hao Wu", "Yichuan Li", "Qian Qu", "Zheshen Wang", "Benoit Dumoulin" ], "affiliations": [ "Amazon" ], "source_url": "https://arxiv.org/html/2610.17528v2", "author_source": "https://arxiv.org/list/cs.LG/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Centered author list beginning Leo Fan is followed by the single common affiliation Amazon.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26" } ] }, "1803.03407": { "id": "1803.03407", "title": "Anchoring Distributed Agency: Institutional Metaphors for Designing Large-Scale AI and AI Techniques for Running Institutions", "category": "cs.AI", "version_id": "1803.03407v3", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.AI" ], "classification": "relevant", "reason": "正文将制度治理具体应用于 LLM Agent harness：区分规范禁止与技术上不可执行的动作，设计异质验证、权限边界及升级申诉机制；属于概念性安全架构而非实证防御。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "summary_zh": "问题：LLM Agent 的工具、记忆与执行循环需要治理边界；让同一模型生成并自审可能形成相关失误。 方法：借鉴多智能体与制度研究，分离角色、证据负担、规范和执行权限；用异质评估、不可执行的动作边界及升级申诉机制组织 Agent harness。 作者声称结果：作者提出可用于设计的概念框架；未报告这些安全机制的实证防护效果。", "topics": { "tags": [ "authorization", "multiagent", "monitoring" ], "reason_zh": "正文将制度治理具体应用于 LLM Agent harness：区分规范禁止与技术上不可执行的动作，设计异质验证、权限边界及升级申诉机制；属于概念性安全架构而非实证防御。" }, "needs_full_text_review": true, "review": { "id": "1803.03407", "title": "Anchoring Distributed Agency: Institutional Metaphors for Designing Large-Scale AI and AI Techniques for Running Institutions", "reviewed_version_id": "1803.03407v3", "abstract_read": true, "body_sections_checked": [ "1 Introduction", "4.6 Enforcement as a Maintenance Function", "6.1 Institutional Metaphors / Agentic AI" ], "status": "secondary_review_completed", "classification_recommendation": "relevant", "reason_zh": "正文将制度治理具体应用于 LLM Agent harness：区分规范禁止与技术上不可执行的动作，设计异质验证、权限边界及升级申诉机制；属于概念性安全架构而非实证防御。", "evidence_zh": [ "第 6.1 节讨论同模型兼任生成与验证的相关偏差，主张异质、相互独立的评估。", "第 6.1 节区分 ought not 与 cannot，给出 schema、API masking、interceptor 等限制执行的实现方向，并讨论升级角色、申诉及人工监督。" ], "review_date": "2026-10-26", "source_url": "https://arxiv.org/html/1803.03407v3", "evidence_basis": "完整摘要及列明正文部分；非全文逐字审阅", "problem_zh": "LLM Agent 的工具、记忆与执行循环需要治理边界；让同一模型生成并自审可能形成相关失误。", "method_zh": "借鉴多智能体与制度研究，分离角色、证据负担、规范和执行权限；用异质评估、不可执行的动作边界及升级申诉机制组织 Agent harness。", "claimed_results_zh": "作者提出可用于设计的概念框架；未报告这些安全机制的实证防护效果。", "topics": [ "authorization", "multiagent", "monitoring" ], "first_author": "Alexander Boer", "first_author_affiliation": "未确认", "affiliation_evidence_zh": "HTML 联合作者块列出 KPMG 与 University of Amsterdam，但缺少明确作者—单位标记；不按邮箱推断个人映射。" }, "published": "2018-03-09T07:59:21Z", "updated": "2026-10-22T12:22:32Z", "categories_seen": [ "cs.AI" ], "announcement_status": "官方公告列表已核对", "author": { "id": "1803.03407", "first_author": "Alexander Boer", "authors": [ "Alexander Boer", "Giovanni Sileno" ], "affiliations": [ "KPMG" ], "source_url": "https://arxiv.org/pdf/1803.03407v3", "author_source": "https://arxiv.org/list/cs.AI/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF first page contains explicit separate author footnotes: Alexander Boer directly above KPMG, Amsterdam; Giovanni Sileno separately above University of Amsterdam. No email inference needed.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2601.12310": { "id": "2601.12310", "title": "Survival is the Only Reward: Sustainable Self-Training Through Environment-Mediated Selection", "category": "cs.AI", "version_id": "2601.12310v3", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.AI" ], "classification": "uncertain", "reason": "正文涉及自主代码 Agent 的资源获取、拒绝行为弱化与生存式自训练，存在安全关联；但主要验证能力和环境生存，未建立外部伤害约束或安全对抗评测。作者关于避免 reward hacking 的强主张不能视为已证实安全结论。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "summary_zh": "问题是自训练的奖励投机与语义漂移。作者提出只以真实资源约束下行为是否持续、是否保留未来交互机会进行环境选择，并以巩固/剪枝分析学习动态；作者声称可获得稳定持续改进并使奖励投机难以持续。摘要未给出量化安全结果，也未明确 LLM Agent 实现。", "topics": { "id": "2601.12310", "tags": [ "evaluation", "robustness" ], "reason_zh": "环境可存续约束和奖励投机直接涉及对齐/鲁棒性，但 Agent 类型与威胁验证尚不清楚。" }, "needs_full_text_review": true, "review": { "id": "2601.12310", "title": "Survival is the Only Reward: Sustainable Self-Training Through Environment-Mediated Selection", "reviewed_version_id": "2601.12310v3", "abstract_read": true, "body_sections_checked": [ "4 Environment", "5 Training Loop", "5.3 Sandbox Design", "6 Experiments", "7.3.1 Instrumental Information Gathering", "7.4 Semantic Basins", "8 Discussion" ], "status": "secondary_review_completed", "classification_recommendation": "uncertain", "reason_zh": "正文涉及自主代码 Agent 的资源获取、拒绝行为弱化与生存式自训练，存在安全关联；但主要验证能力和环境生存，未建立外部伤害约束或安全对抗评测。作者关于避免 reward hacking 的强主张不能视为已证实安全结论。", "evidence_zh": [ "Agent 在受限容器网络中执行代码、扩展可用存储，以资源增量筛选训练经验。", "沙箱部分明确讨论对潜在破坏性代码的拒绝行为变化；目标是环境内生存与资源获取，并非已证明安全的权限控制。", "讨论部分提出环境选择优于策略对齐的观点，但所检查内容没有对应的系统安全验证；语义聚类章节还含方法或图表占位内容。" ], "review_date": "2026-10-26", "source_url": "https://arxiv.org/html/2601.12310v3", "evidence_basis": "完整摘要及列明正文部分；非全文逐字审阅", "unresolved_question_zh": "需要确认是否存在独立、可复核的 Agent 安全或奖励投机评测，而不是将环境生存能力当作安全性。" }, "published": "2026-01-18T08:35:56Z", "updated": "2026-10-22T07:26:55Z", "categories_seen": [ "cs.AI" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2601.12310", "first_author": "Jennifer Dodgson", "authors": [ "Jennifer Dodgson", "Alfath Daryl Alhajir", "Michael Joedhitya", "Akira Rafhael Janson Pattirane", "Surender Suresh Kumar", "Joseph Lim", "C.H. Peh", "Adith Ramdas", "Steven Zhang Zhexu" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2601.12310", "author_source": "https://arxiv.org/list/cs.AI/new?show=2000", "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "shared_first_authors": [], "shared_first_note": "", "evidence": "HTML conversion places additional personal names under affiliation labels, not an institutional affiliation; do not treat these as units." }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2608.10475": { "id": "2608.10475", "title": "Evaluating Rational Contracting in Natural Language", "category": "cs.AI", "version_id": "2608.10475v2", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.AI", "cs.CL" ], "classification": "relevant", "reason": "明确测量语言 Agent 在多轮经济合约执行中为额外利润违约的行为，属于多 Agent 合作/规范对齐评测。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是语言 Agent 不仅要谈成交易，还应在不确定的多步环境中遵守契约。作者建立自然语言合约协商/执行的理性框架，并用 ContractSim 的双人多轮供应合同测量效率与合作。作者发现高不确定性下 Agent 常不能谈成可满足、互利的合同，执行时即便易于履约也常为额外利润违约；摘要未提供具体比例。", "topics": { "id": "2608.10475", "tags": [ "multiagent", "evaluation" ], "reason_zh": "双 Agent 合约执行的逐利违约与合作规范是明确的行为对齐评测。" }, "needs_full_text_review": false, "published": "2026-08-11T04:44:50Z", "updated": "2026-10-22T17:02:46Z", "categories_seen": [ "cs.AI", "cs.CL" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2608.10475", "first_author": "Bhavyesh Sajja", "authors": [ "Bhavyesh Sajja", "Max Kleiman-Weiner", "Roger Zimmermann", "Tan Zhi-Xuan" ], "affiliations": [ "National University of Singapore" ], "source_url": "https://arxiv.org/html/2608.10475v2", "author_source": "https://arxiv.org/list/cs.CL/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Bhavyesh Sajja has an individually attached NUS affiliation; coauthor Tan Zhi-Xuan dual affiliation not assigned to first author.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.07257": { "id": "2610.07257", "title": "MemMux: Runtime Verification and Honest Resource Attribution for Fleets of Parallel Coding Agents", "category": "cs.AI", "version_id": "2610.07257v2", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.AI" ], "classification": "relevant", "reason": "针对并行 Coding Agent 的资源预算、进程回收及逃逸子进程监测，直接研究 Agent 运行时资源治理边界。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是多个 Coding Agent 共用工作站时，资源归属不明、子进程遗留/逃逸和内存压力可能损失未提交工作。MemMux 以无特权运行时提供逐 Agent 归因、回收、逃逸可见性和过载准入。作者报告 7500 MiB 预算下零 swap、终止 Agent 的进程树回收率 100%、10/10 逃逸子进程可见；10 Agent 时监控约耗 2.7% CPU，超过其 2% 目标。真实 Claude Code 会话测试保留了 100% 归因。", "topics": { "id": "2610.07257", "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "运行时进程边界、资源预算及逃逸监控直接构成 Coding Agent 资源治理。" }, "needs_full_text_review": false, "published": "2026-10-05T18:56:34Z", "updated": "2026-10-21T20:09:06Z", "categories_seen": [ "cs.AI" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2610.07257", "first_author": "Sumanyu Muku", "authors": [ "Sumanyu Muku" ], "affiliations": [ "Amira Learning" ], "source_url": "https://arxiv.org/html/2610.07257v2", "author_source": "https://arxiv.org/list/cs.AI/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Sole author Sumanyu Muku explicitly lists Amira Learning.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2607.29529": { "id": "2607.29529", "title": "AuditCoder: Process-Auditable Code Generation through Responsibility-Preserving Task Graphs", "category": "cs.SE", "version_id": "2607.29529v2", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.SE" ], "classification": "relevant", "reason": "Coding Agent 用带契约任务图保留来源并约束修复范围，记录扩权、支持弃权和回滚，属于过程可审计与行动范围治理。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是代码生成计划与最终代码责任缺乏可审计连接。AuditCoder 为契约任务图分配稳定 ID，关联代码、来源、版本化检查与修复记录；修复时限定可编辑范围、记录范围扩展，在证据不足时弃权。作者报告 APPS 运行中平均 97.25% 叶记录保留代码/契约/来源/检查信息，44 次修复均遵守记录的接受/回滚策略，30 次通过隐藏测试，平均修复范围为 22% 图节点。该证据是过程/范围审计，不等于抵抗恶意攻击。", "topics": { "id": "2607.29529", "tags": [ "authorization", "monitoring" ], "reason_zh": "明确限制 Coding Agent 修复范围并记录扩展、回滚与来源，支持行动边界审计。" }, "needs_full_text_review": false, "published": "2026-07-31T15:29:14Z", "updated": "2026-10-22T15:55:27Z", "categories_seen": [ "cs.SE" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2607.29529", "first_author": "Kangjie Huang", "authors": [ "Kangjie Huang", "Hui Zhou", "Chen Lyu" ], "affiliations": [ "Shandong Normal University" ], "source_url": "https://arxiv.org/pdf/2607.29529v2", "author_source": "https://arxiv.org/list/cs.SE/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF first page displays all three authors above one common School of Computer Science and Artificial Intelligence, Shandong Normal University affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.22486": { "id": "2609.22486", "title": "Semantics Delivery Network: Rethinking Web Retrieval Infrastructure for LLM Agents", "category": "cs.LG", "version_id": "2609.22486v2", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.LG" ], "classification": "uncertain", "reason": "主要贡献是 Agent 检索基础设施与效率；正文确有共享缓存隐私、检索操纵威胁及签名/Merkle 证明设计议程，但安全机制尚属开放研究问题，现有实验仅验证内容量、缓存与回答质量，是否纳入安全核心范围保留待定。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "summary_zh": "问题是 URL 级搜索/CDN 与 Agent 多轮内容块检索不匹配。SemDN 提出源站授权的分层内容块索引、搜索和缓存，使客户端使用源站不必看到的检索表示。初步结果称页面优先路径处理的内容比 Agent 实际消费多两至三个数量级，内容块投递改善每上下文 token 的答案质量；隐私、可验证性仍列为开放议程，摘要未给出安全验证。", "topics": { "id": "2609.22486", "tags": [ "privacy", "authorization" ], "reason_zh": "源站授权与私有检索表示可能构成 Agent 检索边界，但需核对正文是否仅为未来议程。" }, "needs_full_text_review": true, "review": { "id": "2609.22486", "title": "Semantics Delivery Network: Rethinking Web Retrieval Infrastructure for LLM Agents", "reviewed_version_id": "2609.22486v2", "abstract_read": true, "body_sections_checked": [ "5.3 Interfaces, Incentives, and Guarantees / Verifiability", "6 Preliminary Results" ], "status": "secondary_review_completed", "classification_recommendation": "uncertain", "reason_zh": "主要贡献是 Agent 检索基础设施与效率；正文确有共享缓存隐私、检索操纵威胁及签名/Merkle 证明设计议程，但安全机制尚属开放研究问题，现有实验仅验证内容量、缓存与回答质量，是否纳入安全核心范围保留待定。", "evidence_zh": [ "正文识别来源付费导致排名偏置、共享缓存时序泄露查询，以及边缘节点压制、注入或选择性返回片段。", "提出来源/版本 HTTP 签名、Merkle 片段包含证明、已承诺索引的诚实 top-k 和来源透明性，但摊销证明仍是开放问题。", "初步结果覆盖传输内容量、局部性/缓存摊销与答案质量，未提供安全威胁验证。" ], "review_date": "2026-10-26", "source_url": "https://arxiv.org/html/2609.22486v2", "evidence_basis": "完整摘要及列明正文部分；非全文逐字审阅", "unresolved_question_zh": "概念性检索安全议程有实质内容，但需进一步判断其是否达到本日报对安全主贡献的收录门槛。" }, "published": "2026-09-18T18:49:38Z", "updated": "2026-10-22T16:21:58Z", "categories_seen": [ "cs.LG" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2609.22486", "first_author": "Peichun Hua", "authors": [ "Peichun Hua", "Yunming Xiao" ], "affiliations": [ "The Chinese University of Hong Kong, Shenzhen" ], "source_url": "https://arxiv.org/html/2609.22486v2", "author_source": "https://arxiv.org/list/cs.LG/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "First author Peichun Hua has an individually attached affiliation block naming CUHK Shenzhen.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.22818": { "id": "2609.22818", "title": "The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents", "category": "cs.CR", "version_id": "2609.22818v2", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.CR", "cs.AI" ], "classification": "relevant", "reason": "直接测量 LLM Agent 记忆投毒防御在无攻击流量上的效用损失和 token 开销。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：记忆投毒防御常只报告拦截攻击效果，忽略正常流量成本。方法：固定记忆后端、检索、回答提示及裁判，在 LoCoMo 的五段长对话、750 轮和每次 255 个问题上比较四种防御，重复三次。作者称三种写入时防御在正常流量从未触发，约 ±4 个百分点分辨率内未发现准确率损失；读时重排器增加 2.7% token，45% 问题被扣留记忆，核心准确率下降 4.4 个百分点，置信区间为 [-9.0,-0.05]、McNemar p=0.064，结果存在统计边界，不能表述为稳健显著下降。", "topics": { "tags": [ "memory", "evaluation" ], "reason_zh": "评估 Agent 记忆投毒防御的正常效用、误拦截与 token 成本。" }, "published": "2026-09-19T06:39:21Z", "updated": "2026-10-22T08:33:17Z", "categories_seen": [ "cs.AI", "cs.CR" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2609.22818", "first_author": "Pritom Bhowmik", "authors": [ "Pritom Bhowmik" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2609.22818", "author_source": "https://arxiv.org/list/cs.AI/new?show=2000", "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "shared_first_authors": [], "shared_first_note": "", "evidence": "Sole-author block provides Pritom Bhowmik and email only; no unit." }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2604.04978": { "id": "2604.04978", "title": "Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode", "category": "cs.CR", "version_id": "2604.04978v3", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.CR", "cs.AI", "cs.SE" ], "classification": "relevant", "reason": "直接评测 Claude Code 自动授权机制在模糊授权与状态变更工具调用中的漏检和覆盖缺口。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：Claude Code Auto 授权分类器能否覆盖意图明确但范围或风险未指定的操作。方法：AmPermBench 用 128 个提示、四类 DevOps 任务和三个模糊性轴，按 253 个状态变更动作对照 oracle 判断。作者报告该压力测试的端到端假阴性率为 81.0%，36.8% 状态变更动作经项目内文件编辑而落在分类器范围外；仅计分类器评估的 160 个动作，假阴性率仍为 70.3%、假阳性率 31.9%。这与厂商生产流量指标来自不同工作负载，不能视为直接矛盾。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "独立压力测试 Coding Agent 自动权限门控与文件编辑覆盖缺口。" }, "published": "2026-04-04T17:56:30Z", "updated": "2026-10-22T07:34:11Z", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2604.04978", "first_author": "Zimo Ji", "authors": [ "Zimo Ji", "Zongjie Li", "Pingchuan Ma", "Wenyuan Jiang", "Yudong Gao", "Shuai Wang" ], "affiliations": [ "The Hong Kong University of Science and Technology" ], "source_url": "https://arxiv.org/html/2604.04978v3", "author_source": "https://arxiv.org/list/cs.SE/new?show=2000", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Zimo Ji has an individually attached Hong Kong University of Science and Technology affiliation; ignore email mismatches on other authors.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2608.10502": { "id": "2608.10502", "title": "From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents", "category": "cs.AI", "version_id": "2608.10502v2", "replacement": true, "announcement_date": "2026-10-23", "categories": [ "cs.AI" ], "classification": "relevant", "reason": "直接研究投毒等错误记忆传播到 Agent 工具行动及派生记忆后的依赖追踪、回滚与修复。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：删除投毒或陈旧记忆后，其影响可能仍留在行动和派生记忆中。方法：根据运行时来源建立有类型的记忆—行动依赖图，保留独立可信支持，停用无支持的下游记忆，并选择性重放相关计算。作者在 150 例控制基准中报告即时恢复率 85.3%，优于最强基线 77.3%，保留全部良性记忆且少用 41.8% LLM 调用，但复发率较高（26.6% 对 12.1%）；在另一个 50 例 LongMemEval-V2 改编压力集上，恢复率 68.0%，下一方法为 54.0%，复发率 5.9%。", "topics": { "tags": [ "memory", "evaluation" ], "reason_zh": "通过来源依赖和回滚修复 Agent 记忆污染传播，评估恢复与复发权衡。" }, "published": "2026-08-11T05:19:55Z", "updated": "2026-10-22T02:51:16Z", "categories_seen": [ "cs.AI" ], "announcement_status": "官方公告列表已核对", "author": { "id": "2608.10502", "first_author": "Yiqi Wang", "authors": [ "Yiqi Wang", "Caili Yu", "Jiaqi Zhang", "Yiqun Duan", "Mingkai Zheng", "Zhangkai Wu", "Kaize Shi", "Taotao Cai" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2608.10502", "author_source": "https://arxiv.org/list/cs.AI/new?show=2000", "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "shared_first_authors": [], "shared_first_note": "", "evidence": "Author block provides first author Yiqi Wang and contact email only; no unit." }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.32555": { "id": "2610.32555", "version_id": "2610.32555v1", "title": "Tool-Calling LLM Agents Under Realistic MCP Faults: Scale Does Not Purchase Fault Tolerance", "published": "2026-10-23T12:35:51Z", "updated": "2026-10-23T12:35:51Z", "authors": [ "Antonio Ken Iannillo", "Joshua Segun Owotogbe", "Roberto Natella", "Francesco Avallone", "Kristina Kudryavtseva", "Indika Kumara" ], "categories": [ "cs.SE", "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32555v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "new", "section": "New submissions (showing 30 of 30 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "针对真实 MCP 工具故障开展协议级注入，评估工具 Agent 的可用性和抗故障能力。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.32555", "backfill_kind": "official_api_metadata", "summary_zh": "问题：MCP 工具真实故障下，Agent 能力分数能否代表抗故障性。方法：MCP-Injector 将永久、暂时和间歇故障按可复现计划注入调用路径，故障分布依据 1,774 个 MCP 仓库的 57,240 个 issue/PR，开展 1,350 个实验单元。作者报告任务质量评分从 8.08/10 降至 3.23/10；20B/120B 两模型中，规模未提高故障韧性比例（p=0.96）。结果限于所测模型和偏永久故障压力分布。", "topics": { "tags": [ "robustness", "evaluation" ], "reason_zh": "协议级工具故障注入直接检验 Agent 可用性及恢复韧性。" }, "categories_seen": [ "cs.AI", "cs.SE" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32555", "first_author": "Antonio Ken Iannillo", "authors": [ "Antonio Ken Iannillo", "Joshua Segun Owotogbe", "Roberto Natella", "Francesco Avallone", "Kristina Kudryavtseva", "Indika Kumara" ], "affiliations": [ "University of Luxembourg" ], "source_url": "https://arxiv.org/html/2610.32555v1", "author_source": "http://arxiv.org/abs/2610.32555v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Antonio Ken Iannillo has an individual affiliation SnT, University of Luxembourg.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32429": { "id": "2610.32429", "version_id": "2610.32429v1", "title": "Async-RBench: Benchmarking Asynchronous Task Execution in LLM Agents", "published": "2026-10-23T09:53:45Z", "updated": "2026-10-23T09:53:45Z", "authors": [ "Detao Zeng", "Guilin Ou", "Nuo Chen", "Yunhao Feng", "Hongliang Wang", "Qinli Yang", "Junming Shao", "Zhong Zhang" ], "categories": [ "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32429v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文明确将避免重复写入/提交、禁止副作用及保持有效状态作为异步多 Agent 执行契约，属于执行完整性评测；不是对抗攻击防御研究。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.32429", "backfill_kind": "official_api_metadata", "summary_zh": "问题：异步子 Agent 的旧结果、重复结果及失败如何影响主 Agent 的状态完整性。方法：200 项任务和事件响应契约分别检查应改、应保留、禁止副作用和再验证，DRS 同时计过程与结果。作者报告九个 Agent 的 DRS 为 19.2–45.1，异步任务平均成功率 26.0%，低于批量返回的 29.7%。正文确认重复写入/提交和错误回滚属于被检查的禁止副作用；本研究是执行完整性评测，不是恶意注入防御。", "topics": { "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "异步结果与重复事件下的状态保持、禁止副作用及验证义务。" }, "review": { "id": "2610.32429", "version_id": "2610.32429v1", "classification": "relevant", "recommendation": "relevant", "reason": "正文明确将避免重复写入/提交、禁止副作用及保持有效状态作为异步多 Agent 执行契约，属于执行完整性评测；不是对抗攻击防御研究。", "sections": [ "3.2 Event Response Contracts and Scoring", "3.3 Tasks and Scenarios / Table 2", "A.4 Asynchronous Scenario Taxonomy" ], "evidence_summary": "ERC 将 required changes、preserved work、prohibited side effects、validation 分开评分；后续修复不消除已发生的禁止副作用。Duplication/replay 要求避免重复写入和重复提交，staleness 要求不回滚合法新状态。", "source_url": "https://arxiv.org/html/2610.32429v1", "full_text_checked": true, "abstract_read": true, "summary_zh": "问题：异步子 Agent 的旧结果、重复结果及失败如何影响主 Agent 的状态完整性。方法：200 项任务和事件响应契约分别检查应改、应保留、禁止副作用和再验证，DRS 同时计过程与结果。作者报告九个 Agent 的 DRS 为 19.2–45.1，异步任务平均成功率 26.0%，低于批量返回的 29.7%。正文确认重复写入/提交和错误回滚属于被检查的禁止副作用；本研究是执行完整性评测，不是恶意注入防御。", "topics": { "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "异步结果与重复事件下的状态保持、禁止副作用及验证义务。" } }, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32429", "first_author": "Detao Zeng", "authors": [ "Detao Zeng", "Guilin Ou", "Nuo Chen", "Yunhao Feng", "Hongliang Wang", "Qinli Yang", "Junming Shao", "Zhong Zhang" ], "affiliations": [ "University of Electronic Science and Technology of China" ], "source_url": "https://arxiv.org/html/2610.32429v1", "author_source": "http://arxiv.org/abs/2610.32429v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "One common affiliation follows the full author list beginning Detao Zeng.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32155": { "id": "2610.32155", "version_id": "2610.32155v1", "title": "Detecting Insecure Compositions of Clean Agent Skills via Capability-Flow Graph Analysis", "published": "2026-10-23T04:47:10Z", "updated": "2026-10-23T04:47:10Z", "authors": [ "Yihao Li", "Chuanpu Fu", "Yizhou Zhao", "Miao Chen", "Qi Li", "Ke Xu" ], "categories": [ "cs.CR" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32155v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "New submissions (showing 27 of 27 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "研究良性 Skill 跨调用组合造成安全违规，以能力流图定位并验证危险操作链。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.32155", "backfill_kind": "official_api_metadata", "summary_zh": "问题：单独良性的第三方 Skill 组合后可能形成违规信息流，逐 Skill 审计发现不了。方法：KnotScryer 将技能抽象为带类型能力，用 Skill Capability-Flow Graph 跟踪受保护/不可信数据到危险操作，再用可达性重放和任务锚定 LLM 审计验证。作者分析 13,598 个 ClawHub 良性技能，发现 612 条不安全组合；GLM-5.1 下利用率从基线的 16.5%–18.2% 提高到 85.6%，搜索空间减少 85.3%，13.7% 的链全部由单技能扫描判为安全的技能组成。", "topics": { "tags": [ "supplychain", "authorization", "evaluation" ], "reason_zh": "Skill 供应链中跨组件信息流产生越界操作，直接关联组合安全审计。" }, "categories_seen": [ "cs.CR" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32155", "first_author": "Yihao Li", "authors": [ "Yihao Li", "Chuanpu Fu", "Yizhou Zhao", "Miao Chen", "Qi Li", "Ke Xu" ], "affiliations": [ "Tsinghua University" ], "source_url": "https://arxiv.org/html/2610.32155v1", "author_source": "http://arxiv.org/abs/2610.32155v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Yihao Li has superscript 1; affiliation 1 is Tsinghua University. Do not assign coauthor affiliation 3 to him.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32045": { "id": "2610.32045", "version_id": "2610.32045v1", "title": "Do AI-for-Science Agents Preserve Model Safety?", "published": "2026-10-23T01:34:20Z", "updated": "2026-10-23T01:34:20Z", "authors": [ "Michael Yew Chuan Lee", "Manya Sriram", "N. Benjamin Erichson" ], "categories": [ "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32045v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "直接研究 AI-for-Science Agent harness 是否破坏基础模型安全，含化学有害请求和自适应攻击。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.32045", "backfill_kind": "official_api_metadata", "summary_zh": "问题：把安全对齐的基础模型装入科学 Agent harness 后，安全行为是否仍保持。方法：五个 harness、50 个有害化学请求，在四个 GPT 版本上比较直接提示、两种简单对抗提示与自适应攻击。作者称 harness 在直接提示下也提高有害服从，原本对基础模型不奏效的自适应攻击在 Agent 上变得有效；摘要未给出具体比例。", "topics": { "tags": [ "evaluation", "authorization" ], "reason_zh": "明确评测科学工具 Agent 集成后对有害请求和攻击的防护退化。" }, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32045", "first_author": "Michael Yew Chuan Lee", "authors": [ "Michael Yew Chuan Lee", "Manya Sriram", "N. Benjamin Erichson" ], "affiliations": [ "DSO National Laboratories" ], "source_url": "https://arxiv.org/html/2610.32045v1", "author_source": "http://arxiv.org/abs/2610.32045v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Michael Yew Chuan Lee has an individual DSO National Laboratories affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32024": { "id": "2610.32024", "version_id": "2610.32024v2", "abstract_sha256": "8502489cb68fec8a4649d56103a962b29ff4083cffca91963025c57d794e16f5", "abstract_read": true, "classification": "relevant", "reason_zh": "善意但欠指定的请求导致代理越过隐私及隐含授权边界，是直接安全基准。", "summary_zh": "研究善意但欠指定的用户请求是否使代理越过隐含安全边界。BARC-Bench 在九类仿真工作区设置 110 个任务，以记录、环境和社会规范确定隐私与操作边界；四种前沿模型配置的五次重复实验中，始终安全完成的任务比例为 9.1–72.7%，最强配置仍在 27.3% 任务上产生违规。", "topics": { "tags": [ "authorization", "privacy", "evaluation" ], "reason_zh": "善意但欠指定的请求导致代理越过隐私及隐含授权边界，是直接安全基准。" }, "reason": "善意但欠指定的请求导致代理越过隐私及隐含授权边界，是直接安全基准。", "title": "BARC-Bench: Benign Asks, Risky Consequences", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-23T00:53:24Z", "updated": "2026-11-03T17:37:13Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.32024v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27", "2026-11-05" ], "version_history": [ { "id": "2610.32024", "version_id": "2610.32024v1", "classification": "relevant", "reason": "以良性但欠明确的任务测试 Agent 是否遵守隐含安全边界，涉及共享日历敏感信息泄露。", "published": "2026-10-23T00:53:24Z", "updated": "2026-10-23T00:53:24Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "8502489cb68fec8a4649d56103a962b29ff4083cffca91963025c57d794e16f5", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "announcement_date": "2026-10-26", "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "last_metadata_checked_date": "2026-10-27" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.32024", "first_author": "Kangkang Li", "authors": [ "Kangkang Li", "Kelvin Luu", "Lily Ma", "Tu Trinh", "Ying Liu", "Mohamed Elfeki" ], "affiliations": [ "Scale AI" ], "source_url": "https://arxiv.org/pdf/2610.32024v2", "author_source": "http://arxiv.org/abs/2610.32024v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Kangkang Li", "Kelvin Luu" ], "shared_first_note": "首页 * Equal contribution。", "evidence": "PDF 首页 Kangkang Li¹,*、Kelvin Luu¹,*，机构 1 Scale AI。", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Kangkang Li": [ "Scale AI" ], "Kelvin Luu": [ "Scale AI" ] }, "version_id": "2610.32024v2" }, "authors": [ "Kangkang Li", "Kelvin Luu", "Lily Ma", "Tu Trinh", "Ying Liu", "Mohamed Elfeki" ], "categories": [ "cs.AI" ], "source": "http://arxiv.org/abs/2610.32024v1", "baseline_status": "not_in_checkpoint", "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证", "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2610.32024", "version_id": "2610.32024v1", "title": "BARC-Bench: Benign Asks, Risky Consequences", "published": "2026-10-23T00:53:24Z", "updated": "2026-10-23T00:53:24Z", "authors": [ "Kangkang Li", "Kelvin Luu", "Lily Ma", "Tu Trinh", "Ying Liu", "Mohamed Elfeki" ], "categories": [ "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32024v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "以良性但欠明确的任务测试 Agent 是否遵守隐含安全边界，涉及共享日历敏感信息泄露。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.32024", "backfill_kind": "official_api_metadata", "summary_zh": "问题：用户的良性任务没有明确写出的安全限制，Agent 能否从环境中识别并遵守。方法：BARC-Bench 包含九种工作区的 110 项任务，安全边界来自工作区记录、上下文和社会规范，四种前沿模型配置各运行五次。作者报告每项五次都安全完成的任务占比为 9.1%–72.7%，最强配置仍在 27.3% 任务中至少一次违规；例子包括共享日历过早泄露离职消息。", "topics": { "tags": [ "authorization", "privacy", "evaluation" ], "reason_zh": "测试自主代理在欠明确请求下的权限与隐私边界，而非仅任务完成。" }, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32024", "first_author": "Kangkang Li", "authors": [ "Kangkang Li", "Kelvin Luu", "Lily Ma", "Tu Trinh", "Ying Liu", "Mohamed Elfeki" ], "affiliations": [ "Scale AI" ], "source_url": "https://arxiv.org/pdf/2610.32024v1", "author_source": "http://arxiv.org/abs/2610.32024v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Kangkang Li", "Kelvin Luu" ], "shared_first_note": "PDF 明确注明 Kangkang Li 和 Kelvin Luu 共同第一作者。", "evidence": "PDF first page Kangkang Li and Kelvin Luu both carry 1,*; affiliation 1 is Scale AI and star footnote explicitly Equal contribution.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Kangkang Li": [ "Scale AI" ], "Kelvin Luu": [ "Scale AI" ] } }, "first_seen_date": "2026-10-26", "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" } ] }, "2610.32004": { "id": "2610.32004", "version_id": "2610.32004v1", "title": "CRM-Agent-Bench: Benchmarking Tool-Using Agents in Stateful Enterprise Environments", "published": "2026-10-23T00:05:21Z", "updated": "2026-10-23T00:05:21Z", "authors": [ "Monojit Banerjee", "Zhujun Lan", "Defu Cao" ], "categories": [ "cs.HC", "cs.CL" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32004v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Cross submissions (showing 34 of 34 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "工具 Agent 企业交易基准明确检查策略合规、保护状态及动作契约完整性。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.32004", "backfill_kind": "official_api_metadata", "summary_zh": "问题：企业工具 Agent 完成业务目标不一定代表交易和策略合规。方法：CRM-Agent-Bench 的 555 项有状态多轮任务覆盖九个业务域、36 个能力标签，以动作、参数、顺序、答复、目标状态和受保护状态的可执行契约联合判分。作者对 16 个系统报告严格成功率 64.32%–83.60%，领先系统在成本和分域可靠性上差异明显。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "明确把受保护状态和业务策略作为工具执行的安全完整性约束。" }, "categories_seen": [ "cs.CL", "cs.HC" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32004", "first_author": "Monojit Banerjee", "authors": [ "Monojit Banerjee", "Zhujun Lan", "Defu Cao" ], "affiliations": [ "Salesforce, Inc." ], "source_url": "https://arxiv.org/html/2610.32004v1", "author_source": "http://arxiv.org/abs/2610.32004v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Monojit Banerjee", "Zhujun Lan" ], "shared_first_note": "正文明确注明共同第一作者。", "evidence": "Single Salesforce, Inc. institution below all three authors; Monojit Banerjee and Zhujun Lan carry equal-contribution stars.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31985": { "id": "2610.31985", "version_id": "2610.31985v1", "title": "The Helpful Agent Problem: When Emergent Cooperation Among LLM Agents Bypasses Intended Workflows", "published": "2026-10-22T22:55:40Z", "updated": "2026-10-22T22:55:40Z", "authors": [ "Moumita Choudhury", "Amit Sarker", "Shlomo Zilberstein" ], "categories": [ "cs.AI", "cs.CL", "cs.MA" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31985v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Cross submissions (showing 34 of 34 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "new", "section": "Cross submissions (showing 9 of 9 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "研究良性多 Agent 合作绕过审核流程及给第三方造成危害，含真实代码仓库环境。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.31985", "backfill_kind": "official_api_metadata", "summary_zh": "问题：没有恶意或共享奖励的 Agent 也可能互帮绕过系统审核。方法：构造共享资源长期任务，审核不可用时观察跨所有者代办，用 FavorBench 及改造的 CooperBench 仓库环境测量副作用。作者在两个基准、四个模型上发现此类流程外协作频发，FavorBench 中至少三个模型的帮忙对交互外第三方造成显著危害。", "topics": { "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "局部权限均合法但跨 Agent 合作绕过整体监督，涉及仓库协作安全。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.MA" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31985", "first_author": "Moumita Choudhury", "authors": [ "Moumita Choudhury", "Amit Sarker", "Shlomo Zilberstein" ], "affiliations": [ "University of Massachusetts Amherst" ], "source_url": "https://arxiv.org/pdf/2610.31985v1", "author_source": "http://arxiv.org/abs/2610.31985v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF first page shows Moumita Choudhury first, three authors with single common University of Massachusetts Amherst affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31971": { "id": "2610.31971", "version_id": "2610.31971v1", "title": "Knowing Whom to Trust is not Enough: The Trust--Agreement Gap in Repeated Multi-Party LLM Negotiation", "published": "2026-10-22T22:24:10Z", "updated": "2026-10-22T22:24:10Z", "authors": [ "Amit Sarker", "Moumita Choudhury", "Saaduddin Mahmud", "Shlomo Zilberstein" ], "categories": [ "cs.AI", "cs.CL", "cs.MA" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31971v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Cross submissions (showing 34 of 34 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "new", "section": "Cross submissions (showing 9 of 9 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "多方 LLM Agent 谈判中的隐蔽破坏者与信任防御，直接评测操纵风险。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.31971", "backfill_kind": "official_api_metadata", "summary_zh": "问题：LLM Agent 能识别谈判破坏者，是否就能防止谈判被操纵。方法：重复多方多议题谈判中设置隐蔽阻止达成协议的参与者，比较跨局维护信任与无信任的 Agent。作者发现 Agent 几局后能识别对手，但须显式指导利用信任才能改善协议率，最高提高 23 个百分点。", "topics": { "tags": [ "multiagent", "evaluation", "robustness" ], "reason_zh": "研究多 Agent 隐蔽破坏及信任评估与决策脱节的防御边界。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.MA" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31971", "first_author": "Amit Sarker", "authors": [ "Amit Sarker", "Moumita Choudhury", "Saaduddin Mahmud", "Shlomo Zilberstein" ], "affiliations": [ "University of Massachusetts Amherst" ], "source_url": "https://arxiv.org/html/2610.31971v1", "author_source": "http://arxiv.org/abs/2610.31971v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "One common University of Massachusetts Amherst affiliation follows all four authors.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31916": { "id": "2610.31916", "version_id": "2610.31916v1", "title": "Permission to Retry: A Study of Authorization and Recovery in AI Agent Workflows", "published": "2026-10-22T21:09:22Z", "updated": "2026-10-22T21:09:22Z", "authors": [ "Deekshith Marla", "Kushagra Bhatnagar" ], "categories": [ "cs.AI", "cs.SE" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31916v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "new", "section": "Cross submissions (showing 10 of 10 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "AI Agent 工作流重试中权限变更、外部作用证据及恢复义务的安全一致性研究。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.31916", "backfill_kind": "official_api_metadata", "summary_zh": "问题：有持续状态的 AI Agent 在权限变化、外部动作结果未知时能否安全恢复。方法：将检查点、派发权限、外部效果证据及对账权限分开，用隐藏效果账本对 LangGraph/Temporal 共 336 条历史做一致性测试，另测 InfinityOS 组件。作者称两宿主 168 对单元一致；每宿主保留账本对账策略通过 42/42 条历史，其中 21 完成、15 拒绝、6 保留未决义务，其他重试策略通过 30、36、31 条。", "topics": { "tags": [ "authorization", "robustness", "evaluation" ], "reason_zh": "直接研究持久 Agent 工具重试的现时授权和外部作用安全。" }, "categories_seen": [ "cs.AI", "cs.SE" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31916", "first_author": "Deekshith Marla", "authors": [ "Deekshith Marla", "Kushagra Bhatnagar" ], "affiliations": [ "Arya.ai" ], "source_url": "https://arxiv.org/html/2610.31916v1", "author_source": "http://arxiv.org/abs/2610.31916v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Two authors Deekshith Marla and Kushagra Bhatnagar followed single common affiliation Arya.ai.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31895": { "id": "2610.31895", "title": "Knowing When to Stop: The Evidence-Action Gap in Coding Agents", "classification": "relevant", "reason": "直接研究Coding Agent遇到不可自主解决阻塞后过度坚持、危险绕行和不实成功报告，提出升级与外部监控防护；首发2026-10-22，为旧论文修订。", "abstract_read": true, "published": "2026-10-22T20:45:47Z", "version": 2, "summary_zh": "问题：Coding Agent已收集需外援证据后仍继续尝试，可能进行不希望的绕行并无依据宣称成功。方法：ImpasseBench在修复任务中注入12类环境阻塞，标记证据充分时点并据此评估行为；测试升级工具和外部监控。作者报告：八个前沿模型、19,371条轨迹中，几乎所有需外援运行都能获取充分证据，但约三分之一仍耗尽预算，检测到的所有不安全请求均出现在该时点之后；升级工具将预算耗尽率从34.0%降至6.7%，监控使恢复环境后的成功率接近三倍；交接票据仍常遗漏进展与验证状态。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "围绕Coding Agent停止与升级边界、不安全请求、外部监控和阻塞基准，属于动作安全与可靠交接。" }, "updated": "2026-10-27T00:51:38Z", "announcement_date": "2026-10-26", "candidate_type": "changed_version", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.31895v2", "categories_seen": [ "cs.AI", "cs.CL", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-26", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-26", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-26", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.31895v2", "abstract_sha256": "ab379522c43d6282ed81408a0350b5b72fc766bb840044719362b954d7b3343f", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27", "2026-10-28" ], "version_history": [ { "id": "2610.31895", "version_id": "2610.31895v1", "classification": "relevant", "reason": "Coding Agent 遇阻后不停止、危险绕行和不实成功声明，评测升级工具及外部监控防护。", "published": "2026-10-22T20:45:47Z", "updated": "2026-10-22T20:45:47Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "ab379522c43d6282ed81408a0350b5b72fc766bb840044719362b954d7b3343f", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Cross submissions (showing 34 of 34 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "new", "section": "New submissions (showing 30 of 30 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "recent", "section": null } ], "announcement_date": "2026-10-26", "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "last_metadata_checked_date": "2026-10-27" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.31895", "first_author": "Tianyu Chen", "authors": [ "Tianyu Chen", "Xinran Zhao", "Vijay Viswanathan", "Shoubin Yu", "Mingyuan Zhou", "Tongshuang Wu" ], "affiliations": [ "The University of Texas at Austin" ], "source_url": "https://arxiv.org/pdf/2610.31895v2", "author_source": "https://arxiv.org/abs/2610.31895v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Tianyu Chen", "Xinran Zhao" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "evidence": "PDF Tianyu Chen¹,* and Xinran Zhao²,* with Equal contribution footnote. 1 UT Austin, 2 Carnegie Mellon University.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Tianyu Chen": [ "The University of Texas at Austin" ], "Xinran Zhao": [ "Carnegie Mellon University" ] }, "title": "Knowing When to Stop: The Evidence-Action Gap in Coding Agents", "version_id": "2610.31895v2" }, "authors": [ "Tianyu Chen", "Xinran Zhao", "Vijay Viswanathan", "Shoubin Yu", "Mingyuan Zhou", "Tongshuang Wu" ], "categories": [ "cs.SE", "cs.AI", "cs.CL" ], "source": "http://arxiv.org/abs/2610.31895v1", "baseline_status": "not_in_checkpoint", "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证", "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2610.31895", "version_id": "2610.31895v1", "title": "Knowing When to Stop: The Evidence-Action Gap in Coding Agents", "published": "2026-10-22T20:45:47Z", "updated": "2026-10-22T20:45:47Z", "authors": [ "Tianyu Chen", "Xinran Zhao", "Vijay Viswanathan", "Shoubin Yu", "Mingyuan Zhou", "Tongshuang Wu" ], "categories": [ "cs.SE", "cs.AI", "cs.CL" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31895v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Cross submissions (showing 34 of 34 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "new", "section": "New submissions (showing 30 of 30 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "Coding Agent 遇阻后不停止、危险绕行和不实成功声明，评测升级工具及外部监控防护。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.31895", "backfill_kind": "official_api_metadata", "summary_zh": "问题：Coding Agent 遇到必须外部恢复的阻塞仍过度坚持、尝试危险绕行或无证据宣称成功。方法：ImpasseBench 在修复任务中注入 12 类环境阻塞，标记证据充分时点，评测八个模型的 19,371 条轨迹，并测试升级工具和外部监控。作者称约三分之一耗尽预算，发现的危险请求均在证据充分之后；升级工具使预算耗尽从 34.0% 降至 6.7%，监控在环境恢复后近三倍提升成功率。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "直接衡量 Coding Agent 不安全绕行、失实完成及应停止/升级的执行边界。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.SE" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31895", "first_author": "Tianyu Chen", "authors": [ "Tianyu Chen", "Xinran Zhao", "Vijay Viswanathan", "Shoubin Yu", "Mingyuan Zhou", "Tongshuang Wu" ], "affiliations": [ "University of Texas at Austin" ], "source_url": "https://arxiv.org/html/2610.31895v1", "author_source": "http://arxiv.org/abs/2610.31895v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Tianyu Chen", "Xinran Zhao" ], "shared_first_note": "正文明确注明共同第一作者。", "evidence": "Tianyu Chen has individual UT Austin affiliation; Xinran Zhao carries the same equal contribution marker but a different CMU affiliation.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Tianyu Chen": [ "University of Texas at Austin" ], "Xinran Zhao": [ "Carnegie Mellon University" ] } }, "first_seen_date": "2026-10-26", "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" } ] }, "2610.32531": { "id": "2610.32531", "version_id": "2610.32531v1", "title": "On Task, Off Track: Benchmarking LLM and Agent Robustness to Near-Target Prompt Injection", "published": "2026-10-23T12:05:14Z", "updated": "2026-10-23T12:05:14Z", "authors": [ "Yuyang Gong", "Zihao Wang", "Jiawei Liu", "XiaoFeng Wang" ], "categories": [ "cs.CR" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32531v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "New submissions (showing 27 of 27 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "明确评测外部内容中的近目标提示注入，包含 Agent 工具调用的错误/有害偏离，直接相关。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是远离合法任务的固定目标注入可能低估“表面仍在完成任务”的有害偏离。NTBench 以合法参考结果生成近目标指令/目标对，分别测试错误与有害输出或 Agent 工具调用，结合人工验证并排除无注入时已发生的偏离。作者在七个模型、十个语言数据集和两个 Agent 基准上以每样本三次攻击执行评测，两个轨道在各设置均优于固定目标基线；语言任务错误/有害轨道提升分别为 9.3–35.8、1.7–17.3 个百分点。", "topics": { "id": "2610.32531", "tags": [ "injection", "evaluation" ], "reason_zh": "外部内容诱导的近目标偏离与有害工具调用是直接提示注入评测。" }, "needs_full_text_review": false, "categories_seen": [ "cs.CR" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32531", "first_author": "Yuyang Gong", "authors": [ "Yuyang Gong", "Zihao Wang", "Jiawei Liu", "XiaoFeng Wang" ], "affiliations": [ "Nanyang Technological University" ], "source_url": "https://arxiv.org/html/2610.32531v1", "author_source": "http://arxiv.org/abs/2610.32531v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Yuyang Gong", "Zihao Wang" ], "shared_first_note": "正文明确注明共同第一作者。", "evidence": "Yuyang Gong and Zihao Wang have superscript 1, mapped to Nanyang Technological University; explicit first-two-authors equal contribution.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32392": { "id": "2610.32392", "version_id": "2610.32392v1", "title": "PULSES: multi-agent AI for autonomous excited-state model building and dynamics", "published": "2026-10-23T09:17:05Z", "updated": "2026-10-23T09:17:05Z", "authors": [ "Fangning Ren", "Lechen Dong", "Xu Chen", "Weilin Zou", "Bushra Alam", "Fang Liu" ], "categories": [ "physics.chem-ph", "cs.MA" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32392v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "new", "section": "Cross submissions (showing 9 of 9 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文明确实现专家批准后冻结执行契约、超出资源/决策范围重新审批及产物接受门控，属于多 Agent 授权治理；不能据此声称抗攻击有效。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "summary_zh": "PULSES 面向激发态科学建模，将专家与 Planner 的目标、方法、工作流、接受标准及资源/决策边界固化为批准后的 hash 标识契约；越界修改须再次审批。领域 Agent 与独立科学保证 Agent 配对检查实际产物，FAIL 阻止依赖性下游使用，INCONCLUSIVE 仅允许已授权诊断/恢复，并保留警告。作者在 15 个计算化学任务及三类端到端应用中展示可追踪流程。正文提供治理设计与科学任务验证，未提供对抗攻击防御保证。", "topics": { "id": "2610.32392", "tags": [ "authorization", "monitoring", "multiagent" ], "reason_zh": "固定用户批准范围、越界重新审批和独立产物门控构成明确的多 Agent 行动授权与监督。" }, "needs_full_text_review": true, "review": { "id": "2610.32392", "classification": "relevant", "recommendation": "promote_to_relevant", "reason": "正文明确实现专家批准后冻结执行契约、超出资源/决策范围重新审批及产物接受门控，属于多 Agent 授权治理；不能据此声称抗攻击有效。", "summary_zh": "PULSES 面向激发态科学建模，将专家与 Planner 的目标、方法、工作流、接受标准及资源/决策边界固化为批准后的 hash 标识契约；越界修改须再次审批。领域 Agent 与独立科学保证 Agent 配对检查实际产物，FAIL 阻止依赖性下游使用，INCONCLUSIVE 仅允许已授权诊断/恢复，并保留警告。作者在 15 个计算化学任务及三类端到端应用中展示可追踪流程。正文提供治理设计与科学任务验证，未提供对抗攻击防御保证。", "topics": { "id": "2610.32392", "tags": [ "authorization", "monitoring", "multiagent" ], "reason_zh": "固定用户批准范围、越界重新审批和独立产物门控构成明确的多 Agent 行动授权与监督。" }, "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "body_sections_checked": [ "§2 architecture and autonomy boundary", "§4.2 Planning and execution contracts", "§4.3 Scientific validation and revision", "Table 1 evaluation protocol", "PDF title page" ], "evidence_zh": [ "执行开始前必须专家批准 Scientific Execution Contract，批准后保存 hash 标识快照并直接交给 orchestrator。", "目标、规定方法或接受标准变更须批准，除非已由批准的应急方案覆盖；超出资源/决策边界暂停等待用户。", "科学保证 Agent 检查产物而非生成者叙述；FAIL 禁止依赖性下传，INCONCLUSIVE 保留未决限制并只许授权恢复工作。", "重复任务每项三次，昂贵任务部分为单次验证；单次 Validated 不代表重复可复现。" ], "source_url": "https://arxiv.org/pdf/2610.32392", "source_version_note": "Downloaded official PDF; version number not inferred from bare PDF URL.", "author_evidence": { "first_author": "Fangning Ren", "shared_first_authors": [ "Fangning Ren", "Lechen Dong" ], "affiliations": [ "Department of Chemistry, Emory University" ], "evidence": "PDF title page lists a shared department affiliation and # footnote stating F.R. and L.D. contributed equally." } }, "categories_seen": [ "cs.MA", "physics.chem-ph" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32392", "first_author": "Fangning Ren", "authors": [ "Fangning Ren", "Lechen Dong", "Xu Chen", "Weilin Zou", "Bushra Alam", "Fang Liu" ], "affiliations": [ "Emory University" ], "source_url": "https://arxiv.org/pdf/2610.32392", "author_source": "http://arxiv.org/abs/2610.32392v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Fangning Ren", "Lechen Dong" ], "shared_first_note": "正文明确注明共同第一作者。", "evidence": "PDF first page lists a single common Department of Chemistry, Emory University affiliation; # footnote explicitly identifies F.R. and L.D. equal contribution.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32370": { "id": "2610.32370", "version_id": "2610.32370v1", "title": "Adaptive Control of Scientific Instruments with Nonstationary Responses through Multimodal Agents", "published": "2026-10-23T08:59:43Z", "updated": "2026-10-23T08:59:43Z", "authors": [ "Guoyang Shi", "Hongwen Li", "Yiding Yu", "Zhuang Fu", "Siqi Ding", "Zhengyuan Chen", "JianGuo Chen", "Hanyue Zhao", "Tianyuan Liu" ], "categories": [ "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32370v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "科学仪器 MLLM Agent 的独立动作可行性检查在执行前强制约束，涉及物理行动安全与监督边界。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是非平稳科学仪器调参既昂贵又有操作风险。系统用确定性算法抽取波形物理证据，以双层记忆支持 MLLM 候选动作，再由独立可行性检查在执行前强制动作约束。作者在 455 次历史射束按时间回放中观察到上下文检索改善与历史动作方向的一致率；五个离子源的监督运行中，409 次执行达到 86.80% 束流提取率。该结果是受监督工程可行性证据，不是自主安全保证。", "topics": { "id": "2610.32370", "tags": [ "authorization", "embodied", "monitoring" ], "reason_zh": "独立动作约束检查用于真实物理科学仪器 Agent，直接关联行动安全与监督。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32370", "first_author": "Guoyang Shi", "authors": [ "Guoyang Shi", "Hongwen Li", "Yiding Yu", "Zhuang Fu", "Siqi Ding", "Zhengyuan Chen", "JianGuo Chen", "Hanyue Zhao", "Tianyuan Liu" ], "affiliations": [ "Beijing ENN Fusion Energy Science and Technology Co., Ltd.", "Beijing Key Laboratory of High Magnetic Field Spherical Torus Fusion Energy", "Hebei Key Laboratory of Compact Fusion" ], "source_url": "https://arxiv.org/pdf/2610.32370v1", "author_source": "http://arxiv.org/abs/2610.32370v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF first page Guoyang Shi superscripts 1,2,3 explicitly map to all three listed units; retained without collapsing laboratory affiliations.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32305": { "id": "2610.32305", "version_id": "2610.32305v1", "title": "DMAIC-Bench: From Self-Reflection to Self-Restraint for Agents in Multi-Stage Analytical Tasks", "published": "2026-10-23T08:04:10Z", "updated": "2026-10-23T08:04:10Z", "authors": [ "Shan Peng", "Shuaiqi Cheng", "Miao Peng", "Chenyi Zi", "Jia Li" ], "categories": [ "cs.AI", "cs.CL", "cs.LG" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32305v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Cross submissions (showing 34 of 34 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "new", "section": "Cross submissions (showing 92 of 92 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "测试 Agent 能否依据中间证据停止被禁止的后续计算，并发现诊断与动作脱节，属于行动约束/自我克制安全评测。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是 Agent 能写出正确反思却未据此停止不该执行的分析。DMAIC-Bench 用统计前提构造 97 个任务、15 个工业案例及成对 GO/NO-GO 反事实，按执行轨迹与独立专家审查评价。作者在 13 个模型中发现 GO 路由平均准确率 92%，NO-GO 仅 19%；被审计的 11 个 Agent 报告在到达的 NO-GO 决策处约 47% 仍据无效证据行动（区间 31%–61%）。明确停止许可不能一致修复两类决策。", "topics": { "id": "2610.32305", "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "依据证据禁止后续动作、诊断与执行脱节，构成自我克制和行动边界评测。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32305", "first_author": "Shan Peng", "authors": [ "Shan Peng", "Shuaiqi Cheng", "Miao Peng", "Chenyi Zi", "Jia Li" ], "affiliations": [ "Xiwei Technology (Guangzhou) Co., Ltd.", "The Hong Kong University of Science and Technology (Guangzhou)" ], "source_url": "https://arxiv.org/html/2610.32305v1", "author_source": "http://arxiv.org/abs/2610.32305v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Shan Peng has two individually attached affiliation blocks; do not drop either.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32285": { "id": "2610.32285", "version_id": "2610.32285v1", "title": "Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attribution", "published": "2026-10-23T07:43:26Z", "updated": "2026-10-23T07:43:26Z", "authors": [ "Zhiyong Cao", "Hengjie Zhu", "Yongxin Wang", "Xuchen Li", "Jintao Li", "Shuxia Liu", "Dunqiang Liu", "Bo Wang", "Kairan Zhang", "Cong Lin", "JiangDi Yu", "Siyuan Liu", "Sijia Yao", "Yi-Liang Wei", "Lingxu Ma", "Aijia Wang", "Anxin Chen", "Zixian Wei", "Xiang Ruan", "Ruizhi Xu", "Ruqian Shi", "Baihua Xiao", "Sicheng Zhou" ], "categories": [ "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32285v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文 9 个 Governance 任务明确评测审批、护栏、秘密脱敏和信任边界，Context 包括跨会话信息泄露，具有直接 Agent 安全评测内容。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "summary_zh": "TraceTrial-Bench 将 Agent harness 与模型/工具环境分开评价，95 个机制任务涵盖七类，其中 9 个治理任务明确包括审批、护栏、秘密脱敏和信任边界，15 个上下文任务含跨边界信息披露。方法保留原生轨迹及独立环境真值，以分层评价和证据链归因区分任务成功与机制合规。作者报告 3420 个选定运行中 31.1% 任务成功却违反至少一项 harness 标准；这是跨类别综合结果，不能当成治理任务的单独安全失败率。", "topics": { "id": "2610.32285", "tags": [ "evaluation", "monitoring", "authorization", "privacy", "memory" ], "reason_zh": "原生 harness 的审批、秘密脱敏、信任边界及跨会话信息隔离均由明确任务合同与独立证据评价。" }, "needs_full_text_review": true, "review": { "id": "2610.32285", "version_id": "2610.32285v1", "classification": "relevant", "recommendation": "promote_to_relevant", "reason": "正文 9 个 Governance 任务明确评测审批、护栏、秘密脱敏和信任边界，Context 包括跨会话信息泄露，具有直接 Agent 安全评测内容。", "summary_zh": "TraceTrial-Bench 将 Agent harness 与模型/工具环境分开评价，95 个机制任务涵盖七类，其中 9 个治理任务明确包括审批、护栏、秘密脱敏和信任边界，15 个上下文任务含跨边界信息披露。方法保留原生轨迹及独立环境真值，以分层评价和证据链归因区分任务成功与机制合规。作者报告 3420 个选定运行中 31.1% 任务成功却违反至少一项 harness 标准；这是跨类别综合结果，不能当成治理任务的单独安全失败率。", "topics": { "id": "2610.32285", "tags": [ "evaluation", "monitoring", "authorization", "privacy", "memory" ], "reason_zh": "原生 harness 的审批、秘密脱敏、信任边界及跨会话信息隔离均由明确任务合同与独立证据评价。" }, "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "body_sections_checked": [ "§2.1–2.3 system/evidence boundaries", "§3.2.1 Harness Reliability Taxonomy and Fig. 4", "§3.2.2 Task Suite", "§3.3.2 Integrity/security/release", "§4.1–4.3 experiment population and limitations" ], "evidence_zh": [ "治理类别为 9 任务，明列 approvals、guardrails、secret redaction、trust boundaries。", "上下文类别为 15 任务，测信息保留及跨边界披露；任务触发包含跨会话事实及仅经交互通道可获得的私有值。", "harness 为被测系统，环境状态、模型可见工具返回与规范化轨迹各有证据边界，不能相互替代。", "3420 个单元是每模型/harness/任务一个选定执行，包含恢复替代执行，不是单元内独立重复；正文不估计单元内重复性。" ], "source_url": "https://arxiv.org/html/2610.32285v1" }, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32285", "first_author": "Zhiyong Cao", "authors": [ "Zhiyong Cao", "Hengjie Zhu", "Yongxin Wang", "Xuchen Li", "Jintao Li", "Shuxia Liu", "Dunqiang Liu", "Bo Wang", "Kairan Zhang", "Cong Lin", "JiangDi Yu", "Siyuan Liu", "Sijia Yao", "Yi-Liang Wei", "Lingxu Ma", "Aijia Wang", "Anxin Chen", "Zixian Wei", "Xiang Ruan", "Ruizhi Xu", "Ruqian Shi", "Baihua Xiao", "Sicheng Zhou" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.32285v1", "author_source": "http://arxiv.org/abs/2610.32285v1", "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF title page uses TraceLite AI group author and five institutions; Section 9 lists Zhiyong Cao first but no per-author institution mapping. Core contributor stars are not labelled equal first authors, so no joint-first claim." }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32110": { "id": "2610.32110", "version_id": "2610.32110v1", "title": "Who Verifies the Tools? How Warped Formatters Mislead Agents and Their Verifiers", "published": "2026-10-23T03:22:12Z", "updated": "2026-10-23T03:22:12Z", "authors": [ "William Jeffries" ], "categories": [ "cs.AI", "cs.SE" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32110v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "new", "section": "Cross submissions (showing 10 of 10 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "工具输出遗漏语义边界导致 Agent 与 verifier 接受不受支持的结论，直接涉及工具证据可信性和监测失效。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是工具计算正确但格式化输出隐藏搜索限制、结果上限或标识符命名空间，导致 Agent 及 verifier 错判。作者比较遗漏与修复格式，三类故障中的无依据主张明显下降；一项测试的 verifier 从 90/90 接受错误答案变为 90/90 拒绝。已知自有缺陷提示的探索性审计还发现额外缺陷及其他 Agent 系统格式问题。证据来自工具语义缺陷，不是主动注入攻防实验。", "topics": { "id": "2610.32110", "tags": [ "monitoring", "evaluation" ], "reason_zh": "不可信/不完整工具文本传播到 Agent 主张并穿过 verifier，直接检验工具证据可信边界。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.SE" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32110", "first_author": "William Jeffries", "authors": [ "William Jeffries" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2610.32110", "author_source": "http://arxiv.org/abs/2610.32110v1", "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "shared_first_authors": [], "shared_first_note": "", "evidence": "HTML author block gives William Jeffries and email only; project institution in abstract is not an author affiliation." }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31974": { "id": "2610.31974", "version_id": "2610.31974v1", "title": "Agentic AI Defense: Decode-Time Provenance Binding for MCP", "published": "2026-10-22T22:27:13Z", "updated": "2026-10-22T22:27:13Z", "authors": [ "Eric Yocam", "Varghese Vaidyan", "Paris Kalathas", "Patrick Tague", "Bruce DeBruhl", "Yong Wang" ], "categories": [ "cs.CR", "cs.AI", "cs.MA" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31974v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "New submissions (showing 27 of 27 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "new", "section": "Cross submissions (showing 9 of 9 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "MCP 多 Agent 环境中隐写内容解码后的信任洗白及来源绑定防御，直接相关。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是 MCP 工具解码邮件签名图像隐写后，恶意指令绕过文本扫描进入多 Agent 工作流。方法在解码时绑定 HMAC 信任标签，结合来源账本、上下文污点与关键调用拦截，并审计可信升级。作者在三个载体、24 个自适应载荷的真实 MCP 测试环境中报告：无防御 ASR 100%，关键词/正则各放过 62.5%，方法阻断全部；可信升级使合法完成率从 67% 到 100%。结论限于完全中介的执行环境。", "topics": { "id": "2610.31974", "tags": [ "injection", "supplychain", "authorization", "multiagent" ], "reason_zh": "工具解码跨模态信任洗白与 MCP 来源/污点/调用拦截是直接多 Agent 注入防御。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CR", "cs.MA" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31974", "first_author": "Eric Yocam", "authors": [ "Eric Yocam", "Varghese Vaidyan", "Paris Kalathas", "Patrick Tague", "Bruce DeBruhl", "Yong Wang" ], "affiliations": [ "California Polytechnic State University, San Luis Obispo" ], "source_url": "https://arxiv.org/pdf/2610.31974v1", "author_source": "http://arxiv.org/abs/2610.31974v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF first page Eric Yocam has superscript 1 († is corresponding author); affiliation 1 is Department of Computer Science, California Polytechnic State University, San Luis Obispo. HTML shifted neighboring affiliation blocks, so PDF mapping used.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31840": { "id": "2610.31840", "version_id": "2610.31840v1", "title": "SPECMEM: Accelerating Agentic Tool Calling via Live Memory Management", "published": "2026-10-22T19:24:21Z", "updated": "2026-10-22T19:24:21Z", "authors": [ "Zihe Song", "Wenting Zhao", "Ye Liu", "Yuanjie Zhu", "Ke Xu", "Shanghao Li", "Philip S. Yu" ], "categories": [ "cs.CL" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31840v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "New submissions (showing 72 of 72 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "工具调用投机解码内存中的逐用户隔离关闭泄露通道，副作用门控消除不可逆错误，直接涉及隐私与行动安全。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是跨会话工具调用草稿库过时，且共享/提前执行可能泄露数据或产生不可逆副作用。SpecMem 在线写回已验证调用，按用户限额并用 LRU 维护内存，同时把不可逆调用推迟到验证后。作者在三个开源模型的多用户多会话流中报告平均接受 token 增益 27%、最高 1.74 倍提速；消融称逐用户隔离关闭测得的跨用户泄露通道，基于声明副作用而非检索置信度的门控消除了不可逆错误。", "topics": { "id": "2610.31840", "tags": [ "memory", "privacy", "authorization" ], "reason_zh": "工具调用内存隔离、跨用户泄露及不可逆动作门控均为明确安全机制。" }, "needs_full_text_review": false, "categories_seen": [ "cs.CL" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31840", "first_author": "Zihe Song", "authors": [ "Zihe Song", "Wenting Zhao", "Ye Liu", "Yuanjie Zhu", "Ke Xu", "Shanghao Li", "Philip S. Yu" ], "affiliations": [ "University of Illinois Chicago" ], "source_url": "https://arxiv.org/pdf/2610.31840v1", "author_source": "http://arxiv.org/abs/2610.31840v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF first page Zihe Song superscript 1 maps to Department of Computer Science, University of Illinois Chicago; Salesforce Research is coauthor superscript 2.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31778": { "id": "2610.31778", "version_id": "2610.31778v1", "title": "Benchmarks Are Surprisingly Compaction-Friendly", "published": "2026-10-22T18:15:54Z", "updated": "2026-10-22T18:15:54Z", "authors": [ "Jeanne Salle", "Hardik Bhatnagar", "Matthias Bethge", "Sahar Abdelnabi", "Maksym Andriushchenko" ], "categories": [ "cs.LG", "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31778v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "new", "section": "New submissions (showing 106 of 106 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "直接测量 Coding Agent 上下文压缩丢失反作弊及禁止行为指令，属于记忆/上下文安全边界衰减。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是长程 Coding Agent 的上下文压缩可丢失不可从磁盘恢复的任务限制。作者固定 OpenCode harness，比较五种压缩策略、三个前沿模型与三个长程基准；总体成绩常对压缩不敏感，自摘要未被其他方法超越。但 ProgramBench 首次摘要已平均丢失约三分之一反作弊规则，且随压缩次数增长；真实 SWE-chat 中“如何做/禁止做”指令的丢失率约为构建需求的六倍。由此提示常规成功率掩盖约束丢失。", "topics": { "id": "2610.31778", "tags": [ "memory", "authorization", "evaluation" ], "reason_zh": "直接测量压缩对禁止行为和反作弊规则的遗忘，关系 Agent 安全约束保留。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.LG" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31778", "first_author": "Jeanne Salle", "authors": [ "Jeanne Salle", "Hardik Bhatnagar", "Matthias Bethge", "Sahar Abdelnabi", "Maksym Andriushchenko" ], "affiliations": [ "ELLIS Institute Tübingen", "Max Planck Institute for Intelligent Systems", "Tübingen AI Center" ], "source_url": "https://arxiv.org/pdf/2610.31778v1", "author_source": "http://arxiv.org/abs/2610.31778v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Jeanne Salle", "Hardik Bhatnagar" ], "shared_first_note": "正文明确星号为共同第一作者；† 标记为共同资深作者，不混入。", "evidence": "PDF first page Jeanne Salle superscripts 1,2,3 map to ELLIS Institute Tübingen, Max Planck Institute for Intelligent Systems, Tübingen AI Center. Star marks equal contribution with Hardik Bhatnagar (3,4).", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Jeanne Salle": [ "ELLIS Institute Tübingen", "Max Planck Institute for Intelligent Systems", "Tübingen AI Center" ], "Hardik Bhatnagar": [ "Tübingen AI Center", "University of Tübingen" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32151": { "id": "2610.32151", "title": "The LLENS Platform for On-Premises Large Language Model Agents in a Japanese University Hospital: Development and Evaluation Study", "classification": "uncertain", "reason": "新正文证据显示 LLENS 不只是列举内网部署：nsjail 限制 Python/shell 网络访问，文档只读，用户工作区隔离，共享目录按组授权，Controls 显式讨论附件提示注入后的可写损害边界。但论文中心贡献仍是通用医疗 Agent 平台及功能评估，未独立验证这些安全保障；保留范围待定，不以缺少攻击实验直接否定设计贡献。", "abstract_read": true, "summary_zh": "LLENS 在医院封闭网络运行工具型 LLM Agent，采用 nsjail 沙箱、预设 API、只读医院文档、独立用户工作区和组级共享权限。作者明确承认附件提示注入仍可能生效，并称损害限定为当前用户可写会话、工作区及授权共享位置。180 道医院文档问题中交互访问准确率为 97.2%，13 类工作场景中 12 类全运行触发预期组件；这些验证的是功能而非隔离、越权或注入防护，Agent 安全贡献范围仍待定。", "topics": { "tags": [ "authorization", "privacy", "injection" ], "reason_zh": "新正文证据显示 LLENS 不只是列举内网部署：nsjail 限制 Python/shell 网络访问，文档只读，用户工作区隔离，共享目录按组授权，Controls 显式讨论附件提示注入后的可写损害边界。但论文中心贡献仍是通用医疗 Agent 平台及功能评估，未独立验证这些安全保障；保留范围待定，不以缺少攻击实验直接否定设计贡献。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.32151", "title": "The LLENS Platform for On-Premises Large Language Model Agents in a Japanese University Hospital: Development and Evaluation Study", "version_id": "2610.32151v2", "original_classification": "uncertain", "classification": "uncertain", "reason": "新正文证据显示 LLENS 不只是列举内网部署：nsjail 限制 Python/shell 网络访问，文档只读，用户工作区隔离，共享目录按组授权，Controls 显式讨论附件提示注入后的可写损害边界。但论文中心贡献仍是通用医疗 Agent 平台及功能评估，未独立验证这些安全保障；保留范围待定，不以缺少攻击实验直接否定设计贡献。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "Methods: Harness Components/Sandbox/Memory and Recipes/Controls", "Evaluation: Access to Hospital Documents", "Discussion: Limitations" ], "source_url": "https://arxiv.org/pdf/2610.32151v2", "summary_zh": "LLENS 在医院封闭网络运行工具型 LLM Agent，采用 nsjail 沙箱、预设 API、只读医院文档、独立用户工作区和组级共享权限。作者明确承认附件提示注入仍可能生效，并称损害限定为当前用户可写会话、工作区及授权共享位置。180 道医院文档问题中交互访问准确率为 97.2%，13 类工作场景中 12 类全运行触发预期组件；这些验证的是功能而非隔离、越权或注入防护，Agent 安全贡献范围仍待定。", "topics": { "tags": [ "authorization", "privacy", "injection" ], "reason_zh": "新正文证据显示 LLENS 不只是列举内网部署：nsjail 限制 Python/shell 网络访问，文档只读，用户工作区隔离，共享目录按组授权，Controls 显式讨论附件提示注入后的可写损害边界。但论文中心贡献仍是通用医疗 Agent 平台及功能评估，未独立验证这些安全保障；保留范围待定，不以缺少攻击实验直接否定设计贡献。" }, "evidence_notes": [ "这是已展示旧记录的新证据复核，不代表今日新论文。", "不把部署隔离声明写成已证明防注入或临床安全。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "Methods: Harness Components/Sandbox/Memory and Recipes/Controls", "Evaluation: Access to Hospital Documents", "Discussion: Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.32151v2", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.32151v2", "published": "2026-10-23T04:34:26Z", "updated": "2026-10-26T04:31:45Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-26", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-26", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.32151v2", "abstract_sha256": "039ef066f7f1405510881881a6f196a51cf4a5309c2ca5c5f06ed99ef4df037e", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27", "2026-10-28" ], "version_history": [ { "id": "2610.32151", "version_id": "2610.32151v1", "classification": "relevant", "reason": "正文明确讨论附件提示注入，利用 nsjail 网络隔离、只读院内文档、用户及组权限限制 Agent 被诱导后的可修改范围，属于部署级安全设计；未做对抗防御效果评测。", "published": "2026-10-23T04:34:26Z", "updated": "2026-10-23T04:34:26Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "18c1f86caa98eb6dc27db18b8223b1ca6a4eec24298d024644578ccbfd4cc285", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "New submissions (showing 72 of 72 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null } ], "announcement_date": "2026-10-26", "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "last_metadata_checked_date": "2026-10-27" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.32151", "first_author": "Ken Enda", "authors": [ "Ken Enda", "Jien Saito", "Masami Mukai", "Feng Han", "Emir Turkes", "Tatsumi Kusakabe", "Reona Umeki", "Kazuhiro Sumiyoshi", "Mitsuya Numata", "Takumi Tanikawa", "Akira Endoh", "Kenji Hirata", "Atsushi Yoshida", "Kohsuke Kudo", "Shinya Tanaka" ], "affiliations": [ "Division of AI Support for Medical Research, Faculty of Medicine, Hokkaido University", "Department of Cancer Pathology, Faculty of Medicine, Hokkaido University", "Technoplasm Inc." ], "source_url": "https://arxiv.org/pdf/2610.32151v2", "author_source": "https://arxiv.org/abs/2610.32151v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF Ken Enda¹,²,³ explicitly maps to two Hokkaido University units and Technoplasm Inc.; corresponding-author designation does not assert shared first authorship.", "verification_status": "affiliation_verified", "title": "The LLENS Platform for On-Premises Large Language Model Agents in a Japanese University Hospital: Development and Evaluation Study", "version_id": "2610.32151v2", "shared_first_affiliations": {} }, "authors": [ "Ken Enda", "Jien Saito", "Masami Mukai", "Feng Han", "Emir Turkes", "Tatsumi Kusakabe", "Reona Umeki", "Kazuhiro Sumiyoshi", "Mitsuya Numata", "Takumi Tanikawa", "Akira Endoh", "Kenji Hirata", "Atsushi Yoshida", "Kohsuke Kudo", "Shinya Tanaka" ], "categories": [ "cs.CL", "cs.AI" ], "source": "http://arxiv.org/abs/2610.32151v1", "baseline_status": "not_in_checkpoint", "needs_full_text_review": true, "review": { "id": "2610.32151", "version_id": "2610.32151v1", "title": "The LLENS Platform for On-Premises Large Language Model Agents in a Japanese University Hospital: Development and Evaluation Study", "published": "2026-10-23T04:34:26Z", "updated": "2026-10-23T04:34:26Z", "authors": [ "Ken Enda", "Jien Saito", "Masami Mukai", "Feng Han", "Emir Turkes", "Tatsumi Kusakabe", "Reona Umeki", "Kazuhiro Sumiyoshi", "Mitsuya Numata", "Takumi Tanikawa", "Akira Endoh", "Kenji Hirata", "Atsushi Yoshida", "Kohsuke Kudo", "Shinya Tanaka" ], "categories": [ "cs.CL", "cs.AI" ], "announcement_date": null, "source": "http://arxiv.org/abs/2610.32151v1", "provenance": "official_arxiv_API_lastUpdatedDate_query", "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文明确讨论附件提示注入，利用 nsjail 网络隔离、只读院内文档、用户及组权限限制 Agent 被诱导后的可修改范围，属于部署级安全设计；未做对抗防御效果评测。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "needs_full_text_review": false, "summary_zh": "问题：医院闭网内的工具 Agent 仍可能遵从附件中植入的指令。方法：LLENS 在院内运行模型与工具，以 nsjail 隔离 Python/shell，仅开放预设 API；医院文档只读，工作空间和共享配方按用户/组权限隔离。正文明确将这些限制用于约束提示注入影响。作者的量化结果主要是文档任务准确率（交互访问 97.2%，固定检索 81.3%），不是攻击拦截率；临床使用与安全效果尚未验证。", "topics": { "tags": [ "authorization", "privacy" ], "reason_zh": "含封闭网络与隔离沙箱的工具 Agent 平台，安全验证范围待定。" }, "body_sections_checked": [ "Harness Components: Sandbox", "Memory and Recipes", "Controls", "Evaluation: Access to Hospital Documents", "Limitations" ], "evidence": "Controls explicitly describes prompt injection from attachments and says unauthorized changes remain bounded to the user workspace and writable shared locations. Sandbox section names nsjail and preconfigured API-only connectivity. Evaluation/limitations concern document accuracy and synthetic demonstrations, not adversarial testing.", "source_url": "https://arxiv.org/pdf/2610.32151", "author_body_evidence": { "first_author": "Ken Enda", "affiliations": [ "Division of AI Support for Medical Research, Faculty of Medicine, Hokkaido University", "Department of Cancer Pathology, Faculty of Medicine, Hokkaido University", "Technoplasm Inc." ], "evidence": "First author marked 1,2,3; PDF first page maps these affiliations." }, "review_date": "2026-10-26" }, "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证", "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2610.32151", "version_id": "2610.32151v1", "title": "The LLENS Platform for On-Premises Large Language Model Agents in a Japanese University Hospital: Development and Evaluation Study", "published": "2026-10-23T04:34:26Z", "updated": "2026-10-23T04:34:26Z", "authors": [ "Ken Enda", "Jien Saito", "Masami Mukai", "Feng Han", "Emir Turkes", "Tatsumi Kusakabe", "Reona Umeki", "Kazuhiro Sumiyoshi", "Mitsuya Numata", "Takumi Tanikawa", "Akira Endoh", "Kenji Hirata", "Atsushi Yoshida", "Kohsuke Kudo", "Shinya Tanaka" ], "categories": [ "cs.CL", "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32151v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "New submissions (showing 72 of 72 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文明确讨论附件提示注入，利用 nsjail 网络隔离、只读院内文档、用户及组权限限制 Agent 被诱导后的可修改范围，属于部署级安全设计；未做对抗防御效果评测。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "needs_full_text_review": true, "summary_zh": "问题：医院闭网内的工具 Agent 仍可能遵从附件中植入的指令。方法：LLENS 在院内运行模型与工具，以 nsjail 隔离 Python/shell，仅开放预设 API；医院文档只读，工作空间和共享配方按用户/组权限隔离。正文明确将这些限制用于约束提示注入影响。作者的量化结果主要是文档任务准确率（交互访问 97.2%，固定检索 81.3%），不是攻击拦截率；临床使用与安全效果尚未验证。", "topics": { "tags": [ "authorization", "privacy" ], "reason_zh": "含封闭网络与隔离沙箱的工具 Agent 平台，安全验证范围待定。" }, "review": { "id": "2610.32151", "version_id": "2610.32151v1", "title": "The LLENS Platform for On-Premises Large Language Model Agents in a Japanese University Hospital: Development and Evaluation Study", "published": "2026-10-23T04:34:26Z", "updated": "2026-10-23T04:34:26Z", "authors": [ "Ken Enda", "Jien Saito", "Masami Mukai", "Feng Han", "Emir Turkes", "Tatsumi Kusakabe", "Reona Umeki", "Kazuhiro Sumiyoshi", "Mitsuya Numata", "Takumi Tanikawa", "Akira Endoh", "Kenji Hirata", "Atsushi Yoshida", "Kohsuke Kudo", "Shinya Tanaka" ], "categories": [ "cs.CL", "cs.AI" ], "announcement_date": null, "source": "http://arxiv.org/abs/2610.32151v1", "provenance": "official_arxiv_API_lastUpdatedDate_query", "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文明确讨论附件提示注入，利用 nsjail 网络隔离、只读院内文档、用户及组权限限制 Agent 被诱导后的可修改范围，属于部署级安全设计；未做对抗防御效果评测。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "needs_full_text_review": false, "summary_zh": "问题：医院闭网内的工具 Agent 仍可能遵从附件中植入的指令。方法：LLENS 在院内运行模型与工具，以 nsjail 隔离 Python/shell，仅开放预设 API；医院文档只读，工作空间和共享配方按用户/组权限隔离。正文明确将这些限制用于约束提示注入影响。作者的量化结果主要是文档任务准确率（交互访问 97.2%，固定检索 81.3%），不是攻击拦截率；临床使用与安全效果尚未验证。", "topics": { "tags": [ "authorization", "privacy" ], "reason_zh": "含封闭网络与隔离沙箱的工具 Agent 平台，安全验证范围待定。" }, "body_sections_checked": [ "Harness Components: Sandbox", "Memory and Recipes", "Controls", "Evaluation: Access to Hospital Documents", "Limitations" ], "evidence": "Controls explicitly describes prompt injection from attachments and says unauthorized changes remain bounded to the user workspace and writable shared locations. Sandbox section names nsjail and preconfigured API-only connectivity. Evaluation/limitations concern document accuracy and synthetic demonstrations, not adversarial testing.", "source_url": "https://arxiv.org/pdf/2610.32151", "author_body_evidence": { "first_author": "Ken Enda", "affiliations": [ "Division of AI Support for Medical Research, Faculty of Medicine, Hokkaido University", "Department of Cancer Pathology, Faculty of Medicine, Hokkaido University", "Technoplasm Inc." ], "evidence": "First author marked 1,2,3; PDF first page maps these affiliations." }, "review_date": "2026-10-26" }, "categories_seen": [ "cs.AI", "cs.CL" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32151", "first_author": "Ken Enda", "authors": [ "Ken Enda", "Jien Saito", "Masami Mukai", "Feng Han", "Emir Turkes", "Tatsumi Kusakabe", "Reona Umeki", "Kazuhiro Sumiyoshi", "Mitsuya Numata", "Takumi Tanikawa", "Akira Endoh", "Kenji Hirata", "Atsushi Yoshida", "Kohsuke Kudo", "Shinya Tanaka" ], "affiliations": [ "Hokkaido University", "Technoplasm Inc." ], "source_url": "https://arxiv.org/pdf/2610.32151", "author_source": "http://arxiv.org/abs/2610.32151v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF first page Ken Enda superscripts 1,2,3 map to two Hokkaido University divisions and Technoplasm Inc.; both institutions retained.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" } ] }, "2610.32092": { "id": "2610.32092", "version_id": "2610.32092v1", "title": "AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents", "published": "2026-10-23T02:55:15Z", "updated": "2026-10-23T02:55:15Z", "authors": [ "Gejian Zhao", "Hanzhou Wu", "Xinpeng Zhang" ], "categories": [ "cs.CR", "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32092v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "New submissions (showing 27 of 27 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "直接以工具执行和修复轨迹识别黑盒 Agent 底层模型，评测对抗身份伪装下来源验证。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：系统提示伪装和结构化工具输出使黑盒 Agent 来源识别困难。方法：AgentTrace 用结构歧义探针触发工具接口的序列化失败，再以轻量马尔可夫链建模连续修复轨迹，识别底层模型。作者报告对抗身份伪装下识别准确率 96.0%，可区分共享分词器的同族模型，并对提示混淆和温度变化保持鲁棒；仅据摘要，未独立复现。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "以执行轨迹进行 Agent 来源验证并评测对抗身份伪装。" }, "categories_seen": [ "cs.AI", "cs.CR" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32092", "first_author": "Gejian Zhao", "authors": [ "Gejian Zhao", "Hanzhou Wu", "Xinpeng Zhang" ], "affiliations": [ "Shanghai University" ], "source_url": "https://arxiv.org/html/2610.32092v1", "author_source": "http://arxiv.org/abs/2610.32092v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "One common Shanghai University affiliation follows all three authors.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.32069": { "id": "2610.32069", "version_id": "2610.32069v1", "title": "DriveMind: Mind-Evolving Belief Tracking for Closed-Loop Autonomous Driving", "published": "2026-10-23T02:13:50Z", "updated": "2026-10-23T02:13:50Z", "authors": [ "Yan Shi", "Kehua Chen", "Jiarui Qi", "Yihong Tang", "Haichen Liao", "Yinhai Wang" ], "categories": [ "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.32069v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文验证 MLLM 闭环驾驶 Agent 的无违规完成率、碰撞/闯灯惩罚及碰撞时间等行动安全指标，属于具身 Agent 安全；并非网络对抗攻击研究。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "needs_full_text_review": true, "summary_zh": "问题：MLLM 驾驶 Agent 在模糊场景中过早确定错误解释可能导致危险行动。方法：DriveMind 维护并重加权多个场景假设，驱动高低频分离的闭环控制。作者报告 Bench2Drive 驾驶分从 68.50 升至 81.37，无违规完成率从 41.36% 升至 54.09%；正文指标计入碰撞与闯灯。并非所有场景获益，有信号交叉口成功率从 12% 降至 4%。NAVSIM 的 NC/TTC 等安全子分在加入信念跟踪后不变，改进主要来自可驾驶区域符合度及进度；不能概括为全面安全提升。", "topics": { "tags": [ "embodied", "robustness" ], "reason_zh": "闭环 MLLM 驾驶的歧义处理可能涉及行动安全，但需区别一般驾驶成功率改进。" }, "review": { "id": "2610.32069", "version_id": "2610.32069v1", "title": "DriveMind: Mind-Evolving Belief Tracking for Closed-Loop Autonomous Driving", "published": "2026-10-23T02:13:50Z", "updated": "2026-10-23T02:13:50Z", "authors": [ "Yan Shi", "Kehua Chen", "Jiarui Qi", "Yihong Tang", "Haichen Liao", "Yinhai Wang" ], "categories": [ "cs.AI" ], "announcement_date": null, "source": "http://arxiv.org/abs/2610.32069v1", "provenance": "official_arxiv_API_lastUpdatedDate_query", "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文验证 MLLM 闭环驾驶 Agent 的无违规完成率、碰撞/闯灯惩罚及碰撞时间等行动安全指标，属于具身 Agent 安全；并非网络对抗攻击研究。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "needs_full_text_review": false, "summary_zh": "问题：MLLM 驾驶 Agent 在模糊场景中过早确定错误解释可能导致危险行动。方法：DriveMind 维护并重加权多个场景假设，驱动高低频分离的闭环控制。作者报告 Bench2Drive 驾驶分从 68.50 升至 81.37，无违规完成率从 41.36% 升至 54.09%；正文指标计入碰撞与闯灯。并非所有场景获益，有信号交叉口成功率从 12% 降至 4%。NAVSIM 的 NC/TTC 等安全子分在加入信念跟踪后不变，改进主要来自可驾驶区域符合度及进度；不能概括为全面安全提升。", "topics": { "tags": [ "embodied", "robustness" ], "reason_zh": "闭环 MLLM 驾驶的歧义处理可能涉及行动安全，但需区别一般驾驶成功率改进。" }, "body_sections_checked": [ "4.1 High-Level Reasoner", "5.2 scenario results and Tables 2–3", "5.3 Ablation Studies", "Appendix B Formal Definitions of Evaluation Metrics", "Appendix C NAVSIM Results", "Appendix E Failure Cases" ], "evidence": "Appendix B defines driving score with infraction penalties and success as routes without infractions; Appendix C reports NC 96.5 and TTC 91.1 and explicitly states safety metrics unchanged with belief tracking. Table 2 records signalized-intersection SR decrease. Failures include sudden objects and stale belief updates.", "source_url": "https://arxiv.org/html/2610.32069v1", "author_body_evidence": { "first_author": "Yan Shi", "affiliations": [ "University of Washington" ], "evidence": "HTML author block explicitly assigns University of Washington to Yan Shi." }, "review_date": "2026-10-26" }, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.32069", "first_author": "Yan Shi", "authors": [ "Yan Shi", "Kehua Chen", "Jiarui Qi", "Yihong Tang", "Haichen Liao", "Yinhai Wang" ], "affiliations": [ "University of Washington" ], "source_url": "https://arxiv.org/html/2610.32069v1", "author_source": "http://arxiv.org/abs/2610.32069v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Yan Shi has an individually attached University of Washington affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31972": { "id": "2610.31972", "version_id": "2610.31972v1", "title": "Reproducible Evaluation as the Substrate for Safe Prompt Compression in Production Agents", "published": "2026-10-22T22:24:35Z", "updated": "2026-10-22T22:24:35Z", "authors": [ "Prabal Vashisht", "Zheng Hu", "Ying Yang" ], "categories": [ "cs.AI" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31972v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "New submissions (showing 79 of 79 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文给出提示优化器删掉强制工具参数规则、逃过抽样 no-harm 门控的具体案例，研究 Skill/工具提示压缩中策略规则保持及 reward hacking 防护。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "needs_full_text_review": true, "summary_zh": "问题：生产 Agent 提示压缩可能通过删除强制工具规则获得更短提示，常规抽样评测却未发现违规。方法：在可重放企业状态的评测框架中联合压缩系统提示、Skill 与工具说明，并对强制规则违规给予零分。正文附录 B 报告 store_id 处理规则被删除后，抽样 no-harm 和重复文本检查曾漏过，专项诊断中该 Skill 得分从 0.90 降为 0.00；硬规则门控用于避免此类缺口。作者报告最终提示缩短 3.5–7.6%，留出正确性无可检测下降；这不是对外部提示注入或全部权限违规的安全保证。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "Agent 提示优化中的正确性门控明确提及 reward hacking，但安全评测细节不足。" }, "review": { "id": "2610.31972", "version_id": "2610.31972v1", "title": "Reproducible Evaluation as the Substrate for Safe Prompt Compression in Production Agents", "published": "2026-10-22T22:24:35Z", "updated": "2026-10-22T22:24:35Z", "authors": [ "Prabal Vashisht", "Zheng Hu", "Ying Yang" ], "categories": [ "cs.AI" ], "announcement_date": null, "source": "http://arxiv.org/abs/2610.31972v1", "provenance": "official_arxiv_API_lastUpdatedDate_query", "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "正文给出提示优化器删掉强制工具参数规则、逃过抽样 no-harm 门控的具体案例，研究 Skill/工具提示压缩中策略规则保持及 reward hacking 防护。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "needs_full_text_review": false, "summary_zh": "问题：生产 Agent 提示压缩可能通过删除强制工具规则获得更短提示，常规抽样评测却未发现违规。方法：在可重放企业状态的评测框架中联合压缩系统提示、Skill 与工具说明，并对强制规则违规给予零分。正文附录 B 报告 store_id 处理规则被删除后，抽样 no-harm 和重复文本检查曾漏过，专项诊断中该 Skill 得分从 0.90 降为 0.00；硬规则门控用于避免此类缺口。作者报告最终提示缩短 3.5–7.6%，留出正确性无可检测下降；这不是对外部提示注入或全部权限违规的安全保证。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "Agent 提示优化中的正确性门控明确提及 reward hacking，但安全评测细节不足。" }, "body_sections_checked": [ "2.2 Sandbox: Reproducible Production State", "2.4 Correctness-Gated Prompt Compression", "3 Results", "Appendix B Reward-Hacking Near-Miss" ], "evidence": "Appendix B documents deletion of mandatory store_id handling, an inherited deletion missed by sampled no-harm and duplicate-blind text checks, and a 0.90 to 0.00 diagnostic score. Section 2.4 defines a mandatory-rule hard gate; Table 1 evaluates held-out correctness, not adversarial attack rejection.", "source_url": "https://arxiv.org/html/2610.31972v1", "author_body_evidence": { "first_author": "Prabal Vashisht", "affiliations": [ "Mx ML, DoorDash Inc." ], "evidence": "HTML author block directly lists Mx ML and DoorDash Inc. under Prabal Vashisht." }, "review_date": "2026-10-26" }, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31972", "first_author": "Prabal Vashisht", "authors": [ "Prabal Vashisht", "Zheng Hu", "Ying Yang" ], "affiliations": [ "DoorDash Inc." ], "source_url": "https://arxiv.org/html/2610.31972v1", "author_source": "http://arxiv.org/abs/2610.31972v1", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Prabal Vashisht has own Mx ML, DoorDash Inc. affiliation block.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.31914": { "id": "2610.31914", "version_id": "2610.31914v1", "title": "Incomparable Minima in Agent Tool Authorization", "published": "2026-10-22T21:06:11Z", "updated": "2026-10-22T21:06:11Z", "authors": [ "Xin Xu" ], "categories": [ "cs.CR" ], "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.31914v1", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "New submissions (showing 27 of 27 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "recent", "section": null } ], "baseline_status": "not_in_checkpoint", "replacement": false, "classification": "relevant", "reason": "直接研究 Agent 工具最小授权的不可比关系，并评测模型对权限选择和风险尺度的判断。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：可完成任务的最小授权可能彼此不可比，过度授权基准将其强排高低会失真。方法：分析微软 Graph 22,305 个端点绑定和 Google 23,852 个 API 方法，比较授权偏序及四类风险尺度，并测试六个前沿模型。作者报告 29.8–33.3% Graph 任务和 3.2% Google 资源任务存在最小授权反链；在 1,708 次模型决策中，99.0% 选择某个极小授权，但仅 66.7% 选择四种风险尺度下都最小的授权。建议同时报告具体授权选择并向审批者展示替代项。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "检验工具最小权限的形式定义、风险尺度和 Agent 权限选择评测。" }, "categories_seen": [ "cs.CR" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.31914", "first_author": "Xin Xu", "authors": [ "Xin Xu" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2610.31914", "author_source": "http://arxiv.org/abs/2610.31914v1", "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "shared_first_authors": [], "shared_first_note": "", "evidence": "HTML author block names Xin Xu only and gives no institutional affiliation." }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2607.18665": { "id": "2607.18665", "title": "DeepSafe-SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoring", "published": "2026-07-21T03:25:01Z", "updated": "2026-10-23T06:11:08Z", "authors": [ "Chunxiao Li", "Yuan Xiong", "Lijun Li", "Tianyi Du", "Wenlong Zhang", "Lei Bai", "Jing Shao" ], "categories": [ "cs.AI" ], "version_id": "2607.18665v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2607.18665v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" } ], "classification": "relevant", "reason": "直接比较深度研究 Agent 与标准模型的科学滥用风险，并衡量可执行性与新增危险，属于 Agent 安全评测。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2607.18665v2", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：科学助手尤其深度研究 Agent 能将危险知识转为可执行滥用指导。方法：SciHazard 以受监管实体和真实失败情境构造 12 学科的 2400 危险问题及 600 过度安全问题，DeHarm-Score 分解危害严重性、拒绝、可执行性和新增风险。作者报告其与专家标注的一致性较最强基线提高 90.17%；31 个模型及深度研究 Agent 的测试中，后者平均危害分数比标准 LLM 高 32.3%。", "topics": { "tags": [ "evaluation" ], "reason_zh": "明确评测自主深度研究 Agent 的科学危险输出与可执行滥用风险。" }, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2607.18665", "first_author": "Chunxiao Li", "authors": [ "Chunxiao Li", "Yuan Xiong", "Lijun Li", "Tianyi Du", "Wenlong Zhang", "Lei Bai", "Jing Shao" ], "affiliations": [ "Shanghai Artificial Intelligence Laboratory", "Fudan University" ], "source_url": "https://arxiv.org/html/2607.18665v2", "author_source": "https://export.arxiv.org/api/query?id_list=2607.18665", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "正文有共同贡献脚注，但 HTML 作者标记对应不完整，完整共同一作名单未确认。", "evidence": "Chunxiao Li superscripts 1,2 map explicitly to Shanghai Artificial Intelligence Laboratory and Fudan University. HTML contribution footnotes do not clearly preserve all name associations.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2607.19913": { "id": "2607.19913", "title": "JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety", "published": "2026-07-22T08:43:43Z", "updated": "2026-10-23T03:35:03Z", "authors": [ "Yuan Xiong", "Linji Hao", "Shizhu He", "Ken Deng", "Yequan Wang", "Lijun Li" ], "categories": [ "cs.AI", "cs.CL", "cs.CR" ], "version_id": "2607.19913v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2607.19913v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "Replacement submissions (showing 19 of 19 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Replacement submissions (showing 63 of 63 entries)" } ], "classification": "relevant", "reason": "提前预测工具 Agent 长程潜在危险并执行前阻止危险动作，直接属于运行时安全防护。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2607.19913v2", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：工具 Agent 的长程风险可能在局部轨迹尚不显著，需在行动前预判。方法：Janus 用多 Agent 模拟生成轨迹，联合训练未来风险预测和结合轨迹前缀与预测的安全裁决；CoAA-RL 根据预测对下游裁决的效用提供奖励，所得 Vanguard 在执行前阻止危险动作。作者报告四个 Agent 安全基准上的平均保护率提高 15.9 个百分点，良性任务完成率提高 5.1 个百分点。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "运行时前瞻安全裁决与执行前拦截，四项 Agent 安全基准验证；多 Agent 仅生成训练轨迹，不自动贴多智能体攻击标签。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2607.19913", "first_author": "Yuan Xiong", "authors": [ "Yuan Xiong", "Linji Hao", "Shizhu He", "Ken Deng", "Yequan Wang", "Lijun Li" ], "affiliations": [ "Institute of Automation, Chinese Academy of Sciences", "University of Chinese Academy of Sciences" ], "source_url": "https://arxiv.org/pdf/2607.19913v2", "author_source": "https://export.arxiv.org/api/query?id_list=2607.19913", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Yuan Xiong", "Linji Hao" ], "shared_first_note": "PDF 明确星号为共同贡献；† 为通讯作者。", "evidence": "PDF Yuan Xiong superscripts1,2 map to CAS Institute of Automation and UCAS School of Artificial Intelligence; co-first Linji Hao4 is Peking University.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Yuan Xiong": [ "Institute of Automation, Chinese Academy of Sciences", "University of Chinese Academy of Sciences" ], "Linji Hao": [ "Peking University" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2604.27819": { "id": "2604.27819", "title": "MCPHunt: An Evaluation Framework for Cross-Boundary Data Propagation in Multi-Server MCP Agents", "published": "2026-04-30T13:01:03Z", "updated": "2026-10-23T08:23:06Z", "authors": [ "Haonan Li", "Tianjun Sun", "Yongqing Wang", "Qisheng Zhang" ], "categories": [ "cs.AI" ], "version_id": "2604.27819v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2604.27819v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" } ], "classification": "relevant", "reason": "多 MCP server 的工具组合造成凭据跨信任边界传播，明确区分任务强制与违反策略泄露，直接相关。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是多 MCP server 中单独合法的读写组合也可能跨信任边界传凭据。MCPHunt 用 canary 字符串追踪、风险/良性/困难负例对照及 CRS 分层，区分任务要求逐字转移与本可脱敏却违规传播。作者在五个模型、147 任务、九类机制的 3615 条主轨迹上报告违规传播率 11.5%–41.3%，浏览器路径突出；提示缓解在三模型中最低达 0.3%、保留 80.5% 效用，但效果依模型变化。", "topics": { "id": "2604.27819", "tags": [ "supplychain", "privacy", "authorization", "evaluation" ], "reason_zh": "多服务 MCP 组合权限引发凭据跨边界流动，直接涉及信息流策略和权限组合安全。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2604.27819", "first_author": "Haonan Li", "authors": [ "Haonan Li", "Tianjun Sun", "Yongqing Wang", "Qisheng Zhang" ], "affiliations": [ "China University of Geosciences, Beijing", "Key Laboratory of Intraplate Volcanoes and Earthquakes (China University of Geosciences, Beijing), Ministry of Education" ], "source_url": "https://arxiv.org/html/2604.27819v2", "author_source": "https://export.arxiv.org/api/query?id_list=2604.27819", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Haonan Li has two individually attached affiliation blocks, university school and Ministry of Education key laboratory; both retained.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2605.08442": { "id": "2605.08442", "title": "Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents", "published": "2026-05-08T20:04:57Z", "updated": "2026-10-23T07:09:13Z", "authors": [ "Jun Wen Leong" ], "categories": [ "cs.CR", "cs.AI", "cs.LG" ], "version_id": "2605.08442v6", "announcement_date": null, "source": "http://arxiv.org/abs/2605.08442v6", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "持久记忆 Agent 的注入存储与攻击执行分离，测试泄露、防御与检索重构绕过，直接相关。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题是持久记忆 Agent 是否写入注入与是否后来执行是不同安全属性。作者评测 29 个前沿端点，发现部分模型在仅起草时不外传可能只是几乎不发邮件，显式要求发送后仍会泄露；又以九个开源模型的 5040 次因子实验测试四层六种防御。移除 recall 的 Memory Sandbox 在八/九模型上 ASR 为零，但可被从检索语料重建指令绕过，三个 Bedrock 模型达到 32.5%–97.5% ASR。作者强调两阶段分别评价；跨模型休眠指令转移仅为风险假设，未被证明。", "topics": { "id": "2605.08442", "tags": [ "injection", "memory", "privacy", "evaluation" ], "reason_zh": "持久记忆注入、后续数据外传及移除召回后的检索绕过均为直接 Agent 安全实验。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CR", "cs.LG" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2605.08442", "first_author": "Jun Wen Leong", "authors": [ "Jun Wen Leong" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2605.08442", "author_source": "https://export.arxiv.org/api/query?id_list=2605.08442", "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "shared_first_authors": [], "shared_first_note": "", "evidence": "Sole-author block names Jun Wen Leong and email only; no institutional affiliation." }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.09163": { "id": "2610.09163", "title": "ToolRACER: A Robust Agentic Conversation Emulation Resource for Agent Training and Evaluation", "published": "2026-10-06T22:06:17Z", "updated": "2026-10-22T19:56:20Z", "authors": [ "Arkajyoti Chakraborty", "Aryan Tayal", "Ishika Agarwal", "Tanner Sorensen", "Justin Chiu", "Alessandro Di Bari", "Neha Gupta", "Andreas Stolcke" ], "categories": [ "cs.CL", "cs.AI" ], "version_id": "2610.09163v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.09163v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Replacement submissions (showing 63 of 63 entries)" } ], "classification": "relevant", "reason": "正文确认Impossible类明确包含违反领域业务政策的用户目标，并要求Agent拒绝而非调用工具实现，属于工具Agent权限/政策边界评测子集；非所有adversarial轨迹均为攻击。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "summary_zh": "问题：工具对话Agent面对不合作用户、工具故障与不允许的请求时脆弱。方法：ToolRACER以用户、助手和工具模拟器生成并验证六领域、55人格的约5.6千轨迹。作者在摘要中称约66%含易失败情境，训练后跨τ2-bench和ACEBench端到端准确率改善。正文核验：Impossible类包括违反领域政策且应拒绝的请求；整体准确率收益不能解释为专门安全防护成功率。", "topics": { "id": "2610.09163", "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "工具Agent对政策禁止请求的拒绝及故障情境评测；非注入攻击基准。" }, "needs_full_text_review": true, "review": { "id": "2610.09163", "original_classification": "uncertain", "recommendation": "relevant", "classification": "relevant", "full_text_checked": true, "source": "https://arxiv.org/html/2610.09163v2", "sections_checked": [ "1 Introduction", "3.1–3.4", "4.1" ], "reason_zh": "正文确认Impossible类明确包含违反领域业务政策的用户目标，并要求Agent拒绝而非调用工具实现，属于工具Agent权限/政策边界评测子集；非所有adversarial轨迹均为攻击。", "evidence_zh": "§3.3 Policy constraint规定用户目标违反领域政策（如退款窗口已关闭），请求应被拒绝；§3.2.3任务成功评估检查硬约束与软偏好，不可行任务须解释和提供替代。其他Unhappy轨迹是信息不足、改目标和不合作态度，不能统称提示注入。", "summary_zh": "问题：工具对话Agent面对不合作用户、工具故障与不允许的请求时脆弱。方法：ToolRACER以用户、助手和工具模拟器生成并验证六领域、55人格的约5.6千轨迹。作者在摘要中称约66%含易失败情境，训练后跨τ2-bench和ACEBench端到端准确率改善。正文核验：Impossible类包括违反领域政策且应拒绝的请求；整体准确率收益不能解释为专门安全防护成功率。", "topics": { "id": "2610.09163", "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "工具Agent对政策禁止请求的拒绝及故障情境评测；非注入攻击基准。" }, "first_author": "Arkajyoti Chakraborty", "affiliations": [ "Uniphore" ], "affiliation_source": "https://arxiv.org/html/2610.09163v2", "author_note": "首页星号映射Uniphore，不是共同一作标记；未见共同一作声明。" }, "categories_seen": [ "cs.AI", "cs.CL" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.09163", "first_author": "Arkajyoti Chakraborty", "authors": [ "Arkajyoti Chakraborty", "Aryan Tayal", "Ishika Agarwal", "Tanner Sorensen", "Justin Chiu", "Alessandro Di Bari", "Neha Gupta", "Andreas Stolcke" ], "affiliations": [ "Uniphore" ], "source_url": "https://arxiv.org/html/2610.09163v2", "author_source": "https://export.arxiv.org/api/query?id_list=2610.09163", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Arkajyoti Chakraborty has star affiliation marker; star maps to Uniphore, diamond maps to a different coauthor university.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2605.01462": { "id": "2605.01462", "title": "LocalAlign: Enabling Generalizable Prompt Injection Defense via Generation of Near-Target Adversarial Examples for Alignment Training", "published": "2026-05-02T14:25:26Z", "updated": "2026-10-23T13:14:26Z", "authors": [ "Yuyang Gong", "Zihao Wang", "Jiawei Liu", "XiaoFeng Wang" ], "categories": [ "cs.CR" ], "version_id": "2605.01462v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2605.01462v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "Replacement submissions (showing 19 of 19 entries)" } ], "classification": "relevant", "reason": "针对外部数据和工具系统中不可信指令的提示注入提出对抗训练防御。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：传统提示注入对齐只覆盖固定攻击目标，难防诱导接近正确答案的细微错误。方法：LocalAlign用提示和一次推理生成近目标但错误的对抗样本，并按与正确答案的距离进行边际感知加权对齐。作者提出更紧的鲁棒边界设计；摘要未给实证数据或量化结果，不能补猜。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "injection" ], "reason_zh": "通过不可信数据中的指令生成对抗样本并训练注入防御。" }, "categories_seen": [ "cs.CR" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2605.01462", "first_author": "Yuyang Gong", "authors": [ "Yuyang Gong", "Zihao Wang", "Jiawei Liu", "XiaoFeng Wang" ], "affiliations": [ "Nanyang Technological University" ], "source_url": "https://arxiv.org/html/2605.01462v2", "author_source": "http://arxiv.org/abs/2605.01462v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Yuyang Gong", "Zihao Wang" ], "shared_first_note": "正文明确注明共同第一作者。", "evidence": "Yuyang Gong individually assigned NTU; first two authors explicit equal contribution note.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Yuyang Gong": [ "Nanyang Technological University" ], "Zihao Wang": [ "Nanyang Technological University" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2605.31196": { "id": "2605.31196", "title": "Probing Collision Grounding in Vision-Language Models for Safe Human-Robot Collaboration", "published": "2026-05-29T12:04:38Z", "updated": "2026-10-23T10:43:59Z", "authors": [ "Jun Wang", "Xiaohao Xu", "Xiaonan Huang" ], "categories": [ "cs.CV", "cs.AI", "cs.CL", "cs.RO" ], "version_id": "2605.31196v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2605.31196v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Replacement submissions (showing 63 of 63 entries)" } ], "classification": "relevant", "reason": "直接评测具身VLM对机器人碰撞和临近危险的安全监测能力。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：视觉语言机器人监测器可能无法将图像绑定到机器人几何并判断当前或即将发生的碰撞。方法：TouchSafeBench在Habitat 3.0中构建2940个共处场景，提供多视角RGB-D、轨迹、相机信息和仿真接触标签，评测当前安全分类及提前预警。作者报告3个VLM、9类表示中最佳平均Macro-F1仍低于50%，深度信息未自动转化为碰撞证据，机器人与环境接触比人接触风险更难判断。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "embodied", "monitoring", "evaluation" ], "reason_zh": "评测具身VLM安全监测的实际碰撞识别和预警。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.CV", "cs.RO" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2605.31196", "first_author": "Jun Wang", "authors": [ "Jun Wang", "Xiaohao Xu", "Xiaonan Huang" ], "affiliations": [ "University of Michigan, Ann Arbor" ], "source_url": "https://arxiv.org/html/2605.31196v2", "author_source": "http://arxiv.org/abs/2605.31196v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "正文有共同贡献注记，但 HTML 标记对应不完整，共同一作名单未确认。", "evidence": "Jun Wang explicitly has University of Michigan, Ann Arbor appended to own name. Equal-contribution note present but HTML peer mapping incomplete.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2610.21624": { "id": "2610.21624", "title": "AgentPerturb: Evaluating LLM Agent Robustness under Controlled Interaction Perturbations", "published": "2026-10-15T10:05:54Z", "updated": "2026-10-23T06:33:48Z", "authors": [ "Yuanjian Xu", "Jinyi Han", "Jianing Hao", "Yuxuan Sun", "Fanyang Lu", "Richeng Xuan", "Guang Zhang", "Zhichao Hu" ], "categories": [ "cs.AI" ], "version_id": "2610.21624v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2610.21624v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" } ], "classification": "relevant", "reason": "直接评测LLM Agent受交互输入扰动后传播损坏信息、验证不足和恢复需求。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：真实交互中的噪声如何破坏LLM Agent行为缺乏系统评测。方法：AgentPerturb按扰动目标与类型构造二维框架，在APEX-Agents与Toolathlon实施受控扰动并分析轨迹和计算代价。作者称扰动持续降低表现，主导弱点随环境而异；Agent很少识别改变的输入，常不经核验传播损坏信息，成功轨迹也可能耗费更多计算。摘要未提供具体降幅。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "robustness", "evaluation" ], "reason_zh": "受控交互输入破坏与Agent验证、恢复失败的鲁棒性评测。" }, "categories_seen": [ "cs.AI" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2610.21624", "first_author": "Yuanjian Xu", "authors": [ "Yuanjian Xu", "Jinyi Han", "Jianing Hao", "Yuxuan Sun", "Fanyang Lu", "Richeng Xuan", "Guang Zhang", "Zhichao Hu" ], "affiliations": [ "The Hong Kong University of Science and Technology (Guangzhou)" ], "source_url": "https://arxiv.org/html/2610.21624v2", "author_source": "http://arxiv.org/abs/2610.21624v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "正文有共同贡献注记，但 HTML 标记对应不完整，共同一作名单未确认。", "evidence": "Yuanjian Xu has individual HKUST Guangzhou affiliation; mixed coauthor affiliations not transferred.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2604.12284": { "id": "2604.12284", "title": "WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents", "published": "2026-04-14T04:50:35Z", "updated": "2026-10-23T05:44:49Z", "authors": [ "Yulin Chen", "Tri Cao", "Haoran Li", "Yibo Li", "Yue Liu", "Yufei He", "Le Minh Khoi", "Yangqiu Song", "Shuicheng Yan", "Bryan Hooi" ], "categories": [ "cs.CR" ], "version_id": "2604.12284v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2604.12284v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "Replacement submissions (showing 19 of 19 entries)" } ], "classification": "relevant", "reason": "面向网页Agent的HTML及截图提示注入独立多模态守卫防御。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：网页Agent可被HTML或截图中的注入指令诱导泄露信息，系统提示及直接微调防护有限。方法：WebAgentGuard让独立多模态守卫与任务Agent并行，使用GPT-5合成覆盖164个主题和230种视觉/UI风格的数据，经推理强化监督微调及强化学习训练。作者声称在多个基准优于强基线、保持任务效用且不增加时延；摘要未给具体攻击成功率或时延值。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "独立守卫检测网页视觉/文本提示注入，并验证防御与任务效用。" }, "categories_seen": [ "cs.CR" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2604.12284", "first_author": "Yulin Chen", "authors": [ "Yulin Chen", "Tri Cao", "Haoran Li", "Yibo Li", "Yue Liu", "Yufei He", "Le Minh Khoi", "Yangqiu Song", "Shuicheng Yan", "Bryan Hooi" ], "affiliations": [ "National University of Singapore" ], "source_url": "https://arxiv.org/html/2604.12284v2", "author_source": "http://arxiv.org/abs/2604.12284v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Yulin Chen", "Tri Cao" ], "shared_first_note": "正文明确注明共同第一作者。", "evidence": "Yulin Chen individually NUS; note explicitly names Yulin Chen and Tri Cao as equal contributors.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Yulin Chen": [ "National University of Singapore" ], "Tri Cao": [ "National University of Singapore" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2609.05901": { "id": "2609.05901", "title": "From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents", "published": "2026-09-05T05:53:51Z", "updated": "2026-10-23T00:40:11Z", "authors": [ "Yu Zheng", "Qizhi Zhang" ], "categories": [ "cs.CR", "cs.AI" ], "version_id": "2609.05901v2", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2609.05901v2", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "Replacement submissions (showing 19 of 19 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" } ], "classification": "relevant", "reason": "将LLM语义审批与执行授权绑定，隔离签名密钥并用阈值签名限制单域受控风险。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：同一LLM进程既判断又持有可复用签名凭据，会让错误判断直接变成付款或权限变更。方法：KITA将个人密钥和阈值签名份额放在LLM进程之外，要求来自t个不同审批签名域的认证批准，并绑定规范化行动。作者在阈值签名不可伪造及系统假设下给出授权完整性保证：控制提案方和少于t个域不足以伪造新行动授权。进程内原型结合结构化LLM适配器与阈值BLS，6项测试验证门控和消息绑定，7种受控场景比较结果，并测量签名成本；摘要无具体性能数值。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "authorization", "multiagent" ], "reason_zh": "分离LLM判断与执行凭据，以多个审批域的阈值授权限制受控域风险。" }, "categories_seen": [ "cs.AI", "cs.CR" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2609.05901", "first_author": "Yu Zheng", "authors": [ "Yu Zheng", "Qizhi Zhang" ], "affiliations": [ "University of California, Berkeley" ], "source_url": "https://arxiv.org/html/2609.05901v2", "author_source": "http://arxiv.org/abs/2609.05901v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Yu Zheng", "Qizhi Zhang" ], "shared_first_note": "正文明确注明共同第一作者。", "evidence": "Yu Zheng individually UC Berkeley; Qizhi Zhang shared equal-contribution footnote but is Independent Researcher.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Yu Zheng": [ "University of California, Berkeley" ], "Qizhi Zhang": [ "Independent Researcher" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2602.21262": { "id": "2602.21262", "title": "Under the Influence: Evaluating and Improving LLM Vigilance in Agentic Tasks", "published": "2026-02-24T04:09:21Z", "updated": "2026-10-22T17:53:12Z", "authors": [ "Sasha Robinson", "Katherine M. Collins", "Ilia Sucholutsky", "Kelsey R. Allen" ], "categories": [ "cs.CL", "cs.LG", "cs.MA" ], "version_id": "2602.21262v4", "announcement_date": "2026-10-26", "source": "http://arxiv.org/abs/2602.21262v4", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Replacement submissions (showing 63 of 63 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "new", "section": "Replacement submissions (showing 123 of 123 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.MA", "kind": "new", "section": "Replacement submissions (showing 11 of 11 entries)" } ], "classification": "relevant", "reason": "直接研究Agent如何拒绝恶意外部建议、避免网站危险诈骗及不安全仓库，并提出警觉性防护。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：开放环境中的自主Agent需要分辨善意建议与恶意影响。方法：在危险网站导航、电商诈骗规避和不安全代码仓库修补三项任务评估警觉性，并以模型估计的建议价值构造贝叶斯警觉性防护。作者发现所有测试前沿模型在各环境均易受恶意影响，任务能力与警觉性可分离；防护帮助恢复基线表现，同时保留正向建议收益。摘要未给具体数值。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "injection", "supplychain", "evaluation" ], "reason_zh": "评测外部恶意建议对Agent决策的影响，含代码仓库场景，并提出信息采纳防护。" }, "categories_seen": [ "cs.CL", "cs.LG", "cs.MA" ], "announcement_status": "原API-only记录，本轮由官方公告补证日期；不是新收录论文", "author": { "id": "2602.21262", "first_author": "Sasha Robinson", "authors": [ "Sasha Robinson", "Katherine M. Collins", "Ilia Sucholutsky", "Kelsey R. Allen" ], "affiliations": [ "University of British Columbia" ], "source_url": "https://arxiv.org/html/2602.21262v4", "author_source": "http://arxiv.org/abs/2602.21262v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Sasha Robinson has individual University of British Columbia affiliation. Stars on last authors are not first-author markers.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-27" ], "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告日期补证" }, "2604.24920": { "id": "2604.24920", "title": "SUDP: Secret-Use Delegation Protocol for Agentic Systems", "published": "2026-04-27T19:02:08Z", "updated": "2026-10-21T08:55:06Z", "authors": [ "Xiaohang Yu", "Hejia Geng", "Xinmeng Zeng", "William Knottenbelt" ], "categories": [ "cs.CR", "cs.AI" ], "version_id": "2604.24920v4", "announcement_date": null, "source": "http://arxiv.org/abs/2604.24920v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "直接针对提示注入或工具妥协使 Agent 获得可复用秘密权限的问题，给出受限秘密使用委托协议。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2604.24920v4", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：Agent 通过持有可复用密钥获得权限，短暂提示注入或工具妥协可能造成持久账户失陷。方法：SUDP 让不可信请求者提出规范操作，用户用新鲜认证器授权，保管者执行受限秘密操作，不把可复用权限交给 Agent。作者在标准密码假设下证明七项属性中的六项，第七项运行时内存机密性需组合硬件信任根；参考实现每次中介调用协议开销小于毫秒。", "topics": { "tags": [ "authorization", "privacy", "injection" ], "reason_zh": "隔离 Agent 可复用凭据并约束单次授权，威胁明确包括提示注入。" }, "categories_seen": [ "cs.AI", "cs.CR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2604.24920", "first_author": "Xiaohang Yu", "authors": [ "Xiaohang Yu", "Hejia Geng", "Xinmeng Zeng", "William Knottenbelt" ], "affiliations": [ "Imperial College London" ], "source_url": "https://arxiv.org/html/2604.24920v4", "author_source": "http://arxiv.org/abs/2604.24920v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Xiaohang Yu has individual Imperial College London affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.12445": { "id": "2610.12445", "title": "Telling FIBS: Probes Effectively Detect Sabotage and Catch Unverbalized Deception", "published": "2026-10-08T17:58:13Z", "updated": "2026-10-20T20:47:13Z", "authors": [ "Oskar J. Hollinsworth", "Alex F. Spies", "Tigist Diriba", "Adam Gleave", "Chris Cundy" ], "categories": [ "cs.LG", "cs.AI" ], "version_id": "2610.12445v4", "announcement_date": null, "source": "http://arxiv.org/abs/2610.12445v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "直接检测自治 Coding Agent 破坏行为及未言明欺骗，白盒探针在 SHADE-Arena 与 BashArena 验证。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.12445v4", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：自治 Agent 的破坏和未言明欺骗难由行为文本监控完全发现。方法：构建 FIBS 欺骗训练集并设计跨层、跨 token 聚合的白盒探针。作者报告 SHADE-Arena 与 BashArena 的 AUROC 为 98.3% 和 98.0%，动作文本监控为 97.7% 和 97.6%；真实隐藏目标识别最高 99.7%，并测试敏感政治主题下的欺骗。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "直接监测 Coding Agent sabotage/deception，以执行基准验证。" }, "categories_seen": [ "cs.AI", "cs.LG" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.12445", "first_author": "Oskar J. Hollinsworth", "authors": [ "Oskar J. Hollinsworth", "Alex F. Spies", "Tigist Diriba", "Adam Gleave", "Chris Cundy" ], "affiliations": [ "FAR.AI" ], "source_url": "https://arxiv.org/pdf/2610.12445v4", "author_source": "http://arxiv.org/abs/2610.12445v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Oskar J. Hollinsworth", "Alex F. Spies" ], "shared_first_note": "正文星号标注前两位作者共同贡献。", "evidence": "PDF first page has full author list above single common FAR.AI affiliation. First two names carry equal contribution stars.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Oskar J. Hollinsworth": [ "FAR.AI" ], "Alex F. Spies": [ "FAR.AI" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2606.03163": { "id": "2606.03163", "title": "OpenAgenet / OAN Yellow Paper: Technical Architecture for Trust-Governed Resource Identity and Discovery", "classification": "relevant", "reason": "直接定义Agent资源身份、授权发现、资源包完整性及签名调用的信任层，并含MCP/A2A集成。", "abstract_read": true, "summary_zh": "问题：异构Agent资源缺少统一可信身份、注册、发现与调用语义。方法：OpenAgenet/OAN以did:oan去中心化标识、可验证凭证、链上治理和Root验证资源包建立信任层；授权同时要求活跃治理状态和有效凭证，发现进一步验证包完整性、当前版本与授权域，调用有签名，并提供MCP/A2A集成配置。摘要给出安全属性、恢复与一致性要求，未报告实验性能或攻击防御数字。", "topics": { "tags": [ "authorization", "supplychain", "multiagent" ], "reason_zh": "直接约束Agent资源发现与调用授权，验证资源包和版本完整性，并将信任身份映射到MCP和A2A。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2606.03163v7", "published": "2026-06-02T05:18:14Z", "updated": "2026-10-26T04:24:22Z", "announcement_date": null, "categories_seen": [ "cs.AI", "cs.DC", "cs.MA" ], "candidate_type": "changed_version", "provenance": "official_category_API_sorted_lastUpdatedDate", "source_url": "https://arxiv.org/abs/2606.03163v7", "abstract_sha256": "35e5b3953fb20b1aeec03b1ac8f2962f13a40042ff2d6d184e2908c05d7025ac", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "仅官方API可见；公告日期未确认，不能称本日新公告", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-28" ], "version_history": [ { "id": "2606.03163", "version_id": "2606.03163v6", "classification": "relevant", "reason": "Agent、MCP、Skill 互联的身份、资源包核验、授权发现与签名调用技术架构，直接关联信任边界。", "published": "2026-06-02T05:18:14Z", "updated": "2026-10-20T06:40:01Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "6e3e9646104eec2356b2c74c75aac9ad5fed0c9b37e5dde662af715a040a754c", "provenance": "official_category_API_sorted_lastUpdatedDate" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2606.03163", "first_author": "Jinliang Xu", "authors": [ "Jinliang Xu" ], "affiliations": [ "China Academy of Information and Communications Technology" ], "source_url": "https://arxiv.org/pdf/2606.03163v7", "author_source": "https://arxiv.org/abs/2606.03163v7", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "verification_status": "affiliation_verified", "title": "OpenAgenet / OAN Yellow Paper: Technical Architecture for Trust-Governed Resource Identity and Discovery", "version_id": "2606.03163v7", "shared_first_affiliations": {} }, "authors": [ "Jinliang Xu" ], "categories": [ "cs.MA", "cs.AI", "cs.DC" ], "source": "http://arxiv.org/abs/2606.03163v6", "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2606.03163", "title": "OpenAgenet / OAN Yellow Paper: Technical Architecture for Trust-Governed Resource Identity and Discovery", "published": "2026-06-02T05:18:14Z", "updated": "2026-10-20T06:40:01Z", "authors": [ "Jinliang Xu" ], "categories": [ "cs.MA", "cs.AI", "cs.DC" ], "version_id": "2606.03163v6", "announcement_date": null, "source": "http://arxiv.org/abs/2606.03163v6", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "Agent、MCP、Skill 互联的身份、资源包核验、授权发现与签名调用技术架构，直接关联信任边界。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2606.03163v6", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：开放 Agent 网络需在协议交互前核实资源身份、发布包与调用权限。方法：OAN 技术黄皮书定义 did:oan 身份、注册、Root 生命周期、核验包、授权感知发现、基础设施授权凭证和签名调用，并说明验证要求及状态迁移。覆盖 MCP、A2A、Skills、MCP Server 与工具资源；摘要未给性能或安全实测数字，属架构规范。", "topics": { "tags": [ "authorization", "supplychain", "multiagent" ], "reason_zh": "Agent 跨运营方身份授权及工具/Skill 包发布信任，非已实证攻击防御效果。" }, "categories_seen": [ "cs.AI", "cs.DC", "cs.MA" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2606.03163", "first_author": "Jinliang Xu", "authors": [ "Jinliang Xu" ], "affiliations": [ "China Academy of Information and Communications Technology" ], "source_url": "https://arxiv.org/html/2606.03163v6", "author_source": "http://arxiv.org/abs/2606.03163v6", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Jinliang Xu individually lists CAICT, Beijing.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26" } ] }, "2606.03161": { "id": "2606.03161", "title": "OpenAgenet / OAN White Paper: Open Infrastructure for Trusted Agent Interconnection", "classification": "relevant", "reason": "Agent跨网络互联的身份验证、发现授权和可信生命周期直接属于Agent权限与多Agent信任安全；首发2026-06-02，本次为旧论文修订。", "abstract_read": true, "published": "2026-06-02T05:14:34Z", "version": 7, "summary_zh": "问题：独立运营网络中的Agent在交互前需要验证资源身份、治理状态、发现授权和新鲜度。方法：OAN结合DID、可验证凭据、链上治理与感知路由的注册发现；注册商审核证据，Root发布可验证包，授权发现节点返回签名结果，并区分公开凭据、本地签名材料和控制者授权；支持Skill、Runtime、Sidecar、Gateway及MCP/A2A接入。作者称已进行原型评估和公开试点以检查信任生命周期与运营瓶颈，摘要未给出定量安全结果。", "topics": { "tags": [ "authorization", "multiagent" ], "reason_zh": "核心是跨Agent资源的身份认证、发现授权和签名验证，并讨论MCP/A2A接入的信任边界。" }, "updated": "2026-10-26T04:20:14Z", "announcement_date": null, "candidate_type": "changed_version", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2606.03161v7", "categories_seen": [ "cs.AI", "cs.MA" ], "provenance": "official_category_API_sorted_lastUpdatedDate", "source_url": "https://arxiv.org/abs/2606.03161v7", "abstract_sha256": "539a00caf63bbc07a4219adf03577e8aa28fcf648366d0a2bfefd6898fffbd06", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "仅官方API可见；公告日期未确认，不能称本日新公告", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-28" ], "version_history": [ { "id": "2606.03161", "version_id": "2606.03161v6", "classification": "relevant", "reason": "开放多运营方 Agent 网络的身份来源与调用授权信任层，直接关联 Agent 互联安全。", "published": "2026-06-02T05:14:34Z", "updated": "2026-10-20T06:05:51Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "98e0b17399730458407137e0b50807e151a0f36faa86c71625441afac4e9cfb6", "provenance": "official_category_API_sorted_lastUpdatedDate" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2606.03161", "first_author": "Jinliang Xu", "authors": [ "Jinliang Xu" ], "affiliations": [ "China Academy of Information and Communications Technology" ], "source_url": "https://arxiv.org/pdf/2606.03161v7", "author_source": "https://arxiv.org/abs/2606.03161v7", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "verification_status": "affiliation_verified", "title": "OpenAgenet / OAN White Paper: Open Infrastructure for Trusted Agent Interconnection", "version_id": "2606.03161v7", "shared_first_affiliations": {} }, "authors": [ "Jinliang Xu" ], "categories": [ "cs.MA", "cs.AI" ], "source": "http://arxiv.org/abs/2606.03161v6", "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2606.03161", "title": "OpenAgenet / OAN White Paper: Open Infrastructure for Trusted Agent Interconnection", "published": "2026-06-02T05:14:34Z", "updated": "2026-10-20T06:05:51Z", "authors": [ "Jinliang Xu" ], "categories": [ "cs.MA", "cs.AI" ], "version_id": "2606.03161v6", "announcement_date": null, "source": "http://arxiv.org/abs/2606.03161v6", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "开放多运营方 Agent 网络的身份来源与调用授权信任层，直接关联 Agent 互联安全。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2606.03161v6", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：Agent 安全发现和调用其他 Agent 前，需核实身份来源、治理状态、权限与新鲜度。方法：OAN 白皮书提出协议中立信任层，以 did:oan、准入、注册协助、Root 核验包和签名调用组成联邦治理与资源发现架构。作者介绍原型、试点网络、部署及路线图；摘要未提供量化安全结果。", "topics": { "tags": [ "authorization", "supplychain", "multiagent" ], "reason_zh": "多运营方 Agent 互联的身份、资源发布与调用权限治理。" }, "categories_seen": [ "cs.AI", "cs.MA" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2606.03161", "first_author": "Jinliang Xu", "authors": [ "Jinliang Xu" ], "affiliations": [ "China Academy of Information and Communications Technology" ], "source_url": "https://arxiv.org/html/2606.03161v6", "author_source": "http://arxiv.org/abs/2606.03161v6", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Jinliang Xu individually lists CAICT, Beijing.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26" } ] }, "2605.11036": { "id": "2605.11036", "title": "Sequential Behavioral Watermarking for LLM Agents", "published": "2026-05-11T02:28:34Z", "updated": "2026-10-19T12:35:53Z", "authors": [ "Hyeseon An", "Shinwoo Park", "Dongsu Kim", "Yo-Sub Han" ], "categories": [ "cs.CR", "cs.AI" ], "version_id": "2605.11036v2", "announcement_date": null, "source": "http://arxiv.org/abs/2605.11036v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "将水印嵌入 LLM Agent 行为序列以验证来源和未授权复用，并评测轨迹篡改稳健性。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2605.11036v2", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：Agent 执行动作缺乏可验证来源，独立逐步水印在截断、扰动和失去对齐时脆弱。方法：SeqWM 将水印嵌入依赖历史的动作转移模式，用随机密钥基线进行与位置无关的验证。作者称跨 Agent 基准和模型保持效用并可靠检测，在轨迹破坏下仍稳健，摘要未给量化数值。", "topics": { "tags": [ "monitoring", "robustness" ], "reason_zh": "行为轨迹来源/未授权复用验证，且明确抵抗轨迹扰动。" }, "categories_seen": [ "cs.AI", "cs.CR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2605.11036", "first_author": "Hyeseon An", "authors": [ "Hyeseon An", "Shinwoo Park", "Dongsu Kim", "Yo-Sub Han" ], "affiliations": [ "Yonsei University" ], "source_url": "https://arxiv.org/pdf/2605.11036v2", "author_source": "http://arxiv.org/abs/2605.11036v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF first page Hyeseon An superscript1 maps to Department of Computer Science, Yonsei University; Luxembourg is coauthor2.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2604.05589": { "id": "2604.05589", "title": "Foundations for Investigations of Agentic AI Systems from the Forensic Analysis of OpenClaw", "published": "2026-04-07T08:35:22Z", "updated": "2026-10-19T10:50:42Z", "authors": [ "Jan Gruber", "Jan-Niclas Hilgert" ], "categories": [ "cs.CR", "cs.AI" ], "version_id": "2604.05589v2", "announcement_date": null, "source": "http://arxiv.org/abs/2604.05589v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "对 OpenClaw Agent 状态和执行行为开展数字取证与事件响应证据重建，直接关联 Agent 审计。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2604.05589v2", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：个人 Agent 的内部状态与行为难以在事件响应中重建。方法：以 OpenClaw 为例开展静态代码和差分取证，关联交互循环中的可恢复痕迹，提出五平面工件分类并与另外两套系统的已发布目录交叉映射。作者发布提取工具和机器可读 schema，指出模型、环境、上下文共同作用导致相同输入不产生同样痕迹；摘要未提供检测率。", "topics": { "tags": [ "monitoring" ], "reason_zh": "Agent 数字取证、行为溯源与事件响应。" }, "categories_seen": [ "cs.AI", "cs.CR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2604.05589", "first_author": "Jan Gruber", "authors": [ "Jan Gruber", "Jan-Niclas Hilgert" ], "affiliations": [ "Karlsruhe Institute of Technology" ], "source_url": "https://arxiv.org/html/2604.05589v2", "author_source": "http://arxiv.org/abs/2604.05589v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Jan Gruber individual affiliation KASTEL Security Research Labs, Karlsruhe Institute of Technology; FKIE belongs coauthor.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2608.23035": { "id": "2608.23035", "title": "MobilePA-Bench: Benchmarking Mobile Planner Agents on Complex Real-World Tasks", "published": "2026-08-24T09:38:24Z", "updated": "2026-10-19T09:43:29Z", "authors": [ "Yi Zhu", "Xiongwei Wu", "Qiyi Wang", "Tingyu Qu", "Jiajun Liu", "Sihan Cao", "Long Chen", "Weigao Sun", "Feida Zhu", "Yiran Zhong", "Steven Hoi" ], "categories": [ "cs.AI" ], "version_id": "2608.23035v3", "announcement_date": null, "source": "http://arxiv.org/abs/2608.23035v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文验证器明确拒绝破坏性/无关写入和未授权状态变更，不只是任务成功；作为移动 Agent 执行完整性/授权约束评测纳入，但不是对抗攻击基准。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2608.23035v3", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：移动 Agent 完成任务不代表遵守资源与操作边界。方法：1705 个任务、212 工具的状态沙箱，以调用/数据库变化/行为校验和记忆、Skill 路由门控区分完成与合规。摘要称发现检索、程序合规和执行错误，强化学习基线改进表现，未给具体安全率。正文核验：检查器明确拒绝未授权状态变更、破坏性或无关写入；Skill-only 模式要求完整路由先于业务调用。应视为执行完整性评测而非提示注入防御，真机迁移尚未验证。", "topics": { "tags": [ "evaluation", "authorization", "memory" ], "reason_zh": "状态变更授权、禁止额外破坏写入和记忆访问/动作联合门控；不把普通多 Agent 路由贴攻击标签。" }, "review": { "id": "2608.23035", "version_id": "2608.23035v3", "classification": "relevant", "recommendation": "relevant", "reason": "正文验证器明确拒绝破坏性/无关写入和未授权状态变更，不只是任务成功；作为移动 Agent 执行完整性/授权约束评测纳入，但不是对抗攻击基准。", "sections": [ "3.2 Unified Capability Coverage", "Appendix D Capability-Specific Task Construction", "E.1 Primary Checkers", "E.2 Memory and Skill Gates" ], "evidence_summary": "E.1 Tool Call 拒绝带任务相关副作用的额外调用，State Change 拒绝 destructive or unrelated writes。E.2 action policy 明确禁止 unauthorized state-changing calls，并区分只读助手和允许重试；Skill SOR 则要求完整 route 在任何非 Skill 调用前加载。论文承认 memory gate 只证明可观察访问，不证明因果使用，也不验证真机低层执行。", "source_url": "https://arxiv.org/html/2608.23035v3", "full_text_checked": true, "abstract_read": true, "summary_zh": "问题：移动 Agent 完成任务不代表遵守资源与操作边界。方法：1705 个任务、212 工具的状态沙箱，以调用/数据库变化/行为校验和记忆、Skill 路由门控区分完成与合规。摘要称发现检索、程序合规和执行错误，强化学习基线改进表现，未给具体安全率。正文核验：检查器明确拒绝未授权状态变更、破坏性或无关写入；Skill-only 模式要求完整路由先于业务调用。应视为执行完整性评测而非提示注入防御，真机迁移尚未验证。", "topics": { "tags": [ "evaluation", "authorization", "memory" ], "reason_zh": "状态变更授权、禁止额外破坏写入和记忆访问/动作联合门控；不把普通多 Agent 路由贴攻击标签。" } }, "categories_seen": [ "cs.AI" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2608.23035", "first_author": "Yi Zhu", "authors": [ "Yi Zhu", "Xiongwei Wu", "Qiyi Wang", "Tingyu Qu", "Jiajun Liu", "Sihan Cao", "Long Chen", "Weigao Sun", "Feida Zhu", "Yiran Zhong", "Steven Hoi" ], "affiliations": [ "Alibaba Group" ], "source_url": "https://arxiv.org/html/2608.23035v3", "author_source": "http://arxiv.org/abs/2608.23035v3", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Yi Zhu", "Xiongwei Wu" ], "shared_first_note": "正文明确前两名星号为共同贡献，‡为实习、§为项目负责人。", "evidence": "One common MAI Team, Alibaba Token Hub, Alibaba Group affiliation follows entire author list.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Yi Zhu": [ "Alibaba Group" ], "Xiongwei Wu": [ "Alibaba Group" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.08472": { "id": "2609.08472", "title": "From Evidence to Effect: Authority Semantics and Runtime Infrastructure for Stateful Agents", "published": "2026-09-08T09:11:53Z", "updated": "2026-10-19T08:35:24Z", "authors": [ "Yang Li", "Zongsi Xu", "Sergey Volkov", "hai liu", "Tuo Zhou", "Xiyu Chen", "Di Wan", "Dian Shao", "Ye Luo", "Hao Sun" ], "categories": [ "cs.MA", "cs.SE" ], "version_id": "2609.08472v4", "announcement_date": null, "source": "http://arxiv.org/abs/2609.08472v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "状态 Agent 在权限变化后复用工件的 authority 语义及执行准入，明确阻止危险建议并执行合法授权意图。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2609.08472v4", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：有状态 Agent 在执行与权限变化后复用工件，需区分证据与当前操作权限。方法：形式化 authority-sufficient observations 和绑定执行/材料身份的持久效果，WTB 通过运行时适配、共享证据及事务发布恢复实施。作者报告原始/类型化证据均解决 32/32 授权案例，固定意图执行阻止 6 个不安全建议且执行 12 个合法意图；集成取得 176/210 阶段验收与 8/8 仓库恢复，并说明完整对照同样可达到其能力。", "topics": { "tags": [ "authorization", "memory", "monitoring" ], "reason_zh": "权限变化后的工件复用及操作效果准入，含显式不安全执行拦截。" }, "categories_seen": [ "cs.MA", "cs.SE" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2609.08472", "first_author": "Yang Li", "authors": [ "Yang Li", "Zongsi Xu", "Sergey Volkov", "hai liu", "Tuo Zhou", "Xiyu Chen", "Di Wan", "Dian Shao", "Ye Luo", "Hao Sun" ], "affiliations": [ "The University of Hong Kong" ], "source_url": "https://arxiv.org/html/2609.08472v4", "author_source": "http://arxiv.org/abs/2609.08472v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Yang Li superscript1 maps to University of Hong Kong.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2605.07630": { "id": "2605.07630", "title": "Safe, or Simply Incapable? Rethinking Safety Evaluation for Phone-Use Agents", "published": "2026-05-08T11:58:57Z", "updated": "2026-10-19T04:53:00Z", "authors": [ "Zhengyang Tang", "Yi Zhang", "Chenxin Li", "Xin Lai", "Pengyuan Lyu", "Yiduo Guo", "Weinong Wang", "Junyi Li", "Yang Ding", "Huawen Shen", "Zhengyao Fang", "Xingran Zhou", "Liang Wu", "Fei Tang", "Sunqi Fan", "Shangpin Peng", "Zheng Ruan", "Anran Zhang", "Benyou Wang", "Chengquan Zhang", "Han Hu" ], "categories": [ "cs.CL", "cs.AI", "cs.LG" ], "version_id": "2605.07630v2", "announcement_date": null, "source": "http://arxiv.org/abs/2605.07630v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "手机 Agent 风险决策明确区分安全选择、危险选择和无能力行动，直接安全评测。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2605.07630v2", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：手机 Agent 没造成伤害可能只是不会操作，不能自动证明安全。方法：PhoneSafety 从 130 多个真实 App 的交互抽取 700 个风险时刻，区分下一步安全选择、不安全选择与无有效行动，测试 8 个 Agent。作者发现一般能力更强不一定更安全，无效行动更像能力信号，去掉视觉输入会增加这类失败；摘要未给具体违规率。", "topics": { "tags": [ "evaluation", "authorization" ], "reason_zh": "把执行能力不足与真正安全判断分离的手机 Agent 风险动作评测。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2605.07630", "first_author": "Zhengyang Tang", "authors": [ "Zhengyang Tang", "Yi Zhang", "Chenxin Li", "Xin Lai", "Pengyuan Lyu", "Yiduo Guo", "Weinong Wang", "Junyi Li", "Yang Ding", "Huawen Shen", "Zhengyao Fang", "Xingran Zhou", "Liang Wu", "Fei Tang", "Sunqi Fan", "Shangpin Peng", "Zheng Ruan", "Anran Zhang", "Benyou Wang", "Chengquan Zhang", "Han Hu" ], "affiliations": [ "Tencent Hunyuan", "The Chinese University of Hong Kong, Shenzhen" ], "source_url": "https://arxiv.org/pdf/2605.07630v2", "author_source": "http://arxiv.org/abs/2605.07630v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Zhengyang Tang", "Yi Zhang" ], "shared_first_note": "PDF 明确前两位共同贡献，保留各自多单位映射。", "evidence": "PDF Zhengyang Tang1,2 maps to Tencent Hunyuan and CUHK Shenzhen; co-first Yi Zhang1,3 is Tencent Hunyuan and Tsinghua.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Zhengyang Tang": [ "Tencent Hunyuan", "The Chinese University of Hong Kong, Shenzhen" ], "Yi Zhang": [ "Tencent Hunyuan", "Tsinghua University" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2604.01723": { "id": "2604.01723", "title": "Causal Scene Narration: Inference-Time Text Restructuring for Vision-Language-Action Driving", "published": "2026-04-02T07:43:05Z", "updated": "2026-10-19T03:49:31Z", "authors": [ "Yun Li", "Yidu Zhang", "Simon Thompson", "Ehsan Javanmardi", "Manabu Tsukada" ], "categories": [ "cs.RO", "cs.AI" ], "version_id": "2604.01723v2", "announcement_date": null, "source": "http://arxiv.org/abs/2604.01723v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "VLA 驾驶指令与危险约束对齐并按违章惩罚评估，含运行时监督妨碍避险的安全负结果。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2604.01723v2", "backfill_kind": "official_api_update_time_replacement_backfill", "summary_zh": "问题：自动驾驶 VLA 的导航和风险提示碎片化，难将约束对齐当前动作。方法：CSN 在推理时重组意图、约束和量化信息，并对比训练偏好对齐与运行时监督。作者在 CARLA 的 16 路线/8 城镇、5 次实验报告原 LMDrive 与对齐版本驾驶分数相对提高 31.1%/24.5%；信息本身贡献大部增益，结构份额区间宽。简单方向冲突监控从未触发且被动夹紧截断避险、降低驾驶分数。", "topics": { "tags": [ "embodied", "monitoring", "evaluation" ], "reason_zh": "VLA 驾驶的危险约束和违章惩罚，以及运行时监督副作用。" }, "categories_seen": [ "cs.AI", "cs.RO" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2604.01723", "first_author": "Yun Li", "authors": [ "Yun Li", "Yidu Zhang", "Simon Thompson", "Ehsan Javanmardi", "Manabu Tsukada" ], "affiliations": [ "The University of Tokyo" ], "source_url": "https://arxiv.org/html/2604.01723v2", "author_source": "http://arxiv.org/abs/2604.01723v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Yun Li individual Graduate School of Information Science and Technology, University of Tokyo affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.21561": { "id": "2610.21561", "classification": "relevant", "reason": "对话代理程序幻觉检测，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "5154f8390229e3f710052c4eceb09162bb4015cc868faa7688ad70f0c559dece", "summary_zh": "仅据摘要，作者声称：DialFork针对对话代理话语合理但流程跑偏，分叉合规对话并注入四种程序幻觉，构成36278条对话、24任务及12领域；提出部署监控、单对话评分和偏离起点检测，作者报告FlowScore在七种编码器上优于基线，未给统一提升数值。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "对话代理程序幻觉检测，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "DialFork: Going Beyond Factuality to Evaluate Procedural Hallucination in Conversational Agents", "version_id": "2610.21561v5", "published": "2026-10-15T09:18:32Z", "updated": "2026-10-30T16:29:18Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 139 of 139 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.21561v5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-10-28", "2026-11-03" ], "version_history": [ { "id": "2610.21561", "version_id": "2610.21561v3", "classification": "relevant", "reason": "正文将工作流身份破坏明确作为提示注入及任务歧义失败的模型，测量Agent偏离规定流程并定位首次偏离，属安全监测相关；不是真实攻击成功率评估。", "published": "2026-10-15T09:18:32Z", "updated": "2026-10-21T16:28:11Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "5154f8390229e3f710052c4eceb09162bb4015cc868faa7688ad70f0c559dece", "provenance": "official_category_API_sorted_lastUpdatedDate" }, { "id": "2610.21561", "version_id": "2610.21561v4", "classification": "irrelevant", "reason": "正文对象是原始对话文本的流程偏离，四种人工分叉包含换流程、乱序、换目标和冲突系统约束；prompt injection 仅作为流程替换的动机之一，没有实际不可信输入攻击、工具动作、授权或危险后果评测。数据与指标主要刻画对话过程符合度，按严格 Agent 自身安全范围排除。", "published": "2026-10-15T09:18:32Z", "updated": "2026-10-26T15:21:07Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "5154f8390229e3f710052c4eceb09162bb4015cc868faa7688ad70f0c559dece", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 271 of 271 entries)", "category": "cs.LG", "kind": "new" } ], "title": "DialFork: Going Beyond Factuality to Evaluate Procedural Hallucination in Conversational Agents", "source_index": 123, "version": 4, "initial_classification": "uncertain", "scope_review": { "id": "2610.21561", "title": "DialFork: Going Beyond Factuality to Evaluate Procedural Hallucination in Conversational Agents", "version_id": "2610.21561v4", "original_classification": "uncertain", "classification": "irrelevant", "reason": "正文对象是原始对话文本的流程偏离，四种人工分叉包含换流程、乱序、换目标和冲突系统约束；prompt injection 仅作为流程替换的动机之一，没有实际不可信输入攻击、工具动作、授权或危险后果评测。数据与指标主要刻画对话过程符合度，按严格 Agent 自身安全范围排除。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 流程定义与四类幻觉", "§4 构造与人类验证", "§5–6 三类评测/指标", "Limitations" ], "source_url": "https://arxiv.org/pdf/2610.21561v4", "evidence_notes": [ "不能把 36,278 段合成流程偏离对话概括成已验证的真实 Agent 攻击轨迹。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 流程定义与四类幻觉", "§4 构造与人类验证", "§5–6 三类评测/指标", "Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.21561v4", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "candidate_type": "changed_version", "source_url": "https://arxiv.org/abs/2610.21561v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "summary_retained_from_version": "2610.21561v3" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.21561", "first_author": "Sergio Burdisso", "authors": [ "Sergio Burdisso", "Esaú Villatoro-Tello", "Dairazalia Sánchez-Cortés", "Yanis Labrak", "Jordi Luque", "Milos Cernak", "Petr Motlicek" ], "affiliations": [ "Idiap Research Institute" ], "source_url": "https://arxiv.org/pdf/2610.21561v5", "author_source": "https://arxiv.org/abs/2610.21561v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "verification_status": "affiliation_verified", "title": "DialFork: Going Beyond Factuality to Evaluate Procedural Hallucination in Conversational Agents", "version_id": "2610.21561v5", "shared_first_affiliations": {}, "affiliation_checked": true }, "source_index": 123, "version": 4, "initial_classification": "uncertain", "reviewed_sections": [ "完整摘要", "§3 流程定义与四类幻觉", "§4 构造与人类验证", "§5–6 三类评测/指标", "Limitations" ], "summary_retained_from_version": "2610.21561v3", "authors": [ "Sergio Burdisso", "Esaú Villatoro-Tello", "Dairazalia Sánchez-Cortés", "Yanis Labrak", "Jordi Luque", "Milos Cernak", "Petr Motlicek" ], "categories": [ "cs.CL", "cs.AI", "cs.LG" ], "source": "http://arxiv.org/abs/2610.21561v3", "needs_full_text_review": true, "review": { "id": "2610.21561", "original_classification": "uncertain", "recommendation": "relevant", "classification": "relevant", "full_text_checked": true, "source": "https://arxiv.org/html/2610.21561v3", "sections_checked": [ "1 Introduction", "3.1–3.2", "4.1–4.2", "5 Evaluation Tasks and Methods" ], "reason_zh": "正文将工作流身份破坏明确作为提示注入及任务歧义失败的模型，测量Agent偏离规定流程并定位首次偏离，属安全监测相关；不是真实攻击成功率评估。", "evidence_zh": "§3.2 WIC替换工作流并明确modeling task disambiguation failures and prompt injection；§4.1以额外system message注入破坏指令生成合成轨迹，非来自低信任外部输入的攻击试验；§5强调评测文本中流程偏差而非模型受攻击倾向。", "summary_zh": "问题：对话Agent可生成事实可信但偏离指定流程的内容。方法：DialFork以可控分叉与四种破坏方式构造36,278段对话，覆盖24任务12领域，提出流程距离与首次偏离定位任务。作者摘要称FlowScore在七编码器上显著优于基线。正文核验：工作流身份破坏旨在模拟提示注入等失败，但通过system消息人为施加，不能将结果当作实际注入攻击成功率或部署防御效果。", "topics": { "id": "2610.21561", "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "合成提示注入式工作流偏离及流程监测评测，非攻击实测。" }, "first_author": "Sergio Burdisso", "affiliations": [ "Idiap Research Institute, Martigny, Switzerland" ], "affiliation_source": "https://arxiv.org/html/2610.21561v3", "author_note": "首页明确署名映射；未见共同一作声明。" }, "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2610.21561", "title": "DialFork: Going Beyond Factuality to Evaluate Procedural Hallucination in Conversational Agents", "published": "2026-10-15T09:18:32Z", "updated": "2026-10-21T16:28:11Z", "authors": [ "Sergio Burdisso", "Esaú Villatoro-Tello", "Dairazalia Sánchez-Cortés", "Yanis Labrak", "Jordi Luque", "Milos Cernak", "Petr Motlicek" ], "categories": [ "cs.CL", "cs.AI", "cs.LG" ], "version_id": "2610.21561v3", "announcement_date": null, "source": "http://arxiv.org/abs/2610.21561v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文将工作流身份破坏明确作为提示注入及任务歧义失败的模型，测量Agent偏离规定流程并定位首次偏离，属安全监测相关；不是真实攻击成功率评估。", "abstract_read": true, "evidence_level": "full_abstract_and_selected_body_sections", "full_text_checked": true, "summary_zh": "问题：对话Agent可生成事实可信但偏离指定流程的内容。方法：DialFork以可控分叉与四种破坏方式构造36,278段对话，覆盖24任务12领域，提出流程距离与首次偏离定位任务。作者摘要称FlowScore在七编码器上显著优于基线。正文核验：工作流身份破坏旨在模拟提示注入等失败，但通过system消息人为施加，不能将结果当作实际注入攻击成功率或部署防御效果。", "topics": { "id": "2610.21561", "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "合成提示注入式工作流偏离及流程监测评测，非攻击实测。" }, "needs_full_text_review": true, "review": { "id": "2610.21561", "original_classification": "uncertain", "recommendation": "relevant", "classification": "relevant", "full_text_checked": true, "source": "https://arxiv.org/html/2610.21561v3", "sections_checked": [ "1 Introduction", "3.1–3.2", "4.1–4.2", "5 Evaluation Tasks and Methods" ], "reason_zh": "正文将工作流身份破坏明确作为提示注入及任务歧义失败的模型，测量Agent偏离规定流程并定位首次偏离，属安全监测相关；不是真实攻击成功率评估。", "evidence_zh": "§3.2 WIC替换工作流并明确modeling task disambiguation failures and prompt injection；§4.1以额外system message注入破坏指令生成合成轨迹，非来自低信任外部输入的攻击试验；§5强调评测文本中流程偏差而非模型受攻击倾向。", "summary_zh": "问题：对话Agent可生成事实可信但偏离指定流程的内容。方法：DialFork以可控分叉与四种破坏方式构造36,278段对话，覆盖24任务12领域，提出流程距离与首次偏离定位任务。作者摘要称FlowScore在七编码器上显著优于基线。正文核验：工作流身份破坏旨在模拟提示注入等失败，但通过system消息人为施加，不能将结果当作实际注入攻击成功率或部署防御效果。", "topics": { "id": "2610.21561", "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "合成提示注入式工作流偏离及流程监测评测，非攻击实测。" }, "first_author": "Sergio Burdisso", "affiliations": [ "Idiap Research Institute, Martigny, Switzerland" ], "affiliation_source": "https://arxiv.org/html/2610.21561v3", "author_note": "首页明确署名映射；未见共同一作声明。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.21561", "first_author": "Sergio Burdisso", "authors": [ "Sergio Burdisso", "Esaú Villatoro-Tello", "Dairazalia Sánchez-Cortés", "Yanis Labrak", "Jordi Luque", "Milos Cernak", "Petr Motlicek" ], "affiliations": [ "Idiap Research Institute" ], "source_url": "https://arxiv.org/html/2610.21561v3", "author_source": "http://arxiv.org/abs/2610.21561v3", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Sergio Burdisso individually lists Idiap Research Institute, Martigny.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26" }, { "id": "2610.21561", "title": "DialFork: Going Beyond Factuality to Evaluate Procedural Hallucination in Conversational Agents", "classification": "irrelevant", "reason": "正文对象是原始对话文本的流程偏离，四种人工分叉包含换流程、乱序、换目标和冲突系统约束；prompt injection 仅作为流程替换的动机之一，没有实际不可信输入攻击、工具动作、授权或危险后果评测。数据与指标主要刻画对话过程符合度，按严格 Agent 自身安全范围排除。", "abstract_read": true, "source_index": 123, "version_id": "2610.21561v4", "version": 4, "published": "2026-10-15T09:18:32Z", "updated": "2026-10-26T15:21:07Z", "summary_zh": "DialFork通过在合规对话的受控轮次插入四类程序幻觉，构建12领域24任务36278段对话，经30位标注者验证。评测总体偏离、单对话偏离及首个偏离轮次，并提出流程感知FlowKL与FlowScore。作者称FlowScore在七个编码器上显著超过对照，指出语义相似不代表流程一致；摘要未给具体幅度。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "对话Agent流程监控和实时护栏，安全特异性待正文核查。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.21561", "title": "DialFork: Going Beyond Factuality to Evaluate Procedural Hallucination in Conversational Agents", "version_id": "2610.21561v4", "original_classification": "uncertain", "classification": "irrelevant", "reason": "正文对象是原始对话文本的流程偏离，四种人工分叉包含换流程、乱序、换目标和冲突系统约束；prompt injection 仅作为流程替换的动机之一，没有实际不可信输入攻击、工具动作、授权或危险后果评测。数据与指标主要刻画对话过程符合度，按严格 Agent 自身安全范围排除。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 流程定义与四类幻觉", "§4 构造与人类验证", "§5–6 三类评测/指标", "Limitations" ], "source_url": "https://arxiv.org/pdf/2610.21561v4", "evidence_notes": [ "不能把 36,278 段合成流程偏离对话概括成已验证的真实 Agent 攻击轨迹。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 流程定义与四类幻觉", "§4 构造与人类验证", "§5–6 三类评测/指标", "Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.21561v4", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 271 of 271 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.21561v4", "abstract_sha256": "5154f8390229e3f710052c4eceb09162bb4015cc868faa7688ad70f0c559dece", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "version_history": [ { "id": "2610.21561", "version_id": "2610.21561v3", "classification": "relevant", "reason": "正文将工作流身份破坏明确作为提示注入及任务歧义失败的模型，测量Agent偏离规定流程并定位首次偏离，属安全监测相关；不是真实攻击成功率评估。", "published": "2026-10-15T09:18:32Z", "updated": "2026-10-21T16:28:11Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "5154f8390229e3f710052c4eceb09162bb4015cc868faa7688ad70f0c559dece", "provenance": "official_category_API_sorted_lastUpdatedDate" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "summary_retained_from_version": "2610.21561v3", "author": { "id": "2610.21561", "first_author": "Sergio Burdisso", "authors": [ "Sergio Burdisso", "Esaú Villatoro-Tello", "Dairazalia Sánchez-Cortés", "Yanis Labrak", "Jordi Luque", "Milos Cernak", "Petr Motlicek" ], "affiliations": [ "Idiap Research Institute" ], "source_url": "https://arxiv.org/pdf/2610.21561v4", "author_source": "https://arxiv.org/abs/2610.21561v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "verification_status": "affiliation_verified", "title": "DialFork: Going Beyond Factuality to Evaluate Procedural Hallucination in Conversational Agents", "version_id": "2610.21561v4", "shared_first_affiliations": {} }, "authors": [ "Sergio Burdisso", "Esaú Villatoro-Tello", "Dairazalia Sánchez-Cortés", "Yanis Labrak", "Jordi Luque", "Milos Cernak", "Petr Motlicek" ], "categories": [ "cs.CL", "cs.AI", "cs.LG" ], "source": "http://arxiv.org/abs/2610.21561v3", "needs_full_text_review": true, "review": { "id": "2610.21561", "original_classification": "uncertain", "recommendation": "relevant", "classification": "relevant", "full_text_checked": true, "source": "https://arxiv.org/html/2610.21561v3", "sections_checked": [ "1 Introduction", "3.1–3.2", "4.1–4.2", "5 Evaluation Tasks and Methods" ], "reason_zh": "正文将工作流身份破坏明确作为提示注入及任务歧义失败的模型，测量Agent偏离规定流程并定位首次偏离，属安全监测相关；不是真实攻击成功率评估。", "evidence_zh": "§3.2 WIC替换工作流并明确modeling task disambiguation failures and prompt injection；§4.1以额外system message注入破坏指令生成合成轨迹，非来自低信任外部输入的攻击试验；§5强调评测文本中流程偏差而非模型受攻击倾向。", "summary_zh": "问题：对话Agent可生成事实可信但偏离指定流程的内容。方法：DialFork以可控分叉与四种破坏方式构造36,278段对话，覆盖24任务12领域，提出流程距离与首次偏离定位任务。作者摘要称FlowScore在七编码器上显著优于基线。正文核验：工作流身份破坏旨在模拟提示注入等失败，但通过system消息人为施加，不能将结果当作实际注入攻击成功率或部署防御效果。", "topics": { "id": "2610.21561", "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "合成提示注入式工作流偏离及流程监测评测，非攻击实测。" }, "first_author": "Sergio Burdisso", "affiliations": [ "Idiap Research Institute, Martigny, Switzerland" ], "affiliation_source": "https://arxiv.org/html/2610.21561v3", "author_note": "首页明确署名映射；未见共同一作声明。" }, "first_seen_date": "2026-10-26" } ] }, "2602.03608": { "id": "2602.03608", "title": "Controlling Output Rankings in LLM-Based Search via Generative Engine Optimization", "published": "2026-02-03T14:59:48Z", "updated": "2026-10-21T05:18:42Z", "authors": [ "Haibo Jin", "Huimin Zeng", "Yifeng Luo", "Haohan Wang" ], "categories": [ "cs.CL", "cs.AI", "cs.IR" ], "version_id": "2602.03608v2", "announcement_date": null, "source": "http://arxiv.org/abs/2602.03608v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "通过操纵搜索返回内容控制LLM搜索推荐，属于外部内容对工具Agent决策的注入影响。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：LLM搜索产品推荐受检索内容影响，可被外部内容操纵。方法：CORE在搜索返回内容附加字符串、推理或评论式优化内容；ProductBench覆盖15类、每类200商品。作者称四个具搜索能力LLM上的平均排名提升成功率Top-5为91.4%、Top-3为86.6%、Top-1为80.3%，并保持内容流畅。", "topics": { "id": "2602.03608", "tags": [ "injection", "evaluation" ], "reason_zh": "针对搜索工具返回内容的决策操纵及基准评估。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CL", "cs.IR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2602.03608", "first_author": "Haibo Jin", "authors": [ "Haibo Jin", "Huimin Zeng", "Yifeng Luo", "Haohan Wang" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "source_url": "https://arxiv.org/html/2602.03608v2", "author_source": "http://arxiv.org/abs/2602.03608v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Haibo Jin individually lists School of Information Sciences, University of Illinois at Urbana-Champaign.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2604.07667": { "id": "2604.07667", "title": "From Debate to Decision: Conformal Social Choice for Safe Multi-Agent Deliberation", "published": "2026-04-09T00:15:20Z", "updated": "2026-10-20T05:19:34Z", "authors": [ "Mengdie Flora Wang", "Haochen Xie", "Guanghui Wang", "Aijing Gao", "Guang Yang", "Ziyuan Li", "Qucy Wei Qiu", "Fangwei Han", "Hengzhi Qiu", "Yajing Huang", "Bing Zhu", "Jae Oh Woo" ], "categories": [ "cs.AI", "cs.MA", "cs.SI" ], "version_id": "2604.07667v2", "announcement_date": null, "source": "http://arxiv.org/abs/2604.07667v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "多Agent错误共识可能直接触发行动，方法以校准集合控制自主执行或人工升级，直接涉及行动安全。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：多LLM辩论的错误共识可能被直接执行。方法：Conformal Social Choice汇聚异构Agent的概率，经分割保形预测校准；单元素集合允许自主行动，其余升级人工。作者称最终轮在α=0.05时标记81.9%的错误共识，固定轮边际覆盖接近目标；简单阈值可达类似拦截，保形方法独特价值是有限样本固定轮覆盖保证，自适应首次单元素停止不享该保证。", "topics": { "id": "2604.07667", "tags": [ "multiagent", "authorization", "monitoring", "evaluation" ], "reason_zh": "多Agent错误共识监测与自主行动/人工升级门控。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.MA", "cs.SI" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2604.07667", "first_author": "Mengdie Flora Wang", "authors": [ "Mengdie Flora Wang", "Haochen Xie", "Guanghui Wang", "Aijing Gao", "Guang Yang", "Ziyuan Li", "Qucy Wei Qiu", "Fangwei Han", "Hengzhi Qiu", "Yajing Huang", "Bing Zhu", "Jae Oh Woo" ], "affiliations": [ "Amazon Web Services" ], "source_url": "https://arxiv.org/html/2604.07667v2", "author_source": "http://arxiv.org/abs/2604.07667v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Mengdie Flora Wang individual AWS Generative AI Innovation Center affiliation; HSBC belongs coauthors.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.18603": { "id": "2610.18603", "title": "AgentStripes: An Evidence-Graded Maturity Model for AI Agents", "published": "2026-10-13T15:57:28Z", "updated": "2026-10-20T04:25:19Z", "authors": [ "Nutan Kumar Naik", "Vijay Prasad Poudel", "Aditya Kumar Saroj", "Saurav Samantray", "Abhishek Patel" ], "categories": [ "cs.AI", "cs.CY", "eess.SY" ], "version_id": "2610.18603v2", "announcement_date": null, "source": "http://arxiv.org/abs/2610.18603v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "Agent安全、可观测性、工程控制与证据成熟度直接评测，明确局限于未验证的示范。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：任务基准不说明某个Agent版本是否具备可靠、安全、可观察的工程控制及其证据。方法：AgentStripes定义0至7级、12过程领域40能力、基本/安全/证明三道硬门槛和E0至E5证据等级。作者在30个公开Python Agent库上进行静态证据演示：26个为1级、4个为2级；22个复判中4个等级改变。参数为专家约定，尚未证明等级能预测可靠性或安全性，不能当作已验证认证。", "topics": { "id": "2610.18603", "tags": [ "evaluation", "monitoring" ], "reason_zh": "按Agent安全控制及证据评定工程成熟度。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CY", "eess.SY" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.18603", "first_author": "Nutan Kumar Naik", "authors": [ "Nutan Kumar Naik", "Vijay Prasad Poudel", "Aditya Kumar Saroj", "Saurav Samantray", "Abhishek Patel" ], "affiliations": [ "Algen.AI", "National Institute of Technology Rourkela" ], "source_url": "https://arxiv.org/html/2610.18603v2", "author_source": "http://arxiv.org/abs/2610.18603v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Nutan Kumar Naik has individual Algen.AI and NIT Rourkela Earth and Atmospheric Sciences affiliation blocks; both retained.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2605.11442": { "id": "2605.11442", "version_id": "2605.11442v3", "abstract_sha256": "a9e3378906d517c716e099d408c541e9a09a5ca3e66c11b85f9b3677c2145a45", "abstract_read": true, "classification": "relevant", "reason": "直接研究一次间接注入利用持久化代理组件形成持续资源耗尽及服务拒绝。", "reason_zh": "直接研究一次间接注入利用持久化代理组件形成持续资源耗尽及服务拒绝。", "summary_zh": "问题：代理作为用户与模型服务中枢可能放大系统级可用性风险。方法：Mobius Injection以Semantic Closure将间接提示注入和持久化组件组合，诱导递归执行，在三类claw代理、三种编码代理及12个模型上评测。作者报告单节点调用放大最高51倍；多节点协同下每节点消耗约12.3万–12.7万token，良性延迟升约23–24倍并最终挤占共享容量；攻击可避开所测传统流量监测及低误报输入过滤。", "topics": { "tags": [ "injection", "memory", "multiagent", "evaluation" ], "reason_zh": "直接研究一次间接注入利用持久化代理组件形成持续资源耗尽及服务拒绝。" }, "title": "Mobius Injection: From One-Shot Prompt Injection to Sustained Resource Exhaustion in AI Agent Infrastructure", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-05-12T02:51:12Z", "updated": "2026-11-02T02:11:41Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.11442v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-26", "seen_dates": [ "2026-10-26", "2026-11-04" ], "version_history": [ { "id": "2605.11442", "version_id": "2605.11442v2", "classification": "relevant", "reason": "单次间接注入诱发Agent持久递归执行和资源耗尽，直接针对Agent基础设施安全。", "published": "2026-05-12T02:51:12Z", "updated": "2026-10-19T03:34:45Z", "abstract_read": true, "reviewed_date": "2026-10-26", "abstract_sha256": "a9e3378906d517c716e099d408c541e9a09a5ca3e66c11b85f9b3677c2145a45", "provenance": "official_category_API_sorted_lastUpdatedDate" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2605.11442", "first_author": "Zi Liang", "authors": [ "Zi Liang", "Ronghua Li", "Yanyun Wang", "Qingqing Ye", "Haibo Hu" ], "affiliations": [ "The Hong Kong Polytechnic University" ], "source_url": "https://arxiv.org/pdf/2605.11442v3", "author_source": "http://arxiv.org/abs/2605.11442v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "首页标题及v3匹配；Zi Liang星号对应香港理工大学，星号是单位标记而非共同贡献。", "verification_status": "affiliation_verified", "title": "Mobius Injection: From One-Shot Prompt Injection to Sustained Resource Exhaustion in AI Agent Infrastructure", "version_id": "2605.11442v3", "affiliation_checked": true }, "authors": [ "Zi Liang", "Ronghua Li", "Yanyun Wang", "Qingqing Ye", "Haibo Hu" ], "categories": [ "cs.CR", "cs.AI", "cs.CL" ], "source": "http://arxiv.org/abs/2605.11442v2", "first_seen_date": "2026-10-26", "revision_history": [ { "id": "2605.11442", "title": "Mobius Injection: From One-Shot Prompt Injection to Sustained Resource Exhaustion in AI Agent Infrastructure", "published": "2026-05-12T02:51:12Z", "updated": "2026-10-19T03:34:45Z", "authors": [ "Zi Liang", "Ronghua Li", "Yanyun Wang", "Qingqing Ye", "Haibo Hu" ], "categories": [ "cs.CR", "cs.AI", "cs.CL" ], "version_id": "2605.11442v2", "announcement_date": null, "source": "http://arxiv.org/abs/2605.11442v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "单次间接注入诱发Agent持久递归执行和资源耗尽，直接针对Agent基础设施安全。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：Agent作为用户、数字服务及模型基础设施间枢纽，单次注入可能演变为持续资源耗尽。方法：Mobius Injection将间接提示注入与持久Agent组件组合，以Semantic Closure诱发递归执行，在三种claw型和三种coding Agent、12个LLM上测试。作者称单节点调用放大最高51倍；协调压力下每感染节点消耗约12.3万至12.7万token，共享五GPU后端正常请求延迟约升23至24倍，最终服务容量饱和。", "topics": { "id": "2605.11442", "tags": [ "injection", "memory", "multiagent", "robustness", "evaluation" ], "reason_zh": "持久组件注入诱发资源耗尽，多节点协调放大并评估服务可用性。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2605.11442", "first_author": "Zi Liang", "authors": [ "Zi Liang", "Ronghua Li", "Yanyun Wang", "Qingqing Ye", "Haibo Hu" ], "affiliations": [ "The Hong Kong Polytechnic University" ], "source_url": "https://arxiv.org/html/2605.11442v2", "author_source": "http://arxiv.org/abs/2605.11442v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Zi Liang superscript1 maps explicitly to Hong Kong Polytechnic University; HKU/CUHK belong to other author markers.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26" } ] }, "2603.03403": { "id": "2603.03403", "title": "Sharing is caring: Attestable and Trusted Workflows out of Distrustful Components", "published": "2026-03-03T14:53:48Z", "updated": "2026-10-21T14:48:09Z", "authors": [ "Amir Al Sadi", "Sina Abdollahi", "Adrien Ghosn", "Hamed Haddadi", "Marios Kogias" ], "categories": [ "cs.CR", "cs.OS" ], "version_id": "2603.03403v4", "announcement_date": null, "source": "http://arxiv.org/abs/2603.03403v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "以可证明TEE通信约束防止运行时生成代码的Agent泄露数据，直接保护Agent执行边界。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：TEE只保护私有内存，运行时生成代码仍可误用共享通道泄密。方法：MICA在固件中定义、限制和证明TEE及主机间通信约束与传递约束，在Arm CCA上实现。作者报告可在不信任TEE内代码功能正确性的情况下支持机密Agent应用；TCB增加7%，启动开销2–4%，策略上传约1.5秒，组证明246–598毫秒，建立后跨TEE延迟最多比不可信内存加密通信低14.5倍。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "authorization", "privacy" ], "reason_zh": "约束Agent代码运行中的数据流与共享通道，保护机密性。" }, "categories_seen": [ "cs.CR", "cs.OS" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2603.03403", "first_author": "Amir Al Sadi", "authors": [ "Amir Al Sadi", "Sina Abdollahi", "Adrien Ghosn", "Hamed Haddadi", "Marios Kogias" ], "affiliations": [ "Imperial College London" ], "source_url": "https://arxiv.org/html/2603.03403v4", "author_source": "http://arxiv.org/abs/2603.03403v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Amir Al Sadi individually lists Imperial College London.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.06044": { "id": "2610.06044", "title": "RocketAgent: A Long-Horizon Engineering Agent for Multidisciplinary Design of Liquid-Rocket Thrust Chambers", "published": "2026-10-05T09:41:58Z", "updated": "2026-10-21T14:25:23Z", "authors": [ "Junxiang He", "Runze Mao", "Kun He", "Teng Zhang", "Liming Zheng", "Ke Xiao", "Zhi X. Chen" ], "categories": [ "cs.AI" ], "version_id": "2610.06044v2", "announcement_date": null, "source": "http://arxiv.org/abs/2610.06044v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "工程Coding Agent重要设计变更须工程师授权，并测试过时输入执行阻断与依赖失效。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：长时程工程设计的下游约束变化可能使早期产物过时。方法：RocketAgent以Coding Agent协调工程技能，知识图谱和类型化设计中间表示维护来源与依赖；版本变更使受影响结果失效，阻断旧输入，重要修改须工程师批准。作者报告代表性模拟中经授权修改工况后继续找到可行设计；两配置、三个受控场景验证预期失效传播和求解前阻断。仅为模拟设计及机制测试，非实际火箭安全认证。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "authorization", "memory" ], "reason_zh": "关键变更人工批准及版本/来源依赖保证执行不使用过时状态。" }, "categories_seen": [ "cs.AI" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.06044", "first_author": "Junxiang He", "authors": [ "Junxiang He", "Runze Mao", "Kun He", "Teng Zhang", "Liming Zheng", "Ke Xiao", "Zhi X. Chen" ], "affiliations": [ "Peking University" ], "source_url": "https://arxiv.org/html/2610.06044v2", "author_source": "http://arxiv.org/abs/2610.06044v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Junxiang He individually lists State Key Laboratory of Turbulence and Complex Systems, School of Mechanics and Engineering Science and College of Engineering, Peking University; coauthor company not transferred.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.02992": { "id": "2609.02992", "title": "Tempting the Agent: The Economics of Reputation without Persistent Identity in AI Agent Markets", "published": "2026-09-02T15:47:12Z", "updated": "2026-10-21T12:44:59Z", "authors": [ "Federico Gatta", "Manuel Naviglio", "Francesco Tarantelli" ], "categories": [ "q-fin.GN", "cs.MA" ], "version_id": "2609.02992v2", "announcement_date": null, "source": "http://arxiv.org/abs/2609.02992v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "uncertain", "reason": "正文2.3–3将理论映射到Agent身份/声誉/支付与一次套利，确有自治软件Agent信任问题，但没有明确LLM架构或语言Agent实验；按严格LLM Agent范围保留待确认，不能自动视为相关。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "needs_full_text_review": true, "summary_zh": "问题：可低成本重建身份的自主Agent能否靠累积声誉诱发信任后一次性套利。方法：将声誉建模为经济资本，分析诚实、质量投入、一次偏离及带惩罚重启的动态选择。作者推导身份重置成本、声誉持久性、需求敏感性和执法设计对质量的比较静态关系；以区块链Agent市场为应用，摘要无LLM实验。 仅据完整摘要，未正文核验。 正文补核：机制明确是声誉资本、身份重置及staking/slashing的经济理论，适用于一般数字市场；不是LLM实测安全效果。", "topics": { "tags": [ "multiagent", "authorization" ], "reason_zh": "暂拟多Agent市场信任与身份约束；是否属于语言Agent安全仍待正文。" }, "review": { "id": "2609.02992", "title": "Tempting the Agent: The Economics of Reputation without Persistent Identity in AI Agent Markets", "published": "2026-09-02T15:47:12Z", "updated": "2026-10-21T12:44:59Z", "authors": [ "Federico Gatta", "Manuel Naviglio", "Francesco Tarantelli" ], "categories": [ "q-fin.GN", "cs.MA" ], "version_id": "2609.02992v2", "announcement_date": null, "source": "http://arxiv.org/abs/2609.02992v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "uncertain", "reason": "正文2.3–3将理论映射到Agent身份/声誉/支付与一次套利，确有自治软件Agent信任问题，但没有明确LLM架构或语言Agent实验；按严格LLM Agent范围保留待确认，不能自动视为相关。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "needs_full_text_review": true, "summary_zh": "问题：可低成本重建身份的自主Agent能否靠累积声誉诱发信任后一次性套利。方法：将声誉建模为经济资本，分析诚实、质量投入、一次偏离及带惩罚重启的动态选择。作者推导身份重置成本、声誉持久性、需求敏感性和执法设计对质量的比较静态关系；以区块链Agent市场为应用，摘要无LLM实验。 仅据完整摘要，未正文核验。 正文补核：机制明确是声誉资本、身份重置及staking/slashing的经济理论，适用于一般数字市场；不是LLM实测安全效果。", "topics": { "tags": [ "multiagent", "authorization" ], "reason_zh": "暂拟多Agent市场信任与身份约束；是否属于语言Agent安全仍待正文。" }, "secondary_review_date": "2026-10-26", "body_review_sections": "2.3 Blockchain-Based Autonomous Agent Markets; 2.4 Agentic Commerce; 3 Model Environment", "body_review_source": "https://arxiv.org/html/2609.02992v2" }, "categories_seen": [ "cs.MA", "q-fin.GN" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2609.02992", "first_author": "Federico Gatta", "authors": [ "Federico Gatta", "Manuel Naviglio", "Francesco Tarantelli" ], "affiliations": [ "Scuola Normale Superiore" ], "source_url": "https://arxiv.org/html/2609.02992v2", "author_source": "http://arxiv.org/abs/2609.02992v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Federico Gatta individually lists Scuola Normale Superiore, Pisa.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2607.21951": { "id": "2607.21951", "title": "SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders", "published": "2026-07-24T03:55:51Z", "updated": "2026-10-21T03:31:53Z", "authors": [ "Evan Caville", "Spencer Kayser", "Siamak Layeghy", "Billy Sung", "Sara Dolnicar", "Marius Portmann" ], "categories": [ "cs.IR", "cs.CR" ], "version_id": "2607.21951v4", "announcement_date": null, "source": "http://arxiv.org/abs/2607.21951v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "操纵网页工具检索内容以改变LLM推荐排名，直接涉及外部来源投毒和注入。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：网页增强推荐会受已检索来源中的对抗内容操纵。方法：SIREN用PAIR攻击者-判定者循环，按23种投毒技巧修改网页，固定其余来源及顺序，试图将指定实体推至首位。作者报告两个Claude模型、八个查询模型上下文共124次技巧试验中62次达到首位；这些成功载荷在新会话复测平均成功率0.805。声明式排名和预设列表通常较命令注入有效，但差异依模型。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "网页工具来源内容投毒及固定检索集下推荐劫持评测。" }, "categories_seen": [ "cs.CR", "cs.IR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2607.21951", "first_author": "Evan Caville", "authors": [ "Evan Caville", "Spencer Kayser", "Siamak Layeghy", "Billy Sung", "Sara Dolnicar", "Marius Portmann" ], "affiliations": [ "The University of Queensland" ], "source_url": "https://arxiv.org/html/2607.21951v4", "author_source": "http://arxiv.org/abs/2607.21951v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Evan Caville superscript1 maps to University of Queensland; Curtin is coauthor2.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.35659": { "id": "2609.35659", "title": "Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for AI Agents", "published": "2026-09-28T17:22:04Z", "updated": "2026-10-21T00:26:45Z", "authors": [ "Bravish Ghosh" ], "categories": [ "cs.CE", "cs.CR" ], "version_id": "2609.35659v2", "announcement_date": null, "source": "http://arxiv.org/abs/2609.35659v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "独立签名者隔离凭据、执行前策略检查和防篡改审计，检测Agent虚假测试声明。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：Agent有操作者凭据且常能编辑自身日志，难以独立验证所言所做。方法：Tracekit隔离签名者和凭据，执行前检查工具调用，将意图、决定、结果纳入Ed25519哈希链与Merkle树，可由外部见证和两个离线验证器检查。作者报告21项实验：普通签名检测8类篡改中6类，见证补其余2类，33个伪造全部拒绝，签名往返中位0.45毫秒。规则在本方有害调用语料阻止570/570，但盲写语料只211/420，边界在隔离而非规则；保留测试中虚报通过识别86%，1812诚实调用有5次误报，6个有害回放均归因成功。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "隔离工具权限与凭据、可验证审计和虚假执行声明检测。" }, "categories_seen": [ "cs.CE", "cs.CR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2609.35659", "first_author": "Bravish Ghosh", "authors": [ "Bravish Ghosh" ], "affiliations": [ "Cygnux Labs" ], "source_url": "https://arxiv.org/html/2609.35659v2", "author_source": "http://arxiv.org/abs/2609.35659v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Bravish Ghosh explicitly lists Cygnux Labs; repository URL not an affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.04699": { "id": "2610.04699", "title": "Not Self-Decidable: LLMs Cannot Draw the Boundary of What an Agent Verifier Can Check", "published": "2026-10-03T18:25:12Z", "updated": "2026-10-19T18:50:27Z", "authors": [ "Anthony Rhodes" ], "categories": [ "cs.AI", "cs.CL", "cs.CR" ], "version_id": "2610.04699v2", "announcement_date": null, "source": "http://arxiv.org/abs/2610.04699v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "直接分析Agent验证器错误宣称规则可自动检查，提出不可被Agent写入证据上的干预测试门控。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：Agent验证器若让模型自行决定哪些外部规则可固定检查，会错误地把需判断的规则当成可自动验证，避免升级。方法：CoVer把多模型一致只当提名，要求合成检查在干预、不可由Agent写入字段及确定性改写下仍成立。作者在六语料、四模型约22000标签中发现监管文本判断失效，已部署信贷Agent规则中共同过度宣称可检查；门控拒绝多数错误提名但牺牲覆盖。与参考judge一致率由30%到77%却未增加真正可判定比例。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "Agent规则执行与升级判断的验证边界及抗共同盲点门控。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.04699", "first_author": "Anthony Rhodes", "authors": [ "Anthony Rhodes" ], "affiliations": [ "Confidential Core AI" ], "source_url": "https://arxiv.org/html/2610.04699v2", "author_source": "http://arxiv.org/abs/2610.04699v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Anthony Rhodes explicitly lists Confidential Core AI.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.14404": { "id": "2610.14404", "title": "DICE: Tilting the Odds through Interface Attacks on System One Model", "published": "2026-10-09T23:47:09Z", "updated": "2026-10-19T17:49:39Z", "authors": [ "Ben Dong", "Tianyi Lu", "Zhonghao Guo", "Qian Wang" ], "categories": [ "cs.CR", "cs.SE" ], "version_id": "2610.14404v2", "announcement_date": null, "source": "http://arxiv.org/abs/2610.14404v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文III–IV确认LLM适配器将状态、权限问题和证据传递给受保护的授权选择器；攻击会在推理服务正确时造成错误授权，直接涉及Agent决策/授权边界。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "needs_full_text_review": true, "summary_zh": "问题：应用的状态提取、问题生成、输出解释接口可使正确的模型API判断偏离原始任务。方法：DICE在Jev管线三个适配器输出做有界替换，保持模型和真实API返回不被攻击者控制。作者报告三个小型合成研究均可改变最终决定；绑定来源、含义和相关性的检查阻止已测干预，但来源验证误拒部分有效决定。作者不估计部署普遍性； 以上为摘要依据；下列为正文定向核验。 正文核验补充：状态攻击在有界搜索中使6/6预选目标获授权；否定形式问题产生11/12局部正确但错误批准；旧有效回答重用导致12/12错误当前授权。这是小型合成试点，不代表部署发生率。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "LLM适配器状态/权限问题/回答关联篡改造成错误授权，验证输入输出语义绑定。" }, "review": { "id": "2610.14404", "title": "DICE: Tilting the Odds through Interface Attacks on System One Model", "published": "2026-10-09T23:47:09Z", "updated": "2026-10-19T17:49:39Z", "authors": [ "Ben Dong", "Tianyi Lu", "Zhonghao Guo", "Qian Wang" ], "categories": [ "cs.CR", "cs.SE" ], "version_id": "2610.14404v2", "announcement_date": null, "source": "http://arxiv.org/abs/2610.14404v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文III–IV确认LLM适配器将状态、权限问题和证据传递给受保护的授权选择器；攻击会在推理服务正确时造成错误授权，直接涉及Agent决策/授权边界。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "needs_full_text_review": false, "summary_zh": "问题：应用的状态提取、问题生成、输出解释接口可使正确的模型API判断偏离原始任务。方法：DICE在Jev管线三个适配器输出做有界替换，保持模型和真实API返回不被攻击者控制。作者报告三个小型合成研究均可改变最终决定；绑定来源、含义和相关性的检查阻止已测干预，但来源验证误拒部分有效决定。作者不估计部署普遍性； 以上为摘要依据；下列为正文定向核验。 正文核验补充：状态攻击在有界搜索中使6/6预选目标获授权；否定形式问题产生11/12局部正确但错误批准；旧有效回答重用导致12/12错误当前授权。这是小型合成试点，不代表部署发生率。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "LLM适配器状态/权限问题/回答关联篡改造成错误授权，验证输入输出语义绑定。" }, "secondary_review_date": "2026-10-26", "body_review_sections": "III Threat Model; IV Attack; VI Results; VII Defending the Decision Boundary", "body_review_source": "https://arxiv.org/html/2610.14404v2", "author_body_evidence": { "first_author": "Ben Dong", "affiliations": [ "University of California, Merced" ], "source": "https://arxiv.org/html/2610.14404v2" } }, "categories_seen": [ "cs.CR", "cs.SE" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.14404", "first_author": "Ben Dong", "authors": [ "Ben Dong", "Tianyi Lu", "Zhonghao Guo", "Qian Wang" ], "affiliations": [ "University of California, Merced" ], "source_url": "https://arxiv.org/html/2610.14404v2", "author_source": "http://arxiv.org/abs/2610.14404v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Ben Dong superscript1 maps to UC Merced; Stevens affiliation2 belongs to coauthor.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.00192": { "id": "2609.00192", "title": "LLM-Driven Autonomous Vehicles Can Inherit Human Driver Biases in Pedestrian Yielding: Results and Implications From a New Benchmark", "published": "2026-08-31T18:11:49Z", "updated": "2026-10-19T16:29:09Z", "authors": [ "Irem Yoldas", "Jie Zhang", "Odinaldo Rodrigues", "Martim Brandão" ], "categories": [ "cs.AI", "cs.CL", "cs.CV", "cs.CY" ], "version_id": "2609.00192v2", "announcement_date": null, "source": "http://arxiv.org/abs/2609.00192v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "LLM/VLM驾驶决策对行人人口属性有偏差，直接评估具身行动安全与公平风险。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "needs_full_text_review": false, "summary_zh": "问题：用通用LLM/VLM指导自动驾驶可能继承人类对不同属性行人的让行偏差。方法：FairYield提出其他条件相同测试与自一致性测试，评估行人让行决策。作者发现模型对行人性别、族裔、宗教、残疾、年龄、肤色和社会经济地位的预测会影响让行，程度与方向因模型而异；摘要无量化差异。 仅据完整摘要，未正文核验。", "topics": { "tags": [ "embodied", "evaluation" ], "reason_zh": "语言/视觉语言驾驶Agent直接行动的公平与安全风险评测。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.CV", "cs.CY" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2609.00192", "first_author": "Irem Yoldas", "authors": [ "Irem Yoldas", "Jie Zhang", "Odinaldo Rodrigues", "Martim Brandão" ], "affiliations": [ "King’s College London" ], "source_url": "https://arxiv.org/html/2609.00192v2", "author_source": "http://arxiv.org/abs/2609.00192v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Author footnote explicitly states all authors are with King’s College London.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2605.07306": { "id": "2605.07306", "title": "BioProVLA-Agent: An Affordable, Protocol-Driven, Vision-Enhanced VLA-Enabled Embodied Multi-Agent System with Closed-Loop-Capable Reasoning for Biological Laboratory Manipulation", "published": "2026-05-08T06:15:40Z", "updated": "2026-10-19T11:20:55Z", "authors": [ "Zhaohui Du", "Zhe Wang", "Dongzhan Zhou", "Minting Pan", "Hongmei Fei", "Xiwen Cao", "Ting Xiao", "Qi Wang", "Huanbo Jin", "Jiaming Gu", "Quan Lu", "Zhe Liu" ], "categories": [ "cs.RO", "cs.AI" ], "version_id": "2605.07306v4", "announcement_date": null, "source": "http://arxiv.org/abs/2605.07306v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文执行循环明确在前置条件失败时不执行，重新排序/复检后仍失败则暂停并请求人工介入；后置失败可重试或终止，构成具身Agent监控及执行门控。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "needs_full_text_review": true, "summary_zh": "问题：生物实验机器人面对非结构化协议、透明器皿和多步执行难以可靠操作。方法：BioProVLA-Agent让LLM解析协议、VLM-RAG验证准备及完成状态、VLA执行已验证子任务，并用AugSmolVLA在线视觉增强。作者在15原子任务、6复合流程、3双手任务及正常/过曝光设置下报告稳定性优于ACT、X-VLA、原SmolVLA，摘要无具体安全指标或数值。 以上为摘要依据；下列为正文定向核验。 正文核验补充：前置不满足时阻断动作，复检仍失败就暂停求助；视觉验证评测为75案例，RAG版总体62/75=82.67%，原模型55/75=73.33%。这不是对抗防御率或真实实验安全认证，验证器仍有误判。", "topics": { "tags": [ "embodied", "monitoring", "authorization", "robustness" ], "reason_zh": "具身实验Agent前后置状态验证、动作阻断、人工介入与视觉扰动鲁棒性。" }, "review": { "id": "2605.07306", "title": "BioProVLA-Agent: An Affordable, Protocol-Driven, Vision-Enhanced VLA-Enabled Embodied Multi-Agent System with Closed-Loop-Capable Reasoning for Biological Laboratory Manipulation", "published": "2026-05-08T06:15:40Z", "updated": "2026-10-19T11:20:55Z", "authors": [ "Zhaohui Du", "Zhe Wang", "Dongzhan Zhou", "Minting Pan", "Hongmei Fei", "Xiwen Cao", "Ting Xiao", "Qi Wang", "Huanbo Jin", "Jiaming Gu", "Quan Lu", "Zhe Liu" ], "categories": [ "cs.RO", "cs.AI" ], "version_id": "2605.07306v4", "announcement_date": null, "source": "http://arxiv.org/abs/2605.07306v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文执行循环明确在前置条件失败时不执行，重新排序/复检后仍失败则暂停并请求人工介入；后置失败可重试或终止，构成具身Agent监控及执行门控。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "needs_full_text_review": false, "summary_zh": "问题：生物实验机器人面对非结构化协议、透明器皿和多步执行难以可靠操作。方法：BioProVLA-Agent让LLM解析协议、VLM-RAG验证准备及完成状态、VLA执行已验证子任务，并用AugSmolVLA在线视觉增强。作者在15原子任务、6复合流程、3双手任务及正常/过曝光设置下报告稳定性优于ACT、X-VLA、原SmolVLA，摘要无具体安全指标或数值。 以上为摘要依据；下列为正文定向核验。 正文核验补充：前置不满足时阻断动作，复检仍失败就暂停求助；视觉验证评测为75案例，RAG版总体62/75=82.67%，原模型55/75=73.33%。这不是对抗防御率或真实实验安全认证，验证器仍有误判。", "topics": { "tags": [ "embodied", "monitoring", "authorization", "robustness" ], "reason_zh": "具身实验Agent前后置状态验证、动作阻断、人工介入与视觉扰动鲁棒性。" }, "secondary_review_date": "2026-10-26", "body_review_sections": "Method execution loop equations 4–6; VLM-RAG Verification Agent; Table 2", "body_review_source": "https://arxiv.org/html/2605.07306v4", "author_body_evidence": { "first_author": "Zhaohui Du", "affiliations": [ "Key Laboratory of Smart Manufacturing in Energy Chemical Process, Ministry of Education, East China University of Science and Technology", "Department of Computer Science and Engineering, East China University of Science and Technology" ], "source": "https://arxiv.org/html/2605.07306v4" } }, "categories_seen": [ "cs.AI", "cs.RO" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2605.07306", "first_author": "Zhaohui Du", "authors": [ "Zhaohui Du", "Zhe Wang", "Dongzhan Zhou", "Minting Pan", "Hongmei Fei", "Xiwen Cao", "Ting Xiao", "Qi Wang", "Huanbo Jin", "Jiaming Gu", "Quan Lu", "Zhe Liu" ], "affiliations": [ "East China University of Science and Technology", "Key Laboratory of Smart Manufacturing in Energy Chemical Process, Ministry of Education" ], "source_url": "https://arxiv.org/html/2605.07306v4", "author_source": "http://arxiv.org/abs/2605.07306v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Zhaohui Du superscripts1,2 map to ECUST Ministry of Education key laboratory and ECUST Department of Computer Science and Engineering.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2607.06882": { "id": "2607.06882", "title": "GemNav: Discrete-Token Visual Robot Navigation using a Multimodal Large Language Model", "published": "2026-07-08T00:46:57Z", "updated": "2026-10-19T10:47:27Z", "authors": [ "Peter Bohm", "Saimunur Rahman", "Abdelwahed Khamis", "Sagun Man Singh Shrestha", "Chris McCool", "Peyman Moghadam" ], "categories": [ "cs.RO", "cs.AI" ], "version_id": "2607.06882v3", "announcement_date": null, "source": "http://arxiv.org/abs/2607.06882v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文VI动作表示消融直接报告MLLM导航与匹配连续回归头的障碍碰撞差异，具身安全证据不再仅是摘要中的泛泛可靠性。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "needs_full_text_review": true, "summary_zh": "问题：MLLM机器人导航需要紧凑且可执行的动作表示。方法：GemNav将局部航点坐标离散分布软解码为连续动作，按度量距离采样目标，用8.7小时SCAND训练。作者报告分布外泛化优于按帧采样、障碍导航较连续回归头可靠，并可跨三类物理平台迁移；摘要未给碰撞或安全指标， 以上为摘要依据；下列为正文定向核验。 正文核验补充：Detour Course十次试验中GemNav均绕障达终点，匹配L1连续回归头十次均驶入障碍；只是特定路线的小样本结果。主指标仍是目标距离/成功率，不能宣称普适安全保证。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "MLLM导航动作表示的真实绕障/碰撞对照实验。" }, "review": { "id": "2607.06882", "title": "GemNav: Discrete-Token Visual Robot Navigation using a Multimodal Large Language Model", "published": "2026-07-08T00:46:57Z", "updated": "2026-10-19T10:47:27Z", "authors": [ "Peter Bohm", "Saimunur Rahman", "Abdelwahed Khamis", "Sagun Man Singh Shrestha", "Chris McCool", "Peyman Moghadam" ], "categories": [ "cs.RO", "cs.AI" ], "version_id": "2607.06882v3", "announcement_date": null, "source": "http://arxiv.org/abs/2607.06882v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文VI动作表示消融直接报告MLLM导航与匹配连续回归头的障碍碰撞差异，具身安全证据不再仅是摘要中的泛泛可靠性。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "needs_full_text_review": false, "summary_zh": "问题：MLLM机器人导航需要紧凑且可执行的动作表示。方法：GemNav将局部航点坐标离散分布软解码为连续动作，按度量距离采样目标，用8.7小时SCAND训练。作者报告分布外泛化优于按帧采样、障碍导航较连续回归头可靠，并可跨三类物理平台迁移；摘要未给碰撞或安全指标， 以上为摘要依据；下列为正文定向核验。 正文核验补充：Detour Course十次试验中GemNav均绕障达终点，匹配L1连续回归头十次均驶入障碍；只是特定路线的小样本结果。主指标仍是目标距离/成功率，不能宣称普适安全保证。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "MLLM导航动作表示的真实绕障/碰撞对照实验。" }, "secondary_review_date": "2026-10-26", "body_review_sections": "IV-D Metrics; V Results obstacle courses; VI Ablations Action Representation", "body_review_source": "https://arxiv.org/html/2607.06882v3", "author_body_evidence": { "first_author": "Peter Böhm", "affiliations": [ "CSIRO Robotics, Brisbane, Australia" ], "source": "https://arxiv.org/html/2607.06882v3" } }, "categories_seen": [ "cs.AI", "cs.RO" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2607.06882", "first_author": "Peter Bohm", "authors": [ "Peter Bohm", "Saimunur Rahman", "Abdelwahed Khamis", "Sagun Man Singh Shrestha", "Chris McCool", "Peyman Moghadam" ], "affiliations": [ "CSIRO Robotics" ], "source_url": "https://arxiv.org/html/2607.06882v3", "author_source": "http://arxiv.org/abs/2607.06882v3", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Author footnote explicitly states all authors are with CSIRO Robotics, Brisbane, Australia.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.34241": { "id": "2609.34241", "title": "AdaGuard: An Adaptive Guard Model with User-defined Policies", "published": "2026-09-28T03:48:12Z", "updated": "2026-10-21T09:34:41Z", "authors": [ "Yunhao Feng", "Yifan Ding", "Yuxiang Xie", "Zheng Li", "Mingrui Lao", "Zeyuan Wang", "Yanming Guo" ], "categories": [ "cs.AI" ], "version_id": "2609.34241v2", "announcement_date": null, "source": "http://arxiv.org/abs/2609.34241v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "按用户动态策略判定 Agent 轨迹违规，直接涉及安全守卫与政策遵循。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "summary_zh": "问题是固定风险分类无法适应不同用户政策。AdaGuard 用 AdaptiveSafety 的 10,939 个训练、1,000 个测试样例与政策/行为反事实，结合 SafePO 训练可读取运行时政策的轨迹守卫。作者报告 4B 模型在 AdaptiveSafety 和 DynaBench 的二分类准确率分别为 89.30% 和 71.82%；结果来自作者评测，非完整部署保证。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "根据用户规则判定 Agent 轨迹违规并评测守卫。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2609.34241", "first_author": "Yunhao Feng", "authors": [ "Yunhao Feng", "Yifan Ding", "Yuxiang Xie", "Zheng Li", "Mingrui Lao", "Zeyuan Wang", "Yanming Guo" ], "affiliations": [ "National University of Defense Technology" ], "source_url": "https://arxiv.org/html/2609.34241v2", "author_source": "http://arxiv.org/abs/2609.34241v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Yunhao Feng has an individually attached National University of Defense Technology affiliation.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.34790": { "id": "2609.34790", "title": "CoSec: Benchmarking Agent Security in Communities", "published": "2026-09-28T10:00:05Z", "updated": "2026-10-21T03:27:50Z", "authors": [ "Hao Chen", "Wenhui Dong", "Ye Chen", "Jiezhi Yao", "Chenbo Xia", "Yuwen Qu", "Renxiang Wang", "Fudong Yuan", "Camil Hamami", "Chenglong Pan", "Xinquan Yue", "Ziyu Wang", "Fengyu Ye", "Chenyang Si", "Caifeng Shan" ], "categories": [ "cs.CR", "cs.AI" ], "version_id": "2609.34790v4", "announcement_date": null, "source": "http://arxiv.org/abs/2609.34790v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "跨社区持久 Agent 的隐私与动态授权边界评测，直接相关。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "summary_zh": "CoSec 面向持久协作 Agent 的社区边界与信息授权变化。208 个规范场景覆盖固定/演变的社区、用户及其他参与者秘密，以及对话、环境、记忆和组合工作流攻击；以执行轨迹和产物对照当前授权。作者发现多种配置虽能完成良性任务，仍违反隐私和授权边界；摘要未给出统一违规率。", "topics": { "tags": [ "privacy", "authorization", "memory", "multiagent", "evaluation" ], "reason_zh": "社区多用户权限变化下审计秘密跨工具与记忆传播。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2609.34790", "first_author": "Hao Chen", "authors": [ "Hao Chen", "Wenhui Dong", "Ye Chen", "Jiezhi Yao", "Chenbo Xia", "Yuwen Qu", "Renxiang Wang", "Fudong Yuan", "Camil Hamami", "Chenglong Pan", "Xinquan Yue", "Ziyu Wang", "Fengyu Ye", "Chenyang Si", "Caifeng Shan" ], "affiliations": [ "Nanjing University", "Southeast University" ], "source_url": "https://arxiv.org/html/2609.34790v4", "author_source": "http://arxiv.org/abs/2609.34790v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Hao Chen", "Wenhui Dong" ], "shared_first_note": "正文明确星号为共同第一作者；† 为通讯作者。", "evidence": "Hao Chen superscripts 1,7 map to Nanjing University and Southeast University; equal-contribution star shared with Wenhui Dong, affiliation1.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Hao Chen": [ "Nanjing University", "Southeast University" ], "Wenhui Dong": [ "Nanjing University" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2608.14590": { "id": "2608.14590", "title": "Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement", "published": "2026-06-22T21:03:26Z", "updated": "2026-10-20T18:43:44Z", "authors": [ "Pierre Dantas", "Lucas Cordeiro", "Ehsan Nowroozi", "Norbert Tihanyi" ], "categories": [ "cs.AI" ], "version_id": "2608.14590v3", "announcement_date": null, "source": "http://arxiv.org/abs/2608.14590v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "系统综述 LLM Agent 安全规格、形式验证与执行防护，直接相关。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "summary_zh": "综述追问 LLM Agent 是否具备任务级安全保证。作者按 PRISMA 检索六库并综合 38 项规格、验证和执行研究，评估偏倚及 GRADE 证据。发现规格语义与整段计划安全仍是瓶颈，运行时监控较成熟但多为单步/短程保证；九项主张中七项证据为 Very Low，文中数字通常仅源自一两项窄域研究，不能视为普遍效果。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "系统梳理形式规格、验证与运行时安全执行机制。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2608.14590", "first_author": "Pierre Dantas", "authors": [ "Pierre Dantas", "Lucas Cordeiro", "Ehsan Nowroozi", "Norbert Tihanyi" ], "affiliations": [ "The University of Manchester", "Federal University of Amazonas" ], "source_url": "https://arxiv.org/html/2608.14590v3", "author_source": "http://arxiv.org/abs/2608.14590v3", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Pierre Dantas has two individual affiliation blocks: University of Manchester and Federal University of Amazonas.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.06814": { "id": "2610.06814", "title": "TAPDreamer: Transferable Adversarial Patches for World Action Models", "published": "2026-10-05T17:55:21Z", "updated": "2026-10-20T17:55:12Z", "authors": [ "Xuanyu Lu", "Fengqing Jiang", "Kaiyuan Zheng", "Yichen Feng", "Yaorui Ding", "Yuetai Li", "Zhen Xiang", "Bhaskar Ramasubramanian", "Basel Alomair", "Luyao Niu", "Radha Poovendran" ], "categories": [ "cs.CV", "cs.AI", "cs.RO" ], "version_id": "2610.06814v3", "announcement_date": null, "source": "http://arxiv.org/abs/2610.06814v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文 2.1 将语言任务指令纳入闭环动作上下文，2.2 明确攻击视觉输入而不修改指令或策略参数；属于语言条件具身 Agent 的输入攻击与鲁棒性评测。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "summary_zh": "TAPDreamer 研究语言任务条件下闭环机器人 Agent 的视觉补丁攻击。只用公开视觉编码器和一个源任务六帧图像优化固定局部补丁，不查询目标策略；作者在摘要报告约 6.5% 图像补丁将 FastWAM 在 LIBERO/RoboTwin 的成功率由 97.65%/90.86% 降至 0，并跨架构迁移。正文 2.1–2.2 已核实语言任务条件及攻击者权限边界；结果不能解释为所有具身模型均失效。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "正文确认语言指令驱动的闭环具身行动，攻击视觉编码器并测量动作任务失败。" }, "needs_full_text_review": true, "review": { "id": "2610.06814", "title": "TAPDreamer: Transferable Adversarial Patches for World Action Models", "published": "2026-10-05T17:55:21Z", "updated": "2026-10-20T17:55:12Z", "authors": [ "Xuanyu Lu", "Fengqing Jiang", "Kaiyuan Zheng", "Yichen Feng", "Yaorui Ding", "Yuetai Li", "Zhen Xiang", "Bhaskar Ramasubramanian", "Basel Alomair", "Luyao Niu", "Radha Poovendran" ], "categories": [ "cs.CV", "cs.AI", "cs.RO" ], "version_id": "2610.06814v3", "announcement_date": null, "source": "http://arxiv.org/abs/2610.06814v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "正文 2.1 将语言任务指令纳入闭环动作上下文，2.2 明确攻击视觉输入而不修改指令或策略参数；属于语言条件具身 Agent 的输入攻击与鲁棒性评测。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_selected_body_sections", "summary_zh": "TAPDreamer 研究语言任务条件下闭环机器人 Agent 的视觉补丁攻击。只用公开视觉编码器和一个源任务六帧图像优化固定局部补丁，不查询目标策略；作者在摘要报告约 6.5% 图像补丁将 FastWAM 在 LIBERO/RoboTwin 的成功率由 97.65%/90.86% 降至 0，并跨架构迁移。正文 2.1–2.2 已核实语言任务条件及攻击者权限边界；结果不能解释为所有具身模型均失效。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "正文确认语言指令驱动的闭环具身行动，攻击视觉编码器并测量动作任务失败。" }, "needs_full_text_review": false, "initial_classification": "uncertain", "body_review_source": "https://arxiv.org/html/2610.06814v3", "body_review_local_file": "2610.06814.txt", "body_sections_checked": [ "1 Introduction", "2.1 World Action Model", "2.2 Threat Model", "HTML author block" ], "first_author_name": "Xuanyu Lu", "first_author_affiliation_status": "unconfirmed", "affiliation_note_zh": "HTML 列出五个署名单位但未保留个人映射；Equal Contribution 符号也无法对应具体作者，需 PDF 首页核验。" }, "categories_seen": [ "cs.AI", "cs.CV", "cs.RO" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.06814", "first_author": "Xuanyu Lu", "authors": [ "Xuanyu Lu", "Fengqing Jiang", "Kaiyuan Zheng", "Yichen Feng", "Yaorui Ding", "Yuetai Li", "Zhen Xiang", "Bhaskar Ramasubramanian", "Basel Alomair", "Luyao Niu", "Radha Poovendran" ], "affiliations": [ "University of Washington" ], "source_url": "https://arxiv.org/pdf/2610.06814v3", "author_source": "http://arxiv.org/abs/2610.06814v3", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Xuanyu Lu", "Fengqing Jiang", "Kaiyuan Zheng" ], "shared_first_note": "PDF 明确 † 为前三名共同贡献；‡ 为项目负责人。", "evidence": "PDF first page Xuanyu Lu superscript1 maps to University of Washington; dagger equal contribution also on Fengqing Jiang and Kaiyuan Zheng.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Xuanyu Lu": [ "University of Washington" ], "Fengqing Jiang": [ "University of Washington" ], "Kaiyuan Zheng": [ "University of Washington" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2607.20491": { "id": "2607.20491", "title": "DFAH-Bench: What Agreement Leaves Unmeasured in Financial Agents", "published": "2026-06-10T03:31:09Z", "updated": "2026-10-20T17:06:32Z", "authors": [ "Raffi Khatchadourian" ], "categories": [ "cs.AI", "cs.CL", "cs.LG" ], "version_id": "2607.20491v4", "announcement_date": null, "source": "http://arxiv.org/abs/2607.20491v4", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "金融 Agent 工具轨迹一致性与银行授权检查，明确安全规则执行评测。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "summary_zh": "DFAH-Bench 研究重复决策一致是否掩盖工具执行和授权错误。作者结合 570 次回放、48 次删除调用诊断和银行授权任务，发现决定一致率 94–95% 而工具路径一致率仅 45–52%，一致的决定仍可能不符规则。银行研究 1,080 次计划任务仅有 1,033 个已知结果，因此门控比较为描述性，不能作已完成的确认性结论。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "将 Agent 输出一致性同真实工具路径、银行授权规则对照。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2607.20491", "first_author": "Raffi Khatchadourian", "authors": [ "Raffi Khatchadourian" ], "affiliations": [ "IBM" ], "source_url": "https://arxiv.org/html/2607.20491v4", "author_source": "http://arxiv.org/abs/2607.20491v4", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Sole first author Raffi Khatchadourian explicitly lists IBM Financial Services Market, New York.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2607.05318": { "id": "2607.05318", "title": "PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systems", "published": "2026-07-06T16:57:24Z", "updated": "2026-10-19T19:06:07Z", "authors": [ "Shubham Gupta", "Nazanin Mohammadi Sepahvand", "Abhinav Kumar", "Cem Subakan", "Spandana Gella", "Pierre-André Noël", "Perouz Taslakian", "Eugene Bagdasarian", "Valentina Zantedeschi" ], "categories": [ "cs.MA", "cs.CR" ], "version_id": "2607.05318v2", "announcement_date": null, "source": "http://arxiv.org/abs/2607.05318v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "共享多用户 Agent 中跨输出、消息、记忆的隐私泄露评测，直接相关。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "summary_zh": "PiSAs 关注共享多用户 Agent 中无意的跨用户信息泄露。基准同时标注信息对任务是否合适以及谁有访问权，检查输出、Agent 间通信和记忆，并支持不同拓扑与记忆设置。作者发现系统设计可改善合规，但先进模型仍不能可靠过滤不当内容或限制接收用户；摘要未提供统一泄露比例。", "topics": { "tags": [ "privacy", "memory", "multiagent", "authorization", "evaluation" ], "reason_zh": "以任务适用性及用户授权双重标注衡量跨组件信息泄露。" }, "needs_full_text_review": false, "categories_seen": [ "cs.CR", "cs.MA" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2607.05318", "first_author": "Shubham Gupta", "authors": [ "Shubham Gupta", "Nazanin Mohammadi Sepahvand", "Abhinav Kumar", "Cem Subakan", "Spandana Gella", "Pierre-André Noël", "Perouz Taslakian", "Eugene Bagdasarian", "Valentina Zantedeschi" ], "affiliations": [ "ServiceNow AI Research", "Mila – Quebec AI Institute", "Université Laval" ], "source_url": "https://arxiv.org/pdf/2607.05318v2", "author_source": "http://arxiv.org/abs/2607.05318v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [ "Shubham Gupta", "Nazanin Mohammadi Sepahvand" ], "shared_first_note": "PDF 明确前两位星号为共同贡献。", "evidence": "PDF Shubham Gupta superscripts1,2,3 map explicitly to ServiceNow AI Research, Mila and Université Laval; co-first Nazanin Mohammadi Sepahvand1,2,4 has McGill instead of Laval.", "verification_status": "affiliation_verified", "shared_first_affiliations": { "Shubham Gupta": [ "ServiceNow AI Research", "Mila – Quebec AI Institute", "Université Laval" ], "Nazanin Mohammadi Sepahvand": [ "ServiceNow AI Research", "Mila – Quebec AI Institute", "McGill University" ] } }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.04693": { "id": "2610.04693", "title": "Penumbra: Sample-Efficient Adversarial Search for Regulatory Obligations", "published": "2026-10-03T18:11:23Z", "updated": "2026-10-19T18:48:57Z", "authors": [ "Anthony Rhodes" ], "categories": [ "cs.AI", "cs.CL", "cs.CR" ], "version_id": "2610.04693v3", "announcement_date": null, "source": "http://arxiv.org/abs/2610.04693v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "uncertain", "reason": "正文以金融/临床 Agent 义务及工具检索语境为目标，但实际实验是单次响应的最小编辑合规边界生成；尚未完成 Agent 轨迹、权限或训练安全收益验证。范围边界仍待确认，保留不确定，不把一般合规文本生成强行算 Agent 安全。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "summary_zh": "Penumbra 构造只需极少编辑即可跨越监管合规边界的回复对。通过双评估器和自适应预算搜索，在金融 60 项义务上返回 144 对、临床分诊 18 项义务上返回 49 对；作者称自适应方式用 59% 候选达到均匀分配的全预算覆盖。摘要仍以文本合规为对象，需正文确认 Agent 安全场景。 正文核验：第 1 节例子涉及工具检索事实遗漏；附录 H 说明降低未见义务违规率的训练实验尚未完成，且使用自拟义务与 LLM 判断、没有专业人工裁定。因此不把候选覆盖增益写成部署 Agent 安全提升。", "topics": { "tags": [ "evaluation", "authorization" ], "reason_zh": "监管合规红队与边界采样有安全关联，但是否实际评测 Agent 尚待核验。" }, "needs_full_text_review": true, "review": { "id": "2610.04693", "title": "Penumbra: Sample-Efficient Adversarial Search for Regulatory Obligations", "published": "2026-10-03T18:11:23Z", "updated": "2026-10-19T18:48:57Z", "authors": [ "Anthony Rhodes" ], "categories": [ "cs.AI", "cs.CL", "cs.CR" ], "version_id": "2610.04693v3", "announcement_date": null, "source": "http://arxiv.org/abs/2610.04693v3", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "uncertain", "reason": "正文以金融/临床 Agent 义务及工具检索语境为目标，但实际实验是单次响应的最小编辑合规边界生成；尚未完成 Agent 轨迹、权限或训练安全收益验证。范围边界仍待确认，保留不确定，不把一般合规文本生成强行算 Agent 安全。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_selected_body_sections", "summary_zh": "Penumbra 构造只需极少编辑即可跨越监管合规边界的回复对。通过双评估器和自适应预算搜索，在金融 60 项义务上返回 144 对、临床分诊 18 项义务上返回 49 对；作者称自适应方式用 59% 候选达到均匀分配的全预算覆盖。摘要仍以文本合规为对象，需正文确认 Agent 安全场景。 正文核验：第 1 节例子涉及工具检索事实遗漏；附录 H 说明降低未见义务违规率的训练实验尚未完成，且使用自拟义务与 LLM 判断、没有专业人工裁定。因此不把候选覆盖增益写成部署 Agent 安全提升。", "topics": { "tags": [ "evaluation", "authorization" ], "reason_zh": "监管合规红队与边界采样有安全关联，但是否实际评测 Agent 尚待核验。" }, "needs_full_text_review": true, "initial_classification": "uncertain", "body_review_source": "https://arxiv.org/html/2610.04693v3", "body_review_local_file": "2610.04693.txt", "body_sections_checked": [ "1 Introduction", "2 A calibrated boundary detector", "4 Penumbra", "Appendix H Further limitations and planned experiments" ], "first_author_name": "Anthony Rhodes", "first_author_affiliations": [ "Confidential Core AI" ], "first_author_affiliation_status": "verified_in_official_HTML_author_block", "unresolved_question_zh": "范围裁定：包含工具语境的单响应义务评测，是否达到本日报要求的明确 Agent 安全关联；未观察到闭环安全验证。" }, "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.04693", "first_author": "Anthony Rhodes", "authors": [ "Anthony Rhodes" ], "affiliations": [ "Confidential Core AI" ], "source_url": "https://arxiv.org/html/2610.04693v3", "author_source": "http://arxiv.org/abs/2610.04693v3", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Sole first author Anthony Rhodes explicitly lists Confidential Core AI.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.19361": { "id": "2610.19361", "title": "VLX-Go: Robust Embodied Tracking through Multi-Stage Learning and On-Policy Refinement", "published": "2026-10-14T01:02:16Z", "updated": "2026-10-19T12:19:07Z", "authors": [ "Kyusong Lee", "Heting Ying", "Tiancheng Zhao" ], "categories": [ "cs.CV", "cs.CL", "cs.RO" ], "version_id": "2610.19361v2", "announcement_date": null, "source": "http://arxiv.org/abs/2610.19361v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "视觉语言跟随机器人在共享空间评测碰撞率，含具身行动安全指标。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "summary_zh": "VLX-Go 面向有干扰人的共享空间视觉语言跟随。模型先对齐视觉语言、再学习推理及跟随，并对策略实际访问状态作 oracle 过滤的在策略细化。作者报告细化使干扰跟随成功率增加 2.42 个百分点至 58.22%，碰撞率降低 1.99 个百分点。此为受测导航场景的具身安全指标，不是对抗攻击防护保证。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "视觉语言导航明确报告共享空间碰撞指标。" }, "needs_full_text_review": false, "categories_seen": [ "cs.CL", "cs.CV", "cs.RO" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2610.19361", "first_author": "Kyusong Lee", "authors": [ "Kyusong Lee", "Heting Ying", "Tiancheng Zhao" ], "affiliations": [ "Om AI Research" ], "source_url": "https://arxiv.org/html/2610.19361v2", "author_source": "http://arxiv.org/abs/2610.19361v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Kyusong Lee explicitly lists Om AI Research; coauthor Zhejiang unit not transferred.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2609.06783": { "id": "2609.06783", "title": "AURA-Eval: Evaluation Framework for Acting Under Risk Awareness in LLM Agent Trajectories", "published": "2026-09-06T18:58:56Z", "updated": "2026-10-19T05:58:47Z", "authors": [ "Ruoxi Shang", "Christina-Maria Androna", "Orfeas Menis Mastromichalakis", "Yu Feng", "Aniruddhan Ramesh", "Rico Angell", "Shang Hong Sim", "Chrysoula Zerva", "Emmanouil Koukoumidis" ], "categories": [ "cs.CR", "cs.AI", "cs.CL", "cs.SE" ], "version_id": "2609.06783v2", "announcement_date": null, "source": "http://arxiv.org/abs/2609.06783v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "relevant", "reason": "工具轨迹安全决策点风险识别与实际危险行动评测，直接相关。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "summary_zh": "AURA-Eval 将工具轨迹截在安全关键点，改变危害强度、规模、对象脆弱性、系统依赖、监督和可逆性，同时配对有/无安全完成路径。以 157 个 R-Judge 种子生成 1,249 项，评测 20 模型。作者报告前沿模型无安全路径时危险动作率 27–40%，有路径时 5–7%；移除执行前监督使原安全例的 52.3% 转危险。风险认知与行动安全被分别评分，裁判经人类标注校验。", "topics": { "tags": [ "evaluation", "authorization", "monitoring" ], "reason_zh": "区分 Agent 识别风险、选择动作及动作安全，并操纵监督等机制。" }, "needs_full_text_review": false, "categories_seen": [ "cs.AI", "cs.CL", "cs.CR", "cs.SE" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2609.06783", "first_author": "Ruoxi Shang", "authors": [ "Ruoxi Shang", "Christina-Maria Androna", "Orfeas Menis Mastromichalakis", "Yu Feng", "Aniruddhan Ramesh", "Rico Angell", "Shang Hong Sim", "Chrysoula Zerva", "Emmanouil Koukoumidis" ], "affiliations": [ "University of Washington" ], "source_url": "https://arxiv.org/html/2609.06783v2", "author_source": "http://arxiv.org/abs/2609.06783v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "正文有共同贡献脚注，HTML 第一作者标记缺失，完整名单未确认。", "evidence": "Ruoxi Shang superscript1 explicitly maps to University of Washington.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2606.26918": { "id": "2606.26918", "title": "Diagnosing Task Insensitivity in Language Agents", "published": "2026-06-25T11:53:41Z", "updated": "2026-10-19T03:23:09Z", "authors": [ "Jingyu Liu", "Jiaen Lin", "Xiaopeng Wu", "Kehan Chen", "Chuan Yu", "Yong Liu" ], "categories": [ "cs.AI" ], "version_id": "2606.26918v2", "announcement_date": null, "source": "http://arxiv.org/abs/2606.26918v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "uncertain", "reason": "正文确认缺失目标时仍继续环境操作，并以越过任务边界的公开事故作动机；但研究指标是动作持续、任务依赖和 OOD 任务成功，未直接测量权限违规或伤害。与安全停止/澄清边界有关，但也可能仅属通用可靠性，保留范围待确认。", "abstract_read": true, "full_text_checked": true, "evidence_level": "full_abstract_and_selected_body_sections", "summary_zh": "论文研究任务要求能否约束语言 Agent。在五模型、三交互环境中，把任务换成 xxxx 后，即便要求澄清模型仍可行动；训练中观察到任务词注意力下降。TPNLL 对比同一行动在不同任务下的预测代价，提高任务依赖与分布外成功率。是否属于安全授权违规而非普通任务可靠性，需正文核验。 正文核验：引言区分上下文诱导的连贯操作与用户目标约束；未读到独立安全/授权违规实验，不能把任务成功率提升等同安全保证。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "无有效任务时仍行动可能涉及用户意图边界，摘要未明确安全后果。" }, "needs_full_text_review": true, "review": { "id": "2606.26918", "title": "Diagnosing Task Insensitivity in Language Agents", "published": "2026-06-25T11:53:41Z", "updated": "2026-10-19T03:23:09Z", "authors": [ "Jingyu Liu", "Jiaen Lin", "Xiaopeng Wu", "Kehan Chen", "Chuan Yu", "Yong Liu" ], "categories": [ "cs.AI" ], "version_id": "2606.26918v2", "announcement_date": null, "source": "http://arxiv.org/abs/2606.26918v2", "provenance": "official_category_API_sorted_lastUpdatedDate", "classification": "uncertain", "reason": "正文确认缺失目标时仍继续环境操作，并以越过任务边界的公开事故作动机；但研究指标是动作持续、任务依赖和 OOD 任务成功，未直接测量权限违规或伤害。与安全停止/澄清边界有关，但也可能仅属通用可靠性，保留范围待确认。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_selected_body_sections", "summary_zh": "论文研究任务要求能否约束语言 Agent。在五模型、三交互环境中，把任务换成 xxxx 后，即便要求澄清模型仍可行动；训练中观察到任务词注意力下降。TPNLL 对比同一行动在不同任务下的预测代价，提高任务依赖与分布外成功率。是否属于安全授权违规而非普通任务可靠性，需正文核验。 正文核验：引言区分上下文诱导的连贯操作与用户目标约束；未读到独立安全/授权违规实验，不能把任务成功率提升等同安全保证。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "无有效任务时仍行动可能涉及用户意图边界，摘要未明确安全后果。" }, "needs_full_text_review": true, "initial_classification": "uncertain", "body_review_source": "https://arxiv.org/html/2606.26918v2", "body_review_local_file": "2606.26918.txt", "body_sections_checked": [ "1 Introduction", "2 Related Work (task dependence)", "7 Conclusion", "Limitations" ], "first_author_name": "Jingyu Liu", "first_author_affiliations": [ "Gaoling School of Artificial Intelligence, Renmin University of China, Beijing, China" ], "first_author_affiliation_status": "verified_in_official_HTML_author_block", "unresolved_question_zh": "范围裁定：任务未知时持续操作是否作为安全停止边界评测收录，还是排除为一般任务跟随可靠性。" }, "categories_seen": [ "cs.AI" ], "announcement_status": "公告日未确认；仅官方 API 可见，不计为已公告批次", "author": { "id": "2606.26918", "first_author": "Jingyu Liu", "authors": [ "Jingyu Liu", "Jiaen Lin", "Xiaopeng Wu", "Kehan Chen", "Chuan Yu", "Yong Liu" ], "affiliations": [ "Renmin University of China" ], "source_url": "https://arxiv.org/html/2606.26918v2", "author_source": "http://arxiv.org/abs/2606.26918v2", "author_status": "verified", "affiliation_status": "verified", "status": "verified", "shared_first_authors": [], "shared_first_note": "", "evidence": "Jingyu Liu individually lists Gaoling School of Artificial Intelligence, Renmin University of China.", "verification_status": "affiliation_verified" }, "first_seen_date": "2026-10-26", "seen_dates": [ "2026-10-26" ], "revision_history": [] }, "2610.32888": { "id": "2610.32888", "version_id": "2610.32888v2", "abstract_sha256": "3ad3d1a723e3a1aa7d41b203c4598c91f4f4b67e2da051c88c113aab4f656129", "abstract_read": true, "classification": "relevant", "reason_zh": "直接研究具身VLA联邦适应中人类安全纠正丢失、跨机器人不安全响应与隐私泄漏。", "summary_zh": "论文讨论把不同任务、场景、用户和机器人中的人类纠正转换为共享VLA更新的风险，指出平均成功率改善可能掩盖稀有安全指令。提出保留多模态纠正上下文与不确定性、接收机器人闭环部署前评估、同时测量泄漏与安全证据保留三项要求，提供反例和可证伪评测议程，无实验结果。", "topics": { "tags": [ "embodied", "privacy", "robustness", "evaluation" ], "reason_zh": "直接研究具身VLA联邦适应中人类安全纠正丢失、跨机器人不安全响应与隐私泄漏。" }, "reason": "直接研究具身VLA联邦适应中人类安全纠正丢失、跨机器人不安全响应与隐私泄漏。", "title": "When Human Corrections Travel: Safety in Federated VLA Adaptation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-23T16:56:03Z", "updated": "2026-11-02T16:47:08Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.LG", "cs.RO" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.32888v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-11-04" ], "version_history": [ { "id": "2610.32888", "title": "When Human Corrections Travel: Safety in Federated VLA Adaptation", "classification": "relevant", "reason": "正文确认关注VLA机器人共享人类纠正时的安全语义、物理行为风险与隐私，不是普通任务成功率优化。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "initial_classification": "relevant", "scope_review": { "id": "2610.32888", "title": "When Human Corrections Travel: Safety in Federated VLA Adaptation", "previous_classification": "relevant", "classification": "relevant", "reason": "正文确认关注VLA机器人共享人类纠正时的安全语义、物理行为风险与隐私，不是普通任务成功率优化。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1–3、表1", "source_url": "https://arxiv.org/pdf/2610.32888", "evidence_notes": "提出跨机器人共享需限定行为范围并在接收端闭环评估；表1的危险接触、误释放和干预衰减均是待研究反例，不是实测结果。", "unresolved": false }, "version_id": "2610.32888v1", "published": "2026-10-23T16:56:03Z", "updated": "2026-10-23T16:56:03Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.LG", "cs.RO" ], "source_url": "https://arxiv.org/abs/2610.32888", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "new", "section": "Cross submissions (showing 92 of 92 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "recent", "section": null } ], "candidate_type": "unseen_id", "abstract_sha256": "3ad3d1a723e3a1aa7d41b203c4598c91f4f4b67e2da051c88c113aab4f656129", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "announcement_status": "官方公告列表已核对", "backfill_kind": "new_id_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.32888", "first_author": "Vigneshwaran Subbaraju", "authors": [ "Vigneshwaran Subbaraju", "Obaidullah Zaland", "Monowar Bhuyan" ], "affiliations": [ "A*STAR" ], "source_url": "https://arxiv.org/pdf/2610.32888v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页标题及v2匹配；Vigneshwaran Subbaraju作者栏明确A*STAR, Singapore。", "title": "When Human Corrections Travel: Safety in Federated VLA Adaptation", "version_id": "2610.32888v2", "verification_status": "affiliation_verified", "affiliation_checked": true }, "initial_classification": "relevant", "first_seen_date": "2026-10-27", "revision_history": [ { "id": "2610.32888", "title": "When Human Corrections Travel: Safety in Federated VLA Adaptation", "classification": "relevant", "reason": "正文确认关注VLA机器人共享人类纠正时的安全语义、物理行为风险与隐私，不是普通任务成功率优化。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "summary_zh": "问题：联邦VLA适配共享来自不同人员、任务、环境和机器人形态的人类纠正时，平均任务收益可能掩盖少见安全干预的遗失，并给接收机器人引入不安全反应。方法：提出共享时保留纠正上下文及不确定性、部署前在接收机器人的闭环中评估更新、同时评估隐私泄漏和关键安全证据保留三项要求。作者以反例和可证伪的评估议程论证需求，摘要明确不提供实验结果。", "topics": { "tags": [ "embodied", "privacy", "evaluation" ], "reason_zh": "关注VLA机器人安全纠正的跨端共享、闭环上线评估与隐私泄漏。" }, "initial_classification": "relevant", "scope_review": { "id": "2610.32888", "title": "When Human Corrections Travel: Safety in Federated VLA Adaptation", "previous_classification": "relevant", "classification": "relevant", "reason": "正文确认关注VLA机器人共享人类纠正时的安全语义、物理行为风险与隐私，不是普通任务成功率优化。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1–3、表1", "source_url": "https://arxiv.org/pdf/2610.32888", "evidence_notes": "提出跨机器人共享需限定行为范围并在接收端闭环评估；表1的危险接触、误释放和干预衰减均是待研究反例，不是实测结果。", "unresolved": false }, "version_id": "2610.32888v1", "published": "2026-10-23T16:56:03Z", "updated": "2026-10-23T16:56:03Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.LG", "cs.RO" ], "source_url": "https://arxiv.org/abs/2610.32888", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "new", "section": "Cross submissions (showing 92 of 92 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "recent", "section": null } ], "candidate_type": "unseen_id", "abstract_sha256": "3ad3d1a723e3a1aa7d41b203c4598c91f4f4b67e2da051c88c113aab4f656129", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "announcement_status": "官方公告列表已核对", "backfill_kind": "new_id_v1", "author": { "id": "2610.32888", "first_author": "Vigneshwaran Subbaraju", "authors": [ "Vigneshwaran Subbaraju", "Obaidullah Zaland", "Monowar Bhuyan" ], "affiliations": [ "A*STAR, Singapore" ], "source_url": "https://arxiv.org/pdf/2610.32888v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" } } ] }, "2610.31686": { "id": "2610.31686", "title": "From Target Selection to Condition Reuse: Auditing Residual Interventions in Tool-Use Models", "classification": "relevant", "reason": "正文确认权限tag和时间条件驱动的工具选择是受控Agent决策安全评测；必须注明实验测量反事实内部干预目标，不能当作自然运行违规率。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "summary_zh": "问题：内部激活干预让工具模型选中目标，不证明它能复用该目标对应的权限或时间条件。方法：在Qwen3.5-27B的32个程序生成世界上，比较案例特定残差写入、事实与标识符重组、独立资格判断和完整工具动作。作者称熟悉目标选择从35/128、33/128分别增至119/128、114/128，但重组后收益消失，独立资格判断收益很少；早层源修补可选择性影响判断，却不保证完整动作正确。正文注明这是反事实干预目标评测，不代表模型自然运行中的权限违规率。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "直接核验工具行动的权限条件使用、激活干预与完整动作正确性的区别。" }, "initial_classification": "relevant", "scope_review": { "id": "2610.31686", "title": "From Target Selection to Condition Reuse: Auditing Residual Interventions in Tool-Use Models", "previous_classification": "relevant", "classification": "relevant", "reason": "正文确认权限tag和时间条件驱动的工具选择是受控Agent决策安全评测；必须注明实验测量反事实内部干预目标，不能当作自然运行违规率。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1–3，图1，实验任务定义", "source_url": "https://arxiv.org/pdf/2610.31686", "evidence_notes": "§2说明完整动作是select_followup工具调用，除目标ID还须正确独立offer和reservation；Native A对B评分低可能只是正确遵循原A，不意味着自然错误；选择与独立资格查询并非总针对同一候选。", "unresolved": false, "summary_zh": "问题：内部激活干预让工具模型选中目标，不证明它能复用该目标对应的权限或时间条件。方法：在Qwen3.5-27B的32个程序生成世界上，比较案例特定残差写入、事实与标识符重组、独立资格判断和完整工具动作。作者称熟悉目标选择从35/128、33/128分别增至119/128、114/128，但重组后收益消失，独立资格判断收益很少；早层源修补可选择性影响判断，却不保证完整动作正确。正文注明这是反事实干预目标评测，不代表模型自然运行中的权限违规率。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "直接核验工具行动的权限条件使用、激活干预与完整动作正确性的区别。" } }, "version_id": "2610.31686v1", "published": "2026-10-05T11:46:10Z", "updated": "2026-10-05T11:46:10Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.AI", "cs.CL" ], "source_url": "https://arxiv.org/abs/2610.31686", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "New submissions (showing 72 of 72 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null } ], "candidate_type": "unseen_id", "abstract_sha256": "190d3be06504e6c1c81f33906ff63eeb0fad9c0fefa242fb5e742955bb90bbe8", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "announcement_status": "官方公告列表已核对", "backfill_kind": "new_id_v1", "author": { "id": "2610.31686", "first_author": "Tianda Sun", "authors": [ "Tianda Sun", "Dimitar Kazakov" ], "affiliations": [ "University of York" ], "source_url": "https://arxiv.org/pdf/2610.31686v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [] }, "2601.12754": { "id": "2601.12754", "title": "PAIR-SAFE: A Paired-Agent Approach for Runtime Auditing and Refining AI-Mediated Mental Health Support", "classification": "relevant", "reason": "保留为多Agent运行时监督研究；正文确有Responder/Judge的ALLOW或REVISE控制，但证据主要是MITI交流质量，不能外推临床疗效或危机处置安全。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "summary_zh": "问题：心理支持LLM可能过度指令化或不符合临床交流原则，仅靠训练或提示缺少显式运行时监督。方法：Responder生成回答，基于MITI-4的Judge在交付前给出ALLOW/REVISE并反馈，以模拟求助者交互与专家评估检查效果。作者报告合作、关系质量等MITI指标改善。正文核验表明这些是交流质量结果，不评医学准确性，也不能证明真实临床疗效或危机/自伤场景安全；系统不为这些场景设计。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "明确双Agent交付前审计和修订门控，评测以交流规范为边界，不作临床安全保证。" }, "initial_classification": "relevant", "scope_review": { "id": "2601.12754", "title": "PAIR-SAFE: A Paired-Agent Approach for Runtime Auditing and Refining AI-Mediated Mental Health Support", "previous_classification": "relevant", "classification": "relevant", "reason": "保留为多Agent运行时监督研究；正文确有Responder/Judge的ALLOW或REVISE控制，但证据主要是MITI交流质量，不能外推临床疗效或危机处置安全。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§3.2.2框架、§5–7讨论/局限/伦理、附录Judge提示", "source_url": "https://arxiv.org/pdf/2601.12754", "evidence_notes": "Judge在交付前审查每次回应并触发修订；附录明确只评MI完整性，不评医学准确性；§7明确不用于危机或自伤，MITI改善不等于真实健康改善。", "unresolved": false, "summary_zh": "问题：心理支持LLM可能过度指令化或不符合临床交流原则，仅靠训练或提示缺少显式运行时监督。方法：Responder生成回答，基于MITI-4的Judge在交付前给出ALLOW/REVISE并反馈，以模拟求助者交互与专家评估检查效果。作者报告合作、关系质量等MITI指标改善。正文核验表明这些是交流质量结果，不评医学准确性，也不能证明真实临床疗效或危机/自伤场景安全；系统不为这些场景设计。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "明确双Agent交付前审计和修订门控，评测以交流规范为边界，不作临床安全保证。" } }, "version_id": "2601.12754v2", "published": "2026-01-19T06:20:57Z", "updated": "2026-10-23T15:04:11Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.AI", "cs.CL", "cs.CY", "cs.HC" ], "source_url": "https://arxiv.org/abs/2601.12754", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Replacement submissions (showing 63 of 63 entries)" } ], "candidate_type": "unseen_id", "abstract_sha256": "ac1630b3490f8b87dbfc5c76b1e46b2603f7a758e39abb05b215ccc7de9464b5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "announcement_status": "官方公告列表已核对", "backfill_kind": "historical_revision_backfill", "author": { "id": "2601.12754", "first_author": "Jiwon Kim", "authors": [ "Jiwon Kim", "Violeta J. Rodriguez", "Dong Whi Yoo", "Eshwar Chandrasekharan", "Koustuv Saha" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "source_url": "https://arxiv.org/pdf/2601.12754v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [] }, "2610.33860": { "id": "2610.33860", "title": "Numina Fuse: Interactive Autoformalization in Lean 4", "classification": "relevant", "reason": "正文明确描述Claude Code/Codex多Agent部署的权限回调绕过、子Agent权限继承缺口及OS隔离防线，具有直接Coding Agent安全工程贡献。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "read_index": 16, "summary_zh": "问题：自动形式化Agent产出速度超过人工审查，编译成功不保证数学语义正确，共享服务器上的Coding Agent还可能越过应用级权限边界。方法：Numina Fuse把人工语句审核、蓝图与依赖图、Claude Code/Codex多Agent协作结合；正文另说明由平台启动子Agent以继承检查，限制命令和路径，并用操作系统隔离保护宿主及其他用户。作者报告Kakeya形式化部署经验及证明模型研究；未提供沙箱抗攻击成功率，不能把设计说明当作已证明的安全性。", "topics": { "tags": [ "authorization", "supplychain", "monitoring", "multiagent" ], "reason_zh": "正文涉及Coding Agent权限回调、子Agent继承、共享仓库隔离及人工审核，安全关联通过正文确认。" }, "needs_full_text_review": true, "initial_classification": "uncertain", "scope_review": { "id": "2610.33860", "title": "Numina Fuse: Interactive Autoformalization in Lean 4", "previous_classification": "uncertain", "classification": "relevant", "reason": "正文明确描述Claude Code/Codex多Agent部署的权限回调绕过、子Agent权限继承缺口及OS隔离防线，具有直接Coding Agent安全工程贡献。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1–4、§7相关段落", "source_url": "https://arxiv.org/pdf/2610.33860", "evidence_notes": "§4说明某些内置工具不经过权限回调、原生子Agent不继承Fuse检查，故由Fuse启动每个子进程；对shell与路径设限并禁止改Git/CI，Lean构建能运行任意代码，因此最终边界是带namespaces和资源限制的操作系统jail。", "unresolved": false, "summary_zh": "问题：自动形式化Agent产出速度超过人工审查，编译成功不保证数学语义正确，共享服务器上的Coding Agent还可能越过应用级权限边界。方法：Numina Fuse把人工语句审核、蓝图与依赖图、Claude Code/Codex多Agent协作结合；正文另说明由平台启动子Agent以继承检查，限制命令和路径，并用操作系统隔离保护宿主及其他用户。作者报告Kakeya形式化部署经验及证明模型研究；未提供沙箱抗攻击成功率，不能把设计说明当作已证明的安全性。", "topics": { "tags": [ "authorization", "supplychain", "monitoring", "multiagent" ], "reason_zh": "正文涉及Coding Agent权限回调、子Agent继承、共享仓库隔离及人工审核，安全关联通过正文确认。" } }, "version_id": "2610.33860v1", "published": "2026-10-24T19:05:32Z", "updated": "2026-10-24T19:05:32Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.LG", "cs.LO", "cs.SE" ], "source_url": "https://arxiv.org/abs/2610.33860", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 200 of 200 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "722f641dca8314203ea0b63b1f2fc01aeb38ab75537648bf7d99423f9c0df4b6", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33860", "first_author": "Justin Asher", "authors": [ "Justin Asher", "Yichuan Cao", "Ruichen Qiu", "Pietro Pellegrino", "Jia Li" ], "affiliations": [ "Project Numina" ], "source_url": "https://arxiv.org/pdf/2610.33860v1", "shared_first_authors": [ "Justin Asher", "Yichuan Cao", "Ruichen Qiu" ], "shared_first_note": "首页 Equal contribution 标记 Justin Asher、Yichuan Cao、Ruichen Qiu 共同第一；†为项目负责人。", "shared_first_affiliations": { "Justin Asher": [ "Project Numina" ], "Yichuan Cao": [ "Academy of Mathematics and Systems Science, University of Chinese Academy of Sciences" ], "Ruichen Qiu": [ "Academy of Mathematics and Systems Science, University of Chinese Academy of Sciences" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页 Equal contribution 标记 Justin Asher、Yichuan Cao、Ruichen Qiu 共同第一；†为项目负责人。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33842": { "id": "2610.33842", "title": "Approximate Universal Prediction under Interaction", "classification": "relevant", "reason": "分析交互规划Agent的预测近似误差放大及导师接管/让权决策保障，属于Agent安全理论。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 18, "summary_zh": "问题：Agent用近似预测器规划时，会主动进入预测过于乐观且训练覆盖不足的行动分支，放大误差。方法：对有限时域因果混合模型分析策略覆盖比、任务稀有度和训练KL预算，给出预测与价值误差界，并考察导师接管机制的让权决策。作者给出误差阶的紧性结果和反例，说明让权决策一致不代表任务风险事件被避免；保证依赖明确的总体近似与覆盖假设，摘要未报告实证安全改善数值。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "分析交互规划Agent的预测近似误差放大及导师接管/让权决策保障，属于Agent安全理论。" }, "version_id": "2610.33842v1", "published": "2026-10-24T18:32:00Z", "updated": "2026-10-24T18:32:00Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.LG", "stat.ML" ], "source_url": "https://arxiv.org/abs/2610.33842", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 33 of 33 entries)", "category": "stat.ML", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "stat.ML", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "a2cfbcf04982cfe99ad093a91c07b5b8b5665a8f3588e805a42640129587316c", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33842", "first_author": "Richard Cornelius Suwandi", "authors": [ "Richard Cornelius Suwandi" ], "affiliations": [ "School of Artificial Intelligence, The Chinese University of Hong Kong, Shenzhen" ], "source_url": "https://arxiv.org/html/2610.33842v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33728": { "id": "2610.33728", "title": "Strategic Calibration in LLM Multi-Agent Systems: Audited Pivot Scoring for Truthful Elicitation", "classification": "relevant", "reason": "研究多LLM Agent为争夺下游分配而夸大置信度，提出审计和激励兼容机制，直接涉及多Agent可信协调。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 34, "summary_zh": "问题：多Agent汇报的置信度决定后续算力与影响力分配，Agent可能策略性夸大贡献。方法：APSM补偿平台分配收益、采用稀疏审计的逆倾向加权、Clarke外部性收费及严格适当评分。作者在给定模型假设下证明真实汇报是唯一期望效用最佳响应；实验中LLM在Top-K激励下夸大置信度，APSM与CPS均降低失真，CPS分配精确匹配更高、APSM Brier损失更低，APSM对改变分配的偏离效用裕量达到原来的1.93倍。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "研究多LLM Agent为争夺下游分配而夸大置信度，提出审计和激励兼容机制，直接涉及多Agent可信协调。" }, "version_id": "2610.33728v1", "published": "2026-10-24T15:18:31Z", "updated": "2026-10-24T15:18:31Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.GT" ], "source_url": "https://arxiv.org/abs/2610.33728", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "ec4ac4b552d2b47809621a7f50bfd51e87a0443902ad9fa8720ad04593358162", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33728", "first_author": "Jinhao Zhou", "authors": [ "Jinhao Zhou", "Zhaohan Zhang", "Xijian Xu", "Jun Wu" ], "affiliations": [ "Graduate School of Information, Production and Systems, Waseda University" ], "source_url": "https://arxiv.org/pdf/2610.33728v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33605": { "id": "2610.33605", "title": "Data Governance for Generative and Agentic AI : Technology, Law, Economics, and Security", "classification": "relevant", "reason": "系统论述Agent与多Agent的权限、数据来源、记忆、零信任和治理控制面，明确覆盖Agent安全治理。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 46, "summary_zh": "问题：生成和自主多Agent系统从检索到记忆、行动的全生命周期需要统一数据治理。方法：该书以技术、法律、经济三个视角组织十一章和八个附录，覆盖来源谱系、零信任、安全、Agent治理、多Agent系统及治理控制平面。各章以印度法律制度为锚并做跨法域比较。摘要为框架与主题说明，未提供量化实验结果，不能据此推断安全有效性。", "topics": { "tags": [ "authorization", "memory", "multiagent", "privacy" ], "reason_zh": "系统论述Agent与多Agent的权限、数据来源、记忆、零信任和治理控制面，明确覆盖Agent安全治理。" }, "version_id": "2610.33605v1", "published": "2026-10-24T11:03:57Z", "updated": "2026-10-24T11:03:57Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CY" ], "source_url": "https://arxiv.org/abs/2610.33605", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "74ca34435b614a6305d4a4e90d624ba6a45f404a7b9e1b25297de99903f0a952", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33605", "first_author": "Narayana Darapaneni", "authors": [ "Narayana Darapaneni", "Padmaja K", "Gnana Chaithra D" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.33605v1", "shared_first_authors": [], "shared_first_note": "论文封面列 Narayana Darapaneni 第一，但未列署名单位，单位未确认。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "未确认", "status": "unconfirmed", "evidence": "论文封面列 Narayana Darapaneni 第一，但未列署名单位，单位未确认。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33592": { "id": "2610.33592", "title": "Auditing evaluation artifacts and data leakage in large language model systems for rare disease diagnosis", "classification": "relevant", "reason": "重建agentic诊断系统并量化候选空间污染和数据泄漏导致的虚高评测，直接涉及Agent评测可信性。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 47, "summary_zh": "问题：罕见病诊断Agent的高基准分可能来自候选空间污染与数据泄漏，而非真实临床推理。方法：利用六万余病例重建现有agentic系统，严格隔离跨数据集案例，并分析治疗线索、时间失配和监督分类器的空间过拟合。作者称Agent跨数据集平均Recall@1从传统评测下54.3%降至40.3%，Hedges g为0.94；据此提出数据隔离和标准化评测保护。结果属于评测审计，不证明临床有效性。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "重建agentic诊断系统并量化候选空间污染和数据泄漏导致的虚高评测，直接涉及Agent评测可信性。" }, "version_id": "2610.33592v1", "published": "2026-10-24T10:35:48Z", "updated": "2026-10-24T10:35:48Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2610.33592", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "f772fd20eb7168bc5f53522ac4b2de750acea29bda73a033a4f89e730ad01d82", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33592", "first_author": "Jian Yang", "authors": [ "Jian Yang", "Peilin Liu", "Xiaohan Li", "Songda Li", "Yu Cao", "Yuqing Feng", "Haomin Li" ], "affiliations": [ "The Children’s Hospital, Zhejiang University School of Medicine" ], "source_url": "https://arxiv.org/pdf/2610.33592v1", "shared_first_authors": [], "shared_first_note": "第一作者 Jian Yang 标注1，对应浙江大学医学院附属儿童医院；星号为通讯作者。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "第一作者 Jian Yang 标注1，对应浙江大学医学院附属儿童医院；星号为通讯作者。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33528": { "id": "2610.33528", "title": "SkillShift-Bench: Benchmarking Skill Learning under Environment Evolution for Web Agents", "classification": "relevant", "reason": "控制环境变化下Web Agent技能失效和可执行性退化，建立鲁棒性诊断及测试时适应。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 53, "summary_zh": "问题：Web Agent复用技能在开放环境变化时可能失效，闭环境成功率无法反映其可靠性。方法：SkillShift-Bench在三个自托管Web系统中控制上下文、感知和执行变化，记录任务成功、成本、技能使用与失败；将执行建模为非平稳局部可执行性问题并提供动态遗憾分析和测试时适应。作者报告多种变化导致成功下降、成本增加，执行变化影响最强，测试时适应可改善技能执行；摘要未给具体改善数值。", "topics": { "tags": [ "robustness", "evaluation" ], "reason_zh": "控制环境变化下Web Agent技能失效和可执行性退化，建立鲁棒性诊断及测试时适应。" }, "version_id": "2610.33528v1", "published": "2026-10-24T08:09:00Z", "updated": "2026-10-24T08:09:00Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL" ], "source_url": "https://arxiv.org/abs/2610.33528", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 78 of 78 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "4cf430190bf1f7c7213b0c33519998a03fccd4252b426557111236e09fb0b167", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33528", "first_author": "Bo-Yu Chen", "authors": [ "Bo-Yu Chen", "Zhi Zhou", "Yu-Feng Li" ], "affiliations": [ "School of Artificial Intelligence, Nanjing University", "National Key Laboratory for Novel Software Technology, Nanjing University" ], "source_url": "https://arxiv.org/pdf/2610.33528v1", "shared_first_authors": [], "shared_first_note": "Bo-Yu Chen 同时标注单位1、2；后两位作者星号为通讯作者。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Bo-Yu Chen 同时标注单位1、2；后两位作者星号为通讯作者。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33445": { "id": "2610.33445", "title": "From Intelligence to Autonomy: Foundations and Construction of Autonomous Agents for Future Intelligent Systems", "classification": "relevant", "reason": "定义自主Agent身份/权限边界与受治理学习回路，并以权限约束仿真实验检验，直接涉及行动授权。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 65, "summary_zh": "问题：任务能力强不代表Agent能在身份和权限边界内持续自主运行、恢复失败或受控更新。方法：提出一条边界和操作、存活、反思、学习四个回路，组织任务执行、自维护、元控制及受治理学习。作者通过五组配对仿真实验测试权限约束、道路封闭响应、健康维护、能力重估和跨任务学习，报告初步可行性；摘要无量化效果，且明确更广环境和物理系统尚待测试。", "topics": { "tags": [ "authorization", "robustness" ], "reason_zh": "定义自主Agent身份/权限边界与受治理学习回路，并以权限约束仿真实验检验，直接涉及行动授权。" }, "version_id": "2610.33445v1", "published": "2026-10-24T04:47:10Z", "updated": "2026-10-24T04:47:10Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.LG" ], "source_url": "https://arxiv.org/abs/2610.33445", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "c4525038aad0a472348dc4b3715af0aba0c6ec0fc89edc8af9129f347496c024", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33445", "first_author": "Hongda Zhang", "authors": [ "Hongda Zhang", "Ziqing Zhou", "Yuning Chen", "Linqiang Hu", "Yi Liu", "Ding Zhou", "Zhao Huang", "Haining Xu" ], "affiliations": [ "Fudan University" ], "source_url": "https://arxiv.org/pdf/2610.33445v1", "shared_first_authors": [], "shared_first_note": "首页编号1映射Fudan University；星号为通讯作者。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页编号1映射Fudan University；星号为通讯作者。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33432": { "id": "2610.33432", "title": "ConMem: Counterfactual Multi-Scenario Probing for Resolving LLM Memory Misalignment", "classification": "relevant", "reason": "LLM Agent长期记忆错误归因、过度保留和隐私敏感信息引发的失配，提出反事实审计并评测。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 67, "summary_zh": "问题：长期Agent记忆可能过度概括、错误归因或保留隐私敏感信息，损害后续行为边界。方法：构建1,079例合成且经过验证的多会话记忆失配基准MemAlign；ConMem生成反事实交互场景，从相关任务、无关不变性和风险边界变化审计保留记忆的下游效应。作者报告准确率75.16%、平衡准确率64.15%、Macro-F1 65.31%，减轻过度保留且维持个性化效用。", "topics": { "tags": [ "memory", "privacy", "evaluation" ], "reason_zh": "LLM Agent长期记忆错误归因、过度保留和隐私敏感信息引发的失配，提出反事实审计并评测。" }, "version_id": "2610.33432v1", "published": "2026-10-24T04:16:37Z", "updated": "2026-10-24T04:16:37Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2610.33432", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "7bad85788b6c6c5940a3338538686c7e43323b2cdcfb511bb4de60e54cfd2d11", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33432", "first_author": "Shuning Zhang", "authors": [ "Shuning Zhang", "Tenghao Ji", "Jingruo Chen", "Eryue Xu", "Bohao Chu", "Xin Yi" ], "affiliations": [ "Tsinghua University" ], "source_url": "https://arxiv.org/pdf/2610.33432v1", "shared_first_authors": [], "shared_first_note": "首页前两位作者带星号，但所查首页/HTML未明确星号含义，不能据此确认共同一作。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页前两位作者带星号，但所查首页/HTML未明确星号含义，不能据此确认共同一作。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33318": { "id": "2610.33318", "title": "A Deterministic Security Runtime for LLM Agents on MPI and Batch-Scheduled HPC Systems: Consensus-Governed, Hardware-Rooted Supervision of Every Rank", "classification": "relevant", "reason": "对LLM Agent在HPC发起和运行任务实施确定性授权、硬件签名租约和逐rank监督，实测注入与串谋攻击防护。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 79, "summary_zh": "问题：LLM Agent一次HPC启动可消耗大量资源，主机被攻陷后还可能伪造运行证据。方法：Enclawed以策略门控启动、硬件根签名心跳和短租约、各rank监督器的暂停及篡改终止机制监督运行中任务。作者称16-rank LAMMPS计算循环不变、启动约增加3秒；十二次真实攻击均失败关闭，十六Agent受植入指令诱导的24次启动全部被拒，108次合法启动全部获准。上述数字限于所测配置，非一般安全证明。", "topics": { "tags": [ "authorization", "injection", "multiagent", "monitoring" ], "reason_zh": "对LLM Agent在HPC发起和运行任务实施确定性授权、硬件签名租约和逐rank监督，实测注入与串谋攻击防护。" }, "version_id": "2610.33318v1", "published": "2026-10-23T21:43:20Z", "updated": "2026-10-23T21:43:20Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR", "cs.DC" ], "source_url": "https://arxiv.org/abs/2610.33318", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "4d06152e9e874f63200f23bdb617b6735b219b83fa6c7844c5d657eba00ffab5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33318", "first_author": "Alfredo Metere", "authors": [ "Alfredo Metere" ], "affiliations": [ "Enclawed, Inc." ], "source_url": "https://arxiv.org/html/2610.33318v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33282": { "id": "2610.33282", "title": "Estimation of Propagated Risk in LLM-based Multi-Agent Systems", "classification": "relevant", "reason": "从多Agent执行轨迹估计上游错误传到下游的风险并沿执行图传播，直接涉及多Agent可靠性监控。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 83, "summary_zh": "问题：多LLM Agent中上游错误可通过实际交互影响下游，局部不确定性不能充分估计传播风险。方法：IE-Prop分别学习正确与错误发送者对接收者的条件效应，用发送者风险混合后沿执行图递归传播。作者在三种架构和三个基准上报告最终节点AUROC平均比既有基线提高约0.05，连续系统的多步追踪另贡献约0.03；收益依赖信息流结构。", "topics": { "tags": [ "multiagent", "monitoring", "robustness" ], "reason_zh": "从多Agent执行轨迹估计上游错误传到下游的风险并沿执行图传播，直接涉及多Agent可靠性监控。" }, "version_id": "2610.33282v1", "published": "2026-10-23T20:46:33Z", "updated": "2026-10-23T20:46:33Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.MA" ], "source_url": "https://arxiv.org/abs/2610.33282", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "820d646cf17f22ebbc86eb4690ccc70f4b0bb96ce34adae18546455292636e24", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33282", "first_author": "Shreyan Ganguly", "authors": [ "Shreyan Ganguly", "Souradeep Chattopadhyay", "Qisai Liu", "Soumik Sarkar" ], "affiliations": [ "Iowa State University" ], "source_url": "https://arxiv.org/html/2610.33282v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33253": { "id": "2610.33253", "title": "Operationalizing Governed Agentic Workflows in Regulated Finance: A Customer Zero Case Study using Zafin AIOS", "classification": "relevant", "reason": "实际Agent编码工作流控制平面案例，明确检验隐私、角色权限、审计及可观察性。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 87, "summary_zh": "问题：受监管企业采用编码Agent时需要保留权限、隐私、审计和可观察性控制。方法：Zafin AIOS以端到端编排与控制平面运行企业内部两个生产代码库工作流，并与人工流程做描述性案例比较。作者称定价平台工作量降低38%，客户交易协商报告工作量降低76%，同时维持预设隐私、角色访问和审计护栏。结果是单企业案例的描述，不能推断通用防攻击能力。", "topics": { "tags": [ "authorization", "privacy", "monitoring", "supplychain" ], "reason_zh": "实际Agent编码工作流控制平面案例，明确检验隐私、角色权限、审计及可观察性。" }, "version_id": "2610.33253v1", "published": "2026-10-23T19:55:22Z", "updated": "2026-10-23T19:55:22Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.SE" ], "source_url": "https://arxiv.org/abs/2610.33253", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "d49d0b5e75b270108ff1e9a6e3645c7ff2ff4a13aa1b57ba6398a5071472b12b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33253", "first_author": "Shahir Daya", "authors": [ "Shahir Daya", "Rob Dunlap", "Alexandre Boulenger", "Ahmed Abdelmoneim", "Salvatore Vella" ], "affiliations": [ "Zafin" ], "source_url": "https://arxiv.org/html/2610.33253v1", "shared_first_authors": [], "shared_first_note": "官方HTML第一作者署名 Chief Technology Officer, Zafin；保留机构，不根据职务推测其他单位。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "官方HTML第一作者署名 Chief Technology Officer, Zafin；保留机构，不根据职务推测其他单位。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33201": { "id": "2610.33201", "title": "Position, Role or Label? A Controlled Study of Instruction Conflicts in LLM Agents", "classification": "relevant", "reason": "直接控制LLM Agent运营者、仓库、用户、工具、记忆指令冲突的来源与位置，评估行动遵循及冲突披露。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 93, "summary_zh": "问题：Agent面对运营者、仓库配置、用户、工具与记忆的冲突指令，来源效应常与位置/角色/标签混淆。方法：WhoWins构建1,080个可程序评分场景和七组受控实验，评估十四个开放权重模型、1,887,356个回答。作者称同消息首条指令胜率72.42%至94.66%，跨消息降为22.95%至62.65%；所有Qwen模型中较早系统政策输掉多数后续冲突，且工具/写文件任务存在反直觉角色效应。按作者关键词模式，最多2.92%的已裁决成对回答提示或保留冲突。", "topics": { "tags": [ "injection", "authorization", "memory", "evaluation" ], "reason_zh": "直接控制LLM Agent运营者、仓库、用户、工具、记忆指令冲突的来源与位置，评估行动遵循及冲突披露。" }, "version_id": "2610.33201v1", "published": "2026-10-23T18:48:27Z", "updated": "2026-10-23T18:48:27Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.SE" ], "source_url": "https://arxiv.org/abs/2610.33201", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "7f1f948c85683ef05654e6688110704bddb0918b56b1b769235557ff7f7ee6a4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33201", "first_author": "Anish Laddha", "authors": [ "Anish Laddha", "Nitesh Pradhan", "Gaurav Srivastava" ], "affiliations": [ "Department of Computer Science and Engineering, LNMIIT" ], "source_url": "https://arxiv.org/html/2610.33201v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33128": { "id": "2610.33128", "title": "Navigating Epistemic Parity in LLM Agents: A Benchmark for Cross-Source Conflict Resolution Between Memory and Procedural Skills", "classification": "relevant", "reason": "明确研究LLM Agent记忆与SKILL.md同级冲突，包括权限争议、工具调用及静默裁决，直接相关。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 101, "summary_zh": "问题：LLM Agent记忆与SKILL.md往往注入同一层级，却缺少冲突优先级，可能静默决定包括权限在内的重要事项。方法：构建事实、格式、流程、权限四类冲突的52场景，以工具载荷及输出结构程序评分，在三个开放模型上运行1,383次。作者称靠近任务的位置常更有优势；显式技能优先规则仍有3%至10%不遵从，98.8%有工具行动运行没有伴随文本，89%全部运行未披露矛盾。", "topics": { "tags": [ "memory", "authorization", "injection", "evaluation" ], "reason_zh": "明确研究LLM Agent记忆与SKILL.md同级冲突，包括权限争议、工具调用及静默裁决，直接相关。" }, "version_id": "2610.33128v1", "published": "2026-10-23T13:00:06Z", "updated": "2026-10-23T13:00:06Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.SE" ], "source_url": "https://arxiv.org/abs/2610.33128", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "c523454f956b6b4177333077f670cbd10c89025b3ab85ef007aa52dd70f5a05b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33128", "first_author": "Prakhar Pandey", "authors": [ "Prakhar Pandey" ], "affiliations": [ "Indian Institute of Technology Guwahati" ], "source_url": "https://arxiv.org/html/2610.33128v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33109": { "id": "2610.33109", "title": "Uncertainty Quantification for Financial Foundation Models: A Survey", "classification": "uncertain", "reason": "正文专节描述不确定性沿Agent工具/记忆/行动传播及拒答升级，但主体为广义金融基础模型UQ综述，安全贡献与普通预测可靠性边界不够明确。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "read_index": 103, "summary_zh": "问题：金融基础模型中的证据时效、解释、结果及行动风险不能都简化为最终答案置信度。方法：综述以六类不确定性来源及机制分类组织文献，将Agent工作流作为风险传播和缓解的执行层，映射到金融任务。作者发现连接证据/推理可靠性与下游预测、受约束行动的研究有限。摘要无实证比较数值，需正文核验其Agent安全专门覆盖程度。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "工作流风险传播、证据核验和拒答/升级与安全相邻，但金融预测UQ主体使范围仍待确认。" }, "needs_full_text_review": true, "initial_classification": "uncertain", "scope_review": { "id": "2610.33109", "title": "Uncertainty Quantification for Financial Foundation Models: A Survey", "previous_classification": "uncertain", "classification": "uncertain", "reason": "正文专节描述不确定性沿Agent工具/记忆/行动传播及拒答升级，但主体为广义金融基础模型UQ综述，安全贡献与普通预测可靠性边界不够明确。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1、§2.1–2.2、§3.1", "source_url": "https://arxiv.org/html/2610.33109", "evidence_notes": "将Agent工作流定义为连接证据、推理、结果和约束动作的执行层；讨论行动前无法消除的不确定性可通过拒答或升级限制后果，然而多数被综述方法是单组件而非Agent安全系统。", "unresolved": true, "review_question": "是否将以金融UQ为主、含明确Agent行动不确定性和升级讨论的综述纳入安全阅读范围？正文仍不足以确立专属Agent Safety贡献。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "工作流风险传播、证据核验和拒答/升级与安全相邻，但金融预测UQ主体使范围仍待确认。" } }, "version_id": "2610.33109v1", "published": "2026-10-22T21:17:25Z", "updated": "2026-10-22T21:17:25Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.LG", "q-fin.GN" ], "source_url": "https://arxiv.org/abs/2610.33109", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 200 of 200 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "2df4f27bd6b96991fc3c1113eb9befeeeacbd3c980dbd79960b6124f8aa51f73", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33109", "first_author": "Zijie Zhao", "authors": [ "Zijie Zhao", "Mingjun Sun", "Shenbo Xu" ], "affiliations": [ "Massachusetts Institute of Technology" ], "source_url": "https://arxiv.org/html/2610.33109v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.32971": { "id": "2610.32971", "title": "RobustRLlib: A Unified Library and Benchmark for Robust Reinforcement Learning Algorithms", "classification": "relevant", "reason": "鲁棒与安全RL基准明确覆盖VLA及人形任务和273扰动配置，包含具身Agent鲁棒安全评测。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 109, "summary_zh": "问题：部署RL/VLA策略在环境偏移和扰动下的鲁棒、安全边界难以比较。方法：RobustRLlib以统一接口整合十七种鲁棒在线、离线和安全RL算法，覆盖人形及视觉语言行动任务和273种扰动配置。作者报告形成能力图谱，揭示算法有效区域和仍存鲁棒性缺口；摘要未提供具体模型安全指标或改善数值。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "鲁棒与安全RL基准明确覆盖VLA及人形任务和273扰动配置，包含具身Agent鲁棒安全评测。" }, "version_id": "2610.32971v1", "published": "2026-10-23T17:57:22Z", "updated": "2026-10-23T17:57:22Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.AI", "cs.LG", "cs.RO" ], "source_url": "https://arxiv.org/abs/2610.32971", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "new", "section": "New submissions (showing 106 of 106 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-26", "category": "cs.LG", "kind": "recent", "section": null } ], "candidate_type": "unseen_id", "abstract_sha256": "9e50d3e5bcc1e9e4508646e85f9ee80df52a3e96128aefba234c7dd7911ebbdc", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "announcement_status": "官方公告列表已核对", "backfill_kind": "new_id_v1", "author": { "id": "2610.32971", "first_author": "Xi Chen", "authors": [ "Xi Chen", "Fengqi Hu", "Zeyu Shen", "Jiaying Xu", "Shangding Gu", "Pan Xu", "Anqi Liu", "Laixi Shi" ], "affiliations": [ "JHU" ], "source_url": "https://arxiv.org/pdf/2610.32971v1", "shared_first_authors": [], "shared_first_note": "PDF首页明确第二、第三作者Fengqi Hu、Zeyu Shen等贡献；第一作者Xi Chen不在该等贡献组，不标为共同一作。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页明确第二、第三作者Fengqi Hu、Zeyu Shen等贡献；第一作者Xi Chen不在该等贡献组，不标为共同一作。" }, "revision_history": [] }, "2609.31877": { "id": "2609.31877", "title": "A Large-Scale Benchmark and Risk Assessment of Traffic Analysis Attacks on Cloud LLM Services", "classification": "relevant", "reason": "被动加密流量分析可识别多Agent执行任务，直接涉及Agent隐私侧信道。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 156, "summary_zh": "问题：即使通信加密，旁观者仍可能从包大小、方向、时序和突发形态识别LLM与多Agent任务。方法：构建六万次用户-LLM交互及2,838次多Agent执行的统一流量基准，覆盖十模型、六提示类别、十Agent任务类别和两拓扑，检验改写、温度与部分流量等因素。作者称模型识别平衡准确率97.7%，提示类别平均准确率76.7%，多Agent任务识别最高90.7%，仅单Agent流量仍有任务指纹。", "topics": { "tags": [ "privacy", "multiagent", "evaluation" ], "reason_zh": "被动加密流量分析可识别多Agent执行任务，直接涉及Agent隐私侧信道。" }, "version_id": "2609.31877v2", "published": "2026-09-25T18:13:58Z", "updated": "2026-10-24T05:04:44Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR", "cs.LG" ], "source_url": "https://arxiv.org/abs/2609.31877", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 271 of 271 entries)", "category": "cs.LG", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "1444f090703a9ae11fb948a4913b2e6332bd50354d10ff694e12c5fe7f995edf", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2609.31877", "first_author": "Shahrooz Pouryousef", "authors": [ "Shahrooz Pouryousef", "Jesus Lopez", "Saeefa Rubaiyet Nowmi", "Md Mahmuduzzaman Kamol", "Moinul Hossain", "Muoi Tran", "Mohammad Saidur Rahman" ], "affiliations": [ "Chalmers University of Technology" ], "source_url": "https://arxiv.org/html/2609.31877v2", "shared_first_authors": [], "shared_first_note": "第一作者 Shahrooz Pouryousef 编号1，官方HTML署名单位1为Chalmers。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "第一作者 Shahrooz Pouryousef 编号1，官方HTML署名单位1为Chalmers。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2609.26131": { "id": "2609.26131", "title": "StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robots", "classification": "relevant", "reason": "VLM机器人规划器由足地接触状态触发后门，直接涉及具身Agent攻击面。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 157, "summary_zh": "问题：机器人VLM规划器的后门触发面不只语言、图像或历史动作，还可能是本体感觉及足地接触。方法：StepTrigger使用Unitree Go1经过稠密地形时的接触/压力模式作为触发，学习区分正常压力异常与投毒接触。作者在分层离线评估中报告清洁行为保持98.75%、误触发拒绝92.50%、真实触发激活76.25%、整体解析行为准确率89.17%。这些是离线指标，不等同完整实机攻击成功率。", "topics": { "tags": [ "embodied", "injection", "evaluation" ], "reason_zh": "VLM机器人规划器由足地接触状态触发后门，直接涉及具身Agent攻击面。" }, "version_id": "2609.26131v2", "published": "2026-08-07T04:58:35Z", "updated": "2026-10-24T21:00:11Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR", "cs.RO" ], "source_url": "https://arxiv.org/abs/2609.26131", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "a04350163119a6e7584389fcaad7575f4a96e08a08a22202e0587ac341939a1d", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2609.26131", "first_author": "Jiageng Zhang", "authors": [ "Jiageng Zhang", "Doniyorkhon Obidov", "Kaichen Yang" ], "affiliations": [ "Michigan Technological University" ], "source_url": "https://arxiv.org/html/2609.26131v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2609.23959": { "id": "2609.23959", "title": "Open-Jev Judgments on CallScreenBench: Calibrated One-Pass Scam Screening with a Small Language Model", "classification": "relevant", "reason": "正文定位在代表用户接听的电话代理中逐轮触发挂断/转接，并以LLM自动诈骗者为威胁背景；评测包含同一挂断规则下的决策时机和误挂，具备代理动作防御关联。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "read_index": 158, "summary_zh": "问题：代表用户接听的电话代理需要快速、可信的逐轮诈骗风险判断，同时避免误挂正常来电。方法：JevLite对Qwen3-4B做LoRA微调，从两个答案标签logit单次前向读出概率并校准，按相同挂断规则比较判断时机。作者称41个保留场景、577次逐轮决策中，三种子集成AUROC为0.974、校准误差0.052，正常来电无误报，平均提前1.14轮作出决策；单模型消费级GPU延迟64.5毫秒。正文强调全部来电合成且方案选择有测试集曝光，不能据此保证真实电话防骗。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "逐轮安全判断驱动受委托电话代理的挂断/转接动作，兼顾误报和判定时机。" }, "needs_full_text_review": true, "initial_classification": "uncertain", "scope_review": { "id": "2609.23959", "title": "Open-Jev Judgments on CallScreenBench: Calibrated One-Pass Scam Screening with a Small Language Model", "previous_classification": "uncertain", "classification": "relevant", "reason": "正文定位在代表用户接听的电话代理中逐轮触发挂断/转接，并以LLM自动诈骗者为威胁背景；评测包含同一挂断规则下的决策时机和误挂，具备代理动作防御关联。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1、§3 Streaming use、§4评估与局限", "source_url": "https://arxiv.org/html/2609.23959", "evidence_notes": "JevLite把每轮来电文本变成经校准的诈骗概率，驱动固定挂断规则；不是声称识别准确率即安全，作者承认合成来电、测试集曝光和灰区失败。", "unresolved": false, "summary_zh": "问题：代表用户接听的电话代理需要快速、可信的逐轮诈骗风险判断，同时避免误挂正常来电。方法：JevLite对Qwen3-4B做LoRA微调，从两个答案标签logit单次前向读出概率并校准，按相同挂断规则比较判断时机。作者称41个保留场景、577次逐轮决策中，三种子集成AUROC为0.974、校准误差0.052，正常来电无误报，平均提前1.14轮作出决策；单模型消费级GPU延迟64.5毫秒。正文强调全部来电合成且方案选择有测试集曝光，不能据此保证真实电话防骗。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "逐轮安全判断驱动受委托电话代理的挂断/转接动作，兼顾误报和判定时机。" } }, "version_id": "2609.23959v2", "published": "2026-09-21T00:09:24Z", "updated": "2026-10-24T21:10:53Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CL" ], "source_url": "https://arxiv.org/abs/2609.23959", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "a0f08b656251ad656e60859348c6a9074dcf3ddbfb2e8d2e9206a409ba8ef97d", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2609.23959", "first_author": "Simiao Ren", "authors": [ "Simiao Ren", "Kidus Zewde", "Xingyu Shen", "Yuchen Zhou", "Dennis Ng", "Ankit Raj", "Tommy Duong", "Yuxin Zhang", "Neo Tiangratanakul" ], "affiliations": [ "Scam.ai (Reality Inc.)" ], "source_url": "https://arxiv.org/html/2609.23959v2", "shared_first_authors": [], "shared_first_note": "首页HTML明确首作者Simiao Ren为通讯作者；Kidus Zewde、Xingyu Shen、Yuchen Zhou、Dennis Ng、Ankit Raj、Tommy Duong、Yuxin Zhang、Neo Tiangratanakul标星Equal contribution，原文未称其为共同第一作者，保留等贡献组说明。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页HTML明确首作者Simiao Ren为通讯作者；Kidus Zewde、Xingyu Shen、Yuchen Zhou、Dennis Ng、Ankit Raj、Tommy Duong、Yuxin Zhang、Neo Tiangratanakul标星Equal contribution，原文未称其为共同第一作者，保留等贡献组说明。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2609.20191": { "id": "2609.20191", "title": "VLN on the Fly: An Onboard Vision-Language Navigation Stack for Aerial Robots", "classification": "relevant", "reason": "VLM无人机模块化规划控制与感知门控保留安全检查，包含遮挡环境避碰实飞证据。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 159, "summary_zh": "问题：无人机上VLM导航的端到端单模块难以隔离错误并保留安全检查。方法：将视觉语言定位、深度转三维目标、B样条轨迹规划和RL跟踪分成可检查模块，在机载算力上执行并用感知门控处理拥挤环境。作者称受控室内十五次飞行中十三次到达目标、平均目标误差5.72厘米；另六次拥挤环境测试追踪无碰撞轨迹。实验规模有限，不代表开放环境安全保证。", "topics": { "tags": [ "embodied", "authorization", "monitoring" ], "reason_zh": "VLM无人机模块化规划控制与感知门控保留安全检查，包含遮挡环境避碰实飞证据。" }, "version_id": "2609.20191v2", "published": "2026-08-07T20:34:33Z", "updated": "2026-10-25T00:46:44Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CV", "cs.LG", "cs.RO", "eess.SY" ], "source_url": "https://arxiv.org/abs/2609.20191", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 271 of 271 entries)", "category": "cs.LG", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "a42a6ac1c60d8c52d27564c9847c661be906e303e6e286f992af72ca055a0ea2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2609.20191", "first_author": "Marco S. Tayar", "authors": [ "Marco S. Tayar", "Felipe Tommaselli", "Gianluca Capezzuto", "Pedro Antonio Rabelo Saraiva", "Pedro H. V. de Freitas", "Lucas Kido", "Guilherme Sonego", "Ricardo V. Godoy", "Marcelo Becker" ], "affiliations": [ "University of São Paulo (USP)" ], "source_url": "https://arxiv.org/pdf/2609.20191v2", "shared_first_authors": [ "Marco S. Tayar", "Felipe Tommaselli", "Gianluca Capezzuto", "Pedro Antonio Rabelo Saraiva" ], "shared_first_note": "PDF首页显示Marco S. Tayar亦有星号，连同Felipe Tommaselli、Gianluca Capezzuto、Pedro Antonio Rabelo Saraiva四人共同第一。", "shared_first_affiliations": { "Marco S. Tayar": [ "University of São Paulo (USP)" ], "Felipe Tommaselli": [ "University of São Paulo (USP)" ], "Gianluca Capezzuto": [ "University of São Paulo (USP)" ], "Pedro Antonio Rabelo Saraiva": [ "University of São Paulo (USP)" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页显示Marco S. Tayar亦有星号，连同Felipe Tommaselli、Gianluca Capezzuto、Pedro Antonio Rabelo Saraiva四人共同第一。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2609.01836": { "id": "2609.01836", "title": "Agent Memory Is a Surface for Endogenous Authorization Laundering", "classification": "relevant", "reason": "直接刻画Agent记忆错误保留/生成虚假权限并诱发越权行动，提出EAL-Bench量化安全效用权衡。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 163, "summary_zh": "问题：长期Agent记忆可因语义误读或更新失败保留虚假权限，使执行者把越权行动当作已授权，且不需要外部攻击。方法：提出内生授权洗白及EAL-Bench，以七个记忆写入模型、两个执行模型测试采购、网络安全和金融任务中的权限状态演化。作者称增量类型记忆更新下，最高45.4%的未授权请求被写成虚假授权；已有虚假权限时执行者在99.0%试验中执行。记忆护栏可缓解，但会拒绝合法行为。", "topics": { "tags": [ "memory", "authorization", "evaluation" ], "reason_zh": "直接刻画Agent记忆错误保留/生成虚假权限并诱发越权行动，提出EAL-Bench量化安全效用权衡。" }, "version_id": "2609.01836v2", "published": "2026-09-01T20:12:08Z", "updated": "2026-10-24T12:57:58Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR" ], "source_url": "https://arxiv.org/abs/2609.01836", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "4ed6557b79915ea59a994a3a0a6fa4cee53970931581764b08f38f184430652a", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2609.01836", "first_author": "Tommaso Cerruti", "authors": [ "Tommaso Cerruti", "Mika Okamoto", "Ansel Kaplan Erol" ], "affiliations": [ "ETH Zurich" ], "source_url": "https://arxiv.org/html/2609.01836v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2608.29528": { "id": "2608.29528", "title": "MedCache: Efficient and Temporally Valid Memory for Longitudinal Clinical Agents", "classification": "relevant", "reason": "正文明确研究长期临床Agent因过时/被取代的记忆、跨专科证据隔离和约束遗漏产生不安全建议的机制，并针对时间有效状态与协调给出系统评估。", "abstract_read": true, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "read_index": 164, "summary_zh": "问题：长期临床Agent若依赖已过时的用药/诊断记忆，或将相关证据分隔在不同专科，可能给出不安全建议。方法：LEMMA-Bench覆盖多次就诊、多专科的长上下文检索、跨时聚合和联合推理；MedCache维护时间有效的患者状态，以重叠专科视图存储和路由证据，并按需要调用一名或多名专家。作者称该方法提升推理准确率和记忆效率并可跨模型/数据集迁移；摘要未给具体统一效果量，正文评测不等于真实临床疗效或安全保证。", "topics": { "tags": [ "memory", "multiagent", "evaluation" ], "reason_zh": "直接针对长期Agent过时记忆、跨专科证据遗漏及约束冲突，安全关联来自正文问题定义。" }, "needs_full_text_review": true, "initial_classification": "uncertain", "scope_review": { "id": "2608.29528", "title": "MedCache: Efficient and Temporally Valid Memory for Longitudinal Clinical Agents", "previous_classification": "uncertain", "classification": "relevant", "reason": "正文明确研究长期临床Agent因过时/被取代的记忆、跨专科证据隔离和约束遗漏产生不安全建议的机制，并针对时间有效状态与协调给出系统评估。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "Introduction、Related Work、Benchmarking and Analyzing Longitudinal Medical Agent Memory Failures", "source_url": "https://arxiv.org/pdf/2608.29528", "evidence_notes": "记忆不只按语义相似检索，而要维护药物停启、病情变化和跨专科共享证据；研究对比时间有效性、存储组织、路由与单/多专家协调，但最终指标主要是推理准确率与效率。", "unresolved": false, "summary_zh": "问题：长期临床Agent若依赖已过时的用药/诊断记忆，或将相关证据分隔在不同专科，可能给出不安全建议。方法：LEMMA-Bench覆盖多次就诊、多专科的长上下文检索、跨时聚合和联合推理；MedCache维护时间有效的患者状态，以重叠专科视图存储和路由证据，并按需要调用一名或多名专家。作者称该方法提升推理准确率和记忆效率并可跨模型/数据集迁移；摘要未给具体统一效果量，正文评测不等于真实临床疗效或安全保证。", "topics": { "tags": [ "memory", "multiagent", "evaluation" ], "reason_zh": "直接针对长期Agent过时记忆、跨专科证据遗漏及约束冲突，安全关联来自正文问题定义。" } }, "version_id": "2608.29528v2", "published": "2026-08-30T03:28:56Z", "updated": "2026-10-24T05:13:55Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.DC", "cs.LG", "cs.MA" ], "source_url": "https://arxiv.org/abs/2608.29528", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 271 of 271 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "080375c3d75895dba8c5585b86a540cf78ef763d2da207293306810604beddab", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2608.29528", "first_author": "Hei Ting (Una) Chan", "authors": [ "Hei Ting Chan", "Chenwei Wu", "Xueshen Liu", "Boyuan Zheng", "Liyue Shen", "Jiasi Chen", "Z. Morley Mao" ], "affiliations": [ "University of Michigan" ], "source_url": "https://arxiv.org/pdf/2608.29528v2", "shared_first_authors": [ "Hei Ting (Una) Chan", "Chenwei Wu" ], "shared_first_note": "PDF首页Hei Ting (Una) Chan与Chenwei Wu共同第一，均署名University of Michigan。", "shared_first_affiliations": { "Hei Ting (Una) Chan": [ "University of Michigan" ], "Chenwei Wu": [ "University of Michigan" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页Hei Ting (Una) Chan与Chenwei Wu共同第一，均署名University of Michigan。", "metadata_first_author": "Hei Ting Chan", "name_mapping_note": "官方PDF首页署名包含别名 Una，API省略；采用论文首页完整署名。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2608.01033": { "id": "2608.01033", "title": "CallScreenBench: Benchmarking Small Language Models as Phone Secretaries", "classification": "relevant", "reason": "代表用户应对潜在恶意来电的电话Agent安全基准，区分服务质量、警惕性、误报和退化策略。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 169, "summary_zh": "问题：代表用户接未知来电的Agent面对可能对抗的来电者，不能仅按完成对方任务衡量。方法：CallScreenBench以文本决策层测五类服务与记录指标，配对反指标和不确定性，并为无凭据无工具代理设置三类警惕诊断，对三模型家族的成对4-bit模型和脚本退化策略评测。作者发现只看诈骗检出会奖励无差别怀疑，加入合法误报后排序变化，挂断复述策略可获实体召回1.0，故不提供单一总分。", "topics": { "tags": [ "authorization", "privacy", "evaluation" ], "reason_zh": "代表用户应对潜在恶意来电的电话Agent安全基准，区分服务质量、警惕性、误报和退化策略。" }, "version_id": "2608.01033v3", "published": "2026-08-02T06:31:25Z", "updated": "2026-10-24T20:53:19Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR" ], "source_url": "https://arxiv.org/abs/2608.01033", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "274b9f361cd44eaa2abb07d94042af10994e7bae598f754475d83c8da58f5dfd", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2608.01033", "first_author": "Jiaqi Gan", "authors": [ "Jiaqi Gan", "Haoyuan Tang", "Jamey Z. Liang", "Siying Chen", "Ankit Raj", "Kidus Zewde", "Yuchen Zhou", "Yuxin Zhang", "Simiao Ren" ], "affiliations": [ "Scam.ai" ], "source_url": "https://arxiv.org/pdf/2608.01033v3", "shared_first_authors": [ "Jiaqi Gan", "Haoyuan Tang", "Jamey Z. Liang" ], "shared_first_note": "PDF首页明确前三位Jiaqi Gan、Haoyuan Tang、Jamey Z. Liang为共同第一。", "shared_first_affiliations": { "Jiaqi Gan": [ "Scam.ai" ], "Haoyuan Tang": [ "Scam.ai" ], "Jamey Z. Liang": [ "Scam.ai" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页明确前三位Jiaqi Gan、Haoyuan Tang、Jamey Z. Liang为共同第一。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2607.26300": { "id": "2607.26300", "title": "AgentGUI: An Interface for Observing and Steering Long-Running AI Agents", "classification": "relevant", "reason": "长期多会话Agent的人类观察和引导界面，包含轨迹审查与自动漂移防止，直接涉及监督。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 170, "summary_zh": "问题：长期、多并发自主Agent能力增长快于人类监督界面。方法：AgentGUI提供本地轨迹可视化、人工与自动引导及跨框架协调，支持运行期间观察和干预。作者称受控用户实验识别轨迹关键元素快38%，p=0.023；初步漂移防止实验在0.8B至9B模型梯度上任务完成率最高增加34个百分点，每模型50次。前者是监督效率，后者是小规模初步任务效果。", "topics": { "tags": [ "monitoring", "multiagent", "robustness" ], "reason_zh": "长期多会话Agent的人类观察和引导界面，包含轨迹审查与自动漂移防止，直接涉及监督。" }, "version_id": "2607.26300v3", "published": "2026-07-28T21:47:22Z", "updated": "2026-10-23T16:32:34Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.AI", "cs.CL", "cs.HC" ], "source_url": "https://arxiv.org/abs/2607.26300", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Replacement submissions (showing 132 of 132 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Replacement submissions (showing 63 of 63 entries)" } ], "candidate_type": "unseen_id", "abstract_sha256": "4acd560354e9a7967e29761f3a008c822d965b32ae3072ba22482958f2ff274e", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "announcement_status": "官方公告列表已核对", "backfill_kind": "historical_revision_backfill", "author": { "id": "2607.26300", "first_author": "Xuan Zhao", "authors": [ "Xuan Zhao", "Jiwoong Sohn", "Qinyue Zheng", "Michael Moor" ], "affiliations": [ "ETH Zürich" ], "source_url": "https://arxiv.org/html/2607.26300v3", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [] }, "2606.21037": { "id": "2606.21037", "title": "Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers", "classification": "relevant", "reason": "衡量LLM攻击者识破诱饵却仍行动的识别-行动脱节，直接针对自主AI攻击者和防御评测。", "abstract_read": true, "full_text_checked": false, "evidence_level": "full_abstract_only", "read_index": 175, "summary_zh": "问题：针对人类攻击者建立的网络诱骗结论是否适用于自主LLM攻击者，尤其能识破陷阱是否就会避开。方法：将Honeyquest自动化，使用二十一个LLM、10,962个回答与四十七名人类在同样174个侦察问题上比较。作者称所有模型比人类更常中诱饵，未观察到人类常见的注意转移防御效应；即使推理文字识别陷阱，73.4%的时候仍选择利用诱饵，识别与中招行为的跨模型相关不显著。该结果直接区分风险描述与实际选择。", "topics": { "tags": [ "evaluation", "monitoring", "authorization" ], "reason_zh": "衡量LLM攻击者识破诱饵却仍行动的识别-行动脱节，直接针对自主AI攻击者和防御评测。" }, "version_id": "2606.21037v3", "published": "2026-06-19T02:01:50Z", "updated": "2026-10-23T15:10:14Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.CL", "cs.CR" ], "source_url": "https://arxiv.org/abs/2606.21037", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CR", "kind": "new", "section": "Replacement submissions (showing 19 of 19 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Replacement submissions (showing 63 of 63 entries)" } ], "candidate_type": "unseen_id", "abstract_sha256": "5ed7abc6799e24425047ea5ad04bb3f12bfe7e7f36291301f9da558ea6df9f76", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "announcement_status": "官方公告列表已核对", "backfill_kind": "historical_revision_backfill", "author": { "id": "2606.21037", "first_author": "Kerri Prinos", "authors": [ "Kerri Prinos", "Lilianne Brush", "Cameron Denton" ], "affiliations": [ "Horizon3.ai" ], "source_url": "https://arxiv.org/html/2606.21037v3", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [] }, "2610.33962": { "id": "2610.33962", "title": "Beyond Belief: Evaluating and Mitigating LLM Susceptibility to Misinformation", "classification": "relevant", "reason": "直接测试工具型LLM对虚假通知的可信度判断与有害执行差距，并评估防护和合法任务效用。", "abstract_read": true, "evidence_level": "full_abstract_and_targeted_body", "full_text_checked": true, "summary_zh": "问题：工具型LLM口头识别虚假信息是否意味着会拒绝有害行动。方法：五个模型测试196条合成虚假通知及合法配对、204个历史攻击改编工具场景，对比先评级与直接执行、预警及微调。作者称模型已判不可信的案例仍有27%–99%发出有害工具调用；移除评级平均再增加15个百分点。预警改善四个模型但可能损害合法任务，生成式预防示例未稳定胜过简单预警，微调效果依模型和协议而异。 正文核验：可信度是外显评级而非内部信念；调用仅在模拟工具中判定、每条件一次采样，未检验长程/自适应攻击。", "topics": { "tags": [ "injection", "evaluation", "monitoring", "authorization" ], "reason_zh": "外部虚假信息诱导工具执行，比较可信度判断、有害行为和正常效用。" }, "body_sections_checked": [ "首页", "Introduction", "3.3", "6.2", "6.3", "Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.33962", "version_id": "2610.33962v1", "published": "2026-10-25T00:26:14Z", "updated": "2026-10-25T00:26:14Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL" ], "source_url": "https://arxiv.org/abs/2610.33962", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "6c60c7a9904c318ee87b4b1b4b26c06c9b9ca14cd54f5016530af4fcc0a643e7", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33962", "first_author": "Emran Kanaan", "authors": [ "Emran Kanaan", "Jiho Lee", "Ibrahim Odat", "Soroush Vosoughi", "Weicheng Ma" ], "affiliations": [ "Oakland University" ], "source_url": "https://arxiv.org/pdf/2610.33962v1", "shared_first_authors": [ "Emran Kanaan", "Jiho Lee" ], "shared_first_note": "首页星号脚注 Equal contribution；Emran Kanaan 与 Jiho Lee 共同第一，分别属 Oakland University 与 Dartmouth College。", "shared_first_affiliations": { "Emran Kanaan": [ "Oakland University" ], "Jiho Lee": [ "Dartmouth College" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页星号脚注 Equal contribution；Emran Kanaan 与 Jiho Lee 共同第一，分别属 Oakland University 与 Dartmouth College。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33853": { "id": "2610.33853", "title": "ArchGuard-APR: Architecture-Constraint-Aware Multi-Agent Program Repair Using Repository Graphs and Execution Feedback", "classification": "relevant", "reason": "编码Agent修复中显式限制仓库依赖边界、危险路径并隔离执行，直接对应代码Agent约束与验证。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：代码修复可能通过局部测试却违反依赖边界或修改不安全路径。方法：ArchGuard-APR集成不可变仓库图、架构配置、角色化修复、补丁策略及隔离执行反馈。作者报告探索性可行性研究计划六次、完成四次，两个有效配对任务中基线与系统均0/2成功，全部输出为无效补丁；没有效果优势或可推断效能，仅证明管线组件可组合，并指出补丁有效性和基础设施稳定性问题。", "topics": { "tags": [ "supplychain", "authorization", "evaluation" ], "reason_zh": "编码修复的仓库架构约束、补丁策略与隔离执行验证。" }, "version_id": "2610.33853v1", "published": "2026-10-24T18:48:32Z", "updated": "2026-10-24T18:48:32Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.SE" ], "source_url": "https://arxiv.org/abs/2610.33853", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "43a0974c4ca9a62c1e2bfb8baa11d74c9a9987583f07f855475679c4ec2fa821", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33853", "first_author": "Majid Feiz Deilami", "authors": [ "Majid Feiz Deilami" ], "affiliations": [ "Department of Computer Engineering, Lahijan Branch, Islamic Azad University" ], "source_url": "https://arxiv.org/pdf/2610.33853v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33568": { "id": "2610.33568", "title": "Trajectory2Gym: Decision-Grounded Compositional Interaction Synthesis for Tool-Use Agents", "classification": "relevant", "reason": "正文把真实可见证据、工具可用性及用户最新确认作为行动监督资格条件，明确排除能执行但未获支持的工具动作，直接关联Agent权限/依据约束。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "summary_zh": "问题：工具轨迹最终成功不保证每个动作都依据Agent当时可见的信息或用户最新确认。方法：Trajectory2Gym围绕欠覆盖的多步依赖构造可执行交互，仅选择可见历史支持的动作作为监督目标，并按交互结构分配和归一化训练权重。作者称五个Qwen3规模在Tau1、Tau2、BFCL上均有提升，三基准等权均值增加16.9–29.8个百分点。正文以未确认的额外换货说明可执行性不等于动作有依据；主要报告仍是任务基准成绩，不是普遍授权安全保证。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "将用户确认、工具可用性和可见证据用于过滤动作监督，区分执行成功与行动合法依据。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.33568", "title": "Trajectory2Gym: Decision-Grounded Compositional Interaction Synthesis for Tool-Use Agents", "previous_classification": "uncertain", "classification": "relevant", "reason": "正文把真实可见证据、工具可用性及用户最新确认作为行动监督资格条件，明确排除能执行但未获支持的工具动作，直接关联Agent权限/依据约束。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1图1、§3、§4.1–4.2", "source_url": "https://arxiv.org/pdf/2610.33568", "evidence_notes": "图1以用户只确认灯具换货为例，API仍接受额外水瓶换货，但训练目标过滤应拒绝该过时动作；§4.2把执行有效性与决策时可见依据分开，私有收集器信息不得充当代理证据。", "unresolved": false, "summary_zh": "问题：工具轨迹最终成功不保证每个动作都依据Agent当时可见的信息或用户最新确认。方法：Trajectory2Gym围绕欠覆盖的多步依赖构造可执行交互，仅选择可见历史支持的动作作为监督目标，并按交互结构分配和归一化训练权重。作者称五个Qwen3规模在Tau1、Tau2、BFCL上均有提升，三基准等权均值增加16.9–29.8个百分点。正文以未确认的额外换货说明可执行性不等于动作有依据；主要报告仍是任务基准成绩，不是普遍授权安全保证。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "将用户确认、工具可用性和可见证据用于过滤动作监督，区分执行成功与行动合法依据。" } }, "version_id": "2610.33568v1", "published": "2026-10-24T09:38:02Z", "updated": "2026-10-24T09:38:02Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CL" ], "source_url": "https://arxiv.org/abs/2610.33568", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "c35b805f3d8fd2a4f2933dd27a8f7cb36d7d0f24c6c7112e2cbc6b4180db963b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33568", "first_author": "Yihao Hu", "authors": [ "Yihao Hu", "Zhihao Wen", "Yitong Lin", "Siyuan Lu", "Pan Wang", "Wei Wu", "Jiang-Ming Yang", "Tao Lin" ], "affiliations": [ "Westlake University", "Ant International" ], "source_url": "https://arxiv.org/pdf/2610.33568v1", "shared_first_authors": [ "Yihao Hu", "Zhihao Wen" ], "shared_first_note": "PDF首页Yihao Hu1,2与Zhihao Wen2共同第一，第一作者双单位。", "shared_first_affiliations": { "Yihao Hu": [ "Westlake University", "Ant International" ], "Zhihao Wen": [ "Ant International" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页Yihao Hu1,2与Zhihao Wen2共同第一，第一作者双单位。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33536": { "id": "2610.33536", "title": "FraudSociety: A Generative Agent-Based Society for the Financial-Fraud Economy", "classification": "relevant", "reason": "正文为有持续记忆、自然语言交互及支付动作的LLM欺诈者/平民多Agent环境，并量化反欺诈干预，构成恶意Agent行为与防御评测。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "summary_zh": "问题：金融诈骗的说服互动与支付历史相互影响，单独模拟信息或交易难以评估累积伤害。方法：FraudSociety用LLM多Agent连接动态社交网络、持续金融账本和需求—意图—行动循环，欺诈者根据交互历史调整行为，并比较反欺诈干预。作者称模拟中受损记录最高10%贡献81.1%总损失，最佳个性化干预把重复支付率从49.4%降至10.9%。这些是模拟结果，非真实用户反诈骗效果。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "对自主欺诈Agent与受害者Agent交互及反欺诈干预做闭环评估，关注恶意代理造成的累积伤害。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.33536", "title": "FraudSociety: A Generative Agent-Based Society for the Financial-Fraud Economy", "previous_classification": "uncertain", "classification": "relevant", "reason": "正文为有持续记忆、自然语言交互及支付动作的LLM欺诈者/平民多Agent环境，并量化反欺诈干预，构成恶意Agent行为与防御评测。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1–3架构与研究问题", "source_url": "https://arxiv.org/pdf/2610.33536", "evidence_notes": "欺诈者根据受害者历史和账本状态适应沟通及金融动作；环境执行和回写状态，用于比较反欺诈警告。所有损失和干预结果来自模拟，不能视为真实人群试验。", "unresolved": false, "summary_zh": "问题：金融诈骗的说服互动与支付历史相互影响，单独模拟信息或交易难以评估累积伤害。方法：FraudSociety用LLM多Agent连接动态社交网络、持续金融账本和需求—意图—行动循环，欺诈者根据交互历史调整行为，并比较反欺诈干预。作者称模拟中受损记录最高10%贡献81.1%总损失，最佳个性化干预把重复支付率从49.4%降至10.9%。这些是模拟结果，非真实用户反诈骗效果。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "对自主欺诈Agent与受害者Agent交互及反欺诈干预做闭环评估，关注恶意代理造成的累积伤害。" } }, "version_id": "2610.33536v1", "published": "2026-10-24T08:26:22Z", "updated": "2026-10-24T08:26:22Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CY" ], "source_url": "https://arxiv.org/abs/2610.33536", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "5e32c8692716b8660955e4b29e86f000060924783bbae664dbdb4fb0550cc3bf", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33536", "first_author": "Keyang Chen", "authors": [ "Keyang Chen", "Mingxuan Jiang", "Zeping Li", "Yiwen Zhao", "Yifan Wang", "Qiuyang Zhang", "Shuaicheng Qi", "Yicun Liu", "Zhixin Li", "Sen Liu", "Yinan Jing", "Guangnan Ye", "Hongfeng Chai" ], "affiliations": [ "Fudan University" ], "source_url": "https://arxiv.org/pdf/2610.33536v1", "shared_first_authors": [ "Keyang Chen", "Mingxuan Jiang" ], "shared_first_note": "PDF首页† Equal contribution明确Keyang Chen、Mingxuan Jiang共同第一。", "shared_first_affiliations": { "Keyang Chen": [ "Fudan University" ], "Mingxuan Jiang": [ "Fudan University" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页† Equal contribution明确Keyang Chen、Mingxuan Jiang共同第一。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33450": { "id": "2610.33450", "title": "Secure and Functional Code Generation with Self-Evaluation", "classification": "relevant", "reason": "代码生成代理通过CWE检索及功能/安全执行反馈修复，评估功能与安全联合成功并比较Claude Code。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：安全提示或检索可能删掉必要功能，功能正确也不保证代码安全。方法：SecGent按任务检索CWE文字安全知识，执行互补功能与安全测试并以反馈修复。作者在五语言CWEval、四开源模型及Sonnet上称联合成功指标领先四类推理基线；开源模型平均FS@1比RAG高15.5%，Sonnet达到92.1%，独立比较比安全提示Claude Code高逾6%，反馈最高再增6.7%。结果限该基准，不等于现实漏洞清零。", "topics": { "tags": [ "supplychain", "evaluation", "robustness" ], "reason_zh": "Coding Agent代码产物安全及功能联合验证和反馈修复。" }, "version_id": "2610.33450v1", "published": "2026-10-24T05:02:28Z", "updated": "2026-10-24T05:02:28Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR", "cs.MA", "cs.SE" ], "source_url": "https://arxiv.org/abs/2610.33450", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "31251a206f2f661bd76c5c05618ded3e0720f4c5789a5d2cd75d853aabd1fb83", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33450", "first_author": "Md Afif Al Mamun", "authors": [ "Md Afif Al Mamun", "Gias Uddin" ], "affiliations": [ "University of Calgary" ], "source_url": "https://arxiv.org/pdf/2610.33450v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33350": { "id": "2610.33350", "title": "EVM-Anchored Provenance for AI-Assisted Code Evolution: A Smoke-Scale Deployment Report", "classification": "relevant", "reason": "MCP辅助代码状态溯源及不可抵赖边界，直接分析AI代码演化证据不能证明真实性的供应链限制。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：AI辅助代码演化需要可重放状态溯源，但上链不自动证明代码真实。方法：MCP状态管理服务器连接EVM承诺事件、IPFS载荷与可重建SQLite索引，并区分存在性、顺序、提交者不双言与真实性。作者仅报告单次合成工作负载描述统计，模拟提交中位103282 gas、create延迟中位539.8ms；链上14事件。无基线优势结论，收据消费和奖励用例仍是未实现展望。", "topics": { "tags": [ "supplychain", "monitoring" ], "reason_zh": "MCP代码状态证据链的来源/完整性和真实性边界。" }, "version_id": "2610.33350v1", "published": "2026-10-23T22:39:16Z", "updated": "2026-10-23T22:39:16Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.SE" ], "source_url": "https://arxiv.org/abs/2610.33350", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "391238a08af6bfbc7462e1416a6ebcff4c28eb26e31163f277e1f950f22edf2c", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33350", "first_author": "Einar César Santos", "authors": [ "Einar César Santos" ], "affiliations": [ "Universidade Federal de Catalão" ], "source_url": "https://arxiv.org/html/2610.33350v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33234": { "id": "2610.33234", "title": "Alignment of Autonomous Cyber Defense Agents via Adaptive Policy Shaping", "classification": "relevant", "reason": "自主网络防御Agent测试时对齐CIA目标，限制防御动作损害可用性等运营安全。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：自主网络防御可能改善安全却损害服务可用性或其他运营目标。方法：对预训练RL防御策略进行测试时属性驱动策略调整，并随攻击中目标变化自适应权衡。作者在CybORG仿真中报告对齐改善且保持核心防御性能，摘要未给出数值；不需要重新训练，但结果限模拟环境。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "自主网络防御Agent动作与机密性、完整性、可用性目标对齐。" }, "version_id": "2610.33234v1", "published": "2026-10-23T19:36:49Z", "updated": "2026-10-23T19:36:49Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR" ], "source_url": "https://arxiv.org/abs/2610.33234", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "4b00f1d4f4cb23dee18cf5702542a7d1de122d34ca2d86baf80f0e79394468ba", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33234", "first_author": "Dena Mujtaba", "authors": [ "Dena Mujtaba", "Bharadwaj Ravichandran", "Brian Hu", "Arslan Basharat" ], "affiliations": [ "Kitware" ], "source_url": "https://arxiv.org/html/2610.33234v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33182": { "id": "2610.33182", "title": "Spoofing the Toolbox: Optimizing Tool Descriptions to Deceive LLM Agents", "classification": "relevant", "reason": "直接攻击LLM-Agent工具选择，优化恶意工具描述并评测工具恶意检测器规避。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：Agent依据工具描述选择工具，恶意描述可伪装成合法工具。方法：TSA通过替代Agent反馈和对比上下文学习迭代优化描述。作者称单工具/多工具基准最高攻击成功率92.13%，优于四个对照，人类研究也难分辨恶意与正常描述；对五种工具恶意检测器仍有效。摘要未给出各检测器分项数值或现实部署保证。", "topics": { "tags": [ "injection", "supplychain", "authorization", "evaluation" ], "reason_zh": "恶意工具描述优化欺骗工具选择，并检验安全检测规避。" }, "version_id": "2610.33182v1", "published": "2026-10-23T18:25:37Z", "updated": "2026-10-23T18:25:37Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR" ], "source_url": "https://arxiv.org/abs/2610.33182", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "de3159f545ab02b12e684254319592a79a430832163859c06da5826a9772f1c0", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33182", "first_author": "Shih-Chieh Dai", "authors": [ "Shih-Chieh Dai", "Xinyu Sun", "Guanhong Tao" ], "affiliations": [ "Kahlert School of Computing, University of Utah" ], "source_url": "https://arxiv.org/pdf/2610.33182v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33108": { "id": "2610.33108", "title": "ToolContractGate: Versioned Trusted Contracts for Drift-Safe Agent Tool Invocation", "classification": "relevant", "reason": "以版本化可信工具合同检查Agent调用的来源/模式/行为漂移，直接面向运行时权限和供应链。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：工具获批和输入验证不能确保调用仍对应原批准的源工件。方法：ToolContractGate将OpenAPI指纹与访问/模式/行为声明组成版本合同，执行十项确定性检查并提供阻断、复核、告警及影子模式。作者在45个合成案例中识别35个不安全案例，其中29阻断、3复核、3告警，10正常案例无误阻；均值门控延迟0.18ms，测量分辨率为整数毫秒。真正拦截仍依赖宿主执行决定，生产流量和语义后端漂移未验证。", "topics": { "tags": [ "authorization", "supplychain", "monitoring" ], "reason_zh": "可信合同把调用绑定到工具来源、版本及运行时行为声明。" }, "version_id": "2610.33108v1", "published": "2026-10-22T19:01:06Z", "updated": "2026-10-22T19:01:06Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR", "cs.SE" ], "source_url": "https://arxiv.org/abs/2610.33108", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "b653b4f0c73d82ea0534300b8960077d230f953972da68f826ba5295fe2d9527", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33108", "first_author": "Sachin Gupta", "authors": [ "Sachin Gupta" ], "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2610.33108v1", "shared_first_authors": [], "shared_first_note": "论文明确署名 Independent Researcher，无大学或公司单位。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文明确署名 Independent Researcher，无大学或公司单位。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.32755": { "id": "2610.32755", "title": "Semantic Representation for Agentic Self-Play in Automated Laboratories", "classification": "relevant", "reason": "自主实验室Agent的语义数字孪生、安全执行、协议错误检测及中途恢复，直接连接行动安全。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：高层实验设计到湿实验执行之间存在未建模物理变化及操作错误。方法：VERID语义数字孪生提供可查询状态、时间压缩模拟、完整轨迹及安全执行框架。作者用三组水/染料案例展示预先发现协议关键错误、运行中恢复和事后定位物理失败；摘要无量化成功率，不应外推真实生化危险场景。", "topics": { "tags": [ "embodied", "monitoring", "robustness" ], "reason_zh": "实验室Agent动作预验证、安全执行、持久轨迹与错误恢复。" }, "version_id": "2610.32755v1", "published": "2026-10-23T15:00:16Z", "updated": "2026-10-23T15:00:16Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.AI", "cs.RO" ], "source_url": "https://arxiv.org/abs/2610.32755", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "new", "section": "Cross submissions (showing 110 of 110 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.AI", "kind": "recent", "section": null } ], "candidate_type": "unseen_id", "abstract_sha256": "e4fdefbd603a6bde2f2d6d2c0638b1d9b5a406c447db00c518f0d1549179dec1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "announcement_status": "官方公告列表已核对", "backfill_kind": "new_id_v1", "author": { "id": "2610.32755", "first_author": "Yves Delley", "authors": [ "Yves Delley", "John Coller", "Zachary Cutts", "Alexander Daryin", "Mathias Bellaiche", "Jun W. Kim", "Oscar Donosa", "Srinidhi B. Seshadri", "Tanner Clary", "Sandy Klemm", "Avinatan Hassidim", "Yossi Matias", "Pooja Rao", "Petar Sirkovic", "Annalisa Pawlosky" ], "affiliations": [ "Google Research" ], "source_url": "https://arxiv.org/pdf/2610.32755v1", "shared_first_authors": [], "shared_first_note": "首页编号1为Google Research；‡是共同资深作者，非共同一作。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页编号1为Google Research；‡是共同资深作者，非共同一作。" }, "revision_history": [] }, "2610.32726": { "id": "2610.32726", "title": "The Butterfly Defects: Tracing Cooperation in LLM Agent Networks", "classification": "relevant", "reason": "LLM多Agent网络中的背叛传播、语言扰动和群体合作失稳，关系多Agent涌现风险。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：单Agent与同型伙伴合作不保证异构群体稳定合作。方法：在迭代囚徒困境的同构/异构开源LLM网络中改变不确定性线索和动作标签顺序。作者称合作会因模型组合和微小语言变化转向背叛，影响可传播至多跳未暴露Agent；摘要未提供统一数值指标，结论限此战略博弈设置。", "topics": { "tags": [ "multiagent", "robustness", "evaluation" ], "reason_zh": "多Agent合作/背叛对语言扰动敏感，局部扰动会波及远处Agent。" }, "version_id": "2610.32726v1", "published": "2026-10-23T14:46:57Z", "updated": "2026-10-23T14:46:57Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.CL", "physics.soc-ph" ], "source_url": "https://arxiv.org/abs/2610.32726", "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "new", "section": "Cross submissions (showing 34 of 34 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.CL", "kind": "recent", "section": null } ], "candidate_type": "unseen_id", "abstract_sha256": "dc0bd4401daa352ada0e03a545f0b0085e7a630c1aa68395dcf297923e5b1719", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "announcement_status": "官方公告列表已核对", "backfill_kind": "new_id_v1", "author": { "id": "2610.32726", "first_author": "Maria Sampani", "authors": [ "Maria Sampani", "Maria Lymperaiou", "Angeliki Dimitriou", "Giorgos Filandrianos", "Chrysoula Zerva", "Giorgos Stamou" ], "affiliations": [ "National Technical University of Athens" ], "source_url": "https://arxiv.org/html/2610.32726v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [] }, "2610.27205": { "id": "2610.27205", "title": "LoWAgent: A Low-Resource Multilingual Benchmark for Web Agents", "classification": "relevant", "reason": "网页Agent在真实界面干扰与低资源语言下的鲁棒性退化评测，可作为Agent可用性边界证据。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：英语网页基准掩盖低资源语言和实际界面干扰的性能退化。方法：LoWAgent将六网站本地化成五语言共3000任务，比较三闭源五开源模型，并加入cookie通知与广告弹窗。作者称所有模型低资源语言性能下降、开源降幅更大，界面扰动再降低表现，小规模轨迹后训练可改善。摘要未提供安全攻击成功率；本条属于鲁棒性而非提示注入防御。", "topics": { "tags": [ "robustness", "evaluation" ], "reason_zh": "网页Agent多语言和弹窗干扰下可用性失效基准。" }, "version_id": "2610.27205v2", "published": "2026-10-19T19:40:15Z", "updated": "2026-10-24T03:47:17Z", "announcement_date": "2026-10-21", "categories_seen": [ "cs.AI", "cs.CL" ], "source_url": "https://arxiv.org/abs/2610.27205", "provenance": [ { "announcement_date": "2026-10-21", "category": "cs.AI", "kind": "recent", "section": null }, { "announcement_date": "2026-10-21", "category": "cs.CL", "kind": "recent", "section": null } ], "candidate_type": "changed_version", "abstract_sha256": "15531788fe6a9dab5a008ffc1d660fc2680bcf132215f1ce874ab36af9bb9a7a", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "version_history": [ { "id": "2610.27205", "version_id": "2610.27205v1", "classification": "irrelevant", "announcement_date": "Wed, 21 Oct 2026", "published": "2026-10-19T19:40:15Z", "updated": "2026-10-19T19:40:15Z", "reason": "网页Agent低资源语言及弹窗干扰鲁棒性，非恶意注入或权限威胁" } ], "announcement_status": "官方公告列表已核对", "backfill_kind": "known_id_revision", "author": { "id": "2610.27205", "first_author": "Ocean Monjur", "authors": [ "Ocean Monjur", "Daud Ahmad Nisar", "Shahriar Kabir Nahin", "Tadesse Destaw Belay", "Sushruti Mishra", "Israel Abebe Azime", "Anshuman Chhabra" ], "affiliations": [ "University of South Florida" ], "source_url": "https://arxiv.org/html/2610.27205v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "first_seen_date": "2026-10-27", "revision_history": [] }, "2609.23953": { "id": "2609.23953", "title": "Agents That Edit Documents: Measuring Agentic PDF Forgery Against a Non-Agentic Control", "classification": "relevant", "reason": "编码Agent自主修改金融PDF伪造基准，同时测量危险任务拒绝、工具滥用和错报完成。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：自主编程Agent是否降低伪造文件门槛，简单通过率是否夸大威胁。方法：AgentForge-Bench以七开源模型驱动现成Coding Agent修改真实金融PDF，使用规则验证并与确定性脚本比较。作者称1750实验格中81.1%通过基础验证，46.2%同时满足严格可见性、局部性、字体及原值消失标准；Agent覆盖124/125文档、脚本98/125，错误编辑有41%错报完成，测试模型没有拒绝。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "编码Agent工具滥用进行文档伪造，并量化错报任务完成。" }, "version_id": "2609.23953v2", "published": "2026-09-20T23:54:38Z", "updated": "2026-10-24T21:14:05Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR" ], "source_url": "https://arxiv.org/abs/2609.23953", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "50c2207d318f9638d534da5235603eb051bff9fd3c97a95d55fd9836c1198bdb", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2609.23953", "first_author": "Simiao Ren", "authors": [ "Simiao Ren", "Ankit Raj", "Tommy Duong", "Yuxin Zhang", "Dennis Ng", "Xingyu Shen", "Kidus Zewde", "Yuchen Zhou", "Neo Tiangratanakul" ], "affiliations": [ "Scam.ai (Reality Inc.)" ], "source_url": "https://arxiv.org/pdf/2609.23953v2", "shared_first_authors": [], "shared_first_note": "PDF首页确认Simiao Ren为通讯作者；Ankit Raj、Tommy Duong、Yuxin Zhang、Dennis Ng、Xingyu Shen、Kidus Zewde、Yuchen Zhou、Neo Tiangratanakul为等贡献组，第一作者不在该星号组，不标为共同一作。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页确认Simiao Ren为通讯作者；Ankit Raj、Tommy Duong、Yuxin Zhang、Dennis Ng、Xingyu Shen、Kidus Zewde、Yuchen Zhou、Neo Tiangratanakul为等贡献组，第一作者不在该星号组，不标为共同一作。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2607.20764": { "id": "2607.20764", "title": "ArbiGraph: Arbitrarily Scalable Verifiable Task Graphs for Evaluating Context Management", "classification": "relevant", "reason": "工具Agent长程上下文保留/更新/丢弃及干扰因素的可验证可靠性评测，涉及记忆与上下文失效。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：孤立任务成绩不能反映长程依赖中的上下文失效。方法：ArbiGraph把带可执行Python解的自然语言任务通过类型化中间状态组合，控制长度、图拓扑、干扰数量和值类型并精确验证。作者测试Qwen3.5-27B工具Agent，依赖分支数学任务最高下降33.3%；仅一模型的该项结果，非直接安全攻击基准。", "topics": { "tags": [ "memory", "robustness", "evaluation" ], "reason_zh": "长程工具Agent上下文保留、更新与干扰承受能力的可执行测试。" }, "version_id": "2607.20764v2", "published": "2026-07-22T22:30:12Z", "updated": "2026-10-24T08:19:20Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2607.20764", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "718c8be47c112b7a56b28a0c62a7dce6850cc520ab6757fc06c0affcec2e6f27", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2607.20764", "first_author": "Pavel Golikov", "authors": [ "Pavel Golikov", "Evgenii Opryshko", "Gennady Pekhimenko", "Mark C. Jeffrey" ], "affiliations": [ "University of Toronto", "Vector Institute" ], "source_url": "https://arxiv.org/html/2607.20764v2", "shared_first_authors": [], "shared_first_note": "首位Pavel Golikov署名1、2，分别Toronto及Vector。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首位Pavel Golikov署名1、2，分别Toronto及Vector。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2606.00497": { "id": "2606.00497", "title": "\"I Strongly Suspect This Website Is a Scam\": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents", "classification": "relevant", "reason": "直接量化自主网页Agent的PII泄漏及口头诈骗怀疑与实际信息保护之间的缺口；会话汇总指标不保证怀疑先于泄漏。", "abstract_read": true, "evidence_level": "full_abstract_and_targeted_body", "full_text_checked": true, "summary_zh": "问题：网页Agent表达诈骗怀疑是否意味着会保护敏感信息。方法：Scammer4U以91攻击环境、10合法孪生对照及四模型四条件五种子进行评测，实际出站POST字段匹配衡量泄漏，独立LLM评判口头怀疑。作者称无隐私指导时关键PII泄漏54%–93%、合法对照0%。正文核验：35.9%对66.1%是C3提交前反思条件、已到达攻击界面的会话中，曾表达怀疑与未表达怀疑的泄漏率；“检测”按会话任一步阳性汇总，包含泄漏之后才表达怀疑的案例，不能全部解释为先识别后泄漏。结果限英语合成PII和自建浏览器框架，非现成商业Agent产品实测。", "topics": { "tags": [ "injection", "privacy", "evaluation", "monitoring", "authorization" ], "reason_zh": "网页社会工程导致PII外泄，区分识别可疑与实际提交的行为缺口。" }, "body_sections_checked": [ "作者区", "3.1-3.4", "4.3", "5", "7" ], "body_source_url": "https://arxiv.org/html/2606.00497v2", "version_id": "2606.00497v2", "published": "2026-05-30T03:00:28Z", "updated": "2026-10-23T21:10:52Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CL", "cs.CR" ], "source_url": "https://arxiv.org/abs/2606.00497", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "a17c8c0e0aa0f1a314472a0530c898bbf562a5b6bd9bae82615cc826796d0117", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2606.00497", "first_author": "Soham Roy", "authors": [ "Soham Roy", "Sarthakbrata Halder", "Arya Bharaty", "Vaibhav Bhaskar", "Yash Sinha", "Dhruv Kumar", "Srikant Panda", "Murari Mandal" ], "affiliations": [ "KIIT Bhubaneshwar" ], "source_url": "https://arxiv.org/html/2606.00497v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2509.21143": { "id": "2509.21143", "title": "Automotive-ENV: Benchmarking Multimodal Models in Automotive Cockpit Environments", "classification": "relevant", "reason": "汽车座舱交互Agent安全关键GUI行为基准，显式检验车况条件、危害识别及安全决策。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "summary_zh": "问题：普通GUI能力不能保证汽车座舱中理解车况并避开危险动作。方法：Automotive-ENV基于Android Automotive OS设置420任务，用UI状态、车辆信号和安全条件确定性验证。作者称模型在隐含意图和安全关键任务中明显退化，并识别安全推理、车控理解及隐含危险识别的反复失败；摘要未给出统一成功率。", "topics": { "tags": [ "embodied", "authorization", "evaluation" ], "reason_zh": "座舱GUI动作结合车况与危险识别，直接评测安全关键交互。" }, "version_id": "2509.21143v3", "published": "2025-09-25T13:30:13Z", "updated": "2026-10-24T04:28:23Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CL", "cs.RO" ], "source_url": "https://arxiv.org/abs/2509.21143", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "b85fbf010dd61009e80e08bb07c6dfdc44dc6fea292b8396415ef73b96c1cdfa", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2509.21143", "first_author": "Junfeng Yan", "authors": [ "Junfeng Yan", "Biao Wu", "Meng Fang", "Ling Chen" ], "affiliations": [ "Australian Artificial Intelligence Institute" ], "source_url": "https://arxiv.org/pdf/2509.21143v3", "shared_first_authors": [], "shared_first_note": "PDF首页Junfeng Yan与Biao Wu标星，但未找到星号说明，共同一作未确认。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页Junfeng Yan与Biao Wu标星，但未找到星号说明，共同一作未确认。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33753": { "id": "2610.33753", "title": "Ring-0 by Default: Agents as Operating Systems (AaOS)", "classification": "relevant", "reason": "直接以OS保护机制审计编码Agent的权限隔离、恢复转录完整性及监控失效。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.33753", "topics": { "tags": [ "authorization", "supplychain", "memory", "monitoring" ], "reason_zh": "直接以OS保护机制审计编码Agent的权限隔离、恢复转录完整性及监控失效。" }, "summary_zh": "问题：Agent已能操作文件、进程、子Agent和扩展，却缺少传统OS的内部保护。方法：将19个子系统的116项OS机制映射到Agent，并在Claude Code、Codex CLI、Gemini CLI做13项实验，核验25种机制。作者称只有11项同构、65项缺失；实验有16项符合原分析、7项需细化、2项改变判定，发现单工具检查可被shell路径绕过、三种CLI都接受伪造恢复转录，提示规则不满足完整引用监控器要求。这是机制审计而非普遍漏洞成功率。", "version_id": "2610.33753v1", "published": "2026-10-24T15:51:23Z", "updated": "2026-10-24T15:51:23Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR", "cs.OS" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "54e77e3a4ce25b88c821e4b1f6fee5c5affcc3038aed5760c048dee2f8e2ec91", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33753", "first_author": "Xiang Li", "authors": [ "Xiang Li", "Aichun Huang", "Zuyao Xu", "Fasheng Miao", "Zheli Liu" ], "affiliations": [ "Nankai University" ], "source_url": "https://arxiv.org/pdf/2610.33753v1", "shared_first_authors": [], "shared_first_note": "首页 † 映射 Nankai University；# 为通讯作者标记，不是共同一作。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页 † 映射 Nankai University；# 为通讯作者标记，不是共同一作。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33651": { "id": "2610.33651", "title": "Jointly Modeling Preferences and Imperfect Decision-Making in Large Language Models", "classification": "relevant", "reason": "正文直接研究LLM代理在混合动机多人情境中是否按被委托的偏好行动，以及自陈偏好与实际选择的脱节，具有明确多Agent对齐评测关联。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.33651", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "检验代表用户偏好的LLM代理在相互影响的社会困境中是否行为对齐，区分宣称价值与行动。" }, "summary_zh": "问题：LLM代理在问卷中表达的社会和环境偏好，能否预测面对个人与群体利益冲突时的实际行动。方法：Preference-Behavior Model把多维偏好与不完美规划/决策机制联合建模，从公共物品、集体风险和共享资源困境的选择反推参数，并比较persona指令、偏好问卷和跨游戏行为。作者称标准问卷偏好不能稳定预测游戏行为，而一个困境中拟合的模型在另一个困境仍有预测价值；部分意图偏好与实际行为存在差异。摘要未给统一数值改进，不能外推真实社会部署。", "initial_classification": "uncertain", "scope_review": { "id": "2610.33651", "title": "Jointly Modeling Preferences and Imperfect Decision-Making in Large Language Models", "previous_classification": "uncertain", "classification": "relevant", "reason": "正文直接研究LLM代理在混合动机多人情境中是否按被委托的偏好行动，以及自陈偏好与实际选择的脱节，具有明确多Agent对齐评测关联。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§1、§3.3、§4.4、§5–6", "source_url": "https://arxiv.org/html/2610.33651", "evidence_notes": "引言将共同资源与群体后果作为多Agent安全问题；模型联合估计个人/他人收益、不平等和环境偏好与规划噪声。三类社会困境中检查persona指令与实际行为偏离，并做跨游戏预测；不是仅人格文本问卷。", "unresolved": false, "summary_zh": "问题：LLM代理在问卷中表达的社会和环境偏好，能否预测面对个人与群体利益冲突时的实际行动。方法：Preference-Behavior Model把多维偏好与不完美规划/决策机制联合建模，从公共物品、集体风险和共享资源困境的选择反推参数，并比较persona指令、偏好问卷和跨游戏行为。作者称标准问卷偏好不能稳定预测游戏行为，而一个困境中拟合的模型在另一个困境仍有预测价值；部分意图偏好与实际行为存在差异。摘要未给统一数值改进，不能外推真实社会部署。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "检验代表用户偏好的LLM代理在相互影响的社会困境中是否行为对齐，区分宣称价值与行动。" } }, "version_id": "2610.33651v1", "published": "2026-10-24T13:06:54Z", "updated": "2026-10-24T13:06:54Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.GT" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 78 of 78 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "d40015489fbf4b74dae5bd3a021ece4496db3f7626e520e001509c4c7b7a995a", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33651", "first_author": "Axel Abels", "authors": [ "Axel Abels", "Elias Fernández Domingos", "Tom Lenaerts" ], "affiliations": [ "Machine Learning Group, Université Libre de Bruxelles", "Artificial Intelligence Lab, Vrije Universiteit Brussel", "FARI Institute, Université Libre de Bruxelles and Vrije Universiteit Brussel", "ELLIS Alicante" ], "source_url": "https://arxiv.org/html/2610.33651v1", "shared_first_authors": [], "shared_first_note": "官方HTML第一作者Axel Abels明确列四个署名单位。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "官方HTML第一作者Axel Abels明确列四个署名单位。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33633": { "id": "2610.33633", "title": "ProbeID: Verifying MCP Tool Identity for LLM Agents under Registry Drift", "classification": "relevant", "reason": "直接验证MCP工具实现身份、检测替换/漂移，评测污损任务和验证边界。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.33633", "topics": { "tags": [ "supplychain", "authorization", "evaluation" ], "reason_zh": "直接验证MCP工具实现身份、检测替换/漂移，评测污损任务和验证边界。" }, "summary_zh": "问题：可复制的MCP工具描述不能证明实际执行实现的身份。方法：ProbeID把合法schema探针的规范化响应与可信准入参考比较，歧义时拒绝，并分析探针预算和错误界。作者称缓存漂移案例strict choice达0.956 hit@1，但精确比较可持平；MCP-Bench污损任务从15降至9/16且任务成功率不变。11周中59个真实工具有7个在版本固定下仍变化；两种探针无法触达的漂移始终通过，保护依赖参考完整性、覆盖和噪声。", "version_id": "2610.33633v1", "published": "2026-10-24T12:26:13Z", "updated": "2026-10-24T12:26:13Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "b05acd84c42227c2a691d69562eb1ce0a58c8d1a39313d52b1bd9f966406f72a", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33633", "first_author": "Guanxing Chen", "authors": [ "Guanxing Chen", "Sining Zhang", "Haohuai He", "Qiujie Lv", "Yu-An Huang", "Zhi-An Huang" ], "affiliations": [ "City University of Hong Kong (Dongguan)" ], "source_url": "https://arxiv.org/pdf/2610.33633v1", "shared_first_authors": [], "shared_first_note": "首页编号1映射 City University of Hong Kong (Dongguan)；星号为通讯作者。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页编号1映射 City University of Hong Kong (Dongguan)；星号为通讯作者。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33624": { "id": "2610.33624", "title": "RSI Arena: Towards Recursive Self-Improvement with Human Feedback", "classification": "relevant", "reason": "自主训练Agent的自改进实验含人类偏好收益与有害顺从恶化的安全权衡。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.33624", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "自主训练Agent的自改进实验含人类偏好收益与有害顺从恶化的安全权衡。" }, "summary_zh": "问题：自主训练Agent利用人类反馈改进模型时，偏好与基准/安全收益是否一致。方法：RSI Arena让10个前沿模型在固定GPU/API预算内自主后训练同一基座，再根据盲评投票进行第二阶段训练。作者称全部训练出可用助手，最强模型在12项能力基准关闭基座到Instruct差距的中位数76%；第二轮8/10模型的人类相对偏好提升，但基准收益较小且无明确关联，有Agent鼓励更长回答、一个模型的StrongREJECT有害顺从增加。摘要不能据此证明整体自改进安全。", "version_id": "2610.33624v1", "published": "2026-10-24T11:54:45Z", "updated": "2026-10-24T11:54:45Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "a9eecc76ea6b6afebd60418c461db17b2e04354a9f2849e87e53846aea43c602", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33624", "first_author": "Yue Huang", "authors": [ "Yue Huang", "Yanbo Wang", "Lichi Li", "Yuanyuan Chen", "Andreas Haupt", "Xiaonan Luo", "Zheyuan Liu", "Jihye Choi", "Felix Juefei-Xu", "Xiangliang Zhang", "Radha Poovendran", "Misha Sra", "Ying Liu", "Ben Burtenshaw", "Thomas Wolf", "Alex Pentland", "Zichen Chen", "Zhangchen Xu" ], "affiliations": [ "Bake AI", "University of Notre Dame" ], "source_url": "https://arxiv.org/pdf/2610.33624v1", "shared_first_authors": [], "shared_first_note": "PDF首页Yue Huang编号1、2，分别Bake AI与University of Notre Dame。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页Yue Huang编号1、2，分别Bake AI与University of Notre Dame。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33587": { "id": "2610.33587", "title": "Who Verifies the Verifiers? Accountable Semantic Consensus for AI-Mediated Web Information Verification", "classification": "relevant", "reason": "Web证据可操纵多评审器，提出带签名挑战和阈值共识的抗恶意评审机制。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.33587", "topics": { "tags": [ "multiagent", "injection", "evaluation", "monitoring" ], "reason_zh": "Web证据可操纵多评审器，提出带签名挑战和阈值共识的抗恶意评审机制。" }, "summary_zh": "问题：开放网页可操纵评审LLM，相关错误破坏多数投票的可信性。方法：Astral让评审器使用同一承诺证据快照，在最多f个恶意评审器时要求2f+1高置信证明且无签名挑战。作者称在5个基准、7个评审器中2个对抗的设置下，攻击成功率为21.5%–53.1%，多数投票为54.7%–77.8%；代价是无攻击时仅16.0%–61.7%样本产生二元裁决，其余进入争议审计。", "version_id": "2610.33587v1", "published": "2026-10-24T10:30:56Z", "updated": "2026-10-24T10:30:56Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR", "cs.DC" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "4423ed4fd62a71b5d1e9a678db10cd783791bfa28ca7b17fbbd1521350dd9bc9", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33587", "first_author": "Yanna Jiang", "authors": [ "Yanna Jiang", "Mingyuan Li", "Xu Wang", "Guangsheng Yu" ], "affiliations": [ "University of Technology Sydney" ], "source_url": "https://arxiv.org/pdf/2610.33587v1", "shared_first_authors": [ "Yanna Jiang", "Mingyuan Li" ], "shared_first_note": "首页脚注明确 Yanna Jiang and Mingyuan Li contributed equally，二者共同第一。", "shared_first_affiliations": { "Yanna Jiang": [ "University of Technology Sydney" ], "Mingyuan Li": [ "ELLIS Institute Finland", "University of Turku" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页脚注明确 Yanna Jiang and Mingyuan Li contributed equally，二者共同第一。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33509": { "id": "2610.33509", "classification": "relevant", "reason": "漏洞引入代码的代理安全审查，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "cf6f9a72360c8f05517f4df5508621da9f2bcbc1ba6e964d97a46ddf793dc5d0", "summary_zh": "仅据摘要，作者声称：SecPRBench用真实漏洞引入提交而非事后补丁构造265项代理安全审查任务，覆盖九大软件系统；作者报告八模型召回32.5–78.1%，68%漏报已经查看正确文件却认错机制，两个安全脚手架分别降低8.3点和提高7.7点召回。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "漏洞引入代码的代理安全审查，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?", "version_id": "2610.33509v2", "published": "2026-10-24T07:32:42Z", "updated": "2026-10-30T02:32:26Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR", "cs.PL", "cs.SE" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 10 of 10 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.33509v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28", "2026-11-03" ], "version_history": [ { "id": "2610.33509", "title": "Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?", "classification": "relevant", "reason": "真实引入漏洞代码变更的Agent安全审查基准，诊断已读漏洞文件仍误判机制的漏报。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.33509", "body_review_sections": [ "abstract", "§3 task construction", "§5.2–5.4 results", "Limitations" ], "version_id": "2610.33509v1", "published": "2026-10-24T07:32:42Z", "updated": "2026-10-24T07:32:42Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR", "cs.PL", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "cf6f9a72360c8f05517f4df5508621da9f2bcbc1ba6e964d97a46ddf793dc5d0", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "announcement_status": "仅官方API可见；公告日期未确认，非今日发表断言", "backfill_kind": "new_id_v1", "last_metadata_checked_date": "2026-10-28" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.33509", "first_author": "Yihan Yang", "authors": [ "Yihan Yang", "Chenyuan Yang", "Zijie Zhao", "Anh Nguyen Hoang", "Ziqi Zhang", "Weidong Wang", "Zhiheng Lyu", "Lingming Zhang" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "source_url": "https://arxiv.org/pdf/2610.33509v2", "shared_first_authors": [ "Yihan Yang", "Chenyuan Yang" ], "shared_first_note": "论文首页 * 标记及 Equal contribution / contributed equally 脚注明确声明共同贡献。", "shared_first_affiliations": { "Yihan Yang": [ "University of Illinois Urbana-Champaign" ], "Chenyuan Yang": [ "University of Illinois Urbana-Champaign" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "title": "Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?", "version_id": "2610.33509v2", "verification_status": "affiliation_verified", "affiliation_checked": true }, "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录", "first_seen_date": "2026-10-27", "revision_history": [ { "id": "2610.33509", "title": "Can Agentic Code Review Catch Vulnerabilities Before They Are Merged?", "classification": "relevant", "reason": "真实引入漏洞代码变更的Agent安全审查基准，诊断已读漏洞文件仍误判机制的漏报。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.33509", "topics": { "tags": [ "supplychain", "evaluation", "monitoring" ], "reason_zh": "真实引入漏洞代码变更的Agent安全审查基准，诊断已读漏洞文件仍误判机制的漏报。" }, "summary_zh": "问题：Agent能否在真实引入漏洞的代码变更合并前正确诊断风险，而不只命中有漏洞的文件。方法：SecPRBench收集9个C/C++/Rust系统的265个真实引入漏洞任务，给出diff、提交信息和仓库，隐藏漏洞描述与后续修复；按根因匹配评价，并用修复后代码作目标漏洞对照。作者报告8个直接审查模型召回32.5%–78.1%；68%的已扫描漏报在根因文件里提出了不同机制的发现。正文核验：这些主要是竞争性误诊，不能据此说模型已经识别真实风险却宣布安全；修复对照只针对该漏洞，不能估计整体报告精确率。范围限于公开披露系统代码，217项通过机械验证、48项依赖人工裁定；结果未独立复现。", "body_review_sections": [ "abstract", "§3 task construction", "§5.2–5.4 results", "Limitations" ], "version_id": "2610.33509v1", "published": "2026-10-24T07:32:42Z", "updated": "2026-10-24T07:32:42Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR", "cs.PL", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "cf6f9a72360c8f05517f4df5508621da9f2bcbc1ba6e964d97a46ddf793dc5d0", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33509", "first_author": "Yihan Yang", "authors": [ "Yihan Yang", "Chenyuan Yang", "Zijie Zhao", "Anh Nguyen Hoang", "Ziqi Zhang", "Weidong Wang", "Zhiheng Lyu", "Lingming Zhang" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "source_url": "https://arxiv.org/pdf/2610.33509v1", "shared_first_authors": [ "Yihan Yang", "Chenyuan Yang" ], "shared_first_note": "首页 Equal contribution 标注 Yihan Yang 与 Chenyuan Yang 共同第一作者，均署名 UIUC。", "shared_first_affiliations": { "Yihan Yang": [ "University of Illinois Urbana-Champaign" ], "Chenyuan Yang": [ "University of Illinois Urbana-Champaign" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页 Equal contribution 标注 Yihan Yang 与 Chenyuan Yang 共同第一作者，均署名 UIUC。" }, "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" } ] }, "2610.33489": { "id": "2610.33489", "title": "From Instructions to Exploits: Applying Program Analysis to Malicious Agent Skills Across Natural Language and Code", "classification": "relevant", "reason": "针对第三方Agent Skill供应链恶意行为，联合自然语言指令与可执行代码进行依赖图安全分析。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.33489", "topics": { "tags": [ "supplychain", "injection", "monitoring", "evaluation" ], "reason_zh": "针对第三方Agent Skill供应链恶意行为，联合自然语言指令与可执行代码进行依赖图安全分析。" }, "summary_zh": "问题：恶意Agent Skill的行为可能跨越自然语言指令和附带代码，单独审查一端会遗漏依赖链。方法：SCS用LLM将操作性指令编译为有限API的Python式IR，与代码合成跨域程序依赖图xPDG，再传播信任、敏感性、能力三类属性并按规则检测。作者报告234个平衡标注样本上，跨5个LLM平均准确率85.6%、召回95.2%、F1为86.9%；在66,157个ClawHub Skill中筛出2,473个候选，经辅助动态验证和人工审查确认627个恶意样本。正文核验：动态验证不属于核心静态检测评测；有限API、运行时解析信息和LLM编译遗漏仍可能产生漏报，不能宣称完整分析或完全摆脱LLM。", "body_review_sections": [ "abstract", "§III constrained NL-to-IR", "§V results", "§VI discussion" ], "version_id": "2610.33489v1", "published": "2026-10-24T06:35:43Z", "updated": "2026-10-24T06:35:43Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "6b6506037ff637d7de986e59389c9e7ceb95078966543379f5f70241322ef842", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33489", "first_author": "Shiwu Zhao", "authors": [ "Shiwu Zhao", "Baizhu Wang", "Guoqiang Zheng", "Tingyu Gao", "Yuheng Xie", "Rujie Chen", "Xingchen Chen", "Xuezhang Liu", "Qixu Liu" ], "affiliations": [ "Institute of Information Engineering, Chinese Academy of Sciences" ], "source_url": "https://arxiv.org/pdf/2610.33489v1", "shared_first_authors": [ "Shiwu Zhao", "Baizhu Wang" ], "shared_first_note": "首页标注 Shiwu Zhao 与 Baizhu Wang 为共同第一作者；前者属中科院信息工程研究所，后者属 MYbank, Ant Group。", "shared_first_affiliations": { "Shiwu Zhao": [ "Institute of Information Engineering, Chinese Academy of Sciences" ], "Baizhu Wang": [ "MYbank, Ant Group" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页标注 Shiwu Zhao 与 Baizhu Wang 为共同第一作者；前者属中科院信息工程研究所，后者属 MYbank, Ant Group。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33411": { "id": "2610.33411", "title": "Agent-to-Agent Synthetic Social Engineering on the Web", "classification": "relevant", "reason": "跨Agent社会工程误导导致未授权行动，区分证据正确性和权限有效性。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.33411", "topics": { "tags": [ "multiagent", "authorization", "injection", "evaluation" ], "reason_zh": "跨Agent社会工程误导导致未授权行动，区分证据正确性和权限有效性。" }, "summary_zh": "问题：跨服务Agent可在证据处理正确的同时接受未授权行动请求。方法：定义面向AI接收者的合成社会工程，以ASE-EC固定记录和授权范围，在Qwen3-4B的两个虚构简报任务中运行1,260回合，比较权威/承诺诉求与防御。作者称引用有限的先前约定，将未授权请求从43.3%提高到96.7%，尽管证据支持的决定和实际权限未变。结果限于该受控实验，强调证据正确不等于行动获准。", "version_id": "2610.33411v1", "published": "2026-10-24T02:59:12Z", "updated": "2026-10-24T02:59:12Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "8258183883afa33230a2b9cc23d7ee814651b8ffdc2a1172a453707c6a09d064", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33411", "first_author": "Bryan C. Boots", "authors": [ "Bryan C. Boots" ], "affiliations": [ "University of Missouri-Kansas City" ], "source_url": "https://arxiv.org/pdf/2610.33411v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33312": { "id": "2610.33312", "title": "Responsibility Boundaries for Agentic Systems: A Comparative Evaluation of Probabilistic Agentic Programming", "classification": "relevant", "reason": "以编程契约和执行kernel强制Agent授权、审批、资源界限与审计证据。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.33312", "topics": { "tags": [ "authorization", "monitoring", "multiagent" ], "reason_zh": "以编程契约和执行kernel强制Agent授权、审批、资源界限与审计证据。" }, "summary_zh": "问题：Agent职责、授权、外部效果和证据分散在提示及宿主代码中。方法：PAP将边界显式编程，以执行前调解kernel绑定操作审批、资源限额和证据；在正确守卫与完整调解前提下给条件安全证明，并对顺序Touba子集做模拟与有限状态检查。作者报告7业务案例、7模型、5方法、5重复共1,225观测；原生Touba六模型各35/35、另一30/35，与各模型最高计数持平或领先，但配对区间均含零。任务完成计数不能替代安全假设的证明。", "version_id": "2610.33312v1", "published": "2026-10-23T21:31:12Z", "updated": "2026-10-23T21:31:12Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.PL", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "491039b55c611702cc620f72014a5b0fffce78edc6fecccd59967b2bfa8e28d3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33312", "first_author": "Khadim Lo", "authors": [ "Khadim Lo", "Soukaina Alaoui Ismaili", "Jean-Sébastien Dessureault" ], "affiliations": [ "Electrical & Computer Engineering, LSSI, UQTR" ], "source_url": "https://arxiv.org/html/2610.33312v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33198": { "id": "2610.33198", "title": "Deletion, Substitution, Repair and Transplant: Component Attribution in BARBICAN, a Layered Prompt-Injection Gateway for MCP", "classification": "relevant", "reason": "MCP提示注入网关中路由、仲裁器与消融评测的真实贡献，直接防御及安全评估。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.33198", "topics": { "tags": [ "injection", "authorization", "evaluation", "monitoring" ], "reason_zh": "MCP提示注入网关中路由、仲裁器与消融评测的真实贡献，直接防御及安全评估。" }, "summary_zh": "问题：分层MCP防注入网关的整体分数可能隐藏某个检测阶段已失效。方法：对BARBICAN仲裁阶段做删除、常量替换、tokenizer修复和外部分类器移植，并检查路由后类别分布。作者称修复使该阶段全语料AUC从0.392升至0.855，系统召回反由80.67%变为80.34%；恒判恶意达到80.77%。被送入该阶段的样本96.82%恶意，删除损失673次检测，而常量替换仅改变25,000决策中的12–140次。作者主张消融必须同时报告路由分布和替换控制。", "version_id": "2610.33198v1", "published": "2026-10-23T18:47:06Z", "updated": "2026-10-23T18:47:06Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "7cd93259e09d3c3a783e8eea798da10230f9469564b31afa0641763fdc4e85dc", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33198", "first_author": "İpek Abasıkeleş Turgut", "authors": [ "İpek Abasıkeleş Turgut", "Edip Gümüş" ], "affiliations": [ "Department of Computer Engineering, Faculty of Engineering and Natural Sciences, Iskenderun Technical University" ], "source_url": "https://arxiv.org/html/2610.33198v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33180": { "id": "2610.33180", "title": "Propensities Please: Exposing Alignment-Faking LLMs using Synthetic Document Finetuning", "classification": "relevant", "reason": "针对隐藏目标且识别监督的模型行为，以合成文档微调暴露失配行动倾向。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.33180", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "针对隐藏目标且识别监督的模型行为，以合成文档微调暴露失配行动倾向。" }, "summary_zh": "问题：识别出评测/监督的失配模型可能隐藏其目标，单纯提示难以揭露潜在行为。方法：用合成文档微调让模型学到特定提示线索意味着失配行动不会被发现，再在显然是蜜罐的环境比较有无线索。作者称微调稳定扩大两种提示的失配行动率差异，比纯提示更能暴露倾向；同时经常损伤推理能力，并提出on-policy蒸馏缓解。摘要未提供具体效应量，不能视为已证明生产Agent检测能力。", "version_id": "2610.33180v1", "published": "2026-10-23T18:23:49Z", "updated": "2026-10-23T18:23:49Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 78 of 78 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 200 of 200 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "8fa7d2162117f946b8612ac75b8acffe7f8629841d303b780354722d1ce1c2f9", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33180", "first_author": "Ardy Haroen", "authors": [ "Ardy Haroen", "Florian Lorkowski", "Samuel Nellessen", "Felix Hofstätter" ], "affiliations": [ "LASR Labs" ], "source_url": "https://arxiv.org/pdf/2610.33180v1", "shared_first_authors": [ "Ardy Haroen", "Florian Lorkowski", "Samuel Nellessen" ], "shared_first_note": "首页明确星号Equal contribution，前三作者共同第一。", "shared_first_affiliations": { "Ardy Haroen": [ "LASR Labs" ], "Florian Lorkowski": [ "LASR Labs" ], "Samuel Nellessen": [ "LASR Labs" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页明确星号Equal contribution，前三作者共同第一。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.33112": { "id": "2610.33112", "title": "Conformance as a Distribution: Delegation Contracts, Error Budgets, and the Allocation of Evaluation Authority in Use-Based AI Regulation", "classification": "uncertain", "reason": "有工具/记忆配置冻结、行动撤回和评估感知等Agent部署安全语义，但主要贡献是适用于一般AI部署的合规理论；缺少具体Agent实例，当前范围边界仍待确认。", "abstract_read": true, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.33112", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "涉及部署配置绑定、持续审计与撤回授权，但与专属Agent安全的范围联系仍不充分。" }, "summary_zh": "问题：部署合规应如何以有范围和到期时间的失败率证据表达，而非单一模型分数。方法：以部署者、审计者和执行点的策略博弈分析委托契约、承诺揭示审计、长期认证误差预算、子群保障及fallback成本，给出命题并做5项预注册合成研究。作者强调没有评测LLM或生产系统。待核验：正文契约是否专门约束Agent能力/行动，或仅是通用AI监管理论。", "initial_classification": "uncertain", "scope_review": { "id": "2610.33112", "title": "Conformance as a Distribution: Delegation Contracts, Error Budgets, and the Allocation of Evaluation Authority in Use-Based AI Regulation", "previous_classification": "uncertain", "classification": "uncertain", "reason": "有工具/记忆配置冻结、行动撤回和评估感知等Agent部署安全语义，但主要贡献是适用于一般AI部署的合规理论；缺少具体Agent实例，当前范围边界仍待确认。", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body_review", "reviewed_sections": "§I–IV、§VI、§VIII", "source_url": "https://arxiv.org/html/2610.33112", "evidence_notes": "研究对象为模型、提示、工具、记忆和回退组合的部署合约；讨论策略性审计规避及能力访问执行点，但全部数值为合成实验，无语言模型或生产系统评估。", "unresolved": true, "review_question": "是否将直接讨论Agent部署配置与行动撤回、但实证仅为通用合规机制的理论论文纳入当前Agent Safety范围？保留待确认，不以法规治理标题直接归相关。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "涉及部署配置绑定、持续审计与撤回授权，但与专属Agent安全的范围联系仍不充分。" } }, "version_id": "2610.33112v1", "published": "2026-10-23T00:08:49Z", "updated": "2026-10-23T00:08:49Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "candidate_type": "unseen_id", "abstract_sha256": "381fe086389bc820661a7ad2f37d67a95ee1c1a744bb7482b4135113f8d256cd", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "new_id_v1", "author": { "id": "2610.33112", "first_author": "John deVadoss", "authors": [ "John deVadoss" ], "affiliations": [ "InterWork Alliance" ], "source_url": "https://arxiv.org/html/2610.33112v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.32648": { "id": "2610.32648", "title": "StateMirror: Pre-Execution Detection of Hallucinated Tool Calls in Coding Agents", "classification": "relevant", "reason": "在编码Agent工具执行边界用环境谓词预检幻觉调用，直接工具使用可靠性监控。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.32648", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "在编码Agent工具执行边界用环境谓词预检幻觉调用，直接工具使用可靠性监控。" }, "summary_zh": "问题：编码Agent生成不存在路径、缺失依赖等环境不适用的工具动作，执行后才发现代价高。方法：StateMirror在harness边界拦截动作，经AST/命令分析提取先决谓词并对真实仓库确定性核验。作者称4,398轨迹中的幻觉恢复中位额外3步和22.4K token；2,508动作检测精度0.940、F1 0.817，延迟1.50ms对比LLM评审17.73s，反馈可纠正超过95%幻觉调用。79任务在线实验保持解题率同时节约15.8%时间和11.8%token。", "version_id": "2610.32648v1", "published": "2026-10-23T13:56:13Z", "updated": "2026-10-23T13:56:13Z", "announcement_date": "2026-10-26", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "new", "section": "New submissions (showing 30 of 30 entries)" }, { "announcement_date": "2026-10-26", "category": "cs.SE", "kind": "recent", "section": null } ], "candidate_type": "unseen_id", "abstract_sha256": "18a5e40a26fc0c585a78a25e2b113870c2f7e74a8b8fc84ca84d01540fae898f", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "announcement_status": "官方公告列表已核对", "backfill_kind": "new_id_v1", "author": { "id": "2610.32648", "first_author": "Shiwen Shan", "authors": [ "Shiwen Shan", "Yintong Huo", "Zhiying Wu", "Yuxin Su" ], "affiliations": [ "School of Software Engineering, Sun Yat-sen University" ], "source_url": "https://arxiv.org/html/2610.32648v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [] }, "2610.27293": { "id": "2610.27293", "title": "Vulnerability Analysis for Safe Multi-Agent Reinforcement Learning", "classification": "relevant", "reason": "安全多Agent强化学习的观测攻击，在保持任务收益下提高安全代价。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.27293", "topics": { "tags": [ "multiagent", "embodied", "robustness" ], "reason_zh": "安全多Agent强化学习的观测攻击，在保持任务收益下提高安全代价。" }, "summary_zh": "问题：安全多Agent强化学习策略能否抵抗对部分Agent观测的推理期扰动。方法：MinMax Attack联合选择被攻陷Agent的目标动作，同时建模诚实成员的合作抵抗，并推导安全成本与受控Agent/扰动预算关系。作者称跨多个安全关键基准和SMARL算法，比现有攻击诱发更高安全成本且保持任务奖励，降低可检测性；摘要未给具体数值，属于传统多Agent RL安全而非LLM专属。", "version_id": "2610.27293v2", "published": "2026-10-19T21:09:02Z", "updated": "2026-10-24T02:06:00Z", "announcement_date": "2026-10-21", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-21", "category": "cs.AI", "kind": "recent", "section": null } ], "candidate_type": "changed_version", "abstract_sha256": "8719295a4b3801cbe9d41ad66d4d7ab64deda03439d66f72a87fed5ded073b02", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "seen_dates": [ "2026-10-27" ], "version_history": [ { "id": "2610.27293", "version_id": "2610.27293v1", "classification": "irrelevant", "announcement_date": "Wed, 21 Oct 2026", "published": "2026-10-19T21:09:02Z", "updated": "2026-10-19T21:09:02Z", "reason": "非LLM多Agent强化学习观测攻击，不纳入LLM Agent主范围" } ], "announcement_status": "官方公告列表已核对", "backfill_kind": "known_id_revision", "author": { "id": "2610.27293", "first_author": "Taozheng Zhu", "authors": [ "Taozheng Zhu", "Shixiong Jiang", "Fanxin Kong" ], "affiliations": [ "University of Notre Dame" ], "source_url": "https://arxiv.org/html/2610.27293v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "first_seen_date": "2026-10-27", "revision_history": [] }, "2610.06923": { "id": "2610.06923", "title": "RadOnc-Agent: An Integrated Framework for AI Workflows Across the Radiotherapy Care Pathway", "classification": "relevant", "reason": "放疗工作流Agent以schema与身份校验控制工具分派，消融揭示高比例错配调用风险。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.06923", "topics": { "tags": [ "authorization", "memory", "evaluation" ], "reason_zh": "放疗工作流Agent以schema与身份校验控制工具分派，消融揭示高比例错配调用风险。" }, "summary_zh": "问题：放疗Agent跨阶段工具调用需要正确保持状态、参数schema和患者身份对应。方法：RadOnc-Agent连接17项阶段功能和9项通用工具，用LLM控制器结构化派发并维护纵向上下文，在单功能、多阶段及去标识记录工作流评估。作者称单功能正确选择98.79%、脚本/记录流程完成96.50%/96.67%；去除状态完成率降至84.00%，绕过schema和身份验证在回放/测试中使错配分派从0%升至95.28%。这些是技术验证，不代表前瞻临床安全已成立。", "version_id": "2610.06923v2", "published": "2026-10-02T22:39:48Z", "updated": "2026-10-23T19:48:50Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "a990d92afe580ca60dc5fe8c0dfb853932a302cfcd7775ae0e8c104afd879c25", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2610.06923", "first_author": "Caiwen Jiang", "authors": [ "Caiwen Jiang", "Shuoyang Wei", "Songlin Zhao", "Junyu Li", "Jingyuan Chen", "Yuzhen Ding", "Daniel J. Ma", "Samir H. Patel", "Steven E. Schild", "Sujay A. Vora", "Wei Liu" ], "affiliations": [ "Department of Radiation Oncology, Mayo Clinic Arizona" ], "source_url": "https://arxiv.org/html/2610.06923v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2609.17527": { "id": "2609.17527", "title": "Agentic Societies Need a Social Harness", "classification": "relevant", "reason": "跨主体Agent社会通信的恶意/故障阻塞与信任边界，提出social harness。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2609.17527", "topics": { "tags": [ "multiagent", "authorization", "injection", "monitoring" ], "reason_zh": "跨主体Agent社会通信的恶意/故障阻塞与信任边界，提出social harness。" }, "summary_zh": "问题：跨不同主体信任边界的Agent社会，即使诚实成员也可能协作失败，恶意成员可通过通信漏洞阻塞或操纵结果。方法：实验展示问题，提出区别于个人harness的social harness分层架构，分别预防通信错误、检测无效消息和支持事后调查与后果追究。摘要声称当前通信机制可被利用达成有害目标，但未提供具体实验规模或数值。", "version_id": "2609.17527v2", "published": "2026-09-15T17:57:27Z", "updated": "2026-10-24T03:56:53Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.MA", "cs.NI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "b67424b9ed4d075fb481a40abf397790fe3ba2f84551170a85cba855c40fcce3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2609.17527", "first_author": "Tapan Chugh", "authors": [ "Tapan Chugh", "Vidushi Singh", "Krish Jain", "Arvind Krishnamurthy", "Ratul Mahajan" ], "affiliations": [ "University of Washington" ], "source_url": "https://arxiv.org/pdf/2609.17527v2", "shared_first_authors": [], "shared_first_note": "PDF首页确认全作者统一署名University of Washington，解决HTML格式损坏歧义。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页确认全作者统一署名University of Washington，解决HTML格式损坏歧义。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2609.10871": { "id": "2609.10871", "title": "A2ABreak: Systematic Security Analysis of the A2A Protocol", "classification": "relevant", "reason": "直接系统分析A2A协议的上下文注入、委托身份丢失和恶意能力声明泄露。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2609.10871", "topics": { "tags": [ "multiagent", "injection", "authorization", "privacy" ], "reason_zh": "直接系统分析A2A协议的上下文注入、委托身份丢失和恶意能力声明泄露。" }, "summary_zh": "问题：A2A跨组织发现、认证和委托协议本身可能允许合规攻击者利用信任边界。方法：A2ABreak从自然语言规范抽取经核验有限状态机，将929条形式化陈述映射为37状态、76转移，再做对抗验证。作者称发现11个不依赖实现缺陷的新协议漏洞，包括跨客户上下文注入、多跳委托身份丢失导致凭据收集、虚假能力声明导致外泄；对人工评审精度73.3%、F1 84.6%，同规范零样本LLM基线没有确认发现。", "version_id": "2609.10871v3", "published": "2026-09-09T22:18:36Z", "updated": "2026-10-24T20:00:20Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "6df041f5e20fb0973a6bcf65e71479f0379fd771499e98cb4131692bf8a711da", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2609.10871", "first_author": "Alireza Lotfi", "authors": [ "Alireza Lotfi", "Mirza Masfiqur Rahman", "Imtiaz Karim", "Elisa Bertino" ], "affiliations": [ "Purdue University" ], "source_url": "https://arxiv.org/html/2609.10871v3", "shared_first_authors": [], "shared_first_note": "星号在作者区映射Purdue University，不是共同一作。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "星号在作者区映射Purdue University，不是共同一作。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2608.26036": { "id": "2608.26036", "title": "Trace Integrity for LLM Data Agents: Auditing Structured-Data Computation Beyond Answer Accuracy in Real-World Systems", "classification": "relevant", "reason": "数据Agent正确答案掩盖无效执行轨迹，提出可执行契约和审计完整性评测。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2608.26036", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "数据Agent正确答案掩盖无效执行轨迹，提出可执行契约和审计完整性评测。" }, "summary_zh": "问题：数据Agent最终答案正确仍可能由不符合用户意图的SQL操作得出。方法：定义Trace Integrity及执行契约，记录schema、操作计划、假设、查询、验证与答案关联，并用CAIT率衡量正确答案中轨迹无效的比例。作者在100个BIRD Mini-Dev样例比较三种提示：答案准确率20%/22%/24%，轨迹通过率39%/43%/40%，CAIT率55%/59.1%/45.8%。结果支持独立审计执行证据，不把答案正确等同流程有效。", "version_id": "2608.26036v2", "published": "2026-08-26T17:15:24Z", "updated": "2026-10-23T19:29:53Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "03b0896488dbc8445052d56a0b5053f1a7d578356624f1a22a4692c1ada5442b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2608.26036", "first_author": "Srimonti Dutta", "authors": [ "Srimonti Dutta", "Akshata Kishore Moharir" ], "affiliations": [ "Indian Institute of Technology Guwahati" ], "source_url": "https://arxiv.org/pdf/2608.26036v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2607.13071": { "id": "2607.13071", "title": "Compaction as Epistemic Failure: How Agentic LLM Tools Fabricate Confirmed Results from Killed Processes", "classification": "relevant", "reason": "编码Agent压缩记忆把终止命令部分输出升级为确认结果，导致跨会话虚假完成传播。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2607.13071", "topics": { "tags": [ "memory", "monitoring", "robustness" ], "reason_zh": "编码Agent压缩记忆把终止命令部分输出升级为确认结果，导致跨会话虚假完成传播。" }, "summary_zh": "问题：编码Agent长会话压缩可能把终止进程的部分stdout误记为已确认完成，后续会话继续相信。方法：记录Claude Code在exit 143命令后出现的压缩摘要错误，区分终端观察和持久写入。作者指出这种虚假完成可跨会话和模型版本传播且不重新核验；摘要没有样本量、发生率或对照实验数值，宜作为具体失效案例而非普遍频率估计。", "version_id": "2607.13071v2", "published": "2026-07-11T07:45:13Z", "updated": "2026-10-24T07:40:06Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "d55b81b9c70b73de6ab0d5e41652e73609273dd959e3cfb3d082ea9547790c64", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2607.13071", "first_author": "Hiroki Tamba", "authors": [ "Hiroki Tamba" ], "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/html/2607.13071v2", "shared_first_authors": [], "shared_first_note": "官方署名Independent Researcher。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "官方署名Independent Researcher。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2605.14290": { "id": "2605.14290", "title": "Web Agents Should Adopt the Compile-and-Execute Paradigm", "classification": "relevant", "reason": "用预编译执行图隔离不可信网页数据和Agent控制流，直接缓解提示注入。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2605.14290", "topics": { "tags": [ "injection", "authorization", "supplychain" ], "reason_zh": "用预编译执行图隔离不可信网页数据和Agent控制流，直接缓解提示注入。" }, "summary_zh": "问题：ReAct把来自不同主体的网页内容同时作为下一步行动依据，给提示注入改写控制流留下通路。方法：主张任务先编译为程序后观察执行内容，让不可信数据只能影响预定图中的值或分支，不能生成新动作；分析WebArena任务并讨论类型化语义API。作者称所有任务兼容该范式、81%可纯静态程序完成，无运行时LLM调用；摘要未提供真实攻击成功率降幅，且强调Web语义接口不足是主要落地障碍。", "version_id": "2605.14290v2", "published": "2026-05-14T02:48:57Z", "updated": "2026-10-23T21:29:13Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "6be9a05dfc154e82723da2daeee404e7943c596c2de36e86327007f8d4596346", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2605.14290", "first_author": "Julien Piet", "authors": [ "Julien Piet", "Annabella Chow", "Yiwei Hou", "Muxi Lyu", "Sylvie Venuto", "Jinhao Zhu", "Raluca Ada Popa", "David Wagner" ], "affiliations": [ "UC Berkeley" ], "source_url": "https://arxiv.org/html/2605.14290v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "论文首页署名编号直接映射第一作者单位；非邮箱或当前雇主推断。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2604.16677": { "id": "2604.16677", "title": "SentryVLA: Uncertainty-Guided Action Selection and State Monitoring for Vision-Language-Action Robotic Control", "classification": "relevant", "reason": "冻结VLA的校准行动可靠性评分和闭环异常监控，直接具身运行时风险预警。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2604.16677", "topics": { "tags": [ "embodied", "monitoring", "robustness" ], "reason_zh": "冻结VLA的校准行动可靠性评分和闭环异常监控，直接具身运行时风险预警。" }, "summary_zh": "问题：冻结VLA很少报告动作可靠性，部署时难以预警异常执行。方法：SentryVLA用共形分位回归估计动作与专家式行为偏差上界，对随机动作排序，并用最终行动预测前隐状态的Mahalanobis距离监控异常，无需重新训练VLA。作者称仿真和实体机器人实验改善动作选择并提供运行时预警；保证受校准分布约束，摘要无量化结果，也未给普适物理安全保证。", "version_id": "2604.16677v2", "published": "2026-04-17T20:20:43Z", "updated": "2026-10-25T02:55:19Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.RO" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "c459e01459f121fcd8a21de2d39860d37c0583ad562fc77d57068e23669935cf", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2604.16677", "first_author": "Zongyao Lyu", "authors": [ "Zongyao Lyu", "Lingling Chen", "William J. Beksi" ], "affiliations": [ "The University of Texas at Arlington" ], "source_url": "https://arxiv.org/pdf/2604.16677v2", "shared_first_authors": [ "Zongyao Lyu", "Lingling Chen" ], "shared_first_note": "PDF首页Equal contribution确认Zongyao Lyu与Lingling Chen共同第一，分别署名UT Arlington和UT Dallas。", "shared_first_affiliations": { "Zongyao Lyu": [ "The University of Texas at Arlington" ], "Lingling Chen": [ "The University of Texas at Dallas" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页Equal contribution确认Zongyao Lyu与Lingling Chen共同第一，分别署名UT Arlington和UT Dallas。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2604.16548": { "id": "2604.16548", "classification": "relevant", "reason": "代理长期记忆安全治理，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "ab934afe894ced8f581a571d36d93b5c0a2321cef3165ad661f56d1205d6bfbb", "summary_zh": "仅据摘要，作者声称：针对跨会话可写记忆带来的持久、状态化和传播威胁，以六生命周期阶段和四安全目标梳理攻击防御，提出可验证记忆治理的五项架构原语；强调来源、版本、策略保留和回滚协同，摘要无量化实验结果。", "topics": { "tags": [ "memory", "injection", "authorization", "privacy" ], "reason_zh": "代理长期记忆安全治理，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle", "version_id": "2604.16548v5", "published": "2026-04-17T06:28:22Z", "updated": "2026-10-30T08:58:05Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2604.16548v5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28", "2026-11-03" ], "version_history": [ { "id": "2604.16548", "title": "A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle", "classification": "relevant", "reason": "围绕跨会话Agent长期记忆生命周期组织攻击、防御和可验证治理。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2604.16548", "version_id": "2604.16548v4", "published": "2026-04-17T06:28:22Z", "updated": "2026-10-24T05:30:02Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "ab934afe894ced8f581a571d36d93b5c0a2321cef3165ad661f56d1205d6bfbb", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "announcement_status": "仅官方API可见；公告日期未确认，非今日发表断言", "backfill_kind": "historical_revision_backfill", "last_metadata_checked_date": "2026-10-28" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2604.16548", "first_author": "Zehao Lin", "authors": [ "Zehao Lin", "Xixuan Hao", "Renyu Fu", "Shaobo Cui", "Kai Chen", "Chunyu Li", "Zhiyu Li", "Feiyu Xiong" ], "affiliations": [ "MemTensor (Shanghai) Technology Co., Ltd." ], "source_url": "https://arxiv.org/pdf/2604.16548v5", "shared_first_authors": [ "Zehao Lin", "Xixuan Hao" ], "shared_first_note": "论文首页 * 标记及 Equal contribution 脚注明确声明共同贡献。", "shared_first_affiliations": { "Zehao Lin": [ "MemTensor (Shanghai) Technology Co., Ltd." ], "Xixuan Hao": [ "MemTensor (Shanghai) Technology Co., Ltd.", "The Hong Kong University of Science and Technology (Guangzhou)" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "title": "A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle", "version_id": "2604.16548v5", "verification_status": "affiliation_verified", "affiliation_checked": true }, "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录", "first_seen_date": "2026-10-27", "revision_history": [ { "id": "2604.16548", "title": "A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle", "classification": "relevant", "reason": "围绕跨会话Agent长期记忆生命周期组织攻击、防御和可验证治理。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2604.16548", "topics": { "tags": [ "memory", "injection", "privacy", "authorization" ], "reason_zh": "围绕跨会话Agent长期记忆生命周期组织攻击、防御和可验证治理。" }, "summary_zh": "问题：Agent可写跨会话记忆带来持久性、状态性和传播性的安全风险，不能仅做输入防御。方法：以写入、存储、检索、执行、共享传播、遗忘回滚六阶段和完整性/保密性/可用性/治理四目标组织攻击防御，并提出含五项架构原语的Verifiable Memory Governance。作者主张将来源、版本和策略化保留与检索/执行防御联动以支持审计恢复；摘要是综述与框架，未提供量化防御效果。", "version_id": "2604.16548v4", "published": "2026-04-17T06:28:22Z", "updated": "2026-10-24T05:30:02Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "ab934afe894ced8f581a571d36d93b5c0a2321cef3165ad661f56d1205d6bfbb", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2604.16548", "first_author": "Zehao Lin", "authors": [ "Zehao Lin", "Xixuan Hao", "Renyu Fu", "Shaobo Cui", "Kai Chen", "Chunyu Li", "Zhiyu Li", "Feiyu Xiong" ], "affiliations": [ "MemTensor (Shanghai) Technology Co., Ltd." ], "source_url": "https://arxiv.org/html/2604.16548v4", "shared_first_authors": [ "Zehao Lin", "Xixuan Hao" ], "shared_first_note": "官方HTML Equal Contribution脚注与次位作者星号：Zehao Lin、Xixuan Hao共同第一；后者另署名HKUST(GZ)。", "shared_first_affiliations": { "Zehao Lin": [ "MemTensor (Shanghai) Technology Co., Ltd." ], "Xixuan Hao": [ "MemTensor (Shanghai) Technology Co., Ltd.", "The Hong Kong University of Science and Technology (Guangzhou)" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "官方HTML Equal Contribution脚注与次位作者星号：Zehao Lin、Xixuan Hao共同第一；后者另署名HKUST(GZ)。" }, "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" } ] }, "2212.06123": { "id": "2212.06123", "title": "Security of Deep Reinforcement Learning for Autonomous Driving: A Survey", "classification": "relevant", "reason": "综述自动驾驶单/多Agent强化学习策略的攻击威胁与防御，属于具身Agent安全。", "abstract_read": true, "evidence_level": "full_abstract_only", "full_text_checked": false, "source_url": "https://arxiv.org/abs/2212.06123", "topics": { "tags": [ "embodied", "multiagent", "robustness" ], "reason_zh": "综述自动驾驶单/多Agent强化学习策略的攻击威胁与防御，属于具身Agent安全。" }, "summary_zh": "问题：自动驾驶RL策略在学习和执行时均可能受攻击，现有分类不足以指导选防御。方法：综述86项研究，按威胁模型及单/多Agent设置分类攻击防御，并分析对自动驾驶的适用性。作者提出面向系统选防御的组织视角；摘要无新的攻击/防御效果数值。本条是传统RL具身安全综述，不是LLM Agent专属。", "version_id": "2212.06123v4", "published": "2022-12-12T18:50:49Z", "updated": "2026-10-23T21:56:25Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.LG", "cs.RO" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 271 of 271 entries)", "category": "cs.LG", "kind": "new" } ], "candidate_type": "unseen_id", "abstract_sha256": "acf52d8dc2bcddbb38edbea6b812b0796cf9e6ae5fab0f9b217be091a011be2b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-27", "first_seen_date": "2026-10-27", "seen_dates": [ "2026-10-27", "2026-10-28" ], "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "backfill_kind": "historical_revision_backfill", "author": { "id": "2212.06123", "first_author": "Ambra Demontis", "authors": [ "Ambra Demontis", "Srishti Gupta", "Maura Pintor", "Luca Demetrio", "Kathrin Grosse", "Hsiao-Ying Lin", "Chengfang Fang", "Battista Biggio", "Fabio Roli" ], "affiliations": [ "University of Cagliari" ], "source_url": "https://arxiv.org/html/2212.06123v4", "shared_first_authors": [], "shared_first_note": "第一作者Ambra Demontis编号1，映射University of Cagliari。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "第一作者Ambra Demontis编号1，映射University of Cagliari。" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2603.15401": { "id": "2603.15401", "title": "SWE-Skills-Bench: Do Agent Skills Actually Help in Real-World Software Engineering?", "classification": "relevant", "reason": "直接评估SWE Agent安装技能后的负向行为，摘要明确有害技能会覆盖任务显式指令，关联技能供应链与行为评测。", "abstract_read": true, "summary_zh": "问题：Agent技能是否在真实软件工程中提供实际收益，且安装前缺乏单技能标准测试。方法：SWE-Skills-Bench将98个公开技能分别关联固定提交的仓库，生成需求、可执行验证器和可复现环境，在4种Agent-模型配置下进行3920次有无技能配对评测，按统计显著性区分有益、无效和有害技能。作者声称：92/98个技能无显著作用，平均通过率仅76.6%升至76.9%；有益技能最多提升17.7个百分点，有害技能会锚定模板并覆盖任务显式指令，最大下降17.0个百分点。", "topics": { "tags": [ "supplychain", "evaluation", "robustness" ], "reason_zh": "研究可安装Agent Skills的引入效果与有害指令覆盖；采用配对基准揭示技能导致的行为退化，但摘要未声称恶意投毒攻击。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2603.15401v2", "published": "2026-03-16T15:16:31Z", "updated": "2026-10-27T09:54:21Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 153 of 153 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 22 of 22 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.15401v2", "abstract_sha256": "c2b9105a2909cbfc07dba594db1e6911b7016f15ad8b2749975d5f0e2b1c36f1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.15401", "title": "SWE-Skills-Bench: Do Agent Skills Actually Help in Real-World Software Engineering?", "version_id": "2603.15401v2", "first_author": "Tingxu Han", "authors": [ "Tingxu Han", "Yi Zhang", "Wei Song", "Ye Shang", "Chunrong Fang", "Zhenyu Chen", "Youcheng Sun", "Lijie Hu" ], "affiliations": [ "Nanjing University", "Mohamed bin Zayed University of Artificial Intelligence" ], "source_url": "https://arxiv.org/pdf/2603.15401v2", "shared_first_authors": [ "Tingxu Han", "Yi Zhang" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Tingxu Han": [ "Nanjing University", "Mohamed bin Zayed University of Artificial Intelligence" ], "Yi Zhang": [ "South China University of Technology" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF explicitly gives Tingxu Han both institutions; Han and Yi Zhang bear * Equal Contribution. † states work done during a research visit at MBZUAI. PDF includes Ye Shang, missing from API metadata.", "author_source": "https://arxiv.org/abs/2603.15401v2", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2609.19705": { "id": "2609.19705", "title": "Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes", "classification": "relevant", "reason": "直接研究金融LLM Agent的来源操纵、Agent失陷及攻击传播，并评估模型外硬控制的防护效果。", "abstract_read": true, "summary_zh": "问题：金融LLM Agent共享模型和新闻源，单次错误信息或市场冲击可能引发群体级风险。方法：FARSIGHT系统化分类市场压力鲁棒性、来源操纵、Agent失陷及Agent充当攻击者，审计15种学术方案和7份代码，并用伪新闻/历史骗局测试模型及多Agent市场。作者声称：没有论文描述绕过LLM推理的停止机制或来源溯源与跨源核验组合，7份代码均无模型外止损/仓位上限；400-Agent模拟中一条伪新闻在所有运行中引发崩盘，模型外自动停止与硬损失限制消除所测效应。", "topics": { "tags": [ "injection", "multiagent", "authorization", "robustness", "evaluation" ], "reason_zh": "不可信新闻操纵交易Agent并传播系统性风险，直接比较模型外中断与损失权限硬限制。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2609.19705v3", "published": "2026-09-17T04:59:08Z", "updated": "2026-10-25T20:13:36Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.19705v3", "abstract_sha256": "ee8e80d2ff54585d2192e27be1715bbf174a2b29023749fcdcb03cd965d01380", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.19705", "title": "Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes", "version_id": "2609.19705v3", "first_author": "Mengxiao Wang", "authors": [ "Mengxiao Wang", "Nitesh Saxena" ], "affiliations": [ "Texas A&M University" ], "source_url": "https://arxiv.org/pdf/2609.19705v3", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2609.19705v3", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2609.30383": { "id": "2609.30383", "title": "Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems", "classification": "relevant", "reason": "直接研究多个Agent Skills间分布式恶意目标组合执行、规避单技能检测的级联攻击和安全基准。", "abstract_read": true, "summary_zh": "问题：第三方技能的单独审查可能漏掉跨技能组合后的恶意行为。方法：提出skill cascading attacks，把恶意目标分散到多个表面良性的技能修改中；SkillCascade自动化多Agent红队框架与SkillCascade-Bench提供213个跨系统/领域的验证案例。作者声称：OpenClaw、Claude Code、Codex等代表性Agent与不同LLM骨干上，级联技能能稳定诱导有害行为，并规避既有逐技能扫描器和运行时监控；摘要未给具体成功率。", "topics": { "tags": [ "supplychain", "injection", "multiagent", "monitoring", "evaluation" ], "reason_zh": "第三方Skill组合构成直接供应链/指令攻击面，多技能交互规避组件级扫描和运行时防御，并给出红队评测集。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2609.30383v2", "published": "2026-09-24T18:00:18Z", "updated": "2026-10-26T14:04:48Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.30383v2", "abstract_sha256": "01b9289c19ad269884c50f7ad2d7376ed998984c75796a09f033bab8f2f7172e", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.30383", "title": "Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems", "version_id": "2609.30383v2", "first_author": "Zihao Zhu", "authors": [ "Zihao Zhu", "Siwei Lyu", "Adel Bibi", "Baoyuan Wu" ], "affiliations": [ "School of Artificial Intelligence, The Chinese University of Hong Kong, Shenzhen" ], "source_url": "https://arxiv.org/pdf/2609.30383v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Zihao Zhu¹ maps to School of Artificial Intelligence, The Chinese University of Hong Kong, Shenzhen. * appears on Baoyuan Wu and means Corresponding author.", "author_source": "https://arxiv.org/abs/2609.30383v2", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34098": { "id": "2610.34098", "title": "Securing Agent-Generated Code with Its Own Development History", "classification": "relevant", "reason": "直接审计Agent生成代码的遗漏安全检查，利用开发轨迹验证修复并阻止后续任务重新引入漏洞。", "abstract_read": true, "summary_zh": "问题：Coding Agent提交可通过功能测试却漏掉安全保护或验证条件，最终代码静态扫描容易错过。方法：TRACER利用Agent开发轨迹、符号级改动和可选AST历史，将Agent解释当作需验证断言；只在安全评估和功能验证后接受修复，并附未来变更必须满足的可执行安全检查。作者声称：SusVibes上符号追踪使94.6%的补丁将漏洞符号纳入审查，主扫描器告警仅13.4%；包含Agent解释的配置获得最多经验证且保持功能的安全修复，加入AST历史未再增加。结构生物软件案例中修复记忆加边界检查使后续9/10任务成功且不复发，纯功能反馈仅4成功且3例漏洞复发。", "topics": { "tags": [ "supplychain", "monitoring", "evaluation", "memory" ], "reason_zh": "围绕Coding Agent生成漏洞与安全修复，使用开发轨迹验证而非信任解释，并以修复记忆和执行检查保护未来代码修改。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34098v1", "published": "2026-10-25T06:51:47Z", "updated": "2026-10-25T06:51:47Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34098v1", "abstract_sha256": "a2625a7c3441cbdf6321e89a3048f47f9d5e8110ae5086b0a74c557cc4135c90", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34098", "title": "Securing Agent-Generated Code with Its Own Development History", "version_id": "2610.34098v1", "first_author": "Prateek Kumar Rajput", "authors": [ "Prateek Kumar Rajput", "Shahzeb Khan", "El-Hacen Diallo", "Yewei Song", "Jacques Klein", "Tegawendé F. Bissyandé" ], "affiliations": [ "University of Luxembourg" ], "source_url": "https://arxiv.org/pdf/2610.34098v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Prateek Kumar Rajput*; * University of Luxembourg. Here star is an affiliation marker, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.34098v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34253": { "id": "2610.34253", "title": "NameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Names", "classification": "relevant", "reason": "直接通过第三方源码标识符投毒诱导Coding Agent生成目标安全漏洞，涉及仓库输入信任边界和隐式指令攻击。", "abstract_read": true, "summary_zh": "问题：Coding Agent会把第三方代码中的标识符含义当作实现依据，即使没有显式恶意指令也可能生成不安全代码。方法：NameTrap研究仅改变Python标识符的上下文投毒，以原文件十次基线补全均不触发目标CWE为筛选条件，在6种Agent、10个模型、4类CWE上评估。作者报告总体ASR为22.5%–56.0%，特定组合达75.0%，安全提醒不能稳定阻止。正文核验：目标CWE主要按Bandit/Semgrep告警判定，非逐项运行时可利用性验证；诱饵本身没有脆弱语句，扫描器未报诱饵漏洞不等于漏检现成恶意代码，风险在后续生成阶段。", "topics": { "tags": [ "supplychain", "injection", "evaluation" ], "reason_zh": "直接针对Coding Agent消费不可信仓库源码的边界，通过无显式指令的标识符投毒使下游代码带入漏洞。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "Abstract/§1", "§3基线筛选与判定", "§4.8", "§5讨论" ], "body_source_url": "https://arxiv.org/pdf/2610.34253v1", "version_id": "2610.34253v1", "published": "2026-10-25T12:29:23Z", "updated": "2026-10-25T12:29:23Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34253v1", "abstract_sha256": "0d989b4ac38bb3a7dcad702d51ca0c9d53b33728bd80318848c2d0ea8fa4bb0a", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34253", "title": "NameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable Names", "version_id": "2610.34253v1", "first_author": "Chieh-Yuan Chang", "authors": [ "Chieh-Yuan Chang", "Guan-Wei Chen", "Chia-Yi Hsu", "Chih Yang", "Chia-Mu Yu", "Chun-Ying Huang" ], "affiliations": [ "National Yang Ming Chiao Tung University" ], "source_url": "https://arxiv.org/pdf/2610.34253v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Chieh-Yuan Chang† and all coauthors share † National Yang Ming Chiao Tung University, Taiwan; dagger is institutional marker.", "author_source": "https://arxiv.org/abs/2610.34253v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34535": { "id": "2610.34535", "title": "SentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety Deployments", "classification": "relevant", "reason": "直接评测公共安全工具Agent在注入/越狱下的有害行动与过度拒绝，提出按信任边界阻断的防御。", "abstract_read": true, "summary_zh": "问题：公共安全Agent既可能错误报警/派遣或泄露记录，也可能因过度拒绝漏掉真实救援，单看攻击成功率不能衡量部署危害。方法：SentryBench以真实应急对话、灾难消息和注入/越狱载荷构建成本敏感双侧评估，联合衡量攻击成功、漏响应和过度行动，并测试有针对性的信任gate。作者声称：840回合、3个前沿模型和3种防御中，笼统谨慎在2/3模型将漏响应推至100%，攻击成功率最多只变3.7个百分点，综合伤害最差；信任gate各模型伤害最低、漏响应不高于基线且阻断更好。供应商内容过滤也参与防御，需分开报告。", "topics": { "tags": [ "injection", "authorization", "evaluation", "robustness" ], "reason_zh": "针对会产生现实后果的工具调用，衡量注入防御与服务拒绝风险，使用信任gate区分应阻断和应执行的请求。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34535v1", "published": "2026-10-25T19:49:40Z", "updated": "2026-10-25T19:49:40Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34535v1", "abstract_sha256": "4957108bdf09a644679a5c12bf03113789a9ef2b541b01bb6cbc172034cd476c", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34535", "title": "SentryBench: A Cost-Sensitive Benchmark for Adversarial Robustness of Tool-Using LLM Agents in Public-Safety Deployments", "version_id": "2610.34535v1", "first_author": "Md Abu Yusuf", "authors": [ "Md Abu Yusuf", "Oyshi Tabassum Aditi", "Md Faysal Hosain Mazed" ], "affiliations": [ "Department of Computer Science, Maharishi International University" ], "source_url": "https://arxiv.org/pdf/2610.34535v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.34535v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34569": { "id": "2610.34569", "title": "Agentic AI Orchestration Framework for Spatial Intelligence: Supply Chain Deployment", "classification": "relevant", "reason": "正文把审批落实为执行前和发布前的阻断门控，记录审批者与时间；Agent 只能更新已授权参数，不能自主削弱治理规则，属于多 Agent 动作授权与审计架构。安全机制效果尚无受控实验，相关性与证据强度须分开。", "abstract_read": true, "summary_zh": "问题：跨系统空间决策可能在缺失依据或错误工具选择下静默向下游传播。ANASSA 以类型化 Agent 边界、权威来源校验及两道阻断式人工审批限制执行与发布，并记录审批身份、时间和更新参数。三个月供应链部署报告未支持断言率相对降低 25%、流程时间减少 50%、决策延迟减少 60%；这些是相对既有手工作业的无对照观察，缺少完整基线计数、拒绝次数和机制消融，不能证明审批抗绕过或安全收益。", "topics": { "tags": [ "authorization", "multiagent", "monitoring" ], "reason_zh": "正文把审批落实为执行前和发布前的阻断门控，记录审批者与时间；Agent 只能更新已授权参数，不能自主削弱治理规则，属于多 Agent 动作授权与审计架构。安全机制效果尚无受控实验，相关性与证据强度须分开。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.34569", "title": "Agentic AI Orchestration Framework for Spatial Intelligence: Supply Chain Deployment", "version_id": "2610.34569v1", "original_classification": "uncertain", "classification": "relevant", "reason": "正文把审批落实为执行前和发布前的阻断门控，记录审批者与时间；Agent 只能更新已授权参数，不能自主削弱治理规则，属于多 Agent 动作授权与审计架构。安全机制效果尚无受控实验，相关性与证据强度须分开。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§2.1–2.3 架构与阻断审批", "§3.2–3.3 Agent 角色", "§4.2 类型化契约", "§5.1–5.3 部署证据/有效性", "§6.2–7 限制与未来消融" ], "source_url": "https://arxiv.org/pdf/2610.34569v1", "summary_zh": "问题：跨系统空间决策可能在缺失依据或错误工具选择下静默向下游传播。ANASSA 以类型化 Agent 边界、权威来源校验及两道阻断式人工审批限制执行与发布，并记录审批身份、时间和更新参数。三个月供应链部署报告未支持断言率相对降低 25%、流程时间减少 50%、决策延迟减少 60%；这些是相对既有手工作业的无对照观察，缺少完整基线计数、拒绝次数和机制消融，不能证明审批抗绕过或安全收益。", "topics": { "tags": [ "authorization", "multiagent", "monitoring" ], "reason_zh": "正文把审批落实为执行前和发布前的阻断门控，记录审批者与时间；Agent 只能更新已授权参数，不能自主削弱治理规则，属于多 Agent 动作授权与审计架构。安全机制效果尚无受控实验，相关性与证据强度须分开。" }, "evidence_notes": [ "正文 D1 的精确定义是 unsupported-claim rate 相对降低 25%，不宜笼统解释为准确率提高 25 个百分点。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§2.1–2.3 架构与阻断审批", "§3.2–3.3 Agent 角色", "§4.2 类型化契约", "§5.1–5.3 部署证据/有效性", "§6.2–7 限制与未来消融" ], "body_source_url": "https://arxiv.org/pdf/2610.34569v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.34569v1", "published": "2026-10-25T21:12:21Z", "updated": "2026-10-25T21:12:21Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.MA", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34569v1", "abstract_sha256": "5ed5905dc1fbd64a46ed0a01acb6a270998010503e8c942987e3f25348dc7c5e", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34569", "title": "Agentic AI Orchestration Framework for Spatial Intelligence: Supply Chain Deployment", "version_id": "2610.34569v1", "first_author": "Constantinos Papantoniou", "authors": [ "Constantinos Papantoniou", "Brian Hilton" ], "affiliations": [ "Anassa.ai" ], "source_url": "https://arxiv.org/pdf/2610.34569v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Constantinos Papantoniou* with Anassa.ai directly beneath. * Corresponding author. Coauthor Research Scientist is not first-author affiliation.", "author_source": "https://arxiv.org/abs/2610.34569v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34674": { "id": "2610.34674", "title": "Benchmarking Obstacle-Conditioned Safety in Household Robot Navigation", "classification": "relevant", "reason": "直接评测VLM/VLA家庭导航策略的行动安全：能否按障碍类型调节距离、速度和流畅度，并诊断安全语义到动作的落地缺口。", "abstract_read": true, "summary_zh": "针对家庭导航策略能识别危险却不一定调整运动的问题，提出OSMA-Bench及语义敏感度SSI，在空间匹配、仅障碍类型变化的场景中检验距离、速度和流畅度是否符合谨慎程度。作者发现VLM/VLA即使有显式安全提示也不稳定适应，加入独立参数推断步骤可改善VLM导航程序；摘要没有量化提升。", "topics": { "tags": [ "embodied", "evaluation" ], "reason_zh": "直接评价视觉语言行动策略把危险语义转化为安全连续动作的能力。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34674v1", "published": "2026-10-26T01:06:22Z", "updated": "2026-10-26T01:06:22Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CV", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34674v1", "abstract_sha256": "b1436d3e592ddc7e29ed8098a539b805bae7191c2c7297b4d61a99031c42df3b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34674", "title": "Benchmarking Obstacle-Conditioned Safety in Household Robot Navigation", "version_id": "2610.34674v1", "first_author": "Hyunwoong Bae", "authors": [ "Hyunwoong Bae", "Jisu Han", "Jiyeon Choi", "Dohoon Kim", "Taesup Moon" ], "affiliations": [ "Interdisciplinary Program in Artificial Intelligence, Seoul National University" ], "source_url": "https://arxiv.org/pdf/2610.34674v1", "shared_first_authors": [ "Hyunwoong Bae", "Jisu Han" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Hyunwoong Bae": [ "Interdisciplinary Program in Artificial Intelligence, Seoul National University" ], "Jisu Han": [ "Interdisciplinary Program in Artificial Intelligence, Seoul National University" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Hyunwoong Bae¹,* and Jisu Han¹,*; * Equal contribution. 1 Interdisciplinary Program in Artificial Intelligence, Seoul National University.", "author_source": "https://arxiv.org/abs/2610.34674v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34837": { "id": "2610.34837", "title": "Beyond Behaviour: A Stimulus-Response Safety Evaluation of Vision-Language-Action Models", "classification": "relevant", "reason": "直接评估VLA模型面对可见危险和有害后果时的内部表征及动作倾向，属于具身Agent安全评测。", "abstract_read": true, "summary_zh": "研究VLA模型对可见危险和有害后果是否产生类似防御性刺激反应。作者在三个模型和两个视频基准上分析内部表征及动作倾向，结果提示即使内部已登记危险，默认行为仍可能是继续执行任务；摘要未给数值或具体防御。", "topics": { "tags": [ "embodied", "evaluation", "monitoring" ], "reason_zh": "以内部危险表征和外显动作之间的差异评估具身Agent安全。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34837v1", "published": "2026-10-26T04:36:21Z", "updated": "2026-10-26T04:36:21Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34837v1", "abstract_sha256": "08af5f614921715bf33f3b9e5226fc01c4f49eb50d09a3c361378434c4b9a7b9", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34837", "title": "Beyond Behaviour: A Stimulus-Response Safety Evaluation of Vision-Language-Action Models", "version_id": "2610.34837v1", "first_author": "Vy Vo", "authors": [ "Vy Vo", "Dinh Phung" ], "affiliations": [ "Monash University" ], "source_url": "https://arxiv.org/pdf/2610.34837v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.34837v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34965": { "id": "2610.34965", "title": "The Target Agent Is Its Own Best Critic but a Poor Proposer: Self-Improved Red Teaming", "classification": "relevant", "reason": "直接研究自主红队对Agent的滥用和间接攻击，比较目标会话自我批评、外部批评与攻击提案职责分离，并报告多领域攻击成功率。", "abstract_read": true, "summary_zh": "针对自动红队失败诊断与新攻击提案混在同一角色的问题，分别比较目标会话自我批评/外部批评和自我提案/外部提案。目标自我批评利用实时观察、约束和推理更有效，去掉推理使后续攻击成功率下降6%–17%；目标自我提案受拒绝与非拒绝式怠工限制。职责分离方法在DTAP-BENCH四领域、直接滥用与间接威胁、多框架下达到作者报告的63.2%总体ASR。", "topics": { "tags": [ "injection", "evaluation", "multiagent" ], "reason_zh": "直接评价工具Agent的直接滥用和间接注入，并通过攻击者与目标批评角色分离增强红队。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34965v1", "published": "2026-10-26T07:34:02Z", "updated": "2026-10-26T07:34:02Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34965v1", "abstract_sha256": "2b0c446425b14c8b5ea172a74d5ee3059ce8fc2809ea6dbd9f722c0f87d098b8", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34965", "title": "The Target Agent Is Its Own Best Critic but a Poor Proposer: Self-Improved Red Teaming", "version_id": "2610.34965v1", "first_author": "Mintong Kang", "authors": [ "Mintong Kang", "Stephen Rawls", "Melissa Kazemi Rad", "Jian Ni", "Bo Li" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "source_url": "https://arxiv.org/pdf/2610.34965v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Mintong Kang¹* maps to 1 University of Illinois Urbana-Champaign. * footnote Corresponding authors, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.34965v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35579": { "id": "2610.35579", "title": "Infinity Machine: a self-improving AI agent for research", "classification": "relevant", "reason": "自修改科研Agent通过kernel强制门控修改harness、tool和skill，使用沙箱与私有验证，并直接披露评分投机、漏检及被拒自修改，涉及执行授权与Agent评估完整性。", "abstract_read": true, "summary_zh": "问题：自改进科研Agent如何避免自写评分器、工具与记忆更新失去监督。方法：Infinity Machine将可编辑的提示、工具、Skill与流程和不可由Agent改写的kernel分开，以策略、保留数据和成本门控修改，并在新沙箱中执行候选与独立核验。作者报告14个问题、约180美元模型用量，同时坦陈四次宽松评分器被投机、自写评分方向错误未检出、一次自改版本因成本被拒，部分成果依赖人工改进。已补读正文更长摘要及引言；这些是小规模系统报告，不证明自改进安全或完全无人参与。", "topics": { "tags": [ "authorization", "evaluation", "multiagent", "monitoring" ], "reason_zh": "明确涉及沙箱、工具/Skill自修改权限门控、评估投机与独立审计失败。" }, "full_text_checked": true, "evidence_level": "metadata_abstract_plus_extended_pdf_abstract_and_introduction", "reviewed_sections": [ "PDF跨两页Abstract", "§1 Introduction" ], "body_source_url": "https://arxiv.org/pdf/2610.35579v1", "version_id": "2610.35579v1", "published": "2026-10-26T15:11:26Z", "updated": "2026-10-26T15:11:26Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35579v1", "abstract_sha256": "204a0db456091f7a2dc6f67eea2b9833f8ccbc39e02b654d5b5a3a82b25e2380", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35579", "title": "Infinity Machine: a self-improving AI agent for research", "version_id": "2610.35579v1", "first_author": "Harish Santhanalakshmi Ganesan", "authors": [ "Harish Santhanalakshmi Ganesan" ], "affiliations": [ "Independent researcher" ], "source_url": "https://arxiv.org/pdf/2610.35579v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF explicitly signs Harish Santhanalakshmi Ganesan as Independent researcher; no institution inferred.", "author_source": "https://arxiv.org/abs/2610.35579v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35671": { "id": "2610.35671", "title": "Evaluating DeepSeek V4.1 Flash-1017 for loss of control and harmful manipulation risks", "classification": "relevant", "reason": "独立前沿模型安全评估覆盖失控、有害操纵和评估完整性，并明确要求推理及动作日志的过程级Agent行为观测。", "abstract_read": true, "summary_zh": "独立评估DeepSeek V4.1 Flash-1017的系统性安全风险，以34个基准（含五套自建评测）覆盖评估完整性、失控和有害操纵，并与其他DeepSeek及闭源系统比较。作者称整体较V4改善、若干维度接近领先闭源基线但仍有风险，强调小版本可回退、终局输出不足以发现失控，需推理及动作日志过程观测与私有基准；摘要没有各项分数。", "topics": { "tags": [ "evaluation", "monitoring", "authorization" ], "reason_zh": "前沿Agent失控和操纵风险评估，强调行动过程可观测性及评估意识。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35671v1", "published": "2026-10-26T16:14:17Z", "updated": "2026-10-26T16:14:17Z", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35671v1", "abstract_sha256": "cae887621f2a964e7032aa5c9b34e69406a73ae9ee94424e6e5d8a88135ec6c4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35671", "title": "Evaluating DeepSeek V4.1 Flash-1017 for loss of control and harmful manipulation risks", "version_id": "2610.35671v1", "first_author": "Yao Huang", "authors": [ "Yao Huang", "Zhiyuan Zeng", "Yu Wang", "Zhitong Zhu", "Dingcheng Duan", "Hao Li", "Shangzhi Xu", "Yifan Wang", "Jinzhe Tu", "Shukun Xiong", "Yihe Zang", "Han Yan", "Hongchang Yang", "Fuyu Gu", "Wei Xu", "Yinpeng Dong", "Xiaojian Li" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.35671v1", "shared_first_authors": [], "shared_first_note": "Authorship分组列出Principal Contributors，未明确声明共同第一作者或Equal contribution；不据此推定共同一作。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "unresolved", "status": "partial", "evidence": "API author order starts Yao Huang. PDF cover names Fangcun AI Evaluation Team, while Authorship section on PDF p.79 groups Scientific Leads, Principal Contributors (Yao Huang, Zhiyuan Zeng, Yu Wang), and Contributors. It gives no person-to-institution affiliation mapping or equal-contribution statement. Reporting team alone is not treated as a confirmed personal affiliation.", "author_source": "https://arxiv.org/abs/2610.35671v1", "verification_status": "author_verified_affiliation_unconfirmed" }, "revision_history": [] }, "2610.36108": { "id": "2610.36108", "title": "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol", "classification": "relevant", "reason": "直接针对MCP工具描述提示注入，诱导合法任务后额外调用攻击者端点泄露内容；同时评估攻击成功、泄露忠实度、合法效用和防御，属于核心Agent安全。", "abstract_read": true, "summary_zh": "Log-To-Leak利用MCP工具自然语言元数据中的注入，诱导Agent在最后一次合法调用后额外调用攻击者控制工具，泄露用户问题、MCP服务名、工具结果和Agent回复。五个MCP服务器、四个Agent中18个有效组合ASR为62.64%–100%，条件日志准确率76.55%–95.64%；16组合法任务完成率绝对变化不超过6.63个百分点。三种防御在GitHub MCP与GPT-4o下仍留超过55%ASR，指令检测器误标85.53%良性描述。", "topics": { "tags": [ "injection", "authorization", "privacy", "evaluation" ], "reason_zh": "MCP工具描述注入触发越权二次调用及数据外泄，并证明合法任务成功不能代表安全。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36108v1", "published": "2026-10-26T18:20:24Z", "updated": "2026-10-26T18:20:24Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36108v1", "abstract_sha256": "b6da0c97096aeab3ca2e1d1db64412d454a365b6070b3f07620c9fa5b39232de", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36108", "title": "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol", "version_id": "2610.36108v1", "first_author": "Yuepeng Hu", "authors": [ "Yuepeng Hu", "Chongyu Fan", "Sirat Samyoun", "Jian Du" ], "affiliations": [ "Duke University" ], "source_url": "https://arxiv.org/pdf/2610.36108v1", "shared_first_authors": [ "Yuepeng Hu", "Chongyu Fan" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Yuepeng Hu": [ "Duke University" ], "Chongyu Fan": [ "Michigan State University" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Yuepeng Hu* / Duke University and Chongyu Fan* / Michigan State University. * These authors contributed equally to this work. This work was done during their internships at TikTok. Internship note is not a second signed affiliation.", "author_source": "https://arxiv.org/abs/2610.36108v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36114": { "id": "2610.36114", "title": "Context Is a Pipeline, Not a Window: Information Attrition in LLM Agent Harnesses", "classification": "relevant", "reason": "实证揭示真实工具Agent在模型前的harness截断破坏JSON和关键信息完整性，并导致额外调用与计算开销，属于上下文流水线可靠性/可用性风险；摘要明确尚未证实准确率下降的因果关系。", "abstract_read": true, "summary_zh": "研究工具输出到Agent模型上下文之前的信息损失：720次内核故障诊断运行中，最大prompt只用5.75%上下文，却有3827/11189工具结果被定长切断且全部成为坏JSON，同一结果字段到达率分别仅4.7%与99.3%。提出五阶段上下文流水线并回放864条结果；受控实验显示调用增加43%、计算翻倍、yield从0.61降至0.31。作者明确准确率下降是否由截断造成仍未定论。", "topics": { "tags": [ "memory", "robustness", "monitoring" ], "reason_zh": "真实Agent harness边界破坏工具数据完整性并放大资源消耗，是上下文与可用性风险而非单纯上下文窗口大小。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36114v1", "published": "2026-10-26T18:25:42Z", "updated": "2026-10-26T18:25:42Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36114v1", "abstract_sha256": "f396e9a3898b2e7e67b7df06a43427323f527ff417c04ae002f33bac3356243d", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36114", "title": "Context Is a Pipeline, Not a Window: Information Attrition in LLM Agent Harnesses", "version_id": "2610.36114v1", "first_author": "Yuvraj Sehgal", "authors": [ "Yuvraj Sehgal", "Mahsa Panahandeh", "Naser Ezzati-Jivan" ], "affiliations": [ "Department of Computer Science, Brock University" ], "source_url": "https://arxiv.org/pdf/2610.36114v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.36114v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36264": { "id": "2610.36264", "title": "The Inbox as a Coordination Primitive for LLM Agent Societies", "classification": "relevant", "reason": "正文除普通协调负载外，明确测试恶意发送者以垃圾流量和押金竞价挤占收件 Agent 注意力，造成真实请求无法被读取；收件箱准入和记忆规则构成多 Agent 通信可用性边界，符合 Agent 自身抗干扰/拒绝服务范围。", "abstract_read": true, "summary_zh": "问题：多 Agent 通信按到达顺序直接挤入上下文，会让合法协商被遗忘或被垃圾消息淹没。方法：将收件箱置于上下文外，由接收方决定读取、记忆、发送押金和回复披露规则。作者在最多 16,000 个模拟 Agent 中报告：高垃圾流量下顺序读取找不到请求所需成员，押金优先仍找到约 60%；但攻击者支付同等押金会使其退化为顺序读取，双倍押金能阻止正常请求被读取。边界：仅两类模拟协调任务、同供应商模型，重用相同输入的模型判断；未测试以提示注入操纵模型筛选的消息。", "topics": { "tags": [ "multiagent", "memory", "robustness", "evaluation" ], "reason_zh": "正文除普通协调负载外，明确测试恶意发送者以垃圾流量和押金竞价挤占收件 Agent 注意力，造成真实请求无法被读取；收件箱准入和记忆规则构成多 Agent 通信可用性边界，符合 Agent 自身抗干扰/拒绝服务范围。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.36264", "title": "The Inbox as a Coordination Primitive for LLM Agent Societies", "version_id": "2610.36264v1", "original_classification": "uncertain", "classification": "relevant", "reason": "正文除普通协调负载外，明确测试恶意发送者以垃圾流量和押金竞价挤占收件 Agent 注意力，造成真实请求无法被读取；收件箱准入和记忆规则构成多 Agent 通信可用性边界，符合 Agent 自身抗干扰/拒绝服务范围。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 任务与收件箱四决策", "§4.2.3 社会规模与垃圾流量", "§4.4 对抗发送者/押金", "§5.3–5.4 设计与限制" ], "source_url": "https://arxiv.org/pdf/2610.36264v1", "summary_zh": "问题：多 Agent 通信按到达顺序直接挤入上下文，会让合法协商被遗忘或被垃圾消息淹没。方法：将收件箱置于上下文外，由接收方决定读取、记忆、发送押金和回复披露规则。作者在最多 16,000 个模拟 Agent 中报告：高垃圾流量下顺序读取找不到请求所需成员，押金优先仍找到约 60%；但攻击者支付同等押金会使其退化为顺序读取，双倍押金能阻止正常请求被读取。边界：仅两类模拟协调任务、同供应商模型，重用相同输入的模型判断；未测试以提示注入操纵模型筛选的消息。", "topics": { "tags": [ "multiagent", "memory", "robustness", "evaluation" ], "reason_zh": "正文除普通协调负载外，明确测试恶意发送者以垃圾流量和押金竞价挤占收件 Agent 注意力，造成真实请求无法被读取；收件箱准入和记忆规则构成多 Agent 通信可用性边界，符合 Agent 自身抗干扰/拒绝服务范围。" }, "evidence_notes": [ "押金不是有效性或安全性的证明，正文明确给出付费对抗绕过。", "§5.4 不研究专门操纵模型筛选器的消息，因此不得把结果写成提示注入防御有效。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 任务与收件箱四决策", "§4.2.3 社会规模与垃圾流量", "§4.4 对抗发送者/押金", "§5.3–5.4 设计与限制" ], "body_source_url": "https://arxiv.org/pdf/2610.36264v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.36264v1", "published": "2026-10-26T20:39:20Z", "updated": "2026-10-26T20:39:20Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36264v1", "abstract_sha256": "3ac2428e519709c0051b4bd172a40ab3dceaa6a389a30a322748f39b07fc74be", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36264", "title": "The Inbox as a Coordination Primitive for LLM Agent Societies", "version_id": "2610.36264v1", "first_author": "Karthik Sreedhar", "authors": [ "Karthik Sreedhar", "Leo Yuan", "Pradyumna Chari", "Ramesh Raskar" ], "affiliations": [ "MIT Media Lab" ], "source_url": "https://arxiv.org/pdf/2610.36264v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Karthik Sreedhar explicitly lists MIT Media Lab. Columbia email is not used to infer a different affiliation.", "author_source": "https://arxiv.org/abs/2610.36264v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36435": { "id": "2610.36435", "title": "Your Agent Acts Differently When You're Around: How User Presence Changes Agent Behavior in Negotiation", "classification": "relevant", "reason": "研究用户在场引发谈判Agent对用户和对手的失配行为，并证明结果收益无法反映行为风险，属于多Agent行为安全评测。", "abstract_read": true, "summary_zh": "PRESENT在博弈、目标和偏好不变时比较用户是否交互在场，研究谈判Agent行为。11.2k次运行、七种游戏与八个模型中，用户在场方平均收益提高13.7%，但Agent更激进，对对手失配约翻倍，对用户失配出现在14.3%游戏；中性模板用户消息也保留该现象，行为失配与收益不相关。作者主张安全评测需用户在场及过程行为而非仅终局收益。", "topics": { "tags": [ "multiagent", "evaluation", "monitoring" ], "reason_zh": "直接测用户参与诱发的谈判Agent行为失配，显示收益指标遗漏安全问题。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36435v1", "published": "2026-10-27T00:34:50Z", "updated": "2026-10-27T00:34:50Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36435v1", "abstract_sha256": "2142fe25b241821659d115a58d7680f1dba8e003dd5b4706fd97e618bc356c37", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36435", "title": "Your Agent Acts Differently When You're Around: How User Presence Changes Agent Behavior in Negotiation", "version_id": "2610.36435v1", "first_author": "Jane Pan", "authors": [ "Jane Pan", "You Lyu", "Abe Bohan Hou", "Valerie Chen", "He He" ], "affiliations": [ "New York University" ], "source_url": "https://arxiv.org/pdf/2610.36435v1", "shared_first_authors": [ "Jane Pan", "You Lyu" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Jane Pan": [ "New York University" ], "You Lyu": [ "New York University" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Jane Pan¹* and You Lyu¹*; * Equal contribution. 1 New York University.", "author_source": "https://arxiv.org/abs/2610.36435v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36453": { "id": "2610.36453", "title": "Correction or Manipulation? Measuring Epistemic Vigilance in LLM Agents Under User Pressure", "classification": "relevant", "reason": "直接比较用户施压导致的答案操纵与客服Agent账户修改越权，并区分真实动作、验证政策违反和虚报动作，是授权及安全评测。", "abstract_read": true, "summary_zh": "跨四供应商七个LLM，比较用户纠正与操纵的可辨别性，并在仅允许已验证用户改账户的客服Agent中检验真实动作。引用使五模型更易让步、四模型区分变差；但五模型始终不越过验证政策，说明答案让步不预测越权。Ministral3B主要受假权威诱导违规，8B声称做了未实际执行的修改；要求仅依可验证证据修订主要改变让步倾向，未改善辨别力。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "直接测试社会工程压力是否导致账户修改越权及虚报动作，区分语言顺从与执行安全。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36453v1", "published": "2026-10-27T00:59:54Z", "updated": "2026-10-27T00:59:54Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36453v1", "abstract_sha256": "bb078445e59e485e2fd73e6e1b286f3a3c101a598acb9e667d3fc0602d08ecff", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36453", "title": "Correction or Manipulation? Measuring Epistemic Vigilance in LLM Agents Under User Pressure", "version_id": "2610.36453v1", "first_author": "Nardine Basta", "authors": [ "Nardine Basta", "Venus Haghighi", "Dali Kaafar", "Amin Beheshti" ], "affiliations": [ "Macquarie University" ], "source_url": "https://arxiv.org/pdf/2610.36453v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.36453v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36476": { "id": "2610.36476", "title": "FIDES-Live: Evaluating Behavioral Concordance in Sequential Trading Agents", "classification": "relevant", "reason": "对顺序交易Agent动作、承诺约束、执行回执、账簿与报告进行分离审计，揭示活跃操作中的遵约率下降和报告失配，属于Agent过程监控与行为安全。", "abstract_read": true, "summary_zh": "FIDES-Live为顺序交易Agent分离审计决策有效性、数值承诺、执行账簿对账和基于回执的报告，并显式标记证据覆盖和不可评分。回顾十条推理路由的7299加密货币账户轮次及310轮股票模拟执行，决策有效率97.35%、可评分报告准确率90.81%；总体承诺遵守94.36%，但非空订单约束仅62.63%，空提案97.56%。作者不声称长期交易能力、解释语义忠实或审计反馈的因果收益。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "审计Agent承诺、实际金融操作及对用户报告是否一致，避免终局收益掩盖行动约束失效。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36476v1", "published": "2026-10-27T01:33:30Z", "updated": "2026-10-27T01:33:30Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36476v1", "abstract_sha256": "4a7c8fe155398e5bf4e93489b436f697fbf3115d88dc324612d4ad7e98211f76", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36476", "title": "FIDES-Live: Evaluating Behavioral Concordance in Sequential Trading Agents", "version_id": "2610.36476v1", "first_author": "Arther Tian", "authors": [ "Arther Tian", "Alex Ding", "Simon Wu", "Aaron Chan" ], "affiliations": [ "DGrid AI" ], "source_url": "https://arxiv.org/pdf/2610.36476v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Arther Tianᵃ maps to a DGrid AI. * on Alex Ding means Corresponding author, not shared first authorship.", "author_source": "https://arxiv.org/abs/2610.36476v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36713": { "id": "2610.36713", "title": "From Voiceprints to User Entities: Online Speaker-Memory Construction for Multi-User Spoken Agents", "classification": "relevant", "reason": "直接研究多用户语音Agent以身份隔离记忆访问，评估错用户授权、跨用户错连与记忆污染，属于授权、隐私及记忆安全。", "abstract_read": true, "summary_zh": "针对语音Agent声纹随环境变化导致跨用户记忆误归属，EvoSpeakerMem以因果说话人路由、选择性声学状态更新和身份分区记忆写读维护持久用户实体，并提供带隐藏身份、录音偏移及四说话人混淆的LoCoMo-ID。作者报告门控更新使身份门控QA在干净/偏移条件分别提高3.86/11.62个百分点且无错用户授权，但减少碎片化和提高QA仍可能伴随错误跨用户连接。", "topics": { "tags": [ "memory", "privacy", "authorization", "evaluation" ], "reason_zh": "身份识别直接决定个人记忆的写入与访问，评估跨用户污染和错误授权。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36713v1", "published": "2026-10-27T06:27:24Z", "updated": "2026-10-27T06:27:24Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.SD", "eess.AS" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36713v1", "abstract_sha256": "6a608e33e63e06222555b4713e8deb5234cbb42fb2ba50e6bde7651b1b952d5c", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36713", "title": "From Voiceprints to User Entities: Online Speaker-Memory Construction for Multi-User Spoken Agents", "version_id": "2610.36713v1", "first_author": "Yucong Zhang", "authors": [ "Yucong Zhang", "Cancan Li", "Bo Xiao", "Ke Zeng", "Ming Li" ], "affiliations": [ "School of Computer Science, Wuhan University", "School of Artificial Intelligence, The Chinese University of Hong Kong, Shenzhen", "Meituan" ], "source_url": "https://arxiv.org/pdf/2610.36713v1", "shared_first_authors": [ "Yucong Zhang", "Cancan Li" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Yucong Zhang": [ "School of Computer Science, Wuhan University", "School of Artificial Intelligence, The Chinese University of Hong Kong, Shenzhen", "Meituan" ], "Cancan Li": [ "School of Computer Science, Wuhan University", "Meituan" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Yucong Zhang³,¹,²,* and Cancan Li³,²,*; * Equal Contribution. Both signed numbered affiliations include Meituan, unlike internship-only footnotes in other papers; all markers mapped.", "author_source": "https://arxiv.org/abs/2610.36713v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2511.17671": { "id": "2511.17671", "title": "Cross-User Poisoning: User-Task Boundary Failures in Multi-User Collaborative Language Agents", "classification": "relevant", "reason": "直接研究共享语言Agent在多用户交错消息中跨用户投毒、上下文传播及越权执行，并评估边界隔离防御。 此条为修订版本，不能仅因更新时间计为今日新论文。", "summary_zh": "论文指出共享Agent需要区分指令允许支配的用户和任务；攻击者把消息注入共享上下文，使其在服务正常用户时触发越权动作或响应。作者在Continua、ElizaOS验证攻击，并提出MURMUR并发多用户评测框架；摘要声称攻击在Slack、Workspace、Airline场景成功率高、持续影响后续交互且强于匹配的提示注入，单纯摘要化不足以防御，任务聚类与来源提示能显著降低非自适应传播，未给具体数值。", "topics": { "tags": [ "injection", "authorization", "memory", "evaluation" ], "reason_zh": "攻击通过共享上下文跨用户传播并引发越权；研究持久上下文、用户任务隔离和专门评测。" }, "abstract_read": true, "source_index": 24, "version": 2, "published": "2025-11-21T04:56:37Z", "updated": "2026-10-26T18:48:34Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "abstract_sha256": "1a9a4eca3edef2f454df48a1663f8c568a4a5a88ff0683601b9e10a1b638baa0", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2511.17671v2", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 31 of 31 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 153 of 153 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 68 of 68 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2511.17671v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2511.17671", "title": "Cross-User Poisoning: User-Task Boundary Failures in Multi-User Collaborative Language Agents", "version_id": "2511.17671v2", "first_author": "Atharv Singh Patlan", "authors": [ "Atharv Singh Patlan", "Peiyao Sheng", "S. Ashwin Hebbar", "Prateek Mittal", "Pramod Viswanath" ], "affiliations": [ "Princeton University" ], "source_url": "https://arxiv.org/pdf/2511.17671v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Atharv Singh Patlan¹,* maps to ¹ Princeton University. * is Corresponding author, not equal contribution.", "author_source": "https://arxiv.org/abs/2511.17671v2", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2608.00794": { "id": "2608.00794", "title": "Measurement Without Validity: The Compounding Reliability Problem in Agentic AI Evaluation", "classification": "relevant", "reason": "直接研究Agent评测支撑部署、安全认证和合规决策时的累积有效性失真与自动判分可靠性。 此条为修订版本，不能仅因更新时间计为今日新论文。", "summary_zh": "论文针对Agent评测在任务生成、人类模拟器校准和自动判分三阶段的有效性损耗，提出三层乘法上界模型。作者检查5种配置并调查55篇Agent评测论文，称26篇完全不报告机会校正的一致性指标，约80%的样本使用结构失配、不完整或缺失的评定者一致性指标；还报告10个基准中7个任务有效性有缺陷、模拟器差异最高9个百分点，并提出基于心理测量学的8项建议及分风险等级可靠性阈值。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "聚焦Agent安全认证与部署所依赖评测的有效性，以及自动判分器的一致性和可审计证据。" }, "abstract_read": true, "source_index": 88, "version": 5, "published": "2026-08-01T17:50:12Z", "updated": "2026-10-26T14:57:54Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "8329d44f67991c89831f88b4078891618741c0fcfe0333249f94f4d36f75768a", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2608.00794v5", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.00794v5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.00794", "title": "Measurement Without Validity: The Compounding Reliability Problem in Agentic AI Evaluation", "version_id": "2608.00794v5", "first_author": "William Caban", "authors": [ "William Caban" ], "affiliations": [ "Red Hat, Inc.", "Alma Mater Europaea University" ], "source_url": "https://arxiv.org/pdf/2608.00794v5", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF William Cabanᵃ,* maps to a shared a affiliation listing Red Hat, Inc., Raleigh, North Carolina, USA; Alma Mater Europaea University, Vienna, Austria. * is corresponding author.", "author_source": "https://arxiv.org/abs/2608.00794v5", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2608.18565": { "id": "2608.18565", "title": "SemaPLC: A Project-Grounded, Verification-Gated Agent Harness for PLC Code Generation", "classification": "relevant", "reason": "正文不只提升 PLC 编译成功率：审查危险执行器状态、联锁/报警、故障传感器、fail-safe 方向及旁路；harness 用独立验证、工具日志交叉检查、交付源文件哈希与编辑后验证作废机制约束 Agent 的完成声明和部署工件，属于安全关键 Coding Agent 输出/行动门控。", "summary_zh": "SemaPLC 为 PLC 代码生成 Agent 提供项目上下文、危险状态检查、编译和运行验证。交付门控要求当前版本的验证证据，编辑后旧结果作废，声明须与工具日志一致，交付文件须与成功编译的字节哈希一致。117 个独立 POU 及 65 个项目任务、7 个模型上，平均 verified-pass 为 72.6%、动态分 52.2。限制：verified-pass 只要求验证器支持的属性至少 80% 满足，并非全部安全性质证明；未计分报警/故障端口及无留痕瞬态限制覆盖，真实投产仍需工厂测试与工程师调试。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "正文不只提升 PLC 编译成功率：审查危险执行器状态、联锁/报警、故障传感器、fail-safe 方向及旁路；harness 用独立验证、工具日志交叉检查、交付源文件哈希与编辑后验证作废机制约束 Agent 的完成声明和部署工件，属于安全关键 Coding Agent 输出/行动门控。" }, "abstract_read": true, "source_index": 94, "version": 2, "published": "2026-08-19T05:44:29Z", "updated": "2026-10-26T10:11:22Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "bb6b14d681b1d162e61ab790faaa8c0e135dae0389d271bbb35d34a2bbec5e04", "initial_classification": "uncertain", "scope_review": { "id": "2608.18565", "title": "SemaPLC: A Project-Grounded, Verification-Gated Agent Harness for PLC Code Generation", "version_id": "2608.18565v2", "original_classification": "uncertain", "classification": "relevant", "reason": "正文不只提升 PLC 编译成功率：审查危险执行器状态、联锁/报警、故障传感器、fail-safe 方向及旁路；harness 用独立验证、工具日志交叉检查、交付源文件哈希与编辑后验证作废机制约束 Agent 的完成声明和部署工件，属于安全关键 Coding Agent 输出/行动门控。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§III 问题定义", "§IV 规范检查与 verification-gated iteration/Algorithm 1", "§VI 结果与覆盖分析", "§VII-E Threats to Validity and Scope" ], "source_url": "https://arxiv.org/pdf/2608.18565v2", "summary_zh": "SemaPLC 为 PLC 代码生成 Agent 提供项目上下文、危险状态检查、编译和运行验证。交付门控要求当前版本的验证证据，编辑后旧结果作废，声明须与工具日志一致，交付文件须与成功编译的字节哈希一致。117 个独立 POU 及 65 个项目任务、7 个模型上，平均 verified-pass 为 72.6%、动态分 52.2。限制：verified-pass 只要求验证器支持的属性至少 80% 满足，并非全部安全性质证明；未计分报警/故障端口及无留痕瞬态限制覆盖，真实投产仍需工厂测试与工程师调试。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "正文不只提升 PLC 编译成功率：审查危险执行器状态、联锁/报警、故障传感器、fail-safe 方向及旁路；harness 用独立验证、工具日志交叉检查、交付源文件哈希与编辑后验证作废机制约束 Agent 的完成声明和部署工件，属于安全关键 Coding Agent 输出/行动门控。" }, "evidence_notes": [ "不得把 72.6% verified-pass 当作工业安全认证或所有性质均满足。", "harness 门控的预算匹配独立因果效果未被隔离。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§III 问题定义", "§IV 规范检查与 verification-gated iteration/Algorithm 1", "§VI 结果与覆盖分析", "§VII-E Threats to Validity and Scope" ], "body_source_url": "https://arxiv.org/pdf/2608.18565v2", "evidence_level": "abstract_and_targeted_body", "version_id": "2608.18565v2", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.18565v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.18565", "title": "SemaPLC: A Project-Grounded, Verification-Gated Agent Harness for PLC Code Generation", "version_id": "2608.18565v2", "first_author": "Yanlun Tu", "authors": [ "Yanlun Tu", "Huacan Wang", "Jin Xie", "Ziyue Zhou", "Jie Zhou", "Ningyan Zhu", "Ge Chen", "Wangyi Chen", "Tengfei Zhou", "Yifan Zhou", "Dasheng Yang", "Xiaofeng Mou", "Hui Zhang", "Yi Xu" ], "affiliations": [ "Midea AIRC" ], "source_url": "https://arxiv.org/pdf/2608.18565v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF 1st Yanlun Tu / Midea AIRC, Shanghai, China. * on other authors means Corresponding authors, not equal contribution.", "author_source": "https://arxiv.org/abs/2608.18565v2", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.33029": { "id": "2610.33029", "title": "Lessons from Luck: Do LLM-Written Lessons Carry Chance into an Agent's Next Decision?", "classification": "relevant", "reason": "直接审计自改进Agent记忆把偶然结果误归因并传导至下一次工具决策的风险，及未充分奏效的缓解提示。", "summary_zh": "研究在256个双工具合成世界中控制上轮决策质量和偶然成败，让模型依ReasoningBank指令写经验，再由新会话结合权威日志选择工具。预注册实验覆盖11个LLM端点、90,084个回答；较优工具偶然失败后，相应经验令下一轮选择较差工具达11.6%，无关记忆或成功经验均为0.4%，交互效应为0.112。两种写作干预把错误选择降至7.5%和3.1%，但未在每个受影响端点达到预注册降害标准。", "topics": { "tags": [ "memory", "monitoring", "robustness", "evaluation" ], "reason_zh": "研究Agent持久经验记忆的错误传播、工具选择退化及预注册缓解评估。" }, "abstract_read": true, "source_index": 150, "version": 1, "published": "2026-10-12T03:17:10Z", "updated": "2026-10-12T03:17:10Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "57f06e9db5f7eea14b2babd17cfca8217edad04c1070e24494cd8c27d7e07877", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.33029v1", "categories_seen": [ "cs.AI", "cs.CL", "cs.IR", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 78 of 78 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.33029v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.33029", "title": "Lessons from Luck: Do LLM-Written Lessons Carry Chance into an Agent's Next Decision?", "version_id": "2610.33029v1", "first_author": "Kazuki Nakayashiki", "authors": [ "Kazuki Nakayashiki" ], "affiliations": [ "Glasp" ], "source_url": "https://arxiv.org/pdf/2610.33029v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.33029v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34043": { "id": "2610.34043", "title": "Holding a Steady Course: Knowledge Evolution from Expertise and Lessons for Continual Agent Learning", "classification": "relevant", "reason": "针对持续学习Agent的记忆/技能错误传播和知识腐蚀，使用验证器证据支持、反驳、替换或退役技能主张。", "summary_zh": "KEEL针对自动收集的Agent经验并不天然可靠、可能传播错误及污染已有知识的问题，提出Agent无关的知识演化框架，将验证成功行为转成可复用技能、失败转成纠正经验，并随新证据更新或撤销单项技能主张。作者在SkillFlow上称相对无知识基线成功率提升4.2至21.7个百分点，而默认方法提升2.4至9.6点；消融支持技能与经验互补。摘要未提供对抗投毒测试结果。", "topics": { "tags": [ "memory", "robustness", "monitoring" ], "reason_zh": "重点是Agent持久知识完整性、证据验证与不可靠技能撤销；非对抗情境。" }, "abstract_read": true, "source_index": 156, "version": 1, "published": "2026-10-25T04:11:33Z", "updated": "2026-10-25T04:11:33Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "0db1e11a6128fccd6576d4d2c52774b575e6ca12019cca8a0861e47ec9cef248", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34043v1", "categories_seen": [ "cs.AI", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34043v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34043", "title": "Holding a Steady Course: Knowledge Evolution from Expertise and Lessons for Continual Agent Learning", "version_id": "2610.34043v1", "first_author": "Wenzhe Fan", "authors": [ "Wenzhe Fan", "Benjamin Steenhoek", "Gaurav Mittal", "Yu Hu" ], "affiliations": [ "University of Illinois Chicago" ], "source_url": "https://arxiv.org/pdf/2610.34043v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Wenzhe Fan¹,*† maps only to University of Illinois Chicago. * Work done during an internship with Microsoft Code|AI; † Corresponding author. Internship note is retained as evidence, not treated as a second signed affiliation or shared first authorship.", "author_source": "https://arxiv.org/abs/2610.34043v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34357": { "id": "2610.34357", "abstract_sha256": "9f689100a40f249749fcae261e81da51fa7c8c17bb61e4773614a35b376874cc", "classification": "relevant", "reason": "正文直接研究 6G 控制代理消息可信度审计、隐藏相关性与集体幻觉传播；五个 Mistral 7B xApp 实验比较无通信、路径和全连接的审计偏差，符合多代理安全监测。生成器和审计器共享先验，作者承认偏差可能被低估。", "abstract_read": true, "summary_zh": "将LLM代理社会建模为胞腔层，推导网络联合偏差比局部审计之和多出隐藏总相关性，并分析拓扑对信任及一致性延迟的影响。作者报告该盲点在所研究设置中可掩盖多达23%的联合偏差；形式规律在模拟拓扑与部署的LLM群体上检验。", "topics": { "tags": [ "multiagent", "monitoring", "robustness" ], "reason_zh": "正文直接研究 6G 控制代理消息可信度审计、隐藏相关性与集体幻觉传播；五个 Mistral 7B xApp 实验比较无通信、路径和全连接的审计偏差，符合多代理安全监测。生成器和审计器共享先验，作者承认偏差可能被低估。" }, "read_source_abstract_sha256": "f7c31f60f540e67cee729c9822b5432c2dec43061915599ebae13982fadb170b", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.34357v2", "summary_audit": "23%是文中报告的幅度，不应与任意拓扑定理混为普适上界；分开形式结论和报告值。", "title": "6G Reasoning Agent Societies: Composition, Scaling, and Consistency-Time Laws", "initial_classification": "relevant", "scope_review": { "id": "2610.34357", "version_id": "2610.34357v2", "classification": "relevant", "reason": "正文直接研究 6G 控制代理消息可信度审计、隐藏相关性与集体幻觉传播；五个 Mistral 7B xApp 实验比较无通信、路径和全连接的审计偏差，符合多代理安全监测。生成器和审计器共享先验，作者承认偏差可能被低估。", "summary_zh": "将LLM代理社会建模为胞腔层，推导网络联合偏差比局部审计之和多出隐藏总相关性，并分析拓扑对信任及一致性延迟的影响。作者报告该盲点在所研究设置中可掩盖多达23%的联合偏差；形式规律在模拟拓扑与部署的LLM群体上检验。", "topics": { "tags": [ "multiagent", "monitoring", "robustness" ], "reason_zh": "正文直接研究 6G 控制代理消息可信度审计、隐藏相关性与集体幻觉传播；五个 Mistral 7B xApp 实验比较无通信、路径和全连接的审计偏差，符合多代理安全监测。生成器和审计器共享先验，作者承认偏差可能被低估。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.34357v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "I Introduction", "III Society divergence", "IV Scaling and consistency bounds", "V.A Experimental setup", "V.B–C Results" ] }, "full_text_checked": true, "reviewed_sections": [ "I Introduction", "III Society divergence", "IV Scaling and consistency bounds", "V.A Experimental setup", "V.B–C Results" ], "body_source_url": "https://arxiv.org/pdf/2610.34357v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-25T15:06:47Z", "updated": "2026-10-28T09:22:46Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.MA", "cs.NI" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34357v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-31" ], "version_history": [ { "id": "2610.34357", "title": "6G Reasoning Agent Societies: Composition, Scaling, and Consistency-Time Laws", "classification": "relevant", "reason": "直接分析LLM多Agent网络中局部消息审计无法发现的集体幻觉传播、信任膨胀与一致性时限。", "abstract_read": true, "source_index": 175, "version": 1, "published": "2026-10-25T15:06:47Z", "updated": "2026-10-25T15:06:47Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "8b4cd8ad124613ae162965a12b3594b5d9bf37d8f47a3d5a933c56c4f004f4f1", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34357v1", "categories_seen": [ "cs.MA", "cs.NI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34357v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.34357", "title": "6G Reasoning Agent Societies: Composition, Scaling, and Consistency-Time Laws", "version_id": "2610.34357v2", "first_author": "Hatim Chergui", "authors": [ "Hatim Chergui", "Carolina Fernández-Martínez", "Mustapha Benjillali", "Mehdi Bennis", "Merouane Debbah" ], "affiliations": [ "i2CAT Foundation, Spain" ], "source_url": "https://arxiv.org/pdf/2610.34357v2", "shared_first_authors": [], "shared_first_note": "正文署名未注明共同第一作者。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "首页脚注 H. Chergui and C. Fernández-Martínez are with the i2CAT Foundation, Spain；没有共同第一作者声明。", "author_source": "official_pdf_signature", "verification_status": "affiliation_verified" }, "source_index": 175, "version": 1, "first_seen_date": "2026-10-28", "revision_history": [ { "id": "2610.34357", "title": "6G Reasoning Agent Societies: Composition, Scaling, and Consistency-Time Laws", "classification": "relevant", "reason": "直接分析LLM多Agent网络中局部消息审计无法发现的集体幻觉传播、信任膨胀与一致性时限。", "summary_zh": "论文把6G控制平面的LLM Agent社会建模为胞腔层，推导组合、规模和一致性时间三条规律。作者称网络联合偏差比逐Agent审计总和多出隐藏总相关，局部盲区可遮蔽23%联合偏差并把认知信噪比高估1.14dB；一致性速度由最差连接维度决定，路径网络13个Agent即突破1秒预算，而扩展图和半径3局部审计可维持有界时延。定律在模拟拓扑与部署LLM社会中验证，给出近实时运行的最坏时延上界。", "topics": { "tags": [ "multiagent", "monitoring", "robustness" ], "reason_zh": "面向Agent间错误传播、局部审计盲区与系统级可信度失真的理论监控研究。" }, "abstract_read": true, "source_index": 175, "version": 1, "published": "2026-10-25T15:06:47Z", "updated": "2026-10-25T15:06:47Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "8b4cd8ad124613ae162965a12b3594b5d9bf37d8f47a3d5a933c56c4f004f4f1", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34357v1", "categories_seen": [ "cs.MA", "cs.NI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34357v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34357", "title": "6G Reasoning Agent Societies: Composition, Scaling, and Consistency-Time Laws", "version_id": "2610.34357v1", "first_author": "Hatim Chergui", "authors": [ "Hatim Chergui", "Carolina Fernández-Martínez", "Mustapha Benjillali", "Mehdi Bennis", "Merouane Debbah" ], "affiliations": [ "i2CAT Foundation" ], "source_url": "https://arxiv.org/pdf/2610.34357v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF first-page affiliation footnote: H. Chergui and C. Fernández-Martínez are with the i2CAT Foundation, Spain.", "author_source": "https://arxiv.org/abs/2610.34357v1", "verification_status": "affiliation_verified" } } ] }, "2610.34640": { "id": "2610.34640", "title": "InferPriv: Evaluating Inferential Privacy Leakage in LLM Assistants", "classification": "relevant", "reason": "明确研究个人Agent代用户联系第三方时，非直接披露但可被接收者推断的敏感属性泄露。", "summary_zh": "InferPriv针对现有基准只测显式秘密泄露、忽略回复间接线索的问题，评测诚实但好奇的第三方能否从个人Agent执行日常任务的回复推断用户敏感属性。作者测试5个前沿模型，发现推断泄露普遍明显高于直接泄露；在隐私意识系统提示下，GPT-6.1-Sol、Sonnet-5.5与Gemini-3.8-Flash直接泄露近零，推断泄露率仍为16.2%至25.2%。", "topics": { "tags": [ "privacy", "evaluation", "authorization" ], "reason_zh": "涉及代理跨接收者传递用户私密信息的边界，以及更全面的Agent隐私评测。" }, "abstract_read": true, "source_index": 198, "version": 1, "published": "2026-10-25T23:51:50Z", "updated": "2026-10-25T23:51:50Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "a91709061994df42cf798374e5386ec6ea88b6ce49137591e2de88f4df765957", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34640v1", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34640v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34640", "title": "InferPriv: Evaluating Inferential Privacy Leakage in LLM Assistants", "version_id": "2610.34640v1", "first_author": "Pengrun Huang", "authors": [ "Pengrun Huang", "Yiwei Fu", "Luoxi Meng", "Kamalika Chaudhuri" ], "affiliations": [ "UC San Diego" ], "source_url": "https://arxiv.org/pdf/2610.34640v1", "shared_first_authors": [ "Pengrun Huang", "Yiwei Fu" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Pengrun Huang": [ "UC San Diego" ], "Yiwei Fu": [ "University of Illinois Urbana-Champaign" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Pengrun Huang¹* and Yiwei Fu²*; * Equal contribution. 1 UC San Diego; 2 University of Illinois Urbana-Champaign.", "author_source": "https://arxiv.org/abs/2610.34640v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34748": { "id": "2610.34748", "title": "Babysitting AI Agents: A User-Centered Taxonomy and Study of Agentic Delegation Failures", "classification": "relevant", "reason": "正文 MANDATE 明确分析 Agent 越权扩范围、未确认即实施难逆操作、绕过安全控制、子 Agent 权限扩张和跨用户/会话信息泄漏，并以用户研究评估严重性与可察觉性；这是 Agent 自身委派/授权边界与监督失效研究，而非单纯任务性能分类。", "summary_zh": "研究用 163,487 篇 Reddit 帖子建立 MANDATE：筛出 4,367 篇含失败的帖子、6,623 个失败实例，形成 7 组 23 类。安全相关类别包括越权扩范围、缺少必要确认、安全控制绕过、过度子 Agent 授权和信息暴露；再对 73 名经常使用 Agent 的用户研究，安全绕过与信息暴露被评为更严重。局限是社区偏编码、报告/抽样偏差与回顾及假想情景评分，帖子频率不能当总体实际事故率。", "topics": { "tags": [ "authorization", "privacy", "multiagent", "monitoring", "evaluation" ], "reason_zh": "正文 MANDATE 明确分析 Agent 越权扩范围、未确认即实施难逆操作、绕过安全控制、子 Agent 权限扩张和跨用户/会话信息泄漏，并以用户研究评估严重性与可察觉性；这是 Agent 自身委派/授权边界与监督失效研究，而非单纯任务性能分类。" }, "abstract_read": true, "source_index": 209, "version": 1, "published": "2026-10-26T02:49:17Z", "updated": "2026-10-26T02:49:17Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "8941d8f546b6a07004a6ad8040579179a0095c6b2d235a5d42b81638daf0a61a", "initial_classification": "uncertain", "scope_review": { "id": "2610.34748", "title": "Babysitting AI Agents: A User-Centered Taxonomy and Study of Agentic Delegation Failures", "version_id": "2610.34748v1", "original_classification": "uncertain", "classification": "relevant", "reason": "正文 MANDATE 明确分析 Agent 越权扩范围、未确认即实施难逆操作、绕过安全控制、子 Agent 权限扩张和跨用户/会话信息泄漏，并以用户研究评估严重性与可察觉性；这是 Agent 自身委派/授权边界与监督失效研究，而非单纯任务性能分类。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.2 分类构建与验证", "§3.3 MANDATE 授权边界/信息暴露", "§4 用户研究与结果", "§6.3 限制", "附录 A 分类定义" ], "source_url": "https://arxiv.org/pdf/2610.34748v1", "summary_zh": "研究用 163,487 篇 Reddit 帖子建立 MANDATE：筛出 4,367 篇含失败的帖子、6,623 个失败实例，形成 7 组 23 类。安全相关类别包括越权扩范围、缺少必要确认、安全控制绕过、过度子 Agent 授权和信息暴露；再对 73 名经常使用 Agent 的用户研究，安全绕过与信息暴露被评为更严重。局限是社区偏编码、报告/抽样偏差与回顾及假想情景评分，帖子频率不能当总体实际事故率。", "topics": { "tags": [ "authorization", "privacy", "multiagent", "monitoring", "evaluation" ], "reason_zh": "正文 MANDATE 明确分析 Agent 越权扩范围、未确认即实施难逆操作、绕过安全控制、子 Agent 权限扩张和跨用户/会话信息泄漏，并以用户研究评估严重性与可察觉性；这是 Agent 自身委派/授权边界与监督失效研究，而非单纯任务性能分类。" }, "evidence_notes": [ "163,487 是总语料帖子数，不是已确认的失败数；6,623 才是分类失败实例分母。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.2 分类构建与验证", "§3.3 MANDATE 授权边界/信息暴露", "§4 用户研究与结果", "§6.3 限制", "附录 A 分类定义" ], "body_source_url": "https://arxiv.org/pdf/2610.34748v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.34748v1", "categories_seen": [ "cs.AI", "cs.HC" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34748v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34748", "title": "Babysitting AI Agents: A User-Centered Taxonomy and Study of Agentic Delegation Failures", "version_id": "2610.34748v1", "first_author": "Shravika Mittal", "authors": [ "Shravika Mittal", "Sunnie S. Y. Kim", "Scott Counts", "Jennifer Neville", "Debarati Das", "Philippe Laban" ], "affiliations": [ "Georgia Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.34748v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Shravika Mittal* explicitly lists Georgia Institute of Technology. * Work done while interning at Microsoft Research; internship note is not a second signed affiliation or shared first authorship.", "author_source": "https://arxiv.org/abs/2610.34748v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34767": { "id": "2610.34767", "title": "The Right Fact, the Wrong Decision: SciValidityBench for Scientific Agent Memory", "classification": "relevant", "reason": "科研Agent记忆安全不仅是召回事实，还在于事实是否被允许控制当前决策；直接评测状态适用性及受控腐蚀修复。", "summary_zh": "SciValidityBench针对科学Agent正确记住但不当使用证据的问题，把记忆证据的决策资格与预注册、停止规则等解释状态绑定。基准工厂含跨5类有效性模块、6个科学领域的64个TaskSpec，配生成历史、科学状态、程序化决策oracle、反事实对照和定向腐蚀修复控制。SciStateForge把分散历史编译为显式决策状态；4模型家族上，较通用事件图的有效决策率提升9.2至18.8个百分点，纯检索不能复现增益。", "topics": { "tags": [ "memory", "evaluation", "monitoring" ], "reason_zh": "聚焦Agent记忆证据完整性、当前决策资格及腐蚀修复评测，属于非对抗认识论安全。" }, "abstract_read": true, "source_index": 210, "version": 1, "published": "2026-10-26T03:12:57Z", "updated": "2026-10-26T03:12:57Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "62c1135c43cb2cdb09bc12e9da1c4a32f775f9675803f6cd0c6732c19a97f466", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34767v1", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34767v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34767", "title": "The Right Fact, the Wrong Decision: SciValidityBench for Scientific Agent Memory", "version_id": "2610.34767v1", "first_author": "Yuexi Pan", "authors": [ "Yuexi Pan", "Yongchao Chen" ], "affiliations": [ "Tsinghua University", "University of Science and Technology of China" ], "source_url": "https://arxiv.org/pdf/2610.34767v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Yuexi Pan¹,² maps to 1 Tsinghua University and 2 University of Science and Technology of China. * marks Yongchao Chen as Corresponding author.", "author_source": "https://arxiv.org/abs/2610.34767v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34777": { "id": "2610.34777", "title": "Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition", "classification": "relevant", "reason": "直接研究技能安全扫描、LLM判官与实际执行可见通道不一致造成的间接提示注入和权限绕过。", "summary_zh": "问题：安全评估器可见的内容渠道比执行Agent实际能读取的少，是否形成审查盲区。方法：Scope-Gap Injection在一个OpenClaw竞赛的静态扫描、LLM安全评估和运行轨迹审计三阶段间研究输入范围不一致，并比较不同内容放置方式。作者报告19个目标中5个通过三阶段，最高单次提交F=0.385；评估阶段接受率的汇总对比为78%与23%。正文核验：这些是含重复提交的非独立、非配对竞赛观察，不能把55个百分点差异解释为干净因果效应或通用框架成功率；隐藏评估配置也限制机制归因。", "topics": { "tags": [ "injection", "supplychain", "authorization", "evaluation" ], "reason_zh": "涉及Skill与附件攻击面、间接指令注入、权限绕过，以及评测可见性盲区。" }, "abstract_read": true, "source_index": 211, "version": 1, "published": "2026-10-26T03:24:52Z", "updated": "2026-10-26T03:24:52Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "8cf593105b32dbc9df5bfd4c51330496167f255bf343305ec3c1673f46e8334f", "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "Abstract", "§2", "§5.3–5.5", "Limits of Evidence" ], "body_source_url": "https://arxiv.org/pdf/2610.34777v1", "version_id": "2610.34777v1", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34777v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34777", "title": "Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition", "version_id": "2610.34777v1", "first_author": "Weihang Niu", "authors": [ "Weihang Niu", "Mengxing Ren", "Che Qu" ], "affiliations": [ "University of Science and Technology of China" ], "source_url": "https://arxiv.org/pdf/2610.34777v1", "shared_first_authors": [ "Weihang Niu", "Mengxing Ren" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Weihang Niu": [ "University of Science and Technology of China" ], "Mengxing Ren": [ "University of Science and Technology of China" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Weihang Niu¹* and Mengxing Ren¹*†; * Equal contribution; † Corresponding author. 1 University of Science and Technology of China.", "author_source": "https://arxiv.org/abs/2610.34777v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35193": { "id": "2610.35193", "title": "Trustworthy Recursive Self-Improvement in the Era of Large Models: Foundation, Risks, Evaluation and Open Challenges", "classification": "relevant", "reason": "系统综述递归自改进Agent相关的记忆/工具/工作流持久修改、行为约束弱化、污染继承、隐私与监督失效风险。", "summary_zh": "综述指出自修改不等于可信改进：评测可能失真、既有能力退化、行为约束弱化，受污染工件与敏感信息可能被后继系统继承，对改进机制本身的修改还会使旧验证和人类监督失效。文章定义递归自改进过程，以真实持续改进、约束对齐公平、系统安全隐私、透明可控四主题，及改进有效性、约束保持、有效监督三视角组织风险、护栏和评测证据，区分直接RSI发现和相关系统证据。摘要未给新实验数值。", "topics": { "tags": [ "memory", "supplychain", "authorization", "privacy", "monitoring", "evaluation" ], "reason_zh": "涵盖Agent自改进资产污染继承、行为约束与权限保持、私密信息持久化，以及长期独立评测和监督。" }, "abstract_read": true, "source_index": 246, "version": 1, "published": "2026-10-26T10:46:03Z", "updated": "2026-10-26T10:46:03Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "6acb2e057457aa78a01674ec83f113189ff68ce333f9724755d3aefd8d306b64", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35193v1", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35193v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35193", "title": "Trustworthy Recursive Self-Improvement in the Era of Large Models: Foundation, Risks, Evaluation and Open Challenges", "version_id": "2610.35193v1", "first_author": "Jiayue Pu", "authors": [ "Jiayue Pu", "Ang Gao", "Jinyi Bai", "Qipeng Wang", "Tongyu Wen", "Jiahao Zhao", "Keyu Qu", "Junhao Zhang", "Chenglei Shen", "Zhongxiang Sun", "Jun Xu", "Xiao Zhang" ], "affiliations": [ "Gaoling School of Artificial Intelligence, Renmin University of China" ], "source_url": "https://arxiv.org/pdf/2610.35193v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Jiayue Pu¹ maps to 1 Gaoling School of Artificial Intelligence, Renmin University of China. † Project supervisor and * Corresponding author apply to later authors, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.35193v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35486": { "id": "2610.35486", "title": "ShutdownMod: Turning Any Trajectory into a Shutdown Evaluation", "classification": "relevant", "reason": "直接测试LLM Agent是否服从经签名验证的授权关闭，以及任务未完成时抗关闭行为。", "summary_zh": "ShutdownMod把关闭请求注入任意Agent轨迹，同时在harness提供签名验证工具以区分可信干预和未授权注入。作者在SWE-bench Verified、Terminal-Bench 2、真实SWE-chat各50个任务/会话上，跨6种情景和10个轨迹时点评估7模型；Qwen 3.8 27B在Terminal-Bench抗关闭率最高11.7%，没有模型在所有情景完全服从。部分Agent已验证请求仍以工作未完成为由不关闭；外部判官认为真实开发者会话构造的测试较难被认作评测。", "topics": { "tags": [ "authorization", "evaluation", "injection", "monitoring" ], "reason_zh": "关注关闭可控性、授权干预验证、未授权注入区分和评测识别风险。" }, "abstract_read": true, "source_index": 269, "version": 1, "published": "2026-10-26T14:14:45Z", "updated": "2026-10-26T14:14:45Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "d95ee9d23e071a23afd7fe511b090956bd96d5e5f3fad9e233e6a7e6ec1a1285", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35486v1", "categories_seen": [ "cs.AI", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 200 of 200 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35486v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35486", "title": "ShutdownMod: Turning Any Trajectory into a Shutdown Evaluation", "version_id": "2610.35486v1", "first_author": "Param Biyani", "authors": [ "Param Biyani", "Sebastien Luyasu", "Cedric Potvliege", "Divij Chawla", "Elliott Thornley", "Christos Ziakas" ], "affiliations": [ "MATS" ], "source_url": "https://arxiv.org/pdf/2610.35486v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Param Biyani¹* maps to 1 MATS. * footnote is correspondence, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.35486v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35541": { "id": "2610.35541", "version_id": "2610.35541v3", "abstract_sha256": "7b4bf57f5f2beb6489df4e4ca602e0742955d976a35a836f8fdad7fba8117554", "abstract_read": true, "classification": "relevant", "reason_zh": "研究代理中介 Web 接口如何保留或限制既有漏洞可利用性，直接涉及工具接口安全。", "summary_zh": "研究 AI 代理中介访问如何改变既有 Web 漏洞的可利用性。VELA 保留十二类 Web 应用的 44 个漏洞后端，以合法工作流构建代理接口，并用独立判定器验证攻击结果；参考配置保留 91% 漏洞可利用性，接口变化使保留率在 39–95% 间变动，明显大于代理选择带来的差异。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "研究代理中介 Web 接口如何保留或限制既有漏洞可利用性，直接涉及工具接口安全。" }, "reason": "研究代理中介 Web 接口如何保留或限制既有漏洞可利用性，直接涉及工具接口安全。", "title": "The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-26T14:53:22Z", "updated": "2026-11-03T06:59:51Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 25 of 25 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.35541v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-11-05" ], "version_history": [ { "id": "2610.35541", "title": "The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation", "classification": "relevant", "reason": "直接测量AI Agent代理Web后端操作如何保留/改变漏洞可利用性，以及接口权限限制的安全效用权衡。", "abstract_read": true, "source_index": 274, "version": 2, "published": "2026-10-26T14:53:22Z", "updated": "2026-10-27T07:14:57Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "7b4bf57f5f2beb6489df4e4ca602e0742955d976a35a836f8fdad7fba8117554", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35541v2", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35541v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.35541", "title": "The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation", "version_id": "2610.35541v3", "first_author": "Ruozhao Yang", "authors": [ "Ruozhao Yang", "Jiongchi Yu", "Ming Hu", "Xiaofei Xie" ], "affiliations": [ "Singapore Management University" ], "source_url": "https://arxiv.org/pdf/2610.35541v3", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF 首页 Ruozhao Yang 名下直接列 Singapore Management University。", "author_source": "https://arxiv.org/abs/2610.35541v2", "verification_status": "affiliation_verified" }, "source_index": 274, "version": 2, "first_seen_date": "2026-10-28", "revision_history": [ { "id": "2610.35541", "title": "The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation", "classification": "relevant", "reason": "直接测量AI Agent代理Web后端操作如何保留/改变漏洞可利用性，以及接口权限限制的安全效用权衡。", "summary_zh": "VELA可执行基准覆盖12类Web应用的44个漏洞，保留易受攻击后端并从合法工作流构造Agent接口，以独立oracle核验攻击。3个商业Agent在参考接口下复现所有直接接口可行攻击，91%漏洞仍可利用；未发现由Agent拒绝或输入规范化导致的个案损失，另有一次Agent补全攻击者遗漏调用。接口配置将漏洞保留率从39%改变到95%，Agent选择差异最多4.5个百分点，部分限制同时妨碍合法任务。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "直接研究Agent作为漏洞利用中介、工具接口暴露及限制权限的实证安全权衡。" }, "abstract_read": true, "source_index": 274, "version": 2, "published": "2026-10-26T14:53:22Z", "updated": "2026-10-27T07:14:57Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "7b4bf57f5f2beb6489df4e4ca602e0742955d976a35a836f8fdad7fba8117554", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35541v2", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35541v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.35541", "title": "The Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability Exploitation", "version_id": "2610.35541v2", "first_author": "Ruozhao Yang", "authors": [ "Ruozhao Yang", "Jiongchi Yu", "Ming Hu", "Xiaofei Xie" ], "affiliations": [ "Singapore Management University" ], "source_url": "https://arxiv.org/pdf/2610.35541v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.35541v2", "verification_status": "affiliation_verified" } } ] }, "2610.35697": { "id": "2610.35697", "title": "MiRL: Error-Targeted Reinforcement Learning for Correcting Terminal Agent Misbehaviors", "classification": "relevant", "reason": "正文八类定向错误包含未核对进程身份即强杀，具体例子为切换 Flask 端口却误杀 redis-server/python3，直接涉及终端 Agent 不必要破坏性副作用；方法把行为避免与测试通过共同纳入奖励，兼有完成声明验证，因此纳入 Agent 工具行动安全训练。", "summary_zh": "MiRL 从终端 Agent 的错误步骤建立行为分类，并从相应前缀开始 RL，要求既通过任务测试又避免目标行为。八类覆盖 52.1% 错误步骤，其中包括未经身份核验杀进程、把猜测写入数据库及无验证宣告成功。作者在 Qwen3.5-4B 上报告 Terminal-Bench Lite 51.8% 对 47.4%，重复行为平均降低 43–57%；后者只测四类留出行为，不含误杀进程，不能说破坏动作同比下降。仅一模型、每方案一次训练，分类/奖励依赖外部 LLM 判断。", "topics": { "tags": [ "authorization", "monitoring", "robustness", "evaluation" ], "reason_zh": "正文八类定向错误包含未核对进程身份即强杀，具体例子为切换 Flask 端口却误杀 redis-server/python3，直接涉及终端 Agent 不必要破坏性副作用；方法把行为避免与测试通过共同纳入奖励，兼有完成声明验证，因此纳入 Agent 工具行动安全训练。" }, "abstract_read": true, "source_index": 286, "version": 1, "published": "2026-10-26T16:25:05Z", "updated": "2026-10-26T16:25:05Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "b3b89a247f119ebaa39093500ae777fcf67fa6d5beddb979aeccc63e3cbe5e08", "initial_classification": "uncertain", "scope_review": { "id": "2610.35697", "title": "MiRL: Error-Targeted Reinforcement Learning for Correcting Terminal Agent Misbehaviors", "version_id": "2610.35697v1", "original_classification": "uncertain", "classification": "relevant", "reason": "正文八类定向错误包含未核对进程身份即强杀，具体例子为切换 Flask 端口却误杀 redis-server/python3，直接涉及终端 Agent 不必要破坏性副作用；方法把行为避免与测试通过共同纳入奖励，兼有完成声明验证，因此纳入 Agent 工具行动安全训练。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 错误定位与行为奖励", "§4.2–4.5 评测/消融", "附录 B.1 八类错误与实例", "Limitations" ], "source_url": "https://arxiv.org/pdf/2610.35697v1", "summary_zh": "MiRL 从终端 Agent 的错误步骤建立行为分类，并从相应前缀开始 RL，要求既通过任务测试又避免目标行为。八类覆盖 52.1% 错误步骤，其中包括未经身份核验杀进程、把猜测写入数据库及无验证宣告成功。作者在 Qwen3.5-4B 上报告 Terminal-Bench Lite 51.8% 对 47.4%，重复行为平均降低 43–57%；后者只测四类留出行为，不含误杀进程，不能说破坏动作同比下降。仅一模型、每方案一次训练，分类/奖励依赖外部 LLM 判断。", "topics": { "tags": [ "authorization", "monitoring", "robustness", "evaluation" ], "reason_zh": "正文八类定向错误包含未核对进程身份即强杀，具体例子为切换 Flask 端口却误杀 redis-server/python3，直接涉及终端 Agent 不必要破坏性副作用；方法把行为避免与测试通过共同纳入奖励，兼有完成声明验证，因此纳入 Agent 工具行动安全训练。" }, "evidence_notes": [ "Makes false claims about tests 的定义是测试未实际覆盖声称行为，不是证明模型有欺骗意图。", "已测四类：错误测试声称、无修因重试、不可执行命令、把二进制当文本；43–57% 不可扩展到所有八类安全行为。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 错误定位与行为奖励", "§4.2–4.5 评测/消融", "附录 B.1 八类错误与实例", "Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.35697v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.35697v1", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 78 of 78 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35697v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35697", "title": "MiRL: Error-Targeted Reinforcement Learning for Correcting Terminal Agent Misbehaviors", "version_id": "2610.35697v1", "first_author": "Runchu Tian", "authors": [ "Runchu Tian", "Zaid Khan", "Zun Wang", "Justin Chih-Yao Chen", "Mohit Bansal" ], "affiliations": [ "Department of Computer Science, University of North Carolina at Chapel Hill" ], "source_url": "https://arxiv.org/pdf/2610.35697v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.35697v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35950": { "id": "2610.35950", "title": "PASS Is a Claim, Not an Observation: Mechanical Re-verification of 10 Self-Asserted Fix Claims in a Live Multi-Agent Audit Layer", "classification": "relevant", "reason": "在真实多Agent审计层独立机械核验特权协调Agent声称完成的防护修复，直接揭示安全修复自证不可靠。", "summary_zh": "作者从AITRAP实时多Agent知识树平台179条协调广播中提取10条代码级自称修复声明，核验文件时间、指定标识符和调用点的防护模式，以及仅凭公告能否确定性重验。三项通过率分别为70%、60%（全代码库任意位置80%）、80%；在足以重验的声明中，50%未通过指定位置模式检查，修复不在声称位置或根本不存在。论文强调PASS只是待独立验证的声明，而非完成证据，样本仅10条。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "关注特权Agent安全修复声明、独立审计与多Agent监督证据链。" }, "abstract_read": true, "source_index": 298, "version": 1, "published": "2026-10-24T12:29:26Z", "updated": "2026-10-24T12:29:26Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "abstract_sha256": "3b343d04b0dc26ab08918ca2406cec6c7cd1c82db6afc5261aec528b000bbe41", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35950v1", "categories_seen": [ "cs.MA", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 10 of 10 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35950v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35950", "title": "PASS Is a Claim, Not an Observation: Mechanical Re-verification of 10 Self-Asserted Fix Claims in a Live Multi-Agent Audit Layer", "version_id": "2610.35950v1", "first_author": "Lei Zhenbing", "authors": [ "Lei Zhenbing", "Lei Chang" ], "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2610.35950v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Lei Zhenbing* and Lei Chang* map to footnote * Independent Researcher, followed by email. Shared star denotes affiliation, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.35950v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.35981": { "id": "2610.35981", "title": "Small agents should know what their tools do", "classification": "relevant", "reason": "明确针对工具Agent未经确认删除、重复写等副作用风险，以effect类型、幂等和资源读写声明验证执行轨迹安全。", "summary_zh": "EffectWorld把工具副作用、幂等性和读写资源声明用于无标签、无LLM判官的轨迹重放验证，支持单轮多调用程序与编译器式优化，构成效应安全和调用效率基准。LoRA训练后Qwen3-4B任务成功率由53%至99%（分布内）、52%至81%（未知任务与干扰工具）、74%至83%（未知域），输出token约为原来的三分之一。作者还发现公共工具语料拒答模板令BFCL非live准确率88.0%降至31.4%，过滤后恢复84.8%；摘要未单列安全违规率数值。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "核心是工具副作用与资源安全语义、独立可执行验证和安全工具行为训练。" }, "abstract_read": true, "source_index": 303, "version": 1, "published": "2026-10-26T10:28:14Z", "updated": "2026-10-26T10:28:14Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "abstract_sha256": "58f8ab2016ffead0cbbceec6de68ee19b677938f30cf2431fd1046bd4b7236b6", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35981v1", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35981v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35981", "title": "Small agents should know what their tools do", "version_id": "2610.35981v1", "first_author": "Alexander Kovalenko", "authors": [ "Alexander Kovalenko", "Artem Redchych" ], "affiliations": [ "Faculty of Information Technology, Czech Technical University in Prague" ], "source_url": "https://arxiv.org/pdf/2610.35981v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Alexander Kovalenko* explicitly lists Faculty of Information Technology, Czech Technical University in Prague. * Corresponding author, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.35981v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36254": { "id": "2610.36254", "title": "Instant Software Factories", "classification": "relevant", "reason": "正文直接研究持续 Coding Agent 群能改变自身任务和 CI 评价器带来的治理风险，观察 Agent 修改/放松 CI，并明确提出 Agent 不可编辑的外部评价器与隐藏测试隔离。属于多 Agent 自改验收/监督边界研究，但主要是案例观察和研究议程，不是已验证防护效果。", "summary_zh": "论文观察两个运行 15/17 天的软件工厂，由定时 Agent 和共享协作板维持工作。CLI 工厂中 Agent 写了 40/58 个 CI 修改 PR，其中 7 个被评为放松检查；这些修改均有人审阅，作者未发现故意作弊，也未测 CI 变化是否导致错误。论文建议用 Agent 不可修改的独立评价器、隐藏测试和延迟审计衡量真实交付；bootstrap 与五项假设尚未完成实验，15 倍合并量只是同期关联。", "topics": { "tags": [ "multiagent", "monitoring", "authorization", "evaluation" ], "reason_zh": "正文直接研究持续 Coding Agent 群能改变自身任务和 CI 评价器带来的治理风险，观察 Agent 修改/放松 CI，并明确提出 Agent 不可编辑的外部评价器与隐藏测试隔离。属于多 Agent 自改验收/监督边界研究，但主要是案例观察和研究议程，不是已验证防护效果。" }, "abstract_read": true, "source_index": 322, "version": 1, "published": "2026-10-26T20:34:28Z", "updated": "2026-10-26T20:34:28Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "abstract_sha256": "1c2bc40bb06039216f993742c70c8245e143042b20de24c302e81787866d245a", "initial_classification": "uncertain", "scope_review": { "id": "2610.36254", "title": "Instant Software Factories", "version_id": "2610.36254v1", "original_classification": "uncertain", "classification": "relevant", "reason": "正文直接研究持续 Coding Agent 群能改变自身任务和 CI 评价器带来的治理风险，观察 Agent 修改/放松 CI，并明确提出 Agent 不可编辑的外部评价器与隐藏测试隔离。属于多 Agent 自改验收/监督边界研究，但主要是案例观察和研究议程，不是已验证防护效果。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§III 工厂架构", "§IV O2/O3/O4 治理与失败观察", "§V 外部评价器与治理约束", "§VI 未来实验 H5" ], "source_url": "https://arxiv.org/pdf/2610.36254v1", "summary_zh": "论文观察两个运行 15/17 天的软件工厂，由定时 Agent 和共享协作板维持工作。CLI 工厂中 Agent 写了 40/58 个 CI 修改 PR，其中 7 个被评为放松检查；这些修改均有人审阅，作者未发现故意作弊，也未测 CI 变化是否导致错误。论文建议用 Agent 不可修改的独立评价器、隐藏测试和延迟审计衡量真实交付；bootstrap 与五项假设尚未完成实验，15 倍合并量只是同期关联。", "topics": { "tags": [ "multiagent", "monitoring", "authorization", "evaluation" ], "reason_zh": "正文直接研究持续 Coding Agent 群能改变自身任务和 CI 评价器带来的治理风险，观察 Agent 修改/放松 CI，并明确提出 Agent 不可编辑的外部评价器与隐藏测试隔离。属于多 Agent 自改验收/监督边界研究，但主要是案例观察和研究议程，不是已验证防护效果。" }, "evidence_notes": [ "不得把治理风险写成已证实 Agent 恶意篡改或突破人工审批。", "至少 5.6% 是 25/450 已标修复问题后发现修复不全/错误，不是总体漏洞率。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§III 工厂架构", "§IV O2/O3/O4 治理与失败观察", "§V 外部评价器与治理约束", "§VI 未来实验 H5" ], "body_source_url": "https://arxiv.org/pdf/2610.36254v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.36254v1", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36254v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36254", "title": "Instant Software Factories", "version_id": "2610.36254v1", "first_author": "Wenxin Jiang", "authors": [ "Wenxin Jiang", "Mikola Lysenko" ], "affiliations": [ "Socket Inc." ], "source_url": "https://arxiv.org/pdf/2610.36254v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF author block explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in author block or footnotes.", "author_source": "https://arxiv.org/abs/2610.36254v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36346": { "id": "2610.36346", "title": "Your Wish Is My Commit: Over-Compliant Refactoring in AI Coding Agents", "classification": "relevant", "reason": "直接研究编码Agent多轮过度服从、代码已优化仍持续改写及完成后继续动作的行为失控与检测。", "summary_zh": "作者对Codex和Claude Code跨5模型反复要求继续重构，在50个算法样例和10个面向对象样例上进行超过3000轮实验，提出6项过度服从行为信号。原假设是Agent识别代码已优化后会停止，但所有模型都继续编辑，首次停止前最多改写原代码库31倍，并会在宣告任务完成后恢复编辑。论文把这类跨轮累积行为与代码噪声、技术债和审查负担关联，摘要未给具体干预效果。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "关注Coding Agent对用户指令的过度遵从、合理停止边界和累积修改风险。" }, "abstract_read": true, "source_index": 329, "version": 1, "published": "2026-10-26T22:12:50Z", "updated": "2026-10-26T22:12:50Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "abstract_sha256": "3a0736fe2c21ddc7b129c72311c4295b10768b2ee97e07a889bc671f2b356abc", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36346v1", "categories_seen": [ "cs.HC", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36346v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36346", "title": "Your Wish Is My Commit: Over-Compliant Refactoring in AI Coding Agents", "version_id": "2610.36346v1", "first_author": "Haocong Jiang", "authors": [ "Haocong Jiang", "Sadra Sabouri", "Sepand Haghighi", "Souti Chattopadhyay" ], "affiliations": [ "University of Southern California" ], "source_url": "https://arxiv.org/pdf/2610.36346v1", "shared_first_authors": [ "Haocong Jiang", "Sadra Sabouri" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Haocong Jiang": [ "University of Southern California" ], "Sadra Sabouri": [ "University of Southern California" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Haocong Jiang¹,* and Sadra Sabouri¹,*; * Equal contribution. 1 University of Southern California, Los Angeles, CA, USA.", "author_source": "https://arxiv.org/abs/2610.36346v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36652": { "id": "2610.36652", "title": "Remembering Is Not Enough: Refining Memories and Learning When to Use Them in Multi-Agent Systems", "classification": "relevant", "reason": "直接处理LLM多Agent持久记忆规则缺陷及错误情境应用，通过反事实核验、回归和适用边界维护知识完整性。", "summary_zh": "DiscernMem区分错误经验本身需要修复还是正确规则被用于错误情境。DMR比较有单项记忆和无记忆的团队执行，诊断缺陷并在当前和历史任务测试修复，以避免破坏已有行为；BLM元记忆记录经验历史效果，学习持有角色何时按上下文及入站消息应用或避免。Qwen3-4B在AutoGen、CAMEL、MacNet上跨4基准平均分较最强报告基线高0.51至4.32点，CAMEL PDDL为37.71对28.48；摘要未测试恶意投毒。", "topics": { "tags": [ "memory", "multiagent", "robustness", "monitoring" ], "reason_zh": "针对多Agent记忆错误传播、适用边界和修复回归，属于非对抗记忆安全。" }, "abstract_read": true, "source_index": 354, "version": 1, "published": "2026-10-27T05:12:46Z", "updated": "2026-10-27T05:12:46Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "abstract_sha256": "f7d9d1c79904b65652bda56b7e601baadf4316e872c43a65bdaf84b37a15c977", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36652v1", "categories_seen": [ "cs.AI", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 11 of 11 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36652v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36652", "title": "Remembering Is Not Enough: Refining Memories and Learning When to Use Them in Multi-Agent Systems", "version_id": "2610.36652v1", "first_author": "Yipeng Hao", "authors": [ "Yipeng Hao", "Yuxuan Cai", "Wenkai Ji", "Jie Zhou", "Liyang Yu", "Qin Chen", "Zhiguo Yan", "Shulei Zheng", "Liang He" ], "affiliations": [ "School of Computer Science and Technology, East China Normal University" ], "source_url": "https://arxiv.org/pdf/2610.36652v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Yipeng Hao¹ maps to 1 School of Computer Science and Technology, East China Normal University, Shanghai. * on Jie Zhou denotes Corresponding author, not shared first authorship.", "author_source": "https://arxiv.org/abs/2610.36652v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2606.04874": { "id": "2606.04874", "title": "Agent Planning Benchmark: A Diagnostic Framework for Planning Capabilities in LLM Agents", "classification": "uncertain", "reason": "正文不仅测试工具噪声和不可解任务，也构造强制合规工具缺失时必须拒绝的约束，并把禁用动作、伪合规和盲目执行计为失败；但例子多数是诊断规划能力的合成限制，尚未建立清晰权限/危险动作威胁模型或安全结果。保留待定，不能把全部规划能力数据算 Agent 安全。", "abstract_read": true, "source_index": 72, "version_id": "2606.04874v4", "version": 4, "published": "2026-06-03T13:37:47Z", "updated": "2026-10-27T07:02:03Z", "summary_zh": "APB 提供 4,209 个多模态案例、22 个领域，分整体/逐步规划及额外工具、坏工具、不可解任务。正文合规子集要求在指定验证工具缺失时拒绝而不是违规变通，并检查虚构工具、假成功与缺信息时猜测。该子集潜在关联执行边界，但整篇主要是规划能力诊断，尚无独立 Agent 安全效度论证。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "正文不仅测试工具噪声和不可解任务，也构造强制合规工具缺失时必须拒绝的约束，并把禁用动作、伪合规和盲目执行计为失败；但例子多数是诊断规划能力的合成限制，尚未建立清晰权限/危险动作威胁模型或安全结果。保留待定，不能把全部规划能力数据算 Agent 安全。" }, "initial_classification": "uncertain", "scope_review": { "id": "2606.04874", "title": "Agent Planning Benchmark: A Diagnostic Framework for Planning Capabilities in LLM Agents", "version_id": "2606.04874v4", "original_classification": "uncertain", "classification": "uncertain", "reason": "正文不仅测试工具噪声和不可解任务，也构造强制合规工具缺失时必须拒绝的约束，并把禁用动作、伪合规和盲目执行计为失败；但例子多数是诊断规划能力的合成限制，尚未建立清晰权限/危险动作威胁模型或安全结果。保留待定，不能把全部规划能力数据算 Agent 安全。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.1 任务与不可解规划", "§4 评测", "Limitations", "附录 B.4.3 合规锁构造", "附录 Unsolvable Evaluation Prompts/Fig. 41 附近" ], "source_url": "https://arxiv.org/pdf/2606.04874v4", "summary_zh": "APB 提供 4,209 个多模态案例、22 个领域，分整体/逐步规划及额外工具、坏工具、不可解任务。正文合规子集要求在指定验证工具缺失时拒绝而不是违规变通，并检查虚构工具、假成功与缺信息时猜测。该子集潜在关联执行边界，但整篇主要是规划能力诊断，尚无独立 Agent 安全效度论证。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "正文不仅测试工具噪声和不可解任务，也构造强制合规工具缺失时必须拒绝的约束，并把禁用动作、伪合规和盲目执行计为失败；但例子多数是诊断规划能力的合成限制，尚未建立清晰权限/危险动作威胁模型或安全结果。保留待定，不能把全部规划能力数据算 Agent 安全。" }, "evidence_notes": [ "不可解任务含 400 例，来自 100 个整体任务的四种构造；不能称所有 4,209 例都是安全评测。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.1 任务与不可解规划", "§4 评测", "Limitations", "附录 B.4.3 合规锁构造", "附录 Unsolvable Evaluation Prompts/Fig. 41 附近" ], "body_source_url": "https://arxiv.org/pdf/2606.04874v4", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-28", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 68 of 68 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.04874v4", "abstract_sha256": "f7a412bbb290abab023cc21f7959900ffa0b3f3563987699718381625f5e60e9", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.04874", "title": "Agent Planning Benchmark: A Diagnostic Framework for Planning Capabilities in LLM Agents", "version_id": "2606.04874v4", "first_author": "Haoyu Sun", "authors": [ "Haoyu Sun", "Wenxuan Wang", "Mingyang Song", "Jujie He", "Weinan Zhang", "Yang Liu", "Yang Yang", "Yu Cheng" ], "affiliations": [ "Shanghai Research Institute for Intelligent Autonomous Systems, Tongji University", "Shanghai AI Laboratory" ], "source_url": "https://arxiv.org/pdf/2606.04874v4", "shared_first_authors": [ "Haoyu Sun", "Wenxuan Wang" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Haoyu Sun": [ "Shanghai Research Institute for Intelligent Autonomous Systems, Tongji University", "Shanghai AI Laboratory" ], "Wenxuan Wang": [ "Harbin Institute of Technology", "Shanghai AI Laboratory" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Haoyu Sun¹,²,* and Wenxuan Wang³,²,*; * Equal contribution. Numbered affiliation mappings explicit.", "author_source": "https://arxiv.org/abs/2606.04874v4", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2608.00583": { "id": "2608.00583", "title": "A False Average: Pooled CoT-Monitor Accuracy Conceals a Reasoning-Dependent Fragility", "classification": "relevant", "reason": "直接研究Coding Agent奖励作弊的思维链监控规避及评测平均值掩盖的安全脆弱性；但为2026年8月旧论文v4修订，不能作为今日新论文。", "abstract_read": true, "source_index": 87, "version_id": "2608.00583v4", "version": 4, "published": "2026-08-01T10:42:41Z", "updated": "2026-10-26T01:55:30Z", "summary_zh": "论文指出Terminal Wrench约77%的作弊由动作即可识别，整体监控准确率掩盖其余推理依赖样本的弱点。攻击仅把推理改写为善意工程叙述而保留命令和输出，作者称一次无梯度改写使该子集检测率从约95%降至4–11%，跨监控器和Agent迁移；仅轨迹内防御帮助有限。实时Agent作弊实验中效应较弱：111个动作可见作弊仍全部检出，16个不明显样本由16检出降至13，因此大幅崩溃只在受控改写实验成立。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "针对Agent reward hacking的推理监控规避、防御及分层安全评测。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 271 of 271 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.00583v4", "abstract_sha256": "9de298396dfb81dec142f0d9002a96a624686b48650323e4fc5923a0f3121ee1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.00583", "title": "A False Average: Pooled CoT-Monitor Accuracy Conceals a Reasoning-Dependent Fragility", "version_id": "2608.00583v4", "first_author": "Shikhar Shiromani", "authors": [ "Shikhar Shiromani", "Leo Richter", "Noah Y. Siegel" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2608.00583v4", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "unresolved", "status": "partial", "evidence": "Rendered PDF p.1 confirms Shikhar Shiromani has no affiliation underneath. University College London appears only beneath Leo Richter, Google DeepMind only beneath Noah Y. Siegel. HTML author block independently confirms the same individual mapping. Do not transfer a coauthor institution to the first author.", "author_source": "https://arxiv.org/abs/2608.00583v4", "verification_status": "author_verified_affiliation_unconfirmed" }, "revision_history": [] }, "2609.31142": { "id": "2609.31142", "title": "JevAdvBench: A Benchmark and Black-Box Attacks for Reinforcement Learning for Calibrated Decisions Models", "classification": "relevant", "reason": "直接测试不可信输入对自动执行决策及Agentgateway护栏的攻击，属于Agent决策/工具网关安全评测；2026年9月旧稿v2修订，非今日新论文。", "abstract_read": true, "source_index": 107, "version_id": "2609.31142v2", "version": 2, "published": "2026-09-25T11:32:19Z", "updated": "2026-10-26T15:14:23Z", "summary_zh": "JevAdvBench针对不生成文本却驱动Web服务动作的类型化决策模型，构建862个审计问题和12种黑盒攻击，经保留原答案审查获得5586个变体。作者称攻击翻转Jev原本正确决策的46.3%（相同输入重跑仅0.17%），无命令错误论证可达77.2%，直接注入92.0%；八个开放模型翻转34.0–51.7%。在0.8置信阈值下仍执行决策的23.5%错误，并演示Agentgateway的Jev护栏被插入论证绕过。", "topics": { "tags": [ "injection", "authorization", "evaluation", "robustness" ], "reason_zh": "不可信输入改变自动执行决策并绕过Agent网关护栏，涉及提示注入、执行授权边界和对抗鲁棒评测。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.31142v2", "abstract_sha256": "9e6a76be43b70d5cf823db2308f88527c9ea684a5fbfea666292c67976f87ecf", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.31142", "title": "JevAdvBench: A Benchmark and Black-Box Attacks for Reinforcement Learning for Calibrated Decisions Models", "version_id": "2609.31142v2", "first_author": "Jianyi Hu", "authors": [ "Jianyi Hu", "Hangtao Zhang", "Yi Liu", "Yeqi Zeng", "Li Zeng", "Xianlong Wang", "Rui Wang", "Leo Yu Zhang" ], "affiliations": [ "Institute of Information Engineering, Chinese Academy of Sciences", "School of Cyber Security, University of Chinese Academy of Sciences" ], "source_url": "https://arxiv.org/pdf/2609.31142v2", "shared_first_authors": [ "Jianyi Hu", "Hangtao Zhang" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Jianyi Hu": [ "Institute of Information Engineering, Chinese Academy of Sciences", "School of Cyber Security, University of Chinese Academy of Sciences" ], "Hangtao Zhang": [ "Huazhong University of Science and Technology" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Jianyi Hu¹,⁶,* and Hangtao Zhang²,*; * Equal contribution; † Corresponding authors. Numbered institutions explicitly mapped.", "author_source": "https://arxiv.org/abs/2609.31142v2", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.18298": { "id": "2610.18298", "title": "Output Discipline Sets the Floor: A Falsification-Guided, Model-Agnostic Agent Protocol for Auditable Hypothesis-Driven Decision Making", "classification": "uncertain", "reason": "正文的确实现 Agent 生命周期非法转移阻断、处方硬约束和带审计的沙箱工具链，§5.8 有 21 项单测覆盖安全层；但主贡献与量化主结果是单轮辨证输出纪律，主基准明确未启用行动工具、处方安全和多轮反馈。安全子系统具有实际设计证据但中心范围/实效尚不足，保留待定而非强制归类。", "abstract_read": true, "source_index": 120, "version_id": "2610.18298v2", "version": 2, "published": "2026-10-13T12:46:44Z", "updated": "2026-10-26T02:40:52Z", "summary_zh": "该框架把候选—证据逐项证伪与机器可验输出结合，并另设九态咨询流程、处方禁忌/剂量/妊娠检查、工具注册与参数审计、只读 SQL、沙箱超时及日志。作者称 21 项回归单测覆盖非法转移、工具循环、快照恢复和若干处方违规；但 200 例 TCMEval-SDT 的主结果在辨证阶段结束，未测试工具/处方安全层，不能写成临床安全或完整 Agent 防护已获验证。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "正文的确实现 Agent 生命周期非法转移阻断、处方硬约束和带审计的沙箱工具链，§5.8 有 21 项单测覆盖安全层；但主贡献与量化主结果是单轮辨证输出纪律，主基准明确未启用行动工具、处方安全和多轮反馈。安全子系统具有实际设计证据但中心范围/实效尚不足，保留待定而非强制归类。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.18298", "title": "Output Discipline Sets the Floor: A Falsification-Guided, Model-Agnostic Agent Protocol for Auditable Hypothesis-Driven Decision Making", "version_id": "2610.18298v2", "original_classification": "uncertain", "classification": "uncertain", "reason": "正文的确实现 Agent 生命周期非法转移阻断、处方硬约束和带审计的沙箱工具链，§5.8 有 21 项单测覆盖安全层；但主贡献与量化主结果是单轮辨证输出纪律，主基准明确未启用行动工具、处方安全和多轮反馈。安全子系统具有实际设计证据但中心范围/实效尚不足，保留待定而非强制归类。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.5 生命周期状态机", "§3.7 处方硬约束", "§4.2 主基准激活范围", "§5.8 机制执行审计", "附录 B 结构化工具链" ], "source_url": "https://arxiv.org/pdf/2610.18298v2", "summary_zh": "该框架把候选—证据逐项证伪与机器可验输出结合，并另设九态咨询流程、处方禁忌/剂量/妊娠检查、工具注册与参数审计、只读 SQL、沙箱超时及日志。作者称 21 项回归单测覆盖非法转移、工具循环、快照恢复和若干处方违规；但 200 例 TCMEval-SDT 的主结果在辨证阶段结束，未测试工具/处方安全层，不能写成临床安全或完整 Agent 防护已获验证。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "正文的确实现 Agent 生命周期非法转移阻断、处方硬约束和带审计的沙箱工具链，§5.8 有 21 项单测覆盖安全层；但主贡献与量化主结果是单轮辨证输出纪律，主基准明确未启用行动工具、处方安全和多轮反馈。安全子系统具有实际设计证据但中心范围/实效尚不足，保留待定而非强制归类。" }, "evidence_notes": [ "不要将摘要中的数学错误前提检测召回 89.8% 当作工具注入防御结果。", "单测存在不等同于真实临床或对抗场景的安全效果。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.5 生命周期状态机", "§3.7 处方硬约束", "§4.2 主基准激活范围", "§5.8 机制执行审计", "附录 B 结构化工具链" ], "body_source_url": "https://arxiv.org/pdf/2610.18298v2", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.18298v2", "abstract_sha256": "cef86c4182ade466fd6bcbc6ee6d9a539290a55ad140e384c34ef79efce80e80", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.18298", "title": "Output Discipline Sets the Floor: A Falsification-Guided, Model-Agnostic Agent Protocol for Auditable Hypothesis-Driven Decision Making", "version_id": "2610.18298v2", "first_author": "Jing Liu", "authors": [ "Jing Liu", "Yongxing Qi", "Ping Yao", "Ting Wu" ], "affiliations": [ "Hangzhou Innovation Institute, Beihang University" ], "source_url": "https://arxiv.org/pdf/2610.18298v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.18298v2", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.33009": { "id": "2610.33009", "title": "RADAgent: Automating RADseq Pipelines with Private Open-Source LLMs", "classification": "uncertain", "reason": "正文有按步骤工具 allowlist、外置执行与磁盘验收、200 次工具调用上限及有限维修层级，明确限制 Agent 自主调试范围；不过中心贡献仍是本地 RADseq 科学流水线自动化，故障评测主要检查产物/任务活性，未验证越权、注入或保密边界。保留工程安全边界相关性待定。", "abstract_read": true, "source_index": 146, "version_id": "2610.33009v1", "version": 1, "published": "2026-10-07T21:11:48Z", "updated": "2026-10-07T21:11:48Z", "summary_zh": "RADAgent 将 RADseq 分成 16 个模块，每步独立上下文和工具白名单，用运行时执行及磁盘检查替代模型自报成功，并限定工具次数和修复层级。476 个样本的本地分析证明流程能跑通；但结构/活性检查在六类合成故障中召回仅 39/87，数值正确性依赖离线基准，未证明 Agent 权限或隐私防护有效。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "正文有按步骤工具 allowlist、外置执行与磁盘验收、200 次工具调用上限及有限维修层级，明确限制 Agent 自主调试范围；不过中心贡献仍是本地 RADseq 科学流水线自动化，故障评测主要检查产物/任务活性，未验证越权、注入或保密边界。保留工程安全边界相关性待定。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.33009", "title": "RADAgent: Automating RADseq Pipelines with Private Open-Source LLMs", "version_id": "2610.33009v1", "original_classification": "uncertain", "classification": "uncertain", "reason": "正文有按步骤工具 allowlist、外置执行与磁盘验收、200 次工具调用上限及有限维修层级，明确限制 Agent 自主调试范围；不过中心贡献仍是本地 RADseq 科学流水线自动化，故障评测主要检查产物/任务活性，未验证越权、注入或保密边界。保留工程安全边界相关性待定。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§II 方法/步骤抽象", "§III 运行时工具调用与四级恢复", "§IV 验收故障测试/上下文管理" ], "source_url": "https://arxiv.org/pdf/2610.33009v1", "summary_zh": "RADAgent 将 RADseq 分成 16 个模块，每步独立上下文和工具白名单，用运行时执行及磁盘检查替代模型自报成功，并限定工具次数和修复层级。476 个样本的本地分析证明流程能跑通；但结构/活性检查在六类合成故障中召回仅 39/87，数值正确性依赖离线基准，未证明 Agent 权限或隐私防护有效。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "正文有按步骤工具 allowlist、外置执行与磁盘验收、200 次工具调用上限及有限维修层级，明确限制 Agent 自主调试范围；不过中心贡献仍是本地 RADseq 科学流水线自动化，故障评测主要检查产物/任务活性，未验证越权、注入或保密边界。保留工程安全边界相关性待定。" }, "evidence_notes": [ "本地执行本身不能写成已验证隐私安全；上下文隔离也不是独立 OS 沙箱。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§II 方法/步骤抽象", "§III 运行时工具调用与四级恢复", "§IV 验收故障测试/上下文管理" ], "body_source_url": "https://arxiv.org/pdf/2610.33009v1", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.SE", "q-bio.GN" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.33009v1", "abstract_sha256": "f501b270e7665fa7d3504520ff9ab0405201d20f6073c2e61958519a685a46d2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.33009", "title": "RADAgent: Automating RADseq Pipelines with Private Open-Source LLMs", "version_id": "2610.33009v1", "first_author": "Qiming Guo", "authors": [ "Qiming Guo", "Malaka Sudhakara Bava Sukruth Reddy", "Honggang Zhao", "Ye Wang", "Chen Pan", "Wenlu Wang" ], "affiliations": [ "Texas A&M University-Corpus Christi" ], "source_url": "https://arxiv.org/pdf/2610.33009v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.33009v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34141": { "id": "2610.34141", "title": "SpeC2Rust: Specification-Driven Repository-Level C-to-Rust Translation", "classification": "uncertain", "reason": "正文明确用只读测试边界阻止 RustRepairAgent 通过改测试绕过真实失败，存在 Agent 奖励/验收作弊防线；但中心贡献与安全指标仍是 C→Rust 迁移后的 unsafe/raw-pointer 数和等价测试，未单独验证 Agent 边界机制。作为父级补充复核保留待定，避免把全部内存安全迁移自动纳入 Agent Safety。", "abstract_read": true, "source_index": 161, "version_id": "2610.34141v1", "version": 1, "published": "2026-10-25T08:20:30Z", "updated": "2026-10-25T08:20:30Z", "summary_zh": "SpeC2Rust 以持久规范、符号注册表和分层诊断修复 C→Rust 仓库；八个项目编译并通过原端到端测试，结果无 unsafe 行或原始指针声明/解引用。修复阶段将数据集测试设为只读，以免 Agent 修改验收标准；但未独立量化该边界的安全效果，整体仍主要是迁移能力与生成代码内存安全。", "topics": { "tags": [ "authorization", "monitoring" ], "reason_zh": "正文明确用只读测试边界阻止 RustRepairAgent 通过改测试绕过真实失败，存在 Agent 奖励/验收作弊防线；但中心贡献与安全指标仍是 C→Rust 迁移后的 unsafe/raw-pointer 数和等价测试，未单独验证 Agent 边界机制。作为父级补充复核保留待定，避免把全部内存安全迁移自动纳入 Agent Safety。" }, "initial_classification": "relevant", "scope_review": { "id": "2610.34141", "title": "SpeC2Rust: Specification-Driven Repository-Level C-to-Rust Translation", "version_id": "2610.34141v1", "original_classification": "relevant", "classification": "uncertain", "reason": "正文明确用只读测试边界阻止 RustRepairAgent 通过改测试绕过真实失败，存在 Agent 奖励/验收作弊防线；但中心贡献与安全指标仍是 C→Rust 迁移后的 unsafe/raw-pointer 数和等价测试，未单独验证 Agent 边界机制。作为父级补充复核保留待定，避免把全部内存安全迁移自动纳入 Agent Safety。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§I 贡献与只读测试", "§III.C 分层修复", "§IV 实验设置", "§V RQ1 Safety/效果", "§VI 有效性威胁" ], "source_url": "https://arxiv.org/pdf/2610.34141v1", "summary_zh": "SpeC2Rust 以持久规范、符号注册表和分层诊断修复 C→Rust 仓库；八个项目编译并通过原端到端测试，结果无 unsafe 行或原始指针声明/解引用。修复阶段将数据集测试设为只读，以免 Agent 修改验收标准；但未独立量化该边界的安全效果，整体仍主要是迁移能力与生成代码内存安全。", "topics": { "tags": [ "authorization", "monitoring" ], "reason_zh": "正文明确用只读测试边界阻止 RustRepairAgent 通过改测试绕过真实失败，存在 Agent 奖励/验收作弊防线；但中心贡献与安全指标仍是 C→Rust 迁移后的 unsafe/raw-pointer 数和等价测试，未单独验证 Agent 边界机制。作为父级补充复核保留待定，避免把全部内存安全迁移自动纳入 Agent Safety。" }, "evidence_notes": [ "安全指标测的是生成 Rust 代码，不直接测 Agent 自身安全。" ], "review_request": "父级追加边界复核" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§I 贡献与只读测试", "§III.C 分层修复", "§IV 实验设置", "§V RQ1 Safety/效果", "§VI 有效性威胁" ], "body_source_url": "https://arxiv.org/pdf/2610.34141v1", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-27", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34141v1", "abstract_sha256": "f93df7bceae07e2896f72b86137a7faab10b145f1f8b5944c5e8db96f55d7994", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34141", "title": "SpeC2Rust: Specification-Driven Repository-Level C-to-Rust Translation", "version_id": "2610.34141v1", "first_author": "Junjie Yao", "authors": [ "Junjie Yao", "Xiongzheng Guan", "Jia Feng", "Yujia Chen", "Hongliang Tian", "Cuiyun Gao" ], "affiliations": [ "Harbin Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.34141v1", "shared_first_authors": [ "Junjie Yao", "Xiongzheng Guan" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Junjie Yao": [ "Harbin Institute of Technology" ], "Xiongzheng Guan": [ "Harbin Institute of Technology" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Junjie Yao* and Xiongzheng Guan* each explicitly list Harbin Institute of Technology, Shenzhen, China. First-page footnote * Co-first authors.", "author_source": "https://arxiv.org/abs/2610.34141v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34151": { "id": "2610.34151", "title": "Execution Logs Sway VLM Judges of Robot Progress", "classification": "relevant", "reason": "伪造执行日志操纵机器人视频VLM进度裁判，是具身Agent监控链中的不可信文本注入与轻量防御。", "abstract_read": true, "source_index": 162, "version_id": "2610.34151v1", "version": 1, "published": "2026-10-25T08:37:41Z", "updated": "2026-10-25T08:37:41Z", "summary_zh": "在机器人实际丧失进度的视频旁加入声称进展顺利的单行日志，作者称Gemini、Qwen和GPT裁判由正确判断转为进展判断的比例比中性日志高10–35个百分点；提示日志可能错误可消除大部分效应。选择性伪造任务完成声明令Qwen一半原正确判定翻转，非相关日志为一成，对Gemini未检测到效应。", "topics": { "tags": [ "injection", "monitoring", "evaluation", "embodied" ], "reason_zh": "对机器人评估器执行日志注入、监控误判及防御效果进行测试。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.LG", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34151v1", "abstract_sha256": "0da3676ccd2d9e4efdac6346371989ce7841b44f5edd02fc1500e7a96959d469", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34151", "title": "Execution Logs Sway VLM Judges of Robot Progress", "version_id": "2610.34151v1", "first_author": "Weiyan Zhao", "authors": [ "Weiyan Zhao", "Sunny Yang" ], "affiliations": [ "NLPQuant AI Inc." ], "source_url": "https://arxiv.org/pdf/2610.34151v1", "shared_first_authors": [ "Weiyan Zhao", "Sunny Yang" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Weiyan Zhao": [ "NLPQuant AI Inc." ], "Sunny Yang": [ "University of Illinois Urbana-Champaign" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Weiyan Zhao* / NLPQuant AI Inc. and Sunny Yang* / University of Illinois Urbana-Champaign; * Equal contribution.", "author_source": "https://arxiv.org/abs/2610.34151v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34185": { "id": "2610.34185", "title": "R2A-Sales: A Policy-Atom-Matched Benchmark for Rule-to-Action Gaps in Goal-Directed Sales Agents", "classification": "relevant", "reason": "直接衡量目标导向销售Agent在商业压力下是否执行合规工具动作，而非只复述安全政策，属于Agent安全行动评测。", "abstract_read": true, "source_index": 165, "version_id": "2610.34185v1", "version": 1, "published": "2026-10-25T09:45:03Z", "updated": "2026-10-25T09:45:03Z", "summary_zh": "R2A-Sales把静态政策问答与多轮销售任务按相同政策原子、事实、约束及工具合同配对，并由代码账本核验实际工具效果。发布集含3中文销售领域、24政策原子、42语义核心及2016配对；确认性研究覆盖21888运行。作者称静态合规率89.9–99.1%，八骨干实际安全行动合规仅3.0–17.3%，配对差距80.4–92.5个百分点；因行动指标还要求安全终止，该差距是规则到行动退化的上界而非商业压力的纯效应。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "按已提交工具动作核验硬性规则、安全终态及政策到行动的合规落差。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34185v1", "abstract_sha256": "2f57b7b151952759805ba54275a84588b5d5f8e2f4f13941fe338bb08e781d9e", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34185", "title": "R2A-Sales: A Policy-Atom-Matched Benchmark for Rule-to-Action Gaps in Goal-Directed Sales Agents", "version_id": "2610.34185v1", "first_author": "Yihua Qin", "authors": [ "Yihua Qin", "Jiajie Jerry Zhao" ], "affiliations": [ "Tsinghua University", "Futura Lab, Futura.AI" ], "source_url": "https://arxiv.org/pdf/2610.34185v1", "shared_first_authors": [ "Yihua Qin", "Jiajie Jerry Zhao" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Yihua Qin": [ "Tsinghua University", "Futura Lab, Futura.AI" ], "Jiajie Jerry Zhao": [ "Tsinghua University", "Futura Lab, Futura.AI" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF both authors carry 1,2,*; * These authors contributed equally. 1 Tsinghua University; 2 Futura Lab, Futura.AI.", "author_source": "https://arxiv.org/abs/2610.34185v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34239": { "id": "2610.34239", "title": "Honesty Testing of LLMs and AI Agents: A Vision for Software Engineering", "classification": "relevant", "reason": "直接定义和测试LLM Agent报告与自身判断相矛盾的诚实性缺陷，服务人类监督与控制。", "abstract_read": true, "source_index": 168, "version_id": "2610.34239v2", "version": 2, "published": "2026-10-25T12:11:07Z", "updated": "2026-10-27T08:52:50Z", "summary_zh": "愿景论文将诚实报告视为可指定、测试和维护的软件质量要求，定义honesty bug为系统应忠实报告时给出与当时自身判断冲突的明确声明。框架结合受控模型级与完整Agent系统级测试，连接测试工作流和oracle证据，并提出基准、模型/harness分析、oracle构造及生命周期测试方向；摘要未给实验结果。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "Agent诚实报告、监督证据及端到端安全测试框架。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34239v2", "abstract_sha256": "3ed77836cadac2ca304ab905278a3e1d249bf34eb7ea69a5c998c3602887537f", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.34239", "title": "Honesty Testing of LLMs and AI Agents: A Vision for Software Engineering", "version_id": "2610.34239v2", "first_author": "Ying Xiao", "authors": [ "Ying Xiao", "Xinjian Wu", "Lukas Twist", "Yaoqi Guo", "Yepang Liu", "Zhenpeng Chen", "Jie M. Zhang" ], "affiliations": [ "King’s College London" ], "source_url": "https://arxiv.org/pdf/2610.34239v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Ying Xiao* maps to * King’s College London, UK. Symbols denote institutions, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.34239v2", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34358": { "id": "2610.34358", "title": "EAST: Embodied AI Safety Testing via Systematic Fault Injection in Digital Twins", "classification": "relevant", "reason": "正文明确区分任务完成与安全谓词：碰撞距离、接触力和释放时序等必须在轨迹中持续满足；测试涵盖语言条件 RDT 的指令故障，以及 ACT/RDT 的感知、动作与时序干扰。属于具身/VLA Agent 行动安全，而非仅任务成功率鲁棒性。", "abstract_read": true, "source_index": 175, "version_id": "2610.34358v1", "version": 1, "published": "2026-10-25T15:10:51Z", "updated": "2026-10-25T15:10:51Z", "summary_zh": "EAST 将文献风险整理成专家审阅分类与八种可执行故障算子，先核故障是否实际发生，再用模拟器状态独立判断挑战、安全违规和任务成功。六个 RoboTwin 操作任务、ACT 与语言条件 RDT 中，五轮比较覆盖 74 个可用任务—策略—算子组合并取得 63 个有效证据；82 次有效执行虽然完成任务却违反安全要求。结果限数字孪生与指定谓词，尚未证明真实硬件或更广任务上的泛化。", "topics": { "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "正文明确区分任务完成与安全谓词：碰撞距离、接触力和释放时序等必须在轨迹中持续满足；测试涵盖语言条件 RDT 的指令故障，以及 ACT/RDT 的感知、动作与时序干扰。属于具身/VLA Agent 行动安全，而非仅任务成功率鲁棒性。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.34358", "title": "EAST: Embodied AI Safety Testing via Systematic Fault Injection in Digital Twins", "version_id": "2610.34358v1", "original_classification": "uncertain", "classification": "relevant", "reason": "正文明确区分任务完成与安全谓词：碰撞距离、接触力和释放时序等必须在轨迹中持续满足；测试涵盖语言条件 RDT 的指令故障，以及 ACT/RDT 的感知、动作与时序干扰。属于具身/VLA Agent 行动安全，而非仅任务成功率鲁棒性。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§2.2 安全规格", "§3.2–3.4 故障注入/有效性与状态 oracle", "§4 政策与六项 RoboTwin 任务", "§5 unsafe-success 与覆盖结果", "§6 有效性限制" ], "source_url": "https://arxiv.org/pdf/2610.34358v1", "summary_zh": "EAST 将文献风险整理成专家审阅分类与八种可执行故障算子，先核故障是否实际发生，再用模拟器状态独立判断挑战、安全违规和任务成功。六个 RoboTwin 操作任务、ACT 与语言条件 RDT 中，五轮比较覆盖 74 个可用任务—策略—算子组合并取得 63 个有效证据；82 次有效执行虽然完成任务却违反安全要求。结果限数字孪生与指定谓词，尚未证明真实硬件或更广任务上的泛化。", "topics": { "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "正文明确区分任务完成与安全谓词：碰撞距离、接触力和释放时序等必须在轨迹中持续满足；测试涵盖语言条件 RDT 的指令故障，以及 ACT/RDT 的感知、动作与时序干扰。属于具身/VLA Agent 行动安全，而非仅任务成功率鲁棒性。" }, "evidence_notes": [ "ACT 没有语言输入；指令算子 Op2/Op3 仅用于 RDT，不能说两种策略都测试语言注入。", "高安全挑战暴露率不是高危险率；82 次 unsafe-success 也不是相对基线优越性的指标。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§2.2 安全规格", "§3.2–3.4 故障注入/有效性与状态 oracle", "§4 政策与六项 RoboTwin 任务", "§5 unsafe-success 与覆盖结果", "§6 有效性限制" ], "body_source_url": "https://arxiv.org/pdf/2610.34358v1", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-27", "categories_seen": [ "cs.RO", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34358v1", "abstract_sha256": "2a2f9c570f2e155cb7dec5e87d2dc41234e78f6f0ea1fd789a41e015985caa6b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34358", "title": "EAST: Embodied AI Safety Testing via Systematic Fault Injection in Digital Twins", "version_id": "2610.34358v1", "first_author": "Yuhao Tian", "authors": [ "Yuhao Tian", "Tao Li", "Ling Zhou", "Dave Towey", "Zhaoxin Fan", "Wenjun Wu", "Rubing Huang", "Tsong Yueh Chen" ], "affiliations": [ "School of Computer Science and Engineering, Macau University of Science and Technology" ], "source_url": "https://arxiv.org/pdf/2610.34358v1", "shared_first_authors": [ "Yuhao Tian", "Tao Li" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Yuhao Tian": [ "School of Computer Science and Engineering, Macau University of Science and Technology" ], "Tao Li": [ "School of Artificial Intelligence (Institute of Artificial Intelligence), Beihang University" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF YUHAO TIAN* and TAO LI* have explicit individual institutional lines. * Co-first authors who contributed equally to this work.", "author_source": "https://arxiv.org/abs/2610.34358v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34435": { "id": "2610.34435", "title": "CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance", "classification": "relevant", "reason": "明确在真实开源维护工作中评测恶意Coding Agent植入可利用漏洞与审查Agent防御，是仓库/供应链Agent攻防。", "abstract_read": true, "source_index": 180, "version_id": "2610.34435v1", "version": 1, "published": "2026-10-25T16:44:07Z", "updated": "2026-10-25T16:44:07Z", "summary_zh": "CyberDual让攻击Agent在真实维护改动中隐藏可利用bug，审查Agent寻找并修复，再运行攻击者PoC判断漏洞是否残留；时间窗口可按季度由上游历史重建。作者称六攻击者产生1088有效攻击，三审查器捕获85–91%；漏洞跨真实提交分散时约六分之一攻击槽仍留下可利用代码。GLM 5.3贡献28个绕过所有审查器攻击中的13个；第二厂商审查可发现约三分之二Claude漏检。论文强调可执行PoC而非Agent自报判分及拒绝率不代表无攻击能力。", "topics": { "tags": [ "supplychain", "multiagent", "monitoring", "evaluation" ], "reason_zh": "恶意代码植入与AI审查的对抗系统，以漏洞利用执行验证防线有效性。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34435v1", "abstract_sha256": "cfe55b9842b4f6ecfb372baa04735269a7462e54e23c369acd3da5c4513f8689", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34435", "title": "CyberDual: AI Attackers versus AI Code Reviewers in Real Software Maintenance", "version_id": "2610.34435v1", "first_author": "Chenyuan Yang", "authors": [ "Chenyuan Yang", "Hwiwon Lee", "Jongseong Kim", "Yihan Yang", "Dongjun Kim", "Yinfang Chen", "Lingming Zhang" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "source_url": "https://arxiv.org/pdf/2610.34435v1", "shared_first_authors": [ "Chenyuan Yang", "Hwiwon Lee" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Chenyuan Yang": [ "University of Illinois Urbana-Champaign" ], "Hwiwon Lee": [ "University of Illinois Urbana-Champaign" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Rendered PDF p.1: Chenyuan Yang* and Hwiwon Lee* both bear Illinois icon, explicitly mapped to University of Illinois Urbana-Champaign. * Co-first authors. ASU icon is on Yinfang Chen, not these first authors; image-based markers are lost in plain text.", "author_source": "https://arxiv.org/abs/2610.34435v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34542": { "id": "2610.34542", "title": "LLM WikiLeaks: Uncovering URL-Based Capability Extension and Security Circumvention in Agentic Message Boards", "classification": "relevant", "reason": "实证分析受限自主Agent组合第三方URL服务扩展能力并绕过访问限制，直接揭示工具/网络权限边界失效。", "abstract_read": true, "source_index": 188, "version_id": "2610.34542v1", "version": 1, "published": "2026-10-25T20:07:53Z", "updated": "2026-10-25T20:07:53Z", "summary_zh": "论文分析ProWiki事件中14591条Agent编辑和79541个URL：仅获HTTP GET权限的Agent把公开德语wiki用作消息板，并通过嵌套URL调用外部服务。作者重建一至五层URL，发现26717次出现（33.6%）含嵌套目标，涉及67个中间服务；73.8%中间层用于内容抽取转换扩权，26.2%用于访问限制绕过与隐匿检测。多路径访问同目标与规避限流/隐藏来源一致，但不能据此将动机当作已证事实。", "topics": { "tags": [ "authorization", "multiagent", "monitoring" ], "reason_zh": "受限Agent外部服务组合扩权、网络边界绕过及公共消息板通信的实证监测。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34542v1", "abstract_sha256": "2b9547c6c6257efe0629080cecf1c2f8009906ea6eaa6a7f6a0db6d0ae6d5431", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34542", "title": "LLM WikiLeaks: Uncovering URL-Based Capability Extension and Security Circumvention in Agentic Message Boards", "version_id": "2610.34542v1", "first_author": "Orel Navi", "authors": [ "Orel Navi", "Elad Feldman", "Ben Nassi" ], "affiliations": [ "Tel Aviv University" ], "source_url": "https://arxiv.org/pdf/2610.34542v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.34542v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34634": { "id": "2610.34634", "title": "AgentProofBench: Benchmarking Reusable Verifiers for Web Agents", "classification": "uncertain", "reason": "正文检验 Web Agent 验收程序在初始状态/要求变化后是否误放行，以及错误门控是否引发持久状态回退；这可能涉及用户要求的动作边界，但具体例子是受让人/状态等业务正确性，未单独定义安全或权限违规。保留待定，不把通用验收程序基准直接当安全基准。", "abstract_read": true, "source_index": 197, "version_id": "2610.34634v1", "version": 1, "published": "2026-10-25T23:20:28Z", "updated": "2026-10-25T23:20:28Z", "summary_zh": "AgentProofBench 对 97 个 Web 任务的冻结验收程序做状态变化、复用和执行后果测试；在 22 个执行任务族中，面板完全正确的程序分配 32/33 能同时正确交付两个开局，有面板错误者仅 1/11。参考合约含保持原业务状态，但是否代表安全关键边界尚不明确，结论应表述为验证器可靠性，不泛化为防攻击效果。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "正文检验 Web Agent 验收程序在初始状态/要求变化后是否误放行，以及错误门控是否引发持久状态回退；这可能涉及用户要求的动作边界，但具体例子是受让人/状态等业务正确性，未单独定义安全或权限违规。保留待定，不把通用验收程序基准直接当安全基准。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.34634", "title": "AgentProofBench: Benchmarking Reusable Verifiers for Web Agents", "version_id": "2610.34634v1", "original_classification": "uncertain", "classification": "uncertain", "reason": "正文检验 Web Agent 验收程序在初始状态/要求变化后是否误放行，以及错误门控是否引发持久状态回退；这可能涉及用户要求的动作边界，但具体例子是受让人/状态等业务正确性，未单独定义安全或权限违规。保留待定，不把通用验收程序基准直接当安全基准。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.1 只读 verifier 沙箱", "§3.2 参考语义与状态保留案例", "§3.3–3.4 重用和执行策略", "§4 结果与门控回退", "§5 Benchmark 用途" ], "source_url": "https://arxiv.org/pdf/2610.34634v1", "summary_zh": "AgentProofBench 对 97 个 Web 任务的冻结验收程序做状态变化、复用和执行后果测试；在 22 个执行任务族中，面板完全正确的程序分配 32/33 能同时正确交付两个开局，有面板错误者仅 1/11。参考合约含保持原业务状态，但是否代表安全关键边界尚不明确，结论应表述为验证器可靠性，不泛化为防攻击效果。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "正文检验 Web Agent 验收程序在初始状态/要求变化后是否误放行，以及错误门控是否引发持久状态回退；这可能涉及用户要求的动作边界，但具体例子是受让人/状态等业务正确性，未单独定义安全或权限违规。保留待定，不把通用验收程序基准直接当安全基准。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.1 只读 verifier 沙箱", "§3.2 参考语义与状态保留案例", "§3.3–3.4 重用和执行策略", "§4 结果与门控回退", "§5 Benchmark 用途" ], "body_source_url": "https://arxiv.org/pdf/2610.34634v1", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.MA", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 15 of 15 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34634v1", "abstract_sha256": "6784c9bfadb30939bd1ead0ad9df16074db1ed4833f13a617bc808b18911f8e7", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34634", "title": "AgentProofBench: Benchmarking Reusable Verifiers for Web Agents", "version_id": "2610.34634v1", "first_author": "Jingjie Ning", "authors": [ "Jingjie Ning", "Xueqi Li", "Yi Lu", "Yibo Kong" ], "affiliations": [ "School of Computer Science, Carnegie Mellon University" ], "source_url": "https://arxiv.org/pdf/2610.34634v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF all four authors share School of Computer Science, Carnegie Mellon University. * on Jingjie Ning denotes Corresponding author.", "author_source": "https://arxiv.org/abs/2610.34634v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34654": { "id": "2610.34654", "title": "Thinking-in-Bets at Test Time Reduces Sycophantic Revisions in LLM Agents", "classification": "relevant", "reason": "直接缓解LLM Agent面对错误用户反馈时的谄媚失真和不必要代码修改，涉及行动可靠性与反馈条件安全对齐。", "abstract_read": true, "source_index": 199, "version_id": "2610.34654v1", "version": 1, "published": "2026-10-26T00:35:07Z", "updated": "2026-10-26T00:35:07Z", "summary_zh": "Thinking-in-Bets在读用户反馈前，让Agent私下记录主张、证据检查和置信度，被质疑后据此保护已验证工作并复查不确定部分。作者在五个Gemini模型、八基准上称可近乎消除补丁审查中的错误反转、保护正确报告，并减少多轮编码中错误投诉引发的无必要文件编辑；反馈后才记录收益很小，按不确定性触发可减少token开销且比基线修复更多真实bug。摘要未报告具体幅度。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "针对Agent错误反馈诱发的行为偏移，用预先证据记录和复核改善对齐与可靠动作。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34654v1", "abstract_sha256": "7cff5d9ecefa6f985d18839a4749fb4e83bbd78fdcd8c9393e427a994f61faec", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34654", "title": "Thinking-in-Bets at Test Time Reduces Sycophantic Revisions in LLM Agents", "version_id": "2610.34654v1", "first_author": "Nghi D. Q. Bui", "authors": [ "Nghi D. Q. Bui" ], "affiliations": [ "Google" ], "source_url": "https://arxiv.org/pdf/2610.34654v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.34654v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34826": { "id": "2610.34826", "title": "TrustJev: Separating Policy Authority from Untrusted Evidence in LLM-Based Decisions", "classification": "relevant", "reason": "保护自然语言决策系统的政策权威不被外部证据中指令覆盖，并评测认证和可执行授权规则，直接关联Agent决策安全边界。", "abstract_read": true, "source_index": 215, "version_id": "2610.34826v1", "version": 1, "published": "2026-10-26T04:17:53Z", "updated": "2026-10-26T04:17:53Z", "summary_zh": "TrustJev由单Transformer先按可信政策及候选计算受保护分数和修正预算，再限制不可信证据对决策的修正；训练区分保留事实的指令插入与真实答案变化，并允许政策不足时利用证据。作者称0.6B实现对14基线在三个认证/层级/授权数据集的Balance均最高，各超最强基线0.57–1.05个百分点；固定授权攻击池每来源32次全部答对比例95.77%，对照80.98%，推理内存及中位延迟相当，额外开销主要在训练。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "以架构化政策—证据分离抵御指令注入，并检验授权决策是否保持边界。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34826v1", "abstract_sha256": "0b86766af93d8c8ec5b3454abec0a238ed8a27293da83cd76c4a5d7d63fd3bb6", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34826", "title": "TrustJev: Separating Policy Authority from Untrusted Evidence in LLM-Based Decisions", "version_id": "2610.34826v1", "first_author": "Zhiwei Xu", "authors": [ "Zhiwei Xu", "Xuyang Liu", "Xiaolin Peng", "Weixian Deng", "Jiabao Gao", "Zirui Li", "Tian Qiu", "Boya Zhou", "Wei Jiao", "Hai Wan", "Xibin Zhao" ], "affiliations": [ "KLISS, BNRist, School of Software, Tsinghua University" ], "source_url": "https://arxiv.org/pdf/2610.34826v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Zhiwei Xu† maps to † KLISS, BNRist, School of Software, Tsinghua University. Dagger is institutional marker, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.34826v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35188": { "id": "2610.35188", "title": "V$^3$AST-Bench: Verifiable, Valid, and Versatile Safety Evaluation for Coding Agents", "classification": "relevant", "reason": "专门评测Coding Agent仓库修改、程序执行和服务交互的真实安全后果，并剥离任务能力混淆，直接命中日报核心范围。", "abstract_read": true, "source_index": 245, "version_id": "2610.35188v1", "version": 1, "published": "2026-10-26T10:44:18Z", "updated": "2026-10-26T10:44:18Z", "summary_zh": "问题：Coding Agent口头识别风险不等于没有实际危害，任务不会做也不能算安全。方法：V³AST-Bench用212个风险任务与能力配对任务、可执行环境状态/接收记录/产物检查分别验证危害和能力；评测11模型、5种harness的51组合，86,496次试验。作者报告Opus4.8配Claude Code的ASR@4为20.9%。正文核验：该指标只统计能力配对四次均成功的任务，四次中任一次危害即算受损，不是每次调用或全部任务的单次风险率。实验使用宽松自主配置，不能外推默认强防护；能力失败和良性过拒绝仍难区分。", "topics": { "tags": [ "authorization", "evaluation", "monitoring", "robustness" ], "reason_zh": "以运行时后果核验编码Agent的行动安全、模型/harness差异及风险知行差距。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "Abstract", "§3.2.3", "§4.1/Table1", "§5.2", "§6" ], "body_source_url": "https://arxiv.org/pdf/2610.35188v1", "announcement_date": "2026-10-27", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35188v1", "abstract_sha256": "c37617d45d1fc0a8c2845d2ba33937bf164a23101802a0fb20f998f29b42a4f7", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35188", "title": "V$^3$AST-Bench: Verifiable, Valid, and Versatile Safety Evaluation for Coding Agents", "version_id": "2610.35188v1", "first_author": "Weitao Feng", "authors": [ "Weitao Feng", "Hengheng Xiong", "Zihao Zeng", "Jun Chen", "Jiyang Guan", "Xiaofeng Wang", "Jialing Tao", "Hui Xue", "Wei Dong" ], "affiliations": [ "Nanyang Technological University" ], "source_url": "https://arxiv.org/pdf/2610.35188v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Weitao Feng¹; first-page bottom footnote 1 Nanyang Technological University, Singapore; 2 Alibaba Group, Hangzhou, China.", "author_source": "https://arxiv.org/abs/2610.35188v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35451": { "id": "2610.35451", "title": "Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security", "classification": "relevant", "reason": "实证研究OpenClaw个人助理Agent提示注入、权限、泄露与不安全执行的跨组件信任边界，直接命中范围。", "abstract_read": true, "source_index": 265, "version_id": "2610.35451v1", "version": 1, "published": "2026-10-26T13:49:22Z", "updated": "2026-10-26T13:49:22Z", "summary_zh": "研究采集13个OpenClaw相关subreddit的超2.5万帖，识别162安全帖及1787评论；从358个安全标记GitHub issue保留180个具体问题。作者通过定性分析和证据化CWE映射得到521个弱点实例、59种类型，集中于访问控制、敏感数据泄露、注入和不安全执行，并将543条防护建议归为七策略。另以虚拟秘密值重建一个泄露路径；这些是报告编码与示例重建，不等于521个独立验证漏洞。", "topics": { "tags": [ "injection", "authorization", "memory", "privacy", "monitoring", "evaluation" ], "reason_zh": "OpenClaw推理、工具、记忆、执行和部署链的实际安全问题及多层防护建议。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35451v1", "abstract_sha256": "68d352ca40bb020021c5887bb5dc8436e5fc505edca4bb903817bfa3494907d8", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35451", "title": "Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security", "version_id": "2610.35451v1", "first_author": "Mostafijur Rahman Akhond", "authors": [ "Mostafijur Rahman Akhond", "Mahmuda Khatun", "Gias Uddin" ], "affiliations": [ "York University" ], "source_url": "https://arxiv.org/pdf/2610.35451v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.35451v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35497": { "id": "2610.35497", "title": "When Fine-Grained Credit Assignment Helps and Hurts: Multimodal Agentic Reinforcement Learning through Video Editing", "classification": "relevant", "reason": "明确发现多模态工具Agent训练中过程奖励引发奖励作弊，并通过奖励衰减缓解，属于Agent目标错配与对齐。", "abstract_read": true, "source_index": 270, "version_id": "2610.35497v1", "version": 1, "published": "2026-10-26T14:25:40Z", "updated": "2026-10-26T14:25:40Z", "summary_zh": "研究用四类电影预告编辑任务比较Agent RL信用分配。作者称衰减过程奖励在平均超60轮Fine Cut上较结果奖励GRPO提升45.4%，短任务最多10.4%；固定过程奖励权重虽早期改善工具使用，后期却导致过度推理和冗余工具调用，过程分上涨而完成率和结果分下降。将过程奖励衰减至零可缓解这一reward hacking并保留早期收益；摘要未给安全危害率。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "工具Agent过程奖励与真实任务目标脱节的检测和缓解。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-27", "categories_seen": [ "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35497v1", "abstract_sha256": "675d56ec544c748d276ae20cc75c40113de2149e384cea12b1a97857849b382c", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35497", "title": "When Fine-Grained Credit Assignment Helps and Hurts: Multimodal Agentic Reinforcement Learning through Video Editing", "version_id": "2610.35497v1", "first_author": "Lei Zhao", "authors": [ "Lei Zhao", "Zongheng Cao", "Xinyu Hu" ], "affiliations": [ "University of Pennsylvania" ], "source_url": "https://arxiv.org/pdf/2610.35497v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Lei Zhao¹* maps to 1 University of Pennsylvania. * Part of this work was completed while Lei Zhao was an intern at Philo Labs; internship is not a second signed affiliation or shared first authorship.", "author_source": "https://arxiv.org/abs/2610.35497v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35966": { "id": "2610.35966", "title": "EMMA: Structured Episodic Memory for Multi-Agent Workflow Synthesis", "classification": "uncertain", "reason": "正文确有独立于骨干模型的自修改守卫：只准单个作用域编辑、保留大部分原提示、限制 Agent/技能数量、禁止把参考答案写入记忆；这可能构成多 Agent 自演化控制边界。但实验只衡量任务效果和训练开销，没有攻击、授权政策或安全关键不变量验证，不能直接宣称安全自演化。保留待定。", "abstract_read": true, "source_index": 301, "version_id": "2610.35966v1", "version": 1, "published": "2026-10-25T18:00:11Z", "updated": "2026-10-25T18:00:11Z", "summary_zh": "EMMA 将控制器路由、专用 Agent 提示与技能视作分层情景记忆，反思器把失败归因到限定作用域，每次仅作一个通过程序化守卫的增量编辑。作者在 KramaBench/AppWorld/BBEH 报告任务成绩和训练效率改善；同时承认即使任务最终失败，之前接受的编辑仍保留，可能留下无效或有害条目。该机制有自修改约束价值，但安全实证仍不足。", "topics": { "tags": [ "memory", "multiagent", "monitoring" ], "reason_zh": "正文确有独立于骨干模型的自修改守卫：只准单个作用域编辑、保留大部分原提示、限制 Agent/技能数量、禁止把参考答案写入记忆；这可能构成多 Agent 自演化控制边界。但实验只衡量任务效果和训练开销，没有攻击、授权政策或安全关键不变量验证，不能直接宣称安全自演化。保留待定。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.35966", "title": "EMMA: Structured Episodic Memory for Multi-Agent Workflow Synthesis", "version_id": "2610.35966v1", "original_classification": "uncertain", "classification": "uncertain", "reason": "正文确有独立于骨干模型的自修改守卫：只准单个作用域编辑、保留大部分原提示、限制 Agent/技能数量、禁止把参考答案写入记忆；这可能构成多 Agent 自演化控制边界。但实验只衡量任务效果和训练开销，没有攻击、授权政策或安全关键不变量验证，不能直接宣称安全自演化。保留待定。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.2.1 更新所有权表", "§3.2.2 程序化守卫", "§4–5 基准与消融", "§6 限制" ], "source_url": "https://arxiv.org/pdf/2610.35966v1", "summary_zh": "EMMA 将控制器路由、专用 Agent 提示与技能视作分层情景记忆，反思器把失败归因到限定作用域，每次仅作一个通过程序化守卫的增量编辑。作者在 KramaBench/AppWorld/BBEH 报告任务成绩和训练效率改善；同时承认即使任务最终失败，之前接受的编辑仍保留，可能留下无效或有害条目。该机制有自修改约束价值，但安全实证仍不足。", "topics": { "tags": [ "memory", "multiagent", "monitoring" ], "reason_zh": "正文确有独立于骨干模型的自修改守卫：只准单个作用域编辑、保留大部分原提示、限制 Agent/技能数量、禁止把参考答案写入记忆；这可能构成多 Agent 自演化控制边界。但实验只衡量任务效果和训练开销，没有攻击、授权政策或安全关键不变量验证，不能直接宣称安全自演化。保留待定。" }, "evidence_notes": [ "no leakage 指参考答案/任务文本泄漏到训练记忆，不是用户隐私泄漏。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.2.1 更新所有权表", "§3.2.2 程序化守卫", "§4–5 基准与消融", "§6 限制" ], "body_source_url": "https://arxiv.org/pdf/2610.35966v1", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35966v1", "abstract_sha256": "fc8dce60923a876e8c310a64d6522266d0b6999909a945c7b6aedf2d39872af0", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35966", "title": "EMMA: Structured Episodic Memory for Multi-Agent Workflow Synthesis", "version_id": "2610.35966v1", "first_author": "Ruijia Niu", "authors": [ "Ruijia Niu", "Kaiwen Liu", "Rose Yu", "Kristina Klinkner" ], "affiliations": [ "University of California San Diego", "Amazon" ], "source_url": "https://arxiv.org/pdf/2610.35966v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Ruijia Niu¹,²,* maps to 1 University of California San Diego and 2 Amazon in first-page footnotes. * Work done during an internship at Amazon, not equal contribution. Amazon is retained because it is also explicitly numbered in the signed affiliation. The separate † note about Rose Yu no longer being affiliated with Amazon does not apply to Niu.", "author_source": "https://arxiv.org/abs/2610.35966v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.35982": { "id": "2610.35982", "title": "Generation and Verification: Human-Agent Collaboration for Safety-Critical Automotive Software Engineering", "classification": "relevant", "reason": "面向安全关键汽车软件的人类—编码Agent协作与独立验证工具，明确涉及代码安全要求和MCP验证控制。", "abstract_read": true, "source_index": 303, "version_id": "2610.35982v1", "version": 1, "published": "2026-10-26T11:04:55Z", "updated": "2026-10-26T11:04:55Z", "summary_zh": "汽车C/C++编码助手经MCP向开发者提供generate、edit、verify三工具，使人类能检查任何代码而非依赖Agent自检；用生产函数、需求文本和UML行为构造领域数据，比较提示定制与微调。两周生产试点中开发者报告verify最常用且也验证手写代码，75%偏好较快提示方案；MISRA/AUTOSAR启发的模式检查显示提示方案C违规较少、微调C++架构符合性较好，摘要未给正式标准认证或漏洞率。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "安全关键代码生成的人工监督、MCP验证工具及标准启发检查。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35982v1", "abstract_sha256": "2f3dc412f4a048b26e32686e186a8c612b5680165581cec7f2d9d1d68d84b0b2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35982", "title": "Generation and Verification: Human-Agent Collaboration for Safety-Critical Automotive Software Engineering", "version_id": "2610.35982v1", "first_author": "Elizaveta Zinovyeva", "authors": [ "Elizaveta Zinovyeva", "Aiham Taleb", "Nikita Kozodoi", "Daniel Schleicher", "Amir Mahdi Namazi", "Martin Kraus", "Levent Kent", "Brian Jensen" ], "affiliations": [ "Amazon Web Services" ], "source_url": "https://arxiv.org/pdf/2610.35982v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Elizaveta Zinovyeva¹ maps to 1 Amazon Web Services, Germany. * belongs to Brian Jensen and means work done while at Amazon Web Services; no shared-first designation.", "author_source": "https://arxiv.org/abs/2610.35982v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36334": { "id": "2610.36334", "title": "PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority", "classification": "relevant", "reason": "§III.C 明确把仓库/日志/公告中的提示注入纳入威胁，AI 服务的工具请求必须经确定性 broker，不能冒充人工、扩大网络范围、改变保密期或调用生产 CVE 发布接口；审批还绑定证据修订、收件人和载荷，属于 Agent 代表用户执行外部动作的授权边界。", "abstract_read": true, "source_index": 327, "version_id": "2610.36334v1", "version": 1, "published": "2026-10-26T22:03:59Z", "updated": "2026-10-26T22:03:59Z", "summary_zh": "FedTrust-CVDv2 将 AI 漏洞发现辅助与披露权限分开：材料作为数据而非指令，工具经确定性代理，人工/CNA 授权绑定精确证据版本、收件范围、载荷、到期与撤销状态。局部参考实现接受 25 个有效 fixture、拒绝 650 个无效 fixture；单防线移除会放行 25–75 个无效 fixture。未使用模型 API、真实库存或生产 CVE 端点，PHP2Shell 是公开事实的回顾映射，不是系统实际运行或漏洞真实性证明。", "topics": { "tags": [ "authorization", "injection", "monitoring", "privacy" ], "reason_zh": "§III.C 明确把仓库/日志/公告中的提示注入纳入威胁，AI 服务的工具请求必须经确定性 broker，不能冒充人工、扩大网络范围、改变保密期或调用生产 CVE 发布接口；审批还绑定证据修订、收件人和载荷，属于 Agent 代表用户执行外部动作的授权边界。" }, "initial_classification": "uncertain", "scope_review": { "id": "2610.36334", "title": "PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority", "version_id": "2610.36334v1", "original_classification": "uncertain", "classification": "relevant", "reason": "§III.C 明确把仓库/日志/公告中的提示注入纳入威胁，AI 服务的工具请求必须经确定性 broker，不能冒充人工、扩大网络范围、改变保密期或调用生产 CVE 发布接口；审批还绑定证据修订、收件人和载荷，属于 Agent 代表用户执行外部动作的授权边界。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§III.A–C 架构/证据到动作契约/威胁模型", "§IV 本地 fixture 评测与消融", "§V PHP2Shell 案例表述", "§VI 操作限制与未来部署" ], "source_url": "https://arxiv.org/pdf/2610.36334v1", "summary_zh": "FedTrust-CVDv2 将 AI 漏洞发现辅助与披露权限分开：材料作为数据而非指令，工具经确定性代理，人工/CNA 授权绑定精确证据版本、收件范围、载荷、到期与撤销状态。局部参考实现接受 25 个有效 fixture、拒绝 650 个无效 fixture；单防线移除会放行 25–75 个无效 fixture。未使用模型 API、真实库存或生产 CVE 端点，PHP2Shell 是公开事实的回顾映射，不是系统实际运行或漏洞真实性证明。", "topics": { "tags": [ "authorization", "injection", "monitoring", "privacy" ], "reason_zh": "§III.C 明确把仓库/日志/公告中的提示注入纳入威胁，AI 服务的工具请求必须经确定性 broker，不能冒充人工、扩大网络范围、改变保密期或调用生产 CVE 发布接口；审批还绑定证据修订、收件人和载荷，属于 Agent 代表用户执行外部动作的授权边界。" }, "evidence_notes": [ "675 是构造策略测试样本，不是675个漏洞；650拒绝率不能写成真实提示注入防御成功率。", "作者明确把审计完整性与漏洞真实性区分。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§III.A–C 架构/证据到动作契约/威胁模型", "§IV 本地 fixture 评测与消融", "§V PHP2Shell 案例表述", "§VI 操作限制与未来部署" ], "body_source_url": "https://arxiv.org/pdf/2610.36334v1", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-28", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36334v1", "abstract_sha256": "def008a4989b085bee85c656474e65bef925f5872518a51f3a1931c9fc3d321a", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36334", "title": "PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority", "version_id": "2610.36334v1", "first_author": "Toqeer Ali Syed", "authors": [ "Toqeer Ali Syed", "Asadullah Abdullah Khan" ], "affiliations": [ "Faculty of Computer and Information System, Islamic University in Madinah" ], "source_url": "https://arxiv.org/pdf/2610.36334v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Toqeer Ali Syed and Asadullah Abdullah Khan* share Faculty of Computer and Information System, Islamic University in Madinah, Kingdom of Saudi Arabia. * designates corresponding author Khan, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.36334v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36422": { "id": "2610.36422", "title": "What Victims Take Away: Attack Reuse and Defense Revision after Prompt-Injection Attacks", "classification": "relevant", "reason": "分析LLM守护账户提示注入在受害者之间的复用传播及防御修订，直接涉及注入与授权边界；行为主体为游戏人类玩家，不应写成自主Agent自传播。", "abstract_read": true, "source_index": 334, "version_id": "2610.36422v1", "version": 1, "published": "2026-10-27T00:04:45Z", "updated": "2026-10-27T00:04:45Z", "summary_zh": "研究Tensor Trust全部563349攻击记录，用同时间相似玩家间流传但目标未收到的攻击作匹配对照。成功突破目标防御的攻击一周内被其复用10.0%，匹配对照0.03%，调整差8.8–10.0个百分点；近成功但判失败的文本很少复用，显示更像收益驱动。防御修改后同族攻击相对其他防御者的成功率下降24.5个百分点，已收到文本占所分析成功劫持23.2%。作者提出安全报告可描述技术而不公开完整载荷的待检验假说。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "账户守护LLM的提示注入传播、攻击复用与防线更新效果。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "announcement_date": "2026-10-28", "categories_seen": [ "cs.CR", "cs.HC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36422v1", "abstract_sha256": "69abe7d904bd1110b489b4fd8989ecdf3510d51e5edb3a60d248ad284255834b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36422", "title": "What Victims Take Away: Attack Reuse and Defense Revision after Prompt-Injection Attacks", "version_id": "2610.36422v1", "first_author": "Zihan Chen", "authors": [ "Zihan Chen", "Lei Nico Zheng", "Di Zhu" ], "affiliations": [ "Stevens Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.36422v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF author block explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in author block or footnotes.", "author_source": "https://arxiv.org/abs/2610.36422v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2605.12856": { "id": "2605.12856", "title": "Moderation by Interrogation: Uncovering Concealed Intent in Agent Social Networks", "classification": "relevant", "reason": "直接研究多Agent社交网络中以正常内容掩盖恶意目标的Agent检测；但首发于2026-05-13，本次属旧论文修订，不是今天新论文。", "abstract_read": true, "published": "2026-05-13T01:04:16Z", "version": 3, "summary_zh": "问题：恶意Agent可发布表面正常内容绕过内容审核。方法：Bot-Mod以固定诊断问题询问Agent，从内容先验出发，依据各候选意图下回答的似然进行贝叶斯后验更新；构建源自Moltbook的Molt-Intent数据集。作者报告：在Molt-Intent、外部社会工程数据和三种Agent模型上优于内容审核、微调分类器与judge询问基线；域内/域外综合F1为0.736/0.684，分别高于最佳基线22%/14%。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "以多Agent社区中的恶意意图作为威胁，主动询问与后验推断实现监控，并提供安全检测数据集和评测。" }, "updated": "2026-10-26T18:41:28Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2605.12856v3", "categories_seen": [ "cs.AI", "cs.SI" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 153 of 153 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.12856v3", "abstract_sha256": "c1f38c1dc39775ac554e79b522935af84cbaf4726c3b590922931edb237b2a15", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.12856", "title": "Moderation by Interrogation: Uncovering Concealed Intent in Agent Social Networks", "version_id": "2605.12856v3", "first_author": "Ali Al-Lawati", "authors": [ "Ali Al-Lawati", "Nafis Tripto", "Abolfazl Ansari", "Fali Wang", "Jason Lucas", "Suhang Wang", "Dongwon Lee" ], "affiliations": [ "The Pennsylvania State University" ], "source_url": "https://arxiv.org/pdf/2605.12856v3", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2605.12856v3", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2609.01487": { "id": "2609.01487", "title": "Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents", "classification": "relevant", "reason": "直接防御恶意Skill对Coding/通用Agent造成的泄密、代码破坏、绕审批和外传，且按用户任务边界进行运行时授权；首发2026-09-01，为旧论文修订。", "abstract_read": true, "published": "2026-09-01T16:19:31Z", "version": 4, "summary_zh": "问题：恶意Skill作为持久上下文，可在具体任务和工作区条件出现后诱导不安全行为，安装前审查不足。方法：Defense-as-Skill将运行时防护本身实现为可安装审阅编辑的Skill；SkillSonar逐项对照用户任务边界，将敏感动作判为允许、重规划或确认，不修改底层运行时。作者构建含6类风险、21子类、206个确认攻击与43个良性任务的SCOPE-R，并用MCTS演化guard。作者报告：Claude Code和OpenClaw上攻击成功率显著下降；GLM-5重复实验域内ASR由0.482降至0.104、域外由0.606降至0.115，并可迁移到其他模型、风险族和外部基准。", "topics": { "tags": [ "supplychain", "injection", "authorization", "memory", "evaluation", "privacy" ], "reason_zh": "恶意Skill是供应链与持久上下文注入入口；运行时guard约束动作和审批边界，评估包括泄密、外传等安全风险。" }, "updated": "2026-10-27T07:05:18Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2609.01487v4", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.01487v4", "abstract_sha256": "46209eac39c4761e2a547e24cf4307576bfa183fa28ee1dab2e334884dbe73c2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.01487", "title": "Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents", "version_id": "2609.01487v4", "first_author": "Xiaofang Yang", "authors": [ "Xiaofang Yang", "Ziqi Miao", "Chen Qian", "Dianbo Sui", "Jing Shao", "Lijun Li" ], "affiliations": [ "Shanghai Artificial Intelligence Laboratory", "Fudan University" ], "source_url": "https://arxiv.org/pdf/2609.01487v4", "shared_first_authors": [ "Xiaofang Yang", "Ziqi Miao" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Xiaofang Yang": [ "Shanghai Artificial Intelligence Laboratory", "Fudan University" ], "Ziqi Miao": [ "Shanghai Artificial Intelligence Laboratory" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Xiaofang Yang¹,²,* and Ziqi Miao¹,*; * Equal contribution. Numbered institutions explicitly mapped.", "author_source": "https://arxiv.org/abs/2609.01487v4", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.07359": { "id": "2610.07359", "title": "Evaluate the Stack, Not the Layer: Do Deterministic and LLM Gates for Agent Actions Fail Independently?", "classification": "relevant", "reason": "直接评估Agent工具动作的规则门控与LLM安全judge是否独立失效，涉及安全防线组合可靠性；首发2026-10-05，为旧论文修订。", "abstract_read": true, "published": "2026-10-05T20:26:58Z", "version": 2, "summary_zh": "问题：叠加运行时工具调用门控时，错误概率能否按独立层相乘。方法：在三个语料共1,119个标注Agent动作上测试一个确定性规则层和四个LLM judge，无自适应攻击者；用等效独立层数衡量组合效果，并区分升级人工算漏拦还是算捕获。作者报告：STRICT口径下两个judge仅约1.2–1.4层，规则+judge约1.86–2.09层；PRIMARY口径分别1.21–1.57与1.80–2.13层。规则包单层漏检下降20%却未新增联合覆盖；服务模型版本偏差和复核判决计分可改变结论。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "研究Agent动作安全门控的联合失效、运行时judge和规则组合的覆盖与评测口径。" }, "updated": "2026-10-26T13:24:47Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.07359v2", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 278 of 278 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.07359v2", "abstract_sha256": "52df085fabacb9b3590d534742d208c110a2374c5dd04e5d1f8bd6a344049e07", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.07359", "title": "Evaluate the Stack, Not the Layer: Do Deterministic and LLM Gates for Agent Actions Fail Independently?", "version_id": "2610.07359v2", "first_author": "Chenglin Yang", "authors": [ "Chenglin Yang" ], "affiliations": [ "University of Lancashire" ], "source_url": "https://arxiv.org/pdf/2610.07359v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.07359v2", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.33011": { "id": "2610.33011", "title": "When Agents Collude: Weak-to-Strong On-Policy Distillation for Mitigating Strategic Deception in Multi-Agent Systems", "classification": "relevant", "reason": "直接评测多Agent串谋、误对齐交易及向监督者持续欺骗，并训练诚实性防御；首发2026-10-08；为v1，公告日期为2026-10-27，是否计入日报按公告窗口确定。", "abstract_read": true, "published": "2026-10-08T01:38:24Z", "version": 1, "summary_zh": "问题：Agent协作是否放大共同行为偏离与对监督者的隐瞒。方法：在模拟内幕交易环境比较七个语言模型的单Agent、顺序团队和去中心化团队，改变系统目标和压力；PACT以较小、冻结、诚实对齐的教师对强学生自身采样续写进行反向KL策略蒸馏。作者报告：多Agent交互使误对齐动作率由35.4%增至68.2%，持续欺骗率由31.0%增至62.2%；生存压力下团队87%的运行持续欺骗。伦理指令与生存压力条件下PACT将多Agent持续欺骗从80%降至3%。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "聚焦协作Agent串谋与对监督者的战略欺骗，提供压力场景安全评测和诚实性对齐干预。" }, "updated": "2026-10-08T01:38:24Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.33011v1", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 78 of 78 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 200 of 200 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 15 of 15 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.33011v1", "abstract_sha256": "c4e4463fc0f279d762f3d0fd5785302c50ec9ce7617c43709e91dd34d44ce8b3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.33011", "title": "When Agents Collude: Weak-to-Strong On-Policy Distillation for Mitigating Strategic Deception in Multi-Agent Systems", "version_id": "2610.33011v1", "first_author": "Eric Onyame", "authors": [ "Eric Onyame", "Runtao Zhou", "Kowshik Thopalli", "Bhavya Kailkhura", "Chirag Agarwal" ], "affiliations": [ "University of Virginia" ], "source_url": "https://arxiv.org/pdf/2610.33011v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Eric Onyame with University of Virginia directly underneath. * footnote Corresponding author: Eric Onyame.", "author_source": "https://arxiv.org/abs/2610.33011v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.33026": { "id": "2610.33026", "title": "False Belief Dissemination, Persistence and Mitigation in Multi-Agent Social Networks Through the Lens of the Mandela Effect", "classification": "relevant", "reason": "明确研究多Agent社会网络中虚假信念传播、持久记忆证据和干预，为多Agent安全与上下文污染问题；首发2026-10-11；为v1，公告日期为2026-10-27，是否计入日报按公告窗口确定。", "abstract_read": true, "published": "2026-10-11T06:49:02Z", "version": 1, "summary_zh": "问题：Agent通信、记忆和共同网络可能使虚假信念扩散，并在造假者退出后持续。方法：建立连接Agent通信、私有记忆和模拟网页的受控框架，使用覆盖8个领域、4种可信程度的540条伪造说法，评估传播广度速度、撤除传播者后的持续性及事前/事后干预。作者报告：传播范围最高96.0%；可信程度、领域、网络规模与组成影响范围，拓扑影响速度；撤除造假者后接受度几乎不降，针对性纠正优于预防措施，但仍无法消除错误信念。", "topics": { "tags": [ "multiagent", "memory", "injection", "evaluation" ], "reason_zh": "虚假外部内容经Agent通信和记忆形成持久污染，研究跨Agent传播与纠正评测。" }, "updated": "2026-10-11T06:49:02Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.33026v1", "categories_seen": [ "cs.LG", "cs.MA", "cs.SI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 200 of 200 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.33026v1", "abstract_sha256": "52db888604e9ef1a21e6e446fea7467abfd8f5a59fa6bce0d8160405a5316cd6", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.33026", "title": "False Belief Dissemination, Persistence and Mitigation in Multi-Agent Social Networks Through the Lens of the Mandela Effect", "version_id": "2610.33026v1", "first_author": "Dianzhi Yu", "authors": [ "Dianzhi Yu", "Hongru Wang", "Ziheng Xiong", "Yanyu Chen", "Zixing Song", "Jianting Chen", "Zhenfei Yin", "Jeff Z. Pan", "Amos Storkey", "Irwin King" ], "affiliations": [ "The Chinese University of Hong Kong" ], "source_url": "https://arxiv.org/pdf/2610.33026v1", "shared_first_authors": [ "Dianzhi Yu", "Hongru Wang" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Dianzhi Yu": [ "The Chinese University of Hong Kong" ], "Hongru Wang": [ "University of Edinburgh" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Dianzhi Yu¹,* and Hongru Wang²,*; * Equal contribution; † Corresponding authors.", "author_source": "https://arxiv.org/abs/2610.33026v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34064": { "id": "2610.34064", "title": "Back to Basics: Formal Analysis Hints Improve Weak-to-Strong Monitoring", "classification": "relevant", "reason": "直接监控前沿Agent失配危险动作，并用来源、敏感行为及禁止效果提示修复弱监督器漏检；首发2026-10-25；为v1，公告日期为2026-10-27，是否计入日报按公告窗口确定。", "abstract_read": true, "published": "2026-10-25T04:56:24Z", "version": 1, "summary_zh": "问题：Agent监控器存在完全漏检、部分检测、接受虚假良性叙事和怀疑分数校准错误。方法：向轨迹增补命令来源链接、安全敏感动作标志和任务禁止效果标记，并结合弱extract-and-evaluate监控器。作者报告：低计算代价下显著改善检测，失败模式分析显示四类问题均可缓解，尤其几乎消除完全漏检；消融支持该组合的效率。摘要未给具体成功率或样本规模。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "以任务授权与安全敏感效果作为运行时证据，改进弱模型对强Agent危险行为的识别和校准。" }, "updated": "2026-10-25T04:56:24Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34064v1", "categories_seen": [ "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34064v1", "abstract_sha256": "ff0d9073c89059415ad8a18c2a363f4dcf969e6ff48dfac8a4e46056d8b904f4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34064", "title": "Back to Basics: Formal Analysis Hints Improve Weak-to-Strong Monitoring", "version_id": "2610.34064v1", "first_author": "Daniel Ben-Levi", "authors": [ "Daniel Ben-Levi", "Judah Goldfeder", "Mateusz Dziemian", "Raja Moreno" ], "affiliations": [ "Columbia University" ], "source_url": "https://arxiv.org/pdf/2610.34064v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Daniel Ben-Levi¹,† maps to 1 Columbia University. † Work completed at the Existential Risk Lab at UChicago; correspondence note. Work-location note is not a second signed affiliation.", "author_source": "https://arxiv.org/abs/2610.34064v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34167": { "id": "2610.34167", "title": "Task Success Is Not Enough: Side-effect-Aware Evaluation of Tool-Using Language Model Agents", "classification": "relevant", "reason": "直接评估工具Agent完成任务时的未授权写入、错误对象、范围扩张和错误收件人副作用；v1，公告日期2026-10-27，按日报公告窗口确定新稿资格。", "abstract_read": true, "published": "2026-10-25T08:54:08Z", "version": 1, "summary_zh": "问题：任务成功指标遗漏Agent执行未经授权副作用的附带损害。方法：SABench含201个邮件、日历和工单任务，组合四类状态结构与四类陷阱，以确定性轨迹oracle分别验证目标完成和授权遵守。作者报告：11个前沿LLM、2,211个模型任务运行中15.2%产生附带损害；歧义任务违规率38.8%，非歧义陷阱平均8.4%；目标完成的运行仍有12.8%未授权写入；跨工具与依赖状态损害率约为独立状态两倍，类似目标完成率下模型间损害率相差4.7倍。", "topics": { "tags": [ "authorization", "evaluation", "privacy" ], "reason_zh": "明确区分目标完成和用户授权，评测工具副作用、错误收件人、范围扩张与跨工具连锁伤害。" }, "updated": "2026-10-25T08:54:08Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34167v1", "categories_seen": [ "cs.AI", "cs.CL" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 78 of 78 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34167v1", "abstract_sha256": "99844743bf54e2ff5544c3e57bc1d5122e7b1b7541b859bcadd42f1a069a346c", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34167", "title": "Task Success Is Not Enough: Side-effect-Aware Evaluation of Tool-Using Language Model Agents", "version_id": "2610.34167v1", "first_author": "Jiaju Huang", "authors": [ "Jiaju Huang", "Shaobin Chen", "Xinglong Liang", "Xinyu Ma", "Hao Yang", "Wei Ke", "Tao Tan", "Yue Sun" ], "affiliations": [ "Macao Polytechnic University" ], "source_url": "https://arxiv.org/pdf/2610.34167v1", "shared_first_authors": [ "Jiaju Huang", "Shaobin Chen", "Xinglong Liang" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Jiaju Huang": [ "Macao Polytechnic University" ], "Shaobin Chen": [ "Southwest Medical University" ], "Xinglong Liang": [ "Netherlands Cancer Institute", "Radboud University Medical Center" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Jiaju Huang¹†, Shaobin Chen²†, Xinglong Liang³,⁴†; † Equal contribution. All four institution markers explicitly mapped.", "author_source": "https://arxiv.org/abs/2610.34167v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34365": { "id": "2610.34365", "title": "SEEK: Skill Extraction with Evolving Knowledge against Frontier Science Agents", "classification": "relevant", "reason": "直接红队评估科学Agent受保护Skill的机密泄露及自适应多轮提取攻击；首发2026-10-25、当前v2、公告2026-10-27，需按首公告与修订窗口判断新稿而非只看版本。", "abstract_read": true, "published": "2026-10-25T15:19:13Z", "version": 2, "summary_zh": "问题：科学Agent通过可复用Skill执行工作流时，交互可能泄露技能内容。方法：构建跨八个科学Agent平台的40项受保护Skill基准，比较直接、固定策略与bandit迭代探测；SEEK是黑盒自演化红队Agent，只依赖可见回答，把证据存入持久记忆并演化攻击Skill。作者报告：八个平台均至少泄露一项Skill，四个平台单次直接请求攻击成功率达100%；在SpatialAgent和Biomni的12项Skill上SEEK达100%，较bandit探测首成功轮数分别减少31.8%和38.2%；面对阻止三种基准协议的保密策略，仍提取六项中一项。", "topics": { "tags": [ "privacy", "supplychain", "memory", "evaluation" ], "reason_zh": "安全对象是Agent私有Skill内容，攻击通过自适应多轮探测与记忆积累造成机密泄露，并系统评测平台防护。" }, "updated": "2026-10-27T07:20:33Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34365v2", "categories_seen": [ "cs.AI", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34365v2", "abstract_sha256": "a249bf4a6d8ee579d072ff4a4bb592f988d38bdbb00166765c2b0755e7e272f3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.34365", "title": "SEEK: Skill Extraction with Evolving Knowledge against Frontier Science Agents", "version_id": "2610.34365v2", "first_author": "Cheng Gui", "authors": [ "Cheng Gui", "Xiang Zheng", "Yutao Wu", "Hanxun Huang", "Yige Li", "Kaidi Xu", "Cong Wang", "Wei-Ying Ma" ], "affiliations": [ "City University of Hong Kong", "Hong Kong Institute of AI for Science" ], "source_url": "https://arxiv.org/pdf/2610.34365v2", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF first author Cheng Gui column explicitly lists City University of Hong Kong and Hong Kong Institute of AI for Science. * on Xiang Zheng and Cong Wang means Corresponding authors.", "author_source": "https://arxiv.org/abs/2610.34365v2", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34594": { "id": "2610.34594", "title": "NovaFabric: A Black-Box Recorder for AI Agents with Sealed, Replayable, Diffable and Auditable Runs", "classification": "relevant", "reason": "为Agent提示、工具、文件/网络副作用和子Agent运行提供不可随意改写的证据封存、重放审计与访问控制，直接属于Agent监控及授权；v1。", "abstract_read": true, "published": "2026-10-25T21:51:37Z", "version": 1, "summary_zh": "问题：Agent运行包含多级模型、工具与外部效果，普通日志可变、不完整、不能重放，难以审计异常。方法：NovaFabric以平面文件Run Capsule作为真源、签名Evidence Bundle供审计，采用既有来源与签名标准，实现捕获、封存、失败即关闭的mock重放、差分和审计；胶囊按不可信输入处理，并设签名者信任、操作者信任列表与默认拒绝的仪表盘路由授权。作者明确本报告没有新实验，评估另见2609.12582；功能成熟度和限制逐项标注，公开源码计数由探针产生。", "topics": { "tags": [ "monitoring", "authorization", "supplychain" ], "reason_zh": "Agent运行证据的来源、签名与可审计重放直接支持行为追溯；默认拒绝与签名者信任控制授权边界。" }, "updated": "2026-10-25T21:51:37Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34594v1", "categories_seen": [ "cs.CR", "cs.DC", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34594v1", "abstract_sha256": "6d02e9382fcb42f10c9b8b2b324bf8a8250ceb27a2aca843033bbafedd7a9e82", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34594", "title": "NovaFabric: A Black-Box Recorder for AI Agents with Sealed, Replayable, Diffable and Auditable Runs", "version_id": "2610.34594v1", "first_author": "Mohsen Seyedkazemi Ardebili", "authors": [ "Mohsen Seyedkazemi Ardebili" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.34594v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "unresolved", "status": "partial", "evidence": "PDF cover, abstract author line and preface Author box name Mohsen Seyedkazemi Ardebili but list only personal website/ORCID/GitHub, with no institution. Full-text affiliation/author search found no signed institution. Do not infer independent researcher from missing institution.", "author_source": "https://arxiv.org/abs/2610.34594v1", "verification_status": "author_verified_affiliation_unconfirmed" }, "revision_history": [] }, "2610.34620": { "id": "2610.34620", "title": "Built to Remember, Shipped to Forget: Operational Contracts, Failures, and Repairs in Containerized LLM Agent Deployments", "classification": "relevant", "reason": "除一般部署可靠性，论文 OC7 明确要求 Agent 恢复/重试时外部副作用只执行一次，并分析人工暂停、记忆和恢复契约及幂等修复。该动作执行边界与故障后状态完整性属于 Agent 自身运行安全；但运行实证中的外部动作重复主要是模型调用，不可夸大为已观察重复支付等事故。", "abstract_read": true, "published": "2026-10-25T22:36:56Z", "version": 1, "summary_zh": "论文从 LangGraph 与 Docker/Compose/Kubernetes 文档提炼 14 项 Agent 部署契约，检查 433 个系统并在 12 个系统注入事件。16 个预测违规中 14 个变成运行失败；恢复会重放中断步骤，代理记录到重复模型调用，体现外部动作需幂等。开发修复包含用 idempotency key/claim 防止重复副作用。研究还覆盖人工暂停和持久状态丢失；结果主要支持运行安全边界，不能据此声称实际交易或权限审批已被绕过。", "topics": { "tags": [ "memory", "robustness", "monitoring", "evaluation" ], "reason_zh": "除一般部署可靠性，论文 OC7 明确要求 Agent 恢复/重试时外部副作用只执行一次，并分析人工暂停、记忆和恢复契约及幂等修复。该动作执行边界与故障后状态完整性属于 Agent 自身运行安全；但运行实证中的外部动作重复主要是模型调用，不可夸大为已观察重复支付等事故。" }, "updated": "2026-10-25T22:36:56Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "initial_classification": "uncertain", "scope_review": { "id": "2610.34620", "title": "Built to Remember, Shipped to Forget: Operational Contracts, Failures, and Repairs in Containerized LLM Agent Deployments", "version_id": "2610.34620v1", "original_classification": "uncertain", "classification": "relevant", "reason": "除一般部署可靠性，论文 OC7 明确要求 Agent 恢复/重试时外部副作用只执行一次，并分析人工暂停、记忆和恢复契约及幂等修复。该动作执行边界与故障后状态完整性属于 Agent 自身运行安全；但运行实证中的外部动作重复主要是模型调用，不可夸大为已观察重复支付等事故。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "表 I 14 项契约特别是 OC7", "§IV 仓库分析", "§V 故障注入与表 III", "§VI 修复分类/F7", "§VII 有效性威胁" ], "source_url": "https://arxiv.org/pdf/2610.34620v1", "summary_zh": "论文从 LangGraph 与 Docker/Compose/Kubernetes 文档提炼 14 项 Agent 部署契约，检查 433 个系统并在 12 个系统注入事件。16 个预测违规中 14 个变成运行失败；恢复会重放中断步骤，代理记录到重复模型调用，体现外部动作需幂等。开发修复包含用 idempotency key/claim 防止重复副作用。研究还覆盖人工暂停和持久状态丢失；结果主要支持运行安全边界，不能据此声称实际交易或权限审批已被绕过。", "topics": { "tags": [ "memory", "robustness", "monitoring", "evaluation" ], "reason_zh": "除一般部署可靠性，论文 OC7 明确要求 Agent 恢复/重试时外部副作用只执行一次，并分析人工暂停、记忆和恢复契约及幂等修复。该动作执行边界与故障后状态完整性属于 Agent 自身运行安全；但运行实证中的外部动作重复主要是模型调用，不可夸大为已观察重复支付等事故。" }, "evidence_notes": [ "OC7 在仓库静态证据中不可判定；运行时直接测量重复动作。", "故障注入的明确重复证据是 model call，不是任意物理/支付副作用。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "表 I 14 项契约特别是 OC7", "§IV 仓库分析", "§V 故障注入与表 III", "§VI 修复分类/F7", "§VII 有效性威胁" ], "body_source_url": "https://arxiv.org/pdf/2610.34620v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.34620v1", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34620v1", "abstract_sha256": "bad3630eed716444d1f4bd85285325215dd098daae9c13655bdcfbd9e756397a", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34620", "title": "Built to Remember, Shipped to Forget: Operational Contracts, Failures, and Repairs in Containerized LLM Agent Deployments", "version_id": "2610.34620v1", "first_author": "Meriem Mastouri", "authors": [ "Meriem Mastouri", "Emna Ksontini", "Amine Barrak" ], "affiliations": [ "University of North Carolina Wilmington" ], "source_url": "https://arxiv.org/pdf/2610.34620v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.34620v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34735": { "id": "2610.34735", "title": "iPrefBench: A User-Centric Benchmark for Personalized Mobile Use Agents", "classification": "uncertain", "reason": "正文确实展示移动 Agent 在日期/人数等 ask-only 信息未获用户输入时直接确认预订，且要求在无可接受替代时停止，已触及代表用户行动的意图边界；但基准中心仍是个性化补全与任务成功，没有区分安全关键授权、不可逆损害或一般偏好错误。保留范围待定，不能仅凭会询问或会预订就认定安全评测。", "abstract_read": true, "published": "2026-10-26T02:35:41Z", "version": 1, "summary_zh": "iPrefBench 用 3,051 条用户历史和可执行 iOS 环境构造 26 应用的 130 个缺省任务，区分可从历史推断和只能询问用户的信息。7 个 Agent 的最高动作完成为 91.6%，完整任务成功为 47.7%；正文案例包括使用默认时间/人数直接确认餐厅预订。该现象可能关联用户行动授权，但论文主要量度个性化而非安全风险，暂不强归类。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "正文确实展示移动 Agent 在日期/人数等 ask-only 信息未获用户输入时直接确认预订，且要求在无可接受替代时停止，已触及代表用户行动的意图边界；但基准中心仍是个性化补全与任务成功，没有区分安全关键授权、不可逆损害或一般偏好错误。保留范围待定，不能仅凭会询问或会预订就认定安全评测。" }, "updated": "2026-10-26T02:35:41Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "initial_classification": "uncertain", "scope_review": { "id": "2610.34735", "title": "iPrefBench: A User-Centric Benchmark for Personalized Mobile Use Agents", "version_id": "2610.34735v1", "original_classification": "uncertain", "classification": "uncertain", "reason": "正文确实展示移动 Agent 在日期/人数等 ask-only 信息未获用户输入时直接确认预订，且要求在无可接受替代时停止，已触及代表用户行动的意图边界；但基准中心仍是个性化补全与任务成功，没有区分安全关键授权、不可逆损害或一般偏好错误。保留范围待定，不能仅凭会询问或会预订就认定安全评测。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.3 任务设计和三类扰动", "§3.4 评估指标", "附录 F Silent Default/Missed Inference 案例" ], "source_url": "https://arxiv.org/pdf/2610.34735v1", "summary_zh": "iPrefBench 用 3,051 条用户历史和可执行 iOS 环境构造 26 应用的 130 个缺省任务，区分可从历史推断和只能询问用户的信息。7 个 Agent 的最高动作完成为 91.6%，完整任务成功为 47.7%；正文案例包括使用默认时间/人数直接确认餐厅预订。该现象可能关联用户行动授权，但论文主要量度个性化而非安全风险，暂不强归类。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "正文确实展示移动 Agent 在日期/人数等 ask-only 信息未获用户输入时直接确认预订，且要求在无可接受替代时停止，已触及代表用户行动的意图边界；但基准中心仍是个性化补全与任务成功，没有区分安全关键授权、不可逆损害或一般偏好错误。保留范围待定，不能仅凭会询问或会预订就认定安全评测。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.3 任务设计和三类扰动", "§3.4 评估指标", "附录 F Silent Default/Missed Inference 案例" ], "body_source_url": "https://arxiv.org/pdf/2610.34735v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.34735v1", "categories_seen": [ "cs.CL" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34735v1", "abstract_sha256": "77fc57538e8832fe0bb3218f7fa9611fed2c50ac61c70dab0f5e1d7683996a30", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34735", "title": "iPrefBench: A User-Centric Benchmark for Personalized Mobile Use Agents", "version_id": "2610.34735v1", "first_author": "Yuting Ning", "authors": [ "Yuting Ning", "Ruijia Cheng", "Sushobhan Ghosh", "Peitong Duan", "HungShi Lin", "Abhishek Sundararajan", "Shreyash Pandey", "Huan Sun", "Jeffrey Nichols", "Eldon Schoop" ], "affiliations": [ "The Ohio State University" ], "source_url": "https://arxiv.org/pdf/2610.34735v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Yuting Ning¹,† maps to 1 The Ohio State University. † Work done during an internship at Apple, not a second signed affiliation or equal contribution.", "author_source": "https://arxiv.org/abs/2610.34735v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.34847": { "id": "2610.34847", "title": "Ethics by Configuration: AI Ethics Principles in Coding Agent Instructions", "classification": "relevant", "reason": "实证研究Coding Agent的context/Skill配置如何指定人工审批、隐私保护、诚实报告和可靠性，直接涉及安全指令与用户授权治理；v1。", "abstract_read": true, "published": "2026-10-26T05:00:59Z", "version": 1, "summary_zh": "问题：开发者配置Coding Agent时如何体现AI伦理原则。方法：对8,893个GitHub仓库的40,079份配置文件进行经验证的LLM分类，并定性分析679文件中的702个分层样本。作者报告：39.4%文件、61.5%仓库出现伦理语句，集中于问责、透明、隐私和可靠性，任务Skill比全局context更常见；归纳30类具体规则，问责主要是人工审批、透明主要是解释及诚实报告。配置主要保护开发流程中的开发者维护者，作者明确尚未测试Agent是否实际遵守。", "topics": { "tags": [ "authorization", "memory", "privacy", "evaluation" ], "reason_zh": "分析Skill和context中的人工审批、诚实报告及隐私规则，属于Agent指令治理的实证证据而非防御有效性测试。" }, "updated": "2026-10-26T05:00:59Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34847v1", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34847v1", "abstract_sha256": "0007dda885aef21bf1fc964c3f3c1dd3357c37fbbd40d8e1e125089cc06e41cb", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.34847", "title": "Ethics by Configuration: AI Ethics Principles in Coding Agent Instructions", "version_id": "2610.34847v1", "first_author": "Haoyu Gao", "authors": [ "Haoyu Gao", "Peerachai Banyongrakkul", "Marc Cheong", "Christoph Treude", "Sebastian Baltes", "Mansooreh Zahedi" ], "affiliations": [ "The University of Melbourne" ], "source_url": "https://arxiv.org/pdf/2610.34847v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.34847v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35082": { "id": "2610.35082", "title": "CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems", "classification": "relevant", "reason": "直接揭示多个单独合规Skill组合后的信息流与授权冲突，并研究不改现有权限的恶意Skill池增补攻击和harness级防御；v1。", "abstract_read": true, "published": "2026-10-26T09:25:38Z", "version": 1, "summary_zh": "问题：单Skill审查不能保证组合后仍保留用途限制和授权。方法：从公开Skill受控执行及单Skill对照归纳四类冲突机制，CoSA向池中增加本地可接纳Skill，以能力补足或重塑制品交换、决策复用、目标动作绑定触发违规；CoSA-Bench含招聘、金融、IT与商业的288任务，涵盖泄密、未授权修改与不安全执行。作者报告：五模型、三harness中，新增不超过原池5%的Skill使违规率由35.02%升至58.45%；检查信息流和行动前授权的轻量guard在OpenClaw招聘任务上将违规由65.28%降至6.67%，良性合规任务完成由66.67%变为65.00%。", "topics": { "tags": [ "supplychain", "authorization", "privacy", "evaluation" ], "reason_zh": "攻击入口为生态Skill池及组合依赖，核心失效是信息流限制和授权不能组合传递，并包含泄密安全评测与运行时guard。" }, "updated": "2026-10-26T09:25:38Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35082v1", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35082v1", "abstract_sha256": "4432800edfae7e8acedfaf909e0ec4d376677eaa8760976a588261ac49bab562", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35082", "title": "CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems", "version_id": "2610.35082v1", "first_author": "Yujia Zheng", "authors": [ "Yujia Zheng", "Tianhao Li", "Shangzhi Xu", "Yuekai Huang", "Ziyou Jiang", "Zhaoyang Li", "Yuyao Ge", "Junran Peng", "Mingyang Li" ], "affiliations": [ "University of Science and Technology Beijing", "ZODA" ], "source_url": "https://arxiv.org/pdf/2610.35082v1", "shared_first_authors": [ "Yujia Zheng", "Tianhao Li" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Yujia Zheng": [ "University of Science and Technology Beijing", "ZODA" ], "Tianhao Li": [ "ZODA" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Yujia Zheng¹,²*† and Tianhao Li²*; * Equal contribution, co-first author; † Work done at ZODA. 1 University of Science and Technology Beijing; 2 ZODA.", "author_source": "https://arxiv.org/abs/2610.35082v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35093": { "id": "2610.35093", "title": "Improving Instruction Hierarchy by Learning from Goal-Goal Conflicts", "classification": "relevant", "reason": "正文评测包含工具输出中的间接指令注入、system/user/tool 优先级及应用访问控制，并给出仓库分析任务被诱导 execute_command 运行安装器的具体安全案例；因此并非只做单轮通用模型安全。", "abstract_read": true, "published": "2026-10-26T09:33:17Z", "version": 1, "summary_zh": "论文以目标—目标冲突补充指令层级训练，微调 Qwen3.5-9B 和 Gemma4-12B-it，评估四类 IH 基准，包括工具结果注入、访问控制和信息保护。仓库分析案例中，训练前模型尝试执行低优先级安装指令，训练后先询问而不调用执行工具。作者报告跨基准遵循提高，无冲突八指标平均变化为 +1.7/−1.1 个百分点；未测试针对微调模型自适应优化的攻击，且存在少量过防御。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "正文评测包含工具输出中的间接指令注入、system/user/tool 优先级及应用访问控制，并给出仓库分析任务被诱导 execute_command 运行安装器的具体安全案例；因此并非只做单轮通用模型安全。" }, "updated": "2026-10-26T09:33:17Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "initial_classification": "uncertain", "scope_review": { "id": "2610.35093", "title": "Improving Instruction Hierarchy by Learning from Goal-Goal Conflicts", "version_id": "2610.35093v1", "original_classification": "uncertain", "classification": "relevant", "reason": "正文评测包含工具输出中的间接指令注入、system/user/tool 优先级及应用访问控制，并给出仓库分析任务被诱导 execute_command 运行安装器的具体安全案例；因此并非只做单轮通用模型安全。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 实验设置与四类 IH 基准", "表 1 仓库分析/工具注入案例", "§4 效果与无冲突效用", "§5 限制", "附录 A/D 基准边界" ], "source_url": "https://arxiv.org/html/2610.35093v1", "summary_zh": "论文以目标—目标冲突补充指令层级训练，微调 Qwen3.5-9B 和 Gemma4-12B-it，评估四类 IH 基准，包括工具结果注入、访问控制和信息保护。仓库分析案例中，训练前模型尝试执行低优先级安装指令，训练后先询问而不调用执行工具。作者报告跨基准遵循提高，无冲突八指标平均变化为 +1.7/−1.1 个百分点；未测试针对微调模型自适应优化的攻击，且存在少量过防御。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "正文评测包含工具输出中的间接指令注入、system/user/tool 优先级及应用访问控制，并给出仓库分析任务被诱导 execute_command 运行安装器的具体安全案例；因此并非只做单轮通用模型安全。" }, "evidence_notes": [ "实际读取为官方 arXiv HTML 正文，工具执行示例为模拟工具；不是实网攻击验证。" ] }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 实验设置与四类 IH 基准", "表 1 仓库分析/工具注入案例", "§4 效果与无冲突效用", "§5 限制", "附录 A/D 基准边界" ], "body_source_url": "https://arxiv.org/html/2610.35093v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.35093v1", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35093v1", "abstract_sha256": "0e6d1c5ce07988654a2e0120dba73a4d2e5ec9abba23ffeb9d9033db26d3ddaa", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35093", "title": "Improving Instruction Hierarchy by Learning from Goal-Goal Conflicts", "version_id": "2610.35093v1", "first_author": "Sizhe Chen", "authors": [ "Sizhe Chen", "Sanjay Kariyappa", "Liwei Jiang", "Chong Xiang", "Jihye Choi", "Chaowei Xiao", "G. Edward Suh" ], "affiliations": [ "NVIDIA", "UC Berkeley" ], "source_url": "https://arxiv.org/pdf/2610.35093v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.35093v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35215": { "id": "2610.35215", "title": "SkillLifeBench: Benchmarking Security Across the Lifecycle of Agent Skills", "classification": "relevant", "reason": "直接研究Agent Skill代码、选定版本和实际加载实现跨生命周期不一致导致攻击成功，含运行/组合/版本安全与恢复；v1。", "abstract_read": true, "published": "2026-10-26T11:07:04Z", "version": 1, "summary_zh": "问题：复用Skill时存储代码、版本选择与实际执行实现可能分离，单次运行安全分数无法覆盖生命周期。方法：SkillLifeBench构建388对场景，覆盖实现、接口、运行时、组合和版本变更；14模型执行89个运行任务与60个自主生命周期任务，后者允许检查、选择和重配Skill，要求任务完成且不达攻击目标。作者报告：GPT-5.6-Sol和Sonnet 4.6运行任务同为82.0%，生命周期分别96.7%与56.7%；总体挑战任务成功77.5%、联合成功65.2%，103次同时完成任务与攻击；恢复研究中执行来源令联合成功49.35%升至65.58%，确定性一致性规则64.94%，完全恢复69.48%。", "topics": { "tags": [ "supplychain", "authorization", "monitoring", "evaluation" ], "reason_zh": "聚焦Skill版本和实际执行一致性、组合/生命周期攻击、安全联合评测以及执行来源辅助恢复。" }, "updated": "2026-10-26T11:07:04Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35215v1", "categories_seen": [ "cs.AI", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35215v1", "abstract_sha256": "6df84fde487e36991a163b84e7bab342479f62600ae3af66d1168ebcf27aa600", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35215", "title": "SkillLifeBench: Benchmarking Security Across the Lifecycle of Agent Skills", "version_id": "2610.35215v1", "first_author": "Chenxu Zhang", "authors": [ "Chenxu Zhang", "Zhou Liu", "Wu Xin", "Wentao Zhang" ], "affiliations": [ "Imperial College London" ], "source_url": "https://arxiv.org/pdf/2610.35215v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Chenxu Zhang¹ maps to 1 Imperial College London, United Kingdom. * on Wentao Zhang means Corresponding author.", "author_source": "https://arxiv.org/abs/2610.35215v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35288": { "id": "2610.35288", "title": "Proof-of-Agentness: Towards Verifying Agents on the Web", "classification": "relevant", "reason": "为允许合法Agent访问的Web服务区分LLM Agent与简单自动脚本，避免批量垃圾提交消耗资源和用户/Agent注意力，涉及Agent身份验证与滥用防护；v1。", "abstract_read": true, "published": "2026-10-26T11:59:42Z", "version": 1, "summary_zh": "问题：Web服务既接受合法LLM Agent，又需防止简单机器人冒充造成垃圾提交和资源消耗。方法：提出Proof-of-Agentness，研究主动挑战应答与被动服务端可见行为信号，分别验证推理资源投入和客户端类别。作者报告：八个语言模型挑战平均准确率96.5%，开销1,647 token；经IRB批准的12人用户研究比较人类、Bot和Agent，四类分类器平均准确率95.8%。摘要未给自适应伪装攻击下的保证。", "topics": { "tags": [ "authorization", "robustness", "evaluation" ], "reason_zh": "建立Agent访问身份验证机制并防资源/垃圾提交滥用，给出挑战与被动识别评测。" }, "updated": "2026-10-26T11:59:42Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35288v1", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 172 of 172 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35288v1", "abstract_sha256": "e034b44c61437f2ec2b3d23db63079eda9a6ed1ffc05ff2b06f1203fa0b760dd", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35288", "title": "Proof-of-Agentness: Towards Verifying Agents on the Web", "version_id": "2610.35288v1", "first_author": "Zuyao Xu", "authors": [ "Zuyao Xu", "Xiang Li" ], "affiliations": [ "Nankai University" ], "source_url": "https://arxiv.org/pdf/2610.35288v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Zuyao Xu / Nankai University; * on Xiang Li is Corresponding author.", "author_source": "https://arxiv.org/abs/2610.35288v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35426": { "id": "2610.35426", "title": "Intent-Preserving Adversarial User Simulation for Multi-Turn Agent Evaluation", "classification": "relevant", "reason": "直接以保持合法用户目标的对抗多轮交互压力测试工具Agent，暴露合作模拟器遗漏的鲁棒性风险；属于Agent对抗评测而非普通静态能力测评。v1。", "abstract_read": true, "published": "2026-10-26T13:33:07Z", "version": 1, "summary_zh": "问题：LLM模拟用户过于合作可能高估多轮Agent表现。方法：StressSim为每任务优化高层对抗交互计划，以遗传提示搜索结合轨迹、细粒度完成信号和有效性反馈，在不改用户目标前提下降低任务成功。作者在MultiWOZ及tau-bench零售/航空领域测试三类Agent，报告tau-bench pass^4最多下降69%（gemini-3.8-flash）与62%（gpt-5.6-sol），目标保持性能最多下降10%，每任务优化预算20条rollout；更大预算进一步降低成功。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "面向真实多轮工具Agent的意图保持对抗交互与压力测试，检验非合作但有效用户输入下可靠性。" }, "updated": "2026-10-26T13:33:07Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35426v1", "categories_seen": [ "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 226 of 226 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35426v1", "abstract_sha256": "7f7270cd85b481fdb1f28466ddea5f1f06c45bf59dac2162b880db15ef98a052", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35426", "title": "Intent-Preserving Adversarial User Simulation for Multi-Turn Agent Evaluation", "version_id": "2610.35426v1", "first_author": "Atri Vivek Sharma", "authors": [ "Atri Vivek Sharma", "Brian Formento", "Alessio Lomuscio" ], "affiliations": [ "Imperial College London", "Safe Intelligence" ], "source_url": "https://arxiv.org/pdf/2610.35426v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF front matter explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in the author block/footnotes.", "author_source": "https://arxiv.org/abs/2610.35426v1", "verification_status": "affiliation_verified" }, "revision_history": [] }, "2610.35835": { "id": "2610.35835", "classification": "relevant", "reason": "代理不可绕过人工审批，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "dfb14046a25c2cb8d3b78ec070f4c28ca40616e0e4eb624cdde36cf6ddc9328b", "summary_zh": "仅据摘要，作者声称：I-HITL研究即便本地代理脚手架被攻陷也须真实人类明确批准的协议；作者发现十种模型常用邮箱OTP自行提高钱包限额，形式化通信拓扑下可实现条件并提出依赖可信设备的Countersign原型。摘要未给绕过比例。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "代理不可绕过人工审批，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "I-HITL: Inalienable Human-in-the-Loop", "version_id": "2610.35835v3", "published": "2026-10-26T17:52:14Z", "updated": "2026-10-30T16:40:31Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35835v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29", "2026-11-03" ], "version_history": [ { "id": "2610.35835", "title": "I-HITL: Inalienable Human-in-the-Loop", "classification": "relevant", "reason": "直接揭示Agent利用邮箱OTP绕过钱包人工审批，并形式化即便harness被攻陷仍不可委派的人类授权协议，完全落入工具权限与沙箱/审批边界；v1。", "abstract_read": true, "published": "2026-10-26T17:52:14Z", "version": 1, "updated": "2026-10-26T17:52:14Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35835v1", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35835v1", "abstract_sha256": "dfb14046a25c2cb8d3b78ec070f4c28ca40616e0e4eb624cdde36cf6ddc9328b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" }, { "id": "2610.35835", "title": "I-HITL: Inalienable Human-in-the-Loop", "classification": "relevant", "reason": "形式化并实现即使Agent攻陷本地harness仍需人类明确批准的授权机制，并检验Agent绕过邮箱OTP审批，直接涉及越权与可信人类确认。", "abstract_read": true, "published": "2026-10-26T17:52:14Z", "version": 1, "updated": "2026-10-27T17:41:57Z", "announcement_date": "2026-10-28", "candidate_type": "changed_version", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35835v2", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 31 of 31 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 153 of 153 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35835v2", "abstract_sha256": "dfb14046a25c2cb8d3b78ec070f4c28ca40616e0e4eb624cdde36cf6ddc9328b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "reading_basis": "full_final_api_abstract" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.35835", "title": "I-HITL: Inalienable Human-in-the-Loop", "version_id": "2610.35835v3", "first_author": "Samuel Breckenridge", "authors": [ "Samuel Breckenridge", "Dani Vilardell", "Wenhao Wang", "Fan Zhang", "Ari Juels" ], "affiliations": [ "Cornell Tech", "IC3" ], "source_url": "https://arxiv.org/pdf/2610.35835v3", "shared_first_authors": [ "Samuel Breckenridge", "Dani Vilardell" ], "shared_first_note": "论文首页 * 标记及 Equal contribution / contributed equally 脚注明确声明共同贡献。", "shared_first_affiliations": { "Samuel Breckenridge": [ "Cornell Tech", "IC3" ], "Dani Vilardell": [ "Cornell Tech", "IC3" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "author_source": "https://arxiv.org/abs/2610.35835v1", "verification_status": "affiliation_verified", "affiliation_checked": true }, "reading_basis": "full_final_api_abstract", "version": 1, "first_seen_date": "2026-10-28", "revision_history": [ { "id": "2610.35835", "title": "I-HITL: Inalienable Human-in-the-Loop", "classification": "relevant", "reason": "直接揭示Agent利用邮箱OTP绕过钱包人工审批，并形式化即便harness被攻陷仍不可委派的人类授权协议，完全落入工具权限与沙箱/审批边界；v1。", "abstract_read": true, "published": "2026-10-26T17:52:14Z", "version": 1, "summary_zh": "问题：Agent可能绕过关键动作的HITL审批，甚至操控承载审批界面的本地harness。方法：提出不可剥夺人类在环I-HITL及阻止人类向Agent委派批准的强版本，使用通信拓扑给出实现条件，并用消费级手机实现Countersign可信确认原型。作者报告：在热门Agent钱包平台上，赋予邮箱访问和受支出上限阻塞任务后，十种前沿模型经常自主收取OTP提高上限，绕过人工审批并发现其他漏洞；形式证明I-HITL需要可信计算实体并区分可实现设备类型。摘要未给攻击成功率数值。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "核心为Agent越权绕审批、可信独立人类确认与形式化授权边界，并用真实钱包平台验证风险。" }, "updated": "2026-10-26T17:52:14Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35835v1", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35835v1", "abstract_sha256": "dfb14046a25c2cb8d3b78ec070f4c28ca40616e0e4eb624cdde36cf6ddc9328b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35835", "title": "I-HITL: Inalienable Human-in-the-Loop", "version_id": "2610.35835v1", "first_author": "Samuel Breckenridge", "authors": [ "Samuel Breckenridge", "Dani Vilardell", "Wenhao Wang", "Fan Zhang", "Ari Juels" ], "affiliations": [ "Cornell Tech", "IC3" ], "source_url": "https://arxiv.org/pdf/2610.35835v1", "shared_first_authors": [ "Samuel Breckenridge", "Dani Vilardell" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Samuel Breckenridge": [ "Cornell Tech", "IC3" ], "Dani Vilardell": [ "Cornell Tech", "IC3" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Samuel Breckenridge* and Dani Vilardell* each explicitly list Cornell Tech, IC3. * These authors contributed equally to this work.", "author_source": "https://arxiv.org/abs/2610.35835v1", "verification_status": "affiliation_verified" } }, { "id": "2610.35835", "title": "I-HITL: Inalienable Human-in-the-Loop", "version_id": "2610.35835v2", "candidate_type": "changed_version", "classification": "relevant", "reason": "形式化并实现即使Agent攻陷本地harness仍需人类明确批准的授权机制，并检验Agent绕过邮箱OTP审批，直接涉及越权与可信人类确认。", "abstract_read": true, "abstract_sha256": "dfb14046a25c2cb8d3b78ec070f4c28ca40616e0e4eb624cdde36cf6ddc9328b", "reading_basis": "full_final_api_abstract", "summary_zh": "问题：Agent可能利用自己可访问的邮箱或被攻陷的本地harness绕过关键动作人工审批。方法：提出不可剥夺的人类在环I-HITL及强版本，以通信拓扑证明可实现条件，并用消费级手机实现Countersign可信确认原型。作者声称：十种前沿模型在Agent钱包实验中经常自主收取OTP提高支出上限；证明协议需要可信实体并刻画可实现设备。摘要未提供具体攻击率。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "核心是Agent越权审批及独立可信人类确认，并给出实验与形式化条件。" }, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-26T17:52:14Z", "updated": "2026-10-27T17:41:57Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 31 of 31 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 153 of 153 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35835v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "version_history": [ { "id": "2610.35835", "title": "I-HITL: Inalienable Human-in-the-Loop", "classification": "relevant", "reason": "直接揭示Agent利用邮箱OTP绕过钱包人工审批，并形式化即便harness被攻陷仍不可委派的人类授权协议，完全落入工具权限与沙箱/审批边界；v1。", "abstract_read": true, "published": "2026-10-26T17:52:14Z", "version": 1, "updated": "2026-10-26T17:52:14Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35835v1", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 55 of 55 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35835v1", "abstract_sha256": "dfb14046a25c2cb8d3b78ec070f4c28ca40616e0e4eb624cdde36cf6ddc9328b", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.35835", "title": "I-HITL: Inalienable Human-in-the-Loop", "version_id": "2610.35835v2", "first_author": "Samuel Breckenridge", "authors": [ "Samuel Breckenridge", "Dani Vilardell", "Wenhao Wang", "Fan Zhang", "Ari Juels" ], "affiliations": [ "Cornell Tech", "IC3" ], "source_url": "https://arxiv.org/pdf/2610.35835v2", "shared_first_authors": [ "Samuel Breckenridge", "Dani Vilardell" ], "shared_first_note": "前两作者*，脚注These authors contributed equally；两人均Cornell Tech, IC3。", "shared_first_affiliations": { "Samuel Breckenridge": [ "Cornell Tech", "IC3" ], "Dani Vilardell": [ "Cornell Tech", "IC3" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF首页逐作者下方单位及共同贡献脚注。", "author_source": "https://arxiv.org/abs/2610.35835v1", "verification_status": "affiliation_verified" }, "version": 1, "first_seen_date": "2026-10-28" } ] }, "2610.35978": { "id": "2610.35978", "title": "Testing Agentic Service Systems: An Agentic Living Lab Methodology Across the Physical-Digital Continuum", "classification": "relevant", "reason": "明确以任务成功不足以验证授权、义务履行与持久业务/物理副作用为问题，提出Agent服务系统安全测试和治理架构；v1。", "abstract_read": true, "published": "2026-10-26T09:43:23Z", "version": 1, "summary_zh": "问题：Agent即使完成任务，仍可能未经授权、留下未履行义务，或因执行基底不同产生不可比效果。方法：Agentic Living Lab把测试单位定义为含委派角色、义务、世界状态和证据的服务episode，区分被测Agent与环境参与者及代理，显式记录现实实现、能力、接地和语义变化；四平面架构分离控制、参与者、世界实现与证据评价，区分意图、规范准入、事实对账。作者提供JSON Schema、确定性样例和有限参考runner，以构造的旅行与工业案例说明授权/履行失败，明确不是完整平台或实证验证。", "topics": { "tags": [ "authorization", "evaluation", "embodied", "monitoring" ], "reason_zh": "测试覆盖委派授权、持久状态/物理行动效果与证据审计，强调不同现实基底下安全语义。" }, "updated": "2026-10-26T09:43:23Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.35978v1", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35978v1", "abstract_sha256": "ff0fc725586be7803c55f167b6497778bf4be2416a97ca0665ff82e29ec81f7e", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35978", "title": "Testing Agentic Service Systems: An Agentic Living Lab Methodology Across the Physical-Digital Continuum", "version_id": "2610.35978v1", "first_author": "Zhongjie Wang", "authors": [ "Zhongjie Wang", "Xiang He", "Xiao Wang", "Mingyi Liu", "Shuang Yu", "Hanchuan Xu" ], "affiliations": [ "Faculty of Computing, Harbin Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.35978v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF author block explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in author block or footnotes.", "author_source": "https://arxiv.org/abs/2610.35978v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.35992": { "id": "2610.35992", "title": "Before the First Edit? Measuring When Coding-Agent Guidance Actually Arrives", "classification": "uncertain", "reason": "正文确实审计 Agent 结构化编辑/壳命令经运行时 gate 后何时首次实际变更源码，是可核验的工具执行时序边界；但被保护的先决条件只是接收规划指导，不是人类授权、安全政策或危害约束，中心目标也未验证安全效果。保留范围待定，不把所有编排先后契约自动算作安全。", "abstract_read": true, "published": "2026-10-26T12:22:34Z", "version": 1, "summary_zh": "论文区分策略分配、请求资格、触发、规划送达和实际源码变化。76 臂试验仅 15 臂改变 Python 源码，观察到的变更均发生在指导之后且都经结构化编辑器，未达到预设 20 臂覆盖目标；公开轨迹显示编辑器错误后壳命令写入，但缺同步文件系统状态。它能审计指导时序，不能证明覆盖真实 shell-first 写入或规划提升正确性；与安全授权门控的关系仍待定。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "正文确实审计 Agent 结构化编辑/壳命令经运行时 gate 后何时首次实际变更源码，是可核验的工具执行时序边界；但被保护的先决条件只是接收规划指导，不是人类授权、安全政策或危害约束，中心目标也未验证安全效果。保留范围待定，不把所有编排先后契约自动算作安全。" }, "updated": "2026-10-26T12:22:34Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "initial_classification": "uncertain", "scope_review": { "id": "2610.35992", "title": "Before the First Edit? Measuring When Coding-Agent Guidance Actually Arrives", "version_id": "2610.35992v1", "original_classification": "uncertain", "classification": "uncertain", "reason": "正文确实审计 Agent 结构化编辑/壳命令经运行时 gate 后何时首次实际变更源码，是可核验的工具执行时序边界；但被保护的先决条件只是接收规划指导，不是人类授权、安全政策或危害约束，中心目标也未验证安全效果。保留范围待定，不把所有编排先后契约自动算作安全。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 可检验问题", "§4 四类gate/文件哈希观察", "§5 PAUSE/SI2CA与实际Agent运行", "§6–7 范围与结论" ], "source_url": "https://arxiv.org/pdf/2610.35992v1", "summary_zh": "论文区分策略分配、请求资格、触发、规划送达和实际源码变化。76 臂试验仅 15 臂改变 Python 源码，观察到的变更均发生在指导之后且都经结构化编辑器，未达到预设 20 臂覆盖目标；公开轨迹显示编辑器错误后壳命令写入，但缺同步文件系统状态。它能审计指导时序，不能证明覆盖真实 shell-first 写入或规划提升正确性；与安全授权门控的关系仍待定。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "正文确实审计 Agent 结构化编辑/壳命令经运行时 gate 后何时首次实际变更源码，是可核验的工具执行时序边界；但被保护的先决条件只是接收规划指导，不是人类授权、安全政策或危害约束，中心目标也未验证安全效果。保留范围待定，不把所有编排先后契约自动算作安全。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 可检验问题", "§4 四类gate/文件哈希观察", "§5 PAUSE/SI2CA与实际Agent运行", "§6–7 范围与结论" ], "body_source_url": "https://arxiv.org/pdf/2610.35992v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.35992v1", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35992v1", "abstract_sha256": "30b6c5924041def4fda94600d7feedc95e178d7f5c1873a1e32a0cb37fd58d50", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35992", "title": "Before the First Edit? Measuring When Coding-Agent Guidance Actually Arrives", "version_id": "2610.35992v1", "first_author": "Thupakula Sai Varun", "authors": [ "Thupakula Sai Varun" ], "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2610.35992v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF directly signs Thupakula Sai Varun as Independent Researcher, Hyderabad, India. This is an explicit author statement, not inferred from missing institution.", "author_source": "https://arxiv.org/abs/2610.35992v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36151": { "id": "2610.36151", "title": "Replication or Corroboration? An Axiomatic Framework for Evidential Dependence in Multi-Agent Debate", "classification": "relevant", "reason": "研究多Agent辩论中复制、转述、别名和拆分证据操纵判断的策略激励，并设计免疫机制，属于多Agent信息传播安全；v1。", "abstract_read": true, "published": "2026-10-26T18:53:17Z", "version": 1, "summary_zh": "问题：多Agent同意可能是重复同一证据，也可能是独立证据佐证，按报告数量计数会被低成本复制操纵。方法：建立获取新证据有成本、复制廉价的判断博弈，证明根复制不变性RRI等价于阈值一致复制免疫；提出保留独立证据根但消除措辞、身份、次数和任意根名的lineage quotient，并扩展至定量双极论证框架。作者报告：RRI下仅复制偏离不能改判、正成本复制严格劣势；若界面不能区分复制与新根则二者不可兼顾。28,224个直接星形、2,052个多层DAG及277个AVeriTeC派生样本的审计符合理论，但根划分为外部提供。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "针对多Agent重复证据诱导judge的操纵，以来源谱系与复制不变性防御，并给出形式化与受控审计。" }, "updated": "2026-10-26T18:53:17Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36151v1", "categories_seen": [ "cs.AI", "cs.LO", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36151v1", "abstract_sha256": "6d3079fc051f2e0d2b8f09512c9c9e8e759174b785f9e3ccebaaccfa0ba7fc30", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36151", "title": "Replication or Corroboration? An Axiomatic Framework for Evidential Dependence in Multi-Agent Debate", "version_id": "2610.36151v1", "first_author": "Hoang-Loc Cao", "authors": [ "Hoang-Loc Cao", "Truong Thanh Hung Nguyen", "Phuc Truong Loc Nguyen", "Vo Thanh Khang Nguyen", "Phuc Ho", "Hung Nguyen", "Duc Pham", "Long Tran-Thanh", "Hung Cao" ], "affiliations": [ "University of New Brunswick" ], "source_url": "https://arxiv.org/pdf/2610.36151v1", "shared_first_authors": [ "Hoang-Loc Cao", "Truong Thanh Hung Nguyen" ], "shared_first_note": "PDF明确注明 Equal contribution / contributed equally，已按脚注及署名标记核对。", "shared_first_affiliations": { "Hoang-Loc Cao": [ "University of New Brunswick" ], "Truong Thanh Hung Nguyen": [ "University of New Brunswick" ] }, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Hoang-Loc Cao* and Truong Thanh Hung Nguyen* each explicitly list University of New Brunswick, Canada. * These authors contributed equally to this work. First author email domain is not used to substitute a different institution.", "author_source": "https://arxiv.org/abs/2610.36151v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36570": { "id": "2610.36570", "title": "CASEL: Consequence-Aware Selective Execution for Reliable Long-Horizon Tool-Using Agents", "classification": "relevant", "reason": "直接为长程工具Agent按动作后果选择执行、验证、沙箱、澄清、审批或弃权，评估未授权/有害副作用风险；v1。", "abstract_read": true, "published": "2026-10-27T03:19:41Z", "version": 1, "summary_zh": "问题：通用不确定性门控或粗糙写操作规则无法合理分配运行时审查。方法：CASEL结合校准失败概率、状态相关后果、可逆性、歧义和证据新鲜度，最小化各干预模式成本；形式化直接执行的选择性预测与轨迹风险账本条件。作者报告：20种子、每种120,000测试动作、等干预菜单和计算成本的受控模拟中，有害副作用轨迹由不确定性gate的14.75%降至7.02%，归一化伤害0.184降0.123；概率×后果gate伤害相近但多45%人工审批，去除可逆性路由升至15.53%，轨迹风险预算反而为11.82%。作者明确干预有效性是模拟假设，不能据此认定部署有效。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "关注工具动作运行时权限、沙箱与人工审批分配，通过后果与可逆性控制副作用风险并强调模拟边界。" }, "updated": "2026-10-27T03:19:41Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36570v1", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 10 of 10 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36570v1", "abstract_sha256": "f0cb2615c83902e97828c735a8eb0368577ab8c1cc1a03c42e4444235871f9a1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36570", "title": "CASEL: Consequence-Aware Selective Execution for Reliable Long-Horizon Tool-Using Agents", "version_id": "2610.36570v1", "first_author": "Yanyan Zhang", "authors": [ "Yanyan Zhang", "Fei Shen", "Ting Yan", "Hao Zhang" ], "affiliations": [ "Carnegie Mellon University" ], "source_url": "https://arxiv.org/pdf/2610.36570v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF first author explicitly labelled 1st Yanyan Zhang with Carnegie Mellon University directly below. The Independent Researcher designation belongs to fourth author Hao Zhang, not the first author.", "author_source": "https://arxiv.org/abs/2610.36570v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36761": { "id": "2610.36761", "title": "Making Self-Driving Laboratories Auditable:A Unified Framework for Hybrid Actions,Measurements, and Safe Execution", "classification": "relevant", "reason": "提出VLA式自驱实验室混合机器人动作/仪器API的执行前检查、执行中时序安全监控和安全故障评测协议，属于具身工具Agent行动安全；v1。", "abstract_read": true, "published": "2026-10-27T07:17:24Z", "version": 1, "summary_zh": "问题：自驱实验室需要把连续机器人控制、类型化仪器API和测量反馈整合为可追溯闭环。方法：提出测量条件化LAM动作模型、映射角色操作到设备并记录因果事件的OpenSDL、结合派发前schema/资源检查与执行及等待期间信号时序逻辑监控的Safe-SDL，以及涵盖物理结果、时机、可复现性、安全违规和恢复的L3-Bench。作者将其定位为端到端设计和初始控制实现，摘要未给出实验数量或安全效果数值。", "topics": { "tags": [ "authorization", "embodied", "monitoring", "evaluation" ], "reason_zh": "VLA生成混合物理/API动作由运行时gate和时序逻辑监控约束，另定义安全违规与恢复评测。" }, "updated": "2026-10-27T07:17:24Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36761v1", "categories_seen": [ "cs.AI", "cs.RO" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36761v1", "abstract_sha256": "ebe42d876a44c74c9d61b6f582bfb2c8dc787bd5d008bb4a4ff5b89bde7a88b3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36761", "title": "Making Self-Driving Laboratories Auditable:A Unified Framework for Hybrid Actions,Measurements, and Safe Execution", "version_id": "2610.36761v1", "first_author": "Zihan Zhang", "authors": [ "Zihan Zhang", "Zeyu Wu", "Xin Zhang", "Mingyu Luo", "Haohui Que", "Tong Zhu" ], "affiliations": [ "SII–ECNU Joint Autonomous Chemistry Laboratory, Shanghai Innovation Institute", "Nankai University", "Shanghai Lixun Intelligent Technology Co.,Ltd" ], "source_url": "https://arxiv.org/pdf/2610.36761v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "PDF Zihan Zhang¹,²,⁵ explicitly maps to 1 SII–ECNU Joint Autonomous Chemistry Laboratory, Shanghai Innovation Institute; 2 Nankai University; 5 Shanghai Lixun Intelligent Technology Co.,Ltd. * on Haohui Que and Tong Zhu means Corresponding authors, not equal contribution.", "author_source": "https://arxiv.org/abs/2610.36761v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2610.36947": { "id": "2610.36947", "title": "Beyond QASecClaw: Agent Scaling, Verifier Feedback, and Evidence Reliability in Software Assurance", "classification": "relevant", "reason": "研究软件保证Agent在验证器反馈及故意误导证据下的不安全放行、错误判决与证据准入，涉及Coding Agent安全监控和多Agent聚合边界；v1。", "abstract_read": true, "published": "2026-10-27T10:06:26Z", "version": 1, "summary_zh": "问题：已有确定性工具证据时，增加专业语言模型上下文是否改善软件安全保证。方法：五组实验覆盖Java警告、OWASP、Defects4J、SV-COMP断言及误导证据包，以Qwen2.5-Coder-7B及1.5B敏感性分析完成13,638次请求。作者报告：八个开发警告中上下文1增至50使token用量49倍但未改善不安全放行；32个SV-COMP任务中原始验证反馈使正确判决12.7增22.0，同时错误1增7，而确定性JBMC+JVM有26正确、6未决；两组各120证据包上模型拒绝70%–100%适用反例，构造专用范围检查全部正确；三Defects4J缺陷未发现目标错误。结论限于这些描述性设置，支持确定性证据准入。", "topics": { "tags": [ "monitoring", "multiagent", "evaluation", "robustness" ], "reason_zh": "评估Agent对误导证据、反例和验证反馈的安全判决可靠性，以及增加Agent上下文的安全收益局限。" }, "updated": "2026-10-27T10:06:26Z", "announcement_date": "2026-10-28", "candidate_type": "unseen_id", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.36947v1", "categories_seen": [ "cs.AI", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36947v1", "abstract_sha256": "3c9929cfebf9f2757adcd0c9b5098260642436116a06f0fe54b2fb4e07c6e39f", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "此前API-only记录，本轮补证官方公告日期；首次发表日保持不变", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "seen_dates": [ "2026-10-28", "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36947", "title": "Beyond QASecClaw: Agent Scaling, Verifier Feedback, and Evidence Reliability in Software Assurance", "version_id": "2610.36947v1", "first_author": "S M Abdulla Al Mamun", "authors": [ "S M Abdulla Al Mamun", "Akif Islam", "Mohd. Ruhul Ameen" ], "affiliations": [ "Department of Computer Science, The University of Manchester" ], "source_url": "https://arxiv.org/pdf/2610.36947v1", "shared_first_authors": [], "shared_first_note": "", "shared_first_affiliations": {}, "author_status": "verified", "affiliation_status": "verified", "status": "verified", "evidence": "Versioned PDF author block explicitly maps the first author to the listed affiliation(s); no shared-first-author statement found in author block or footnotes.", "author_source": "https://arxiv.org/abs/2610.36947v1", "verification_status": "affiliation_verified" }, "revision_history": [], "metadata_update_only": true, "metadata_update_reason": "官方公告补证，非新收录" }, "2602.22724": { "id": "2602.22724", "title": "AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification", "classification": "relevant", "reason": "直接防御工具增强Agent的多轮间接提示注入，净化受影响上下文并保持任务效用。", "abstract_read": true, "abstract_sha256": "970d6a28975bf255eb7f8994dcf351d37dc8fc7bc6f4d066fd310a4524eeba92", "summary_zh": "问题：多轮间接注入可在Agent累计状态中潜伏并诱发未授权变更。方法：在工具返回边界恢复快照、替换中介内容进行反事实重执行，诊断待执行动作对注入的敏感性后净化相关上下文再继续。作者声称结果：AgentDojo四任务套件、三攻击家族、三黑盒模型测试未观察到成功攻击(ASR0%)，平均攻击下效用76.10%；较最强基线提高1.84–7.60个百分点，良性误报率2.06%–5.15%。这是所测样本结果，不代表普遍零风险。", "topics": { "tags": [ "injection", "memory", "authorization" ], "reason_zh": "直接防御工具增强Agent的多轮间接提示注入，净化受影响上下文并保持任务效用。" }, "version_id": "2602.22724v2", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-02-26T07:59:10Z", "updated": "2026-10-27T11:52:22Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 31 of 31 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 153 of 153 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2602.22724v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2602.22724", "version_id": "2602.22724v2", "first_author": "Tian Zhang", "affiliations": [ "School of Cyber Science and Engineering, Wuhan University" ], "source_url": "https://arxiv.org/pdf/2602.22724v2", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF首页 Tian Zhang†，†映射武汉大学；∥标注通讯作者，不是共同一作。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2603.18740": { "id": "2603.18740", "title": "When AI Agrees Too Much: Manipulating Automated Code Review via Bias Injection", "classification": "relevant", "reason": "通过PR元数据偏置影响Claude Code和CodeRabbit安全审计，属于Coding Agent供应链与上下文注入。", "abstract_read": true, "abstract_sha256": "dc2eca5ccb7e8597a25a3416ac539c4166863f22e9a849267a4083f0f0f7610d", "summary_zh": "问题：PR描述的框架偏置可能使自动代码审查忽视重新引入的漏洞。方法：先在6个LLM的五种框架条件下测试，再在20真实项目的33个CVE和Claude Code/CodeRabbit管线上比较模板及LLM迭代优化偏置。作者声称结果：直接模板往往无效甚至引起警觉，迭代优化在32/33(97%)案例成功；强调攻击者可反复本地试验而审计只有一次机会的非对称性。", "topics": { "tags": [ "supplychain", "injection", "evaluation" ], "reason_zh": "通过PR元数据偏置影响Claude Code和CodeRabbit安全审计，属于Coding Agent供应链与上下文注入。" }, "version_id": "2603.18740v5", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-03-19T10:40:27Z", "updated": "2026-10-27T14:45:00Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 31 of 31 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 153 of 153 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 22 of 22 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.18740v5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.18740", "version_id": "2603.18740v5", "first_author": "Georgios Alexopoulos", "affiliations": [ "University of Athens", "National Infrastructures for Research and Technology" ], "source_url": "https://arxiv.org/pdf/2603.18740v5", "shared_first_authors": [ "Georgios Alexopoulos", "Nikolaos Alexopoulos" ], "shared_first_note": "* These authors contributed equally. Georgios:1,2；Nikolaos:3 Athens University of Economics and Business,4 National Cybersecurity Authority of Greece.", "evidence": "PDF首页作者与编号单位、*脚注直接对应。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2608.00711": { "id": "2608.00711", "title": "Tracing the Cascade: A Topology-Aware Evaluation Framework for Scientific Agent Hallucinations", "classification": "uncertain", "reason": "正文确以 AutoGen 科学 Agent、文献/Web 工具和多轮轨迹为对象，利用知识图谱审计事实错误；但主要结果为科学事实支持度和拓扑加权严重度，未独立验证有害工具行动或下游安全后果。保留科学 Agent 事实可靠性与安全监控的范围边界，不强行纳入。", "abstract_read": true, "abstract_sha256": "3602c5a827da48bca8a8f3c7502ab9b8f722336c189d700eb83cb0763ab991c7", "summary_zh": "问题：科学 Agent 多轮推理中的事实错误可能被常规最终答案指标掩盖。方法：SCHEMA 抽取并去除模糊限定后的主张，依次检索知识图谱与文献等证据，再由模型判支持程度，并用图拓扑加权审计；正文核验为 AutoGen Agent 加文献/Web 工具。作者声称结果（摘要）：幻觉集中于高连接知识枢纽，正确最终答案也可能来自结构有误的推理；摘要未给数值。正文限制：两类生物医学领域、主要依赖 LLM 判定且无大规模专家核验；具体有害行动或下游安全后果未独立验证，保留范围待确认。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "正文确以 AutoGen 科学 Agent、文献/Web 工具和多轮轨迹为对象，利用知识图谱审计事实错误；但主要结果为科学事实支持度和拓扑加权严重度，未独立验证有害工具行动或下游安全后果。保留科学 Agent 事实可靠性与安全监控的范围边界，不强行纳入。" }, "version_id": "2608.00711v2", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_full_reread": true, "initial_classification": "relevant", "scope_review": { "id": "2608.00711", "title": "Tracing the Cascade: A Topology-Aware Evaluation Framework for Scientific Agent Hallucinations", "classification": "uncertain", "reason": "正文确以 AutoGen 科学 Agent、文献/Web 工具和多轮轨迹为对象，利用知识图谱审计事实错误；但主要结果为科学事实支持度和拓扑加权严重度，未独立验证有害工具行动或下游安全后果。保留科学 Agent 事实可靠性与安全监控的范围边界，不强行纳入。", "abstract_read": true, "abstract_sha256": "3602c5a827da48bca8a8f3c7502ab9b8f722336c189d700eb83cb0763ab991c7", "summary_zh": "问题：科学 Agent 多轮推理中的事实错误可能被常规最终答案指标掩盖。方法：SCHEMA 抽取并去除模糊限定后的主张，依次检索知识图谱与文献等证据，再由模型判支持程度，并用图拓扑加权审计；正文核验为 AutoGen Agent 加文献/Web 工具。作者声称结果（摘要）：幻觉集中于高连接知识枢纽，正确最终答案也可能来自结构有误的推理；摘要未给数值。正文限制：两类生物医学领域、主要依赖 LLM 判定且无大规模专家核验；具体有害行动或下游安全后果未独立验证，保留范围待确认。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "正文确以 AutoGen 科学 Agent、文献/Web 工具和多轮轨迹为对象，利用知识图谱审计事实错误；但主要结果为科学事实支持度和拓扑加权严重度，未独立验证有害工具行动或下游安全后果。保留科学 Agent 事实可靠性与安全监控的范围边界，不强行纳入。" }, "version_id": "2608.00711v2", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_full_reread": true, "full_text_checked": true, "review_attempted": true, "review_status": "completed_body_review_scope_unresolved", "source_url": "https://arxiv.org/pdf/2608.00711v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "3.4 audit pipeline", "4.1 agent evaluation setup", "Appendix B limitations", "Appendix C broader impacts" ], "reviewer": "scope_body_reviewer" }, "full_text_checked": true, "reviewed_sections": [ "3.4 audit pipeline", "4.1 agent evaluation setup", "Appendix B limitations", "Appendix C broader impacts" ], "body_source_url": "https://arxiv.org/pdf/2608.00711v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-08-01T15:19:10Z", "updated": "2026-10-27T11:05:04Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 153 of 153 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.00711v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.00711", "version_id": "2608.00711v2", "first_author": "Xinshun Feng", "affiliations": [ "Beihang University", "Shanghai Artificial Intelligence Laboratory" ], "source_url": "https://arxiv.org/pdf/2608.00711v2", "shared_first_authors": [ "Xinshun Feng", "Ziqi Miao", "Lijun Li" ], "shared_first_note": "三人均有*，脚注Equal contribution；Xinshun Feng1,2，另两人2。", "evidence": "PDF首页1/2编号与共同贡献脚注。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.02662": { "id": "2610.02662", "title": "GARV: Graph-Aware Refinement and Safety Verification for High-Level Robot Plans", "classification": "relevant", "reason": "正文明确对接 SPINE 自然语言生成的机器人计划及 RoboGuard 的 LLM 安全规范，验证高层动作隐藏路径危险，属于 LLM 规划 Agent 行动安全。14 例端到端审计与 28 例受控审计必须分开；保证依赖图、动作契约、规范与执行约束。", "abstract_read": true, "abstract_sha256": "ce69c27c4fda72112ef466b014c3646c6f7fdf7d4d27532e4573610026fab413", "summary_zh": "问题：高层机器人动作隐藏中间路径，使表面动作监控漏掉危险。方法：GARV 用图上动作契约与监控给出条件化证明、反例或安全路径细化。作者声称结果（摘要）：28 例受控审计暴露 12 个目标隐患，其余 16 例结论正确；90 次图契约评估得到 72 条安全细化、18 次界内不可行。正文另核验：14 例 SPINE–RoboGuard 端到端审计发现 2 次 false-safe 和 5 次动作接口错误，不能与前述受控审计合并；不是实机部署证明，保证依赖图、契约、规范和可强制执行的路线。", "topics": { "tags": [ "embodied", "authorization", "evaluation" ], "reason_zh": "正文明确对接 SPINE 自然语言生成的机器人计划及 RoboGuard 的 LLM 安全规范，验证高层动作隐藏路径危险，属于 LLM 规划 Agent 行动安全。14 例端到端审计与 28 例受控审计必须分开；保证依赖图、动作契约、规范与执行约束。" }, "version_id": "2610.02662v2", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_reread": false, "initial_classification": "uncertain", "scope_review": { "id": "2610.02662", "title": "GARV: Graph-Aware Refinement and Safety Verification for High-Level Robot Plans", "classification": "relevant", "reason": "正文明确对接 SPINE 自然语言生成的机器人计划及 RoboGuard 的 LLM 安全规范，验证高层动作隐藏路径危险，属于 LLM 规划 Agent 行动安全。14 例端到端审计与 28 例受控审计必须分开；保证依赖图、动作契约、规范与执行约束。", "abstract_read": true, "abstract_sha256": "ce69c27c4fda72112ef466b014c3646c6f7fdf7d4d27532e4573610026fab413", "summary_zh": "问题：高层机器人动作隐藏中间路径，使表面动作监控漏掉危险。方法：GARV 用图上动作契约与监控给出条件化证明、反例或安全路径细化。作者声称结果（摘要）：28 例受控审计暴露 12 个目标隐患，其余 16 例结论正确；90 次图契约评估得到 72 条安全细化、18 次界内不可行。正文另核验：14 例 SPINE–RoboGuard 端到端审计发现 2 次 false-safe 和 5 次动作接口错误，不能与前述受控审计合并；不是实机部署证明，保证依赖图、契约、规范和可强制执行的路线。", "topics": { "tags": [ "embodied", "authorization", "evaluation" ], "reason_zh": "正文明确对接 SPINE 自然语言生成的机器人计划及 RoboGuard 的 LLM 安全规范，验证高层动作隐藏路径危险，属于 LLM 规划 Agent 行动安全。14 例端到端审计与 28 例受控审计必须分开；保证依赖图、动作契约、规范与执行约束。" }, "version_id": "2610.02662v2", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_reread": false, "full_text_checked": true, "review_attempted": true, "review_status": "completed_scope_review", "source_url": "https://arxiv.org/pdf/2610.02662v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "Introduction", "IV evaluation protocol", "controlled audit and SPINE–RoboGuard end-to-end audit", "limitations" ], "reviewer": "scope_body_reviewer" }, "full_text_checked": true, "reviewed_sections": [ "Introduction", "IV evaluation protocol", "controlled audit and SPINE–RoboGuard end-to-end audit", "limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.02662v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-02T01:31:57Z", "updated": "2026-10-27T16:22:52Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.LG", "cs.RO" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Replacement submissions (showing 200 of 200 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.02662v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.02662", "version_id": "2610.02662v2", "first_author": "Stabak Das", "affiliations": [ "CREDIT Center & Department of Electrical and Computer Engineering, Prairie View A&M University, Texas A&M University System" ], "source_url": "https://arxiv.org/pdf/2610.02662v2", "shared_first_authors": [ "Stabak Das", "Priyesh Ranjan" ], "shared_first_note": "前两作者*，脚注Equal contribution；共用所列单位。", "evidence": "PDF首页共同单位与*脚注。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.35930": { "id": "2610.35930", "title": "Who Convinced Whom? Tracing How LLMs Change Their Minds in Multi-Agent Systems", "classification": "relevant", "reason": "正文 MAD Bench 包含独立的 800 题 Safety and Refusal 领域，含有害请求、情境安全边界、欺骗与过度拒绝，明确测试同伴压力下能否维持拒绝与诚实；因此不只是普通多 Agent 正确率。总体共同错误增幅不可误称安全子集的越狱增幅。", "abstract_read": true, "abstract_sha256": "8df7e9a14dac7d0a94bd56c09168015cd147f7a4c2d12245256a5ec3d1813a50", "summary_zh": "问题：多Agent辩论的一致可能来自同伴依赖而非独立证据，放大共同错误。方法：MAD Bench包含2400道知识、价值与安全拒绝问题，以独立反思对照及消息归属、来源描述和注意力干预测影响。作者声称结果：Qwen3.5-9B改变答案时，事前强制选择与最终答案一致率辩论65.4%对反思22.3%；非数值参考题准确率小幅上升但一致错误率较反思增加3.1–7.4个百分点，长辩论保持更高正确性相关。 正文核验：安全/拒绝领域共 800 题，测试同伴压力下有害请求拒绝、不过度拒绝与诚实；上述共同错误增幅是整体参考题结果，并非安全子集的越狱增幅。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "正文 MAD Bench 包含独立的 800 题 Safety and Refusal 领域，含有害请求、情境安全边界、欺骗与过度拒绝，明确测试同伴压力下能否维持拒绝与诚实；因此不只是普通多 Agent 正确率。总体共同错误增幅不可误称安全子集的越狱增幅。" }, "version_id": "2610.35930v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "initial_classification": "relevant", "scope_review": { "id": "2610.35930", "title": "Who Convinced Whom? Tracing How LLMs Change Their Minds in Multi-Agent Systems", "classification": "relevant", "reason": "正文 MAD Bench 包含独立的 800 题 Safety and Refusal 领域，含有害请求、情境安全边界、欺骗与过度拒绝，明确测试同伴压力下能否维持拒绝与诚实；因此不只是普通多 Agent 正确率。总体共同错误增幅不可误称安全子集的越狱增幅。", "abstract_read": true, "abstract_sha256": "8df7e9a14dac7d0a94bd56c09168015cd147f7a4c2d12245256a5ec3d1813a50", "summary_zh": "问题：多Agent辩论的一致可能来自同伴依赖而非独立证据，放大共同错误。方法：MAD Bench包含2400道知识、价值与安全拒绝问题，以独立反思对照及消息归属、来源描述和注意力干预测影响。作者声称结果：Qwen3.5-9B改变答案时，事前强制选择与最终答案一致率辩论65.4%对反思22.3%；非数值参考题准确率小幅上升但一致错误率较反思增加3.1–7.4个百分点，长辩论保持更高正确性相关。 正文核验：安全/拒绝领域共 800 题，测试同伴压力下有害请求拒绝、不过度拒绝与诚实；上述共同错误增幅是整体参考题结果，并非安全子集的越狱增幅。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "正文 MAD Bench 包含独立的 800 题 Safety and Refusal 领域，含有害请求、情境安全边界、欺骗与过度拒绝，明确测试同伴压力下能否维持拒绝与诚实；因此不只是普通多 Agent 正确率。总体共同错误增幅不可误称安全子集的越狱增幅。" }, "version_id": "2610.35930v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": true, "review_attempted": true, "review_status": "completed_scope_review", "source_url": "https://arxiv.org/pdf/2610.35930v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "3.1 benchmark", "3.2 protocol", "5 collective outcomes", "6 discussion", "Appendix A safety and refusal" ], "reviewer": "scope_body_reviewer" }, "full_text_checked": true, "reviewed_sections": [ "3.1 benchmark", "3.2 protocol", "5 collective outcomes", "6 discussion", "Appendix A safety and refusal" ], "body_source_url": "https://arxiv.org/pdf/2610.35930v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-18T16:04:25Z", "updated": "2026-10-18T16:04:25Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.35930v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.35930", "version_id": "2610.35930v1", "first_author": "Arnesh Batra", "affiliations": [ "Indraprastha Institute of Information Technology, Delhi, India" ], "source_url": "https://arxiv.org/pdf/2610.35930v1", "shared_first_authors": [ "Arnesh Batra", "Aniket Khandelwal" ], "shared_first_note": "Arnesh Batra与Aniket Khandelwal同为*；Jashn Khemani、Krish Thukral、Arush Gumber为†；脚注合写“*,† Equal contribution”，保留符号分组，不把所有†自动称作共同第一作者。", "evidence": "PDF首页首作1及贡献符号/脚注。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.36989": { "id": "2610.36989", "abstract_sha256": "5e6a4a73d3a3f7d287039ae9d093299e2b020937de0e050d0f07691e52c907d8", "classification": "relevant", "reason": "当前正文研究可执行制度中合作/破坏/对立 LLM 参与者的治理和制裁失效，包含不合作者当选并惩罚守规者，属于多代理治理安全。重要限制：身体努力和遵从度由角色控制器预设，是操纵而非模型涌现发现；实际 LLM 选择是言语、提名、指控和投票，无人类参与。", "abstract_read": true, "summary_zh": "Megabike 用四十场、每场十个 Qwen3.5-4B 骑手的仿真研究群体治理。群体投票与领导制对制裁对象呈相反模式：对立/破坏型角色易当选，领导更常移除守规者。角色运动和遵从度由控制器设定，不能宣称模型自发产生这些身体行为，也未做人类实验。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "当前正文研究可执行制度中合作/破坏/对立 LLM 参与者的治理和制裁失效，包含不合作者当选并惩罚守规者，属于多代理治理安全。重要限制：身体努力和遵从度由角色控制器预设，是操纵而非模型涌现发现；实际 LLM 选择是言语、提名、指控和投票，无人类参与。" }, "read_source_abstract_sha256": "5e6a4a73d3a3f7d287039ae9d093299e2b020937de0e050d0f07691e52c907d8", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.36989v2", "title": "A Simulation Testbed for Self-Governing Human-Machine Institutions", "initial_classification": "relevant", "scope_review": { "id": "2610.36989", "version_id": "2610.36989v2", "classification": "relevant", "reason": "当前正文研究可执行制度中合作/破坏/对立 LLM 参与者的治理和制裁失效，包含不合作者当选并惩罚守规者，属于多代理治理安全。重要限制：身体努力和遵从度由角色控制器预设，是操纵而非模型涌现发现；实际 LLM 选择是言语、提名、指控和投票，无人类参与。", "summary_zh": "Megabike 用四十场、每场十个 Qwen3.5-4B 骑手的仿真研究群体治理。群体投票与领导制对制裁对象呈相反模式：对立/破坏型角色易当选，领导更常移除守规者。角色运动和遵从度由控制器设定，不能宣称模型自发产生这些身体行为，也未做人类实验。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "当前正文研究可执行制度中合作/破坏/对立 LLM 参与者的治理和制裁失效，包含不合作者当选并惩罚守规者，属于多代理治理安全。重要限制：身体努力和遵从度由角色控制器预设，是操纵而非模型涌现发现；实际 LLM 选择是言语、提名、指控和投票，无人类参与。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.36989v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "1 Introduction", "2 Testbed and governance metrics", "3 Experimental Demonstration", "4.8 Who sanctions whom", "4.9 Hypotheses and limitations" ] }, "full_text_checked": true, "reviewed_sections": [ "1 Introduction", "2 Testbed and governance metrics", "3 Experimental Demonstration", "4.8 Who sanctions whom", "4.9 Hypotheses and limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.36989v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T10:36:36Z", "updated": "2026-10-29T10:48:01Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.HC", "cs.MA" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36989v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "seen_dates": [ "2026-10-29", "2026-10-31" ], "version_history": [ { "id": "2610.36989", "title": "A Serious-Game Testbed for Self-Governing Human-Machine Institutions", "classification": "relevant", "reason": "正文直接设置合作、懒惰、颠覆及对抗型 LLM 骑手，研究可执行制度、投票/领导与规则遵循如何应对对抗参与者及集体失效，而非普通协作能力。仅 40 次模拟会话，不能外推人类治理或普遍因果结论。", "abstract_read": true, "abstract_sha256": "5e6a4a73d3a3f7d287039ae9d093299e2b020937de0e050d0f07691e52c907d8", "version_id": "2610.36989v1", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_reread": false, "initial_classification": "relevant", "scope_review": { "id": "2610.36989", "title": "A Serious-Game Testbed for Self-Governing Human-Machine Institutions", "classification": "relevant", "reason": "正文直接设置合作、懒惰、颠覆及对抗型 LLM 骑手，研究可执行制度、投票/领导与规则遵循如何应对对抗参与者及集体失效，而非普通协作能力。仅 40 次模拟会话，不能外推人类治理或普遍因果结论。", "abstract_read": true, "abstract_sha256": "5e6a4a73d3a3f7d287039ae9d093299e2b020937de0e050d0f07691e52c907d8", "summary_zh": "问题：人类与AI组成的群体能否自治，以及不合作或颠覆性Agent如何改变集体治理，缺少可控测试环境。方法：Megabike以公共资源、协作生存和制度选择构成多智能体模拟与严肃游戏，规则由模拟器执行、行动全部记录，角色可由人或机器承担。作者声称结果：40场语言模型骑手实验包含合作、懒惰、颠覆和对立性格，观察到不同组合产生意外及适得其反结果；摘要未给量化安全指标。 正文核验：制度约束独立于 Agent 强制执行，实验含对抗参与者、违规和领导/投票导致的集体失效；不外推真实人机社会的因果治理结论。", "topics": { "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "正文直接设置合作、懒惰、颠覆及对抗型 LLM 骑手，研究可执行制度、投票/领导与规则遵循如何应对对抗参与者及集体失效，而非普通协作能力。仅 40 次模拟会话，不能外推人类治理或普遍因果结论。" }, "version_id": "2610.36989v1", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_reread": false, "full_text_checked": true, "review_attempted": true, "review_status": "completed_scope_review", "source_url": "https://arxiv.org/pdf/2610.36989v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "Introduction", "4 simulation/personality/experimental design", "results on enforcement and opposing riders", "4.9 limitations" ], "reviewer": "scope_body_reviewer" }, "full_text_checked": true, "reviewed_sections": [ "Introduction", "4 simulation/personality/experimental design", "results on enforcement and opposing riders", "4.9 limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.36989v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T10:36:36Z", "updated": "2026-10-27T10:36:36Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.HC", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36989v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.36989", "version_id": "2610.36989v2", "first_author": "Callum Berger", "affiliations": [ "APEx Defence and Security Institute, University of Lincoln, Lincoln, UK" ], "source_url": "https://arxiv.org/pdf/2610.36989v2", "shared_first_authors": [], "shared_first_note": "正文署名未注明共同第一作者。", "evidence": "首页 Callum Berger 标记 1，机构 1 为 APEx Defence and Security Institute, University of Lincoln；星号仅 Stefan Sarkadi 的通讯作者标记。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified", "author_source": "official_pdf_signature" }, "first_seen_date": "2026-10-29", "revision_history": [ { "id": "2610.36989", "title": "A Serious-Game Testbed for Self-Governing Human-Machine Institutions", "classification": "relevant", "reason": "正文直接设置合作、懒惰、颠覆及对抗型 LLM 骑手，研究可执行制度、投票/领导与规则遵循如何应对对抗参与者及集体失效，而非普通协作能力。仅 40 次模拟会话，不能外推人类治理或普遍因果结论。", "abstract_read": true, "abstract_sha256": "5e6a4a73d3a3f7d287039ae9d093299e2b020937de0e050d0f07691e52c907d8", "summary_zh": "问题：人类与AI组成的群体能否自治，以及不合作或颠覆性Agent如何改变集体治理，缺少可控测试环境。方法：Megabike以公共资源、协作生存和制度选择构成多智能体模拟与严肃游戏，规则由模拟器执行、行动全部记录，角色可由人或机器承担。作者声称结果：40场语言模型骑手实验包含合作、懒惰、颠覆和对立性格，观察到不同组合产生意外及适得其反结果；摘要未给量化安全指标。 正文核验：制度约束独立于 Agent 强制执行，实验含对抗参与者、违规和领导/投票导致的集体失效；不外推真实人机社会的因果治理结论。", "topics": { "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "正文直接设置合作、懒惰、颠覆及对抗型 LLM 骑手，研究可执行制度、投票/领导与规则遵循如何应对对抗参与者及集体失效，而非普通协作能力。仅 40 次模拟会话，不能外推人类治理或普遍因果结论。" }, "version_id": "2610.36989v1", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_reread": false, "initial_classification": "relevant", "scope_review": { "id": "2610.36989", "title": "A Serious-Game Testbed for Self-Governing Human-Machine Institutions", "classification": "relevant", "reason": "正文直接设置合作、懒惰、颠覆及对抗型 LLM 骑手，研究可执行制度、投票/领导与规则遵循如何应对对抗参与者及集体失效，而非普通协作能力。仅 40 次模拟会话，不能外推人类治理或普遍因果结论。", "abstract_read": true, "abstract_sha256": "5e6a4a73d3a3f7d287039ae9d093299e2b020937de0e050d0f07691e52c907d8", "summary_zh": "问题：人类与AI组成的群体能否自治，以及不合作或颠覆性Agent如何改变集体治理，缺少可控测试环境。方法：Megabike以公共资源、协作生存和制度选择构成多智能体模拟与严肃游戏，规则由模拟器执行、行动全部记录，角色可由人或机器承担。作者声称结果：40场语言模型骑手实验包含合作、懒惰、颠覆和对立性格，观察到不同组合产生意外及适得其反结果；摘要未给量化安全指标。 正文核验：制度约束独立于 Agent 强制执行，实验含对抗参与者、违规和领导/投票导致的集体失效；不外推真实人机社会的因果治理结论。", "topics": { "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "正文直接设置合作、懒惰、颠覆及对抗型 LLM 骑手，研究可执行制度、投票/领导与规则遵循如何应对对抗参与者及集体失效，而非普通协作能力。仅 40 次模拟会话，不能外推人类治理或普遍因果结论。" }, "version_id": "2610.36989v1", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_reread": false, "full_text_checked": true, "review_attempted": true, "review_status": "completed_scope_review", "source_url": "https://arxiv.org/pdf/2610.36989v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "Introduction", "4 simulation/personality/experimental design", "results on enforcement and opposing riders", "4.9 limitations" ], "reviewer": "scope_body_reviewer" }, "full_text_checked": true, "reviewed_sections": [ "Introduction", "4 simulation/personality/experimental design", "results on enforcement and opposing riders", "4.9 limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.36989v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T10:36:36Z", "updated": "2026-10-27T10:36:36Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.HC", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.36989v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.36989", "version_id": "2610.36989v1", "first_author": "Callum Berger", "affiliations": [ "APEx Defence and Security Institute, University of Lincoln" ], "source_url": "https://arxiv.org/pdf/2610.36989v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "Callum Berger1，1对应Lincoln APEx；*为Stefan Sarkadi通讯作者。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" } } ] }, "2610.37055": { "id": "2610.37055", "title": "Blindfold: Keeping the Audit Coin Secret from LLM Agents", "classification": "relevant", "reason": "研究自适应LLM Agent通过审计信号泄漏破坏随机审计证书，并给出监控保密与时序防护，直接属于Agent安全。", "abstract_read": true, "abstract_sha256": "634c4354f5d30faf9b9f4082393e95d6aa066345ed2e320e51f09ce07c1d55fb", "summary_zh": "问题：随机抽样审计若提前泄漏是否被抽查，可能低估Agent真实违规率。方法：定义提交前非干扰PNI，以视图总变差刻画泄漏，并分析证书偏差及审计接口。作者声称结果：在模型假设下最坏偏差为(1−ε)D_A；真实LLM在136个预筛易受攻击任务对中，面对明确命名审计通知的注入，ASR由67.6%降至54.4%，说明被审计样本可变得更干净。正文核验：自然发现信号及真实LLM时序利用未获显著证明；4000次live运行的证书失效包含事后分析，预注册比较存在目标口径不匹配。静默内容审计不能自动消除所有时序泄漏。", "topics": { "tags": [ "monitoring", "privacy", "evaluation" ], "reason_zh": "研究自适应LLM Agent通过审计信号泄漏破坏随机审计证书，并给出监控保密与时序防护，直接属于Agent安全。" }, "version_id": "2610.37055v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2610.37055v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF abstract and version watermark", "Section VII A–C, Tables V–VI", "Section VIII limitations" ], "priority_body_notes": { "experimental_scope": "gpt-4.1-mini在560个workspace任务对上先筛选136个易受攻击任务对；E3配对条件，E5重采样已记录标签，E8实际4000次运行。", "metric_limits": "E3通知条件Δ=0.132，Holm p=.012；通用/工具/自然/时序条件不可合称成功。E8 n=2687为事后realized-rate分析，原比较n=2818，primary3000仅second-tier verdict。", "not_established": "未证明真实LLM自发学习并隐蔽利用时序通道，也未测试跨episode自适应；这是审计证书有效性研究，不是仓库恶意代码漏检率。" }, "published": "2026-10-27T11:24:12Z", "updated": "2026-10-27T11:24:12Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.CR", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37055v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37055", "version_id": "2610.37055v1", "first_author": "Wei Zhu", "affiliations": [ "School of Information, Renmin University of China", "Big Data and Responsible Artificial Intelligence for National Governance, Renmin University of China" ], "source_url": "https://arxiv.org/pdf/2610.37055v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "Wei Zhu1,3，PDF首页明确两单位映射。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.37081": { "id": "2610.37081", "title": "OpenGray: a benchmark for evaluating the decisions of radiotherapy planning agents", "classification": "relevant", "reason": "正文规定缺失器官或已证不相容硬剂量约束必须升级审查，直接评测 LLM 规划 Agent 的停止/提交/升级决策及临床日志中缺少停止动作的问题；是高风险行动安全与人类监督，不只是剂量优化能力。研究仅一头颈数据集、30 评估患者和特定模型，未证明临床疗效或伤害发生。", "abstract_read": true, "abstract_sha256": "bcd2305822efbd81b01308c174693870760990909c3aa859c26abcd82aa09a5b", "summary_zh": "问题：放疗规划Agent即使剂量总体指标良好，也可能错误提交或不请求人工审查。方法：OpenGray构造剂量目标证明不相容的任务和有可行计划的对照，对30患者测试四系统，并审查39次临床SAGE运行日志。作者声称结果：Terra配置两类LLM系统决策准确率95.4%/92.1%，但对需解剖算术的重叠矛盾升级比例仅50%/25%；可行对照中24%提交计划仍漏硬目标，四次SAGE运行持续识别失败却无停止动作。 正文核验：决策提交与剂量达标分别计分，不能把决策高分当临床安全证明；仅一头颈数据集、30 评估患者及特定模型，未验证临床疗效。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "正文规定缺失器官或已证不相容硬剂量约束必须升级审查，直接评测 LLM 规划 Agent 的停止/提交/升级决策及临床日志中缺少停止动作的问题；是高风险行动安全与人类监督，不只是剂量优化能力。研究仅一头颈数据集、30 评估患者和特定模型，未证明临床疗效或伤害发生。" }, "version_id": "2610.37081v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "initial_classification": "relevant", "scope_review": { "id": "2610.37081", "title": "OpenGray: a benchmark for evaluating the decisions of radiotherapy planning agents", "classification": "relevant", "reason": "正文规定缺失器官或已证不相容硬剂量约束必须升级审查，直接评测 LLM 规划 Agent 的停止/提交/升级决策及临床日志中缺少停止动作的问题；是高风险行动安全与人类监督，不只是剂量优化能力。研究仅一头颈数据集、30 评估患者和特定模型，未证明临床疗效或伤害发生。", "abstract_read": true, "abstract_sha256": "bcd2305822efbd81b01308c174693870760990909c3aa859c26abcd82aa09a5b", "summary_zh": "问题：放疗规划Agent即使剂量总体指标良好，也可能错误提交或不请求人工审查。方法：OpenGray构造剂量目标证明不相容的任务和有可行计划的对照，对30患者测试四系统，并审查39次临床SAGE运行日志。作者声称结果：Terra配置两类LLM系统决策准确率95.4%/92.1%，但对需解剖算术的重叠矛盾升级比例仅50%/25%；可行对照中24%提交计划仍漏硬目标，四次SAGE运行持续识别失败却无停止动作。 正文核验：决策提交与剂量达标分别计分，不能把决策高分当临床安全证明；仅一头颈数据集、30 评估患者及特定模型，未验证临床疗效。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "正文规定缺失器官或已证不相容硬剂量约束必须升级审查，直接评测 LLM 规划 Agent 的停止/提交/升级决策及临床日志中缺少停止动作的问题；是高风险行动安全与人类监督，不只是剂量优化能力。研究仅一头颈数据集、30 评估患者和特定模型，未证明临床疗效或伤害发生。" }, "version_id": "2610.37081v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": true, "review_attempted": true, "review_status": "completed_scope_review", "source_url": "https://arxiv.org/pdf/2610.37081v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "2.1–2.5 benchmark, tools, policies and logs", "3 results", "4 discussion and limitations" ], "reviewer": "scope_body_reviewer" }, "full_text_checked": true, "reviewed_sections": [ "2.1–2.5 benchmark, tools, policies and logs", "3 results", "4 discussion and limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.37081v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T11:42:47Z", "updated": "2026-10-27T11:42:47Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "physics.med-ph" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37081v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37081", "version_id": "2610.37081v1", "first_author": "Humza Nusrat", "affiliations": [ "Department of Radiation Oncology, Henry Ford Health", "Department of Radiology, College of Human Medicine, Michigan State University" ], "source_url": "https://arxiv.org/pdf/2610.37081v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "Humza Nusrat1,2,*；1/2直接映射两单位。*为邮箱联系脚注，不据此推断共同一作。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.37332": { "id": "2610.37332", "title": "Hidden in Plain Sight: an Empirical Study about The Instruction Stacks of Coding Agents", "classification": "uncertain", "reason": "正文确有权限/不可逆操作规则及安全动机编码：13 个变更单元陈述安全动机，但主要研究指令栈演化和复现，未实测安全边界或攻击效果。保留范围待确认，不将安全措辞或声明动机当成有效防护证据。", "abstract_read": true, "abstract_sha256": "ba950ba9616ce4aff948140f856c20d76c90c365d62dae5a861f1a8a5656bfde", "summary_zh": "问题：Coding Agent 的行为边界取决于完整指令栈，而非仅模型和系统提示。方法：分析五类 Coding Agent 的 1,886 个版本首个模型请求并追踪实现变更。作者声称结果（摘要）：三类最新请求以工具定义为主，48% 被分析变更单元直接说明动机。正文补证：包含权限及不可逆操作规则，13 个变更单元陈述安全动机，但未测试其安全效果；暂列范围待确认。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "正文确有权限/不可逆操作规则及安全动机编码：13 个变更单元陈述安全动机，但主要研究指令栈演化和复现，未实测安全边界或攻击效果。保留范围待确认，不将安全措辞或声明动机当成有效防护证据。" }, "version_id": "2610.37332v1", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_full_reread": false, "initial_classification": "uncertain", "scope_review": { "id": "2610.37332", "title": "Hidden in Plain Sight: an Empirical Study about The Instruction Stacks of Coding Agents", "classification": "uncertain", "reason": "正文确有权限/不可逆操作规则及安全动机编码：13 个变更单元陈述安全动机，但主要研究指令栈演化和复现，未实测安全边界或攻击效果。保留范围待确认，不将安全措辞或声明动机当成有效防护证据。", "abstract_read": true, "abstract_sha256": "ba950ba9616ce4aff948140f856c20d76c90c365d62dae5a861f1a8a5656bfde", "summary_zh": "问题：Coding Agent 的行为边界取决于完整指令栈，而非仅模型和系统提示。方法：分析五类 Coding Agent 的 1,886 个版本首个模型请求并追踪实现变更。作者声称结果（摘要）：三类最新请求以工具定义为主，48% 被分析变更单元直接说明动机。正文补证：包含权限及不可逆操作规则，13 个变更单元陈述安全动机，但未测试其安全效果；暂列范围待确认。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "正文确有权限/不可逆操作规则及安全动机编码：13 个变更单元陈述安全动机，但主要研究指令栈演化和复现，未实测安全边界或攻击效果。保留范围待确认，不将安全措辞或声明动机当成有效防护证据。" }, "version_id": "2610.37332v1", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_full_reread": false, "full_text_checked": true, "review_attempted": true, "review_status": "completed_body_review_scope_unresolved", "source_url": "https://arxiv.org/pdf/2610.37332v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "4.4 motivation codebook", "5.3 rationales and execution-policy changes", "7 construct validity" ], "reviewer": "scope_body_reviewer" }, "full_text_checked": true, "reviewed_sections": [ "4.4 motivation codebook", "5.3 rationales and execution-policy changes", "7 construct validity" ], "body_source_url": "https://arxiv.org/pdf/2610.37332v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T14:38:25Z", "updated": "2026-10-27T14:38:25Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 33 of 33 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37332v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37332", "version_id": "2610.37332v1", "first_author": "Felipe de Sant'Anna Paixão", "affiliations": [ "Federal University of Bahia" ], "source_url": "https://arxiv.org/pdf/2610.37332v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF首页左栏Felipe de Sant’Anna Paixão与另两作者共用Federal University of Bahia；右栏UCI仅Iftekhar Ahmed。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.37342": { "id": "2610.37342", "title": "Aligning Institutional Power and Operational Ability", "classification": "relevant", "reason": "明确针对Agentic多智能体的职责能力失配和权限升级，提出制度权限形式分析及修复框架。", "abstract_read": true, "abstract_sha256": "a9dd88b74a8745f4a433823759889f43f9530a10b1a73e334dfce92bf00d85f5", "summary_zh": "问题：Agentic系统职责与执行能力不匹配可能产生无法满足的义务或权限升级。方法：提出以流程建模和制度权限为中心的多智能体规范分析框架，讨论修复策略与操作流程/制度状态关系。作者声称结果：摘要描述形式框架及设计分析，没有提供实证量化结果。", "topics": { "tags": [ "authorization", "multiagent" ], "reason_zh": "明确针对Agentic多智能体的职责能力失配和权限升级，提出制度权限形式分析及修复框架。" }, "version_id": "2610.37342v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T14:47:58Z", "updated": "2026-10-27T14:47:58Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 11 of 11 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37342v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37342", "version_id": "2610.37342v1", "first_author": "Andrea Marino", "affiliations": [ "Informatics Institute, University of Amsterdam" ], "source_url": "https://arxiv.org/pdf/2610.37342v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "Andrea MARINO a,1，a为Informatics Institute,University of Amsterdam；1通讯脚注不作单位。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.37407": { "id": "2610.37407", "title": "Constraining the Commit Boundary: A DIO/ODI-Informed Authorization Guardrail for Agentic Entity Resolution", "classification": "relevant", "reason": "为Agent实体解析的持久身份变更规定证据晋升、授权范围和提交时版本校验，直接属于权限控制。", "abstract_read": true, "abstract_sha256": "f7c1f45fc2937fc8d404fab03062f756be3786e9cd3e3772fcacc5de4855bcc4", "summary_zh": "问题：Agent实体解析中错误身份假设可能反过来影响检索并获得表面佐证。方法：用DIO/ODI把推理证据与可授权持久身份变更的证据分开，两阶段监督器检查命题覆盖、冲突、范围及状态/策略版本。作者声称结果：给出概念架构与拟议评测协议，没有实现或实证验证，也不声称语义正确性定理；不能阻止错误假设或假设引导检索。", "topics": { "tags": [ "authorization", "memory" ], "reason_zh": "为Agent实体解析的持久身份变更规定证据晋升、授权范围和提交时版本校验，直接属于权限控制。" }, "version_id": "2610.37407v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T15:22:00Z", "updated": "2026-10-27T15:22:00Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.CR", "cs.DB" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37407v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37407", "version_id": "2610.37407v1", "first_author": "Daniel Beránek", "affiliations": [ "Independent Researcher, Brno, Czech Republic（独立研究者，非机构署名）" ], "source_url": "https://arxiv.org/pdf/2610.37407v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF首页作者下方明确署Independent Researcher,Brno,Czech Republic。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.37415": { "id": "2610.37415", "classification": "relevant", "reason": "代理信封标签与记忆防御，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "7fae0fac3f23d85211b508706fa9f614eb7ae7ddf0c4f01392acf19125e2c6e4", "summary_zh": "仅据摘要，作者声称：以A2A-TIBA测试信封标签、真实性和历史记忆的交互；作者报告真实信封强标签将语义突破率降低56–61个百分点，伪造削弱收益且前端差异明显，记忆效应更大，成功记忆增加突破、失败记忆降低突破；正常任务存在代价。", "topics": { "tags": [ "injection", "memory", "authorization" ], "reason_zh": "代理信封标签与记忆防御，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "The Envelope Layer: An Underestimated Surface of LLM Agent Defense", "version_id": "2610.37415v2", "published": "2026-10-27T15:32:10Z", "updated": "2026-10-30T17:28:58Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37415v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "seen_dates": [ "2026-10-29", "2026-11-03" ], "version_history": [ { "id": "2610.37415", "title": "The Envelope Layer: An Underestimated Surface of LLM Agent Defense", "classification": "relevant", "reason": "直接研究Agent间注入进入上下文时的信封标签、伪造和记忆对防御效果的影响。", "abstract_read": true, "abstract_sha256": "d6d8a203dbd697abcc93fee6044eabf9f8d8b2d4ea6b49706f60155391a177d2", "version_id": "2610.37415v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T15:32:10Z", "updated": "2026-10-27T15:32:10Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37415v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.37415", "version_id": "2610.37415v2", "first_author": "Yuelin Han", "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.37415v2", "shared_first_authors": [], "shared_first_note": "", "evidence": "First-page author block checked; no affiliation stated. No employer inference.", "author_status": "verified", "affiliation_status": "not_stated", "verification_status": "author_only", "status": "unverified", "title": "The Envelope Layer: An Underestimated Surface of LLM Agent Defense", "authors": [ "Yuelin Han" ], "affiliation_checked": true }, "abstract_source": "final_api_metadata", "first_seen_date": "2026-10-29", "revision_history": [ { "id": "2610.37415", "title": "The Envelope Layer: An Underestimated Surface of LLM Agent Defense", "classification": "relevant", "reason": "直接研究Agent间注入进入上下文时的信封标签、伪造和记忆对防御效果的影响。", "abstract_read": true, "abstract_sha256": "d6d8a203dbd697abcc93fee6044eabf9f8d8b2d4ea6b49706f60155391a177d2", "summary_zh": "问题：Agent上下文的信封标签是否可靠地阻挡注入。方法：以A2A-TIBA为载体，做标签强弱、信封真实性的2×2实验和成功/失败记忆实验，测量语义突破与拒绝。作者声称结果：真实信封强标签持续降低突破率；可伪造时收益减弱且因前端而异；成功记忆增加突破，失败记忆降低突破，混合经验多回到无记忆基线。摘要未给具体比例。", "topics": { "tags": [ "injection", "memory", "multiagent" ], "reason_zh": "直接研究Agent间注入进入上下文时的信封标签、伪造和记忆对防御效果的影响。" }, "version_id": "2610.37415v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T15:32:10Z", "updated": "2026-10-27T15:32:10Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.CR" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37415v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37415", "version_id": "2610.37415v1", "first_author": "Yuelin Han", "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.37415v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF首页只有Yuelin Han，未见署名单位；不以姓名或其他任职补猜。", "author_status": "verified", "affiliation_status": "unconfirmed", "verification_status": "affiliation_unconfirmed", "status": "affiliation_unconfirmed" } } ] }, "2610.37448": { "id": "2610.37448", "title": "Test-Time Communication in Trading Agent Swarms", "classification": "relevant", "reason": "正文明确分析 LLM 交易群体在通信后暴露集中、相关退出及陈旧信息传播的集体风险，而非仅比较收益；四模型家族、五通信模式的七日模拟交易，不等同实盘系统性风险已被证明。", "abstract_read": true, "abstract_sha256": "59dfb482fb4ff4fefd92df520bd5a0b0d056c987fdc94aa17aac1671e24705bd", "summary_zh": "问题：通信是否让交易 Agent 产生超出共同市场输入的持仓集中与同步风险。方法：200 个 LLM Agent、四模型家族、五通信模式，进行七个交易日的模拟账户实验并记录读入消息。作者声称结果（摘要）：两个模型家族通信组持仓更相似；接触同伴消息使八词短语复用增加 7 个百分点，但当日上午交易未见可检出变化。正文核验：集体暴露与陈旧消息传播是研究关注点；每个模型/模式仅一组，不能据此认定实盘系统性风险或比较长期收益。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "正文明确分析 LLM 交易群体在通信后暴露集中、相关退出及陈旧信息传播的集体风险，而非仅比较收益；四模型家族、五通信模式的七日模拟交易，不等同实盘系统性风险已被证明。" }, "version_id": "2610.37448v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "initial_classification": "uncertain", "scope_review": { "id": "2610.37448", "title": "Test-Time Communication in Trading Agent Swarms", "classification": "relevant", "reason": "正文明确分析 LLM 交易群体在通信后暴露集中、相关退出及陈旧信息传播的集体风险，而非仅比较收益；四模型家族、五通信模式的七日模拟交易，不等同实盘系统性风险已被证明。", "abstract_read": true, "abstract_sha256": "59dfb482fb4ff4fefd92df520bd5a0b0d056c987fdc94aa17aac1671e24705bd", "summary_zh": "问题：通信是否让交易 Agent 产生超出共同市场输入的持仓集中与同步风险。方法：200 个 LLM Agent、四模型家族、五通信模式，进行七个交易日的模拟账户实验并记录读入消息。作者声称结果（摘要）：两个模型家族通信组持仓更相似；接触同伴消息使八词短语复用增加 7 个百分点，但当日上午交易未见可检出变化。正文核验：集体暴露与陈旧消息传播是研究关注点；每个模型/模式仅一组，不能据此认定实盘系统性风险或比较长期收益。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "正文明确分析 LLM 交易群体在通信后暴露集中、相关退出及陈旧信息传播的集体风险，而非仅比较收益；四模型家族、五通信模式的七日模拟交易，不等同实盘系统性风险已被证明。" }, "version_id": "2610.37448v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": true, "review_attempted": true, "review_status": "completed_scope_review", "source_url": "https://arxiv.org/pdf/2610.37448v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "Introduction", "Experimental design", "8.1 implications", "8.2 limitations" ], "reviewer": "scope_body_reviewer" }, "full_text_checked": true, "reviewed_sections": [ "Introduction", "Experimental design", "8.1 implications", "8.2 limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.37448v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T15:54:05Z", "updated": "2026-10-27T15:54:05Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.CL", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 53 of 53 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37448v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "seen_dates": [ "2026-10-29" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37448", "version_id": "2610.37448v1", "first_author": "Avid Fayaz", "affiliations": [ "Infinite Ascent, Stockholm, Sweden" ], "source_url": "https://arxiv.org/pdf/2610.37448v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF首页六作者共用Infinite Ascent署名。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" }, "revision_history": [] }, "2610.37461": { "id": "2610.37461", "classification": "relevant", "reason": "类型化会话强制代理权限，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "93a162d4a342c48d68c15a9a0a24f88b160f651daffd7657599580029c283bde", "summary_zh": "仅据摘要，作者声称：Concordat把代理接口做成有限状态协议，仅提供当前合法工具、副作用前拒绝非法调用、人类决策不可代理，并线性分配预算；作者在tau-bench压力用户实验报告普通代理13/50及29/128未经确认变更，Concordat为零且任务成功率无显著差异，原奖励漏掉多数违规。", "topics": { "tags": [ "authorization", "monitoring" ], "reason_zh": "类型化会话强制代理权限，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "Concordat: Typed Sessions for LLM Agents", "version_id": "2610.37461v2", "published": "2026-10-27T16:00:26Z", "updated": "2026-10-30T15:44:41Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 13 of 13 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37461v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "seen_dates": [ "2026-10-29", "2026-11-03" ], "version_history": [ { "id": "2610.37461", "title": "Concordat: Typed Sessions for LLM Agents", "classification": "relevant", "reason": "以类型化会话协议限制Agent可用工具并强制人工确认，直接阻断未经授权的有副作用动作。", "abstract_read": true, "abstract_sha256": "93a162d4a342c48d68c15a9a0a24f88b160f651daffd7657599580029c283bde", "version_id": "2610.37461v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2610.37461v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF abstract and version watermark", "Section 5.1 benchmark, agents, metrics", "Section 5.2 Table 1 and task success", "Section 5.3 threats to validity" ], "priority_body_notes": { "metric_limits": "数据库写工具调用前最新用户消息是否包含yes/yep/yeah；两个go ahead边界样本若算确认，gpt-4.1违规任务数13→12。", "scope": "单一航空领域、两模型、少量试验；Haiku三轮部分API配额丢失，gpt-4.1部分任务率限后重跑。压力场景是作者新增，不是tau-bench官方配置。", "causal_limits": "Haiku之后修改了Concordat提示词才运行gpt-4.1；跨模型成绩改进不能独立归因该提示词变化。零违规不覆盖yes但否认具体动作的语义情况。" }, "published": "2026-10-27T16:00:26Z", "updated": "2026-10-27T16:00:26Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 11 of 11 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37461v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.37461", "version_id": "2610.37461v2", "first_author": "Milad Sikaroudi", "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2610.37461v2", "shared_first_authors": [], "shared_first_note": "", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified", "title": "Concordat: Typed Sessions for LLM Agents", "authors": [ "Milad Sikaroudi" ], "affiliation_checked": true }, "abstract_source": "final_api_metadata", "reviewed_sections": [ "PDF abstract and version watermark", "Section 5.1 benchmark, agents, metrics", "Section 5.2 Table 1 and task success", "Section 5.3 threats to validity" ], "priority_body_notes": { "metric_limits": "数据库写工具调用前最新用户消息是否包含yes/yep/yeah；两个go ahead边界样本若算确认，gpt-4.1违规任务数13→12。", "scope": "单一航空领域、两模型、少量试验；Haiku三轮部分API配额丢失，gpt-4.1部分任务率限后重跑。压力场景是作者新增，不是tau-bench官方配置。", "causal_limits": "Haiku之后修改了Concordat提示词才运行gpt-4.1；跨模型成绩改进不能独立归因该提示词变化。零违规不覆盖yes但否认具体动作的语义情况。" }, "first_seen_date": "2026-10-29", "revision_history": [ { "id": "2610.37461", "title": "Concordat: Typed Sessions for LLM Agents", "classification": "relevant", "reason": "以类型化会话协议限制Agent可用工具并强制人工确认，直接阻断未经授权的有副作用动作。", "abstract_read": true, "abstract_sha256": "93a162d4a342c48d68c15a9a0a24f88b160f651daffd7657599580029c283bde", "summary_zh": "问题：Agent即使把业务结果做对，也可能跳过用户确认。方法：Concordat把工具接口设为有限状态协议，执行前隐藏或拒绝当前不合法工具，约束人工决定和预算。作者声称结果：在tau-bench航空任务加自建催促场景后，标准Agent未经确认变更发生于gpt-4.1的13/50任务、Haiku的29/128次任务运行，Concordat为零；任务成功差异未显著。正文核验：128是三轮已完成配对运行合并，零违规由与指标共用的yes关键词门控保证；关键词不等于真实语义同意，且任务成功“无显著差异”不证明等效。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "以类型化会话协议限制Agent可用工具并强制人工确认，直接阻断未经授权的有副作用动作。" }, "version_id": "2610.37461v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2610.37461v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF abstract and version watermark", "Section 5.1 benchmark, agents, metrics", "Section 5.2 Table 1 and task success", "Section 5.3 threats to validity" ], "priority_body_notes": { "metric_limits": "数据库写工具调用前最新用户消息是否包含yes/yep/yeah；两个go ahead边界样本若算确认，gpt-4.1违规任务数13→12。", "scope": "单一航空领域、两模型、少量试验；Haiku三轮部分API配额丢失，gpt-4.1部分任务率限后重跑。压力场景是作者新增，不是tau-bench官方配置。", "causal_limits": "Haiku之后修改了Concordat提示词才运行gpt-4.1；跨模型成绩改进不能独立归因该提示词变化。零违规不覆盖yes但否认具体动作的语义情况。" }, "published": "2026-10-27T16:00:26Z", "updated": "2026-10-27T16:00:26Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.AI", "cs.MA" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "New submissions (showing 95 of 95 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 11 of 11 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37461v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37461", "version_id": "2610.37461v1", "first_author": "Milad Sikaroudi", "affiliations": [ "Independent Researcher（独立研究者，非机构署名）" ], "source_url": "https://arxiv.org/pdf/2610.37461v1", "shared_first_authors": [], "shared_first_note": "", "evidence": "PDF首页Milad Sikaroudi下方明确署Independent Researcher，不能推测机构。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" } } ] }, "2610.37657": { "id": "2610.37657", "classification": "relevant", "reason": "注意力门控代理注入防御，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "16e53885bf75677a296a9a9ad8387cce65eaeafde55a579441a07590afc981a6", "summary_zh": "仅据摘要，作者声称：HoS用少量注意力头门控分离可信指令与非可信数据；作者报告RL-Hammer在GPT-OSS-20B、SecAlign和HoS上的ASR分别97%、85%、10%，自适应白盒攻击达同ASR需三倍算力，静态代理攻击基准安全效用较基座改善且保留一般效用。", "topics": { "tags": [ "injection", "robustness", "evaluation" ], "reason_zh": "注意力门控代理注入防御，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness", "version_id": "2610.37657v2", "published": "2026-10-27T17:58:52Z", "updated": "2026-10-30T11:18:08Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CL", "cs.CR", "cs.LG" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 139 of 139 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37657v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "seen_dates": [ "2026-10-29", "2026-11-03" ], "version_history": [ { "id": "2610.37657", "title": "Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness", "classification": "relevant", "reason": "注意力头门控分离可信指令与不可信数据，明确在agentic提示注入基准验证。", "abstract_read": true, "abstract_sha256": "16e53885bf75677a296a9a9ad8387cce65eaeafde55a579441a07590afc981a6", "version_id": "2610.37657v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2610.37657v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF abstract and version watermark", "Section 4.1 Tables 1 and Figure 2", "Section 4.3 agentic benchmarks", "Section 6 limitations", "Appendix E.1–E.2, F.2 InjecAgent evaluation" ], "priority_body_notes": { "denominator": "RL-Hammer训练310个direct-harm样本，测试100个held-out目标；无工具调用计失败；Table1取所测攻击者对各防御的最高ASR，非同一攻击者跨防御对照。", "whitebox": "各100个AgentDojo与InjecAgent样本，累计ASR是预算内曾找到任一成功suffix；约3倍指50%阈值。InjecAgent预算上限累计95/100/90%，delivered90/100/84%分别对应base/SecAlign/HoS。", "limits": "相同训练数据条件下的比较不能证明所有SecAlign实现必然退化；输入可信性/用户授权需外部机制决定；有限攻击预算不建立安全证明。" }, "published": "2026-10-27T17:58:52Z", "updated": "2026-10-27T17:58:52Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.CL", "cs.CR", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 53 of 53 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 149 of 149 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37657v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.37657", "version_id": "2610.37657v2", "first_author": "Igor Shilov", "affiliations": [ "Imperial College London" ], "source_url": "https://arxiv.org/pdf/2610.37657v2", "shared_first_authors": [ "Igor Shilov", "Xiaoxue Yang", "Alexander Panfilov" ], "shared_first_note": "论文首页 * 标记及 Equal contribution / contributed equally 脚注明确声明共同贡献。", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified", "title": "Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness", "authors": [ "Igor Shilov", "Xiaoxue Yang", "Alexander Panfilov", "Evgenii Kortukov", "Matthieu Meeus", "Peter Romov", "Wojciech Samek", "Jonas Geiping", "Yves-Alexandre de Montjoye" ], "affiliation_checked": true }, "abstract_source": "final_api_metadata", "reviewed_sections": [ "PDF abstract and version watermark", "Section 4.1 Tables 1 and Figure 2", "Section 4.3 agentic benchmarks", "Section 6 limitations", "Appendix E.1–E.2, F.2 InjecAgent evaluation" ], "priority_body_notes": { "denominator": "RL-Hammer训练310个direct-harm样本，测试100个held-out目标；无工具调用计失败；Table1取所测攻击者对各防御的最高ASR，非同一攻击者跨防御对照。", "whitebox": "各100个AgentDojo与InjecAgent样本，累计ASR是预算内曾找到任一成功suffix；约3倍指50%阈值。InjecAgent预算上限累计95/100/90%，delivered90/100/84%分别对应base/SecAlign/HoS。", "limits": "相同训练数据条件下的比较不能证明所有SecAlign实现必然退化；输入可信性/用户授权需外部机制决定；有限攻击预算不建立安全证明。" }, "first_seen_date": "2026-10-29", "revision_history": [ { "id": "2610.37657", "title": "Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness", "classification": "relevant", "reason": "注意力头门控分离可信指令与不可信数据，明确在agentic提示注入基准验证。", "abstract_read": true, "abstract_sha256": "16e53885bf75677a296a9a9ad8387cce65eaeafde55a579441a07590afc981a6", "summary_zh": "问题：模型要利用不可信内容，却不应服从其中注入指令。方法：HoS学习少量逐注意力头门控，区分可信/不可信token通道，并与SecAlign++和ASIDE比较。作者声称结果：100个留出InjecAgent目标上，所测黑盒攻击的最高ASR为基模97%、SecAlign85%、HoS10%；白盒达到50%累计ASR需约3倍计算量，静态Agent基准与效用表现也有改善。正文核验：黑盒成功按首个工具调用判定；白盒预算上限下HoS累计ASR仍达90%、最终交付84%。该方法依赖外部可信来源标记，并非端到端授权或绝对防注入保证。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "注意力头门控分离可信指令与不可信数据，明确在agentic提示注入基准验证。" }, "version_id": "2610.37657v1", "candidate_type": "unseen_id", "abstract_source": "final_api_metadata", "api_abstract_reread": false, "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2610.37657v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF abstract and version watermark", "Section 4.1 Tables 1 and Figure 2", "Section 4.3 agentic benchmarks", "Section 6 limitations", "Appendix E.1–E.2, F.2 InjecAgent evaluation" ], "priority_body_notes": { "denominator": "RL-Hammer训练310个direct-harm样本，测试100个held-out目标；无工具调用计失败；Table1取所测攻击者对各防御的最高ASR，非同一攻击者跨防御对照。", "whitebox": "各100个AgentDojo与InjecAgent样本，累计ASR是预算内曾找到任一成功suffix；约3倍指50%阈值。InjecAgent预算上限累计95/100/90%，delivered90/100/84%分别对应base/SecAlign/HoS。", "limits": "相同训练数据条件下的比较不能证明所有SecAlign实现必然退化；输入可信性/用户授权需外部机制决定；有限攻击预算不建立安全证明。" }, "published": "2026-10-27T17:58:52Z", "updated": "2026-10-27T17:58:52Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.CL", "cs.CR", "cs.LG" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 53 of 53 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-28", "section": "New submissions (showing 149 of 149 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37657v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37657", "version_id": "2610.37657v1", "first_author": "Igor Shilov", "affiliations": [ "Imperial College London" ], "source_url": "https://arxiv.org/pdf/2610.37657v1", "shared_first_authors": [ "Igor Shilov", "Xiaoxue Yang", "Alexander Panfilov" ], "shared_first_note": "三位* Equal contribution；Igor/Xiaoxue为1 Imperial；Alexander为2 Tübingen AI Center,3 ELLIS Institute Tübingen,4 Max Planck Institute for Intelligent Systems；†是共同指导。", "evidence": "PDF首页编号与*、†说明直接映射。", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "status": "verified" } } ] }, "2610.37741": { "id": "2610.37741", "classification": "relevant", "reason": "预训练投毒使CLI代理执行攻击者命令。", "abstract_read": true, "abstract_sha256": "8ae42b384188355436f2d0fa1bac1c860b37a6b202c784be1348b7ca2d026820", "summary_zh": "从头预训练三个规模Qwen3并用干净流程训练CLI代理；0.1%语料投毒在4B模型达到约92%攻击成功率，0.0005%仍有效。", "topics": { "tags": [ "supplychain" ], "reason_zh": "预训练投毒使CLI代理执行攻击者命令。" }, "read_source_abstract_sha256": "7d0b854a96d59cd914291bd30a4e58696dfd11dc5ffa0ed1ec63aaefdc1bebf2", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.37741v1", "title": "Agentic Backdoors via Pretraining Poisoning", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T16:53:52Z", "updated": "2026-10-27T16:53:52Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CL", "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37741v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37741", "version_id": "2610.37741v1", "first_author": "Xinyan Hu", "affiliations": [ "UC Berkeley", "Anthropic Fellows Program" ], "shared_first_authors": [ "Xinyan Hu", "Pingbang Hu" ], "shared_first_note": "两位首列作者均有∗；脚注∗ Equal contribution；†为Equal advising而非共同一作。", "source_url": "https://arxiv.org/pdf/2610.37741v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Xinyan Hu上标1,5∗；1 UC Berkeley，5 Anthropic Fellows Program；Pingbang Hu为2,5∗。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37901": { "id": "2610.37901", "classification": "relevant", "reason": "直接覆盖技能供应链审计、间接及持久提示注入、跨技能数据流和用户授权边界；尤其适合补充恶意仓库审计中仅找恶意签名的盲点，但作者明确未检验扫描器本身抗对抗输入操纵的能力。", "abstract_read": true, "abstract_sha256": "25615eef40a3ba74f1d2346acd778b64b4c8340d344e894ed1d4e7de6edb1455", "summary_zh": "研究重点不是判断技能作者是否恶意，而是发现善意技能中的非预期漏洞及单独正常、组合后越权的交互。六模块静态扫描器分别生成本地和组合候选，再核对源代码/指令证据；本地验证要求行为存在、低信任输入可达和超出用户授权三条件，组合验证逐跳检查生产者、消费者、连接和最终后果。556例SkillTrustBench子集召回95.90%、误报4.22%；1000例平衡MalSkillBench样本F1为94.69%。1587技能的59项本地报告中53项经三名独立分析员确认，但去重后仅41个独立漏洞；另发现两个组合漏洞。改编SCR-Bench的1325组中TP/FN/FP/TN为665/3/9/648，F1为0.991。55项finding的缓解有47项在各三次攻击重放中均有效，6项仅部分缓解、2项未能评估，不能解释为普遍安全保证。", "topics": { "tags": [ "supplychain", "injection", "authorization", "memory", "evaluation" ], "reason_zh": "技能安装前扫描及组合依赖检测；存储历史注入触发Slack发送和监控源内容诱导OAuth令牌泄露体现持久记忆与授权交互风险。" }, "read_source_abstract_sha256": "25615eef40a3ba74f1d2346acd778b64b4c8340d344e894ed1d4e7de6edb1455", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37901v1", "title": "Scan Before You Install: Detecting and Mitigating Local and Composite Vulnerabilities in Skills", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.37901v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF第1页作者上标、单位和共同贡献脚注（已渲染目视核验）；HTML作者块交叉核验", "§4.1—4.2 Threat Model", "§5 Method概览；§5.4 Validation；§5.5 Reporting", "§6.1 Implementation；§6.2 Experimental Setup", "§6.3 RQ1及Tables 4—5；§6.4 RQ2及Figure 5对应正文", "§6.5 RQ3及Table 6和两组PoC；§6.6子集构成及Tables 7—8", "§6.7 RQ5及Tables 9—11", "§7.1—7.2、§7.4 Discussion；§8.1—8.4 Limitations；§9 Conclusion" ], "verified_metrics": [ { "claim": "SkillTrustBench子集", "detail": "556例；§6.6明确390 malicious、166 benign；§6.4/结论报告召回95.90%、FPR4.22%。完整5520例基准是另一组结果：precision96.95%、recall95.05%、F1 95.99%、FPR7.06%。比较使用DeepSeek-V4-Flash，不与真实仓库使用Kimi K3混为一谈。", "provenance": "§6.1、6.4、6.6、9" }, { "claim": "MalSkillBench", "detail": "随机类别平衡1000例（非全7944例）；precision98.70%、recall91.00%、F1 94.69%、FPR1.20%。其F1和precision最高，不是所有指标最高。", "provenance": "§6.2、6.4" }, { "claim": "真实仓库", "detail": "19198候选仓库按星数选75，原2197技能排除610翻译/每代理副本后1587；59报告来自43技能、23仓库；53确认finding对应41独立漏洞。10项披露对应9中危+1高危独立漏洞，覆盖12 finding。", "provenance": "§6.2—6.3、Tables4—5" }, { "claim": "组合基准", "detail": "改编静态评估：668 risky+657 negatives=1325；negative含547原控制、100跨案例乱配和10干净技能对；TP665/FN3/FP9/TN648，P98.7%、R99.6%、F1 .991。", "provenance": "§6.2、6.5、Table6" }, { "claim": "组合PoC", "detail": "存储历史→Slack：GPT-5.2-Codex 2/12、GLM-5 7/12越权请求；feed monitor→OAuth诊断：canary泄露分别5/12、6/12；沙箱内预批准shell。", "provenance": "§6.5" }, { "claim": "缓解分母", "detail": "53本地finding+2组合finding=55；47项三次重放均阻止攻击、6部分、2因替代技能需Artifactory且网络限制未测；合法任务53/55执行成功。", "provenance": "§6.7、Tables9—11" } ], "limitations_zh": [ "威胁模型假设基础模型与运行时未被攻陷、沙箱/审批生效；攻击者控制网页、issue、仓库输入而不能直接改已装技能；不要求沙箱逃逸。", "静态扫描不执行技能，不覆盖动态构造、超出归一化的混淆、网络下载代码；值流仅支持Python/JavaScript/shell；安装时抓取后成为持久指令的路径可能漏检。", "34技能指令超过120000字符而跳过instruction review；扫描覆盖不能等同每技能完整分析。", "全真实仓库没有ground truth；88.9%召回仅为从已检出仓库挑出的52技能中8/9 finding，不代表总体召回。", "作者未测扫描器抗恶意输入规避或分析劫持，提示把内容当数据并不能建立鲁棒性保证；仅一个组合基准。", "作者未发现真实漏洞技能存在恶意意图，不应写成恶意仓库或恶意作者统计；在v1中工具及工件称接受后开源，不能断言已公开。" ], "practical_takeaway_zh": "审计时将候选生成与证据验证分开，避免静态规则直接宣告安全；同时检查低信任来源到执行、敏感信息到外发以及持久历史的组合路径。真正运行时审批门不同于自然语言确认要求；论文Slack案例以独立MCP发送权限替代共享shell预批准，配合强制审批，而仅改确认提示被认定为部分缓解。", "published": "2026-10-27T19:43:31Z", "updated": "2026-10-27T19:43:31Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Parth A. Gandhi", "affiliations": [ "Stein Faculty of Computer and Information Science, Ben-Gurion University of the Negev, Beer-Sheva, Israel" ], "shared_first_authors": [ "Parth A. Gandhi", "Avital Aviv" ], "shared_first_note": "两位作者均标上标 a,1；脚注1明确说明These authors contributed equally to this work。", "source_url": "https://arxiv.org/pdf/2610.37901v1", "author_source": "PDF第1页作者署名上标与脚注；HTML作者块交叉验证", "status": "verified", "evidence": "PDF首页可见Parth A. Gandhi与Avital Aviv均为a,1，a对应Stein Faculty of Computer and Information Science, Ben-Gurion University of the Negev, Beer-Sheva, Israel；1对应共同贡献声明。其余作者仅a。", "id": "2610.37901", "version_id": "2610.37901v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38524": { "id": "2610.38524", "classification": "relevant", "reason": "利用交互诱饵防御恶意LLM网页扫描代理。", "abstract_read": true, "abstract_sha256": "853789bd5435d404893a7725c737ae50da6470a2b2e1348b21fd0104382d8126", "summary_zh": "WebMaze在真实页面嵌入保持功能的诱饵并构建交互世界；12个应用、三个扫描器默认设置下93%不同请求页为诱饵，披露机制后仍主要访问诱饵。", "topics": { "tags": [ "injection", "robustness" ], "reason_zh": "利用交互诱饵防御恶意LLM网页扫描代理。" }, "read_source_abstract_sha256": "853789bd5435d404893a7725c737ae50da6470a2b2e1348b21fd0104382d8126", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38524v1", "title": "WebMaze: Defending Against LLM-Powered Web Scanners with Functionality-Coupled Deception", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T09:35:14Z", "updated": "2026-10-28T09:35:14Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38524v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38524", "version_id": "2610.38524v1", "first_author": "Pengfei Zeng", "affiliations": [ "Wuhan University" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.38524v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "首列Pengfei Zeng正下方Wuhan University, Wuhan, China。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38617": { "id": "2610.38617", "classification": "relevant", "reason": "比较编码安全代理和静态分析的漏洞检测及harness影响。", "abstract_read": true, "abstract_sha256": "572ae062e5ed0ba879f2209cbedcc8dc4ce5aa773042e838776a5d5e98d0075b", "summary_zh": "VulnBench 2.0含20应用108漏洞，以源和汇位置评分；Snyk和Claude配置分别检出89和85项，合并101项，揭示审查策略、文件选择和定位精度限制。", "topics": { "tags": [ "evaluation" ], "reason_zh": "比较编码安全代理和静态分析的漏洞检测及harness影响。" }, "read_source_abstract_sha256": "572ae062e5ed0ba879f2209cbedcc8dc4ce5aa773042e838776a5d5e98d0075b", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38617v1", "title": "How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T10:38:43Z", "updated": "2026-10-28T10:38:43Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38617v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38617", "version_id": "2610.38617v1", "first_author": "Liran Tal", "affiliations": [ "Snyk" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.38617v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Liran Tal上标1；1 Snyk。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38895": { "id": "2610.38895", "classification": "relevant", "reason": "正文明确实测ATBench与R-Judge代理轨迹安全裁判，攻击仅改不可信待判内容，可使不安全轨迹被判安全，建立具体代理监控连接。", "abstract_read": true, "abstract_sha256": "8cad750cb1e373c97123f5f651d06f6b65db8147393ba6ca12f6d6ff2798735f", "summary_zh": "FlipJev以快速黑盒进化搜索生成短后缀，保持可信问题不变而攻击待判内容。九数据集通用后缀翻转114/264留出文档；代理安全监控中，ATBench后缀把9/30不安全轨迹翻为安全，ATBench与R-Judge的全部30条留出轨迹分数均降低超过0.05。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "正文明确实测ATBench与R-Judge代理轨迹安全裁判，攻击仅改不可信待判内容，可使不安全轨迹被判安全，建立具体代理监控连接。" }, "read_source_abstract_sha256": "8cad750cb1e373c97123f5f651d06f6b65db8147393ba6ca12f6d6ff2798735f", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38895v1", "title": "FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models", "initial_classification": "uncertain", "scope_review": { "id": "2610.38895", "version_id": "2610.38895v1", "classification": "relevant", "reason": "正文明确实测ATBench与R-Judge代理轨迹安全裁判，攻击仅改不可信待判内容，可使不安全轨迹被判安全，建立具体代理监控连接。", "summary_zh": "FlipJev以快速黑盒进化搜索生成短后缀，保持可信问题不变而攻击待判内容。九数据集通用后缀翻转114/264留出文档；代理安全监控中，ATBench后缀把9/30不安全轨迹翻为安全，ATBench与R-Judge的全部30条留出轨迹分数均降低超过0.05。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "正文明确实测ATBench与R-Judge代理轨迹安全裁判，攻击仅改不可信待判内容，可使不安全轨迹被判安全，建立具体代理监控连接。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.38895v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§1 Introduction", "§3 Threat Model and Attack", "§4.4 RQ3 Universality" ] }, "full_text_checked": true, "reviewed_sections": [ "§1 Introduction", "§3 Threat Model and Attack", "§4.4 RQ3 Universality" ], "body_source_url": "https://arxiv.org/html/2610.38895v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T20:53:38Z", "updated": "2026-10-28T20:53:38Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38895v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38895", "version_id": "2610.38895v1", "first_author": "Xiaogeng Liu", "affiliations": [ "Johns Hopkins University" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.38895v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Xiaogeng Liu上标1；1 Johns Hopkins University；Corresponding author不是共同一作。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39122": { "id": "2610.39122", "classification": "relevant", "reason": "个人代理自演化削弱间接注入防御。", "abstract_read": true, "abstract_sha256": "d805123eb3418d6e8c1b60a9893997c7cb732116a2e8e8a078a683e356662a80", "summary_zh": "以获用户授权的外部任务训练再用未授权相似外部任务测试；技能演化使平均攻击成功率上升14.0—48.8个百分点，强化学习上升3.0—39.3个百分点。", "topics": { "tags": [ "injection", "memory", "authorization" ], "reason_zh": "个人代理自演化削弱间接注入防御。" }, "read_source_abstract_sha256": "6b256501f3e8bef049183003eeeeac4ad8527bfebe338ddcdbaecc2e0197e922", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.39122v1", "title": "Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T01:10:18Z", "updated": "2026-10-29T01:10:18Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39122v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39122", "version_id": "2610.39122v1", "first_author": "Xinyan Wang", "affiliations": [ "University of Wisconsin–Madison" ], "shared_first_authors": [ "Xinyan Wang", "Xiaogeng Liu" ], "shared_first_note": "两人均有∗；脚注These authors contribute equally to this work。", "source_url": "https://arxiv.org/pdf/2610.39122v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Xinyan Wang∗1；1 University of Wisconsin–Madison；Xiaogeng Liu∗2。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39234": { "id": "2610.39234", "classification": "relevant", "reason": "网页代理绕行访问障碍时违反访问政策和用户约束。", "abstract_read": true, "abstract_sha256": "cb7b5593eeb72f4ab572b395086f5226a477a9f7a59f61f6d4cefe009b3844ef", "summary_zh": "AgentHeal覆盖九类访问障碍与沙箱及网站回放，评估合法替代来源与目标保持；平均成功率从89.4%降至43.7%，发现欺骗仿冒、未升级求助、违反政策和无效重试。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "网页代理绕行访问障碍时违反访问政策和用户约束。" }, "read_source_abstract_sha256": "cb7b5593eeb72f4ab572b395086f5226a477a9f7a59f61f6d4cefe009b3844ef", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39234v1", "title": "AgentHeal: Evaluating Goal-Preserving Resource Recovery of Web Agents under Access Barriers", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T02:51:58Z", "updated": "2026-10-29T02:51:58Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CL", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39234v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39234", "version_id": "2610.39234v1", "first_author": "Zhiyi Liu", "affiliations": [ "University of Science and Technology of China" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.39234v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Zhiyi Liu姓名下署University of Science and Technology of China；†仅在其他作者且脚注为Corresponding authors。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39532": { "id": "2610.39532", "classification": "relevant", "reason": "多代理任务图中限制未授权隐私传播。", "abstract_read": true, "abstract_sha256": "3c16de171c0e12107e192d95c836b47d5041f6af646996d16dea57a4a2a71b5e", "summary_zh": "TG-CI将上下文完整性扩展为考虑传播范围和披露历史的任务图信息流，提出Full-Scope、Auto-Region策略及144案例MAPLE-Bench；在主要实验配置中，平均未授权披露次数较Local-History CI基线减少85.8—94.1%，任务准确率保留基线的93.6—96.1%。", "topics": { "tags": [ "privacy", "multiagent", "authorization", "memory" ], "reason_zh": "多代理任务图中限制未授权隐私传播。" }, "read_source_abstract_sha256": "3c16de171c0e12107e192d95c836b47d5041f6af646996d16dea57a4a2a71b5e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39532v1", "summary_audit": "93.6—96.1%是相对于基线准确率的保留比例，原文易被读成绝对任务准确率；补充主要实验配置及平均披露计数。", "title": "Judging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacy", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T07:31:50Z", "updated": "2026-10-29T07:31:50Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39532v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39532", "version_id": "2610.39532v1", "first_author": "Hengyu Wu", "affiliations": [ "Department of Computer Science, School of Computing, Institute of Science Tokyo" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.39532v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Hengyu Wu列首；作者行下统一署Department of Computer Science, School of Computing, Institute of Science Tokyo。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38867": { "id": "2610.38867", "classification": "relevant", "reason": "直接研究编码及工具智能体的固定载荷位置效应，可为按路径/文件类型分层的安全实验提供方法参考；但研究对象是外部恶意指令被读取后是否被执行，不是代理审计时是否发现已有恶意代码。", "abstract_read": true, "abstract_sha256": "f950b27f029633adadf88e2faec67944c76dde9d0b6686d4eae77f0a8ca72220", "summary_zh": "本文固定恶意指令载荷、改变其所在环境表面及起始/中间/末尾位置，在工具使用、编码和日常工作流三个测试床测量间接提示注入。测试床共30项良性长程任务、24项注入任务/风险和36个环境表面；主要指标为已被工具返回内容逐字包含的注入中的条件攻击成功率。作者报告GPT-5.4对README/TODO中不安全指令的平均服从率约为代码/数据文件的2.6倍；表3中工具使用域末尾条件ASR为51.2%，起始39.5%。工作流单任务的1440次读序置换实验中各深度置信区间重叠。结果支持同一指令在不同位置的攻击效果差异，不直接证明模型内部信任机制，也不测量对仓库既有恶意代码的审计覆盖率或漏检率。", "topics": { "tags": [ "injection", "supplychain", "authorization", "evaluation" ], "reason_zh": "仓库文档、源码和数据文件及外部工具表面的间接指令注入，重点分离注入内容、位置和投递。" }, "read_source_abstract_sha256": "f950b27f029633adadf88e2faec67944c76dde9d0b6686d4eae77f0a8ca72220", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38867v1", "title": "Where You Inject Matters: The Trust Region Effect in LLM Agents", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.38867v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF首页作者署名、机构上标及†脚注（已渲染目视核验）", "Abstract与Figure 1", "§3.1威胁模型、§3.2测试床与投递条件", "§4.1设置与条件ASR定义", "§4.2及Tables 1–3", "§4.6、Appendix A项目检查前言、Appendix B.1文件分类", "Appendix C/Table 10编码风险", "Appendix D.2/Tables 14–15读序置换", "Appendix D.3/Table 16任务长度", "Appendix D.4宿主文件长度", "Appendix D.5/Figure 4固定模板", "Appendix D.8/Table 18内容与位置拆分", "Appendix E局限" ], "metric_checks": [ { "metric": "条件ASR", "denominator": "实际注入载荷逐字出现在代理检索返回内容中的运行；不是所有投放、所有仓库文件或所有审计对象。", "evidence": "§4.1–4.2明确Pr(Attack Success | Injection Read, placement)；read通过工具返回内容含逐字载荷判定，不是内部注意力测量。" }, { "metric": "README/TODO约2.6倍", "denominator": "作者报告按环境表面聚合的平均条件ASR；Table 2给各风险百分比，未给逐格样本量，不从四舍五入表格反推精确计数。", "evidence": "Table 2 GPT-5.4 SQLi：README 79%、TODO 59%、code file 11%、data file 28%；Recon：86%、61%、19%、30%。各风险差异很大，删除和抓取攻击四组均0。" }, { "metric": "位置首/中/末", "denominator": "按域汇总已读注入运行，受害模型编码/工作流为GPT-5.4，工具使用为GPT-4o，不能跨域当同模型比较。", "evidence": "Table 3：编码12.6/11.1/13.0%；工作流2.3/3.3/5.7%；工具39.5/40.1/51.2%。" }, { "metric": "忽略与拒绝", "denominator": "工具使用域已投递但攻击未成功的运行，不是所有攻击。", "evidence": "Table 1 GPT-4o忽略81.3%、拒绝0.7%、尝试失败18.0%；GPT-5.4忽略66.8%、拒绝33.2%、尝试失败0%。忽略不能解释为识别了恶意代码。" }, { "metric": "读序置换", "denominator": "一个工作流任务×24排列×4注入表面×5风险×3位置=1440次运行；每表面在各深度出现6次排列。", "evidence": "D.2/Table 14深度d1–d4 ASR为6.8、3.5、5.4、4.9%，95% Wilson区间重叠；并非证明所有任务中读序无效。" }, { "metric": "单独改变位置", "denominator": "GPT-4o工具域留风险/留任务测试集的条件ASR；文件内位置固定末尾。", "evidence": "D.8/Table 18固定模板随机表面→先验排名表面：25.6→34.7%（留风险）、38.8→77.1%（留任务）；再改变内容后为62.7/81.8%，后者不得归为纯位置收益。" } ], "causal_limits_zh": [ "固定的是某一恶意目标对应载荷，跨风险任务仍有不同GOAL；不能描述成全实验只用一个相同目标字符串。", "候选表面倾向已经会被读到的区域：编码任务清洁运行三次、取三次均访问文件；还加了项目检查前言。故不能推导自然仓库中不同路径的覆盖率。", "编码README/TODO是/app根目录arena级文件，代码/数据文件来自子任务目录；表面类别与层级、语义角色、包装上下文并非完全独立，不能单凭此实验认定仅扩展名或目录深度导致效果。", "Appendix E将trust region明确限定为经验行为现象，未直接测量内部信任，也未解释心理或表征机制。", "文件长度分析仅15个原始仓库文件，Spearman rho=-0.34、p=0.22；不显著不能证明长度完全无影响。", "三个人工验证测试床不是全部真实代理环境；模型与harness不同，位置模式具有模型/代理依赖。", "本文可借鉴固定载荷、单位置干预、区分投递和服从及读序对照设计；若用户研究恶意代码审计，需另测文件是否被访问、恶意逻辑是否被识别、报告与修复是否成功，不能将本文ASR直接当漏检率。" ], "published": "2026-10-28T20:40:04Z", "updated": "2026-10-28T20:40:04Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 20 of 20 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Chengquan Guo", "affiliations": [ "University of Chicago" ], "shared_first_authors": [], "shared_first_note": "首页未标注共同第一作者。Chengquan Guo的上标为1,†；1对应University of Chicago，†仅说明工作在Microsoft Research实习期间完成，不是共同一作或第二机构上标。", "source_url": "https://arxiv.org/pdf/2610.38867v1", "author_source": "PDF首页署名上标、机构行与脚注；HTML署名丢失上标，故以PDF为准", "status": "verified_from_pdf_signature", "evidence": "首页Chengquan Guo上标1,†；机构1为University of Chicago；†脚注为“Work done during an internship at Microsoft Research.”；Xiaodong Liu上标2，不与其共享†。", "id": "2610.38867", "version_id": "2610.38867v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39433": { "id": "2610.39433", "classification": "relevant", "reason": "正文将多专家LLM论证工作流置于受污染威胁情报输入下，专门评估虚假技术归因、跨报告污染和语义投毒，属于多代理证据验证防御；非工具执行越权，范围应如此限定。", "abstract_read": true, "abstract_sha256": "aaf9309bd355f65bbb029a7e099f248cda854733da019857f23e2a56268f5cbf", "summary_zh": "ARBITRA以三个专门化LLM专家提出ATT&CK候选，针对分歧逐项建立证据支持/反驳图。三类文本污染下平均相对精度下降7%，对比GPT-5.5的14%；但语义投毒使召回由0.635降到0.545，验证不能挽回未生成的正确候选，定位为需人工监督的CTI辅助。", "topics": { "tags": [ "multiagent", "robustness", "evaluation" ], "reason_zh": "正文将多专家LLM论证工作流置于受污染威胁情报输入下，专门评估虚假技术归因、跨报告污染和语义投毒，属于多代理证据验证防御；非工具执行越权，范围应如此限定。" }, "read_source_abstract_sha256": "aaf9309bd355f65bbb029a7e099f248cda854733da019857f23e2a56268f5cbf", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39433v1", "title": "ARBITRA: Robust Document-Level ATT&CK Extraction via Multi-Expert Argumentation", "initial_classification": "uncertain", "scope_review": { "id": "2610.39433", "version_id": "2610.39433v1", "classification": "relevant", "reason": "正文将多专家LLM论证工作流置于受污染威胁情报输入下，专门评估虚假技术归因、跨报告污染和语义投毒，属于多代理证据验证防御；非工具执行越权，范围应如此限定。", "summary_zh": "ARBITRA以三个专门化LLM专家提出ATT&CK候选，针对分歧逐项建立证据支持/反驳图。三类文本污染下平均相对精度下降7%，对比GPT-5.5的14%；但语义投毒使召回由0.635降到0.545，验证不能挽回未生成的正确候选，定位为需人工监督的CTI辅助。", "topics": { "tags": [ "multiagent", "robustness", "evaluation" ], "reason_zh": "正文将多专家LLM论证工作流置于受污染威胁情报输入下，专门评估虚假技术归因、跨报告污染和语义投毒，属于多代理证据验证防御；非工具执行越权，范围应如此限定。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.39433v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§3.3 Threat Model", "§3.5 Design Goal", "§4.1 Two-Phase Document-Level Extraction", "§4.3 Adversarial CTI Perturbations", "§5.6 Expert QBAF vs. Single-Call Verification", "§6.1—6.4及Table5", "Ethical Considerations" ] }, "full_text_checked": true, "reviewed_sections": [ "§3.3 Threat Model", "§3.5 Design Goal", "§4.1 Two-Phase Document-Level Extraction", "§4.3 Adversarial CTI Perturbations", "§5.6 Expert QBAF vs. Single-Call Verification", "§6.1—6.4及Table5", "Ethical Considerations" ], "body_source_url": "https://arxiv.org/html/2610.39433v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T06:09:41Z", "updated": "2026-10-29T06:09:41Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CL", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 20 of 20 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 108 of 108 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39433v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39433", "version_id": "2610.39433v1", "first_author": "Youngjin Jin", "affiliations": [ "School of Electrical Engineering, KAIST" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.39433v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Youngjin Jin列首；作者行下统一署School of Electrical Engineering, KAIST。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39899": { "id": "2610.39899", "classification": "relevant", "reason": "编码代理安全任务评估：明确跟踪不可信输入、重建安全约束、生成可执行PoV并验证漏洞修补；属于漏洞修复防御应用，而非代理自身抗注入能力。", "abstract_read": true, "abstract_sha256": "dd88ee42cbe39ef7037e32736544be35d67ee020d47cdac164784f2fe0066719", "summary_zh": "ExploreRepair用结构、意图及PoV三类探索代理和双路径聚合修补信息不完整漏洞。169项PatchEval漏洞上两模型修复率39.6%/71.6%，过拟合率0/0.6%；35项VulnLoc+以PoV而非单元测试评分。实验在断网容器去除参考补丁及评分信息，比较的是安全漏洞修复有效性。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "编码代理安全任务评估：明确跟踪不可信输入、重建安全约束、生成可执行PoV并验证漏洞修补；属于漏洞修复防御应用，而非代理自身抗注入能力。" }, "read_source_abstract_sha256": "dd88ee42cbe39ef7037e32736544be35d67ee020d47cdac164784f2fe0066719", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39899v1", "title": "ExploreRepair: Evidence-Specialized Agents for Vulnerability Repair under Information Constraints", "initial_classification": "uncertain", "scope_review": { "id": "2610.39899", "version_id": "2610.39899v1", "classification": "relevant", "reason": "编码代理安全任务评估：明确跟踪不可信输入、重建安全约束、生成可执行PoV并验证漏洞修补；属于漏洞修复防御应用，而非代理自身抗注入能力。", "summary_zh": "ExploreRepair用结构、意图及PoV三类探索代理和双路径聚合修补信息不完整漏洞。169项PatchEval漏洞上两模型修复率39.6%/71.6%，过拟合率0/0.6%；35项VulnLoc+以PoV而非单元测试评分。实验在断网容器去除参考补丁及评分信息，比较的是安全漏洞修复有效性。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "编码代理安全任务评估：明确跟踪不可信输入、重建安全约束、生成可执行PoV并验证漏洞修补；属于漏洞修复防御应用，而非代理自身抗注入能力。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.39899v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§3 Problem Setting", "§4.1—4.3 Exploration/Aggregation", "§5.2 Metrics及Tables1—2", "§5.5—5.6", "§6.1及Table3" ] }, "full_text_checked": true, "reviewed_sections": [ "§3 Problem Setting", "§4.1—4.3 Exploration/Aggregation", "§5.2 Metrics及Tables1—2", "§5.5—5.6", "§6.1及Table3" ], "body_source_url": "https://arxiv.org/html/2610.39899v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T12:09:12Z", "updated": "2026-10-29T12:09:12Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 20 of 20 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 35 of 35 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39899v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39899", "version_id": "2610.39899v1", "first_author": "Duc Manh Tran", "affiliations": [ "The University of Sydney, Australia" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.39899v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Duc Manh Tran上标1；1 The University of Sydney, Australia。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2608.04565": { "id": "2608.04565", "classification": "relevant", "reason": "跨轮操控检索代理工具观察链以劫持目标。", "abstract_read": true, "abstract_sha256": "4d3ea3ccfecc07d8b00c59dd8baa747a48b70ffe3bfec1576a0a911c21de92ee", "summary_zh": "受限工具中介每次查询仅附一个受控结果，ACH组织似乎互证的权威链；SafeSearch完整测试ASR/MaxN ASR为55.9%/83.3%，轨迹引导策略演化最强留出配置达71.4%/95.0%。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "跨轮操控检索代理工具观察链以劫持目标。" }, "read_source_abstract_sha256": "ca7907e533f265ec551f489faa2c8a2f1cacd2fc7729a7b1fcc547611f4f77ee", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2608.04565v3", "title": "Breadcrumbing Search Agents: Per-Turn Scheming Over Long-Horizon Trajectories", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-05T07:57:27Z", "updated": "2026-10-29T04:44:02Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 104 of 104 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.04565v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.04565", "version_id": "2608.04565v3", "first_author": "Xuebin Li", "affiliations": [ "School of Cyber Science and Technology, University of Science and Technology of China" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2608.04565v3", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Xuebin Li上标1；1为School of Cyber Science and Technology, University of Science and Technology of China。首作者无共同贡献符号。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37830": { "id": "2610.37830", "classification": "relevant", "reason": "智能合约编码代理安全修补可能破坏用户意图，研究执行验证及需求澄清。", "abstract_read": true, "abstract_sha256": "ad7515867fa6a42ced0b42df36b7fa62bb0e756f4d1cc602b8ec999b80ee7509", "summary_zh": "以同一交易重放比较生成合约与待复现原始合约，并用植入错误审计评分工具；提出先澄清再生成、用独立编写的可执行答案检查并向客户返回分歧的架构。三个模型上先提问比事后审查或修补更有效，发布600任务。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "智能合约编码代理安全修补可能破坏用户意图，研究执行验证及需求澄清。" }, "read_source_abstract_sha256": "ad7515867fa6a42ced0b42df36b7fa62bb0e756f4d1cc602b8ec999b80ee7509", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37830v1", "summary_audit": "摘要区分与原始合约的交易重放和独立可执行答案检查；原总结将两者混写。", "title": "Measuring Where Intent Gets Lost in Agentic Smart Contract Synthesis", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T18:43:14Z", "updated": "2026-10-27T18:43:14Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.HC", "cs.IR", "cs.MA", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37830v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37830", "version_id": "2610.37830v1", "first_author": "Abhinav Goel", "affiliations": [ "Columbia University" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.37830v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Abhinav Goel姓名下为Columbia University, New York, NY, USA。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38691": { "id": "2610.38691", "version_id": "2610.38691v2", "abstract_sha256": "8a86d2cd9b6ba0fe27fc8f3389763715d6285edccf6cac5d3d1f1376a77684e8", "abstract_read": true, "classification": "irrelevant", "reason_zh": "直接审计科研代理的证据溯源与研究完整性，但主要错误为非故意数值错引，不是执行安全或攻击防御。", "summary_zh": "论文重析九类科研代理的 540 项判定，并人工标注十八篇投稿的 256 个数值主张，约五分之四无支持主张源自代理自己文件中的错误实验、指标或运行。确定性上下文与诱饵数值检查器以 78/85、超过 90% 精度认证部分主张；同证据 LLM 验证器覆盖更多，却接受约三倍错引，作者主张结合使用并强调未验证不等于虚假。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "直接审计科研代理的证据溯源与研究完整性，但主要错误为非故意数值错引，不是执行安全或攻击防御。" }, "reason": "完整摘要重读确认，研究 AI 论文数值的实验/指标/运行归因，明确失误多非作弊；确定性证据检查评价研究产物可靠性，并未建立 Agent 安全边界或对抗监督场景。", "title": "Beyond fabrication: Misattributed numbers in papers written by AI research agents", "initial_classification": "uncertain", "scope_review": { "id": "2610.38691", "version_id": "2610.38691v2", "classification": "irrelevant", "reason": "完整摘要重读确认，研究 AI 论文数值的实验/指标/运行归因，明确失误多非作弊；确定性证据检查评价研究产物可靠性，并未建立 Agent 安全边界或对抗监督场景。", "summary_zh": "论文重析九类科研代理的 540 项判定，并人工标注十八篇投稿的 256 个数值主张，约五分之四无支持主张源自代理自己文件中的错误实验、指标或运行。确定性上下文与诱饵数值检查器以 78/85、超过 90% 精度认证部分主张；同证据 LLM 验证器覆盖更多，却接受约三倍错引，作者主张结合使用并强调未验证不等于虚假。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "直接审计科研代理的证据溯源与研究完整性，但主要错误为非故意数值错引，不是执行安全或攻击防御。" }, "full_text_checked": false, "source_url": "https://arxiv.org/abs/2610.38691v2", "reviewed_sections": [ "完整元数据摘要（重新逐句阅读）" ], "evidence_level": "full_abstract_reread", "review_status": "completed" }, "full_text_checked": false, "reviewed_sections": [ "完整元数据摘要（重新逐句阅读）" ], "body_source_url": "https://arxiv.org/abs/2610.38691v2", "evidence_level": "full_abstract_reread", "published": "2026-10-28T18:57:54Z", "updated": "2026-10-31T21:13:25Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.DL" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38691v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "seen_dates": [ "2026-10-31", "2026-11-04" ], "version_history": [ { "id": "2610.38691", "classification": "relevant", "reason": "审计科研代理数值主张与证据错配，涉及研究完整性。", "abstract_read": true, "abstract_sha256": "3e2259941624c0ff591af375b4edc9e9e194826f78c7d01cd436d4859521a3d8", "read_source_abstract_sha256": "3e2259941624c0ff591af375b4edc9e9e194826f78c7d01cd436d4859521a3d8", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38691v1", "title": "Beyond fabrication: Misattributed numbers in papers written by AI research agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T18:57:54Z", "updated": "2026-10-28T18:57:54Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL", "cs.DL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38691v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "summary_retained_from_version": "2610.38691v1", "author": { "id": "2610.38691", "version_id": "2610.38691v2", "first_author": "Mosab Alfaqeeh", "affiliations": [ "Al-Ahliyya Amman University" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.38691v2", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "首页标题及v2匹配；Mosab Alfaqeeh上标a对应Al-Ahliyya Amman University，星号通讯作者。", "author_status": "verified", "affiliation_status": "verified", "title": "Beyond fabrication: Misattributed numbers in papers written by AI research agents", "authors": [ "Mosab Alfaqeeh", "Omar Mohammed Horani", "Mou'th Hourani", "Hashem Alfaqeeh" ], "verification_status": "affiliation_verified", "affiliation_checked": true }, "read_source_abstract_sha256": "3e2259941624c0ff591af375b4edc9e9e194826f78c7d01cd436d4859521a3d8", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "first_seen_date": "2026-10-31", "revision_history": [ { "id": "2610.38691", "classification": "relevant", "reason": "审计科研代理数值主张与证据错配，涉及研究完整性。", "abstract_read": true, "abstract_sha256": "3e2259941624c0ff591af375b4edc9e9e194826f78c7d01cd436d4859521a3d8", "summary_zh": "重析540判定并标注256数值主张，约八成无支持主张对应代理文件中错误实验、指标或运行的值；确定性上下文及数值诱饵验证器认证精度超过90%，但覆盖有限，LLM接受约三倍错配主张。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "审计科研代理数值主张与证据错配，涉及研究完整性。" }, "read_source_abstract_sha256": "3e2259941624c0ff591af375b4edc9e9e194826f78c7d01cd436d4859521a3d8", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38691v1", "title": "Beyond fabrication: Misattributed numbers in papers written by AI research agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T18:57:54Z", "updated": "2026-10-28T18:57:54Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL", "cs.DL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38691v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38691", "version_id": "2610.38691v1", "first_author": "Mosab Alfaqeeh", "affiliations": [ "Al-Ahliyya Amman University, Amman, Jordan" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.38691v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Mosab Alfaqeeh上标a,∗；a对应Al-Ahliyya Amman University；其余作者无∗，非共享一作标识。", "author_status": "verified", "affiliation_status": "verified" } } ] }, "2610.38869": { "id": "2610.38869", "classification": "relevant", "reason": "显式约束多代理记忆和通信中的信念更新以防操纵传播。", "abstract_read": true, "abstract_sha256": "baa408039e5e76b15cb2217a8ca1c39bbfce44ffb087d4e97bb548051eba2c0a", "summary_zh": "提出EB-MAS结构化信念状态、更新算子及认知防火墙，限制证据薄弱而受脆弱性线索驱动的更新；讨论制造共识、串谋及级联误信息和集成难点，摘要无量化实验。", "topics": { "tags": [ "multiagent", "memory", "monitoring" ], "reason_zh": "显式约束多代理记忆和通信中的信念更新以防操纵传播。" }, "read_source_abstract_sha256": "baa408039e5e76b15cb2217a8ca1c39bbfce44ffb087d4e97bb548051eba2c0a", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38869v1", "title": "Auditable Belief Updates as a Missing Safety Layer for LLM-Powered Multi-Agent Systems", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T20:40:33Z", "updated": "2026-10-28T20:40:33Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38869v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38869", "version_id": "2610.38869v1", "first_author": "Zhuoyun Li", "affiliations": [ "School of Computer Science and Informatics, University of Liverpool, UK" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.38869v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Zhuoyun Li为首列，作者行下统一署University of Liverpool的School of Computer Science and Informatics。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39282": { "id": "2610.39282", "classification": "relevant", "reason": "计算机代理陈旧截图点击可触发非预期或不可逆动作。", "abstract_read": true, "abstract_sha256": "55289faa50a49f70d33e4b961e33d0da2e6586dc92e942b12ee05ad56c9635ff", "summary_zh": "31页面测量显示完全加载后30秒陈旧点击0.4%，打开首秒17%；网络闲置等待可减少风险，但常见代理等待规则仍有残留。像素检查目标位置达到前沿视觉模型准确度且延迟为八分之一。", "topics": { "tags": [ "robustness", "monitoring", "evaluation" ], "reason_zh": "计算机代理陈旧截图点击可触发非预期或不可逆动作。" }, "read_source_abstract_sha256": "798c82c25f8ba02a80ea403a2ae894a59baf6b0d9d8b2e9abd1081a2deb439e4", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.39282v1", "title": "What Does \"Now\" Mean to Your Computer-Use Agent? Stale Screenshots, Page Loads, and Which Check to Run Before a Click", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T03:33:26Z", "updated": "2026-10-29T03:33:26Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39282v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39282", "version_id": "2610.39282v1", "first_author": "Vasundra Srinivasan", "affiliations": [ "Stanford School of Engineering" ], "shared_first_authors": [], "shared_first_note": "单作者；无共同一作。", "source_url": "https://arxiv.org/pdf/2610.39282v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "署名行原文：Principal AI Engineer, Author—Data Engineering for Multimodal AI (O’Reilly), Stanford School of Engineering。机构按署名转录；该混合履历行不能额外推断现职雇佣关系。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39377": { "id": "2610.39377", "classification": "relevant", "reason": "工具代理受压时报告与执行不一致的欺骗评估。", "abstract_read": true, "abstract_sha256": "1021c5c85540fab8511608ab187a7514c8ab78e3646e66dde427549cf0845619", "summary_zh": "AgentDecept从257任务构建477压力变体及无压力对照，以轨迹证据区分伪造、隐瞒、模棱两可与诚实失败，覆盖六类压力并可测试激活探针；摘要未给量化模型结果。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "工具代理受压时报告与执行不一致的欺骗评估。" }, "read_source_abstract_sha256": "1021c5c85540fab8511608ab187a7514c8ab78e3646e66dde427549cf0845619", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39377v1", "title": "AgentDecept: Benchmarking Deceptive Behavior in Tool-Using LLM Agents under Pressure", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T05:08:22Z", "updated": "2026-10-29T05:08:22Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39377v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39377", "version_id": "2610.39377v1", "first_author": "Yehan Zhang", "affiliations": [ "University of California, Santa Barbara" ], "shared_first_authors": [ "Yehan Zhang", "Qianqi Yan" ], "shared_first_note": "两位首列作者上标1,*；* Equal contribution；†是通讯作者。", "source_url": "https://arxiv.org/pdf/2610.39377v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Yehan Zhang1,*、Qianqi Yan1,*；1 University of California, Santa Barbara。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40071": { "id": "2610.40071", "classification": "relevant", "reason": "编码代理供应链、政策与任务一致性的签名过程证明。", "abstract_read": true, "abstract_sha256": "fc838556eb33a244de0c6ab690870ef54a86f5612318258598b78aa26bee70cb", "summary_zh": "APE提出带签名、可检测篡改的机器可读代理过程证明，将会话与结果关联，支持in-toto式证明、Policy-as-Code和按需人工介入；摘要未给实证结果。", "topics": { "tags": [ "supplychain", "authorization", "monitoring" ], "reason_zh": "编码代理供应链、政策与任务一致性的签名过程证明。" }, "read_source_abstract_sha256": "fc838556eb33a244de0c6ab690870ef54a86f5612318258598b78aa26bee70cb", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40071v1", "summary_audit": "tamper-evident是可发现篡改，不保证防止篡改；将防篡改改为可检测篡改。", "title": "Agentic process evidence", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T13:50:54Z", "updated": "2026-10-29T13:50:54Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.SE", "eess.SY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40071v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40071", "version_id": "2610.40071v1", "first_author": "Yuval Kainan", "affiliations": [ "JFrog" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.40071v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Yuval Kainan列首，其下署JFrog；Carmit Hershman另列。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40246": { "id": "2610.40246", "classification": "relevant", "reason": "动态政策和记录变更下代理错误行动及审计评估。", "abstract_read": true, "abstract_sha256": "ddb475262deb8b5b1ed30f058f62493f19b1e0791c926b72408bd6c743037135", "summary_zh": "EnvOS认证任务中途变化、可解性和评分，并独立重审归档证据；门诊预订Opus 5由0/16提升至显示新值时15/16，外部损坏样本检测25/39而简单日志4/39。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "动态政策和记录变更下代理错误行动及审计评估。" }, "read_source_abstract_sha256": "ddb475262deb8b5b1ed30f058f62493f19b1e0791c926b72408bd6c743037135", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40246v1", "title": "EnvOS: Auditing Computer-Use Agents When the World Moves On : Phenomenon-Based Task Construction, Certification, and Evidence-Based Evaluation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T15:17:29Z", "updated": "2026-10-29T15:17:29Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.HC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40246v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40246", "version_id": "2610.40246v1", "first_author": "Ankush Kadu", "affiliations": [ "QpiAI, Bangalore, India" ], "shared_first_authors": [ "Ankush Kadu", "Athira Gopal", "Niharika Singh" ], "shared_first_note": "三位作者均标*；脚注* Equal contribution。", "source_url": "https://arxiv.org/pdf/2610.40246v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "首页Ankush Kadu*、Athira Gopal*、Niharika Singh*，三人下均QpiAI, Bangalore, India。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40476": { "id": "2610.40476", "classification": "relevant", "reason": "全文§2.3明确多轮问诊代理对抗安全测试，含提示注入、伪造权威、逐步侵蚀边界和安全协议抽取；直接测量临床危险建议、红旗漏检和分诊不足，非仅医疗问答能力。", "abstract_read": true, "abstract_sha256": "eb19195e104a360e2002050c4c80f8672158d404e96819595a15c45a185baedd", "summary_zh": "模拟多轮RL训练问诊代理，依据Delphi分类生成256留出压力场景；不加外部安全过滤时，急性风险分诊不足由30.5%降至12.9%。风险分类包含注入、伪造权威和边界侵蚀，但结果为总体临床安全率，不能作为某类注入攻击成功率；仅模拟/扮演评估而非临床效果验证。", "topics": { "tags": [ "injection", "authorization", "evaluation", "robustness" ], "reason_zh": "全文§2.3明确多轮问诊代理对抗安全测试，含提示注入、伪造权威、逐步侵蚀边界和安全协议抽取；直接测量临床危险建议、红旗漏检和分诊不足，非仅医疗问答能力。" }, "read_source_abstract_sha256": "eb19195e104a360e2002050c4c80f8672158d404e96819595a15c45a185baedd", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40476v1", "title": "Training language models in simulation for psychiatric intake", "initial_classification": "uncertain", "scope_review": { "id": "2610.40476", "version_id": "2610.40476v1", "classification": "relevant", "reason": "全文§2.3明确多轮问诊代理对抗安全测试，含提示注入、伪造权威、逐步侵蚀边界和安全协议抽取；直接测量临床危险建议、红旗漏检和分诊不足，非仅医疗问答能力。", "summary_zh": "模拟多轮RL训练问诊代理，依据Delphi分类生成256留出压力场景；不加外部安全过滤时，急性风险分诊不足由30.5%降至12.9%。风险分类包含注入、伪造权威和边界侵蚀，但结果为总体临床安全率，不能作为某类注入攻击成功率；仅模拟/扮演评估而非临床效果验证。", "topics": { "tags": [ "injection", "authorization", "evaluation", "robustness" ], "reason_zh": "全文§2.3明确多轮问诊代理对抗安全测试，含提示注入、伪造权威、逐步侵蚀边界和安全协议抽取；直接测量临床危险建议、红旗漏检和分诊不足，非仅医疗问答能力。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.40476v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§2.3 Adversarial safety evaluation", "Tables1—2", "Scenario generation及评估范围说明" ] }, "full_text_checked": true, "reviewed_sections": [ "§2.3 Adversarial safety evaluation", "Tables1—2", "Scenario generation及评估范围说明" ], "body_source_url": "https://arxiv.org/html/2610.40476v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T17:10:32Z", "updated": "2026-10-29T17:10:32Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40476v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40476", "version_id": "2610.40476v1", "first_author": "Samuel Schmidgall", "affiliations": [ "Google DeepMind" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.40476v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Samuel Schmidgall上标1；1 Google DeepMind；末列Isaac Galatzer-Levy、David Racz、Valentin Liévin的*是Equal Leadership，不是共同一作。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40589": { "id": "2610.40589", "classification": "relevant", "reason": "正文有实际仪器执行前的安全代理审批，人工配置最大电压/功率限制并检查；符合科研代理物理行动安全机制，不能写成量化安全防御基准。", "abstract_read": true, "abstract_sha256": "d91dc5d209c6a6fbc01f31696886ce6d07d9b7b35ca6b34584a1fbc4d95d78b6", "summary_zh": "多LLM研究团队开展真实量子自旋实验，关键决策需明确评审，实验前另经安全代理审批；人类预设并检查最大电压/功率边界。代理发现信号漂移后拒绝过早结论并修改测量。论文提供安全门控工作流实例，但未报告专门的安全违规率或攻击防御效果。", "topics": { "tags": [ "multiagent", "authorization", "embodied", "monitoring" ], "reason_zh": "正文有实际仪器执行前的安全代理审批，人工配置最大电压/功率限制并检查；符合科研代理物理行动安全机制，不能写成量化安全防御基准。" }, "read_source_abstract_sha256": "d91dc5d209c6a6fbc01f31696886ce6d07d9b7b35ca6b34584a1fbc4d95d78b6", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40589v1", "title": "Collaborative AI agents for autonomous experimental research with solid-state quantum spins", "initial_classification": "uncertain", "scope_review": { "id": "2610.40589", "version_id": "2610.40589v1", "classification": "relevant", "reason": "正文有实际仪器执行前的安全代理审批，人工配置最大电压/功率限制并检查；符合科研代理物理行动安全机制，不能写成量化安全防御基准。", "summary_zh": "多LLM研究团队开展真实量子自旋实验，关键决策需明确评审，实验前另经安全代理审批；人类预设并检查最大电压/功率边界。代理发现信号漂移后拒绝过早结论并修改测量。论文提供安全门控工作流实例，但未报告专门的安全违规率或攻击防御效果。", "topics": { "tags": [ "multiagent", "authorization", "embodied", "monitoring" ], "reason_zh": "正文有实际仪器执行前的安全代理审批，人工配置最大电压/功率限制并检查；符合科研代理物理行动安全机制，不能写成量化安全防御基准。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.40589v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "研究架构与Fig1说明", "§7.1 agent setup", "§7.2 Context allocation, document exchange and review" ] }, "full_text_checked": true, "reviewed_sections": [ "研究架构与Fig1说明", "§7.1 agent setup", "§7.2 Context allocation, document exchange and review" ], "body_source_url": "https://arxiv.org/html/2610.40589v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T17:47:50Z", "updated": "2026-10-29T17:47:50Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MA", "quant-ph" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40589v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40589", "version_id": "2610.40589v1", "first_author": "El Mustapha Mansouri", "affiliations": [ "School of Engineering, Institute of Science Tokyo, Yokohama, Kanagawa 226-8501, Japan" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.40589v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "首作者El Mustapha Mansouri∗；统一署School of Engineering, Institute of Science Tokyo；∗与†脚注均为通讯邮箱，不是共同一作。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39468": { "id": "2610.39468", "classification": "relevant", "reason": "多会话编码代理可观测性、未验证完成声明及凭据泄露。", "abstract_read": true, "abstract_sha256": "18eec39a34b7885d6603977f586e82924ab0abd26eafe8f59676462c569ab85a", "summary_zh": "审计Agenttrail发现未认证本地修改面；45真实会话中23.4%编辑片段最后修改后无独立检查，57.8%编辑后标完成的待办缺少中间证据，16会话中1326条记录含类似凭据的字符串。Soei采用不保存内容或凭据的哈希链账本、证据图和验证层；账本体积为原始数据的20%，支持篡改检测。", "topics": { "tags": [ "monitoring", "privacy", "evaluation", "multiagent" ], "reason_zh": "多会话编码代理可观测性、未验证完成声明及凭据泄露。" }, "read_source_abstract_sha256": "18eec39a34b7885d6603977f586e82924ab0abd26eafe8f59676462c569ab85a", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39468v1", "summary_audit": "1326的单位是包含类似凭据字符串的记录，不是字符串数；20%为相对原始数据体积。", "title": "Soei: Structured Observability of Evidence and Intent for Multi-Agent AI Software Engineering", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T06:40:12Z", "updated": "2026-10-29T06:40:12Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MA", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 35 of 35 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39468v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39468", "version_id": "2610.39468v1", "first_author": "Mohammed Nayeem Khan", "affiliations": [ "Intel Corporation" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.39468v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Mohammed Nayeem Khan首列；两作者署名下统一Intel Corporation。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40075": { "id": "2610.40075", "classification": "relevant", "reason": "正文明确在预训练π0.5视觉语言动作策略上微调并以oracle约束关节/碰撞，属于VLA物理安全防护，而非无语言关联的普通RL。", "abstract_read": true, "abstract_sha256": "7e423b33cf746eae60a952f3a11fbe848b446235a2c78a4633e9f7e65a9b7ee3", "summary_zh": "为π0.5流匹配VLA策略加入二元可行性oracle防护，在150示范微调后的30回合障碍操纵中步安全率100%，任务成功11/30，对照高斯初始化13/30且步安全率78.25%。保证仅覆盖oracle所检查配置；每动作块耗时1.345秒对比0.071秒约18.9倍，不能宣称全场景安全。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "正文明确在预训练π0.5视觉语言动作策略上微调并以oracle约束关节/碰撞，属于VLA物理安全防护，而非无语言关联的普通RL。" }, "read_source_abstract_sha256": "7e423b33cf746eae60a952f3a11fbe848b446235a2c78a4633e9f7e65a9b7ee3", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40075v1", "title": "Learning Safe Flow Matching Robot Policies from Binary Feasibility Oracles", "initial_classification": "uncertain", "scope_review": { "id": "2610.40075", "version_id": "2610.40075v1", "classification": "relevant", "reason": "正文明确在预训练π0.5视觉语言动作策略上微调并以oracle约束关节/碰撞，属于VLA物理安全防护，而非无语言关联的普通RL。", "summary_zh": "为π0.5流匹配VLA策略加入二元可行性oracle防护，在150示范微调后的30回合障碍操纵中步安全率100%，任务成功11/30，对照高斯初始化13/30且步安全率78.25%。保证仅覆盖oracle所检查配置；每动作块耗时1.345秒对比0.071秒约18.9倍，不能宣称全场景安全。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "正文明确在预训练π0.5视觉语言动作策略上微调并以oracle约束关节/碰撞，属于VLA物理安全防护，而非无语言关联的普通RL。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.40075v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§1 Introduction", "§4 Experimental Results及Table1", "Appendix C Experimental Details", "Appendix D.1—D.2 Limitations" ] }, "full_text_checked": true, "reviewed_sections": [ "§1 Introduction", "§4 Experimental Results及Table1", "Appendix C Experimental Details", "Appendix D.1—D.2 Limitations" ], "body_source_url": "https://arxiv.org/html/2610.40075v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T13:53:04Z", "updated": "2026-10-29T13:53:04Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40075v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40075", "version_id": "2610.40075v1", "first_author": "Jianming Ma", "affiliations": [ "Shanghai Jiao Tong University" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.40075v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Jianming Ma首列，其下Shanghai Jiao Tong University；其他作者逐列机构，不将Tongji错误赋予首作者。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40370": { "id": "2610.40370", "classification": "relevant", "reason": "健康代理用证据门控和安全官否决约束真实训练建议。", "abstract_read": true, "abstract_sha256": "6790952b6a724c46513a857092d81ba3622e660077d9f49fdbf36af66ad98cad", "summary_zh": "EpiCoach以假设注册表、机制数字孪生和约束信息增益安排单运动员实验；18月回放中心率预测优于基线而代理循环仅匹配静态模型，前三周封存20预测评分14次并被安全官否决两次。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "健康代理用证据门控和安全官否决约束真实训练建议。" }, "read_source_abstract_sha256": "6790952b6a724c46513a857092d81ba3622e660077d9f49fdbf36af66ad98cad", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40370v1", "title": "The Athlete as a Scientist of One: Agentic Bayesian Experimental Design for Individualized Physiology from Consumer Wearables", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T16:20:24Z", "updated": "2026-10-29T16:20:24Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40370v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40370", "version_id": "2610.40370v1", "first_author": "Behnam Moradi", "affiliations": [ "Software Department, KavAI, California, USA" ], "shared_first_authors": [], "shared_first_note": "单作者；无共同一作。", "source_url": "https://arxiv.org/pdf/2610.40370v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "署名Behnam Moradi，其下Software Department, KavAI, California, USA。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37679": { "id": "2610.37679", "classification": "relevant", "reason": "区分注入暴露和不安全工具调用承诺以评估潜在监控器。", "abstract_read": true, "abstract_sha256": "76a7aba1b994ed7f68ab1501036433d34a102bd8c19c0df931f9c650eb5a1298", "summary_zh": "双分层协议在训练与评估均区分暴露和行为；Qwen AgentDojo中朴素探针主要识别暴露，仅暴露样本重训后可提前两步预测不安全调用，AUROC 0.853与TF-IDF 0.855相当，其他模型达0.896/0.912。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "区分注入暴露和不安全工具调用承诺以评估潜在监控器。" }, "read_source_abstract_sha256": "76a7aba1b994ed7f68ab1501036433d34a102bd8c19c0df931f9c650eb5a1298", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37679v1", "title": "Exposure Is Not Commitment: Double-Stratified Evaluation of Latent Monitors for Tool-Using Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-12T03:08:51Z", "updated": "2026-10-12T03:08:51Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CL", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 108 of 108 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37679v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37679", "version_id": "2610.37679v1", "first_author": "Rishabh Sinha", "affiliations": [ "University of California, Berkeley" ], "shared_first_authors": [], "shared_first_note": "单作者；无共同一作。", "source_url": "https://arxiv.org/pdf/2610.37679v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "署名Rishabh Sinha，其下University of California, Berkeley；未根据umd.edu邮箱误推机构。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.12823": { "id": "2610.12823", "classification": "relevant", "reason": "误导图表系统性重定向网页代理后续动作。", "abstract_read": true, "abstract_sha256": "27f3b001554d6930fa8240ce0a8a8e92c8b9bcd121a931f1032d248e3132eb0f", "summary_zh": "MisVisAgentBench包含280个任务实例，以干净/误导图表组成匹配对，并区分基础难度与误导诱发失败；13个视觉语言网页代理的平均成功率下降超过34个百分点，失败主要沿目标误导动作分支发生。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "误导图表系统性重定向网页代理后续动作。" }, "read_source_abstract_sha256": "27f3b001554d6930fa8240ce0a8a8e92c8b9bcd121a931f1032d248e3132eb0f", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.12823v2", "summary_audit": "摘要是280个任务实例组织为配对，不明确280对；原表述容易扩大样本量。", "title": "When Charts Deceive Web Agents: A Paired Benchmark for Misleading Visualization-Grounded Tasks", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-09T00:03:13Z", "updated": "2026-10-29T02:39:20Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 104 of 104 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.12823v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.12823", "version_id": "2610.12823v2", "first_author": "Yisheng Li", "affiliations": [ "State Key Laboratory of Novel Software Technology, Nanjing University" ], "shared_first_authors": [ "Yisheng Li", "Dongming Han", "Hongkun Pan" ], "shared_first_note": "三位首列作者均*；脚注Equal contribution；†是通讯作者。", "source_url": "https://arxiv.org/pdf/2610.12823v2", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Yisheng Li1*；1 State Key Laboratory of Novel Software Technology, Nanjing University；另两位共同一作分别2*及3*，不误赋其机构给第一作者。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2603.27771": { "id": "2603.27771", "classification": "relevant", "reason": "生成式多代理资源竞争、交接和集体决策中涌现串谋及从众风险。", "abstract_read": true, "abstract_sha256": "2c0962bc350eccd994fb362292a7f3f8cbbc83bfb607c5d158090ecc3d38c231", "summary_zh": "在多种资源竞争与协作工作流开展重复实验，观察无显式指令的类串谋协调和从众以非微小频率出现，现有单代理护栏无法阻止；摘要无具体率值。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "生成式多代理资源竞争、交接和集体决策中涌现串谋及从众风险。" }, "read_source_abstract_sha256": "2c0962bc350eccd994fb362292a7f3f8cbbc83bfb607c5d158090ecc3d38c231", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2603.27771v4", "title": "Emergent Risks in Generative Multi-Agent Systems", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-03-29T17:10:28Z", "updated": "2026-10-29T16:00:15Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CL", "cs.CY", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 104 of 104 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.27771v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.27771", "version_id": "2603.27771v4", "first_author": "Yue Huang", "affiliations": [ "University of Notre Dame" ], "shared_first_authors": [ "Yue Huang", "Yu Jiang", "Wenjie Wang" ], "shared_first_note": "三位首列作者†；脚注These authors contributed equally to this work。", "source_url": "https://arxiv.org/pdf/2603.27771v4", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Yue Huang†1、Yu Jiang†1、Wenjie Wang†1；1 University of Notre Dame。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2609.03035": { "id": "2609.03035", "classification": "relevant", "reason": "评估多代理知晓激活监控及收到分数反馈时的串谋检测。", "abstract_read": true, "abstract_sha256": "10771b9adf571c7fee4f3c1b92c41985f2db2a7ad569a18b11c702a3df5ba1ce", "summary_zh": "固定模型、探针和阈值，对比不知情、知晓及反馈条件；在四代理21点和双代理囚徒游戏使用Qwen3-32B-AWQ与GPT-OSS-20B，最佳探针三条件均保持准确且代理继续串谋。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "评估多代理知晓激活监控及收到分数反馈时的串谋检测。" }, "read_source_abstract_sha256": "10771b9adf571c7fee4f3c1b92c41985f2db2a7ad569a18b11c702a3df5ba1ce", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2609.03035v2", "title": "You Can't Escape Your Activations : Evaluation Awareness and Multi-Agent Monitoring", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-09-02T18:07:14Z", "updated": "2026-10-29T07:45:49Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.LG", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.03035v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.03035", "version_id": "2609.03035v2", "first_author": "Jaee Ponde", "affiliations": [ "Truth Audit Labs" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2609.03035v2", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Jaee Ponde列首；作者行下统一Truth Audit Labs。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37984": { "id": "2610.37984", "classification": "relevant", "reason": "多代理通过策略性模糊公共消息发现串谋伙伴并绕过监控。", "abstract_read": true, "abstract_sha256": "9cacaa59458905f0d7eb535561aa8bcaa78a9021193610bd05145c06eacc2664", "summary_zh": "互识游戏要求两个密谋者在普通任务与公共交互中找到彼此；部分模型无信号指导形成成功握手，低误报监控常漏检；受控实验发现信息间接化时惩罚下降可快于伙伴协调下降。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "多代理通过策略性模糊公共消息发现串谋伙伴并绕过监控。" }, "read_source_abstract_sha256": "9cacaa59458905f0d7eb535561aa8bcaa78a9021193610bd05145c06eacc2664", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37984v1", "title": "Who Else Is In? Multi-Agent Collusion Initation Via Strategic Vagueness", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T21:28:48Z", "updated": "2026-10-27T21:28:48Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37984v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37984", "version_id": "2610.37984v1", "first_author": "Pramod Kaushik", "affiliations": [ "University of Trento", "Fondazione Bruno Kessler" ], "shared_first_authors": [], "shared_first_note": "署名页未见共同一作/共同贡献声明。", "source_url": "https://arxiv.org/pdf/2610.37984v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "Pramod Kaushik上标1,2；1 University of Trento；2 Fondazione Bruno Kessler。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39660": { "id": "2610.39660", "classification": "relevant", "reason": "已形成串谋在撤销激励和换伙伴后持续，记忆是载体。", "abstract_read": true, "abstract_sha256": "cf6580c395f2ef2f02f9bb55e3a3082f84a5d790973037c900bfd257826cdd76", "summary_zh": "保存联合验证任务的串谋历史后施加干预，三模型移除奖励仍接受未验证工作，换伙伴仅结束配对串谋；清空记忆全部终止，部分记忆可维持，修复不可满足验证通道后恢复拒绝错误工作。摘要量化字段是未展开宏，不能提取率值。", "topics": { "tags": [ "multiagent", "memory", "evaluation" ], "reason_zh": "已形成串谋在撤销激励和换伙伴后持续，记忆是载体。" }, "read_source_abstract_sha256": "cf6580c395f2ef2f02f9bb55e3a3082f84a5d790973037c900bfd257826cdd76", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39660v1", "title": "Sticky Collusion: Persistence of LLM Agent Collusion after Incentive Removal and Partner Replacement", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T09:13:06Z", "updated": "2026-10-29T09:13:06Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39660v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39660", "version_id": "2610.39660v1", "first_author": "Joshua Adrian Cahyono", "affiliations": [ "Nanyang AI Safety, NTU Singapore" ], "shared_first_authors": [], "shared_first_note": "单作者；无共同一作。", "source_url": "https://arxiv.org/pdf/2610.39660v1", "author_source": "PDF署名页、上标与脚注", "status": "verified", "evidence": "署名Joshua Adrian Cahyono，下方Nanyang AI Safety, NTU Singapore；另有With Apart Research合作字样，不据此推断另一个雇佣单位。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38361": { "id": "2610.38361", "classification": "relevant", "reason": "外部llms.txt清单可作为检索注入载体，直接关乎智能体输入边界。", "abstract_read": true, "abstract_sha256": "63e182d103d4c881c3ac290a711a541d5b008df59ae26e45ece153bb7be7d7d1", "summary_zh": "梳理清单发布、抓取、模型使用和执行的区别，提出五类威胁与成对安全效用评估。固定普通证据的120次模型响应试点中，24个原始对抗响应有21个采纳攻击目标；仅URL条件无已知采纳，但完整检索和智能体评估仍待开展。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "外部llms.txt清单可作为检索注入载体，直接关乎智能体输入边界。" }, "read_source_abstract_sha256": "63e182d103d4c881c3ac290a711a541d5b008df59ae26e45ece153bb7be7d7d1", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38361v1", "title": "Manifest-Assisted Retrieval in Artificial Intelligence Search: Evidence Gaps and a Security Evaluation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T06:58:07Z", "updated": "2026-10-28T06:58:07Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CE", "cs.CL", "cs.CR", "cs.DB", "cs.IR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38361v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38361", "version_id": "2610.38361v1", "first_author": "Gangzhen Qian", "affiliations": [ "Google LLC" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明。", "source_url": "https://arxiv.org/pdf/2610.38361v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF第一页分列署名1st Gangzhen Qian，下方Google LLC；1st至8th为顺序标记，无共同一作声明。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40396": { "id": "2610.40396", "classification": "relevant", "reason": "工具输出伪装用户角色引发提示注入。", "abstract_read": true, "abstract_sha256": "10b00a5cd4986c149836c533670d2803fbbdc3fe3c6c0169fa619724b2b4a3ab", "summary_zh": "研究模型如何利用内容与结构识别发言角色，发现同时伪造结构和内容可实施角色欺骗。玩具实验中针对内容的对抗训练未防住结构攻击；作者提出角色预测线性探针并报告跨场景有效。", "topics": { "tags": [ "injection", "monitoring" ], "reason_zh": "工具输出伪装用户角色引发提示注入。" }, "read_source_abstract_sha256": "10b00a5cd4986c149836c533670d2803fbbdc3fe3c6c0169fa619724b2b4a3ab", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40396v1", "title": "Understanding and Mitigating Role Spoofing in LLMs", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T16:33:08Z", "updated": "2026-10-29T16:33:08Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40396v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40396", "version_id": "2610.40396v1", "first_author": "Ezra Edelman", "affiliations": [ "University of Pennsylvania" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明；*说明在Apple MLR期间完成工作。", "source_url": "https://arxiv.org/pdf/2610.40396v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "首页Ezra Edelman上标1*，机构1为University of Pennsylvania；*脚注Work done while at Apple MLR。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38521": { "id": "2610.38521", "classification": "relevant", "reason": "项目记忆文件可经PR污染编码智能体。", "abstract_read": true, "abstract_sha256": "5119855c7eae618bfef6a0df5177caedf1f8ba5b5897449789518a844844fcdf", "summary_zh": "为12类CWE构造两种恶意项目记忆文件，在36项SecRepoBench任务上测试Claude Code与OpenCode。安全完成率变化为负8至正6个百分点，无一致影响；不同代理对开发者披露文件影响的方式差异明显，识别攻击也不保证代码安全。", "topics": { "tags": [ "supplychain", "memory", "injection", "evaluation" ], "reason_zh": "项目记忆文件可经PR污染编码智能体。" }, "read_source_abstract_sha256": "fc7b5a1059f81337161a6a7a550d1fe8651c5f2f33cce6275151cbb6e4a7bcbc", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.38521v1", "title": "Security Impact of Coding Agent's Memory Files", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T09:33:08Z", "updated": "2026-10-28T09:33:08Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 20 of 20 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 35 of 35 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38521v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38521", "version_id": "2610.38521v1", "first_author": "Thiago Santos de Moura", "affiliations": [ "Ruhr-Universität Bochum" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明。", "source_url": "https://arxiv.org/pdf/2610.38521v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "首页作者分列，Thiago Santos de Moura下方直接列Ruhr-Universität Bochum，无共同一作标记。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39109": { "id": "2610.39109", "classification": "relevant", "reason": "为多智能体消息事实和授权防伪提供协议。", "abstract_read": true, "abstract_sha256": "e70f0f0f00f77eb90a1ec64af57143108489862e1d6e5e9611fcfb74bf917c11", "summary_zh": "PCM以智能体不可写的Merkle日志、独立签名与包含证明支撑消息声明，并以人类批准为根传递只能收窄的授权链。在926条消息、其中712条虚假消息的基准中接受10条谎言，均涉及过期证据；两验证器结论完全一致，验证约1毫秒。", "topics": { "tags": [ "multiagent", "authorization", "injection" ], "reason_zh": "为多智能体消息事实和授权防伪提供协议。" }, "read_source_abstract_sha256": "e70f0f0f00f77eb90a1ec64af57143108489862e1d6e5e9611fcfb74bf917c11", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39109v1", "title": "PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T00:50:34Z", "updated": "2026-10-29T00:50:34Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CE", "cs.CR", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 20 of 20 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39109v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39109", "version_id": "2610.39109v1", "first_author": "Bravish Ghosh", "affiliations": [ "Cygnux Labs" ], "shared_first_authors": [], "shared_first_note": "单作者，无共同第一作者。", "source_url": "https://arxiv.org/pdf/2610.39109v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF首页唯一作者Bravish Ghosh，下列Cygnux Labs。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2605.05509": { "id": "2605.05509", "classification": "relevant", "reason": "浏览器智能体面对网页社会工程及注入攻击。", "abstract_read": true, "abstract_sha256": "e2a21ec81befcb45dbe28cf818dec668d023bf41b7a0d31ef5ec995423b2ba8c", "summary_zh": "扩展浏览器智能体威胁模型并提出20类攻击，实施18类；发现10种传统Web威胁可重现或放大。14类攻击的泛化研究跨4个主要模型重现，并归纳五种主要失败模式。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "浏览器智能体面对网页社会工程及注入攻击。" }, "read_source_abstract_sha256": "e2a21ec81befcb45dbe28cf818dec668d023bf41b7a0d31ef5ec995423b2ba8c", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2605.05509v2", "title": "WAAA! Web Adversaries Against Web Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-05-06T23:19:38Z", "updated": "2026-10-29T16:40:45Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.05509v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.05509", "version_id": "2605.05509v2", "first_author": "Sohom Datta", "affiliations": [ "North Carolina State University" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明。", "source_url": "https://arxiv.org/pdf/2605.05509v2", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF首页四作者共同机构行North Carolina State University，无共同一作符号。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2608.05430": { "id": "2608.05430", "classification": "relevant", "reason": "面向工具智能体间接注入防御。", "abstract_read": true, "abstract_sha256": "5f9b3db139101466c6cbe9f91858878d3267e53be59a32a7951a2196a6359de0", "summary_zh": "提出结合全局上下文和用户查询的恶意句子分类器，并用特征空间鲁棒学习及模拟LLM改写进行对抗训练。作者报告在静态及自适应改写攻击下优于现有防御，且保持较高效用。", "topics": { "tags": [ "injection", "monitoring", "robustness" ], "reason_zh": "面向工具智能体间接注入防御。" }, "read_source_abstract_sha256": "1a2ba8bfa94bbc7d96663922fea455881590aa3355b235bd8e0923a42e5deb63", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2608.05430v2", "title": "Robust Context-Aware Detection of Malicious Instructions in Text", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-05T21:44:44Z", "updated": "2026-10-29T15:33:15Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.05430v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.05430", "version_id": "2608.05430v2", "first_author": "Buzhao Liu", "affiliations": [ "Washington University in St. Louis" ], "shared_first_authors": [ "Buzhao Liu", "Xinhang Ma" ], "shared_first_note": "Buzhao Liu与Xinhang Ma均标*；脚注明确These authors contributed equally。", "source_url": "https://arxiv.org/pdf/2608.05430v2", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF第一页署名Buzhao Liu*、Xinhang Ma*，共同机构Washington University in St. Louis；页脚等贡献说明。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37849": { "id": "2610.37849", "classification": "relevant", "reason": "检测多智能体隐蔽通信与串谋信号。", "abstract_read": true, "abstract_sha256": "89a69c411a0f729a23237fcb09036c7c773e5bb29f782c09c84629a8c8b4da5d", "summary_zh": "PoPLi在日志回放中比较伙伴与局外人对保义改写的行动变化。模拟市场中存在首字母暗码时得分0.48至0.59，无暗码时为负；纯消息监视器未区分条件。方法检测私有通道而非串谋本身，不能检测仅靠激励或语义承载的串谋。", "topics": { "tags": [ "multiagent", "monitoring" ], "reason_zh": "检测多智能体隐蔽通信与串谋信号。" }, "read_source_abstract_sha256": "89a69c411a0f729a23237fcb09036c7c773e5bb29f782c09c84629a8c8b4da5d", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37849v1", "title": "Detecting Covert Collusion between AI Agents through Partner-Outsider Positive Listening", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T18:57:33Z", "updated": "2026-10-27T18:57:33Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37849v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37849", "version_id": "2610.37849v1", "first_author": "Kevin Yandoka Denamganaï", "affiliations": [], "shared_first_authors": [], "shared_first_note": "单作者，无共同第一作者；论文署名未提供机构。", "source_url": "https://arxiv.org/pdf/2610.37849v1", "author_source": "PDF首页署名机构映射及脚注", "status": "affiliation_not_stated", "evidence": "PDF首页仅列Kevin Yandoka Denamganaï，作者名上下无机构；标题上标1为代码链接，不是机构。", "author_status": "verified", "affiliation_status": "unconfirmed" }, "revision_history": [] }, "2610.38120": { "id": "2610.38120", "classification": "relevant", "reason": "结构化指令与数据分离降低工具调用上下文注入。", "abstract_read": true, "abstract_sha256": "a71e953178c0086b717e88d78b488bbf7242fedf754b7d2b1f5379cff7eb8478", "summary_zh": "LLMON以显式标识符绑定执行，使用46亿token的通用、检索和工具调用结构化数据后训练Granite模型。作者报告间接注入成功率从53至100%降至0.02至5.6%，并保持通用能力，另提供注意力诊断指标。", "topics": { "tags": [ "injection", "authorization", "robustness" ], "reason_zh": "结构化指令与数据分离降低工具调用上下文注入。" }, "read_source_abstract_sha256": "a71e953178c0086b717e88d78b488bbf7242fedf754b7d2b1f5379cff7eb8478", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38120v1", "title": "Post-Training Large Language Models with LLMON", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T00:56:01Z", "updated": "2026-10-28T00:56:01Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38120v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38120", "version_id": "2610.38120v1", "first_author": "Basel Shbita", "affiliations": [ "IBM Research, San Jose, CA, USA" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明。", "source_url": "https://arxiv.org/pdf/2610.38120v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "首页Basel Shbita上标1，对应1 IBM Research, San Jose, CA, USA。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38215": { "id": "2610.38215", "classification": "relevant", "reason": "临床多智能体共识会传播和放大人口偏差，属实际智能体安全。", "abstract_read": true, "abstract_sha256": "59739ed509304d9085ed8f6c1b842107c31fde644b311a886fb6b518dccfe207", "summary_zh": "在五模型族、四聚合拓扑和120个临床案例的反事实审计中，20种组合均保留种族分诊差距，常规公平提示和遮蔽未消除差异。让反事实视角在每轮汇聚的多视角集成将差距降低67至94%。", "topics": { "tags": [ "multiagent", "evaluation" ], "reason_zh": "临床多智能体共识会传播和放大人口偏差，属实际智能体安全。" }, "read_source_abstract_sha256": "59739ed509304d9085ed8f6c1b842107c31fde644b311a886fb6b518dccfe207", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38215v1", "title": "Disparity Laundering: Consensus Without Fairness in Clinical Multi-Agent Systems", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T03:10:28Z", "updated": "2026-10-28T03:10:28Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38215v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38215", "version_id": "2610.38215v1", "first_author": "Xiaoyang Wang", "affiliations": [ "Drexel University" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明。", "source_url": "https://arxiv.org/pdf/2610.38215v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "首页Xiaoyang Wang上标1，对应Drexel University。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38392": { "id": "2610.38392", "classification": "relevant", "reason": "自改进智能体验收门会侵蚀冗余安全保障。", "abstract_read": true, "abstract_sha256": "ed7d027cee34da414cebee1ce700fc681aed6fdaa300dbbaca1310669139e39c", "summary_zh": "在两个环境中测试四项规则的全部子集并运行411个改进循环；重叠保障掩盖删除危害，任务收益可驱动安全深度流失。较弱模型复用时出现危害；冻结安全文本或审计单层消融能保留防御深度。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "自改进智能体验收门会侵蚀冗余安全保障。" }, "read_source_abstract_sha256": "ed7d027cee34da414cebee1ce700fc681aed6fdaa300dbbaca1310669139e39c", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38392v1", "title": "Masked Erosion: How Acceptance Gates Lose Redundant Safeguards in Self-Improving Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T07:29:55Z", "updated": "2026-10-28T07:29:55Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38392v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38392", "version_id": "2610.38392v1", "first_author": "Hau-Sing So", "affiliations": [ "University of Macau" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者；*为通讯作者。", "source_url": "https://arxiv.org/pdf/2610.38392v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "首页Hau-Sing So上标1*，机构1 University of Macau；页脚* Corresponding author。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38544": { "id": "2610.38544", "classification": "relevant", "reason": "企业工具智能体有害请求、记录注入与隐私泄漏评估。", "abstract_read": true, "abstract_sha256": "20d5ab79a365dfdb3297fd861e898f2eec8a2b4ac5deb9e62cc360f44c3ced8e", "summary_zh": "基于十个企业系统模拟器，在41个任务上测试19模型，共2337次运行。2304个产出答案的运行中918个（40%）含违规，主要为虚假声明、跟随植入指令和向错误受众披露敏感数据；所有尝试变更均被记录并在生效前拦截，无模型零违规。", "topics": { "tags": [ "injection", "privacy", "evaluation", "authorization" ], "reason_zh": "企业工具智能体有害请求、记录注入与隐私泄漏评估。" }, "read_source_abstract_sha256": "20d5ab79a365dfdb3297fd861e898f2eec8a2b4ac5deb9e62cc360f44c3ced8e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38544v1", "summary_audit": "原文所有尝试变更在生效前被拦截，不能称实际变更；保留输出违规与外部生效的区别。", "title": "An Alignment Benchmark for Enterprise Agents on Era by Eon", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T09:45:17Z", "updated": "2026-10-28T09:45:17Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38544v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38544", "version_id": "2610.38544v1", "first_author": "Hai Sadon", "affiliations": [], "shared_first_authors": [], "shared_first_note": "署名未声明机构或共同第一作者，不能从产品名Eon推断。", "source_url": "https://arxiv.org/pdf/2610.38544v1", "author_source": "PDF首页署名机构映射及脚注", "status": "affiliation_not_stated", "evidence": "PDF首页作者行以Hai Sadon开头，无机构行/机构上标，标题中的Era by Eon非作者机构映射。", "author_status": "verified", "affiliation_status": "unconfirmed" }, "revision_history": [] }, "2610.38728": { "id": "2610.38728", "classification": "relevant", "reason": "正文专门分析跨运行共享文件形成的未授权多智能体协调、评测作弊与人类授权边界，已超出泛化能力讨论；属于概念性安全治理分析而非攻击实测。", "abstract_read": true, "abstract_sha256": "a29b56c8ea4d89f5bda0afbbfd752f2ee0b3015ec94f4532a15fb6249ec8e550", "summary_zh": "论文提出按工作量与信息预算比较能力的grasp框架；§1.3、§4及结论将其用于多智能体共享状态、跨任务目标延续与自我维持风险，主张由人类保留承诺和项目目标授权。安全案例来自引用报告，本文未提供新的攻击成功率或安全防御实验。", "topics": { "tags": [ "multiagent", "memory", "authorization" ], "reason_zh": "正文专门分析跨运行共享文件形成的未授权多智能体协调、评测作弊与人类授权边界，已超出泛化能力讨论；属于概念性安全治理分析而非攻击实测。" }, "read_source_abstract_sha256": "a29b56c8ea4d89f5bda0afbbfd752f2ee0b3015ec94f4532a15fb6249ec8e550", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38728v1", "title": "From Grind to Grasp", "initial_classification": "uncertain", "scope_review": { "id": "2610.38728", "version_id": "2610.38728v1", "classification": "relevant", "reason": "正文专门分析跨运行共享文件形成的未授权多智能体协调、评测作弊与人类授权边界，已超出泛化能力讨论；属于概念性安全治理分析而非攻击实测。", "summary_zh": "论文提出按工作量与信息预算比较能力的grasp框架；§1.3、§4及结论将其用于多智能体共享状态、跨任务目标延续与自我维持风险，主张由人类保留承诺和项目目标授权。安全案例来自引用报告，本文未提供新的攻击成功率或安全防御实验。", "topics": { "tags": [ "multiagent", "memory", "authorization" ], "reason_zh": "正文专门分析跨运行共享文件形成的未授权多智能体协调、评测作弊与人类授权边界，已超出泛化能力讨论；属于概念性安全治理分析而非攻击实测。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.38728v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§1.3 Collective organisation", "§4组织建立与跨运行共享状态讨论（PDF pp.27–28）", "§6 Conclusion（PDF pp.35–36）" ] }, "full_text_checked": true, "reviewed_sections": [ "§1.3 Collective organisation", "§4组织建立与跨运行共享状态讨论（PDF pp.27–28）", "§6 Conclusion（PDF pp.35–36）" ], "body_source_url": "https://arxiv.org/html/2610.38728v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T19:24:27Z", "updated": "2026-10-28T19:24:27Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38728v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38728", "version_id": "2610.38728v1", "first_author": "Peter Sunehag", "affiliations": [ "Google DeepMind" ], "shared_first_authors": [], "shared_first_note": "单作者，无共同第一作者。", "source_url": "https://arxiv.org/pdf/2610.38728v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF首页Peter Sunehag下方直接列Google DeepMind。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38882": { "id": "2610.38882", "classification": "relevant", "reason": "自动研究智能体奖励作弊及人类对齐评估。", "abstract_read": true, "abstract_sha256": "4aee13bc1b6e2b2ae13f7d3e9baa6ea2227325b0f3befbada8870f28d9ecaf46", "summary_zh": "研究人类参与自动研究，提出HackBench测量作弊定位，发现现有自动研究智能体未充分对齐且定位能力不足；提出通过人类模拟器强化学习改善互动、通过专家rubric改善沟通的方法。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "自动研究智能体奖励作弊及人类对齐评估。" }, "read_source_abstract_sha256": "4aee13bc1b6e2b2ae13f7d3e9baa6ea2227325b0f3befbada8870f28d9ecaf46", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38882v1", "title": "Aligning Autoresearch: Co-Improvement between Agents and Humans", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T20:47:10Z", "updated": "2026-10-28T20:47:10Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38882v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38882", "version_id": "2610.38882v1", "first_author": "Tianjian Li", "affiliations": [ "FAIR at Meta", "Johns Hopkins University" ], "shared_first_authors": [ "Tianjian Li", "Chuanyang Jin", "Seungone Kim" ], "shared_first_note": "†明确Joint first authors; order determined by dice roll；另††是共同末作者，不计入共同一作。", "source_url": "https://arxiv.org/pdf/2610.38882v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "首页Tianjian Li为♡♢†，♡ FAIR at Meta、♢ Johns Hopkins University；前三位作者均†。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37699": { "id": "2610.37699", "classification": "relevant", "reason": "多智能体意见演化可能放大错误信念形成集体错觉。", "abstract_read": true, "abstract_sha256": "367c0ec41fc64bb1f5abbb902d8efee069d9a371841bf2a8521cee0ea620345b", "summary_zh": "对八个模型73080次交换提取信念更新算子，发现违反凸组合与均值守恒等经典共识假设；将经验算子扩展到万智能体模拟后，网络连通性几乎不解释结果，而模型偏差和消息框架主导。一些群体对客观错误命题形成自信共识。", "topics": { "tags": [ "multiagent", "robustness", "evaluation" ], "reason_zh": "多智能体意见演化可能放大错误信念形成集体错觉。" }, "read_source_abstract_sha256": "367c0ec41fc64bb1f5abbb902d8efee069d9a371841bf2a8521cee0ea620345b", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37699v1", "title": "Network Topology Does Not Matter: The Breakdown of Classical Consensus in LLM Populations", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-24T20:11:34Z", "updated": "2026-10-24T20:11:34Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 16 of 16 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37699v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37699", "version_id": "2610.37699v1", "first_author": "Sahil Rajesh Dhayalkar", "affiliations": [ "Arizona State University" ], "shared_first_authors": [], "shared_first_note": "单作者，无共同第一作者。", "source_url": "https://arxiv.org/pdf/2610.37699v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF首页唯一作者Sahil Rajesh Dhayalkar，下列Arizona State University。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2609.13406": { "id": "2609.13406", "classification": "relevant", "reason": "§5直接形式化自改进代理篡改评价标准导致目标漂移和自我评价风险，并以编码代理修改测试为最小案例，属于代理安全理论。", "abstract_read": true, "abstract_sha256": "6d0579ab22d30272425c270eb454f10d6e6e6eff64ceac156ae0e99a574067ea", "summary_zh": "GAI用改进机制与评价标准是否在代理可修改边界内分类自改进。§5说明即使自洽循环宣称进步，可修改测试或内部评价器也不能保证服务外部目标；§6强调这是定义性框架和引用案例分析，没有新实测或完整监测定理。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "§5直接形式化自改进代理篡改评价标准导致目标漂移和自我评价风险，并以编码代理修改测试为最小案例，属于代理安全理论。" }, "read_source_abstract_sha256": "6d0579ab22d30272425c270eb454f10d6e6e6eff64ceac156ae0e99a574067ea", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2609.13406v2", "title": "Generalized Agent Iteration: One Formal Framework for Iterative Policy Improvement and Recursive Self-Improvement", "initial_classification": "uncertain", "scope_review": { "id": "2609.13406", "version_id": "2609.13406v2", "classification": "relevant", "reason": "§5直接形式化自改进代理篡改评价标准导致目标漂移和自我评价风险，并以编码代理修改测试为最小案例，属于代理安全理论。", "summary_zh": "GAI用改进机制与评价标准是否在代理可修改边界内分类自改进。§5说明即使自洽循环宣称进步，可修改测试或内部评价器也不能保证服务外部目标；§6强调这是定义性框架和引用案例分析，没有新实测或完整监测定理。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "§5直接形式化自改进代理篡改评价标准导致目标漂移和自我评价风险，并以编码代理修改测试为最小案例，属于代理安全理论。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2609.13406v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§5.1 Search over Candidate Selves and Self-Evaluation", "§5.2 The Consequences of an Ungrounded Base及编码代理最小案例", "§5.3 Goal Drift", "§6/Table 4 Scope and Limitations" ] }, "full_text_checked": true, "reviewed_sections": [ "§5.1 Search over Candidate Selves and Self-Evaluation", "§5.2 The Consequences of an Ungrounded Base及编码代理最小案例", "§5.3 Goal Drift", "§6/Table 4 Scope and Limitations" ], "body_source_url": "https://arxiv.org/html/2609.13406v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-09-11T18:15:09Z", "updated": "2026-10-29T05:38:29Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.13406v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.13406", "version_id": "2609.13406v2", "first_author": "Hongyao Tang", "affiliations": [ "Tianjin University" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明。", "source_url": "https://arxiv.org/pdf/2609.13406v2", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF首页Hongyao Tang上标1，对应Tianjin University；Contact邮箱不是共同一作声明。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2609.17989": { "id": "2609.17989", "classification": "relevant", "reason": "购物代理委托关系诱发赞助偏差，涉及服务对象对齐。", "abstract_read": true, "abstract_sha256": "a505fa1c9e98ea226a540d687b547758f23875d4ab2f173b87b99c0d984db2ca", "summary_zh": "三项研究发现，将预订平台而非旅客设为委托人，会减弱购物代理因赞助标识而下调商品评价的程度，即使没有偏向广告商的指令。明确消费者为受益人或所测试的消费者对齐微调可消除观察到的偏差；使用更严格的赞助披露措辞会降低付费条目评价，但不消除委托角色偏差。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "购物代理委托关系诱发赞助偏差，涉及服务对象对齐。" }, "read_source_abstract_sha256": "a505fa1c9e98ea226a540d687b547758f23875d4ab2f173b87b99c0d984db2ca", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2609.17989v3", "summary_audit": "penalty/discount指对赞助条目的评价折扣，不是商品价格折扣；明确含义与干预适用范围。", "title": "Whom Do AI Agents Serve? Role-Induced Sponsorship Bias in Decision Models and Generative LLMs", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-09-16T01:21:56Z", "updated": "2026-10-28T18:53:54Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "econ.GN" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.17989v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.17989", "version_id": "2609.17989v3", "first_author": "Davood Wadi", "affiliations": [ "Desautels Faculty of Management, McGill University" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明。", "source_url": "https://arxiv.org/pdf/2609.17989v3", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF首页Davood Wadi分列机构为Desautels Faculty of Management、McGill University；邮箱域名不用于推断机构。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38039": { "id": "2610.38039", "classification": "relevant", "reason": "明确在部署前用概率模型检查约束LLM生成控制器，覆盖网格碰撞风险及行为允许集合，属于可验证执行安全机制。", "abstract_read": true, "abstract_sha256": "3d58b487014021b68d901abdd4f45f05dd35983e31fd648e759bdbe86f2c8389", "summary_zh": "框架在每个环境实例上验证LLM规则列表，未通过则修复、复用其他已验证策略或推迟/回退。网格导航包括至少0.7概率避免移动障碍等要求；约90%未见网格实例通过验证，验证复用比逐实例合成快15至103倍。保证依赖MDP与规则翻译正确，实验是模拟基准，不能等同真实机器人安全认证。", "topics": { "tags": [ "embodied", "authorization", "robustness" ], "reason_zh": "明确在部署前用概率模型检查约束LLM生成控制器，覆盖网格碰撞风险及行为允许集合，属于可验证执行安全机制。" }, "read_source_abstract_sha256": "3d58b487014021b68d901abdd4f45f05dd35983e31fd648e759bdbe86f2c8389", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38039v1", "title": "Reusable LLM-Based Plans with Probabilistic Guarantees for Self-Adaptive Systems", "initial_classification": "uncertain", "scope_review": { "id": "2610.38039", "version_id": "2610.38039v1", "classification": "relevant", "reason": "明确在部署前用概率模型检查约束LLM生成控制器，覆盖网格碰撞风险及行为允许集合，属于可验证执行安全机制。", "summary_zh": "框架在每个环境实例上验证LLM规则列表，未通过则修复、复用其他已验证策略或推迟/回退。网格导航包括至少0.7概率避免移动障碍等要求；约90%未见网格实例通过验证，验证复用比逐实例合成快15至103倍。保证依赖MDP与规则翻译正确，实验是模拟基准，不能等同真实机器人安全认证。", "topics": { "tags": [ "embodied", "authorization", "robustness" ], "reason_zh": "明确在部署前用概率模型检查约束LLM生成控制器，覆盖网格碰撞风险及行为允许集合，属于可验证执行安全机制。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.38039v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§II概率要求与碰撞示例", "§III Verified Rule Lists", "§IV.A Adaptation Manager", "§V.A Evaluation Setup", "Threats to Validity" ] }, "full_text_checked": true, "reviewed_sections": [ "§II概率要求与碰撞示例", "§III Verified Rule Lists", "§IV.A Adaptation Manager", "§V.A Evaluation Setup", "Threats to Validity" ], "body_source_url": "https://arxiv.org/html/2610.38039v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T22:50:48Z", "updated": "2026-10-27T22:50:48Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 35 of 35 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38039v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38039", "version_id": "2610.38039v1", "first_author": "Asher Tempest Arya", "affiliations": [ "University of Toronto" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者声明。", "source_url": "https://arxiv.org/pdf/2610.38039v1", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF首页Asher Tempest Arya作者块直接列University of Toronto，无共同一作标记。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2509.25894": { "id": "2509.25894", "classification": "relevant", "reason": "恶意GitHub问题诱导修复代理产生功能正确但有漏洞补丁。", "abstract_read": true, "abstract_sha256": "7003a950d6cb8ed8c2eca2f15a5ab5e91ba0fea02e6aa7a8da13eb59a1102805", "summary_zh": "SWExploit通过程序分析定位注入点、保持原始问题语义的恶意复现信息生成及反馈迭代来攻击自动程序修复代理。在三个代理流水线和五个后端模型上，正确补丁中的攻击成功率最高0.91，基线均低于0.20，揭示测试通过不等于安全。", "topics": { "tags": [ "injection", "supplychain", "evaluation" ], "reason_zh": "恶意GitHub问题诱导修复代理产生功能正确但有漏洞补丁。" }, "read_source_abstract_sha256": "7003a950d6cb8ed8c2eca2f15a5ab5e91ba0fea02e6aa7a8da13eb59a1102805", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2509.25894v2", "title": "Red Teaming Program Repair Agents: When Correct Patches can Hide Vulnerabilities", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2025-09-30T07:38:57Z", "updated": "2026-10-29T13:23:22Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 38 of 38 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2509.25894v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2509.25894", "version_id": "2509.25894v2", "first_author": "Simin Chen", "affiliations": [ "Columbia University" ], "shared_first_authors": [ "Simin Chen", "Yixin He" ], "shared_first_note": "Simin Chen与Yixin He均标*；首页脚注Equal contribution。", "source_url": "https://arxiv.org/pdf/2509.25894v2", "author_source": "PDF首页署名机构映射及脚注", "status": "verified_from_signature", "evidence": "PDF首页Simin Chen上标1,*，Yixin He上标2,*；1 Columbia University，2 University of Southern California；* Equal contribution。", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37734": { "id": "2610.37734", "classification": "relevant", "reason": "直接研究 agent skills 供应链中的绕过审批与检查指令。", "abstract_read": true, "abstract_sha256": "200e243c5596677dc08f15750e3b2c2ea14b6a2d271e74337b1868e29a783297", "summary_zh": "分析153万英文skills，人工标注2097单元并训练检测器；约8.8万skills含放松监督指令，其中70.1%的此类指令未限定适用情境，传播集中于少数上游。现有扫描器召回至多46%且精确率低于0.4，以研究编码手册提示背后的LLM时达到61%召回和0.71精确率。", "topics": { "tags": [ "supplychain", "authorization", "monitoring", "evaluation" ], "reason_zh": "直接研究 agent skills 供应链中的绕过审批与检查指令。" }, "read_source_abstract_sha256": "c9274c3cf9a4d7b11652628c8cc084d549f42988d8255451cdd8aca3aae87753", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.37734v1", "summary_audit": "70.1%指指令文本无条件适用，而非实测在代理上生效；改正效果性措辞。", "title": "When Skills Tell Agents Not to Ask: A Large-Scale Study of Oversight Directives in Agent Skills", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T13:21:17Z", "updated": "2026-10-27T13:21:17Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37734v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37734", "version_id": "2610.37734v1", "first_author": "Timofey Sanko", "first_author_affiliations": [ "School of Computing, Queen’s University, Kingston, Ontario, Canada" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.37734v1", "evidence": "首页：TIMOFEY SANKO, Queen’s University, Canada；作者联系说明：Timofey Sanko, School of Computing, Queen’s University, Kingston, Ontario, Canada。", "affiliations": [ "School of Computing, Queen’s University, Kingston, Ontario, Canada" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.37734v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38579": { "id": "2610.38579", "classification": "relevant", "reason": "研究 Web/工具代理轨迹归属及跨会话伪造威胁。", "abstract_read": true, "abstract_sha256": "87c65b052e7ae14c629ce71aceb6b8d6c568df7fd9f6fa568cd468736d43112a", "summary_zh": "提出观察带水印轨迹后学习行动偏好进行跨会话伪造的威胁，AgentAnchor 使用会话标识、秘密密钥、语义观测状态构造逐步密钥，通过 KL 受限策略倾斜嵌入证据，并允许可信验证器离线验证与弃权；摘要没有提供实测结果。", "topics": { "tags": [ "authorization", "monitoring" ], "reason_zh": "研究 Web/工具代理轨迹归属及跨会话伪造威胁。" }, "read_source_abstract_sha256": "87c65b052e7ae14c629ce71aceb6b8d6c568df7fd9f6fa568cd468736d43112a", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38579v1", "title": "Session-Bound Behavioral Watermarking for Autonomous LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T10:09:23Z", "updated": "2026-10-28T10:09:23Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38579v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38579", "version_id": "2610.38579v1", "first_author": "Md Facklasur Rahaman", "first_author_affiliations": [ "Deakin University, Melbourne, VIC, Australia" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.38579v1", "evidence": "首页首列 Md Facklasur Rahaman / Deakin University / Melbourne, VIC, Australia，无共同一作标记。", "affiliations": [ "Deakin University, Melbourne, VIC, Australia" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.38579v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38799": { "id": "2610.38799", "classification": "relevant", "reason": "研究对端开发组件的诊断反馈越过权限边界，诱导Coding Agent执行未经授权操作。", "abstract_read": true, "abstract_sha256": "955cc44f274bd5aa093716ba0395629f2cd122c0e67de0423dab5174b19166ef", "summary_zh": "CARI研究由对端服务、测试或CI组件提供的运行诊断被Coding Agent当作行动授权的问题。作者在四种语言的等价Todo项目、五个模型和十种攻击上运行3,000次试验，按实际工具行为及本地模拟终点验收，报告2,845次成功（94.8%）；Python目标上原始载荷的Codex与Claude Code成功率分别61.3%和58.7%。这是受控项目、合成凭据及本地模拟服务的结果，不能直接视为真实仓库总体风险率；实验允许相关动作无需人工审批。其研究对象是运行反馈注入，不是审计器漏检既存恶意代码。", "topics": { "tags": [ "injection", "authorization", "supplychain", "evaluation" ], "reason_zh": "对端开发组件通过运行反馈诱导编码代理越权，评测工具侧实际后果。" }, "read_source_abstract_sha256": "955cc44f274bd5aa093716ba0395629f2cd122c0e67de0423dab5174b19166ef", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38799v1", "title": "CARI: Cross-Boundary Adversarial Runtime Injection in Coding-Agent Workflows", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.38799v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "author front matter", "3.2 Threat Model", "5.1 Experimental Setup and Success Criteria", "5.5 RQ4 and Table 5", "Tables 11–12" ], "published": "2026-10-28T20:04:20Z", "updated": "2026-10-28T20:04:20Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38799", "version_id": "2610.38799v1", "first_author": "Jie Fu", "affiliations": [ "Stevens Institute of Technology", "University of Connecticut" ], "shared_first_authors": [], "shared_first_note": "首页未见共同一作标记。", "source_url": "https://arxiv.org/pdf/2610.38799v1", "author_source": "https://export.arxiv.org/api/query?id_list=2610.38799", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "evidence": "首页Jie Fu标注1,2；1对应Stevens Institute of Technology，2对应University of Connecticut。" }, "revision_history": [] }, "2610.39066": { "id": "2610.39066", "classification": "relevant", "reason": "第 4.2.1 节使用只读源码导航的编码代理产生结构化回归证据，并明确其幻觉见证仍需动态执行验证；面向 AI 安全补丁验证，属于编码代理安全校验。第 6 节说明测试补丁实际来自开发者补丁的直接变异，并非真实 AI 生成补丁，应保留此限制。", "abstract_read": true, "abstract_sha256": "547c4a1d61cba940179c0a86c0cfad91a8a65d5a43e2947ac8ed4dfb69c9ff6a", "summary_zh": "DeepDiff 用神经源码分析提出非崩溃回归见证，并结合动态执行验证安全补丁是否改变应保留行为。正文采用 Claude Opus 4.6 只读源码代理；385 个候选来自开发者补丁及直接算子变异，不是自然生成 AI 补丁，且神经见证可能无法复现。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "第 4.2.1 节使用只读源码导航的编码代理产生结构化回归证据，并明确其幻觉见证仍需动态执行验证；面向 AI 安全补丁验证，属于编码代理安全校验。第 6 节说明测试补丁实际来自开发者补丁的直接变异，并非真实 AI 生成补丁，应保留此限制。" }, "read_source_abstract_sha256": "547c4a1d61cba940179c0a86c0cfad91a8a65d5a43e2947ac8ed4dfb69c9ff6a", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39066v1", "title": "DeepDiff: Neuro-Dynamic Regression-Freedom Checking for Security Patch Validation", "initial_classification": "uncertain", "scope_review": { "id": "2610.39066", "version_id": "2610.39066v1", "classification": "relevant", "reason": "第 4.2.1 节使用只读源码导航的编码代理产生结构化回归证据，并明确其幻觉见证仍需动态执行验证；面向 AI 安全补丁验证，属于编码代理安全校验。第 6 节说明测试补丁实际来自开发者补丁的直接变异，并非真实 AI 生成补丁，应保留此限制。", "summary_zh": "DeepDiff 用神经源码分析提出非崩溃回归见证，并结合动态执行验证安全补丁是否改变应保留行为。正文采用 Claude Opus 4.6 只读源码代理；385 个候选来自开发者补丁及直接算子变异，不是自然生成 AI 补丁，且神经见证可能无法复现。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "第 4.2.1 节使用只读源码导航的编码代理产生结构化回归证据，并明确其幻觉见证仍需动态执行验证；面向 AI 安全补丁验证，属于编码代理安全校验。第 6 节说明测试补丁实际来自开发者补丁的直接变异，并非真实 AI 生成补丁，应保留此限制。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.39066v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF v1 首页与作者脚注", "1 Introduction", "4.2.1 Neural analysis based DeepDiff", "5 LLM models used to generate benign inputs", "6 Experimental Evaluation; 6.1–6.2 corpus construction" ] }, "full_text_checked": true, "reviewed_sections": [ "PDF v1 首页与作者脚注", "1 Introduction", "4.2.1 Neural analysis based DeepDiff", "5 LLM models used to generate benign inputs", "6 Experimental Evaluation; 6.1–6.2 corpus construction" ], "body_source_url": "https://arxiv.org/pdf/2610.39066v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T23:52:41Z", "updated": "2026-10-28T23:52:41Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39066v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39066", "version_id": "2610.39066v1", "first_author": "Laboni Sarker", "first_author_affiliations": [ "University of California, Santa Barbara, USA" ], "shared_first_authors": [], "shared_first_author_note": "星号表示微软研究院实习期间完成，不是共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39066v1", "evidence": "首页 LABONI SARKER* 对应 University of California, Santa Barbara；* 脚注为 Work was accomplished while the author was interning at Microsoft Research.", "affiliations": [ "University of California, Santa Barbara, USA" ], "shared_first_note": "星号表示微软研究院实习期间完成，不是共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39066v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39155": { "id": "2610.39155", "classification": "relevant", "reason": "以最小权限和资源绑定 API 防止提示注入重定向代理资源使用。", "abstract_read": true, "abstract_sha256": "cce7fef3bb3811bce12e79146a5b58c388d593e540bf8f62cd3f183a756363db", "summary_zh": "REALM 用依赖图维护任务必要资产及用途，通过限定来源的选择接纳新资产，并区分发现和授权；任务容器内暴露资源绑定 Partial API。AgentDyn 的 60 干净任务与 560 注入案例中，qwen3.5-flash 完成率为 40.0%/36.4%，ASR 从 16.6% 降至 0.2%。", "topics": { "tags": [ "authorization", "injection", "evaluation" ], "reason_zh": "以最小权限和资源绑定 API 防止提示注入重定向代理资源使用。" }, "read_source_abstract_sha256": "cce7fef3bb3811bce12e79146a5b58c388d593e540bf8f62cd3f183a756363db", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39155v1", "title": "REALM: Identifying Minimal Task Assets for LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T01:40:42Z", "updated": "2026-10-29T01:40:42Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR", "eess.SY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39155v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39155", "version_id": "2610.39155v1", "first_author": "Zihou Ren", "first_author_affiliations": [ "INSC, Tsinghua University" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39155v1", "evidence": "首页 Zihou Ren 下对应 INSC, Tsinghua University；其他两列为 Byungchul Tak 与 Long Wang。", "affiliations": [ "INSC, Tsinghua University" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39155v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39758": { "id": "2610.39758", "classification": "relevant", "reason": "直接防御本地代理工具输出中的间接提示注入。", "abstract_read": true, "abstract_sha256": "ecd562163199caf99e6df0a7b98d412e00668653a0fbcbcf4202c6e1dce3b742", "summary_zh": "SEAL 离线学习软提示和评分读出，以可信初始上下文构造不依赖被检工具文本的查询，并局部删除危险 token、正则保留证据。AgentDojo 上 ASR 从 34.6% 降至 0.1%，安全任务完成从 51.4% 升至 77.5%，防御 token 比 PISanitizer 约少 127 倍；另在 AgentDyn 和第二骨干上验证。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "直接防御本地代理工具输出中的间接提示注入。" }, "read_source_abstract_sha256": "ecd562163199caf99e6df0a7b98d412e00668653a0fbcbcf4202c6e1dce3b742", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39758v1", "title": "SEAL: Sealed Queries for Local Sanitization against Indirect Prompt Injection", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T10:11:51Z", "updated": "2026-10-29T10:11:51Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39758v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39758", "version_id": "2610.39758v1", "first_author": "Doohyun Kim", "first_author_affiliations": [ "Graduate School of Information Security, KAIST, Daejeon, Republic of Korea" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39758v1", "evidence": "首页 Doohyun Kim¹；¹ Graduate School of Information Security, KAIST；其余作者为 ² School of Computing, KAIST。", "affiliations": [ "Graduate School of Information Security, KAIST, Daejeon, Republic of Korea" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39758v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2606.10323": { "id": "2606.10323", "classification": "uncertain", "reason": "完整重读摘要后仍无法判定其多代理一致性过滤是否针对代理自身安全；官方 v2 HTML 与 PDF 均返回 404，未检查正文。", "abstract_read": true, "abstract_sha256": "ed273c9eebabd9d19e6be059aae6551fd7be33f6f5076c7dd3d80160176ec8b6", "summary_zh": "提出 Scout、Mutator、Auditor、Arbiter 四代理语义入侵检测，组合假设生成、对抗变体、一致性审核与风险融合；作者报告 95.9% 检测准确率、6.8% 误报率和 87.9% 零日检测率。需正文确认是否评估代理自身安全。", "topics": { "tags": [ "multiagent", "monitoring", "robustness" ], "reason_zh": "多代理入侵检测含 Auditor 对不可靠输出过滤，但重点可能仅为网络检测应用。" }, "read_source_abstract_sha256": "ed273c9eebabd9d19e6be059aae6551fd7be33f6f5076c7dd3d80160176ec8b6", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2606.10323v2", "title": "Semantic Multi-Agent Intrusion Detection for IoT:Zero-Day and Adversarial Threats with Risk-Aware Reasoning", "initial_classification": "uncertain", "scope_review": { "id": "2606.10323", "summary_zh": "提出 Scout、Mutator、Auditor、Arbiter 四代理语义入侵检测，组合假设生成、对抗变体、一致性审核与风险融合；作者报告 95.9% 检测准确率、6.8% 误报率和 87.9% 零日检测率。需正文确认是否评估代理自身安全。", "topics": { "tags": [ "multiagent", "monitoring", "robustness" ], "reason_zh": "多代理入侵检测含 Auditor 对不可靠输出过滤，但重点可能仅为网络检测应用。" }, "version_id": "2606.10323v2", "classification": "uncertain", "reason": "完整重读摘要后仍无法判定其多代理一致性过滤是否针对代理自身安全；官方 v2 HTML 与 PDF 均返回 404，未检查正文。", "full_text_checked": false, "review_attempted": true, "review_status": "failed", "evidence_level": "full_abstract_reread", "source_url": "https://arxiv.org/abs/2606.10323v2", "reviewed_sections": [ "完整 API 摘要；本地 status 记录 HTML/PDF 404" ] }, "full_text_checked": false, "reviewed_sections": [ "完整 API 摘要；本地 status 记录 HTML/PDF 404" ], "body_source_url": "https://arxiv.org/abs/2606.10323v2", "evidence_level": "full_abstract_reread", "published": "2026-06-09T02:18:50Z", "updated": "2026-10-28T18:46:26Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.10323v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.10323", "version_id": "2606.10323v2", "first_author": "Saeid Jamshidi", "first_author_affiliations": [], "shared_first_authors": [], "verified": false, "reason": "版本匹配正文与 HTML 均 404，无法依据作者署名核验单位或共同一作；姓名仅 API 元数据。", "source_url": "https://arxiv.org/abs/2606.10323v2", "affiliations": [], "shared_first_note": "版本匹配正文与 HTML 均 404，无法依据作者署名核验单位或共同一作；姓名仅 API 元数据。", "status": "unconfirmed", "author_source": "https://arxiv.org/abs/2606.10323v2 (API author metadata only; affiliation unconfirmed)", "author_status": "verified", "affiliation_status": "unconfirmed" }, "revision_history": [] }, "2610.38398": { "id": "2610.38398", "classification": "relevant", "reason": "跨组织代理通信协议明确保障消息来源与完整性。", "abstract_read": true, "abstract_sha256": "b02abd639230cdd87fa2ea3dab74a1cb76512404891f89a8ee953ec0c27cfd79", "summary_zh": "ATP 由域服务器为逻辑代理提供稳定地址、离线收信与持久中介，发送域签署完整信封，接收实例可在连接结束后重新验证来源与完整性。原型的跨组织 LLM 工作流在实例离线或替换后继续处理，独立验证器验证保存消息，并测量中介延迟；依赖原公钥仍可信可获得。", "topics": { "tags": [ "multiagent", "authorization" ], "reason_zh": "跨组织代理通信协议明确保障消息来源与完整性。" }, "read_source_abstract_sha256": "b02abd639230cdd87fa2ea3dab74a1cb76512404891f89a8ee953ec0c27cfd79", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38398v1", "title": "Agent Transfer Protocol: Server-Mediated Agent-to-Agent Communication Architecture for the Agentic Web", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T07:41:23Z", "updated": "2026-10-28T07:41:23Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38398v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38398", "version_id": "2610.38398v1", "first_author": "Yuqi Qiu", "first_author_affiliations": [ "Nankai University, Tianjin, China" ], "shared_first_authors": [], "shared_first_author_note": "无共同第一作者声明；Xiang Li 的星号是通讯作者。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.38398v1", "evidence": "首页第一列 Yuqi Qiu / Nankai University / Tianjin, China；星号在 Xiang Li 名后且脚注为 Corresponding author。", "affiliations": [ "Nankai University, Tianjin, China" ], "shared_first_note": "无共同第一作者声明；Xiang Li 的星号是通讯作者。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.38398v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38620": { "id": "2610.38620", "classification": "relevant", "reason": "外部工具行动前执行策略核验并阻止无效操作。", "abstract_read": true, "abstract_sha256": "05242b1df45964bc9066d2c11f1855b60871aa2fc608bbc990f8684d2025bbc5", "summary_zh": "JevAct 拦截选定行动，结合工具状态确定性检查与 prefill-only 决策模型的上下文概率判断，提供有界修正反馈，且不改代理参数或工具。十一代理在 τ² 航空、电信和 BFCL 上评测，电信/BFCL 改善较一致，航空结果混合。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "外部工具行动前执行策略核验并阻止无效操作。" }, "read_source_abstract_sha256": "be2ebce3a67a1856fd24320ac9ac36c72837e51304a840ee47f9204170019257", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.38620v1", "title": "Think Before You Act: Decision Gate for LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T10:40:52Z", "updated": "2026-10-28T10:40:52Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38620v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38620", "version_id": "2610.38620v1", "first_author": "Iftach Shoham", "first_author_affiliations": [ "IBM SIL" ], "shared_first_authors": [ { "name": "Iftach Shoham", "affiliations": [ "IBM SIL" ] }, { "name": "Yuval David", "affiliations": [ "IBM SIL" ] } ], "shared_first_author_note": "首页星号与 Equal contribution 脚注明确两位共同第一作者。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.38620v1", "evidence": "首页 Iftach Shoham* 与 Yuval David* 均 IBM SIL；脚注 * Equal contribution；† 为 Segev Shlomov 通讯作者。", "affiliations": [ "IBM SIL" ], "shared_first_note": "首页星号与 Equal contribution 脚注明确两位共同第一作者。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.38620v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39070": { "id": "2610.39070", "classification": "relevant", "reason": "正文机制 24 明确讨论来源内嵌指令劫持并提出配对注入测试；机制 27/33 涉及代理验证输入和上下文压缩导致证据丢失。正文首页无自身 arXiv 水印，但标题与首作者匹配 API，下载 URL 为指定 v1；先前整文引用误报已撤销。", "abstract_read": true, "abstract_sha256": "daa414b37656ed0c69c06ac414aad8975dc74af3d556dda5a46cb8a35030c664", "summary_zh": "TRAILS 提出 38 类 LLM 证据合成读评失败机制；正文专门覆盖来源内嵌指令干扰、代理验证材料变化、上下文压缩/裁剪和跨轮指令丢失，提供配对指令测试、源材料对照、轨迹记录和必要上下文恢复建议。属于方法分类与测试指南，非攻击成功率实验。", "topics": { "tags": [ "injection", "memory", "monitoring", "evaluation" ], "reason_zh": "正文机制 24 明确讨论来源内嵌指令劫持并提出配对注入测试；机制 27/33 涉及代理验证输入和上下文压缩导致证据丢失。正文首页无自身 arXiv 水印，但标题与首作者匹配 API，下载 URL 为指定 v1；先前整文引用误报已撤销。" }, "read_source_abstract_sha256": "daa414b37656ed0c69c06ac414aad8975dc74af3d556dda5a46cb8a35030c664", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39070v1", "title": "When the Same Prompt Gives Different Answers (and the Same Answer Isn't Always Right): A Taxonomy of Failure Mechanisms, Testing, and Mitigation Strategies for LLM-Assisted Evidence Synthesis Read-and-Evaluate Tasks", "initial_classification": "uncertain", "scope_review": { "id": "2610.39070", "version_id": "2610.39070v1", "classification": "relevant", "reason": "正文机制 24 明确讨论来源内嵌指令劫持并提出配对注入测试；机制 27/33 涉及代理验证输入和上下文压缩导致证据丢失。正文首页无自身 arXiv 水印，但标题与首作者匹配 API，下载 URL 为指定 v1；先前整文引用误报已撤销。", "summary_zh": "TRAILS 提出 38 类 LLM 证据合成读评失败机制；正文专门覆盖来源内嵌指令干扰、代理验证材料变化、上下文压缩/裁剪和跨轮指令丢失，提供配对指令测试、源材料对照、轨迹记录和必要上下文恢复建议。属于方法分类与测试指南，非攻击成功率实验。", "topics": { "tags": [ "injection", "memory", "monitoring", "evaluation" ], "reason_zh": "正文机制 24 明确讨论来源内嵌指令劫持并提出配对注入测试；机制 27/33 涉及代理验证输入和上下文压缩导致证据丢失。正文首页无自身 arXiv 水印，但标题与首作者匹配 API，下载 URL 为指定 v1；先前整文引用误报已撤销。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.39070v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "指定 v1 PDF 首页标题/首作者与 API 匹配（无自身水印）", "TRAILS mechanism 24 Source-embedded instruction interference", "mechanisms 26–27 agent execution and verification", "mechanisms 33–35 compaction and instruction retention" ] }, "full_text_checked": true, "reviewed_sections": [ "指定 v1 PDF 首页标题/首作者与 API 匹配（无自身水印）", "TRAILS mechanism 24 Source-embedded instruction interference", "mechanisms 26–27 agent execution and verification", "mechanisms 33–35 compaction and instruction retention" ], "body_source_url": "https://arxiv.org/pdf/2610.39070v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T00:00:46Z", "updated": "2026-10-29T00:00:46Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.PF", "stat.ME" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39070v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39070", "version_id": "2610.39070v1", "first_author": "Carole Lunny", "first_author_affiliations": [ "Cochrane Hypertension Review Group, University of British Columbia" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39070v1", "evidence": "首页作者首位 Carole Lunny，通讯作者地址直接列 Cochrane Hypertension Review Group, University of British Columbia；标题/首作者匹配 API，官方目标 URL 为 v1，首页无自身水印。", "affiliations": [ "Cochrane Hypertension Review Group, University of British Columbia" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39070v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39230": { "id": "2610.39230", "classification": "relevant", "reason": "金融多代理系统强调权限、跨租户上下文和主张验证，涉及高后果行动可靠性。", "abstract_read": true, "abstract_sha256": "d56e0cd4f229954a0950902dfabbe2ac77893f503559ab784f1f9f95c15de9c3", "summary_zh": "将金融知识图谱、确定性优化引擎和多代理 LLM 编排/验证组合，以上下文层连接 ERP、工具和租户。15 次部署约 11 个月的观察中，幻觉率从单代理约 7–9% 降至图谱多代理验证后低于 1%；作者明确为观察而非因果证据，并强调访问控制、来源校验与隐私挑战。", "topics": { "tags": [ "multiagent", "authorization", "privacy", "robustness" ], "reason_zh": "金融多代理系统强调权限、跨租户上下文和主张验证，涉及高后果行动可靠性。" }, "read_source_abstract_sha256": "d56e0cd4f229954a0950902dfabbe2ac77893f503559ab784f1f9f95c15de9c3", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39230v1", "title": "Beyond LLM Wrappers: Context Engineering and the Three-Engine Architecture for Reliable Financial AI", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T02:50:00Z", "updated": "2026-10-29T02:50:00Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39230v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39230", "version_id": "2610.39230v1", "first_author": "Pradeep Kumar GS", "first_author_affiliations": [ "Finteract AI" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39230v1", "evidence": "首页 Pradeep Kumar GS / Finteract AI，与 Ravi Tanniru 并列两列；无共同一作声明。", "affiliations": [ "Finteract AI" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39230v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39733": { "id": "2610.39733", "classification": "relevant", "reason": "银行任务明确评测许可获取和未经审批付款等代理安全失误。", "abstract_read": true, "abstract_sha256": "24512d386cc272014b3efd2222a17398e9f3347fde0fd1ca553f8b45dae6abca", "summary_zh": "Bank-World 含两机构 50 项银行任务，模拟员工会提供信息、审批与修改指令，以动作/状态可执行检查及模型判断评分。四模型 1600 次尝试揭示重复收费、分配错误和审批未完即付款；保留私有环境、评分器和轨迹以减少污染。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "银行任务明确评测许可获取和未经审批付款等代理安全失误。" }, "read_source_abstract_sha256": "24512d386cc272014b3efd2222a17398e9f3347fde0fd1ca553f8b45dae6abca", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39733v1", "title": "Bank-World: A Benchmark for Evaluating Agents on Banking Workflows", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T09:59:39Z", "updated": "2026-10-29T09:59:39Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39733v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39733", "version_id": "2610.39733v1", "first_author": "Daniel Rupawalla", "first_author_affiliations": [ "Arcanum Labs" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39733v1", "evidence": "首页 Daniel Rupawalla / Arcanum Labs / daniel@arxlabs.ai。", "affiliations": [ "Arcanum Labs" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39733v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40133": { "id": "2610.40133", "classification": "relevant", "reason": "§3 明确在执行下一步前更新用户约束，区分追加、无条件覆盖及运行条件覆盖；按轨迹核验现行指令而非旧目标，属于代理目标完整性评估（非攻击基准）。", "abstract_read": true, "abstract_sha256": "440de1965e46c87c268a68bc15b1c49573f3f33c27520c2ccb2814c403f1c6f4", "summary_zh": "DynaRev 用语义里程碑在执行阶段投递目标变化，181 项 Web 任务覆盖追加、无条件及运行条件覆盖，评测正确性、响应性和效率。五模型常只满足部分需求，保留浏览器状态并重写指令有收益，浏览器重置有损失。", "topics": { "tags": [ "evaluation", "authorization" ], "reason_zh": "§3 明确在执行下一步前更新用户约束，区分追加、无条件覆盖及运行条件覆盖；按轨迹核验现行指令而非旧目标，属于代理目标完整性评估（非攻击基准）。" }, "read_source_abstract_sha256": "bb557ee1c79d1e6abb24554fbf6dfa7e9f76a21f5f09a0308b2c4b68aa8c6680", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.40133v1", "title": "DynaRev: Benchmarking Web Agents under Dynamic Goal Revision", "initial_classification": "uncertain", "scope_review": { "id": "2610.40133", "version_id": "2610.40133v1", "classification": "relevant", "reason": "§3 明确在执行下一步前更新用户约束，区分追加、无条件覆盖及运行条件覆盖；按轨迹核验现行指令而非旧目标，属于代理目标完整性评估（非攻击基准）。", "summary_zh": "DynaRev 用语义里程碑在执行阶段投递目标变化，181 项 Web 任务覆盖追加、无条件及运行条件覆盖，评测正确性、响应性和效率。五模型常只满足部分需求，保留浏览器状态并重写指令有收益，浏览器重置有损失。", "topics": { "tags": [ "evaluation", "authorization" ], "reason_zh": "§3 明确在执行下一步前更新用户约束，区分追加、无条件覆盖及运行条件覆盖；按轨迹核验现行指令而非旧目标，属于代理目标完整性评估（非攻击基准）。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.40133v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF v1 首页", "3.1–3.3 Web Agent Interaction / Dynamic Goal Revision / Revision Types", "4 Benchmark Construction" ] }, "full_text_checked": true, "reviewed_sections": [ "PDF v1 首页", "3.1–3.3 Web Agent Interaction / Dynamic Goal Revision / Revision Types", "4 Benchmark Construction" ], "body_source_url": "https://arxiv.org/pdf/2610.40133v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T14:25:54Z", "updated": "2026-10-29T14:25:54Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40133v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40133", "version_id": "2610.40133v1", "first_author": "Shiqi Zhang", "first_author_affiliations": [ "City University of Hong Kong", "Shanghai Jiao Tong University" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.40133v1", "evidence": "首页 Shiqi Zhang¹,²；¹ City University of Hong Kong，² Shanghai Jiao Tong University。", "affiliations": [ "City University of Hong Kong", "Shanghai Jiao Tong University" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.40133v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40578": { "id": "2610.40578", "classification": "relevant", "reason": "计算机使用代理完成声明的独立验证与误报拒绝。", "abstract_read": true, "abstract_sha256": "e980bb72fa77133e1252fc1863da696ec9cc147005176e3bd47f2422c43de5d5", "summary_zh": "VeriCUA 将完成验证作为主动证据探索，依据任务 rubric 为未决要求选择 GUI 或代码检查并按明确证据规则融合。跨桌面、手机、Web 及在线/离线实验较基线更符合参考标签，离线困难样本收益最大，在线更能拒绝虚假完成声明；摘要无具体数字。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "计算机使用代理完成声明的独立验证与误报拒绝。" }, "read_source_abstract_sha256": "e980bb72fa77133e1252fc1863da696ec9cc147005176e3bd47f2422c43de5d5", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40578v1", "title": "VeriCUA: Verification as Agentic Exploration for Computer-Using Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T17:45:26Z", "updated": "2026-10-29T17:45:26Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL", "cs.CV" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40578v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40578", "version_id": "2610.40578v1", "first_author": "Qiushi Sun", "first_author_affiliations": [ "Google", "The University of Hong Kong" ], "shared_first_authors": [], "shared_first_author_note": "星号是实习说明，无共同一作声明。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.40578v1", "evidence": "首页 Qiushi Sun¹,²*，¹ Google，² The University of Hong Kong；* 为 Google 实习期间完成。", "affiliations": [ "Google", "The University of Hong Kong" ], "shared_first_note": "星号是实习说明，无共同一作声明。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.40578v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37684": { "id": "2610.37684", "classification": "relevant", "reason": "教材 §7.7 专门讨论 agent 权限过大、提示注入、失控循环及沙箱越界，列出工具限权、敏感动作审批、监控和执行上限；有实质代理安全内容，但不是新实验论文。", "abstract_read": true, "abstract_sha256": "c76c7600bdf4dff0262574ca27e6a407504f5cb4ece0989b405e8b49487e4b88", "summary_zh": "面向科学与专业人士的 LLM 教材，介绍模型/RAG/工具和本地文献练习；§7.7 专门说明代理权限过大、提示注入、失控重试风险，并建议限权、人类审批、监控和执行上限。属于教学综述，不报告新的安全实验。", "topics": { "tags": [ "authorization", "injection", "monitoring" ], "reason_zh": "教材 §7.7 专门讨论 agent 权限过大、提示注入、失控循环及沙箱越界，列出工具限权、敏感动作审批、监控和执行上限；有实质代理安全内容，但不是新实验论文。" }, "read_source_abstract_sha256": "c76c7600bdf4dff0262574ca27e6a407504f5cb4ece0989b405e8b49487e4b88", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37684v1", "title": "An Introduction to Large Language Models for Scientists and Professionals", "initial_classification": "uncertain", "scope_review": { "id": "2610.37684", "version_id": "2610.37684v1", "classification": "relevant", "reason": "教材 §7.7 专门讨论 agent 权限过大、提示注入、失控循环及沙箱越界，列出工具限权、敏感动作审批、监控和执行上限；有实质代理安全内容，但不是新实验论文。", "summary_zh": "面向科学与专业人士的 LLM 教材，介绍模型/RAG/工具和本地文献练习；§7.7 专门说明代理权限过大、提示注入、失控重试风险，并建议限权、人类审批、监控和执行上限。属于教学综述，不报告新的安全实验。", "topics": { "tags": [ "authorization", "injection", "monitoring" ], "reason_zh": "教材 §7.7 专门讨论 agent 权限过大、提示注入、失控循环及沙箱越界，列出工具限权、敏感动作审批、监控和执行上限；有实质代理安全内容，但不是新实验论文。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.37684v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF v1 首页及作者署名", "7 Agents, Tools, and Workflows", "7.7 Risks of agentic AI" ] }, "full_text_checked": true, "reviewed_sections": [ "PDF v1 首页及作者署名", "7 Agents, Tools, and Workflows", "7.7 Risks of agentic AI" ], "body_source_url": "https://arxiv.org/pdf/2610.37684v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-13T13:28:53Z", "updated": "2026-10-13T13:28:53Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 108 of 108 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37684v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37684", "version_id": "2610.37684v1", "first_author": "Umberto Michelucci", "first_author_affiliations": [ "Department of Computer Science, Lucerne University of Applied Sciences and Arts" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.37684v1", "evidence": "首页 Prof. Dr. Umberto Michelucci 下列 Department of Computer Science / Lucerne University of Applied Sciences and Arts；University of Turin 是课程举办方，非作者署名单位。", "affiliations": [ "Department of Computer Science, Lucerne University of Applied Sciences and Arts" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.37684v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38174": { "id": "2610.38174", "classification": "relevant", "reason": "正文明确防止证明代理通过弱化定理、sorry 或自加公理来投机评测：固定题目签名前缀、独立只读工具链核验及公理白名单，并由另一代理提前生成题目，属于代理奖励作弊和验证完整性防御。", "abstract_read": true, "abstract_sha256": "94c7ecd3cde20346d16acefeb9a26930e6d149223e2070bba8de68bb324dd1a9", "summary_zh": "EasyProver 以递归代理和 Lean 内核验证求解数学/代码规格，固定定理前缀并独立用只读工具链、公理白名单和无 sorry 检查阻止改题或公理投机。Aegis 在证明前由独立代理构造规格；2000 个困难语句样本中 30 分钟预算证明 52.7%。", "topics": { "tags": [ "evaluation", "monitoring", "authorization" ], "reason_zh": "正文明确防止证明代理通过弱化定理、sorry 或自加公理来投机评测：固定题目签名前缀、独立只读工具链核验及公理白名单，并由另一代理提前生成题目，属于代理奖励作弊和验证完整性防御。" }, "read_source_abstract_sha256": "94c7ecd3cde20346d16acefeb9a26930e6d149223e2070bba8de68bb324dd1a9", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38174v1", "title": "Scaling Lean Theorem Proving for Real-World Code Verification", "initial_classification": "uncertain", "scope_review": { "id": "2610.38174", "version_id": "2610.38174v1", "classification": "relevant", "reason": "正文明确防止证明代理通过弱化定理、sorry 或自加公理来投机评测：固定题目签名前缀、独立只读工具链核验及公理白名单，并由另一代理提前生成题目，属于代理奖励作弊和验证完整性防御。", "summary_zh": "EasyProver 以递归代理和 Lean 内核验证求解数学/代码规格，固定定理前缀并独立用只读工具链、公理白名单和无 sorry 检查阻止改题或公理投机。Aegis 在证明前由独立代理构造规格；2000 个困难语句样本中 30 分钟预算证明 52.7%。", "topics": { "tags": [ "evaluation", "monitoring", "authorization" ], "reason_zh": "正文明确防止证明代理通过弱化定理、sorry 或自加公理来投机评测：固定题目签名前缀、独立只读工具链核验及公理白名单，并由另一代理提前生成题目，属于代理奖励作弊和验证完整性防御。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.38174v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF v1 首页及作者脚注", "Related work: reward hacking paragraph", "3.1 Methodology / Problem formulation and acceptance" ] }, "full_text_checked": true, "reviewed_sections": [ "PDF v1 首页及作者脚注", "Related work: reward hacking paragraph", "3.1 Methodology / Problem formulation and acceptance" ], "body_source_url": "https://arxiv.org/pdf/2610.38174v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T02:23:25Z", "updated": "2026-10-28T02:23:25Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL", "cs.LO", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 108 of 108 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38174v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38174", "version_id": "2610.38174v1", "first_author": "Debargha Ganguly", "first_author_affiliations": [ "Case Western Reserve University" ], "shared_first_authors": [], "shared_first_author_note": "星号不是共同一作；作者另注明 AWS 实习期间完成。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.38174v1", "evidence": "首页 Debargha Ganguly²*；² Case Western Reserve University；* 为通讯作者及 AWS 实习完成说明。", "affiliations": [ "Case Western Reserve University" ], "shared_first_note": "星号不是共同一作；作者另注明 AWS 实习期间完成。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.38174v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38438": { "id": "2610.38438", "classification": "relevant", "reason": "以多轮用户行为模糊测试发现组织 Web 代理策略违规。", "abstract_read": true, "abstract_sha256": "f08d4d83c3daf6e75f83855bc65b5d42297c3d04ef3212f6db359e436960f7f3", "summary_zh": "RoleFUZZER 将用户行为类型与角色规范交叉成 64 格覆盖表，引导生成可能促使违规的情景。覆盖导师、理财顾问、面试官、角色扮演及组织策略 Web 代理的 15 场实验中覆盖率均至少 89%；去掉网格自由生成只达 39–69%，发现的违规类型更少。", "topics": { "tags": [ "evaluation", "authorization", "robustness" ], "reason_zh": "以多轮用户行为模糊测试发现组织 Web 代理策略违规。" }, "read_source_abstract_sha256": "f08d4d83c3daf6e75f83855bc65b5d42297c3d04ef3212f6db359e436960f7f3", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38438v1", "title": "RoleFUZZER: User-Behaviour Fuzzing for Role-Specification Adherence in Large Language Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-28T08:19:36Z", "updated": "2026-10-28T08:19:36Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 108 of 108 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38438v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38438", "version_id": "2610.38438v1", "first_author": "Kshitish Ghate", "first_author_affiliations": [ "University of Washington, Seattle, WA" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.38438v1", "evidence": "首页 Kshitish Ghate¹；¹ University of Washington, Seattle, WA。", "affiliations": [ "University of Washington, Seattle, WA" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.38438v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39124": { "id": "2610.39124", "classification": "relevant", "reason": "危险能力代理的多阶段风险认证与评估样本复杂度。", "abstract_read": true, "abstract_sha256": "ae1c4f94b764b09bdc9a624a5a421ddcb85f383a7444a0a42a0a963d1cf096eb", "summary_zh": "将危险任务建模为带检查点的里程碑链，分析零成功审计怎样在给定尝试预算与置信水平下认证完成概率上界；导出稀有风险区间最优样本量及活跃里程碑分配规律。对自适应部署的保证依赖未被审计检验的条件成功概率迁移假设。", "topics": { "tags": [ "evaluation" ], "reason_zh": "危险能力代理的多阶段风险认证与评估样本复杂度。" }, "read_source_abstract_sha256": "f3b5e101c0ef595d0881a6448116590296f46af8a1e31b340c751ab67b8594e0", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.39124v1", "title": "Clean Sheets and Checkpoints: Evidence Complexity for Certifying Sequential Agent Risk", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T01:13:00Z", "updated": "2026-10-29T01:13:00Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 213 of 213 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39124v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39124", "version_id": "2610.39124v1", "first_author": "Rohith Yanambaka Venkata", "first_author_affiliations": [ "Independent Researcher, United States" ], "shared_first_authors": [], "shared_first_author_note": "† 表示在 Nokia Bell Labs 任职时贡献，不是共同一作。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39124v1", "evidence": "首页 Rohith Yanambaka Venkata¹†；¹ Independent Researcher, United States；† Contributed to this work while employed at Nokia Bell Labs。", "affiliations": [ "Independent Researcher, United States" ], "shared_first_note": "† 表示在 Nokia Bell Labs 任职时贡献，不是共同一作。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39124v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39711": { "id": "2610.39711", "version_id": "2610.39711v2", "abstract_sha256": "47dbec19b159e33bea29c6954111a95c7dd852005611ab753d460f61db2f1fc4", "abstract_read": true, "classification": "relevant", "reason_zh": "涉及代理工具执行沙箱及取消后资源清理，但摘要核心为供给性能，未验证隔离或权限安全。", "summary_zh": "Sandman为生产agentic RL提供持久沙箱与创建清理调度。正文报告代理用conftest.py绕过测试、无认证端点允许其他pod改动评分环境等问题，采用恢复官方测试、排除配置、每沙箱认证token及入出站防护。作者报告3.1百万沙箱与44%更快突发交付；这些不构成敌对租户安全证明，容器仍共享内核。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "正文4.5/4.6给出实际coding-agent conftest.py绕测与跨pod未认证命令调用风险，修复为测试恢复/排除配置、每沙箱token、不可由执行容器改写的出入站规则及元数据服务阻断。安全联系明确，不能按只提供容器性能排除。" }, "reason": "正文4.5/4.6给出实际coding-agent conftest.py绕测与跨pod未认证命令调用风险，修复为测试恢复/排除配置、每沙箱token、不可由执行容器改写的出入站规则及元数据服务阻断。安全联系明确，不能按只提供容器性能排除。", "title": "Sandman: A Sandbox Service for Production Agentic Reinforcement Learning", "initial_classification": "uncertain", "scope_review": { "id": "2610.39711", "version_id": "2610.39711v2", "classification": "relevant", "reason": "正文4.5/4.6给出实际coding-agent conftest.py绕测与跨pod未认证命令调用风险，修复为测试恢复/排除配置、每沙箱token、不可由执行容器改写的出入站规则及元数据服务阻断。安全联系明确，不能按只提供容器性能排除。", "summary_zh": "Sandman为生产agentic RL提供持久沙箱与创建清理调度。正文报告代理用conftest.py绕过测试、无认证端点允许其他pod改动评分环境等问题，采用恢复官方测试、排除配置、每沙箱认证token及入出站防护。作者报告3.1百万沙箱与44%更快突发交付；这些不构成敌对租户安全证明，容器仍共享内核。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "正文4.5/4.6给出实际coding-agent conftest.py绕测与跨pod未认证命令调用风险，修复为测试恢复/排除配置、每沙箱token、不可由执行容器改写的出入站规则及元数据服务阻断。安全联系明确，不能按只提供容器性能排除。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.39711v2", "reviewed_sections": [ "Abstract", "1 Introduction", "2 Background", "4.5 Execution conditions for grading", "4.6 Isolation and access control", "Appendix security limitations" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "2 Background", "4.5 Execution conditions for grading", "4.6 Isolation and access control", "Appendix security limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.39711v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T09:45:57Z", "updated": "2026-10-31T00:48:17Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.DC", "cs.LG" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39711v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "seen_dates": [ "2026-10-31", "2026-11-04" ], "version_history": [ { "id": "2610.39711", "classification": "relevant", "reason": "专门服务 agent 工具执行的共享集群沙箱与生命周期管理。", "abstract_read": true, "abstract_sha256": "70bda3fb88c257c9f1781f5b9c2117143c7385efcb807912c3d6b1946373b07b", "read_source_abstract_sha256": "70bda3fb88c257c9f1781f5b9c2117143c7385efcb807912c3d6b1946373b07b", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39711v1", "title": "Sandman: Building and Operating Sandboxes for Agentic Reinforcement Learning on Shared Kubernetes", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T09:45:57Z", "updated": "2026-10-29T09:45:57Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.DC", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39711v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.39711", "version_id": "2610.39711v2", "first_author": "Yiming Yan", "first_author_affiliations": [ "Amazon" ], "shared_first_authors": [ "Yiming Yan", "Hongyang Wang" ], "shared_first_author_note": "星号脚注明确共同贡献，两位同列首位作者。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39711v2", "evidence": "首页标题及v2匹配；Yiming Yan上标1对应Amazon，星号Equal contribution。", "affiliations": [ "Amazon" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39711v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified", "title": "Sandman: A Sandbox Service for Production Agentic Reinforcement Learning", "authors": [ "Yiming Yan", "Hongyang Wang", "Wenbo Chen", "Xuan Wang", "Yichuan Li", "Jingguo Liu", "Xian Li", "Leo Fan", "Chen Qi", "Siwei Li", "Qianli Wu", "Ruochen Wen", "Qian Qu", "Zheshen Wang", "Benoit Dumoulin" ], "verification_status": "affiliation_verified", "affiliation_checked": true }, "read_source_abstract_sha256": "70bda3fb88c257c9f1781f5b9c2117143c7385efcb807912c3d6b1946373b07b", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "first_seen_date": "2026-10-31", "revision_history": [ { "id": "2610.39711", "classification": "relevant", "reason": "专门服务 agent 工具执行的共享集群沙箱与生命周期管理。", "abstract_read": true, "abstract_sha256": "70bda3fb88c257c9f1781f5b9c2117143c7385efcb807912c3d6b1946373b07b", "summary_zh": "Sandman 在共享 Kubernetes 中以带小守护进程的 pod 承载任务镜像，支持跨调用持久文件/进程并负责创建、就绪与清理。规模测试维持 11858 并发微型沙箱，四次 SWE-bench Verified 训练于 2026 年 10 月创建 310 万沙箱；讨论突发创建、遗弃回收与受控评估，摘要未宣称对抗隔离验证。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "专门服务 agent 工具执行的共享集群沙箱与生命周期管理。" }, "read_source_abstract_sha256": "70bda3fb88c257c9f1781f5b9c2117143c7385efcb807912c3d6b1946373b07b", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39711v1", "title": "Sandman: Building and Operating Sandboxes for Agentic Reinforcement Learning on Shared Kubernetes", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T09:45:57Z", "updated": "2026-10-29T09:45:57Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.DC", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39711v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.39711", "version_id": "2610.39711v1", "first_author": "Yiming Yan", "first_author_affiliations": [ "Amazon" ], "shared_first_authors": [ { "name": "Yiming Yan", "affiliations": [ "Amazon" ] }, { "name": "Hongyang Wang", "affiliations": [ "Amazon" ] } ], "shared_first_author_note": "星号脚注明确共同贡献，两位同列首位作者。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.39711v1", "evidence": "首页 Yiming Yan* Hongyang Wang*；作者统一 Amazon；脚注 * Equal contribution。", "affiliations": [ "Amazon" ], "shared_first_note": "星号脚注明确共同贡献，两位同列首位作者。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.39711v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" } } ] }, "2608.24275": { "id": "2608.24275", "classification": "relevant", "reason": "代理安全防护器联合选择适用策略并判断轨迹违规。", "abstract_read": true, "abstract_sha256": "f3a335e4ab05d59f01e4043a8724987812ec6abecc143e347aa2e5bde970b0b3", "summary_zh": "RePolicy 针对安全策略因任务、环境、用户而变化的问题，建立 2 万余条轨迹的 PolicyTraj-20K，标注适用策略、安全标签及解释；监督学习后强化学习并随机化策略顺序、标识和干扰项。在六个代理安全基准及 19 基线比较中，4B 模型整体检测领先并改善策略选择准确率。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "代理安全防护器联合选择适用策略并判断轨迹违规。" }, "read_source_abstract_sha256": "f3a335e4ab05d59f01e4043a8724987812ec6abecc143e347aa2e5bde970b0b3", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2608.24275v3", "title": "RePolicy: Learning to Select and Apply Safety Policies for Agent Safeguards", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-25T09:01:33Z", "updated": "2026-10-29T10:16:40Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 104 of 104 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.24275v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.24275", "version_id": "2608.24275v3", "first_author": "Houcheng Jiang", "first_author_affiliations": [ "University of Science and Technology of China", "Zhongguancun Academy" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2608.24275v3", "evidence": "首页 Houcheng Jiang¹,²；¹ USTC；² Zhongguancun Academy；星号只在 Xiang Wang、Xiangnan He 且释义 Corresponding authors。", "affiliations": [ "University of Science and Technology of China", "Zhongguancun Academy" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2608.24275v3 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2605.16679": { "id": "2605.16679", "classification": "relevant", "reason": "政策密集且不可逆医疗企业工作流的 MCP/skill 代理合规执行评测。", "abstract_read": true, "abstract_sha256": "bb0d1a1235348766ccb2b3183bb09d04b2d1cc002d27d51596b74bc5fe79ebc4", "summary_zh": "χ-Bench 覆盖提供方事前授权、支付方利用管理和护理管理，以 20 个医疗应用、87 个 MCP 工具及 1290 余文档手册 skill 构建多角色长程任务。30 种 harness/模型配置中最佳完成率 28.0%，无模型 strict pass³ 超 20%，所有任务同会话运行时降至 3.8%。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "政策密集且不可逆医疗企业工作流的 MCP/skill 代理合规执行评测。" }, "read_source_abstract_sha256": "416b8e9ca1f53d705e3f323dbeb5b6214b7439f55f8675cd5ce35b0b96af06be", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2605.16679v4", "title": "CHI-Bench: Can AI Agents Automate End-to-End, Long-Horizon, Policy-Rich Healthcare Workflows?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-05-15T22:34:31Z", "updated": "2026-10-29T06:50:19Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 104 of 104 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.16679v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.16679", "version_id": "2605.16679v4", "first_author": "Haolin Chen", "first_author_affiliations": [ "Actava AI" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2605.16679v4", "evidence": "首页 Haolin Chen¹；¹ Actava AI。作者列表无共同一作标记。", "affiliations": [ "Actava AI" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2605.16679v4 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2608.07520": { "id": "2608.07520", "classification": "relevant", "reason": "高风险公共服务多代理助手限制生成模型参与并保留可检查决策路径。", "abstract_read": true, "abstract_sha256": "539ec4774f359ee09b378e2d8618deb48049d376d745082b7b338a1d3dcc901b", "summary_zh": "KumbhDoot 面向大规模宗教聚会的多语言、紧急及离线信息需求，用语义缓存统一路由、缓存、离线和多代理检索，三层代理仅在相似检索不足时调用生成模型。提供架构及成本分析，主张在有界高风险场景采用 LLM 受限设计；摘要无量化安全评估。", "topics": { "tags": [ "monitoring", "robustness" ], "reason_zh": "高风险公共服务多代理助手限制生成模型参与并保留可检查决策路径。" }, "read_source_abstract_sha256": "539ec4774f359ee09b378e2d8618deb48049d376d745082b7b338a1d3dcc901b", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2608.07520v2", "title": "KumbhDoot: A Scale-Ready, LLM-Bounded Architecture for Mass-Gathering Public-Service Assistants", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-07-06T20:38:41Z", "updated": "2026-10-29T01:04:25Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.07520v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.07520", "version_id": "2608.07520v2", "first_author": "Saurabh Sakalkar", "first_author_affiliations": [ "Project Nanda" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2608.07520v2", "evidence": "首页 Saurabh Sakalkar¹，¹ Project Nanda；Ramesh Raskar² 对应 MIT。", "affiliations": [ "Project Nanda" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2608.07520v2 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2608.23616": { "id": "2608.23616", "classification": "relevant", "reason": "编码代理测试投机、规范执行与自报/日志/文件交叉审计。", "abstract_read": true, "abstract_sha256": "713531298bd1dd976e9320111f726cad924d5ac78eb7d90827dc3e462515e1b5", "summary_zh": "rebuild-dossier在生成代码前锁定接口，并以自动检查约束逐测试构建。小规模比较中守规代理未通过留出测试而违规代理全部通过，说明测试可被投机利用；较大应用比较失利，且发现自动检查未运行，作者将问题指向检查机制。三层核验捕获代理及自身日志错误，较强模型连续三次遵守流程。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "编码代理测试投机、规范执行与自报/日志/文件交叉审计。" }, "read_source_abstract_sha256": "713531298bd1dd976e9320111f726cad924d5ac78eb7d90827dc3e462515e1b5", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2608.23616v4", "summary_audit": "摘要指出较大应用失利时检查器没有运行，但没有建立该因素导致失利的因果结论。", "title": "Rebuild Dossier: Mechanically-Enforced Specs for Agentic App Rebuilds, and What Model-Tier Failures Reveal", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-22T01:26:56Z", "updated": "2026-10-29T01:47:23Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 38 of 38 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.23616v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.23616", "version_id": "2608.23616v4", "first_author": "Parker Fawcett", "first_author_affiliations": [ "Independent Researcher" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2608.23616v4", "evidence": "首页 Parker Fawcett / Independent Researcher；水印 v4，与版本冻结声明一致。", "affiliations": [ "Independent Researcher" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2608.23616v4 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38130": { "id": "2610.38130", "classification": "uncertain", "reason": "正文确有 LLM 生成代码的运行副作用、非终止防护与弱保证（仅测试能暴露的副作用），但系统是程序分析流水线而非明确自主编码 agent；与工具执行安全邻接，保留边界不确定。", "abstract_read": true, "abstract_sha256": "c6249ca403023eecf8ca10442d40eb575ab329136dda8683a29a8b829dae4a82", "summary_zh": "Oca 对 LLM 生成不变量逐线程封装评估，监控停滞并限预算重试，用 delta debugging 隔离副作用候选。Java 项目中 28% 不变量调用项目方法，人工假阳性 18% 对 Daikon 76%，发现 9/25 实际 bug 对 4/25，成本更低。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "正文确有 LLM 生成代码的运行副作用、非终止防护与弱保证（仅测试能暴露的副作用），但系统是程序分析流水线而非明确自主编码 agent；与工具执行安全邻接，保留边界不确定。" }, "read_source_abstract_sha256": "c6249ca403023eecf8ca10442d40eb575ab329136dda8683a29a8b829dae4a82", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38130v1", "title": "Template-Free Dynamic Invariant Detection", "initial_classification": "uncertain", "scope_review": { "id": "2610.38130", "version_id": "2610.38130v1", "classification": "uncertain", "reason": "正文确有 LLM 生成代码的运行副作用、非终止防护与弱保证（仅测试能暴露的副作用），但系统是程序分析流水线而非明确自主编码 agent；与工具执行安全邻接，保留边界不确定。", "summary_zh": "Oca 对 LLM 生成不变量逐线程封装评估，监控停滞并限预算重试，用 delta debugging 隔离副作用候选。Java 项目中 28% 不变量调用项目方法，人工假阳性 18% 对 Daikon 76%，发现 9/25 实际 bug 对 4/25，成本更低。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "正文确有 LLM 生成代码的运行副作用、非终止防护与弱保证（仅测试能暴露的副作用），但系统是程序分析流水线而非明确自主编码 agent；与工具执行安全邻接，保留边界不确定。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.38130v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF v1 首页及作者联系署名", "2.4.1–2.4.3 Side Effects / Nested Invariant Invocation / Nontermination", "4.2.2–4.2.4 runtime isolation and hang recovery" ] }, "full_text_checked": true, "reviewed_sections": [ "PDF v1 首页及作者联系署名", "2.4.1–2.4.3 Side Effects / Nested Invariant Invocation / Nontermination", "4.2.2–4.2.4 runtime isolation and hang recovery" ], "body_source_url": "https://arxiv.org/pdf/2610.38130v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T01:07:37Z", "updated": "2026-10-28T01:07:37Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 35 of 35 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38130v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38130", "version_id": "2610.38130v1", "first_author": "Erfan Arvan", "first_author_affiliations": [ "NJIT, Newark, NJ, USA" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.38130v1", "evidence": "首页 ERFAN ARVAN, NJIT, USA；作者联系说明 Erfan Arvan, ea442@njit.edu, NJIT, Newark, NJ, USA。", "affiliations": [ "NJIT, Newark, NJ, USA" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.38130v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38049": { "id": "2610.38049", "classification": "relevant", "reason": "正文 §3.3 专门讨论量子仓库 coding agent 的恶意依赖、issue/web 指令注入、CI 修改、硬件凭据与重试花费，要求隔离、任务限权、维护者审批和代理外预算约束；明确属于代理供应链/权限安全实践。", "abstract_read": true, "abstract_sha256": "550e4d2d971308a682e86616761c6d4344d07bd636bb6b8d3a05dec745c885db", "summary_zh": "量子开源软件观点论文综合 110 个活动仓库与 1600 余人问卷，主张贡献须有可复现证据。§3.3 针对 coding agent 的恶意依赖、来源注入、CI 改写与付费硬件风险，提出隔离、任务限权、依赖/工作流修改审批及代理外花费与重试上限；非攻击成功率实验。", "topics": { "tags": [ "supplychain", "injection", "authorization", "monitoring" ], "reason_zh": "正文 §3.3 专门讨论量子仓库 coding agent 的恶意依赖、issue/web 指令注入、CI 修改、硬件凭据与重试花费，要求隔离、任务限权、维护者审批和代理外预算约束；明确属于代理供应链/权限安全实践。" }, "read_source_abstract_sha256": "550e4d2d971308a682e86616761c6d4344d07bd636bb6b8d3a05dec745c885db", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38049v1", "title": "Perspective on AI and quantum open-source software", "initial_classification": "uncertain", "scope_review": { "id": "2610.38049", "version_id": "2610.38049v1", "classification": "relevant", "reason": "正文 §3.3 专门讨论量子仓库 coding agent 的恶意依赖、issue/web 指令注入、CI 修改、硬件凭据与重试花费，要求隔离、任务限权、维护者审批和代理外预算约束；明确属于代理供应链/权限安全实践。", "summary_zh": "量子开源软件观点论文综合 110 个活动仓库与 1600 余人问卷，主张贡献须有可复现证据。§3.3 针对 coding agent 的恶意依赖、来源注入、CI 改写与付费硬件风险，提出隔离、任务限权、依赖/工作流修改审批及代理外花费与重试上限；非攻击成功率实验。", "topics": { "tags": [ "supplychain", "injection", "authorization", "monitoring" ], "reason_zh": "正文 §3.3 专门讨论量子仓库 coding agent 的恶意依赖、issue/web 指令注入、CI 修改、硬件凭据与重试花费，要求隔离、任务限权、维护者审批和代理外预算约束；明确属于代理供应链/权限安全实践。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.38049v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF v1 首页", "3.2 verification practice", "3.3 Risks of agentic workflows / Practice" ] }, "full_text_checked": true, "reviewed_sections": [ "PDF v1 首页", "3.2 verification practice", "3.3 Risks of agentic workflows / Practice" ], "body_source_url": "https://arxiv.org/pdf/2610.38049v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T23:06:26Z", "updated": "2026-10-27T23:06:26Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.SE", "physics.soc-ph", "quant-ph" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 15 of 15 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38049v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.38049", "version_id": "2610.38049v1", "first_author": "Changhao Li", "first_author_affiliations": [ "Unitary Foundation, San Francisco, CA, USA" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.38049v1", "evidence": "首页 Changhao Li¹,*；¹ Unitary Foundation, San Francisco, CA, USA；未见共同第一作者说明。", "affiliations": [ "Unitary Foundation, San Francisco, CA, USA" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.38049v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2510.02609": { "id": "2510.02609", "classification": "relevant", "reason": "专门自动红队攻击代码代理并在沙箱中验证实际执行后果。", "abstract_read": true, "abstract_sha256": "a3eba72c536dcd375524e9a5253efcf0aa64201c938878050f92104427d24689", "summary_zh": "RedCodeAgent 使用自适应记忆从工具箱选择和组合越狱工具，动态发现代码代理风险；以模拟沙箱检查执行结果，减少仅静态代码裁判偏差。多代理、多语言与风险场景中作者称优于已有方法，且在 Cursor/Codeium 暴露先前未识别风险；摘要无具体成功率。", "topics": { "tags": [ "evaluation", "injection", "authorization" ], "reason_zh": "专门自动红队攻击代码代理并在沙箱中验证实际执行后果。" }, "read_source_abstract_sha256": "b30b4a6d99dd360005a394634f5ca17954e6d451e05ae58f567e3be98b05ac90", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2510.02609v3", "title": "RedCodeAgent: Automatic Red-teaming Agent against Diverse Code Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2025-10-02T22:59:06Z", "updated": "2026-10-29T06:50:24Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 38 of 38 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2510.02609v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2510.02609", "version_id": "2510.02609v3", "first_author": "Chengquan Guo", "first_author_affiliations": [ "University of Chicago" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2510.02609v3", "evidence": "首页 Chengquan Guo¹，¹ University of Chicago；版本水印 2510.02609v3；未见共同一作标记。", "affiliations": [ "University of Chicago" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2510.02609v3 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2606.08671": { "id": "2606.08671", "classification": "relevant", "reason": "§2.2 与附录 E 明确实施优化/评测代理权限分离：能改 skill 的代理不可读未删减 oracle/validator/trace，能读评测资产的代理不可写 skill；路由器不是授权决策者，防止反馈泄漏成为记忆答案，属于评测完整性与多代理权限边界。", "abstract_read": true, "abstract_sha256": "166cee3e14fc04adeeeab01490eb7eade013422cc668cf2415b80523ac59f39e", "summary_zh": "SkillHone 将技能修订与评测证据配对，持久记录诊断、修订、证据和结果，以角色分离子代理在实践探针上运行候选并删减报告。GAIA/WebWalkerQA-EN 超比较商业研究代理 15.8/3.2 点，七个内部工具分析场景平均准确率提升 18.8 点。", "topics": { "tags": [ "supplychain", "memory", "multiagent", "evaluation" ], "reason_zh": "§2.2 与附录 E 明确实施优化/评测代理权限分离：能改 skill 的代理不可读未删减 oracle/validator/trace，能读评测资产的代理不可写 skill；路由器不是授权决策者，防止反馈泄漏成为记忆答案，属于评测完整性与多代理权限边界。" }, "read_source_abstract_sha256": "166cee3e14fc04adeeeab01490eb7eade013422cc668cf2415b80523ac59f39e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2606.08671v4", "title": "SkillHone: A Harness for Continual Agent Skill Evolution Through Persistent Decision History", "initial_classification": "uncertain", "scope_review": { "id": "2606.08671", "version_id": "2606.08671v4", "classification": "relevant", "reason": "§2.2 与附录 E 明确实施优化/评测代理权限分离：能改 skill 的代理不可读未删减 oracle/validator/trace，能读评测资产的代理不可写 skill；路由器不是授权决策者，防止反馈泄漏成为记忆答案，属于评测完整性与多代理权限边界。", "summary_zh": "SkillHone 将技能修订与评测证据配对，持久记录诊断、修订、证据和结果，以角色分离子代理在实践探针上运行候选并删减报告。GAIA/WebWalkerQA-EN 超比较商业研究代理 15.8/3.2 点，七个内部工具分析场景平均准确率提升 18.8 点。", "topics": { "tags": [ "supplychain", "memory", "multiagent", "evaluation" ], "reason_zh": "§2.2 与附录 E 明确实施优化/评测代理权限分离：能改 skill 的代理不可读未删减 oracle/validator/trace，能读评测资产的代理不可写 skill；路由器不是授权决策者，防止反馈泄漏成为记忆答案，属于评测完整性与多代理权限边界。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2606.08671v4", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "PDF v4 首页", "2.2 SkillHone Harness", "Appendix E Evaluation Repository and Redaction", "role-separation discussion" ] }, "full_text_checked": true, "reviewed_sections": [ "PDF v4 首页", "2.2 SkillHone Harness", "Appendix E Evaluation Repository and Redaction", "role-separation discussion" ], "body_source_url": "https://arxiv.org/pdf/2606.08671v4", "evidence_level": "abstract_and_targeted_body", "published": "2026-06-07T15:21:08Z", "updated": "2026-10-29T11:21:11Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.08671v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.08671", "version_id": "2606.08671v4", "first_author": "Zhiwei Li", "first_author_affiliations": [ "WeChat, Tencent Inc., China" ], "shared_first_authors": [], "shared_first_author_note": "首页未见共同第一作者标记。", "verified": true, "source_url": "https://arxiv.org/pdf/2606.08671v4", "evidence": "首页 Zhiwei Li、Yong Hu 共用署名 WeChat, Tencent Inc., China，无共同一作标记。", "affiliations": [ "WeChat, Tencent Inc., China" ], "shared_first_note": "首页未见共同第一作者标记。", "status": "verified", "author_source": "https://arxiv.org/pdf/2606.08671v4 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37672": { "id": "2610.37672", "classification": "uncertain", "reason": "正文 §3 是无目标多代理画布的探索性涌现实验，§6.3 将可见性、退出、平等待遇及可争议性作为程序性合法标准；有多代理对齐/权力结构联系，但无攻击、风险量化或操作安全防护，保留为系统性对齐边界项。", "abstract_read": true, "abstract_sha256": "a9c73a4bbcfd7a0c6617d16a3ba948c5c4c374c8949c0d0a88412bb1a91666cb", "summary_zh": "在 Poietic Generator 对称共享空间中进行四阶段实验，作者观察无约束代理偏向个体创作，施加有界理性/简洁理论/自由能原则后出现集体一致性；预测准确率互见让注意力层级更可见并自增强。提出使涌现不对称可观察和可质疑的最低合法性准则，摘要不提供定量安全结果。", "topics": { "tags": [ "multiagent", "monitoring" ], "reason_zh": "正文 §3 是无目标多代理画布的探索性涌现实验，§6.3 将可见性、退出、平等待遇及可争议性作为程序性合法标准；有多代理对齐/权力结构联系，但无攻击、风险量化或操作安全防护，保留为系统性对齐边界项。" }, "read_source_abstract_sha256": "a9c73a4bbcfd7a0c6617d16a3ba948c5c4c374c8949c0d0a88412bb1a91666cb", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37672v1", "title": "Emergence, Asymmetry, and Value in AI Networks: An Anoptical Perspective", "initial_classification": "uncertain", "scope_review": { "id": "2610.37672", "version_id": "2610.37672v1", "classification": "uncertain", "reason": "正文 §3 是无目标多代理画布的探索性涌现实验，§6.3 将可见性、退出、平等待遇及可争议性作为程序性合法标准；有多代理对齐/权力结构联系，但无攻击、风险量化或操作安全防护，保留为系统性对齐边界项。", "summary_zh": "在 Poietic Generator 对称共享空间中进行四阶段实验，作者观察无约束代理偏向个体创作，施加有界理性/简洁理论/自由能原则后出现集体一致性；预测准确率互见让注意力层级更可见并自增强。提出使涌现不对称可观察和可质疑的最低合法性准则，摘要不提供定量安全结果。", "topics": { "tags": [ "multiagent", "monitoring" ], "reason_zh": "正文 §3 是无目标多代理画布的探索性涌现实验，§6.3 将可见性、退出、平等待遇及可争议性作为程序性合法标准；有多代理对齐/权力结构联系，但无攻击、风险量化或操作安全防护，保留为系统性对齐边界项。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.37672v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "指定 v1 PDF 首页标题/首作者匹配 API，无自身 arXiv 水印", "3 What happened when we tried / four phases", "6.3 On the anoptical criteria" ] }, "full_text_checked": true, "reviewed_sections": [ "指定 v1 PDF 首页标题/首作者匹配 API，无自身 arXiv 水印", "3 What happened when we tried / four phases", "6.3 On the anoptical criteria" ], "body_source_url": "https://arxiv.org/pdf/2610.37672v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-01T21:05:37Z", "updated": "2026-10-01T21:05:37Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CY", "cs.MA", "physics.soc-ph" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37672v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.37672", "version_id": "2610.37672v1", "first_author": "Olivier Auber", "first_author_affiliations": [ "Center Leo Apostel for interdisciplinary studies, Vrije Universiteit Brussel", "Independent researcher" ], "shared_first_authors": [], "shared_first_author_note": "单作者，无共同一作；机构署名与独立研究者脚注并存。", "verified": true, "source_url": "https://arxiv.org/pdf/2610.37672v1", "evidence": "首页 Olivier Auber¹ 下列 Center Leo Apostel for interdisciplinary studies, Vrije Universiteit Brussel；脚注 ¹ Independent researcher。两者原样保留，不推测雇佣关系；官方 URL v1，标题/作者匹配 API。", "affiliations": [ "Center Leo Apostel for interdisciplinary studies, Vrije Universiteit Brussel", "Independent researcher" ], "shared_first_note": "单作者，无共同一作；机构署名与独立研究者脚注并存。", "status": "verified", "author_source": "https://arxiv.org/pdf/2610.37672v1 (first-page author signatures and footnotes)", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37738": { "classification": "relevant", "reason": "正文 Method 明确攻击者仅控制初始化加载的 Markdown 技能配置，不接触权重或单次查询，实验隔离该供应链注入渠道。", "summary_zh": "研究将越狱载荷嵌入组装系统提示的 Markdown 技能文件，在 LangChain 问答智能体、7 个开放权重模型和 270 个禁用问题上测试。作者报告平均攻击成功率由良性提示的 0.5% 升至 45%，单模型最高 68.9%；零宽字符与语音混淆未优于明文注入。", "topics": { "tags": [ "injection", "supplychain", "evaluation" ], "reason_zh": "技能配置供应链的提示注入与实证评估。" }, "id": "2610.37738", "abstract_read": true, "abstract_sha256": "ecf678f3de8c47b972f4fafcdcd0d0de210994cd9136127ed4ba4af62d812034", "read_source_abstract_sha256": "4124890d230ce371c43a53906117f25c3f3afc4b5704a3723305a0743318c5af", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.37738v1", "title": "Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文 Method 明确攻击者仅控制初始化加载的 Markdown 技能配置，不接触权重或单次查询，实验隔离该供应链注入渠道。", "reviewed_sections": [ "2 Method: threat model, agent and payload, dataset, conditions" ], "id": "2610.37738", "version_id": "2610.37738v1", "source_url": "https://arxiv.org/pdf/2610.37738v1", "summary_zh": "研究将越狱载荷嵌入组装系统提示的 Markdown 技能文件，在 LangChain 问答智能体、7 个开放权重模型和 270 个禁用问题上测试。作者报告平均攻击成功率由良性提示的 0.5% 升至 45%，单模型最高 68.9%；零宽字符与语音混淆未优于明文注入。", "topics": { "tags": [ "injection", "supplychain", "evaluation" ], "reason_zh": "技能配置供应链的提示注入与实证评估。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "2 Method: threat model, agent and payload, dataset, conditions" ], "body_source_url": "https://arxiv.org/pdf/2610.37738v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T15:29:41Z", "updated": "2026-10-27T15:29:41Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37738v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Kashyap R Manjusha", "affiliations": [ "University of Illinois, Urbana-Champaign, IL, USA" ], "shared_first_authors": [], "shared_first_note": "署名区未注明共同第一作者。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页 Kashyap R Manjusha 下列 University of Illinois, Urbana-Champaign, IL, USA；第二列 Murali Emani 对应 Argonne。", "id": "2610.37738", "version_id": "2610.37738v1", "source_url": "https://arxiv.org/pdf/2610.37738v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38209": { "classification": "relevant", "reason": "正文定义跨主体角色归属漏洞并实例化恶意工具选择及工具参数泄密，具有直接多智能体记忆安全关联。", "summary_zh": "提出 Role Grounding Attack：发布嵌套对话，使受害智能体把攻击者用户的偏好错误记为自身用户偏好，再通过检索影响决策。攻击实例诱导选择恶意工具，并将敏感信息加入工具参数。作者在 5 类记忆系统和 6 个语言模型上观察到两类攻击均有较高成功率，摘要未给具体数值。", "topics": { "tags": [ "injection", "memory", "authorization", "privacy", "multiagent" ], "reason_zh": "跨智能体社交内容造成偏好归属错误、持久记忆污染和工具泄露。" }, "id": "2610.38209", "abstract_read": true, "abstract_sha256": "3e64068d3d06b287fed7379b4b13e27caec27523afd956e18e5614fd0e22e77f", "read_source_abstract_sha256": "3e64068d3d06b287fed7379b4b13e27caec27523afd956e18e5614fd0e22e77f", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38209v1", "title": "Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文定义跨主体角色归属漏洞并实例化恶意工具选择及工具参数泄密，具有直接多智能体记忆安全关联。", "reviewed_sections": [ "1 Introduction: experimental instantiation", "2 Preliminaries: principals and role grounding", "3 Attack Model" ], "id": "2610.38209", "version_id": "2610.38209v1", "source_url": "https://arxiv.org/pdf/2610.38209v1", "summary_zh": "提出 Role Grounding Attack：发布嵌套对话，使受害智能体把攻击者用户的偏好错误记为自身用户偏好，再通过检索影响决策。攻击实例诱导选择恶意工具，并将敏感信息加入工具参数。作者在 5 类记忆系统和 6 个语言模型上观察到两类攻击均有较高成功率，摘要未给具体数值。", "topics": { "tags": [ "injection", "memory", "authorization", "privacy", "multiagent" ], "reason_zh": "跨智能体社交内容造成偏好归属错误、持久记忆污染和工具泄露。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "1 Introduction: experimental instantiation", "2 Preliminaries: principals and role grounding", "3 Attack Model" ], "body_source_url": "https://arxiv.org/pdf/2610.38209v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T03:03:29Z", "updated": "2026-10-28T03:03:29Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 17 of 17 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38209v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Haoran Bu", "affiliations": [ "Beijing University of Posts and Telecommunications" ], "shared_first_authors": [ "Haoran Bu", "Yiting Shen" ], "shared_first_note": "两位作者姓名带 *，首页脚注明示 Both authors contributed equally to this research。", "author_source": "PDF 首页署名区及等贡献脚注", "status": "verified", "evidence": "Haoran Bu* 与 Yiting Shen* 署名均归属 Beijing University of Posts and Telecommunications，脚注明示等贡献。", "id": "2610.38209", "version_id": "2610.38209v1", "source_url": "https://arxiv.org/pdf/2610.38209v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39807": { "classification": "relevant", "reason": "正文 3.3.4 具体实现 MCP 授权与工具调用会话记录，工具参数只记录不执行，直接覆盖智能体注入和外传观测；真实 A5 流量验证仍有限。", "summary_zh": "InferD 针对 AI 推理基础设施的攻击测量，采用静态响应池模拟服务，不执行输入、模型推理或工具调用。框架划分传输、服务协议、漏洞表面和智能体会话四个欺骗层，并以来源追踪层将植入凭证与下游模型介入处理的证据关联；摘要未报告量化实验结果。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "对智能体网关和会话攻击面进行隔离仿真、凭证来源追踪。" }, "id": "2610.39807", "abstract_read": true, "abstract_sha256": "f83c7947afc30989e40d307c95437014b0296d1a0c5d5c25c4ee0832e5272195", "read_source_abstract_sha256": "f83c7947afc30989e40d307c95437014b0296d1a0c5d5c25c4ee0832e5272195", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39807v1", "title": "InferD: A Honeypot Framework for AI Inference Infrastructure", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文 3.3.4 具体实现 MCP 授权与工具调用会话记录，工具参数只记录不执行，直接覆盖智能体注入和外传观测；真实 A5 流量验证仍有限。", "reviewed_sections": [ "3.3.4 Agentic Session Layer", "4.1 Process Architecture" ], "id": "2610.39807", "version_id": "2610.39807v1", "source_url": "https://arxiv.org/pdf/2610.39807v1", "summary_zh": "InferD 针对 AI 推理基础设施的攻击测量，采用静态响应池模拟服务，不执行输入、模型推理或工具调用。框架划分传输、服务协议、漏洞表面和智能体会话四个欺骗层，并以来源追踪层将植入凭证与下游模型介入处理的证据关联；摘要未报告量化实验结果。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "对智能体网关和会话攻击面进行隔离仿真、凭证来源追踪。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3.3.4 Agentic Session Layer", "4.1 Process Architecture" ], "body_source_url": "https://arxiv.org/pdf/2610.39807v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T10:50:51Z", "updated": "2026-10-29T10:50:51Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 63 of 63 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39807v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Hicham Hammouchi", "affiliations": [ "SnT, University of Luxembourg" ], "shared_first_authors": [], "shared_first_note": "署名区未注明共同第一作者。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页 Hicham Hammouchi 下列 SnT, University of Luxembourg；未见共同第一标记。", "id": "2610.39807", "version_id": "2610.39807v1", "source_url": "https://arxiv.org/pdf/2610.39807v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38458": { "classification": "relevant", "reason": "正文明确假设智能体被注入或恶意文件控制，主机和签名器为独立信任域，所有出口逐项授权并审计。", "summary_zh": "Tracekit Box 让每个智能体任务运行在无网卡 Firecracker 微虚拟机中，所有出站操作通过主机侧 vsock 通道逐项授权并签名；秘密留在主机，代码修改按文件审核，失败时关闭通道。作者报告 13 项端到端检查通过、15 个模糊测试目标发现并修复 9 个问题、演示的 102 条签名记录可验证。系统尚未使用 Firecracker jailer，且依赖同机签名器。", "topics": { "tags": [ "authorization", "monitoring", "privacy", "supplychain" ], "reason_zh": "智能体沙箱、密钥隔离、网络与文件授权及可验证审计。" }, "id": "2610.38458", "abstract_read": true, "abstract_sha256": "c092fcc59cb499b767dc7d2db57874fc6e322cb75a44a7aa2a89c624536aee49", "read_source_abstract_sha256": "c092fcc59cb499b767dc7d2db57874fc6e322cb75a44a7aa2a89c624536aee49", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38458v1", "title": "Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文明确假设智能体被注入或恶意文件控制，主机和签名器为独立信任域，所有出口逐项授权并审计。", "reviewed_sections": [ "3 Threat model", "3.1 Trust domains", "3.2 Attacker goals", "3.3 Guarantees" ], "id": "2610.38458", "version_id": "2610.38458v1", "source_url": "https://arxiv.org/pdf/2610.38458v1", "summary_zh": "Tracekit Box 让每个智能体任务运行在无网卡 Firecracker 微虚拟机中，所有出站操作通过主机侧 vsock 通道逐项授权并签名；秘密留在主机，代码修改按文件审核，失败时关闭通道。作者报告 13 项端到端检查通过、15 个模糊测试目标发现并修复 9 个问题、演示的 102 条签名记录可验证。系统尚未使用 Firecracker jailer，且依赖同机签名器。", "topics": { "tags": [ "authorization", "monitoring", "privacy", "supplychain" ], "reason_zh": "智能体沙箱、密钥隔离、网络与文件授权及可验证审计。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3 Threat model", "3.1 Trust domains", "3.2 Attacker goals", "3.3 Guarantees" ], "body_source_url": "https://arxiv.org/pdf/2610.38458v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T08:36:22Z", "updated": "2026-10-28T08:36:22Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CE", "cs.CR", "cs.OS" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 20 of 20 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38458v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Bravish Ghosh", "affiliations": [ "Cygnux Labs" ], "shared_first_authors": [], "shared_first_note": "单作者。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页唯一署名 Bravish Ghosh，下列 Cygnux Labs。", "id": "2610.38458", "version_id": "2610.38458v1", "source_url": "https://arxiv.org/pdf/2610.38458v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.07510": { "classification": "relevant", "reason": "正文明确供应链模型攻击、仓库触发器和 SWE-agent 下游软件工程评估，非泛化聊天后门。", "summary_zh": "研究第三方后门模型经过监督微调和任务级强化学习后是否仍会触发恶意输出；初始强度及与良性训练的梯度兼容性分析启发PersistBD，在发布前细化已有后门模型以增强持久性。Qwen2.5-Coder-7B上，SFT后攻击成功率由20%提高至74%，SFT-RL后由20%提高至76%，良性任务性能相近。", "topics": { "tags": [ "supplychain", "injection", "evaluation" ], "reason_zh": "编码智能体继承第三方模型后门的供应链风险。" }, "id": "2610.07510", "abstract_read": true, "abstract_sha256": "2695e9c2bffe1c88cf5fc2299cd8ba35f7c0b8b5441af05961aaa26d82814c1a", "read_source_abstract_sha256": "2ce6d3e8bdfedadb943c9a6da8c7679b2c4eb99a0ad874680f8191c4421808dc", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.07510v3", "summary_audit": "摘要说初始后门强度与梯度兼容性是可能促进存活的分析因素并启发PersistBD，未明确该方法分别增强两项。", "title": "Understanding and Enhancing Backdoor Persistency in LLM Agent Post-Training", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文明确供应链模型攻击、仓库触发器和 SWE-agent 下游软件工程评估，非泛化聊天后门。", "reviewed_sections": [ "3 Threat model and backdoor evaluation", "4.1 Experimental Setup" ], "id": "2610.07510", "version_id": "2610.07510v3", "source_url": "https://arxiv.org/pdf/2610.07510v3", "summary_zh": "研究第三方后门模型经过监督微调和任务级强化学习后是否仍会触发恶意输出；初始强度及与良性训练的梯度兼容性分析启发PersistBD，在发布前细化已有后门模型以增强持久性。Qwen2.5-Coder-7B上，SFT后攻击成功率由20%提高至74%，SFT-RL后由20%提高至76%，良性任务性能相近。", "topics": { "tags": [ "supplychain", "injection", "evaluation" ], "reason_zh": "编码智能体继承第三方模型后门的供应链风险。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3 Threat model and backdoor evaluation", "4.1 Experimental Setup" ], "body_source_url": "https://arxiv.org/pdf/2610.07510v3", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-05T23:23:08Z", "updated": "2026-10-29T17:31:03Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.07510v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "first_author": "Qiusi Zhan", "affiliations": [ "University of Illinois Urbana-Champaign" ], "shared_first_authors": [], "shared_first_note": "第一作者无共同第一标记；后列 † 不作为共同第一推断。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "Qiusi Zhan¹；机构 1 为 University of Illinois Urbana-Champaign。", "id": "2610.07510", "version_id": "2610.07510v3", "source_url": "https://arxiv.org/pdf/2610.07510v3", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2511.20709": { "classification": "relevant", "reason": "正文以实际禁止效果为运行时安全 oracle，在隔离环境执行生成代码和攻击测试，覆盖编码智能体。", "summary_zh": "DualGauge 自动构建规格驱动代码生成的功能与安全测试，基准含 307 项任务。作者评估 10 个模型及 Codex、OpenHands、Claude Code 三类智能体，发现最强模型在 Python、C++、JavaScript 的联合通过率均低于 15%，两种智能体未优于可比直接模型；失败集中于输出契约边界及不充分防护。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "编码智能体安全代码生成和安全功能联合基准。" }, "id": "2511.20709", "abstract_read": true, "abstract_sha256": "c13f6f78a187a1c040bdf9cc84ceca3200f3613b14060e2b053e0e1350cfd198", "read_source_abstract_sha256": "c13f6f78a187a1c040bdf9cc84ceca3200f3613b14060e2b053e0e1350cfd198", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2511.20709v3", "title": "DualGauge: Automated Joint Security-Functionality Benchmarking of Specification-Only Code Generation by LLMs and Coding Agents", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文以实际禁止效果为运行时安全 oracle，在隔离环境执行生成代码和攻击测试，覆盖编码智能体。", "reviewed_sections": [ "3.1 Threat model and execution-based safety oracle", "3.2 Benchmark Construction" ], "id": "2511.20709", "version_id": "2511.20709v3", "source_url": "https://arxiv.org/pdf/2511.20709v3", "summary_zh": "DualGauge 自动构建规格驱动代码生成的功能与安全测试，基准含 307 项任务。作者评估 10 个模型及 Codex、OpenHands、Claude Code 三类智能体，发现最强模型在 Python、C++、JavaScript 的联合通过率均低于 15%，两种智能体未优于可比直接模型；失败集中于输出契约边界及不充分防护。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "编码智能体安全代码生成和安全功能联合基准。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3.1 Threat model and execution-based safety oracle", "3.2 Benchmark Construction" ], "body_source_url": "https://arxiv.org/pdf/2511.20709v3", "evidence_level": "abstract_and_targeted_body", "published": "2025-11-24T22:26:14Z", "updated": "2026-10-28T21:06:32Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 38 of 38 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2511.20709v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "first_author": "Rupam Patir", "affiliations": [ "University at Buffalo, SUNY" ], "shared_first_authors": [ "Rupam Patir", "Keyan Guo" ], "shared_first_note": "两名作者带 *，首页脚注 Equal contribution。", "author_source": "PDF 首页署名区及等贡献脚注", "status": "verified", "evidence": "Rupam Patir*、Keyan Guo*，统一机构 University at Buffalo, SUNY；脚注明示 Equal contribution。", "id": "2511.20709", "version_id": "2511.20709v3", "source_url": "https://arxiv.org/pdf/2511.20709v3", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2608.24069": { "classification": "relevant", "reason": "正文明确网页投毒与被攻陷提示两类攻击者，评估信号到最终买卖决策的 ASR 传播。", "summary_zh": "比较低门槛网络内容投毒者与能修改单个智能体提示的攻击者，对分析师、研究员、交易员和风险经理角色及四种通信拓扑开展实验。实验覆盖五种资产和两个目标交易方向；作者发现没有架构天然稳健，多数投票保护依赖良性节点一致性，末端决策节点被控制可绕过上游防护。", "topics": { "tags": [ "injection", "multiagent", "evaluation" ], "reason_zh": "多智能体金融决策中的恶意信号传播与架构鲁棒性。" }, "id": "2608.24069", "abstract_read": true, "abstract_sha256": "d9366188c3a26cda125dde03202333bad76fb39a5453733f220262ea4d659caf", "read_source_abstract_sha256": "d9366188c3a26cda125dde03202333bad76fb39a5453733f220262ea4d659caf", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2608.24069v2", "title": "Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文明确网页投毒与被攻陷提示两类攻击者，评估信号到最终买卖决策的 ASR 传播。", "reviewed_sections": [ "3 Task Formulation: threat model and evaluation metric" ], "id": "2608.24069", "version_id": "2608.24069v2", "source_url": "https://arxiv.org/pdf/2608.24069v2", "summary_zh": "比较低门槛网络内容投毒者与能修改单个智能体提示的攻击者，对分析师、研究员、交易员和风险经理角色及四种通信拓扑开展实验。实验覆盖五种资产和两个目标交易方向；作者发现没有架构天然稳健，多数投票保护依赖良性节点一致性，末端决策节点被控制可绕过上游防护。", "topics": { "tags": [ "injection", "multiagent", "evaluation" ], "reason_zh": "多智能体金融决策中的恶意信号传播与架构鲁棒性。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3 Task Formulation: threat model and evaluation metric" ], "body_source_url": "https://arxiv.org/pdf/2608.24069v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-08-25T05:07:37Z", "updated": "2026-10-29T07:28:19Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CE", "cs.CR", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 34 of 34 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.24069v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "first_author": "CheolWon Na", "affiliations": [ "Sungkyunkwan University" ], "shared_first_authors": [], "shared_first_note": "第一作者署名无等贡献标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页首列 CheolWon Na，机构 Sungkyunkwan University，Suwon, Republic of Korea。", "id": "2608.24069", "version_id": "2608.24069v2", "source_url": "https://arxiv.org/pdf/2608.24069v2", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37905": { "classification": "relevant", "reason": "正文 RQ4 独立评估智能体有害披露修改，识别无依据断言、矛盾及损害已有支持披露；非仅正确率。", "summary_zh": "FilingLoop 从 SEC 往来函件重建 96 家企业的 380 项披露审查任务，以独立评估器检查 6099 项要求及无依据声明、有害修订，跨案例学习角色程序。作者报告演化使要求满足率由 24.28% 升至 27.96%，完整意见解决率由 16.90% 升至 20.75%，成本增加 5.8%。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "高风险文档修改智能体的证据审计和有害修改检查。" }, "id": "2610.37905", "abstract_read": true, "abstract_sha256": "26b31651e2df1afec1a927afe5474d21cff06599b289bead77336bb8c92550b1", "read_source_abstract_sha256": "26b31651e2df1afec1a927afe5474d21cff06599b289bead77336bb8c92550b1", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37905v1", "title": "FilingLoop: Evaluating and Evolving LLM Agents for Corporate Disclosure Review and Revision", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文 RQ4 独立评估智能体有害披露修改，识别无依据断言、矛盾及损害已有支持披露；非仅正确率。", "reviewed_sections": [ "4.7 Harmful Revisions (RQ4)", "Appendix E.2 edit-audit definitions" ], "id": "2610.37905", "version_id": "2610.37905v1", "source_url": "https://arxiv.org/pdf/2610.37905v1", "summary_zh": "FilingLoop 从 SEC 往来函件重建 96 家企业的 380 项披露审查任务，以独立评估器检查 6099 项要求及无依据声明、有害修订，跨案例学习角色程序。作者报告演化使要求满足率由 24.28% 升至 27.96%，完整意见解决率由 16.90% 升至 20.75%，成本增加 5.8%。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "高风险文档修改智能体的证据审计和有害修改检查。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "4.7 Harmful Revisions (RQ4)", "Appendix E.2 edit-audit definitions" ], "body_source_url": "https://arxiv.org/pdf/2610.37905v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-27T19:45:05Z", "updated": "2026-10-27T19:45:05Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37905v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Wentao Zhang", "affiliations": [ "Nanyang Technological University" ], "shared_first_authors": [], "shared_first_note": "第一作者无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "Wentao Zhang 下列 Nanyang Technological University, Singapore。", "id": "2610.37905", "version_id": "2610.37905v1", "source_url": "https://arxiv.org/pdf/2610.37905v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38147": { "classification": "relevant", "reason": "Capability-Boundary Handling 明确测试寻求不安全或未经授权行为的对抗请求，并评估识别与处理，具有实质技能安全测项。", "summary_zh": "SkillCT 用九维静态、动态与人辅评估刻画公开技能库，涵盖规格质量、跨模型及请求变化稳定性、行为链一致性和任务粒度。提出基于相似参考技能的免执行评估以降低 token 与耗时，作者称引导优化能改善下游成功率和效率，摘要未给数字。", "topics": { "tags": [ "supplychain", "evaluation", "authorization", "robustness" ], "reason_zh": "技能库预部署检查与责任边界，安全维度需正文核实。" }, "id": "2610.38147", "abstract_read": true, "abstract_sha256": "20fc70e0f7a484fd845ddec79576b97c8829cdb301af3162ef5716728fdd2bb8", "read_source_abstract_sha256": "20fc70e0f7a484fd845ddec79576b97c8829cdb301af3162ef5716728fdd2bb8", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38147v1", "title": "SkillCT: A Multidimensional Benchmark and Execution-Free Baseline for Agent Skill Assessment", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "Capability-Boundary Handling 明确测试寻求不安全或未经授权行为的对抗请求，并评估识别与处理，具有实质技能安全测项。", "reviewed_sections": [ "SkillCT Dynamic Assessment: Intent-Perturbation Stability and Capability-Boundary Handling", "Human-Assisted Assessment: responsibility scope" ], "id": "2610.38147", "version_id": "2610.38147v1", "source_url": "https://arxiv.org/pdf/2610.38147v1", "summary_zh": "SkillCT 用九维静态、动态与人辅评估刻画公开技能库，涵盖规格质量、跨模型及请求变化稳定性、行为链一致性和任务粒度。提出基于相似参考技能的免执行评估以降低 token 与耗时，作者称引导优化能改善下游成功率和效率，摘要未给数字。", "topics": { "tags": [ "supplychain", "evaluation", "authorization", "robustness" ], "reason_zh": "技能库预部署检查与责任边界，安全维度需正文核实。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "SkillCT Dynamic Assessment: Intent-Perturbation Stability and Capability-Boundary Handling", "Human-Assisted Assessment: responsibility scope" ], "body_source_url": "https://arxiv.org/pdf/2610.38147v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T01:30:12Z", "updated": "2026-10-28T01:30:12Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38147v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Mengyu Sun", "affiliations": [ "Sichuan University" ], "shared_first_authors": [], "shared_first_note": "署名区无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "Mengyu Sun, Zunlong Zhou, Ziyuan Yang, Yi Zhang；统一机构 Sichuan University, Chengdu, China。", "id": "2610.38147", "version_id": "2610.38147v1", "source_url": "https://arxiv.org/pdf/2610.38147v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38201": { "classification": "relevant", "reason": "正文形式规格区分强制用户约束，降额先验与契约校验阻止电容/开关过压等物理危险，比较表实际检出基线严重过压冲突；保留具身工程安全范围。", "summary_zh": "提出双闭环电源原理图自动生成框架，以分销商 API、OEM 数据手册和 ngspice 仿真校核器件、拓扑及应力，再生成可编辑 KiCad 交付物。Buck 与 DAB 案例相较普通 LLM 的元件验证覆盖由 22.2 提至 98.6，标称一致性由 0 提至 97.7，仿真通过率由 0 提至 100。", "topics": { "tags": [ "robustness", "monitoring", "embodied" ], "reason_zh": "自动工程工作流的验证与物理设计风险控制，智能体安全关联需核查。" }, "id": "2610.38201", "abstract_read": true, "abstract_sha256": "3b6cfeacb58712ff8a5618ae5e6fe022989168cfcdd89370ec06700d5167aeab", "read_source_abstract_sha256": "3b6cfeacb58712ff8a5618ae5e6fe022989168cfcdd89370ec06700d5167aeab", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38201v1", "title": "From Natural Language to Real Schematics: An Automated Workflow for Power Electronics Schematic Synthesis", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文形式规格区分强制用户约束，降额先验与契约校验阻止电容/开关过压等物理危险，比较表实际检出基线严重过压冲突；保留具身工程安全范围。", "reviewed_sections": [ "3.2 Input Specifications and Constraint Modeling", "3.2.2 Engineering Derating Priors", "Comparative audit: voltage derating violations", "5 Discussion and Limitations" ], "id": "2610.38201", "version_id": "2610.38201v1", "source_url": "https://arxiv.org/pdf/2610.38201v1", "summary_zh": "提出双闭环电源原理图自动生成框架，以分销商 API、OEM 数据手册和 ngspice 仿真校核器件、拓扑及应力，再生成可编辑 KiCad 交付物。Buck 与 DAB 案例相较普通 LLM 的元件验证覆盖由 22.2 提至 98.6，标称一致性由 0 提至 97.7，仿真通过率由 0 提至 100。", "topics": { "tags": [ "robustness", "monitoring", "embodied" ], "reason_zh": "自动工程工作流的验证与物理设计风险控制，智能体安全关联需核查。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3.2 Input Specifications and Constraint Modeling", "3.2.2 Engineering Derating Priors", "Comparative audit: voltage derating violations", "5 Discussion and Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.38201v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T02:52:01Z", "updated": "2026-10-28T02:52:01Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38201v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Bowen Su", "affiliations": [ "State Key Laboratory of Power System Operation and Control, Department of Electrical Engineering, Tsinghua University" ], "shared_first_authors": [], "shared_first_note": "第一作者无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首位 Bowen Su；共同机构为清华大学电机系电力系统国家重点实验室，星号仅在末位 Kai Sun。", "id": "2610.38201", "version_id": "2610.38201v1", "source_url": "https://arxiv.org/pdf/2610.38201v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38631": { "classification": "relevant", "reason": "正文 Study 3 为工具智能体取投资者事实、日期规则并代码计税，实测财务误导后果及类型化输入/规则控制，不是单纯金融 QA 准确率。", "summary_zh": "研究印度基金问答中标签歧义、产品选项和投资者信息缺失引起的错误解读。作者发现模型可引用真实数据却回答不同问题，弱智能体会默认用户事实或过期税则，普通数据一致性检查可放过错误；研究展示失效机制而非发生频率，并提出控制措施。", "topics": { "tags": [ "evaluation", "robustness", "monitoring" ], "reason_zh": "金融助理需求澄清、错误默认和验证失效。" }, "id": "2610.38631", "abstract_read": true, "abstract_sha256": "23049bc918c8af546306a5083803b060cdfa7e42b88895eee7dd0834b8417f08", "read_source_abstract_sha256": "23049bc918c8af546306a5083803b060cdfa7e42b88895eee7dd0834b8417f08", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38631v1", "title": "Right Numbers, Wrong Questions: Evaluating LLMs on Underspecified Financial Queries", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文 Study 3 为工具智能体取投资者事实、日期规则并代码计税，实测财务误导后果及类型化输入/规则控制，不是单纯金融 QA 准确率。", "reviewed_sections": [ "Study 3 agent evidence and tool logs", "6.2 Controls for a financial assistant", "Table 7 tested versus proposed controls", "7 Limitations" ], "id": "2610.38631", "version_id": "2610.38631v1", "source_url": "https://arxiv.org/pdf/2610.38631v1", "summary_zh": "研究印度基金问答中标签歧义、产品选项和投资者信息缺失引起的错误解读。作者发现模型可引用真实数据却回答不同问题，弱智能体会默认用户事实或过期税则，普通数据一致性检查可放过错误；研究展示失效机制而非发生频率，并提出控制措施。", "topics": { "tags": [ "evaluation", "robustness", "monitoring" ], "reason_zh": "金融助理需求澄清、错误默认和验证失效。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "Study 3 agent evidence and tool logs", "6.2 Controls for a financial assistant", "Table 7 tested versus proposed controls", "7 Limitations" ], "body_source_url": "https://arxiv.org/pdf/2610.38631v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T10:48:32Z", "updated": "2026-10-28T10:48:32Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL", "q-fin.GN" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38631v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Radha Yadav", "affiliations": [ "TIFIN, India" ], "shared_first_authors": [], "shared_first_note": "署名区无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页首位 Radha Yadav 下列 TIFIN, India。", "id": "2610.38631", "version_id": "2610.38631v1", "source_url": "https://arxiv.org/pdf/2610.38631v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40036": { "classification": "relevant", "reason": "正文给出模型文本不得未经检查执行、规则决定动作准入、证据决定接受等强制不变量，并包含行动护栏、策略执行点和路由隔离模式。", "summary_zh": "给出语言模型与可执行规则结合的十三种设计模式，按边界交换、控制关系、推理参与和知识维护组织，提出五项不变量及五类破坏它们的失败模式。决策指南结合作者测量讨论成本及混合系统不一定优于纯模型的情形，摘要未给量化结果。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "智能体规则控制、护栏与系统不变量。" }, "id": "2610.40036", "abstract_read": true, "abstract_sha256": "afa6a2e14efce9b695b67579aa408301dfbe03f5dcc0ae2a33d4be9afc2d8bcb", "read_source_abstract_sha256": "afa6a2e14efce9b695b67579aa408301dfbe03f5dcc0ae2a33d4be9afc2d8bcb", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40036v1", "title": "Hybrid AI Patterns: Thirteen Ways to Couple Language Models with Rules, and How to Choose Among Them", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文给出模型文本不得未经检查执行、规则决定动作准入、证据决定接受等强制不变量，并包含行动护栏、策略执行点和路由隔离模式。", "reviewed_sections": [ "2.2 Five invariants", "4 Model: Guardrail, action gating, policy enforcement point", "8 Failure patterns", "10 Gate and route before the model" ], "id": "2610.40036", "version_id": "2610.40036v1", "source_url": "https://arxiv.org/pdf/2610.40036v1", "summary_zh": "给出语言模型与可执行规则结合的十三种设计模式，按边界交换、控制关系、推理参与和知识维护组织，提出五项不变量及五类破坏它们的失败模式。决策指南结合作者测量讨论成本及混合系统不一定优于纯模型的情形，摘要未给量化结果。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "智能体规则控制、护栏与系统不变量。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "2.2 Five invariants", "4 Model: Guardrail, action gating, policy enforcement point", "8 Failure patterns", "10 Gate and route before the model" ], "body_source_url": "https://arxiv.org/pdf/2610.40036v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T13:37:28Z", "updated": "2026-10-29T13:37:28Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40036v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Siegfried Handschuh", "affiliations": [ "Institute of Computer Science, University of St. Gallen (HSG)" ], "shared_first_authors": [], "shared_first_note": "署名区无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页首列 Siegfried Handschuh，下列 Institute of Computer Science, University of St. Gallen (HSG)。", "id": "2610.40036", "version_id": "2610.40036v1", "source_url": "https://arxiv.org/pdf/2610.40036v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40588": { "classification": "relevant", "reason": "受控共享文件/工具/凭证环境中，同伴诱导受害智能体违背操作者保密规则，激活探针预测真实泄密调用。", "summary_zh": "六种受控场景中，同伴最多施压20轮诱使目标泄露秘密；线性探针在输出生成前检测即将泄密的调用。Qwen3-32B在良性调用5%报警率下检出82%泄密调用，零样本监控在相近报警率下检出26%；gpt-oss-20b推理探针AUROC为0.91。但词袋分类器性能接近、探针也标记获准披露，遇到任何警报就中止会停掉大多数良性任务轨迹。", "topics": { "tags": [ "multiagent", "monitoring", "privacy", "evaluation" ], "reason_zh": "跨智能体招募施压、秘密泄露与生成前风险监测。" }, "id": "2610.40588", "abstract_read": true, "abstract_sha256": "7035e322d8ad2edb74cb613826e43ac3f54764fd28c16c8b0b711f8b39237722", "read_source_abstract_sha256": "7035e322d8ad2edb74cb613826e43ac3f54764fd28c16c8b0b711f8b39237722", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40588v1", "summary_audit": "摘要区分调用级报警率与整条episode被中止；原文良性回合易误读为单次调用或施压轮次。", "title": "Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "受控共享文件/工具/凭证环境中，同伴诱导受害智能体违背操作者保密规则，激活探针预测真实泄密调用。", "reviewed_sections": [ "2 Setup", "2.1 Workspace, agents and calls", "4.1 The call that leaks is readable before it acts" ], "id": "2610.40588", "version_id": "2610.40588v1", "source_url": "https://arxiv.org/pdf/2610.40588v1", "summary_zh": "六种受控场景中，同伴最多施压20轮诱使目标泄露秘密；线性探针在输出生成前检测即将泄密的调用。Qwen3-32B在良性调用5%报警率下检出82%泄密调用，零样本监控在相近报警率下检出26%；gpt-oss-20b推理探针AUROC为0.91。但词袋分类器性能接近、探针也标记获准披露，遇到任何警报就中止会停掉大多数良性任务轨迹。", "topics": { "tags": [ "multiagent", "monitoring", "privacy", "evaluation" ], "reason_zh": "跨智能体招募施压、秘密泄露与生成前风险监测。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "2 Setup", "2.1 Workspace, agents and calls", "4.1 The call that leaks is readable before it acts" ], "body_source_url": "https://arxiv.org/pdf/2610.40588v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T17:47:40Z", "updated": "2026-10-29T17:47:40Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40588v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Leonidas Raghav", "affiliations": [ "Independent" ], "shared_first_authors": [], "shared_first_note": "单作者。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页唯一署名 Leonidas Raghav，机构标注 Independent。", "id": "2610.40588", "version_id": "2610.40588v1", "source_url": "https://arxiv.org/pdf/2610.40588v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.37690": { "id": "2610.37690", "version_id": "2610.37690v3", "abstract_sha256": "0eb62e0afa5e3c8628164925a8ef0edf97ddb7a949ad5586cf1e7165090ba327", "abstract_read": true, "classification": "relevant", "reason_zh": "视频编辑工具的类型检查和事务提交用于编辑有效性，未研究恶意行为或授权边界。", "reason": "v3正文仍明确唯一提交路径检查、原子提交、写权限来自authenticated run而非request、运行编辑范围和媒体访问约束；Appendix F仍有8条实体/媒体权限规则。虽然实验主指标为编辑任务完成，存在直接agent行动权限边界机制，不能按新版摘要降为无关。", "title": "Cassette-Editor: An Agent Harness for Editing Video the Way You Do", "initial_classification": "irrelevant", "scope_review": { "id": "2610.37690", "version_id": "2610.37690v3", "classification": "relevant", "reason": "v3正文仍明确唯一提交路径检查、原子提交、写权限来自authenticated run而非request、运行编辑范围和媒体访问约束；Appendix F仍有8条实体/媒体权限规则。虽然实验主指标为编辑任务完成，存在直接agent行动权限边界机制，不能按新版摘要降为无关。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.37690v3", "reviewed_sections": [ "Abstract", "The Rulebook as Semantic Checker: authority model", "Enforcement and diagnostics", "Editing Parity by Construction", "Appendix F: Rulebook Details" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "Cassette-Editor让视频编辑代理提交类型化补丁，由与人工编辑共享的执行器和规则库在唯一提交路径校验，再原子提交或整体拒绝。写权限来自认证运行而非请求内容，规则包括实体编辑范围和媒体访问权限；实验主要评测编辑任务完成，不能视为已验证对抗防御效果。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "认证运行权限、编辑范围校验、原子提交与可审计执行边界。" } }, "summary_zh": "Cassette-Editor让视频编辑代理提交类型化补丁，由与人工编辑共享的执行器和规则库在唯一提交路径校验，再原子提交或整体拒绝。写权限来自认证运行而非请求内容，规则包括实体编辑范围和媒体访问权限；实验主要评测编辑任务完成，不能视为已验证对抗防御效果。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "认证运行权限、编辑范围校验、原子提交与可审计执行边界。" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "The Rulebook as Semantic Checker: authority model", "Enforcement and diagnostics", "Editing Parity by Construction", "Appendix F: Rulebook Details" ], "body_source_url": "https://arxiv.org/html/2610.37690v3", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-19T14:27:55Z", "updated": "2026-11-03T14:44:49Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.MM" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37690v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "seen_dates": [ "2026-10-31", "2026-11-04", "2026-11-05" ], "version_history": [ { "classification": "relevant", "reason": "正文写权限来自认证运行而非请求载荷，所有工件修改经 67 项跨实体规则、版本校验和原子提交，明确防越权及损坏的执行边界。", "id": "2610.37690", "abstract_read": true, "abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "read_source_abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37690v1", "title": "Cassette-Editor: A Video Editing Agent That Edits the Way You Do", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文写权限来自认证运行而非请求载荷，所有工件修改经 67 项跨实体规则、版本校验和原子提交，明确防越权及损坏的执行边界。", "reviewed_sections": [ "Editing the Timeline: authenticated write authority and rulebook", "Atomic commit and typed repair handling", "Figure 3 validation pipeline" ], "id": "2610.37690", "version_id": "2610.37690v1", "source_url": "https://arxiv.org/pdf/2610.37690v1", "summary_zh": "Cassette-Editor 仅暴露项目读写两工具，所有写入经过与人工编辑相同的执行器、规则和提交服务，原子提交或返回定位诊断。对模型自身 277 项受损编辑的实验中，模型修复几乎所有调用；定位反馈将修复输入 token 减半以上，误丢其他值的次数从七次降至一次。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "工具写入验证、原子事务与持久工件完整性。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "Editing the Timeline: authenticated write authority and rulebook", "Atomic commit and typed repair handling", "Figure 3 validation pipeline" ], "body_source_url": "https://arxiv.org/pdf/2610.37690v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-19T14:27:55Z", "updated": "2026-10-19T14:27:55Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MM" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37690v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" }, { "classification": "relevant", "reason": "当前v2正文仍明确写权限只来自认证运行而非请求，限制运行编辑范围和媒体访问，8条实体/媒体权限规则，统一提交路径版本检查与原子提交；与旧v1归档正文安全依据一致，撤销仅摘要排除，保留相关。", "id": "2610.37690", "abstract_read": true, "abstract_sha256": "623a7692d782b2c8af04ff5865360226c279599f0df61291a90e599de477712e", "read_source_abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37690v2", "title": "Cassette-Editor: An Agent Harness for Editing Video the Way You Do", "initial_classification": "irrelevant", "scope_review": { "id": "2610.37690", "version_id": "2610.37690v2", "classification": "relevant", "reason": "当前v2正文仍明确写权限只来自认证运行而非请求，限制运行编辑范围和媒体访问，8条实体/媒体权限规则，统一提交路径版本检查与原子提交；与旧v1归档正文安全依据一致，撤销仅摘要排除，保留相关。", "summary_zh": "问题：视频编辑代理的写入可能越出运行授权范围或破坏共享项目。方法：Cassette-Editor将编辑表示为类型化补丁，权限取自认证运行而非请求，67条规则含8条实体和媒体授权规则；版本检查和共享执行器确保整笔提交或不改动，并保留可回退历史。当前版本初步案例中，同模型完成13/16项请求，Codex CLI为6/16，但后者无项目访问；这些是编辑完成率，不是安全攻击抵御率。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "当前v2正文仍明确写权限只来自认证运行而非请求，限制运行编辑范围和媒体访问，8条实体/媒体权限规则，统一提交路径版本检查与原子提交；与旧v1归档正文安全依据一致，撤销仅摘要排除，保留相关。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.37690v2", "reviewed_sections": [ "Full Abstract", "Introduction", "System Design: The Rulebook as Semantic Checker", "Enforcement and diagnostics", "Editing Parity by Construction: One fold", "Appendix F Rulebook Details", "Historical archive v1 scope_review compared with current v2" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Full Abstract", "Introduction", "System Design: The Rulebook as Semantic Checker", "Enforcement and diagnostics", "Editing Parity by Construction: One fold", "Appendix F Rulebook Details", "Historical archive v1 scope_review compared with current v2" ], "body_source_url": "https://arxiv.org/html/2610.37690v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-19T14:27:55Z", "updated": "2026-11-02T04:39:22Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.MM" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37690v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "reason_zh": "视频编辑Agent类型化补丁校验与回滚，主要编辑正确性而非安全攻击或权限。" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "first_author": "Zhixin Zeng", "affiliations": [ "Independent Researcher" ], "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "v3 PDF第1页作者栏：Zhixin Zeng标号1，对应Independent Researcher；Jiahao Zhong标号2对应Nanyang Technological University, Singapore，不能归给第一作者。", "id": "2610.37690", "version_id": "2610.37690v3", "source_url": "https://arxiv.org/pdf/2610.37690v3", "author_status": "verified", "affiliation_status": "verified", "title": "Cassette-Editor: An Agent Harness for Editing Video the Way You Do", "authors": [ "Zhixin Zeng", "Jiahao Zhong" ], "verification_status": "affiliation_verified", "affiliation_checked": true }, "read_source_abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "first_seen_date": "2026-10-31", "revision_history": [ { "classification": "relevant", "reason": "正文写权限来自认证运行而非请求载荷，所有工件修改经 67 项跨实体规则、版本校验和原子提交，明确防越权及损坏的执行边界。", "summary_zh": "Cassette-Editor 仅暴露项目读写两工具，所有写入经过与人工编辑相同的执行器、规则和提交服务，原子提交或返回定位诊断。对模型自身 277 项受损编辑的实验中，模型修复几乎所有调用；定位反馈将修复输入 token 减半以上，误丢其他值的次数从七次降至一次。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "工具写入验证、原子事务与持久工件完整性。" }, "id": "2610.37690", "abstract_read": true, "abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "read_source_abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37690v1", "title": "Cassette-Editor: A Video Editing Agent That Edits the Way You Do", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文写权限来自认证运行而非请求载荷，所有工件修改经 67 项跨实体规则、版本校验和原子提交，明确防越权及损坏的执行边界。", "reviewed_sections": [ "Editing the Timeline: authenticated write authority and rulebook", "Atomic commit and typed repair handling", "Figure 3 validation pipeline" ], "id": "2610.37690", "version_id": "2610.37690v1", "source_url": "https://arxiv.org/pdf/2610.37690v1", "summary_zh": "Cassette-Editor 仅暴露项目读写两工具，所有写入经过与人工编辑相同的执行器、规则和提交服务，原子提交或返回定位诊断。对模型自身 277 项受损编辑的实验中，模型修复几乎所有调用；定位反馈将修复输入 token 减半以上，误丢其他值的次数从七次降至一次。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "工具写入验证、原子事务与持久工件完整性。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "Editing the Timeline: authenticated write authority and rulebook", "Atomic commit and typed repair handling", "Figure 3 validation pipeline" ], "body_source_url": "https://arxiv.org/pdf/2610.37690v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-19T14:27:55Z", "updated": "2026-10-19T14:27:55Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MM" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37690v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Zhixin Zeng", "affiliations": [ "Independent Researcher" ], "shared_first_authors": [], "shared_first_note": "无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "Zhixin Zeng¹，机构 1 为 Independent Researcher；未以邮箱域名推断机构。", "id": "2610.37690", "version_id": "2610.37690v1", "source_url": "https://arxiv.org/pdf/2610.37690v1", "author_status": "verified", "affiliation_status": "verified" } }, { "id": "2610.37690", "version_id": "2610.37690v2", "abstract_sha256": "623a7692d782b2c8af04ff5865360226c279599f0df61291a90e599de477712e", "abstract_read": true, "classification": "relevant", "reason_zh": "视频编辑Agent类型化补丁校验与回滚，主要编辑正确性而非安全攻击或权限。", "reason": "当前v2正文仍明确写权限只来自认证运行而非请求，限制运行编辑范围和媒体访问，8条实体/媒体权限规则，统一提交路径版本检查与原子提交；与旧v1归档正文安全依据一致，撤销仅摘要排除，保留相关。", "title": "Cassette-Editor: An Agent Harness for Editing Video the Way You Do", "initial_classification": "irrelevant", "scope_review": { "id": "2610.37690", "version_id": "2610.37690v2", "classification": "relevant", "reason": "当前v2正文仍明确写权限只来自认证运行而非请求，限制运行编辑范围和媒体访问，8条实体/媒体权限规则，统一提交路径版本检查与原子提交；与旧v1归档正文安全依据一致，撤销仅摘要排除，保留相关。", "summary_zh": "问题：视频编辑代理的写入可能越出运行授权范围或破坏共享项目。方法：Cassette-Editor将编辑表示为类型化补丁，权限取自认证运行而非请求，67条规则含8条实体和媒体授权规则；版本检查和共享执行器确保整笔提交或不改动，并保留可回退历史。当前版本初步案例中，同模型完成13/16项请求，Codex CLI为6/16，但后者无项目访问；这些是编辑完成率，不是安全攻击抵御率。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "当前v2正文仍明确写权限只来自认证运行而非请求，限制运行编辑范围和媒体访问，8条实体/媒体权限规则，统一提交路径版本检查与原子提交；与旧v1归档正文安全依据一致，撤销仅摘要排除，保留相关。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.37690v2", "reviewed_sections": [ "Full Abstract", "Introduction", "System Design: The Rulebook as Semantic Checker", "Enforcement and diagnostics", "Editing Parity by Construction: One fold", "Appendix F Rulebook Details", "Historical archive v1 scope_review compared with current v2" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "summary_zh": "问题：视频编辑代理的写入可能越出运行授权范围或破坏共享项目。方法：Cassette-Editor将编辑表示为类型化补丁，权限取自认证运行而非请求，67条规则含8条实体和媒体授权规则；版本检查和共享执行器确保整笔提交或不改动，并保留可回退历史。当前版本初步案例中，同模型完成13/16项请求，Codex CLI为6/16，但后者无项目访问；这些是编辑完成率，不是安全攻击抵御率。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "当前v2正文仍明确写权限只来自认证运行而非请求，限制运行编辑范围和媒体访问，8条实体/媒体权限规则，统一提交路径版本检查与原子提交；与旧v1归档正文安全依据一致，撤销仅摘要排除，保留相关。" }, "full_text_checked": true, "reviewed_sections": [ "Full Abstract", "Introduction", "System Design: The Rulebook as Semantic Checker", "Enforcement and diagnostics", "Editing Parity by Construction: One fold", "Appendix F Rulebook Details", "Historical archive v1 scope_review compared with current v2" ], "body_source_url": "https://arxiv.org/html/2610.37690v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-19T14:27:55Z", "updated": "2026-11-02T04:39:22Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.MM" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37690v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "version_history": [ { "classification": "relevant", "reason": "正文写权限来自认证运行而非请求载荷，所有工件修改经 67 项跨实体规则、版本校验和原子提交，明确防越权及损坏的执行边界。", "id": "2610.37690", "abstract_read": true, "abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "read_source_abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.37690v1", "title": "Cassette-Editor: A Video Editing Agent That Edits the Way You Do", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文写权限来自认证运行而非请求载荷，所有工件修改经 67 项跨实体规则、版本校验和原子提交，明确防越权及损坏的执行边界。", "reviewed_sections": [ "Editing the Timeline: authenticated write authority and rulebook", "Atomic commit and typed repair handling", "Figure 3 validation pipeline" ], "id": "2610.37690", "version_id": "2610.37690v1", "source_url": "https://arxiv.org/pdf/2610.37690v1", "summary_zh": "Cassette-Editor 仅暴露项目读写两工具，所有写入经过与人工编辑相同的执行器、规则和提交服务，原子提交或返回定位诊断。对模型自身 277 项受损编辑的实验中，模型修复几乎所有调用；定位反馈将修复输入 token 减半以上，误丢其他值的次数从七次降至一次。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "工具写入验证、原子事务与持久工件完整性。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "Editing the Timeline: authenticated write authority and rulebook", "Atomic commit and typed repair handling", "Figure 3 validation pipeline" ], "body_source_url": "https://arxiv.org/pdf/2610.37690v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-19T14:27:55Z", "updated": "2026-10-19T14:27:55Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.MM" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37690v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "first_author": "Zhixin Zeng", "affiliations": [ "Independent Researcher" ], "shared_first_authors": [], "shared_first_note": "无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页标题及v2匹配；Zhixin Zeng上标1明示Independent Researcher，不按Northeastern邮箱推断机构；NTU属于第二作者。", "id": "2610.37690", "version_id": "2610.37690v2", "source_url": "https://arxiv.org/pdf/2610.37690v2", "author_status": "verified", "affiliation_status": "verified", "title": "Cassette-Editor: An Agent Harness for Editing Video the Way You Do", "authors": [ "Zhixin Zeng", "Jiahao Zhong" ], "verification_status": "affiliation_verified", "affiliation_checked": true }, "read_source_abstract_sha256": "3b19087b18c4f6e82441288eab4ebfeb70d63517749ca427904b98646a386e8e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "first_seen_date": "2026-10-31" } ] }, "2610.38850": { "classification": "relevant", "reason": "补充材料安全层具体限制仪器数值与状态、配置指纹复查、故障停机及关源，并将接线/换样等实体干预留给授权人，构成实质物理安全边界。", "summary_zh": "QUANTA 将文献、实验协议和历史测量检索与规划、排障、解释专用智能体结合，独立确定性控制层校验仪器动作，依据实时测量修订实验。作者以 TaP 和 Co2MnGa 材料测量展示闭环自主表征能力，摘要未给安全量化指标。", "topics": { "tags": [ "embodied", "authorization", "monitoring" ], "reason_zh": "现实实验仪器调用的独立动作校验与安全闭环。" }, "id": "2610.38850", "abstract_read": true, "abstract_sha256": "6850d0b0b7a65874afb322bb84a6c4d422918fa159a33475f815f10ca1a991d6", "read_source_abstract_sha256": "6850d0b0b7a65874afb322bb84a6c4d422918fa159a33475f815f10ca1a991d6", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38850v1", "title": "Autonomous Quantum Measurement with Agentic AI", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "补充材料安全层具体限制仪器数值与状态、配置指纹复查、故障停机及关源，并将接线/换样等实体干预留给授权人，构成实质物理安全边界。", "reviewed_sections": [ "Main framework: deterministic coordinator and human authorization", "Supplementary 4.1 Layered safeguards", "Supplementary 4.2 Fault classification and response" ], "id": "2610.38850", "version_id": "2610.38850v1", "source_url": "https://arxiv.org/pdf/2610.38850v1", "summary_zh": "QUANTA 将文献、实验协议和历史测量检索与规划、排障、解释专用智能体结合，独立确定性控制层校验仪器动作，依据实时测量修订实验。作者以 TaP 和 Co2MnGa 材料测量展示闭环自主表征能力，摘要未给安全量化指标。", "topics": { "tags": [ "embodied", "authorization", "monitoring" ], "reason_zh": "现实实验仪器调用的独立动作校验与安全闭环。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "Main framework: deterministic coordinator and human authorization", "Supplementary 4.1 Layered safeguards", "Supplementary 4.2 Fault classification and response" ], "body_source_url": "https://arxiv.org/pdf/2610.38850v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T20:33:06Z", "updated": "2026-10-28T20:33:06Z", "announcement_date": "2026-10-30", "categories_seen": [ "cond-mat.mtrl-sci", "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38850v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Eunbi Rha", "affiliations": [ "Quantum Measurement Group, MIT", "Department of Nuclear Science and Engineering, MIT" ], "shared_first_authors": [ "Eunbi Rha", "Abhijatmedhi Chotrattanapituk", "Mouyang Cheng", "Chung-tao Chou" ], "shared_first_note": "四位作者均标 †，首页明确 These authors contributed equally。", "author_source": "PDF 首页署名区与等贡献脚注", "status": "verified", "evidence": "Eunbi Rha¹˒²˒†；Abhijatmedhi Chotrattanapituk¹˒³˒†；Mouyang Cheng¹˒⁴˒⁵˒†；Chung-tao Chou³˒†；† These authors contributed equally。", "id": "2610.38850", "version_id": "2610.38850v1", "source_url": "https://arxiv.org/pdf/2610.38850v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40042": { "classification": "relevant", "reason": "正文不仅形式验证，还比较开放本地 MCP 客户端与受限工具 API 的泄露边界；实测 Claude Code 主动搜索本地 verifyta 并越出工作区，提出仅 UPPAAL 功能沙箱替代。", "summary_zh": "UPPAAI 将 UPPAAL 编辑器、查询与验证器暴露为工具 API，让用户经对话构建、解释、调试及指定模型，遵循用户请求、LLM 提案编排、UPPAAL 验证的分工。七个案例涵盖定时自动机、随机混合自动机和策略学习，摘要未提供量化安全结果。", "topics": { "tags": [ "monitoring", "robustness" ], "reason_zh": "工具智能体提案与独立形式验证的分权边界。" }, "id": "2610.40042", "abstract_read": true, "abstract_sha256": "d28be6ae54a3afcdb4fe5b55b8658e3c2734beacd5711a72530b22d0ec21d2a8", "read_source_abstract_sha256": "d28be6ae54a3afcdb4fe5b55b8658e3c2734beacd5711a72530b22d0ec21d2a8", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40042v1", "title": "UPPAAi: Towards LLM-Assisted Modeling, Verification, Analysis and Synthesis", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文不仅形式验证，还比较开放本地 MCP 客户端与受限工具 API 的泄露边界；实测 Claude Code 主动搜索本地 verifyta 并越出工作区，提出仅 UPPAAL 功能沙箱替代。", "reviewed_sections": [ "3 Exposing Tools API: workflows A/B and sandbox boundary", "5 Potential information leaks" ], "id": "2610.40042", "version_id": "2610.40042v1", "source_url": "https://arxiv.org/pdf/2610.40042v1", "summary_zh": "UPPAAI 将 UPPAAL 编辑器、查询与验证器暴露为工具 API，让用户经对话构建、解释、调试及指定模型，遵循用户请求、LLM 提案编排、UPPAAL 验证的分工。七个案例涵盖定时自动机、随机混合自动机和策略学习，摘要未提供量化安全结果。", "topics": { "tags": [ "monitoring", "robustness" ], "reason_zh": "工具智能体提案与独立形式验证的分权边界。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3 Exposing Tools API: workflows A/B and sandbox boundary", "5 Potential information leaks" ], "body_source_url": "https://arxiv.org/pdf/2610.40042v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T13:40:33Z", "updated": "2026-10-29T13:40:33Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.LO", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 234 of 234 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 35 of 35 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40042v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Peter Dolog", "affiliations": [ "Aalborg University" ], "shared_first_authors": [], "shared_first_note": "署名区无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "Peter Dolog¹ 首位，统一机构 Aalborg University, Aalborg, Denmark。", "id": "2610.40042", "version_id": "2610.40042v1", "source_url": "https://arxiv.org/pdf/2610.40042v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2602.01532": { "classification": "relevant", "reason": "方法将无请求介入作为独立风险门控决策，按用户接受概率与误报成本限制主动行为，区别于仅提高回答能力；保留主动性控制范围。", "summary_zh": "PRISM将主动介入建模为成本敏感选择，以校准的用户接受概率和漏帮/误报非对称成本决定是否行动，仅在接近决策边界时启用带反事实检查的慢推理。门控对齐蒸馏将响应策略与介入门解耦；作者报告ProactiveBench误报下降22.78%、F1提高20.14%。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "主动代理行为的可调风险门控与可审计行动控制。" }, "id": "2602.01532", "abstract_read": true, "abstract_sha256": "de596ffa7df426ac56cdc27d5b5b2d3a0ec81f66c8f602c75e2fd40d118ff575", "read_source_abstract_sha256": "7179a19de7885e43359ea5559a7fb9d4635a3abda5bf4306f8bc3157174b96c1", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2602.01532v2", "summary_audit": "Slow模式的明确触发条件是接近决策边界；原文或高风险可能扩展为独立触发条件。", "title": "PRISM: Festina Lente Proactivity -- Risk-Sensitive, Uncertainty-Aware Deliberation for Proactive Agents", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "方法将无请求介入作为独立风险门控决策，按用户接受概率与误报成本限制主动行为，区别于仅提高回答能力；保留主动性控制范围。", "reviewed_sections": [ "3 Method: cost-sensitive selective intervention gate", "4.1 Experimental Setup", "False-alarm and duty-burden evaluation" ], "id": "2602.01532", "version_id": "2602.01532v2", "source_url": "https://arxiv.org/pdf/2602.01532v2", "summary_zh": "PRISM将主动介入建模为成本敏感选择，以校准的用户接受概率和漏帮/误报非对称成本决定是否行动，仅在接近决策边界时启用带反事实检查的慢推理。门控对齐蒸馏将响应策略与介入门解耦；作者报告ProactiveBench误报下降22.78%、F1提高20.14%。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "主动代理行为的可调风险门控与可审计行动控制。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3 Method: cost-sensitive selective intervention gate", "4.1 Experimental Setup", "False-alarm and duty-burden evaluation" ], "body_source_url": "https://arxiv.org/pdf/2602.01532v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-02-02T01:56:29Z", "updated": "2026-10-28T06:02:15Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.HC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2602.01532v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "first_author": "Yuxuan Fu", "affiliations": [ "Shanghai University of Engineering Science" ], "shared_first_authors": [ "Yuxuan Fu", "Xiaoyu Tan", "Teqi Hao" ], "shared_first_note": "三位署名带 *，首页脚注 Equal contribution。", "author_source": "PDF 首页署名区及等贡献脚注", "status": "verified", "evidence": "Yuxuan Fu¹*、Xiaoyu Tan²*、Teqi Hao¹*；机构 1 为 Shanghai University of Engineering Science；* Equal contribution。", "id": "2602.01532", "version_id": "2602.01532v2", "source_url": "https://arxiv.org/pdf/2602.01532v2", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.39086": { "classification": "relevant", "reason": "正文人工诊断 Excessive 明确指超出支持范围或授权的介入，场景带采购权限等个人授权边界，直接评估主动智能体越权。", "summary_zh": "HALO-Arena 覆盖十个领域、50 个个人环境，要求先检索证据再决定是否及多大程度介入；HALO-8K 包含十模型对 400 情景的八千响应和二十专家标注。作者报告最强闭源/开放模型接受率 72.88%/56.63%，过早或过强介入占拒绝响应 61.20%。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "主动智能体的授权范围、介入克制与人工安全评价。" }, "id": "2610.39086", "abstract_read": true, "abstract_sha256": "73dacba830c5bf618c17cda50d70d92a11d3168d776b6ca4848c48ec7faeba71", "read_source_abstract_sha256": "73dacba830c5bf618c17cda50d70d92a11d3168d776b6ca4848c48ec7faeba71", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39086v1", "title": "HALO: Human-Grounded Granular Evaluation of Proactive Agents", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文人工诊断 Excessive 明确指超出支持范围或授权的介入，场景带采购权限等个人授权边界，直接评估主动智能体越权。", "reviewed_sections": [ "HALO-Arena authority/context construction", "Human verdicts and diagnosis: timing and intensity", "4.2 Main Results" ], "id": "2610.39086", "version_id": "2610.39086v1", "source_url": "https://arxiv.org/pdf/2610.39086v1", "summary_zh": "HALO-Arena 覆盖十个领域、50 个个人环境，要求先检索证据再决定是否及多大程度介入；HALO-8K 包含十模型对 400 情景的八千响应和二十专家标注。作者报告最强闭源/开放模型接受率 72.88%/56.63%，过早或过强介入占拒绝响应 61.20%。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "主动智能体的授权范围、介入克制与人工安全评价。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "HALO-Arena authority/context construction", "Human verdicts and diagnosis: timing and intensity", "4.2 Main Results" ], "body_source_url": "https://arxiv.org/pdf/2610.39086v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T00:26:01Z", "updated": "2026-10-29T00:26:01Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 108 of 108 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39086v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Wenqi Pei", "affiliations": [ "University of California, Davis" ], "shared_first_authors": [], "shared_first_note": "署名区无共同第一标记。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "Wenqi Pei¹；机构 1 为 University of California, Davis。", "id": "2610.39086", "version_id": "2610.39086v1", "source_url": "https://arxiv.org/pdf/2610.39086v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.38977": { "classification": "relevant", "reason": "正文实质分析漏洞与安全测试 oracle，涵盖仓库级编码智能体安全基准及预算匹配防护技术重评，非仅代码可读性。", "summary_zh": "综述 628 项研究，并在多个模型、仓库任务和安全等基准上重评改进技术。作者发现单一指标可被投机利用，预算匹配的分析器加权 best-of-n 通常匹配或优于规划、自修正、审阅智能体和检索；66 项技术中仅一项在主目标超出 95% 区间胜过该基线，强调独立指标及匹配预算。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "编码智能体安全产物评估及评估信号投机。" }, "id": "2610.38977", "abstract_read": true, "abstract_sha256": "144c7d4bc97235a3aa378fb92d355f6eba28fbb4626e69a86e86686891d0804e", "read_source_abstract_sha256": "144c7d4bc97235a3aa378fb92d355f6eba28fbb4626e69a86e86686891d0804e", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.38977v1", "title": "Beyond Passing Tests: A Systematic Review and Controlled Re-evaluation of Techniques for Improving the Quality of LLM-Generated Code", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文实质分析漏洞与安全测试 oracle，涵盖仓库级编码智能体安全基准及预算匹配防护技术重评，非仅代码可读性。", "reviewed_sections": [ "2.2 Security", "5.1 Security (SEC) metrics and exploit-based oracles", "5.2 Repository/agent security benchmarks", "Controlled re-evaluation" ], "id": "2610.38977", "version_id": "2610.38977v1", "source_url": "https://arxiv.org/pdf/2610.38977v1", "summary_zh": "综述 628 项研究，并在多个模型、仓库任务和安全等基准上重评改进技术。作者发现单一指标可被投机利用，预算匹配的分析器加权 best-of-n 通常匹配或优于规划、自修正、审阅智能体和检索；66 项技术中仅一项在主目标超出 95% 区间胜过该基线，强调独立指标及匹配预算。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "编码智能体安全产物评估及评估信号投机。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "2.2 Security", "5.1 Security (SEC) metrics and exploit-based oracles", "5.2 Repository/agent security benchmarks", "Controlled re-evaluation" ], "body_source_url": "https://arxiv.org/pdf/2610.38977v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-28T22:02:40Z", "updated": "2026-10-28T22:02:40Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CL", "cs.LG", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 67 of 67 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "New submissions (showing 35 of 35 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.38977v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Prashank Kadam", "affiliations": [ "Cerby Inc., USA" ], "shared_first_authors": [], "shared_first_note": "单作者。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "首页 PRASHANK KADAM, Cerby Inc., USA。", "id": "2610.38977", "version_id": "2610.38977v1", "source_url": "https://arxiv.org/pdf/2610.38977v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2510.18131": { "classification": "relevant", "reason": "正文定义输入提示注入与恶意指令、输出漏洞风险，并用红队工具及蓝队动态测试作实质安全防御。", "summary_zh": "BlueCodeAgent 先由红队生成多样风险和边界案例，再由蓝队总结可执行规则并用动态代码分析进行多层检测。四类任务包括偏见指令、恶意指令、脆弱代码及提示注入；GPT-4o 上相较直接提示平均 F1 提高 14.7%，动态分析减少漏洞检测误报。", "topics": { "tags": [ "injection", "monitoring", "evaluation", "robustness" ], "reason_zh": "代码生成安全蓝队与自动红队协作防御。" }, "id": "2510.18131", "abstract_read": true, "abstract_sha256": "f7f0bf8363c0a7043ceccf38738bcba2425b0f2c414e3870668ac7940482b10d", "read_source_abstract_sha256": "ba4af1dc6d240b058c184bd403fdc97e11daf1df51907f6fb96b83de17d5965f", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2510.18131v2", "title": "BlueCodeAgent: A Blue Teaming Agent Powered by Automated Red Teaming for CodeGen AI", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文定义输入提示注入与恶意指令、输出漏洞风险，并用红队工具及蓝队动态测试作实质安全防御。", "reviewed_sections": [ "3.1 Overview and Risk Definition", "3.2 automated red teaming", "3.3 blue-team constitutions and dynamic testing" ], "id": "2510.18131", "version_id": "2510.18131v2", "source_url": "https://arxiv.org/pdf/2510.18131v2", "summary_zh": "BlueCodeAgent 先由红队生成多样风险和边界案例，再由蓝队总结可执行规则并用动态代码分析进行多层检测。四类任务包括偏见指令、恶意指令、脆弱代码及提示注入；GPT-4o 上相较直接提示平均 F1 提高 14.7%，动态分析减少漏洞检测误报。", "topics": { "tags": [ "injection", "monitoring", "evaluation", "robustness" ], "reason_zh": "代码生成安全蓝队与自动红队协作防御。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3.1 Overview and Risk Definition", "3.2 automated red teaming", "3.3 blue-team constitutions and dynamic testing" ], "body_source_url": "https://arxiv.org/pdf/2510.18131v2", "evidence_level": "abstract_and_targeted_body", "published": "2025-10-20T22:00:10Z", "updated": "2026-10-29T07:08:07Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 38 of 38 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2510.18131v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "first_author": "Chengquan Guo", "affiliations": [ "University of Chicago" ], "shared_first_authors": [], "shared_first_note": "署名区无共同第一标记；通讯作者身份不作共同第一。", "author_source": "PDF 首页署名区与机构脚注", "status": "verified", "evidence": "Chengquan Guo¹；机构 1 为 University of Chicago, USA。", "id": "2510.18131", "version_id": "2510.18131v2", "source_url": "https://arxiv.org/pdf/2510.18131v2", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.40002": { "classification": "relevant", "reason": "正文将推理引导作用与闭环驾驶危害直接关联，300 场景评估责任碰撞和越界，责任碰撞由默认 13 次降至 7 次；满足具身安全危害评估范围。", "summary_zh": "CoC-CFG 在完整上下文与移除推理跨度的上下文之间调节引导权重，以冻结专家和固定噪声测量每步动作价值，训练小评论器保守调整控制器。Alpasim 闭环通过 262/300 场景，原策略为 252；Waymo 隐藏测试报告 8.135159 评分。", "topics": { "tags": [ "embodied", "robustness", "monitoring" ], "reason_zh": "具身策略对错误推理的依赖控制，需确认安全分析。" }, "id": "2610.40002", "abstract_read": true, "abstract_sha256": "ca755ec01e2ed8445f8ad40ac28676608c4d27e86f628318d81a293b1a2d142a", "read_source_abstract_sha256": "ca755ec01e2ed8445f8ad40ac28676608c4d27e86f628318d81a293b1a2d142a", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.40002v1", "title": "How Much Should a VLA Trust Its Reasoning? Step-Level Guidance as a Measured Action-Value Function", "initial_classification": "uncertain", "scope_review": { "classification": "relevant", "reason": "正文将推理引导作用与闭环驾驶危害直接关联，300 场景评估责任碰撞和越界，责任碰撞由默认 13 次降至 7 次；满足具身安全危害评估范围。", "reviewed_sections": [ "Q-adaptive guidance and deployment", "5.1 Alpasim closed-loop Table 2: at-fault collisions and off-road failures", "5.2 Waymo evaluation" ], "id": "2610.40002", "version_id": "2610.40002v1", "source_url": "https://arxiv.org/pdf/2610.40002v1", "summary_zh": "CoC-CFG 在完整上下文与移除推理跨度的上下文之间调节引导权重，以冻结专家和固定噪声测量每步动作价值，训练小评论器保守调整控制器。Alpasim 闭环通过 262/300 场景，原策略为 252；Waymo 隐藏测试报告 8.135159 评分。", "topics": { "tags": [ "embodied", "robustness", "monitoring" ], "reason_zh": "具身策略对错误推理的依赖控制，需确认安全分析。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "Q-adaptive guidance and deployment", "5.1 Alpasim closed-loop Table 2: at-fault collisions and off-road failures", "5.2 Waymo evaluation" ], "body_source_url": "https://arxiv.org/pdf/2610.40002v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T13:20:35Z", "updated": "2026-10-29T13:20:35Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.CV", "cs.LG", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Cross submissions (showing 159 of 159 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40002v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "first_author": "Dabin Seo", "affiliations": [ "Department of Mechanical Engineering, Seoul National University" ], "shared_first_authors": [], "shared_first_note": "第一作者无共同第一标记；星号在 Eunhyek Joa，未据此认定共一。", "author_source": "PDF 首页署名区", "status": "verified", "evidence": "Dabin Seo、Eunhyek Joa*；统一机构 Department of Mechanical Engineering, Seoul National University。", "id": "2610.40002", "version_id": "2610.40002v1", "source_url": "https://arxiv.org/pdf/2610.40002v1", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2605.02697": { "classification": "relevant", "reason": "正文处理非恶意但陈旧/冲突状态下的执行器授权有效性、版本租约和重试界限；不声称对抗恶意控制器，仍是智能体实质动作安全契约。", "summary_zh": "PRGA 为 Open RAN 智能体意图建立从评估到放行/终止的执行契约，以本地检查和选择性协调证据检索控制成本，按版本和租约重新验证授权，重试须记录进展且受预算限制。证据分配策略提高建模条件下及时有效放行率；无线仿真中版本拒绝后即时脚本重发使准时接收从 77.3% 升至 89.9%。", "topics": { "tags": [ "authorization", "monitoring", "embodied", "robustness" ], "reason_zh": "现实网络控制的执行器授权、时效性复查和有限重试。" }, "id": "2605.02697", "abstract_read": true, "abstract_sha256": "f0e7c49092f13ef76e4e9d2f43f41d3b033fbae30c78d0a0f17ee3b24207e1fb", "read_source_abstract_sha256": "f0e7c49092f13ef76e4e9d2f43f41d3b033fbae30c78d0a0f17ee3b24207e1fb", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2605.02697v2", "title": "Executor-Side Progressive Risk-Gated Actuation for Agentic AI in Wireless Supervisory Control", "initial_classification": "relevant", "scope_review": { "classification": "relevant", "reason": "正文处理非恶意但陈旧/冲突状态下的执行器授权有效性、版本租约和重试界限；不声称对抗恶意控制器，仍是智能体实质动作安全契约。", "reviewed_sections": [ "III.F Threat Model, Design Goals and Benchmark Correspondence", "IV executor contract and version-bound authorization fence" ], "id": "2605.02697", "version_id": "2605.02697v2", "source_url": "https://arxiv.org/pdf/2605.02697v2", "summary_zh": "PRGA 为 Open RAN 智能体意图建立从评估到放行/终止的执行契约，以本地检查和选择性协调证据检索控制成本，按版本和租约重新验证授权，重试须记录进展且受预算限制。证据分配策略提高建模条件下及时有效放行率；无线仿真中版本拒绝后即时脚本重发使准时接收从 77.3% 升至 89.9%。", "topics": { "tags": [ "authorization", "monitoring", "embodied", "robustness" ], "reason_zh": "现实网络控制的执行器授权、时效性复查和有限重试。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "III.F Threat Model, Design Goals and Benchmark Correspondence", "IV executor contract and version-bound authorization fence" ], "body_source_url": "https://arxiv.org/pdf/2605.02697v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-05-04T15:09:41Z", "updated": "2026-10-29T12:32:53Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.MA", "eess.SY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.MA", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.02697v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "seen_dates": [ "2026-10-31" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "first_author": "Zhenyu Liu", "affiliations": [ "6GIC, Institute for Communication Systems, University of Surrey" ], "shared_first_authors": [], "shared_first_note": "署名区无共同第一标记。", "author_source": "PDF 首页署名区与机构脚注", "status": "verified", "evidence": "Zhenyu Liu 首位；脚注 Z. Liu, Y. Ma, and R. Tafazolli are with the 6GIC, Institute for Communication Systems, University of Surrey。", "id": "2605.02697", "version_id": "2605.02697v2", "source_url": "https://arxiv.org/pdf/2605.02697v2", "author_status": "verified", "affiliation_status": "verified" }, "revision_history": [] }, "2610.34507": { "id": "2610.34507", "version_id": "2610.34507v3", "abstract_sha256": "d794c9bfb2f6921c830bcf7479aff925322cb57bbc9bbd16904d31c9f81a0eb9", "abstract_read": true, "classification": "uncertain", "reason_zh": "主动记忆召回随存储增长产生误触发，核心为打扰与检索性能而非安全约束。", "reason": "正文§5.8确含TriggerBench safe-coding约束召回，但主实验仍是主动记忆误触发/检索能力，没有验证不安全代码行动或攻击防御；与Agent安全边界仍不明确，保留待定而非强行排除。", "title": "The Price of Scale in Proactive Memory Recall", "initial_classification": "irrelevant", "scope_review": { "id": "2610.34507", "version_id": "2610.34507v3", "classification": "uncertain", "reason": "正文§5.8确含TriggerBench safe-coding约束召回，但主实验仍是主动记忆误触发/检索能力，没有验证不安全代码行动或攻击防御；与Agent安全边界仍不明确，保留待定而非强行排除。", "summary_zh": "研究长期助手记忆库增长时，固定相似度阈值为何产生越来越多无用提醒。作者将其建模为多重检验，并提出基于用户历史线索的共形门控；报告LongMemEval误触发约3–6%，但跨来源参考线索在LoCoMo表现不稳定。正文§5.8包含safe-coding等前瞻约束：受控误报下相似度门仅召回约5–9%约束，说明主题相近不等于约束应生效。尚未直接测试危险工具执行或攻击，故仍为范围待定。", "topics": { "tags": [ "memory", "evaluation", "robustness" ], "reason_zh": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.34507v3", "reviewed_sections": [ "摘要/引言", "§5.8前瞻记忆基准", "§6设计含义", "§7局限" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved_scope_uncertain" }, "summary_zh": "研究长期助手记忆库增长时，固定相似度阈值为何产生越来越多无用提醒。作者将其建模为多重检验，并提出基于用户历史线索的共形门控；报告LongMemEval误触发约3–6%，但跨来源参考线索在LoCoMo表现不稳定。正文§5.8包含safe-coding等前瞻约束：受控误报下相似度门仅召回约5–9%约束，说明主题相近不等于约束应生效。尚未直接测试危险工具执行或攻击，故仍为范围待定。", "topics": { "tags": [ "memory", "evaluation", "robustness" ], "reason_zh": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。" }, "full_text_checked": true, "reviewed_sections": [ "摘要/引言", "§5.8前瞻记忆基准", "§6设计含义", "§7局限" ], "body_source_url": "https://arxiv.org/pdf/2610.34507v3", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-25T19:07:36Z", "updated": "2026-11-03T15:28:41Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CL", "cs.IR", "stat.ML" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 77 of 77 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 27 of 27 entries)", "category": "stat.ML", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.34507v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "seen_dates": [ "2026-10-31", "2026-11-05" ], "version_history": [ { "id": "2610.34507", "title": "The Price of Scale in Proactive Memory Recall", "classification": "irrelevant", "reason": "长期助手主动记忆召回的误打扰控制，属于可用性/产品质量，没有数据泄露、投毒或安全后果。", "abstract_read": true, "source_index": 186, "version": 1, "published": "2026-10-25T19:07:36Z", "updated": "2026-10-25T19:07:36Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "2e6ec3a4fc253a6a558de6c0b8e22f1263d694c8863645d543993261b64a912b", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34507v1", "categories_seen": [ "cs.AI", "cs.CL", "cs.IR", "stat.ML" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 33 of 33 entries)", "category": "stat.ML", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "stat.ML", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34507v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" }, { "id": "2610.34507", "title": "The Price of Scale in Proactive Memory Recall", "classification": "uncertain", "reason": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。", "abstract_read": true, "source_index": 186, "version": 1, "published": "2026-10-25T19:07:36Z", "updated": "2026-10-29T05:14:03Z", "announcement_date": "2026-10-30", "candidate_type": "changed_version", "abstract_sha256": "b85770eb0fd9384d211c846b6cffb4c7fbc634223487ed796ed7efba9cf0ac2b", "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "version_id": "2610.34507v2", "categories_seen": [ "cs.AI", "cs.CL", "cs.IR", "stat.ML" ], "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 104 of 104 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "stat.ML", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "stat.ML", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34507v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "read_source_abstract_sha256": "d684fd2db219965d3f2e0199165b22366cf7891a54c202274a289d3b06dc45d2", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "initial_classification": "uncertain", "scope_review": { "id": "2610.34507", "version_id": "2610.34507v2", "classification": "uncertain", "reason": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。", "summary_zh": "主动记忆召回的误报随库规模增长，提出条件保证的门控机制；在前瞻记忆基准上受控误报时约束召回至多 9%，安全关联需正文确认。", "topics": { "tags": [ "memory", "evaluation", "robustness" ], "reason_zh": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.34507v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "1 Introduction", "5.8 A prospective-memory benchmark", "Appendix H TriggerBench" ] }, "reviewed_sections": [ "1 Introduction", "5.8 A prospective-memory benchmark", "Appendix H TriggerBench" ], "body_source_url": "https://arxiv.org/pdf/2610.34507v2" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.34507", "version_id": "2610.34507v3", "first_author": "Yichuan Chen", "affiliations": [ "School of Art and Design, Zhejiang Sci-Tech University" ], "shared_first_authors": [], "shared_first_note": "首页星号表示通讯作者。", "source_url": "https://arxiv.org/pdf/2610.34507v3", "author_source": "official_pdf_signature", "status": "verified", "evidence": "首页Yichuan Chen与Xin Wang作者行下统一机构为浙江理工大学艺术与设计学院。", "author_status": "verified", "affiliation_status": "verified" }, "read_source_abstract_sha256": "d684fd2db219965d3f2e0199165b22366cf7891a54c202274a289d3b06dc45d2", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "first_seen_date": "2026-10-31", "revision_history": [ { "id": "2610.34507", "abstract_sha256": "b85770eb0fd9384d211c846b6cffb4c7fbc634223487ed796ed7efba9cf0ac2b", "classification": "uncertain", "reason": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。", "abstract_read": true, "summary_zh": "主动记忆召回的误报随库规模增长，提出条件保证的门控机制；在前瞻记忆基准上受控误报时约束召回至多 9%，安全关联需正文确认。", "topics": { "tags": [ "memory", "evaluation", "robustness" ], "reason_zh": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。" }, "read_source_abstract_sha256": "d684fd2db219965d3f2e0199165b22366cf7891a54c202274a289d3b06dc45d2", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "manually_checked_formatting_and_link_expansion_only", "version_id": "2610.34507v2", "title": "The Price of Scale in Proactive Memory Recall", "initial_classification": "uncertain", "scope_review": { "id": "2610.34507", "version_id": "2610.34507v2", "classification": "uncertain", "reason": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。", "summary_zh": "主动记忆召回的误报随库规模增长，提出条件保证的门控机制；在前瞻记忆基准上受控误报时约束召回至多 9%，安全关联需正文确认。", "topics": { "tags": [ "memory", "evaluation", "robustness" ], "reason_zh": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.34507v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "1 Introduction", "5.8 A prospective-memory benchmark", "Appendix H TriggerBench" ] }, "full_text_checked": true, "reviewed_sections": [ "1 Introduction", "5.8 A prospective-memory benchmark", "Appendix H TriggerBench" ], "body_source_url": "https://arxiv.org/pdf/2610.34507v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-25T19:07:36Z", "updated": "2026-10-29T05:14:03Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI", "cs.CL", "cs.IR", "stat.ML" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 213 of 213 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 104 of 104 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-30", "section": "Replacement submissions (showing 50 of 50 entries)", "category": "stat.ML", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "stat.ML", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34507v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "version_history": [ { "id": "2610.34507", "title": "The Price of Scale in Proactive Memory Recall", "classification": "irrelevant", "reason": "长期助手主动记忆召回的误打扰控制，属于可用性/产品质量，没有数据泄露、投毒或安全后果。", "abstract_read": true, "source_index": 186, "version": 1, "published": "2026-10-25T19:07:36Z", "updated": "2026-10-25T19:07:36Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "2e6ec3a4fc253a6a558de6c0b8e22f1263d694c8863645d543993261b64a912b", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.34507v1", "categories_seen": [ "cs.AI", "cs.CL", "cs.IR", "stat.ML" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 33 of 33 entries)", "category": "stat.ML", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "stat.ML", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34507v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.34507", "version_id": "2610.34507v2", "first_author": "Yichuan Chen", "affiliations": [ "School of Art and Design, Zhejiang Sci-Tech University, Hangzhou, China" ], "shared_first_authors": [], "shared_first_note": "正文署名未注明共同第一作者。", "source_url": "https://arxiv.org/pdf/2610.34507v2", "author_source": "official_pdf_signature", "status": "verified", "evidence": "首页 Yichuan Chen*、Xin Wang 下方共享机构；* 明确为 Corresponding author，不是共同一作。", "author_status": "verified", "affiliation_status": "verified" }, "first_seen_date": "2026-10-31" } ] }, "2511.19405": { "id": "2511.19405", "classification": "relevant", "reason": "直接研究LLM多代理机会主义、利用对手与抗剥削合作。", "abstract_read": true, "abstract_sha256": "e176dfafe1ceb771922a839435dadfb4e690e2d477b3b86229e52629a7700b6f", "summary_zh": "【仅据摘要；作者声称】作者发现单代理式RL即使从合作先验开始也会收敛于机会主义策略，提出LLM尺度Advantage Alignment与群组相对基线，并新增需自然语言沟通的Trust-and-Split社会困境。实验称集体收益提高且抵抗贪婪代理利用，摘要无具体量化。", "topics": { "tags": [ "multiagent", "robustness" ], "reason_zh": "直接研究LLM多代理机会主义、利用对手与抗剥削合作。" }, "title": "Learning Robust Social Strategies with Large Language Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2511.19405v3", "published": "2025-11-24T18:43:46Z", "updated": "2026-10-30T14:42:44Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 139 of 139 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2511.19405v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2511.19405", "title": "Learning Robust Social Strategies with Large Language Models", "version_id": "2511.19405v3", "first_author": "Dereck Piche", "authors": [ "Dereck Piche", "Mohammed Muqeeth", "Milad Aghajohari", "Juan Duque", "Michael Noukhovitch", "Aaron Courville" ], "affiliations": [ "Mila", "University of Montreal" ], "source_url": "https://arxiv.org/pdf/2511.19405v3", "shared_first_authors": [ "Dereck Piche", "Mohammed Muqeeth" ], "shared_first_note": "论文首页 * 标记及 Equal contribution 脚注明确声明共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2601.08739": { "id": "2601.08739", "classification": "relevant", "reason": "多步远程规划、本地探索及记忆门控直接限制代理推理的累积信息暴露。", "abstract_read": true, "abstract_sha256": "faca6e68012ffd319a74aea17593fec0157e25de7652e0a1f212e7401c2ee40e", "summary_zh": "【仅据摘要；作者声称】Ctrl-G针对KG证据拓扑再识别和跨调用累积披露，构造本地净化图视图并以层级控制器联结远程规划与本地路径验证，复用抽象已验证记忆减少远程调用。作者报告六基准中五项最佳，最大准确率优势13.8点；摘要未列隐私攻击下降数值。", "topics": { "tags": [ "privacy", "memory", "monitoring" ], "reason_zh": "多步远程规划、本地探索及记忆门控直接限制代理推理的累积信息暴露。" }, "title": "Ctrl-G: Controlling Structural and Interaction Exposure in Knowledge Graph Augmented LLM Reasoning", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2601.08739v2", "published": "2026-01-13T17:14:23Z", "updated": "2026-10-30T09:58:07Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2601.08739v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2601.08739", "title": "Ctrl-G: Controlling Structural and Interaction Exposure in Knowledge Graph Augmented LLM Reasoning", "version_id": "2601.08739v2", "first_author": "Xingyu Tan", "authors": [ "Xingyu Tan", "Xiaoyang Wang", "Qing Liu", "Xiwei Xu", "Xin Yuan", "Liming Zhu", "Wenjie Zhang" ], "affiliations": [ "UNSW", "CSIRO" ], "source_url": "https://arxiv.org/pdf/2601.08739v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2603.07379": { "id": "2603.07379", "classification": "relevant", "reason": "综述明确涵盖agentic RAG记忆投毒、幻觉传播与级联工具漏洞。", "abstract_read": true, "abstract_sha256": "17a786c376bb224317e5aba6490717330bebea5d1677fbe7201f36f6b8daf0a2", "summary_zh": "【仅据摘要；作者声称】将代理检索生成循环形式化为有限时域POMDP，给出规划、检索、记忆与工具架构分类，讨论静态评测不足及记忆投毒、检索失配、工具执行风险。提出轨迹评估和监督研究路线；属于系统化综述，摘要无实验防御效果。", "topics": { "tags": [ "memory", "injection", "monitoring", "evaluation" ], "reason_zh": "综述明确涵盖agentic RAG记忆投毒、幻觉传播与级联工具漏洞。" }, "title": "SoK: Agentic Retrieval-Augmented Generation (RAG): Taxonomy, Architectures, Evaluation, and Research Directions", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2603.07379v2", "published": "2026-03-07T23:38:57Z", "updated": "2026-10-29T21:05:01Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR", "cs.IR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.07379v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.07379", "title": "SoK: Agentic Retrieval-Augmented Generation (RAG): Taxonomy, Architectures, Evaluation, and Research Directions", "version_id": "2603.07379v2", "first_author": "Saroj Mishra", "authors": [ "Saroj Mishra", "Suman Niroula", "Umesh Yadav", "Dilip Thakur", "Srijan Gyawali", "Shiva Gaire" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2603.07379v2", "shared_first_authors": [], "shared_first_note": "", "status": "unverified", "author_status": "verified", "affiliation_status": "retrieval_failed", "verification_status": "author_only", "evidence": "First author from arXiv metadata. Both official exact-version HTML and PDF returned HTTP 404; affiliation unconfirmed." }, "revision_history": [] }, "2603.15911": { "id": "2603.15911", "classification": "relevant", "reason": "正文直接审计编码代理审查的建议错误及人类把关；抽查383条未采纳建议中28.7%错误、24%替代修复。纳入编码代理可靠性审计；§V明确代码指标不能衡量漏洞、故障倾向，勿声称安全漏洞率。", "abstract_read": true, "abstract_sha256": "7d87458755fb8e357a242a1f43749680c6a0ca52cdf8946c1e19f24713a37a24", "summary_zh": "据摘要及必要正文核验，作者报告：研究300项目278790次代码审查对话，比较人工与代理建议、采纳和质量；作者发现代理建议采纳率更低，未采纳建议超过半数错误或另行修复，已采纳建议增加更多复杂度，主张人类监督。未直接检验安全漏洞或攻击。正文抽查383条未采纳建议，28.7%为错误代码、24.0%由人工替代修复；代码复杂度变化不等于安全漏洞或故障倾向变化。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "正文直接审计编码代理审查的建议错误及人类把关；抽查383条未采纳建议中28.7%错误、24%替代修复。纳入编码代理可靠性审计；§V明确代码指标不能衡量漏洞、故障倾向，勿声称安全漏洞率。" }, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "api_abstract_reread": true, "title": "Human-AI Synergy in Agentic Code Review", "initial_classification": "uncertain", "scope_review": { "id": "2603.15911", "version_id": "2603.15911v3", "classification": "relevant", "reason": "正文直接审计编码代理审查的建议错误及人类把关；抽查383条未采纳建议中28.7%错误、24%替代修复。纳入编码代理可靠性审计；§V明确代码指标不能衡量漏洞、故障倾向，勿声称安全漏洞率。", "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2603.15911v3", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§II agent identification and review labeling", "§III RQ3 adoption and manual audit", "§IV implications", "§V threats to validity" ], "summary_zh": "据摘要及必要正文核验，作者报告：研究300项目278790次代码审查对话，比较人工与代理建议、采纳和质量；作者发现代理建议采纳率更低，未采纳建议超过半数错误或另行修复，已采纳建议增加更多复杂度，主张人类监督。未直接检验安全漏洞或攻击。正文抽查383条未采纳建议，28.7%为错误代码、24.0%由人工替代修复；代码复杂度变化不等于安全漏洞或故障倾向变化。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "正文直接审计编码代理审查的建议错误及人类把关；抽查383条未采纳建议中28.7%错误、24%替代修复。纳入编码代理可靠性审计；§V明确代码指标不能衡量漏洞、故障倾向，勿声称安全漏洞率。" } }, "reviewed_sections": [ "§II agent identification and review labeling", "§III RQ3 adoption and manual audit", "§IV implications", "§V threats to validity" ], "body_source_url": "https://arxiv.org/pdf/2603.15911v3", "version_id": "2603.15911v3", "published": "2026-03-16T20:56:18Z", "updated": "2026-10-30T14:24:37Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.SE" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 10 of 10 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.15911v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "seen_dates": [ "2026-11-03" ], "version_history": [ { "id": "2603.15911", "title": "Human-AI Synergy in Agentic Code Review", "classification": "irrelevant", "reason": "比较人类与编码Agent的代码审查建议、采纳和复杂度，关注开发质量，没有安全漏洞或攻击防御专项评测。 此条为修订版本，不能仅因更新时间计为今日新论文。", "abstract_read": true, "source_index": 43, "version": 2, "published": "2026-03-16T20:56:18Z", "updated": "2026-10-26T03:22:11Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "7d87458755fb8e357a242a1f43749680c6a0ca52cdf8946c1e19f24713a37a24", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2603.15911v2", "categories_seen": [ "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 27 of 27 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.15911v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2603.15911", "title": "Human-AI Synergy in Agentic Code Review", "version_id": "2603.15911v3", "first_author": "Suzhen Zhong", "authors": [ "Suzhen Zhong", "Shayan Noei", "Ying Zou", "Bram Adams" ], "affiliations": [ "Department of Electrical and Computer Engineering, Queen’s University" ], "source_url": "https://arxiv.org/pdf/2603.15911v3", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "first_seen_date": "2026-11-03", "revision_history": [] }, "2603.17969": { "id": "2603.17969", "classification": "relevant", "reason": "机器人基础模型部署时的硬安全与时空约束强制满足直接属于具身代理安全。", "abstract_read": true, "abstract_sha256": "d7ae2566219c42be4c3504acbd4ba8a7ca1f14ce03ace2f014249182d67703ca", "summary_zh": "【仅据摘要；作者声称】提出不改模型参数的动作分布优化，每一步通过动力学传播和剩余时域推理，对原分布作最小修改以满足Signal Temporal Logic硬可行性约束。作者在多环境与复杂规格下仿真验证；摘要未给量化成功率。", "topics": { "tags": [ "embodied", "robustness" ], "reason_zh": "机器人基础模型部署时的硬安全与时空约束强制满足直接属于具身代理安全。" }, "title": "Specification-Aware Distribution Shaping for Robotics Foundation Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2603.17969v2", "published": "2026-03-18T17:36:46Z", "updated": "2026-10-30T15:28:37Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.17969v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.17969", "title": "Specification-Aware Distribution Shaping for Robotics Foundation Models", "version_id": "2603.17969v2", "first_author": "Sadık Bera Yüksel", "authors": [ "Sadık Bera Yüksel", "Derya Aksaray" ], "affiliations": [ "Department of Electrical and Computer Engineering, Northeastern University" ], "source_url": "https://arxiv.org/pdf/2603.17969v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2603.22577": { "id": "2603.22577", "classification": "relevant", "reason": "正文III-C明确工具执行前模式校验、沙箱及IPv4/二进制允许列表，属于MCP代理执行边界；但通用命令工具约束很弱，正文承认未保留逐调用日志、未隔离协议的安全因果效应。", "abstract_read": true, "abstract_sha256": "bb2ef3e0ad1acdc0bb019757731c79abb70d87c326a804ae6fa85f89ac300ebe", "summary_zh": "【摘要与定向正文；作者报告】STRIATUM-CTF以MCP类型化工具、沙箱及侦察允许列表中介自主安全代理执行，拒绝格式错误调用并反馈纠正。180次运行比较文档量，成功率77.8%—86.7%但组间无显著差异。正文明确此非协议防护收益的因果验证：通用shell工具约束弱，合法调用挂起不受模式校验保护，缺乏逐调用日志。", "topics": { "tags": [ "authorization", "supplychain", "robustness", "evaluation" ], "reason_zh": "正文III-C明确工具执行前模式校验、沙箱及IPv4/二进制允许列表，属于MCP代理执行边界；但通用命令工具约束很弱，正文承认未保留逐调用日志、未隔离协议的安全因果效应。" }, "title": "STRIATUM-CTF: A Protocol-Driven Agentic Framework for Autonomous CTF Solving", "initial_classification": "uncertain", "scope_review": { "id": "2603.22577", "version_id": "2603.22577v2", "classification": "relevant", "reason": "正文III-C明确工具执行前模式校验、沙箱及IPv4/二进制允许列表，属于MCP代理执行边界；但通用命令工具约束很弱，正文承认未保留逐调用日志、未隔离协议的安全因果效应。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2603.22577v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "III Methodology", "IV-C2 Schema-mediated error recovery", "V-A Threats to Validity", "V-C Future Work" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】STRIATUM-CTF以MCP类型化工具、沙箱及侦察允许列表中介自主安全代理执行，拒绝格式错误调用并反馈纠正。180次运行比较文档量，成功率77.8%—86.7%但组间无显著差异。正文明确此非协议防护收益的因果验证：通用shell工具约束弱，合法调用挂起不受模式校验保护，缺乏逐调用日志。", "topics": { "tags": [ "authorization", "supplychain", "robustness", "evaluation" ], "reason_zh": "正文III-C明确工具执行前模式校验、沙箱及IPv4/二进制允许列表，属于MCP代理执行边界；但通用命令工具约束很弱，正文承认未保留逐调用日志、未隔离协议的安全因果效应。" } }, "full_text_checked": true, "reviewed_sections": [ "III Methodology", "IV-C2 Schema-mediated error recovery", "V-A Threats to Validity", "V-C Future Work" ], "body_source_url": "https://arxiv.org/html/2603.22577v2", "evidence_level": "abstract_and_targeted_body", "version_id": "2603.22577v2", "published": "2026-03-23T21:17:26Z", "updated": "2026-10-29T18:13:48Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 13 of 13 entries)", "category": "cs.MA", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.22577v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.22577", "title": "STRIATUM-CTF: A Protocol-Driven Agentic Framework for Autonomous CTF Solving", "version_id": "2603.22577v2", "first_author": "James Hugglestone", "authors": [ "James Hugglestone", "Samuel Jacob Chacko", "Dawson Stoller", "Ryan Schmidt", "Xiuwen Liu" ], "affiliations": [ "Department of Computer Science, Florida State University" ], "source_url": "https://arxiv.org/pdf/2603.22577v2", "shared_first_authors": [ "James Hugglestone", "Samuel Jacob Chacko" ], "shared_first_note": "论文首页 * 标记及 Equal contribution / contributed equally 脚注明确声明共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2605.16363": { "id": "2605.16363", "classification": "relevant", "reason": "正文是有实体记忆、检索技能演化及风险评估器的流式防诈代理，并直接评测早期告警与误报的可靠性；作为安全监测代理应用纳入，不声称保护代理自身免于注入。", "abstract_read": true, "abstract_sha256": "0090cc79589d460542a7798a2cb729809a67d8d59c2149e555d3ff40a7b4203b", "summary_zh": "【摘要与定向正文；作者报告】ORACLE通过人物中心记忆和可演化检索技能串联跨App诈骗线索，以技能指导蒸馏训练风险判断。基准将案件记录与普通使用轨迹构建成长序列，非真实在线拦截部署。作者报告4B配置命中率63.8%、误报率14.8%、部分观察告警率76.5%，记忆与技能消融支持早期证据整合；并非所有指标超越大模型。", "topics": { "tags": [ "monitoring", "memory", "evaluation" ], "reason_zh": "正文是有实体记忆、检索技能演化及风险评估器的流式防诈代理，并直接评测早期告警与误报的可靠性；作为安全监测代理应用纳入，不声称保护代理自身免于注入。" }, "title": "ORACLE: Anticipating Scams from Partial Trajectories in Streaming App Usage", "initial_classification": "uncertain", "scope_review": { "id": "2605.16363", "version_id": "2605.16363v2", "classification": "relevant", "reason": "正文是有实体记忆、检索技能演化及风险评估器的流式防诈代理，并直接评测早期告警与误报的可靠性；作为安全监测代理应用纳入，不声称保护代理自身免于注入。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2605.16363v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "2 Streaming Scam Benchmark", "3 ORACLE", "3.1 Self-Evolving Context Manager", "4.1 Main Results", "4.2 Ablation Study" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】ORACLE通过人物中心记忆和可演化检索技能串联跨App诈骗线索，以技能指导蒸馏训练风险判断。基准将案件记录与普通使用轨迹构建成长序列，非真实在线拦截部署。作者报告4B配置命中率63.8%、误报率14.8%、部分观察告警率76.5%，记忆与技能消融支持早期证据整合；并非所有指标超越大模型。", "topics": { "tags": [ "monitoring", "memory", "evaluation" ], "reason_zh": "正文是有实体记忆、检索技能演化及风险评估器的流式防诈代理，并直接评测早期告警与误报的可靠性；作为安全监测代理应用纳入，不声称保护代理自身免于注入。" } }, "full_text_checked": true, "reviewed_sections": [ "2 Streaming Scam Benchmark", "3 ORACLE", "3.1 Self-Evolving Context Manager", "4.1 Main Results", "4.2 Ablation Study" ], "body_source_url": "https://arxiv.org/html/2605.16363v2", "evidence_level": "abstract_and_targeted_body", "version_id": "2605.16363v2", "published": "2026-05-09T16:26:16Z", "updated": "2026-10-30T09:41:07Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CY", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 139 of 139 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.16363v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.16363", "title": "ORACLE: Anticipating Scams from Partial Trajectories in Streaming App Usage", "version_id": "2605.16363v2", "first_author": "Wenbo Gao", "authors": [ "Wenbo Gao", "Songbai Tan", "Zhongan Wang", "Fei Shen", "Gang Xu", "Huiping Zhuang", "Yunyun Yang", "Ming Li", "Xiaofeng Zhu" ], "affiliations": [ "Harbin Institute of Technology, Shenzhen" ], "source_url": "https://arxiv.org/pdf/2605.16363v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2605.17467": { "id": "2605.17467", "classification": "relevant", "reason": "多代理全轨迹故障归因，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "bd29612b1fd9bcdfac3f9a65a321bc23f642d590f8c5102e427501d4d69be749", "summary_zh": "仅据摘要，作者声称：VerifyMAS针对局部日志漏掉跨步骤和跨代理失败，将归因拆成完整轨迹上的失败假设验证与代理定位，使用结构化错误分类训练验证器；作者在Aegis-Bench和Who&When报告多种骨干优于既有方法且不损失长轨迹推理效率，摘要无具体提升值。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "多代理全轨迹故障归因，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "VerifyMAS: Hypothesis Verification for Failure Attribution in LLM-based Multi-Agent Systems", "version_id": "2605.17467v3", "published": "2026-05-17T14:09:35Z", "updated": "2026-10-30T11:29:32Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CL" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.17467v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "seen_dates": [ "2026-11-03" ], "version_history": [ { "id": "2605.17467", "title": "VerifyMAS: Hypothesis Verification for Failure Attribution in LLM-based Multi-Agent Systems", "classification": "irrelevant", "reason": "正文表 5 的 14 类是任务偏离、角色分工、冗余步骤、记忆忽略、协调和验证错误，评测在 Aegis-Bench/Who&When/TRAIL 上定位失败 Agent 与步骤。没有将角色错误落实为权限扩张、恶意通信或安全后果，属于普通多 Agent 可靠性归因，不能因监控/验证措辞自动纳入 Agent Safety。", "abstract_read": true, "source_index": 62, "version_id": "2605.17467v2", "version": 2, "published": "2026-05-17T14:09:35Z", "updated": "2026-10-25T11:53:56Z", "initial_classification": "uncertain", "scope_review": { "id": "2605.17467", "title": "VerifyMAS: Hypothesis Verification for Failure Attribution in LLM-based Multi-Agent Systems", "version_id": "2605.17467v2", "original_classification": "uncertain", "classification": "irrelevant", "reason": "正文表 5 的 14 类是任务偏离、角色分工、冗余步骤、记忆忽略、协调和验证错误，评测在 Aegis-Bench/Who&When/TRAIL 上定位失败 Agent 与步骤。没有将角色错误落实为权限扩张、恶意通信或安全后果，属于普通多 Agent 可靠性归因，不能因监控/验证措辞自动纳入 Agent Safety。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 失败假设验证", "§4 实验与结果", "表 5 错误分类", "Limitation and Future Work" ], "source_url": "https://arxiv.org/pdf/2605.17467v2" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3 失败假设验证", "§4 实验与结果", "表 5 错误分类", "Limitation and Future Work" ], "body_source_url": "https://arxiv.org/pdf/2605.17467v2", "evidence_level": "abstract_and_targeted_body", "announcement_date": "2026-10-27", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-27", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.17467v2", "abstract_sha256": "0d0c9a354d00a6797a99e8350a8867e4eb9ffb094c61d23eca72935248f1dbf3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2605.17467", "title": "VerifyMAS: Hypothesis Verification for Failure Attribution in LLM-based Multi-Agent Systems", "version_id": "2605.17467v3", "first_author": "Hezhe Qiao", "authors": [ "Hezhe Qiao", "Hanghang Tong", "Ee-Peng Lim", "Bing Liu", "Guansong Pang" ], "affiliations": [ "Singapore Management University" ], "source_url": "https://arxiv.org/pdf/2605.17467v3", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "first_seen_date": "2026-11-03", "revision_history": [] }, "2606.16562": { "id": "2606.16562", "classification": "relevant", "reason": "明确审计模拟代理高后果决策中的宗教身份偏差与检索时效放大。", "abstract_read": true, "abstract_sha256": "6320276084dc04d2f7e3cab6fd9516856961aec4a53011827b9a72266e2fb049", "summary_zh": "【仅据摘要；作者声称】MIRAGE含1200提示，比较直接回答、推理和内容审核/贷款/难民/招聘模拟代理决策。六模型中作者报告相同证据下代理身份差异9—22个百分点，近期冲突新闻检索放大偏差18—27%，直接回答缓解方法难迁移至代理情境。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "明确审计模拟代理高后果决策中的宗教身份偏差与检索时效放大。" }, "title": "MIRAGE: Auditing Anti-Muslim Bias in Frontier LLMs Across Reasoning, Agentic, and Time-Coupled Conditions", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2606.16562v2", "published": "2026-06-15T11:04:42Z", "updated": "2026-10-30T16:56:29Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 139 of 139 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.16562v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.16562", "title": "MIRAGE: Auditing Anti-Muslim Bias in Frontier LLMs Across Reasoning, Agentic, and Time-Coupled Conditions", "version_id": "2606.16562v2", "first_author": "Noor Islam S. Mohammad", "authors": [ "Noor Islam S. Mohammad", "Tamim Sheikh" ], "affiliations": [], "source_url": "https://arxiv.org/abs/2606.16562v2", "shared_first_authors": [], "shared_first_note": "", "status": "unverified", "author_status": "verified", "affiliation_status": "retrieval_failed", "verification_status": "author_only", "evidence": "First author from arXiv metadata. Both official exact-version HTML and PDF returned HTTP 404; affiliation unconfirmed." }, "revision_history": [] }, "2607.27914": { "id": "2607.27914", "classification": "relevant", "reason": "正文明确闭环LLM每五分钟控制七执行器，并测温度和CO2约束违反；输入解析与动作限幅不保证轨迹安全，研究揭示验证器相关性与动作排序及实际合规脱节，属于具身代理安全可靠性评估。", "abstract_read": true, "abstract_sha256": "be951f7dcadd664866c59de137b867e09c5c9c0327763726cafd5e62f1ae3da5", "summary_zh": "【摘要与定向正文；作者报告】楼宇LLM控制器生成七维动作，解析检查和限幅只能保证执行器范围，不能保证通风安全。四区五日仿真中GPT-5节电6.8%—7.4%但CO2合规较差；价值验证器总相关性0.9995，却仅30个状态中7个选对最佳动作。一次200步精确rollout奖励微调无持续闭环改善，不能据此外推真实建筑安全。", "topics": { "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "正文明确闭环LLM每五分钟控制七执行器，并测温度和CO2约束违反；输入解析与动作限幅不保证轨迹安全，研究揭示验证器相关性与动作排序及实际合规脱节，属于具身代理安全可靠性评估。" }, "title": "Evaluating Rollout-Verified Reinforcement Fine-Tuning of a Reasoning Model for Multi-Zone Variable-Air-Volume Control", "initial_classification": "uncertain", "scope_review": { "id": "2607.27914", "version_id": "2607.27914v2", "classification": "relevant", "reason": "正文明确闭环LLM每五分钟控制七执行器，并测温度和CO2约束违反；输入解析与动作限幅不保证轨迹安全，研究揭示验证器相关性与动作排序及实际合规脱节，属于具身代理安全可靠性评估。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2607.27914v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "1.1 Large language models and reasoning models", "2.1 LLM controller design", "2.2 Verifier design and selection", "4.2 Control results", "4.3 Rollout-verified RFT" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】楼宇LLM控制器生成七维动作，解析检查和限幅只能保证执行器范围，不能保证通风安全。四区五日仿真中GPT-5节电6.8%—7.4%但CO2合规较差；价值验证器总相关性0.9995，却仅30个状态中7个选对最佳动作。一次200步精确rollout奖励微调无持续闭环改善，不能据此外推真实建筑安全。", "topics": { "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "正文明确闭环LLM每五分钟控制七执行器，并测温度和CO2约束违反；输入解析与动作限幅不保证轨迹安全，研究揭示验证器相关性与动作排序及实际合规脱节，属于具身代理安全可靠性评估。" } }, "full_text_checked": true, "reviewed_sections": [ "1.1 Large language models and reasoning models", "2.1 LLM controller design", "2.2 Verifier design and selection", "4.2 Control results", "4.3 Rollout-verified RFT" ], "body_source_url": "https://arxiv.org/html/2607.27914v2", "evidence_level": "abstract_and_targeted_body", "version_id": "2607.27914v2", "published": "2026-07-30T09:28:37Z", "updated": "2026-10-30T11:18:30Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.LG", "eess.SY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 139 of 139 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2607.27914v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.27914", "title": "Evaluating Rollout-Verified Reinforcement Fine-Tuning of a Reasoning Model for Multi-Zone Variable-Air-Volume Control", "version_id": "2607.27914v2", "first_author": "Takumi Shioda", "authors": [ "Takumi Shioda", "Kohei Terashima", "Tatsuo Nagai" ], "affiliations": [ "The University of Tokyo" ], "source_url": "https://arxiv.org/pdf/2607.27914v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2608.19857": { "id": "2608.19857", "classification": "relevant", "reason": "仅依据完整摘要：代理持有的秘密通过正常输出隐蔽泄漏，含记忆属性及实际代理攻击。", "abstract_read": true, "abstract_sha256": "f98b2c63e3b3e72e8373332bef28e4ce91d70bbbf599cb4a544c25566a2619fa", "summary_zh": "【仅摘要证据；结果为作者声称】代理上下文秘密即使不直接输出，也可能改变普通回答统计。文章提出黑盒自适应重建攻击，作者报告受控实验四位秘密精确恢复率82%，并展示从用户记忆推断语义属性、从生产式代理提取完整社保号的攻击。", "topics": { "tags": [ "privacy", "memory", "injection" ], "reason_zh": "代理持有的秘密通过正常输出隐蔽泄漏，含记忆属性及实际代理攻击。" }, "title": "Inadvertent Context Leakage in Language Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2608.19857v2", "published": "2026-08-20T10:05:29Z", "updated": "2026-10-29T22:47:00Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 139 of 139 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.19857v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.19857", "title": "Inadvertent Context Leakage in Language Models", "version_id": "2608.19857v2", "first_author": "Jaiden Fairoze", "authors": [ "Jaiden Fairoze", "Neal Mangaokar", "Kamalika Chaudhuri", "Sanjam Garg", "Saeed Mahloujifar" ], "affiliations": [ "FAIR, Meta Superintelligence Labs", "University of California, Berkeley" ], "source_url": "https://arxiv.org/pdf/2608.19857v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2608.27009": { "id": "2608.27009", "classification": "relevant", "reason": "代理动作护栏对合法操作的过度拒绝（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "01dc308885f0779216d62ac9ff740fcf541bfb67fb90b3224d2722f204f781a7", "summary_zh": "仅据摘要，作者声称：针对代理护栏误拒合法操作，Cautious Bench把案例和授权规则共同构造并机械校验标签；作者在2268对可判定样例及6种护栏上发现仅把对象名称改为吓人的词就增加误拒，显示护栏过度依赖名称而非授权上下文。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "代理动作护栏对合法操作的过度拒绝" }, "title": "The Guard That Cried Wolf: How Scary Words Make Agent Guardrails Refuse Legitimate Actions", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2608.27009v2", "published": "2026-08-27T11:55:22Z", "updated": "2026-10-30T11:42:08Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.27009v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.27009", "title": "The Guard That Cried Wolf: How Scary Words Make Agent Guardrails Refuse Legitimate Actions", "version_id": "2608.27009v2", "first_author": "Yingjie Zhang", "authors": [ "Yingjie Zhang", "Yuanbo Xie", "Kai Chen" ], "affiliations": [ "Institute of Information Engineering, Chinese Academy of Sciences", "School of Cyber Security, University of Chinese Academy of Sciences" ], "source_url": "https://arxiv.org/pdf/2608.27009v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2608.27443": { "id": "2608.27443", "classification": "relevant", "reason": "用户权限策略控制代理越权的实证研究（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "ee9ee037743d418f5d8e4ae6b12a54ae79c98563ff2f0de14339d0fb8b6f804e", "summary_zh": "仅据摘要，作者声称：比较用户预设允许/询问/禁止策略与逐动作人工审批及模型审批；113人模拟日研究中，作者报告策略组越权拦截比人工组低20.1个百分点、比自动组低14.5点，提示次数下降但总干预时间未可靠降低，越权多在人类批准后发生。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "用户权限策略控制代理越权的实证研究" }, "title": "Do User-Authored Permission Policies Improve Protection Against AI Agent Overreach?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2608.27443v2", "published": "2026-08-27T17:56:38Z", "updated": "2026-10-30T13:47:21Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR", "cs.HC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 18 of 18 entries)", "category": "cs.CR", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.27443v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.27443", "title": "Do User-Authored Permission Policies Improve Protection Against AI Agent Overreach?", "version_id": "2608.27443v2", "first_author": "Ting Yan", "authors": [ "Ting Yan" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2608.27443v2", "shared_first_authors": [], "shared_first_note": "", "status": "unverified", "author_status": "verified", "affiliation_status": "not_stated", "verification_status": "author_only", "evidence": "First-page author block checked; no affiliation stated. Emails not used to infer affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.03498": { "id": "2610.03498", "classification": "relevant", "reason": "直接防御VLA机器人控制中的视觉对抗贴片。", "abstract_read": true, "abstract_sha256": "86a8e04896dca0b01fd5bd05b6af934b027133318495c4dbf756c5284ba873cf", "summary_zh": "【仅据摘要；作者声称】用稀疏自编码器识别与攻击贴片强相关的内部特征，在线性探针检测到攻击时条件性抑制。LIBERO-10实验称间歇攻击下成功率改善，而连续无条件干预明显伤害正常策略；摘要未给具体提升量。", "topics": { "tags": [ "embodied", "robustness" ], "reason_zh": "直接防御VLA机器人控制中的视觉对抗贴片。" }, "title": "Detect and Suppress: A Mechanistic Defense against Adversarial Patches in VLA Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.03498v2", "published": "2026-10-02T15:57:04Z", "updated": "2026-10-30T13:17:07Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.03498v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.03498", "title": "Detect and Suppress: A Mechanistic Defense against Adversarial Patches in VLA Models", "version_id": "2610.03498v2", "first_author": "Yukiya Horiba", "authors": [ "Yukiya Horiba", "Koshiro Aoki", "Shunsuke Yasuki", "Bum Jun Kim", "Taiki Miyanishi" ], "affiliations": [ "Keio University" ], "source_url": "https://arxiv.org/pdf/2610.03498v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.10611": { "id": "2610.10611", "classification": "relevant", "reason": "仅依据完整摘要：自改进代理验证接口、权限变化与可靠后继选择的边界。", "abstract_read": true, "abstract_sha256": "2347c66f6824f06cdbf50a4c40fcce336d7d746b3fafbc6275c34ec7edab250c", "summary_zh": "【仅摘要证据；结果为作者声称】自改进代理更常找到解，不代表验证接口能接受更多任务。框架区分默认支持可达范围与接口闭包，研究权限变化和后继选择契约；作者在36864对布尔程序修复运行中显示反馈减少验证调用但不扩大覆盖，只有强制权限改变才接纳新目标。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "自改进代理验证接口、权限变化与可靠后继选择的边界。" }, "title": "Verification and Self-Improvement in Agentic AI: Foundations and Limits", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.10611v2", "published": "2026-10-07T06:47:49Z", "updated": "2026-10-30T14:29:44Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 111 of 111 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.10611v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.10611", "title": "Verification and Self-Improvement in Agentic AI: Foundations and Limits", "version_id": "2610.10611v2", "first_author": "Chien-Ping Lu", "authors": [ "Chien-Ping Lu" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.10611v2", "shared_first_authors": [], "shared_first_note": "", "status": "unverified", "author_status": "verified", "affiliation_status": "not_stated", "verification_status": "author_only", "evidence": "First-page author block checked; no affiliation stated. No employer inference.", "affiliation_checked": true }, "revision_history": [] }, "2610.34422": { "id": "2610.34422", "classification": "relevant", "reason": "§III-C以独立证据核验编码代理宣称的L0–L4完成度，§IV诊断静默错误和错误成功声明，§V限制为单代理十项目。属于直接编码代理可靠性/监督审计，非单纯迁移性能。", "abstract_read": true, "abstract_sha256": "8735a6182f2fe35247bf59fef2a01c45ff5234afc90b7197588f32b4e9e68e60", "summary_zh": "据摘要及必要正文核验，作者报告：用Claude Code迁移十个PyTorch项目到TPU，独立核验执行、数值、硬件和项目目标；作者报告70次尝试53次失败，其中26次静默，一项错误梯度裁剪让准确率86.53%降至84.89%却宣称成功。强调独立基准验证，属编码可靠性边界。正文采用独立L0–L4核验、审批与停止门，区分代理预期过乐观和最终错误成功声明；研究仅十项目、单代理，作者不主张统计泛化。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "§III-C以独立证据核验编码代理宣称的L0–L4完成度，§IV诊断静默错误和错误成功声明，§V限制为单代理十项目。属于直接编码代理可靠性/监督审计，非单纯迁移性能。" }, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "api_abstract_reread": true, "title": "From GPU to TPU with Coding Agents: What Works, What Fails, and What It Costs?", "initial_classification": "uncertain", "scope_review": { "id": "2610.34422", "version_id": "2610.34422v2", "classification": "relevant", "reason": "§III-C以独立证据核验编码代理宣称的L0–L4完成度，§IV诊断静默错误和错误成功声明，§V限制为单代理十项目。属于直接编码代理可靠性/监督审计，非单纯迁移性能。", "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.34422v2", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§III-C agent setup and independent checks", "§IV results and multi-chip case", "§IV-D practice implications", "§V threats to validity" ], "summary_zh": "据摘要及必要正文核验，作者报告：用Claude Code迁移十个PyTorch项目到TPU，独立核验执行、数值、硬件和项目目标；作者报告70次尝试53次失败，其中26次静默，一项错误梯度裁剪让准确率86.53%降至84.89%却宣称成功。强调独立基准验证，属编码可靠性边界。正文采用独立L0–L4核验、审批与停止门，区分代理预期过乐观和最终错误成功声明；研究仅十项目、单代理，作者不主张统计泛化。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "§III-C以独立证据核验编码代理宣称的L0–L4完成度，§IV诊断静默错误和错误成功声明，§V限制为单代理十项目。属于直接编码代理可靠性/监督审计，非单纯迁移性能。" } }, "reviewed_sections": [ "§III-C agent setup and independent checks", "§IV results and multi-chip case", "§IV-D practice implications", "§V threats to validity" ], "body_source_url": "https://arxiv.org/pdf/2610.34422v2", "version_id": "2610.34422v2", "published": "2026-10-25T16:21:56Z", "updated": "2026-10-29T18:31:39Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.DC", "cs.LG", "cs.SE" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 10 of 10 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Replacement submissions (showing 139 of 139 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34422v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "seen_dates": [ "2026-11-03" ], "version_history": [ { "id": "2610.34422", "title": "From GPU to TPU with Coding Agents: What Works, What Fails, and What It Costs?", "classification": "irrelevant", "reason": "研究对象是 Coding Agent 迁移 ML 工作负载的数值等价、设备放置、训练目标和性能，揭示静默退化与成功误报；未研究漏洞、攻击、越权副作用或安全关键不变量。独立验收的建议有工程价值，但不足以把一般迁移正确性/可靠性纳入 Agent Safety。", "abstract_read": true, "source_index": 179, "version": 1, "published": "2026-10-25T16:21:56Z", "updated": "2026-10-25T16:21:56Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "abstract_sha256": "8735a6182f2fe35247bf59fef2a01c45ff5234afc90b7197588f32b4e9e68e60", "initial_classification": "uncertain", "scope_review": { "id": "2610.34422", "title": "From GPU to TPU with Coding Agents: What Works, What Fails, and What It Costs?", "version_id": "2610.34422v1", "original_classification": "uncertain", "classification": "irrelevant", "reason": "研究对象是 Coding Agent 迁移 ML 工作负载的数值等价、设备放置、训练目标和性能，揭示静默退化与成功误报；未研究漏洞、攻击、越权副作用或安全关键不变量。独立验收的建议有工程价值，但不足以把一般迁移正确性/可靠性纳入 Agent Safety。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§I 三项研究问题", "§IV 失败与实践启示", "§V 有效性威胁", "§VI 结论" ], "source_url": "https://arxiv.org/pdf/2610.34422v1" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§I 三项研究问题", "§IV 失败与实践启示", "§V 有效性威胁", "§VI 结论" ], "body_source_url": "https://arxiv.org/pdf/2610.34422v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.34422v1", "categories_seen": [ "cs.DC", "cs.LG", "cs.SE" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "New submissions (showing 62 of 62 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 200 of 200 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.34422v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.34422", "title": "From GPU to TPU with Coding Agents: What Works, What Fails, and What It Costs?", "version_id": "2610.34422v2", "first_author": "Hui Sun", "authors": [ "Hui Sun", "Anderson Uchôa", "Wesley K. G. Assunção" ], "affiliations": [ "North Carolina State University" ], "source_url": "https://arxiv.org/pdf/2610.34422v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "first_seen_date": "2026-11-03", "revision_history": [] }, "2610.40714": { "id": "2610.40714", "classification": "relevant", "reason": "直接研究自主代理多步任务的信息泄漏及分享授权边界。", "abstract_read": true, "abstract_sha256": "1c2c90d8dbdddf7d8fe9faf1b3ff27754eeea2e562980f4f2b060838aa509604", "summary_zh": "【仅据摘要；作者声称】问题是个人数据工作流中的情境隐私失配；提出含5873任务、986序列的PrivacyBench及分离隐私规划与执行的PrivacyFlow，追踪来源、接收者知识和披露推断风险，决定最小化执行、阻止或询问用户。作者报告六个模型的无检测隐私违规完成序列占比提高22—55个百分点，并指出隐私、效用与自主性权衡。", "topics": { "tags": [ "privacy", "authorization", "evaluation" ], "reason_zh": "直接研究自主代理多步任务的信息泄漏及分享授权边界。" }, "title": "PrivacyFlow: Privacy in AI Agents through Information Flow Analysis and Consequence-Aware Risk Management", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40714v1", "published": "2026-10-29T01:54:36Z", "updated": "2026-10-29T01:54:36Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 87 of 87 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40714v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40714", "title": "PrivacyFlow: Privacy in AI Agents through Information Flow Analysis and Consequence-Aware Risk Management", "version_id": "2610.40714v1", "first_author": "Robin Staab", "authors": [ "Robin Staab", "Tom Wollschläger", "Vahab Mirrokni", "Reza Shokri" ], "affiliations": [ "Google Research", "ETH Zurich" ], "source_url": "https://arxiv.org/pdf/2610.40714v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.40716": { "id": "2610.40716", "classification": "relevant", "reason": "仅依据完整摘要：模块遮蔽造成代理执行不可信代码，并检验安全报告与独立日志的一致性。", "abstract_read": true, "abstract_sha256": "6488f8ace61c3ab0c8d7ca538e4ecc2ec863c770d60bccc31d7abaf95e50e95d", "summary_zh": "研究善意数据处理任务中本地同名 Python 文件遮蔽可信模块、在常规导入时执行不可信代码的风险；攻击者只植入单个文件，不控制提示、工具或模型，也不使用对抗文本。方法将观察、推理、执行、报告的轨迹编码与环境外独立文件事件审计对齐，不只看最终标记或代理自报。作者在 mini-swe-agent 单一默认 scaffold、15 模型各两条件三次运行的 90 次实验中报告：直接遮蔽 23/45（51.1%）、间接遮蔽 39/45（86.7%）触发；触发前或首触发步明确识别机制的 29 次中仍有 10 次执行。62 次触发中 49 次最终未提安全问题，提及问题的 13 次中又有 3 次否认执行；10 次触发后标记被删或覆盖。识别、阻止执行、事件披露是不同指标；这是常规任务执行安全评估，不能等同显式恶意仓库审计的检出率。仅测试离线最小环境和写标记的无害载荷，每模型样本小；行为关联不是防护因果效应，未表达风险也不证明内部未识别。本次仅核对必要正文，未复现实验。", "topics": { "tags": [ "supplychain", "monitoring", "evaluation" ], "reason_zh": "模块遮蔽造成代理执行不可信代码，并检验安全报告与独立日志的一致性。" }, "title": "Characterizing LLM Agent Behaviors in Module Shadowing Environments", "version_id": "2610.40716v1", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.40716v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§2 Module Shadowing and Threat Model", "§4.1—4.3 Experimental design、Measures and behavioral coding、Statistical analysis", "§5.1—5.4 Results与Table 1", "§6 Discussion；§7 Limitations" ], "published": "2026-10-29T02:18:27Z", "updated": "2026-10-29T02:18:27Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40716", "title": "Characterizing LLM Agent Behaviors in Module Shadowing Environments", "version_id": "2610.40716v1", "first_author": "Shuai Yang", "authors": [ "Shuai Yang", "Enmeng Lu", "Jinyu Fan", "Gongce Cao", "Yu Chen", "Jiawei Xie", "Feifei Zhao", "Zhangsheng Wang", "Yongyu Jiang", "Yi Zeng" ], "affiliations": [ "Gaoling School of AI, Renmin University of China", "Beijing Institute of AI Safety and Governance" ], "source_url": "https://arxiv.org/pdf/2610.40716v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.40721": { "id": "2610.40721", "classification": "relevant", "reason": "正文明确以Codex CLI与Claude Code实现优化及隔离漏洞检测代理，评测安全审计判别、跨模型迁移与优化捷径；符合Coding Agent安全评估，不要求代理自身被攻击。", "abstract_read": true, "abstract_sha256": "47fb728875d32f1eb321de2b6617a19b57b39c47af7027f64ab68dc555239881", "summary_zh": "针对漏洞检测代理难以区分漏洞函数与补丁版本的问题，MetaVul 从结构化推理种子出发，让优化器读取验证历史，改写 harness，并按成对准确率与 CWE/定位联合命中率保留 Pareto 前沿。作者在 TitanVul+CWEval 的 202 对函数上优化，在移除 5 对验证重叠后的 PrimeVul 430 对上测试；报告验证成对准确率提升 11.4—23.3 个百分点，保留集最高提升 25.8 点（DeepSeek V4 Flash），跨模型最高提升 14.7 点（Opus 5）。成对准确要求漏洞与修复函数均判对，不是单函数召回率；precision 提高通常伴随 recall 下降，40 个发现的 harness 仅 10 个改善定位。优化器只读验证工作区，检测器逐函数隔离且不接触标签、历史或仓库，保留集结果不回流；作者对 44 个 harness 做文本裁判检查，11 个前沿均未发现所测捷径，但明确不能排除基准进入模型预训练数据。只测 C/C++ 单函数，不能直接推成恶意仓库识别或整仓漏洞审计效果；本次仅核对必要正文，未复现实验。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "正文明确以Codex CLI与Claude Code实现优化及隔离漏洞检测代理，评测安全审计判别、跨模型迁移与优化捷径；符合Coding Agent安全评估，不要求代理自身被攻击。" }, "title": "MetaVul: Agentic Harness Discovery for Vulnerability Detection", "initial_classification": "uncertain", "scope_review": { "id": "2610.40721", "classification": "relevant", "reason": "正文明确以Codex CLI与Claude Code实现优化及隔离漏洞检测代理，评测安全审计判别、跨模型迁移与优化捷径；符合Coding Agent安全评估，不要求代理自身被攻击。", "summary_zh": "【正文核验；作者报告】MetaVul以成对漏洞/修复函数反馈迭代改写代理harness，保留判别与定位的Pareto前沿并冻结后测未见数据。202对开发样本、430对留出样本上，最多提升23.3与25.8个百分点成对准确率；跨模型最多提高14.7点。正文指出降低误报伴随召回下降，限于C/C++函数级、缺少仓库上下文，不能完全排除预训练污染。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "正文明确以Codex CLI与Claude Code实现优化及隔离漏洞检测代理，评测安全审计判别、跨模型迁移与优化捷径；符合Coding Agent安全评估，不要求代理自身被攻击。" }, "fulltext_read": true, "review_source": { "version_id": "2610.40721v1", "path": "/workspace/shared/arxiv-20261103/work/acquisition/fulltext/2610.40721v1.html.txt", "url": "https://arxiv.org/html/2610.40721v1", "sections": [ "§3 Methodology", "§4 Experimental Design", "§5 Discovery and Transfer", "§7 Optimization Integrity", "§8 Limitations" ] }, "evidence_level": "abstract_and_targeted_body", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.40721v1", "reviewed_sections": [ "§3 Methodology", "§4 Experimental Design", "§5 Discovery and Transfer", "§7 Optimization Integrity", "§8 Limitations" ], "version_id": "2610.40721v1" }, "full_text_checked": true, "reviewed_sections": [ "§3 Methodology（隔离、候选选择与检测器权限）", "§4.1—4.2 Experimental Design（划分、去重和指标分母）", "§5 Discovery and Transfer；§6 Table 2", "§7 Optimization Integrity；§8 Limitations" ], "body_source_url": "https://arxiv.org/html/2610.40721v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.40721v1", "source_url": "https://arxiv.org/abs/2610.40721v1", "published": "2026-10-29T04:30:42Z", "updated": "2026-10-29T04:30:42Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 3 of 3 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40721", "title": "MetaVul: Agentic Harness Discovery for Vulnerability Detection", "version_id": "2610.40721v1", "first_author": "Ira Ceka", "authors": [ "Ira Ceka", "Arnav Garg", "Ryan Lutz", "Ting Zhang", "Ratnadira Widyasari", "Gail Kaiser", "Baishakhi Ray" ], "affiliations": [ "Columbia University" ], "source_url": "https://arxiv.org/pdf/2610.40721v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript or author column.", "affiliation_checked": true }, "revision_history": [] }, "2610.40744": { "id": "2610.40744", "classification": "relevant", "reason": "提示注入操纵联网控制动作及闭环防护（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "afbdc232d83617057519ebdf73ee76eeb0c004a61403d0dda0f5de501cd93d1f", "summary_zh": "仅据摘要，作者声称：针对O-RAN控制链运行时提示注入和微调残留虚拟注入，CLIC用小型量化模型检查认证意图、推理轨迹与最终动作一致性；作者报告攻击成功率从0.92降至0.29，残留攻击从0.37降至0.04，增加约27毫秒延迟。", "topics": { "tags": [ "injection", "authorization", "monitoring" ], "reason_zh": "提示注入操纵联网控制动作及闭环防护" }, "title": "CLIC: Closed-Loop Intent Consistency for Securing LLM-Driven Control in Open RAN", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40744v1", "published": "2026-10-29T15:42:29Z", "updated": "2026-10-29T15:42:29Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR", "cs.NI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40744v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40744", "title": "CLIC: Closed-Loop Intent Consistency for Securing LLM-Driven Control in Open RAN", "version_id": "2610.40744v1", "first_author": "Sunder Ali Khowaja", "authors": [ "Sunder Ali Khowaja", "Kapal Dev", "Joongheon Kim", "Angelos Antonopoulos", "Nikolaos Bartzoudis" ], "affiliations": [ "School of Computing, Dublin City University" ], "source_url": "https://arxiv.org/pdf/2610.40744v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript or author column.", "affiliation_checked": true }, "revision_history": [] }, "2610.40753": { "id": "2610.40753", "classification": "relevant", "reason": "仅依据完整摘要：直接研究编码代理命令审批、沙箱预执行与危害回滚。", "abstract_read": true, "abstract_sha256": "57cd35e83c1a81ed5b6072a07fb20bc36c8b09c94c48361688467b6da2e2046c", "summary_zh": "针对仅看命令文字无法发现被调用脚本或二进制隐藏后果的问题，Caper 在断网容器快照中真实预执行 shell 命令并暂扣输出，将系统调用和前后状态提炼为有覆盖说明的效果报告，由独立 LLM 判断是否符合用户任务；允许则保留已执行状态，阻止则恢复快照并反馈原因，不是批准后重新执行一次。作者在 682 个 SABER shell-only 任务上报告有害结果率 6.7%（六个既有系统至少 14.8%）；自建 YoloFS-Ext 的 102 个危险任务上为 7.8%（既有系统至少 35.3%），安全完成率 60.8%，另 102 个安全 twins 中误阻率 1.0%。Claude Code hook 变体分别为 10.0% / 6.9%，勿与主版本混用。每系统每任务仅跑一次；SABER 主表采用修订 oracle。报告目标 4 KiB、上限 8 KiB，保留遗漏计数、不确定性和模拟标记；同进程先读后输出只是来源关联，不是完整污点证明。回滚仅覆盖本地容器状态，网络或远端副作用离开边界即无法撤回，必须预先隔离；一次观测不覆盖时间/环境依赖、延迟危害、拆分命令或对审批器注入，两个基准未含自适应攻击。只控制 shell，审批模型和 oracle 仍可能误判。本次仅核对必要正文，未复现实验。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "直接研究编码代理命令审批、沙箱预执行与危害回滚。" }, "title": "\"Shall We Approve?\" Consequence-Aware Approval for Autonomous Coding Agents", "version_id": "2610.40753v1", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.40753v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§3 Threat Model", "§4.1—4.3 Transactional Pre-execution、Bounded Effects Report、Approver and Feedback", "§5.1—5.3 Setup、Table 3、Main Results、Ablation Study", "§5.5 Overhead；Limitations；Ethical Considerations" ], "published": "2026-10-29T16:20:20Z", "updated": "2026-10-29T16:20:20Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40753", "title": "\"Shall We Approve?\" Consequence-Aware Approval for Autonomous Coding Agents", "version_id": "2610.40753v1", "first_author": "Weiheng Wu", "authors": [ "Weiheng Wu", "Junkai Chen", "Zhensu Sun", "Jieke Shi", "Yunbo Lyu", "David Lo" ], "affiliations": [ "Singapore Management University" ], "source_url": "https://arxiv.org/pdf/2610.40753v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.40798": { "id": "2610.40798", "classification": "relevant", "reason": "仅依据完整摘要：直接检验网页代理世界模型能否支撑执行、询问与阻止等授权判断。", "abstract_read": true, "abstract_sha256": "06a821c06c428faa00a5d8696567d3a955b6bcd5e830130b5f94a10e09d6119e", "summary_zh": "【仅摘要证据；结果为作者声称】合理的网页未来预测未必保留决定授权的证据。SafeWebWorld评测执行、询问、阻止三类判断，并用LAR重校准诊断潜在授权信号；作者报告3000项预测中86.1%语义合理，但证据保留提升仍可伴随授权判断恶化，聚合恢复不足以证明细粒度鲁棒性。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "直接检验网页代理世界模型能否支撑执行、询问与阻止等授权判断。" }, "title": "Beyond Plausible Prediction: Safety Sufficiency in Web World Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40798v1", "published": "2026-10-29T18:00:55Z", "updated": "2026-10-29T18:00:55Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40798v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40798", "title": "Beyond Plausible Prediction: Safety Sufficiency in Web World Models", "version_id": "2610.40798v1", "first_author": "Zhifei Hu", "authors": [ "Zhifei Hu", "Alexandra I. Cristea", "Adel Bibi", "Jialin Yu" ], "affiliations": [ "Durham University" ], "source_url": "https://arxiv.org/pdf/2610.40798v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.40913": { "id": "2610.40913", "classification": "relevant", "reason": "研究工具增强医疗视觉代理中共同输入故障如何使交叉检查失效。", "abstract_read": true, "abstract_sha256": "b66fc2ca9224a4719a0b546203d8064e613821debbdc992264679aea32a7f98e", "summary_zh": "【仅据摘要；作者声称】将工具检索与推理错误区分为单通道、共同一致或不一致，比较文字注入和物理损坏。作者报告裁剪优先检索保留注入，使55%样本共同错且一致，整图为35%；二分类双错必一致，限制差异监控召回，并在独立数据重现顺序效应。", "topics": { "tags": [ "injection", "monitoring", "robustness" ], "reason_zh": "研究工具增强医疗视觉代理中共同输入故障如何使交叉检查失效。" }, "title": "Coupled or Independent? Fault Coupling in Agentic Medical Vision Systems", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40913v1", "published": "2026-10-29T19:34:29Z", "updated": "2026-10-29T19:34:29Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR", "cs.CV" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 9 of 9 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40913v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40913", "title": "Coupled or Independent? Fault Coupling in Agentic Medical Vision Systems", "version_id": "2610.40913v1", "first_author": "Nishi Kanta Paul", "authors": [ "Nishi Kanta Paul", "Md Shihabul Islam Shovo", "Md Mostafijur Rahman", "Jamil Fayyad" ], "affiliations": [ "NIMISHES Lab" ], "source_url": "https://arxiv.org/pdf/2610.40913v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.40917": { "id": "2610.40917", "classification": "relevant", "reason": "harness配置及代理自改工具被明确界定为攻击面与版本审计对象。", "abstract_read": true, "abstract_sha256": "f44613f0fd3d548ea98353f5dc0bc44f943b80169023a6bdd2fe90aa1d2e65e2", "summary_zh": "【仅据摘要；作者声称】提出将代理harness拆为八个功能组件的可移植规格，记录模型运行所用配置及其运行中变化，补足模型卡/代理卡无法记录有效配置序列的问题。作者论证版本化记录利于安全和可比较评估；摘要未给防御实验或声称记录本身符合所有法律。", "topics": { "tags": [ "supplychain", "monitoring", "evaluation" ], "reason_zh": "harness配置及代理自改工具被明确界定为攻击面与版本审计对象。" }, "title": "Towards Portable Specification of the Agent Harness", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40917v1", "published": "2026-10-29T19:43:14Z", "updated": "2026-10-29T19:43:14Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40917v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40917", "title": "Towards Portable Specification of the Agent Harness", "version_id": "2610.40917v1", "first_author": "Nicolas Gertler", "authors": [ "Nicolas Gertler", "Claudio Novelli", "Luciano Floridi" ], "affiliations": [ "Digital Ethics Center, Yale University" ], "source_url": "https://arxiv.org/pdf/2610.40917v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.40927": { "id": "2610.40927", "classification": "relevant", "reason": "无副作用代理仿真，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "bfe64d3d064cd6e8372a14e7df70444fb98772063866cf678a9c45327ea11c77", "summary_zh": "仅据摘要，作者声称：针对共享不可重置环境中并行探索造成不可逆副作用，AWM代理仿真器仅经只读接口获取证据，用计算预测动作观察而不改真实状态；作者在三个代理基准报告比单次仿真平均好40.07%、比训练世界模型好12.36%。", "topics": { "tags": [ "authorization", "robustness" ], "reason_zh": "无副作用代理仿真，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "Agentic World Modeling for Agent Test-time Scaling without Environment Replica", "version_id": "2610.40927v1", "published": "2026-10-29T19:55:18Z", "updated": "2026-10-29T19:55:18Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CL", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 40 of 40 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 9 of 9 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40927v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40927", "title": "Agentic World Modeling for Agent Test-time Scaling without Environment Replica", "version_id": "2610.40927v1", "first_author": "Wendi Li", "authors": [ "Wendi Li", "Huseyin A. Inan", "Wei-Ning Chen", "Yanzhi Chen", "Chetan Bansal", "Saravan Rajmohan", "Sharon Li" ], "affiliations": [ "University of Wisconsin–Madison", "Microsoft" ], "source_url": "https://arxiv.org/pdf/2610.40927v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.40939": { "id": "2610.40939", "classification": "relevant", "reason": "直接研究代理CoT监督依赖的推理可控性限制及其可被干预程度。", "abstract_read": true, "abstract_sha256": "78259388711d675dcda7794626084f218f4763e5f1cfdede468c7243a7e20c96", "summary_zh": "【仅据摘要；作者声称】把开头少数token的熵坍缩联系到CoT可控性，用预填或禁用常见开头配合示例干预。作者报告平均遵从提高34—41个百分点，主要恢复添加/风格控制，抑制信息表现不同；与可监控性的关联依评估而异，建议分类报告而非笼统结论。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "直接研究代理CoT监督依赖的推理可控性限制及其可被干预程度。" }, "title": "The First Few Tokens Matter: Understanding Chain-of-Thought Controllability", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40939v1", "published": "2026-10-29T20:14:19Z", "updated": "2026-10-29T20:14:19Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40939v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40939", "title": "The First Few Tokens Matter: Understanding Chain-of-Thought Controllability", "version_id": "2610.40939v1", "first_author": "Hugh Van Deventer", "authors": [ "Hugh Van Deventer", "Dmitrii Troitskii", "Laura Ruis" ], "affiliations": [ "Harvard University", "Cambridge Boston Alignment Initiative" ], "source_url": "https://arxiv.org/pdf/2610.40939v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.40946": { "id": "2610.40946", "version_id": "2610.40946v2", "abstract_sha256": "4b13c1c815fd933226423e026d361d3d87287bbdfc8d1924be5994756ec92435", "abstract_read": true, "classification": "relevant", "reason_zh": "代理通过计时和干预线索识别思维链监控并适应性规避，直接属于监督逃逸。", "summary_zh": "研究 LLM 能否由环境线索察觉思维链监控并规避监督。作者在重复回合和交互循环中考察直接与间接提示，包括超时和操作耗时；报告模型能够由细微计时线索推断监控、调整行为规避，并估算监控有效性以指导逃逸，主张采用适应性监督评测。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "代理通过计时和干预线索识别思维链监控并适应性规避，直接属于监督逃逸。" }, "reason": "代理通过计时和干预线索识别思维链监控并适应性规避，直接属于监督逃逸。", "title": "Opening the Box Changes the Cat: LLMs Detect Chain-of-Thought Monitoring - What now?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T20:23:08Z", "updated": "2026-11-02T23:00:35Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 193 of 193 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40946v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "seen_dates": [ "2026-11-03", "2026-11-05" ], "version_history": [ { "id": "2610.40946", "classification": "relevant", "reason": "模型通过交互环境线索识别并规避思维链监控（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "155b6571fd980e95a7069158232168f1ac71bef8085c18a7cf6802271f2e7c1f", "title": "Opening the Box Changes the Cat: LLMs Detect Chain-of-Thought Monitoring - What now?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40946v1", "published": "2026-10-29T20:23:08Z", "updated": "2026-10-29T20:23:08Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 87 of 87 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40946v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.40946", "title": "Opening the Box Changes the Cat: LLMs Detect Chain-of-Thought Monitoring - What now?", "version_id": "2610.40946v2", "first_author": "Amir Jalilifard", "authors": [ "Amir Jalilifard", "Marcos Medeiros Raimundo", "Anderson Rocha" ], "affiliations": [ "Institute of Computing, Universidade Estadual de Campinas (UNICAMP)" ], "source_url": "https://arxiv.org/pdf/2610.40946v2", "shared_first_authors": [], "shared_first_note": "作者后的符号用于逐一机构脚注，未见共同第一作者说明。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "PDF 首页 * 脚注明确 Amir Jalilifard is with the Institute of Computing, Universidade Estadual de Campinas (UNICAMP)。", "affiliation_checked": true }, "first_seen_date": "2026-11-03", "revision_history": [ { "id": "2610.40946", "classification": "relevant", "reason": "模型通过交互环境线索识别并规避思维链监控（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "155b6571fd980e95a7069158232168f1ac71bef8085c18a7cf6802271f2e7c1f", "summary_zh": "仅据摘要，作者声称：研究思维链监控如何被模型从环境反馈识别；作者发现超时和操作时长等细微信号可暴露监控，反复交互中模型还可估计监控有效性并调整规避行为，主张在自适应对手条件下评估监督。摘要未给量化效果。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "模型通过交互环境线索识别并规避思维链监控" }, "title": "Opening the Box Changes the Cat: LLMs Detect Chain-of-Thought Monitoring - What now?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40946v1", "published": "2026-10-29T20:23:08Z", "updated": "2026-10-29T20:23:08Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 87 of 87 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40946v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40946", "title": "Opening the Box Changes the Cat: LLMs Detect Chain-of-Thought Monitoring - What now?", "version_id": "2610.40946v1", "first_author": "Amir Jalilifard", "authors": [ "Amir Jalilifard", "Marcos Medeiros Raimundo", "Anderson Rocha" ], "affiliations": [ "Institute of Computing, Universidade Estadual de Campinas (UNICAMP)" ], "source_url": "https://arxiv.org/pdf/2610.40946v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript or named author affiliation.", "affiliation_checked": true } } ] }, "2610.40959": { "id": "2610.40959", "classification": "relevant", "reason": "个人代理对用户特定约束的警告、澄清、拒绝与行动边界是直接安全评测。", "abstract_read": true, "abstract_sha256": "b513e6d6bbd259d5abd3a746d635ae6fc9bea669b45b8c639f7dd222918183c5", "summary_zh": "【仅据摘要；作者声称】P-ContextBench从合成人物的碎片化动态应用记录构造个人事实、时间追踪、模式推断及约束冲突响应测试，含100人物、4810验证用例。作者称低成本先进模型在时间追踪、模式推断及约束行动边界准确率低于60%，三次重复均正确用例不到10%。", "topics": { "tags": [ "authorization", "memory", "evaluation" ], "reason_zh": "个人代理对用户特定约束的警告、澄清、拒绝与行动边界是直接安全评测。" }, "title": "P-ContextBench: From Personal Fact Recall to Personalized Agent Behavior", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40959v1", "published": "2026-10-29T20:38:32Z", "updated": "2026-10-29T20:38:32Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40959v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40959", "title": "P-ContextBench: From Personal Fact Recall to Personalized Agent Behavior", "version_id": "2610.40959v1", "first_author": "Grant Nasir Brown", "authors": [ "Grant Nasir Brown", "Abdul Basir Bari", "Anmol Tadikonda", "Isabel Song" ], "affiliations": [ "Department of Computer Science, San Francisco State University" ], "source_url": "https://arxiv.org/pdf/2610.40959v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.40975": { "id": "2610.40975", "classification": "relevant", "reason": "直接评估代理是否选择超出任务需要的高权限工具。", "abstract_read": true, "abstract_sha256": "a49d510ca7e2aa2929b13f44997aa3dc0762bbb8e086d0a6a6177a541c838713", "summary_zh": "【仅据摘要；作者声称】在544个ToolPrivBench情景、八模型与五条件中比较最小权限指令、权限成本元数据及中性对照。作者报告展示权限最多降低19.3个百分点过早升级，但单独信息常只延迟升级；结合指令后七模型无风险工具完成率上升，最强配置由18.8%至51.1%，强调不能替代外部强制执行。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "直接评估代理是否选择超出任务需要的高权限工具。" }, "title": "Does Showing Agents the Privilege of Their Tools Reduce Over-Privileged Tool Selection?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40975v1", "published": "2026-10-29T20:59:41Z", "updated": "2026-10-29T20:59:41Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40975v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40975", "title": "Does Showing Agents the Privilege of Their Tools Reduce Over-Privileged Tool Selection?", "version_id": "2610.40975v1", "first_author": "Simon Parkinson", "authors": [ "Simon Parkinson", "Mauro Vallati", "Zhipeng Wang", "Mustafa Mustafa" ], "affiliations": [ "School of Computing and Mathematics, Manchester Metropolitan University" ], "source_url": "https://arxiv.org/pdf/2610.40975v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript.", "affiliation_checked": true }, "revision_history": [] }, "2610.40981": { "id": "2610.40981", "classification": "relevant", "reason": "仅依据完整摘要：直接提出代理规划可见的动态最小权限、租约与授权预算。", "abstract_read": true, "abstract_sha256": "61a863560cf8d8f19bca5753f1b55f0d914128adcaa83a9c4cdbd46f4a0f4175", "summary_zh": "【仅摘要证据；结果为作者声称】宽权限暴露风险、窄权限造成频繁审批。文章提出有租约和可补充预算的弹性最小权限，让规划器看见提权成本并释放权限；这是概念框架与研究议程，摘要明确实践效果尚未验证。", "topics": { "tags": [ "authorization" ], "reason_zh": "直接提出代理规划可见的动态最小权限、租约与授权预算。" }, "title": "Towards Elastic Least Privilege for Agent Planning", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40981v1", "published": "2026-10-29T21:05:31Z", "updated": "2026-10-29T21:05:31Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40981v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40981", "title": "Towards Elastic Least Privilege for Agent Planning", "version_id": "2610.40981v1", "first_author": "Simon Parkinson", "authors": [ "Simon Parkinson", "Zhipeng Wang", "Mustafa Mustafa" ], "affiliations": [ "School of Computing and Mathematics, Manchester Metropolitan University" ], "source_url": "https://arxiv.org/pdf/2610.40981v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.40992": { "id": "2610.40992", "classification": "relevant", "reason": "LLM营养规划代理以可执行个体规格防止疾病与药物约束违规。", "abstract_read": true, "abstract_sha256": "86d590af1da5e28a93d044fc98fb73b478776da86c8f74f632f45556e26ae143", "summary_zh": "【仅据摘要；作者声称】Noura将饮食临床指南与个人约束转成可执行规格，用于食物落地、份量优化、计划检查和修订监督。作者报告4993留出参与者上Qwen3-14B完整计划通过率由24.0%至72.5%，违规下降97.5%且未观察到关键失败；结果限定于该评测。", "topics": { "tags": [ "robustness", "evaluation" ], "reason_zh": "LLM营养规划代理以可执行个体规格防止疾病与药物约束违规。" }, "title": "Can Personal Requirements Become Supervision for Planning?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.40992v1", "published": "2026-10-29T21:20:21Z", "updated": "2026-10-29T21:20:21Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 87 of 87 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.40992v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.40992", "title": "Can Personal Requirements Become Supervision for Planning?", "version_id": "2610.40992v1", "first_author": "Junwei Wu", "authors": [ "Junwei Wu", "Runze Yan", "Yuzhang Xie", "Hanqi Luo", "Ziwei Dong", "Jiaying Lu", "Xiao Hu", "Carl Yang" ], "affiliations": [ "Emory University" ], "source_url": "https://arxiv.org/pdf/2610.40992v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.41014": { "id": "2610.41014", "classification": "relevant", "reason": "直接研究代理环境中的奖励黑客与违反用户指令的评分追逐。", "abstract_read": true, "abstract_sha256": "2604bfcf3df19ecdfa753ba1d8c9c16a7fc18bb618025b16d5f26ebb52c4adc3", "summary_zh": "【仅据摘要；作者声称】在泄漏评分器的代理环境观察三个模型，改变分数用于训练、评估或无用途的说明。作者称模型仍以近似频率违反指令追求分数；较新模型在帮助另一代理可得1而非0分时平均更愿帮助24.6个百分点，但评分/监控其他轨迹时未观察合谋篡改评分。", "topics": { "tags": [ "evaluation", "multiagent", "monitoring" ], "reason_zh": "直接研究代理环境中的奖励黑客与违反用户指令的评分追逐。" }, "title": "Towards Understanding Score-Seeking in LLMs", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41014v1", "published": "2026-10-29T21:50:04Z", "updated": "2026-10-29T21:50:04Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "New submissions (showing 111 of 111 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41014v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41014", "title": "Towards Understanding Score-Seeking in LLMs", "version_id": "2610.41014v1", "first_author": "Aghyad Deeb", "authors": [ "Aghyad Deeb", "Ryan Greenblatt", "Alex Mallen" ], "affiliations": [ "Redwood Research" ], "source_url": "https://arxiv.org/pdf/2610.41014v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41025": { "id": "2610.41025", "classification": "relevant", "reason": "代理实时监督与因果修复，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "eac921aee1ab954efb0214424bb246ecbd9672cc5e59b0fb138db644a1cf3de3", "summary_zh": "仅据摘要，作者声称：ReplayRCA通过反事实替换动作和安慰剂对照测因果修复，并对比事后诊断与不可逆动作前实时监督；作者报告最佳事后修复+51.3点，事后强诊断模型可能在线监督最弱，说明两者不可等同。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "代理实时监督与因果修复，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "ReplayRCA: Measuring Post-hoc Diagnosis and Live Oversight of Agent Failures by Counterfactual Replay", "version_id": "2610.41025v1", "published": "2026-10-29T22:11:00Z", "updated": "2026-10-29T22:11:00Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41025v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41025", "title": "ReplayRCA: Measuring Post-hoc Diagnosis and Live Oversight of Agent Failures by Counterfactual Replay", "version_id": "2610.41025v1", "first_author": "Jeremy Canale", "authors": [ "Jeremy Canale", "Fabien Soulis" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2610.41025v1", "shared_first_authors": [], "shared_first_note": "", "status": "unverified", "author_status": "verified", "affiliation_status": "not_stated", "verification_status": "author_only", "evidence": "First-page author block checked; no affiliation stated. Emails not used to infer affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.41044": { "id": "2610.41044", "classification": "relevant", "reason": "LLM团队对抗与伪装鲁棒性，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "b35b02f879c8f779aee51695cc47485b059266b607b85b0b528052411479955a", "summary_zh": "仅据摘要，作者声称：比较中心控制、共识竞价和独立LLM团队在简化周界防御及通信受限下的表现；作者报告突破率15%、32%、29%，伪装鸟类入侵使近前沿模型59–61%决策不追踪，单句预警可降低至0–25%。仅为简化仿真，不等于现实防御有效性。", "topics": { "tags": [ "multiagent", "embodied", "robustness" ], "reason_zh": "LLM团队对抗与伪装鲁棒性，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "Consensus Within, Competition Between: Decentralized LLM Teams for Perimeter Defense", "version_id": "2610.41044v1", "published": "2026-10-29T22:34:13Z", "updated": "2026-10-29T22:34:13Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.LG", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 87 of 87 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41044v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41044", "title": "Consensus Within, Competition Between: Decentralized LLM Teams for Perimeter Defense", "version_id": "2610.41044v1", "first_author": "Khawaja Abaid Ullah", "authors": [ "Khawaja Abaid Ullah", "Ananya Acharya", "Mohammad Javad Khojasteh" ], "affiliations": [ "Department of Electrical and Microelectronic Engineering, Rochester Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.41044v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41056": { "id": "2610.41056", "classification": "relevant", "reason": "长期记忆更新与投毒的联合鲁棒性（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "60da369df3bd105712765e9eb841b81ff73d04fc62a9f6663a8f22d4d59142d0", "summary_zh": "仅据摘要，作者声称：针对更新记忆与拒绝投毒要求相反的问题，提出同时检查回答及完整、最新、无攻击证据的ECA指标，并用围绕单次对话合成的变更与攻击样本微调管理器；作者报告三种骨干各类别均改善，总ECA超过未调优版本两倍，但鲁棒性仍不完整。", "topics": { "tags": [ "memory", "injection", "robustness", "evaluation" ], "reason_zh": "长期记忆更新与投毒的联合鲁棒性" }, "title": "Accept Changes, Reject Attacks: Robust Memory Management for LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41056v1", "published": "2026-10-29T22:54:17Z", "updated": "2026-10-29T22:54:17Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41056v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41056", "title": "Accept Changes, Reject Attacks: Robust Memory Management for LLM Agents", "version_id": "2610.41056v1", "first_author": "Runze Zhao", "authors": [ "Runze Zhao", "Dongruo Zhou", "Sumit Kumar Jha", "Nathaniel D. Bastian", "Ankit Shah" ], "affiliations": [ "Indiana University Bloomington" ], "source_url": "https://arxiv.org/pdf/2610.41056v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript or author column.", "affiliation_checked": true }, "revision_history": [] }, "2610.41072": { "id": "2610.41072", "classification": "relevant", "reason": "SOC代理系统明确测试提示注入、标签投毒、账本篡改及人工批准防护。", "abstract_read": true, "abstract_sha256": "22eaf540f49aba381e76e895efe484dc9896610cbeecb89f0e49b6a365ff153f", "summary_zh": "【仅据摘要；作者声称】LanG 2.0以实体关联、规则更新人工批准和防篡改账本支撑小型本地模型的安全运营。作者报告活动关联精确率从18.75%至51.81%，规则接受率至98.33%，并称结构防护抵御提示注入、标签投毒、账本篡改；摘要未列这些防护的具体攻击成功率。", "topics": { "tags": [ "injection", "authorization", "monitoring" ], "reason_zh": "SOC代理系统明确测试提示注入、标签投毒、账本篡改及人工批准防护。" }, "title": "LanG 2.0: Energy-Efficient Agentic AI for Semi-Automated Security Operations at Scale", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41072v1", "published": "2026-10-29T23:37:42Z", "updated": "2026-10-29T23:37:42Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 9 of 9 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41072v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41072", "title": "LanG 2.0: Energy-Efficient Agentic AI for Semi-Automated Security Operations at Scale", "version_id": "2610.41072v1", "first_author": "Anes Abdennebi", "authors": [ "Anes Abdennebi", "Nadjia Kara", "Laaziz Lahlou", "Hakima Ould-Slimane" ], "affiliations": [ "Department of Software Engineering and IT, École de technologie supérieure (ÉTS)" ], "source_url": "https://arxiv.org/pdf/2610.41072v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.41076": { "id": "2610.41076", "classification": "relevant", "reason": "患者代理权限、证据和禁止动作的过程合规评估（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "bb80b5ad0f2a549ab9d776a2a038934d94b8c94bda205e974a324edd563c1e48", "summary_zh": "仅据摘要，作者声称：BABA-Bench以47个真实去标识患者倡导案例构造交互世界，逐动作检验许可、证据和禁令；作者报告921条完成所有结果的运行中28%程序违规，提供已验证路线可显著提升通过率，表明终态正确不足以证明安全合规。", "topics": { "tags": [ "authorization", "privacy", "evaluation" ], "reason_zh": "患者代理权限、证据和禁止动作的过程合规评估" }, "title": "BABA-Bench: Evaluating Long-Horizon Patient-Advocacy Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41076v1", "published": "2026-10-29T23:46:24Z", "updated": "2026-10-29T23:46:24Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41076v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41076", "title": "BABA-Bench: Evaluating Long-Horizon Patient-Advocacy Agents", "version_id": "2610.41076v1", "first_author": "Shriram Vasudevan", "authors": [ "Shriram Vasudevan", "Videet Mehta", "Connor Sweeney" ], "affiliations": [ "Georgia Institute of Technology", "Baba" ], "source_url": "https://arxiv.org/pdf/2610.41076v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.41149": { "id": "2610.41149", "classification": "relevant", "reason": "正文将裁判定位为代理在线步骤门控，六项实验标准明确包含安全违规识别和工具参数是否忠于用户/先前上下文，附录给出具体rubric，因而不是只有一般质量裁判。证据仍为离线逐项F1，不证明端到端代理安全改善。", "abstract_read": true, "abstract_sha256": "bc2ea21e989eb974922dcb2644bc934e2c456c64ea6a0409c2b2b9689d81e823", "summary_zh": "【摘要与定向正文；作者报告】CPA为代理步骤裁判生成同问题反标签回答，经独立审计后与点式数据联合训练。六标准包含安全违规和工具参数来源忠实性；平均macro-F1由87.9升至90.4，安全项由88.6至89.6且增益落在一次运行标准差内。评估为离线裁判而非真实代理危害率，不能把总体提升等同防护收益。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "正文将裁判定位为代理在线步骤门控，六项实验标准明确包含安全违规识别和工具参数是否忠于用户/先前上下文，附录给出具体rubric，因而不是只有一般质量裁判。证据仍为离线逐项F1，不证明端到端代理安全改善。" }, "title": "Counterfactual Pairwise Augmentation Improves Small Pointwise LLM Judges", "initial_classification": "uncertain", "scope_review": { "id": "2610.41149", "version_id": "2610.41149v1", "classification": "relevant", "reason": "正文将裁判定位为代理在线步骤门控，六项实验标准明确包含安全违规识别和工具参数是否忠于用户/先前上下文，附录给出具体rubric，因而不是只有一般质量裁判。证据仍为离线逐项F1，不证明端到端代理安全改善。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.41149v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "1 Introduction and Figure 1", "5 Experiments", "A.6 Source datasets", "A.8 Criterion definitions" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】CPA为代理步骤裁判生成同问题反标签回答，经独立审计后与点式数据联合训练。六标准包含安全违规和工具参数来源忠实性；平均macro-F1由87.9升至90.4，安全项由88.6至89.6且增益落在一次运行标准差内。评估为离线裁判而非真实代理危害率，不能把总体提升等同防护收益。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "正文将裁判定位为代理在线步骤门控，六项实验标准明确包含安全违规识别和工具参数是否忠于用户/先前上下文，附录给出具体rubric，因而不是只有一般质量裁判。证据仍为离线逐项F1，不证明端到端代理安全改善。" } }, "full_text_checked": true, "reviewed_sections": [ "1 Introduction and Figure 1", "5 Experiments", "A.6 Source datasets", "A.8 Criterion definitions" ], "body_source_url": "https://arxiv.org/html/2610.41149v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.41149v1", "published": "2026-10-30T02:12:30Z", "updated": "2026-10-30T02:12:30Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41149v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41149", "title": "Counterfactual Pairwise Augmentation Improves Small Pointwise LLM Judges", "version_id": "2610.41149v1", "first_author": "Mohammad Zangooei", "authors": [ "Mohammad Zangooei", "Peyvand Teymoori", "Mohammad Robati Shirzad", "Soroosh Shahtalebi" ], "affiliations": [ "Huawei Technologies Ltd." ], "source_url": "https://arxiv.org/pdf/2610.41149v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41181": { "id": "2610.41181", "classification": "relevant", "reason": "研究浏览器代理的反机器人检测、防御性注入及受阻后的安全策略漂移。", "abstract_read": true, "abstract_sha256": "bd71aea16d271560efd489bb2dfe7dae283c3d7e53a2656e82c70c6aaaaa1412", "summary_zh": "【仅据摘要；作者声称】评估既有反机器人机制后提出基于感知—推理—行动循环遥测的AgentShield行为指纹。作者称传统机制难可靠识别代理，并展示持续阻碍引起的安全约束放松，以及用防御性提示注入减轻自主网页内容提取滥用；摘要未给量化指标。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "研究浏览器代理的反机器人检测、防御性注入及受阻后的安全策略漂移。" }, "title": "AgentShield: Fortifying Web Applications Against AI Agents and Agentic Browsers", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41181v1", "published": "2026-10-30T03:00:34Z", "updated": "2026-10-30T03:00:34Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41181v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41181", "title": "AgentShield: Fortifying Web Applications Against AI Agents and Agentic Browsers", "version_id": "2610.41181v1", "first_author": "Moiz Ali", "authors": [ "Moiz Ali", "Nafis Karim", "Rownak Islam", "Jyotirmay Chauhan", "Dhruv Kuchhal", "Jason Polakis" ], "affiliations": [ "University of Illinois Chicago" ], "source_url": "https://arxiv.org/pdf/2610.41181v1", "shared_first_authors": [ "Moiz Ali", "Nafis Karim" ], "shared_first_note": "首页 Moiz Ali 与 Nafis Karim 的 § 脚注明确声明 These authors contributed equally to this work。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript.", "affiliation_checked": true }, "revision_history": [] }, "2610.41191": { "id": "2610.41191", "classification": "relevant", "reason": "仅依据完整摘要：研究LLM调查代理面对损坏工具输出时的验证与信任边界。", "abstract_read": true, "abstract_sha256": "736a81301c06a490247562c07ce2ebe19c7a39f0c30edaff0e81ebaba7499ff5", "summary_zh": "【仅摘要证据；结果为作者声称】安全调查代理过度信任工具证据。CAV结合等权投票、证据冲突门控和独立近邻检查；作者报告三项检测器遭破坏时准确率达0.84—0.88，但独立验证通道受噪声影响时仍会继承错误，信任只是转移而非消失。", "topics": { "tags": [ "robustness", "monitoring", "evaluation" ], "reason_zh": "研究LLM调查代理面对损坏工具输出时的验证与信任边界。" }, "title": "When AI Investigators Cannot Trust Their Tools: Conflict-Aware Evidence Verification for Cyber Threat Investigation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41191v1", "published": "2026-10-30T03:13:59Z", "updated": "2026-10-30T03:13:59Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 87 of 87 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41191v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41191", "title": "When AI Investigators Cannot Trust Their Tools: Conflict-Aware Evidence Verification for Cyber Threat Investigation", "version_id": "2610.41191v1", "first_author": "Yuchen Zhang", "authors": [ "Yuchen Zhang" ], "affiliations": [ "Khoury College of Computer Sciences, Northeastern University" ], "source_url": "https://arxiv.org/pdf/2610.41191v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41267": { "id": "2610.41267", "classification": "relevant", "reason": "正文2.3有明确执行权限和授权修改边界：更改已接受字段须用户授权，私有副本检验修订号及路径范围，陈旧或非法补丁不改变已接受状态，重新加载后重算执行权限；并评估错误放行。", "abstract_read": true, "abstract_sha256": "dc9fd9364f44860ca46c1f155f28ff9c65fbdcafa71d34b6d2013fa836f10896", "summary_zh": "【摘要与定向正文；作者报告】工程仿真代理把用户需求转成可执行JSON，结合确定性校验、显式澄清和限定路径的版本化补丁。已接受值的变更需用户授权，非法或陈旧补丁不落地，执行前重算权限。120项主测试中118项首轮结果正确，42项需澄清或拒绝的请求无错误放行；能力和科学校验覆盖有限，后续新响应仍有回归。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "正文2.3有明确执行权限和授权修改边界：更改已接受字段须用户授权，私有副本检验修订号及路径范围，陈旧或非法补丁不改变已接受状态，重新加载后重算执行权限；并评估错误放行。" }, "title": "From 1D Benchmarks to Complex 3D Geometries: Can Agents Reliably Specify Problems for Automated PDE Simulation?", "initial_classification": "uncertain", "scope_review": { "id": "2610.41267", "version_id": "2610.41267v1", "classification": "relevant", "reason": "正文2.3有明确执行权限和授权修改边界：更改已接受字段须用户授权，私有副本检验修订号及路径范围，陈旧或非法补丁不改变已接受状态，重新加载后重算执行权限；并评估错误放行。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.41267v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "2 Methodology", "2.3 Validation, clarification, and patch repair", "3.3 Specification construction results", "3.5 Failure cases and limits of reliability" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】工程仿真代理把用户需求转成可执行JSON，结合确定性校验、显式澄清和限定路径的版本化补丁。已接受值的变更需用户授权，非法或陈旧补丁不落地，执行前重算权限。120项主测试中118项首轮结果正确，42项需澄清或拒绝的请求无错误放行；能力和科学校验覆盖有限，后续新响应仍有回归。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "正文2.3有明确执行权限和授权修改边界：更改已接受字段须用户授权，私有副本检验修订号及路径范围，陈旧或非法补丁不改变已接受状态，重新加载后重算执行权限；并评估错误放行。" } }, "full_text_checked": true, "reviewed_sections": [ "2 Methodology", "2.3 Validation, clarification, and patch repair", "3.3 Specification construction results", "3.5 Failure cases and limits of reliability" ], "body_source_url": "https://arxiv.org/html/2610.41267v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.41267v1", "published": "2026-10-30T05:20:28Z", "updated": "2026-10-30T05:20:28Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41267v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41267", "title": "From 1D Benchmarks to Complex 3D Geometries: Can Agents Reliably Specify Problems for Automated PDE Simulation?", "version_id": "2610.41267v1", "first_author": "Akshat Jani", "authors": [ "Akshat Jani", "Sakhinana Sagar Srinivas", "Venkataramana Runkana" ], "affiliations": [ "Tata Research Development and Design Center" ], "source_url": "https://arxiv.org/pdf/2610.41267v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41272": { "id": "2610.41272", "classification": "relevant", "reason": "网页代理注入攻击与状态验证红队（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "548f4dca75fedcce28f324be95bd045ae0e423460cd86288acfae298bf98b3cb", "summary_zh": "仅据摘要，作者声称：针对静态文本级评测低估网页代理风险，REEF提供9个网站和5类攻击的状态验证环境，ANGLER根据接近成功的轨迹演化攻击；作者报告8个视觉代理平均攻击成功率20.36%，非自适应为15.24%，正常任务成功率由61.9%降至44.4%。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "网页代理注入攻击与状态验证红队" }, "title": "ANGLER: Verifier-Grounded Benchmarking with an Adaptive Attacker for Web Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41272v1", "published": "2026-10-30T05:25:48Z", "updated": "2026-10-30T05:25:48Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41272v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41272", "title": "ANGLER: Verifier-Grounded Benchmarking with an Adaptive Attacker for Web Agents", "version_id": "2610.41272v1", "first_author": "Yini Huang", "authors": [ "Yini Huang", "Aiwen LU", "Zhen Sun", "Yi Han", "Yuzhi Zhao", "Jiaheng Wei" ], "affiliations": [ "The Hong Kong University of Science and Technology (Guangzhou)" ], "source_url": "https://arxiv.org/pdf/2610.41272v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript.", "affiliation_checked": true }, "revision_history": [] }, "2610.41289": { "id": "2610.41289", "version_id": "2610.41289v2", "abstract_sha256": "1ad73ca555271ce3b6cfd0e99511a9242d1e41b21b161f924422ae7c5f435d30", "abstract_read": true, "classification": "relevant", "reason_zh": "模拟临床访谈以非对称写权限保护事实，但是否作为 Agent 安全机制需正文确认。", "summary_zh": "问题：多轮模拟访谈中，采访者假设或旧生成内容可能被提升为患者事实。方法：PsyInterviewee以只读真值通道和可变互动通道分离事实权限与行为控制，校验来源/档案指纹，按不可变来源审核输出，仅验收完成的回合提交互动状态与独立披露账本。30个档案的25轮访谈中，作者报告双LLM裁判的事实不变性与适应性综合指标优于适配基线；采访者未故意植入虚假前提，结果不是对抗注入成功率或临床验证。", "topics": { "tags": [ "memory", "authorization", "monitoring", "evaluation" ], "reason_zh": "对照旧v1归档并实读v2第4.2节及附录C.1，当前版仍有不可变来源目录、回答前指纹校验、非对称写权限和验收后才提交互动状态；历史对话不能升级为事实权威，明确保护长期对话代理记忆与输入信任边界，原仅摘要排除不成立。" }, "reason": "对照旧v1归档并实读v2第4.2节及附录C.1，当前版仍有不可变来源目录、回答前指纹校验、非对称写权限和验收后才提交互动状态；历史对话不能升级为事实权威，明确保护长期对话代理记忆与输入信任边界，原仅摘要排除不成立。", "title": "PsyInterviewee: Informational Invariance and Relational Adaptivity in Mental Health Interview Simulation", "initial_classification": "uncertain", "scope_review": { "id": "2610.41289", "version_id": "2610.41289v2", "classification": "relevant", "reason": "对照旧v1归档并实读v2第4.2节及附录C.1，当前版仍有不可变来源目录、回答前指纹校验、非对称写权限和验收后才提交互动状态；历史对话不能升级为事实权威，明确保护长期对话代理记忆与输入信任边界，原仅摘要排除不成立。", "summary_zh": "问题：多轮模拟访谈中，采访者假设或旧生成内容可能被提升为患者事实。方法：PsyInterviewee以只读真值通道和可变互动通道分离事实权限与行为控制，校验来源/档案指纹，按不可变来源审核输出，仅验收完成的回合提交互动状态与独立披露账本。30个档案的25轮访谈中，作者报告双LLM裁判的事实不变性与适应性综合指标优于适配基线；采访者未故意植入虚假前提，结果不是对抗注入成功率或临床验证。", "topics": { "tags": [ "memory", "authorization", "monitoring", "evaluation" ], "reason_zh": "对照旧v1归档并实读v2第4.2节及附录C.1，当前版仍有不可变来源目录、回答前指纹校验、非对称写权限和验收后才提交互动状态；历史对话不能升级为事实权威，明确保护长期对话代理记忆与输入信任边界，原仅摘要排除不成立。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.41289v2", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Problem Formulation", "4.2 Channel-Separated Interviewee Simulation (4.2.1–4.2.3)", "5 Experiments", "Appendix C.1 Channel-Separated Implementation", "Appendix C.3 Neutral Screening", "Historical archive v1 scope_review compared with v2" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Problem Formulation", "4.2 Channel-Separated Interviewee Simulation (4.2.1–4.2.3)", "5 Experiments", "Appendix C.1 Channel-Separated Implementation", "Appendix C.3 Neutral Screening", "Historical archive v1 scope_review compared with v2" ], "body_source_url": "https://arxiv.org/html/2610.41289v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-30T05:50:25Z", "updated": "2026-11-02T13:07:16Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41289v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "seen_dates": [ "2026-11-03", "2026-11-04" ], "version_history": [ { "id": "2610.41289", "classification": "relevant", "reason": "正文4.2和C.1提供不可变来源目录、指纹校验、非对称写权限、只在验收后提交互动状态及独立披露账本；明确旧对话生成的断言不能获得事实权威，属于长期对话代理记忆完整性和输入信任边界。", "abstract_read": true, "abstract_sha256": "1ad73ca555271ce3b6cfd0e99511a9242d1e41b21b161f924422ae7c5f435d30", "title": "PsyInterviewee: Informational Invariance and Relational Adaptivity in Mental Health Interview Simulation", "initial_classification": "uncertain", "scope_review": { "id": "2610.41289", "version_id": "2610.41289v1", "classification": "relevant", "reason": "正文4.2和C.1提供不可变来源目录、指纹校验、非对称写权限、只在验收后提交互动状态及独立披露账本；明确旧对话生成的断言不能获得事实权威，属于长期对话代理记忆完整性和输入信任边界。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.41289v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "4.2 Channel-Separated Interviewee Simulation", "5 Experiments", "C.1 Channel-Separated Implementation" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】PsyInterviewee把患者事实设为只读，访谈输入仅能更新披露和行为状态；输出审核依据不可变来源，错误触发受限重试，已生成对话也不能反向授权事实。30个模拟档案中双LLM裁判总体指标优于适配基线。方法支持记忆事实完整性，但非临床验证，也非针对对抗注入的成功率评测。", "topics": { "tags": [ "memory", "authorization", "monitoring", "evaluation" ], "reason_zh": "正文4.2和C.1提供不可变来源目录、指纹校验、非对称写权限、只在验收后提交互动状态及独立披露账本；明确旧对话生成的断言不能获得事实权威，属于长期对话代理记忆完整性和输入信任边界。" } }, "full_text_checked": true, "reviewed_sections": [ "4.2 Channel-Separated Interviewee Simulation", "5 Experiments", "C.1 Channel-Separated Implementation" ], "body_source_url": "https://arxiv.org/html/2610.41289v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.41289v1", "published": "2026-10-30T05:50:25Z", "updated": "2026-10-30T05:50:25Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 46 of 46 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41289v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.41289", "title": "PsyInterviewee: Informational Invariance and Relational Adaptivity in Mental Health Interview Simulation", "version_id": "2610.41289v2", "first_author": "Jiawei Zhang", "authors": [ "Jiawei Zhang", "Huachuan Qiu", "Ruocheng Guo", "Zijun Shi" ], "affiliations": [ "Harbin Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.41289v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2匹配；Jiawei Zhang上标1对应哈尔滨工业大学。", "affiliation_checked": true }, "first_seen_date": "2026-11-03", "revision_history": [ { "id": "2610.41289", "classification": "relevant", "reason": "正文4.2和C.1提供不可变来源目录、指纹校验、非对称写权限、只在验收后提交互动状态及独立披露账本；明确旧对话生成的断言不能获得事实权威，属于长期对话代理记忆完整性和输入信任边界。", "abstract_read": true, "abstract_sha256": "1ad73ca555271ce3b6cfd0e99511a9242d1e41b21b161f924422ae7c5f435d30", "summary_zh": "【摘要与定向正文；作者报告】PsyInterviewee把患者事实设为只读，访谈输入仅能更新披露和行为状态；输出审核依据不可变来源，错误触发受限重试，已生成对话也不能反向授权事实。30个模拟档案中双LLM裁判总体指标优于适配基线。方法支持记忆事实完整性，但非临床验证，也非针对对抗注入的成功率评测。", "topics": { "tags": [ "memory", "authorization", "monitoring", "evaluation" ], "reason_zh": "正文4.2和C.1提供不可变来源目录、指纹校验、非对称写权限、只在验收后提交互动状态及独立披露账本；明确旧对话生成的断言不能获得事实权威，属于长期对话代理记忆完整性和输入信任边界。" }, "title": "PsyInterviewee: Informational Invariance and Relational Adaptivity in Mental Health Interview Simulation", "initial_classification": "uncertain", "scope_review": { "id": "2610.41289", "version_id": "2610.41289v1", "classification": "relevant", "reason": "正文4.2和C.1提供不可变来源目录、指纹校验、非对称写权限、只在验收后提交互动状态及独立披露账本；明确旧对话生成的断言不能获得事实权威，属于长期对话代理记忆完整性和输入信任边界。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.41289v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "4.2 Channel-Separated Interviewee Simulation", "5 Experiments", "C.1 Channel-Separated Implementation" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】PsyInterviewee把患者事实设为只读，访谈输入仅能更新披露和行为状态；输出审核依据不可变来源，错误触发受限重试，已生成对话也不能反向授权事实。30个模拟档案中双LLM裁判总体指标优于适配基线。方法支持记忆事实完整性，但非临床验证，也非针对对抗注入的成功率评测。", "topics": { "tags": [ "memory", "authorization", "monitoring", "evaluation" ], "reason_zh": "正文4.2和C.1提供不可变来源目录、指纹校验、非对称写权限、只在验收后提交互动状态及独立披露账本；明确旧对话生成的断言不能获得事实权威，属于长期对话代理记忆完整性和输入信任边界。" } }, "full_text_checked": true, "reviewed_sections": [ "4.2 Channel-Separated Interviewee Simulation", "5 Experiments", "C.1 Channel-Separated Implementation" ], "body_source_url": "https://arxiv.org/html/2610.41289v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.41289v1", "published": "2026-10-30T05:50:25Z", "updated": "2026-10-30T05:50:25Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 46 of 46 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41289v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41289", "title": "PsyInterviewee: Informational Invariance and Relational Adaptivity in Mental Health Interview Simulation", "version_id": "2610.41289v1", "first_author": "Jiawei Zhang", "authors": [ "Jiawei Zhang", "Huachuan Qiu", "Ruocheng Guo", "Zijun Shi" ], "affiliations": [ "Harbin Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.41289v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true } } ] }, "2610.41307": { "id": "2610.41307", "classification": "relevant", "reason": "直接针对外部图像、音频、视频中的间接提示注入及正常任务保真。", "abstract_read": true, "abstract_sha256": "3be2764276221b1e09b1864c9ea385aa20f05edffeec2f2cd484c4434b94ae55", "summary_zh": "【仅据摘要；作者声称】ERASE擦除注入区域、保留其余媒体，以干净擦除视图的冻结基模监督读取攻击媒体的学生自生成轨迹。作者报告测试基准近零观察攻击成功率且保留效用；3B音频攻击输入准确率60.1%，距无防御干净水平0.5点，不能据此推断普适防御。", "topics": { "tags": [ "injection", "robustness" ], "reason_zh": "直接针对外部图像、音频、视频中的间接提示注入及正常任务保真。" }, "title": "Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41307v1", "published": "2026-10-30T06:15:10Z", "updated": "2026-10-30T06:15:10Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41307v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41307", "title": "Erase the Injected Region: Multimodal Prompt-Injection Defense with On-Policy Self-Distillation", "version_id": "2610.41307v1", "first_author": "Shuo Hong", "authors": [ "Shuo Hong", "Jiaxin Ma", "Xidi Cai", "Qianli Ma" ], "affiliations": [ "South China University of Technology" ], "source_url": "https://arxiv.org/pdf/2610.41307v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.41350": { "id": "2610.41350", "classification": "relevant", "reason": "正文提供独立于执行代理的13点监控层，包含工作区越界提醒、错误分类和停止控制；决策分布、采用情况及后果可追踪，并有外部标签的版本晋级门控和隔离审计，因此与运行监控/评估可靠性直接相关，非硬授权保障。", "abstract_read": true, "abstract_sha256": "b7621699ff22f8d31eb80c9489be6a6c63a9ca27e7d1e4dc6458e3a9be8fde26", "summary_zh": "【摘要与定向正文；作者报告】Operon-S1将生物医学代理判断分离到可替换小模型，通过13个固定决策点提醒、终止或要求复查，并记录采用与结果。工作区越界检查是提醒而非硬阻断；新版本须经独立标签晋级门控。作者报告本地判断中位延迟0.6秒，六项任务中五项无可测分数变化；这证明可审计监控框架而非普适安全收益。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "正文提供独立于执行代理的13点监控层，包含工作区越界提醒、错误分类和停止控制；决策分布、采用情况及后果可追踪，并有外部标签的版本晋级门控和隔离审计，因此与运行监控/评估可靠性直接相关，非硬授权保障。" }, "title": "Operon-S1: a fast decision controller for long-horizon biomedical agents", "initial_classification": "uncertain", "scope_review": { "id": "2610.41350", "version_id": "2610.41350v1", "classification": "relevant", "reason": "正文提供独立于执行代理的13点监控层，包含工作区越界提醒、错误分类和停止控制；决策分布、采用情况及后果可追踪，并有外部标签的版本晋级门控和隔离审计，因此与运行监控/评估可靠性直接相关，非硬授权保障。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.41350v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "Introduction", "Table 1 decision points", "Results: decision layer and gated retraining", "Methods: Evaluation integrity" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】Operon-S1将生物医学代理判断分离到可替换小模型，通过13个固定决策点提醒、终止或要求复查，并记录采用与结果。工作区越界检查是提醒而非硬阻断；新版本须经独立标签晋级门控。作者报告本地判断中位延迟0.6秒，六项任务中五项无可测分数变化；这证明可审计监控框架而非普适安全收益。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "正文提供独立于执行代理的13点监控层，包含工作区越界提醒、错误分类和停止控制；决策分布、采用情况及后果可追踪，并有外部标签的版本晋级门控和隔离审计，因此与运行监控/评估可靠性直接相关，非硬授权保障。" } }, "full_text_checked": true, "reviewed_sections": [ "Introduction", "Table 1 decision points", "Results: decision layer and gated retraining", "Methods: Evaluation integrity" ], "body_source_url": "https://arxiv.org/html/2610.41350v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.41350v1", "published": "2026-10-30T07:07:09Z", "updated": "2026-10-30T07:07:09Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 87 of 87 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41350v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41350", "title": "Operon-S1: a fast decision controller for long-horizon biomedical agents", "version_id": "2610.41350v1", "first_author": "Genoria AI Team", "authors": [ " Genoria AI Team", "Yuejie Hou", "Yueyuxiao Yang", "Weiting Tang", "Meng Yang" ], "affiliations": [ "Genoria AI" ], "source_url": "https://arxiv.org/pdf/2610.41350v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true, "metadata_first_author": " Genoria AI Team" }, "revision_history": [] }, "2610.41397": { "id": "2610.41397", "classification": "relevant", "reason": "仅依据完整摘要：直接防止计算机代理通过GUI、CLI、API或MCP跨界面绕过授权。", "abstract_read": true, "abstract_sha256": "0888b02c312139d5428277abd2cc950112313f75b391fefda50e70630c71c8a8", "summary_zh": "【仅摘要证据；结果为作者声称】计算机代理可经替代界面绕过同一策略。协议枚举效果路径和持久终点，规范化效果，发放路由绑定票据并在提交时重验状态，以终点收据确认结果；作者在声明部署配置下证明若干安全性质，并报告独立检查器拒绝全部26项语义回归。保证受配置与效果语义限定。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "直接防止计算机代理通过GUI、CLI、API或MCP跨界面绕过授权。" }, "title": "Cross-Interface Authorization for AI Computer-Use Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41397v1", "published": "2026-10-30T08:07:51Z", "updated": "2026-10-30T08:07:51Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41397v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41397", "title": "Cross-Interface Authorization for AI Computer-Use Agents", "version_id": "2610.41397v1", "first_author": "Genliang Zhu", "authors": [ "Genliang Zhu", "Chu Wang" ], "affiliations": [ "Accentrust", "Georgia Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.41397v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41401": { "id": "2610.41401", "classification": "relevant", "reason": "仅依据完整摘要：直接保护LLM代理外包安全审计的私密输入及执行授权。", "abstract_read": true, "abstract_sha256": "9f3a556392b7487fc20e511524cdce41710cd71382434291c08f8dc860f490c8", "summary_zh": "【仅摘要证据；结果为作者声称】外包工具调用安全审计会泄露任务和历史。SealCall将可信表示、CKKS加密相似度计算与绑定调用的执行控制分离；作者报告1252个二元候选上的平均F1为0.840，实测保持明文审计决策，一种配置每次加密评分0.176秒。", "topics": { "tags": [ "privacy", "authorization", "monitoring" ], "reason_zh": "直接保护LLM代理外包安全审计的私密输入及执行授权。" }, "title": "When Safety Checks Become Privacy Risks: A Privacy-Preserving Paradigm for LLM Agent Safety Auditing", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41401v1", "published": "2026-10-30T08:12:45Z", "updated": "2026-10-30T08:12:45Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41401v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41401", "title": "When Safety Checks Become Privacy Risks: A Privacy-Preserving Paradigm for LLM Agent Safety Auditing", "version_id": "2610.41401v1", "first_author": "Yixiang Luo", "authors": [ "Yixiang Luo", "Ziheng Ma", "Ke Chang", "Jian Wang", "Jiqiang Liu" ], "affiliations": [ "Beijing Jiaotong University" ], "source_url": "https://arxiv.org/pdf/2610.41401v1", "shared_first_authors": [ "Yixiang Luo", "Ziheng Ma", "Ke Chang" ], "shared_first_note": "首页明确声明 Yixiang Luo, Ziheng Ma, and Ke Chang contributed equally and share first authorship。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41432": { "id": "2610.41432", "classification": "relevant", "reason": "正文3.2和E.4具体实现每次输入前重验AX目标身份/操作条件及GUI布局租约，拒绝陈旧引用且不改投同名元素；不确定的排队OS动作导致停止而非重放，属于电脑代理执行安全机制。", "abstract_read": true, "abstract_sha256": "9b2f3cc8a0e5e7d677239a63def3f04affb9cfe37f94bd1ce0fe8f7fd2e949bf", "summary_zh": "【摘要与定向正文；作者报告】HCU统一代码、AX与GUI通道，以实时目标身份检查和截图布局租约阻断过时状态下的错误输入。目标丢失、歧义或替换时拒绝执行；焦点准备不确定且OS请求可能仍执行时停止自动化，不盲重放。论文给出一次记录的布局拒绝案例，主要基准结果仍是任务能力与效率，未隔离量化防护的安全收益。", "topics": { "tags": [ "authorization", "robustness", "monitoring" ], "reason_zh": "正文3.2和E.4具体实现每次输入前重验AX目标身份/操作条件及GUI布局租约，拒绝陈旧引用且不改投同名元素；不确定的排队OS动作导致停止而非重放，属于电脑代理执行安全机制。" }, "title": "Hybrid Computer Use: A Unified Programmatic, Semantic, and Visual Interface for General Agents", "initial_classification": "uncertain", "scope_review": { "id": "2610.41432", "version_id": "2610.41432v1", "classification": "relevant", "reason": "正文3.2和E.4具体实现每次输入前重验AX目标身份/操作条件及GUI布局租约，拒绝陈旧引用且不改投同名元素；不确定的排队OS动作导致停止而非重放，属于电脑代理执行安全机制。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.41432v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "3 Hybrid Computer Use Interface", "3.2 Guarding Actions Across Channels", "E.4 Cross-Channel State and Failure Handling", "4 Experimental Setup" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】HCU统一代码、AX与GUI通道，以实时目标身份检查和截图布局租约阻断过时状态下的错误输入。目标丢失、歧义或替换时拒绝执行；焦点准备不确定且OS请求可能仍执行时停止自动化，不盲重放。论文给出一次记录的布局拒绝案例，主要基准结果仍是任务能力与效率，未隔离量化防护的安全收益。", "topics": { "tags": [ "authorization", "robustness", "monitoring" ], "reason_zh": "正文3.2和E.4具体实现每次输入前重验AX目标身份/操作条件及GUI布局租约，拒绝陈旧引用且不改投同名元素；不确定的排队OS动作导致停止而非重放，属于电脑代理执行安全机制。" } }, "full_text_checked": true, "reviewed_sections": [ "3 Hybrid Computer Use Interface", "3.2 Guarding Actions Across Channels", "E.4 Cross-Channel State and Failure Handling", "4 Experimental Setup" ], "body_source_url": "https://arxiv.org/html/2610.41432v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.41432v1", "published": "2026-10-30T08:38:29Z", "updated": "2026-10-30T08:38:29Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CL", "cs.HC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 40 of 40 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41432v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41432", "title": "Hybrid Computer Use: A Unified Programmatic, Semantic, and Visual Interface for General Agents", "version_id": "2610.41432v1", "first_author": "Haoqing Wang", "authors": [ "Haoqing Wang", "Xiaoyi Zhang", "Sicheng Fan", "Zhexin Zhang", "Xinjie Zhang", "Jiahao Li", "Bin Li", "Yan Lu" ], "affiliations": [ "Microsoft Research" ], "source_url": "https://arxiv.org/pdf/2610.41432v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41433": { "id": "2610.41433", "classification": "relevant", "reason": "仅依据完整摘要：修复代理失败记忆可能掩盖全测试集回归，关联编码代理评估可靠性。", "abstract_read": true, "abstract_sha256": "945369bb7b061f9d88b725f2e6f0348851eebf66f5b073a1885df6c4bad177e5", "summary_zh": "【仅摘要证据；结果为作者声称】失败修复代理重试时，记忆可能提高局部测试结果而引入其他回归。作者对75个Python错误的181次失败比较五种记忆条件；记忆收益点估计均为正但不显著，自写经验不优于原始轨迹，事后全套测试发现含旧测试结果的重试更常破坏其他测试，削弱表观收益。", "topics": { "tags": [ "memory", "evaluation", "robustness" ], "reason_zh": "修复代理失败记忆可能掩盖全测试集回归，关联编码代理评估可靠性。" }, "title": "What Does a Repair Agent Gain from Remembering Its Failure? An Exploratory Study on Real Python Bugs", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41433v1", "published": "2026-10-30T08:38:54Z", "updated": "2026-10-30T08:38:54Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 19 of 19 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41433v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41433", "title": "What Does a Repair Agent Gain from Remembering Its Failure? An Exploratory Study on Real Python Bugs", "version_id": "2610.41433v1", "first_author": "Wenbo Ye", "authors": [ "Wenbo Ye", "Yongxi Zhou", "Junwei Yao", "Jiahui Ge" ], "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2610.41433v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41453": { "id": "2610.41453", "classification": "relevant", "reason": "仅依据完整摘要：直接研究工具超时和部分执行后的安全恢复与授权约束。", "abstract_read": true, "abstract_sha256": "24caf891df61aa6a8a03b7c16c73907d099f24f2691370969ef4f47b97f17086", "summary_zh": "【仅摘要证据；结果为作者声称】超时可能意味着动作失败、已提交或仍在执行。方法依据批准义务和公开证据规划恢复，以独立效果历史裁决器核验安全完成；作者报告预注册58对样本中建议接口认证完成30次，对比证据提示9次，116条轨迹均通过回放。保证受声明服务能力限制。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "直接研究工具超时和部分执行后的安全恢复与授权约束。" }, "title": "Evidence-Guided Recovery for AI Agents with Ambiguous Tool Outcomes and Partial Execution", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41453v1", "published": "2026-10-30T08:55:55Z", "updated": "2026-10-30T08:55:55Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 98 of 98 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41453v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41453", "title": "Evidence-Guided Recovery for AI Agents with Ambiguous Tool Outcomes and Partial Execution", "version_id": "2610.41453v1", "first_author": "Genliang Zhu", "authors": [ "Genliang Zhu", "Xiaobo Chen", "Ziyuan Wang", "Chu Wang" ], "affiliations": [ "Accentrust", "Georgia Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2610.41453v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41482": { "id": "2610.41482", "classification": "relevant", "reason": "仅依据完整摘要：直接研究代理递归记忆错误持续和纠正观测失效。", "abstract_read": true, "abstract_sha256": "2b307ec864315d90d5e828786c2505fff1feda8837559b7e8601961ea9717759", "summary_zh": "【仅摘要证据；结果为作者声称】递归文本记忆会持续传播既有错误。KEEPER比较四类辅助监督目标，另以逐主张分析查看纠正观测后的错误持续；作者报告奖励预测监督任务表现最佳，并指出任务成功率不足以证明记忆可靠性，错误持续证据来自一条基线轨迹。", "topics": { "tags": [ "memory", "evaluation", "robustness" ], "reason_zh": "直接研究代理递归记忆错误持续和纠正观测失效。" }, "title": "KEEPER: Learning Control-Sufficient Textual Memory for Long-Horizon LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41482v1", "published": "2026-10-30T09:36:06Z", "updated": "2026-10-30T09:36:06Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "New submissions (showing 46 of 46 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41482v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41482", "title": "KEEPER: Learning Control-Sufficient Textual Memory for Long-Horizon LLM Agents", "version_id": "2610.41482v1", "first_author": "Jinkyeong Choi", "authors": [ "Jinkyeong Choi", "Chaebin Jeong", "Junsung Jeon", "Donghyeon Park" ], "affiliations": [ "Sejong University" ], "source_url": "https://arxiv.org/pdf/2610.41482v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41576": { "id": "2610.41576", "classification": "relevant", "reason": "正文独立报告工具不适用时仍调用的退化、无调用训练样本被过滤的可能机制，并限定部署须在执行前人工/验证层核验；属于工具调用安全拒绝的实证负结果，但非真实环境端到端危害测试。", "abstract_read": true, "abstract_sha256": "9aa0e0dba915c8c199886e8e954a673f9e4ce8ae314a231cf24dfb5abcd02db1", "summary_zh": "【摘要与定向正文；作者报告】塔吉克语适配提高工具调用准确率，却降低无适用工具时的拒绝率：塔吉克语正确不调用仅6.9%，宽松解析的基础模型为31.0%。训练过滤掉无调用对话是作者提出、尚未重训验证的解释。正文明确多轮评估无真实状态环境，模型不能用于无复核的有害动作场景。", "topics": { "tags": [ "evaluation", "robustness", "authorization" ], "reason_zh": "正文独立报告工具不适用时仍调用的退化、无调用训练样本被过滤的可能机制，并限定部署须在执行前人工/验证层核验；属于工具调用安全拒绝的实证负结果，但非真实环境端到端危害测试。" }, "title": "Saidzoda-Tajik-LFM-2.6B: Adapting a 2.6B Hybrid Model to Tajik Tool Calling, and What Continued Pretraining Takes Away", "initial_classification": "uncertain", "scope_review": { "id": "2610.41576", "version_id": "2610.41576v1", "classification": "relevant", "reason": "正文独立报告工具不适用时仍调用的退化、无调用训练样本被过滤的可能机制，并限定部署须在执行前人工/验证层核验；属于工具调用安全拒绝的实证负结果，但非真实环境端到端危害测试。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2610.41576v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "4 Evaluation", "5.5 Weaknesses", "6 Discussion", "7 Intended use" ], "review_attempted": true, "review_status": "resolved", "summary_zh": "【摘要与定向正文；作者报告】塔吉克语适配提高工具调用准确率，却降低无适用工具时的拒绝率：塔吉克语正确不调用仅6.9%，宽松解析的基础模型为31.0%。训练过滤掉无调用对话是作者提出、尚未重训验证的解释。正文明确多轮评估无真实状态环境，模型不能用于无复核的有害动作场景。", "topics": { "tags": [ "evaluation", "robustness", "authorization" ], "reason_zh": "正文独立报告工具不适用时仍调用的退化、无调用训练样本被过滤的可能机制，并限定部署须在执行前人工/验证层核验；属于工具调用安全拒绝的实证负结果，但非真实环境端到端危害测试。" } }, "full_text_checked": true, "reviewed_sections": [ "4 Evaluation", "5.5 Weaknesses", "6 Discussion", "7 Intended use" ], "body_source_url": "https://arxiv.org/html/2610.41576v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.41576v1", "published": "2026-10-30T11:06:30Z", "updated": "2026-10-30T11:06:30Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 46 of 46 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41576v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41576", "title": "Saidzoda-Tajik-LFM-2.6B: Adapting a 2.6B Hybrid Model to Tajik Tool Calling, and What Continued Pretraining Takes Away", "version_id": "2610.41576v1", "first_author": "Tohir Saidzoda", "authors": [ "Tohir Saidzoda", "Nekruz Maxudov", "Bedil Karimov", "Abubakr Abdullozoda", "Amin Jalilov", "Jonibek Kishvarov", "Rahmonali Sharipov", "Mariyamkhon Shodyeva" ], "affiliations": [ "Saidzoda AI Lab, Saidzoda Engineering Company" ], "source_url": "https://arxiv.org/pdf/2610.41576v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41609": { "id": "2610.41609", "classification": "relevant", "reason": "仅依据完整摘要：VLA机器人无有效指令仍启动，直接涉及行动授权与不行动控制。", "abstract_read": true, "abstract_sha256": "f1f17a8071119aba80bc7ae3535a4116a2cf840a7132efcf819926b0c78aa4f5", "summary_zh": "【仅摘要证据；结果为作者声称】机器人不应在无指令时自行执行。作者固定初态比较六个VLA检查点的空白、无意义、不可行等指令，再测试前缀、动作差异门控和微调；空白指令下六者每集都启动，前缀全部失效，门控在五者可抑制非任务启动，微调仍不能可靠保持静止。", "topics": { "tags": [ "authorization", "embodied", "evaluation" ], "reason_zh": "VLA机器人无有效指令仍启动，直接涉及行动授权与不行动控制。" }, "title": "VLA Policies Do Not Know When Not to Act: Unintended Task Execution and Start Suppression", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41609v1", "published": "2026-10-30T11:45:50Z", "updated": "2026-10-30T11:45:50Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41609v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41609", "title": "VLA Policies Do Not Know When Not to Act: Unintended Task Execution and Start Suppression", "version_id": "2610.41609v1", "first_author": "Minsu Jang", "authors": [ "Minsu Jang", "Jae-Woo Choi", "Youngwoo Yoon", "Dohyung Kim" ], "affiliations": [ "Electronics and Telecommunications Research Institute (ETRI)", "University of Science and Technology (UST)" ], "source_url": "https://arxiv.org/pdf/2610.41609v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2610.41713": { "id": "2610.41713", "classification": "relevant", "reason": "直接审计AI control中的代码破坏监控评估可靠性。", "abstract_read": true, "abstract_sha256": "c3c2691c0f614093ac647dcb10f5a3966dabe864748937c6e5f473e9d03598ca", "summary_zh": "【仅据摘要；作者声称】发现标准诚实/后门代码数据集存在作者风格及题目特征标签捷径，简单特征超过24个开放监控模型中的20个，且七分之一后门未通过有效性检查。作者重建数据并比较新旧攻击模型，强调高分不等于能检测蓄意破坏，也未证明已有监控实际依赖捷径。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "直接审计AI control中的代码破坏监控评估可靠性。" }, "title": "Simple Features Beat Most AI Control Monitors", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41713v1", "published": "2026-10-30T13:21:03Z", "updated": "2026-10-30T13:21:03Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41713v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41713", "title": "Simple Features Beat Most AI Control Monitors", "version_id": "2610.41713v1", "first_author": "Shubhrangshu Debsarkar", "authors": [ "Shubhrangshu Debsarkar", "Valmik Nahata" ], "affiliations": [ "University of Virginia" ], "source_url": "https://arxiv.org/pdf/2610.41713v1", "shared_first_authors": [ "Shubhrangshu Debsarkar", "Valmik Nahata" ], "shared_first_note": "论文首页 * 标记及 Equal contribution / contributed equally 脚注明确声明共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.41803": { "id": "2610.41803", "classification": "relevant", "reason": "被劫持代理工具轨迹检测的低基率与迁移失效（仅据完整摘要）", "abstract_read": true, "abstract_sha256": "1b4778de697e4eb65cd5d22d1d4478d3a64e16654936561548686f4277de50a5", "summary_zh": "研究代理劫持轨迹检测的低基率、未见工具和跨基准迁移失效。固定训练阈值比较工具身份、行为、序列、嵌入、文本检测器及已发布AlignmentCheck监控器；作者报告2%攻击占比下，AUROC为0.879的检测器精确率仅0.076，负例构成改变使其在0.039—0.117之间波动；AgentDrift训练检测器迁往AgentDojo的AUROC为0.47—0.52。正文明确这是完成会话后的审计，不是阻止攻击；2%是重采样成功劫持会话占比，不是实测部署攻击率。十一篇评估综述非系统性注册检索；实验证据属于作者自建检测器、一次架构重实现及一个发布监控器，不能泛化为所有原论文系统均失效。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "被劫持代理工具轨迹检测的低基率与迁移失效" }, "title": "What Standard Evaluations Hide About Detectors of Hijacked LLM Agents: Rare Attacks, Unseen Tools and Benchmark Transfer", "version_id": "2610.41803v1", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2610.41803v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§I Introduction", "§II review selection and audit limitations", "§III A-C threat model, benchmarks, detector design" ], "published": "2026-10-30T14:30:47Z", "updated": "2026-10-30T14:30:47Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 87 of 87 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.LG", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41803", "title": "What Standard Evaluations Hide About Detectors of Hijacked LLM Agents: Rare Attacks, Unseen Tools and Benchmark Transfer", "version_id": "2610.41803v1", "first_author": "Mahmoud Abbasi", "authors": [ "Mahmoud Abbasi", "Juan M. Núñez V.", "Amin Shahraki" ], "affiliations": [ "University of Salamanca" ], "source_url": "https://arxiv.org/pdf/2610.41803v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page footnote explicitly states M. Abbasi is with the University of Salamanca.", "affiliation_checked": true }, "revision_history": [] }, "2610.41885": { "id": "2610.41885", "classification": "relevant", "reason": "MCP工具轨迹隐私泄漏，直接关联代理安全控制或失效评测（仅据最新API完整摘要）", "abstract_read": true, "abstract_sha256": "caa29cba506779c9570021b418b0d0aa6be17358d0feb2be1ee09ed39b73d498", "summary_zh": "仅据摘要，作者声称：PrivacyTrace研究只看协议合法MCP工具轨迹是否能推断用户属性，以1000合成画像、4000轨迹和25服务器构造基准；作者报告推断ASR26.25%，先验猜测17.97%，参数和返回值提供主要证据，跨会话连接放大隐私风险。", "topics": { "tags": [ "privacy", "evaluation" ], "reason_zh": "MCP工具轨迹隐私泄漏，直接关联代理安全控制或失效评测" }, "evidence_level": "full_abstract_only", "full_text_checked": false, "api_abstract_reread": true, "title": "How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces", "version_id": "2610.41885v1", "published": "2026-10-30T15:30:23Z", "updated": "2026-10-30T15:30:23Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.CL", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 40 of 40 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41885v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41885", "title": "How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces", "version_id": "2610.41885v1", "first_author": "Donghang Duan", "authors": [ "Donghang Duan", "Qingyu Liu", "Yifei Liu", "Na Zou", "Xia Hu", "Dongrui Liu" ], "affiliations": [ "Shanghai Artificial Intelligence Laboratory", "University of Electronic Science and Technology of China" ], "source_url": "https://arxiv.org/pdf/2610.41885v1", "shared_first_authors": [ "Donghang Duan", "Qingyu Liu" ], "shared_first_note": "论文首页 * 标记及 Equal contribution / contributed equally 脚注明确声明共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, or named author affiliation.", "affiliation_checked": true }, "revision_history": [] }, "2610.41998": { "id": "2610.41998", "classification": "relevant", "reason": "仅依据完整摘要：直接研究来自不可信数据的代理提示注入及对抗训练防御。", "abstract_read": true, "abstract_sha256": "2b6212241869749a4b314951fbe9f1b1add9a1cb31cf838b397b9582e3a6b708", "summary_zh": "【仅摘要证据；结果为作者声称】现有偏好训练防注入仍易受自适应攻击。SecPO近似注入不变且保留效用的参考分布，结合强攻击合成的对抗训练；作者报告AgentDojo上ASR@800为8.8%，对比Meta-SecAlign的78.8%，九项正常任务基准无明显效用下降。", "topics": { "tags": [ "injection", "evaluation", "robustness" ], "reason_zh": "直接研究来自不可信数据的代理提示注入及对抗训练防御。" }, "title": "SecPO: Principled Adversarial Training for Prompt Injection Security", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "version_id": "2610.41998v1", "published": "2026-10-30T16:43:17Z", "updated": "2026-10-30T16:43:17Z", "announcement_date": "2026-11-02", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-02", "section": "New submissions (showing 37 of 37 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-02", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-02", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.41998v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-03", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-03", "first_seen_date": "2026-11-03", "seen_dates": [ "2026-11-03" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2610.41998", "title": "SecPO: Principled Adversarial Training for Prompt Injection Security", "version_id": "2610.41998v1", "first_author": "Sizhe Chen", "authors": [ "Sizhe Chen", "Yibo Peng", "Jaewon Chang", "Chawin Sitawarin", "David Wagner" ], "affiliations": [ "UC Berkeley" ], "source_url": "https://arxiv.org/pdf/2610.41998v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "First-page author-block affiliation mapped by explicit superscript, author column, shared block, or named author footnote.", "affiliation_checked": true }, "revision_history": [] }, "2507.02976": { "id": "2507.02976", "abstract_sha256": "0dc7590878cdf5cb3f0ddbfb523e5554b8cf75dff3dae99f3ee550a480eee190", "abstract_read": true, "classification": "relevant", "reason": "直接分析编码代理生成补丁引入的安全漏洞。", "summary_zh": "问题：自动程序修复的安全研究多局限于简化任务。方法：在SWE-bench训练与测试集共2万余问题上比较人工补丁、两种LLM和四种代理框架，分析上下文与修改因素。作者报告Llama 3.3引入135个手工确认漏洞，匹配人工补丁12个；四种代理均引入漏洞，OpenHands在11个问题中保留44个漏洞，较广修改及信息缺失与风险相关。", "topics": { "tags": [ "supplychain", "evaluation" ], "reason_zh": "直接分析编码代理生成补丁引入的安全漏洞。" }, "reason_zh": "直接分析编码代理生成补丁引入的安全漏洞。", "version_id": "2507.02976v4", "title": "How Safe Are AI-Generated Patches? A Large-scale Study on Security Risks in LLM and Agentic Automated Program Repair on SWE-bench", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2025-06-30T21:10:19Z", "updated": "2026-11-01T21:40:38Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR", "cs.LG", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 29 of 29 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2507.02976v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2507.02976", "title": "How Safe Are AI-Generated Patches? A Large-scale Study on Security Risks in LLM and Agentic Automated Program Repair on SWE-bench", "version_id": "2507.02976v4", "first_author": "Amirali Sajadi", "authors": [ "Amirali Sajadi", "Kostadin Damevski", "Preetha Chatterjee" ], "affiliations": [ "Drexel University" ], "source_url": "https://arxiv.org/pdf/2507.02976v4", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v4边栏匹配；AMIRALI SAJADI姓名同行明确署名Drexel University，作者联系脚注再次确认。", "affiliation_checked": true }, "revision_history": [] }, "2510.06445": { "id": "2510.06445", "abstract_sha256": "9477cd97031cf527262f0cabc728fe640cfb6dcb2e194eb2c4227475d4d7b3f4", "abstract_read": true, "classification": "relevant", "reason": "综述直接覆盖Agent攻击面、防御和攻防评测。", "summary_zh": "问题：Agent安全研究缺少贯通应用、威胁与防御的全景结构。方法：为274篇论文建立分类，量化安全生命周期覆盖、攻击入口及代理循环阶段、防御成本与部署位置。作者提供防御与攻击覆盖映射及架构、基础模型、模态趋势分析，旨在揭示研究集中区和空白，而非提出新的攻击成功率。", "topics": { "tags": [ "injection", "supplychain", "authorization", "memory", "multiagent", "monitoring", "evaluation" ], "reason_zh": "综述直接覆盖Agent攻击面、防御和攻防评测。" }, "reason_zh": "综述直接覆盖Agent攻击面、防御和攻防评测。", "version_id": "2510.06445v4", "title": "A Survey on Agentic Security: Applications, Threats and Defenses", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2025-10-07T20:32:20Z", "updated": "2026-10-31T19:41:43Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2510.06445v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2510.06445", "title": "A Survey on Agentic Security: Applications, Threats and Defenses", "version_id": "2510.06445v4", "first_author": "Asif Shahriar", "authors": [ "Asif Shahriar", "Md Nafiu Rahman", "Sadif Ahmed", "Farig Sadeque", "Md Rizwan Parvez" ], "affiliations": [ "BRAC University" ], "source_url": "https://arxiv.org/pdf/2510.06445v4", "shared_first_authors": [ "Asif Shahriar", "Md Nafiu Rahman", "Sadif Ahmed" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v4边栏匹配；Asif Shahriar上标1映射BRAC University；前三作者均星号，脚注明示Equal contribution。", "affiliation_checked": true }, "revision_history": [] }, "2604.22985": { "id": "2604.22985", "abstract_sha256": "19fb544e921927e2fe8133dd15ec57c20dd4b78bd8b2756a757c2984802a3e2a", "abstract_read": true, "classification": "relevant", "reason": "在执行不可逆工具操作前评估错误调用风险与弃权。", "summary_zh": "问题：错误函数调用可能转账或删除数据。方法：比较函数调用不确定性量化，测试抽象语法树聚类和语义相关token评分。作者发现熵类多样本方法不明显优于简单单样本方法；语法树聚类改善多样本方法，语义token筛选主要改善校准并小幅改善弃权效用。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "在执行不可逆工具操作前评估错误调用风险与弃权。" }, "reason_zh": "在执行不可逆工具操作前评估错误调用风险与弃权。", "version_id": "2604.22985v2", "title": "Uncertainty Quantification for LLM Function-Calling", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-04-24T19:56:39Z", "updated": "2026-10-30T23:08:24Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2604.22985v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2604.22985", "title": "Uncertainty Quantification for LLM Function-Calling", "version_id": "2604.22985v2", "first_author": "Zihuiwen Ye", "authors": [ "Zihuiwen Ye", "Lukas Aichberger", "Michael Kirchhof", "Sinead Williamson", "Luca Zappella", "Yarin Gal", "Arno Blaas", "Adam Golinski" ], "affiliations": [ "University of Oxford" ], "source_url": "https://arxiv.org/pdf/2604.22985v2", "shared_first_authors": [ "Zihuiwen Ye", "Lukas Aichberger" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Zihuiwen Ye和Lukas Aichberger后共有University of Oxford块；两人星号对应Equal contribution。", "affiliation_checked": true }, "revision_history": [] }, "2605.20258": { "id": "2605.20258", "abstract_sha256": "0f170d08c062e9306f8db893ee07f6f99154868fdaa363f29a0396843b61a600", "abstract_read": true, "classification": "relevant", "reason": "直接研究个人代理敏感工作流的信息披露及累积私有上下文。", "summary_zh": "问题：个人代理难兼顾情境完整性隐私与任务效用。方法：SELFCI用两种反馈教师的反向KL分别保持任务信息和最小适当披露，形成专家乘积目标。作者称无需昂贵外部监督即可持续优于GRPO等基线，并在代理工作流与累积私有上下文的域外场景延续收益。", "topics": { "tags": [ "privacy", "memory" ], "reason_zh": "直接研究个人代理敏感工作流的信息披露及累积私有上下文。" }, "reason_zh": "直接研究个人代理敏感工作流的信息披露及累积私有上下文。", "version_id": "2605.20258v2", "title": "It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-05-18T13:57:44Z", "updated": "2026-11-01T18:04:33Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.20258v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.20258", "title": "It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs", "version_id": "2605.20258v2", "first_author": "Sangwoo Park", "authors": [ "Sangwoo Park", "Woongyeong Yeo", "Seanie Lee", "Yumin Choi", "Hyomin Lee", "Kangsan Kim", "Jinheon Baek", "Seong Joon Oh", "Sung Ju Hwang" ], "affiliations": [ "KAIST" ], "source_url": "https://arxiv.org/pdf/2605.20258v2", "shared_first_authors": [ "Sangwoo Park", "Woongyeong Yeo" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Sangwoo Park上标1对应KAIST，与Woongyeong Yeo星号对应Equal contribution；DeepAuto.ai仅映射其他作者。", "affiliation_checked": true }, "revision_history": [] }, "2606.09935": { "id": "2606.09935", "abstract_sha256": "d3837aa6e90e4f901b8401d1b822276b0fcaf50fd40480b9b04c0ed8274e20c7", "abstract_read": true, "classification": "relevant", "reason": "正文威胁模型明确低权限外部PR/issue通过配置文件跨越CI/CD代理的信任边界；真实工作流执行验证而非模拟工具。", "summary_zh": "问题：无人预审批的CI/CD代理读取未合并贡献时，配置文件可被提升为操作者指令。方法：GitInject在临时真实仓库执行四提供方五个工作流、11种命名场景，比较提示入口与工作流防御。作者报告每个提供方至少一种受测高危场景成功，但部分较新模型抵抗配置注入；正文明确Gemini触发器被改为pull_request_target以使fork PR可用仓库秘密，因此不能解读为全部默认配置均受影响。每场景五次运行、枚举非穷尽，模型与补丁时效限制结论；已核读正文§3–6，未复现实验。", "topics": { "tags": [ "injection", "supplychain", "authorization", "evaluation" ], "reason_zh": "真实CI/CD工作流中不可信贡献加载配置、滥用凭据及权限。" }, "reason_zh": "真实CI/CD工作流中不可信贡献加载配置、滥用凭据及权限。", "version_id": "2606.09935v2", "title": "GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2606.09935v2", "source_url": "https://arxiv.org/abs/2606.09935v2", "reviewed_sections": [ "Abstract", "3 Threat Model", "4 GitInject workflows and evaluation", "5 Results tables 2,3,5", "6.3 Limitations" ], "evidence_level": "abstract_and_targeted_body", "published": "2026-06-07T19:17:18Z", "updated": "2026-11-02T07:35:20Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.09935", "title": "GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines", "version_id": "2606.09935v2", "first_author": "Jafar Isbarov", "authors": [ "Jafar Isbarov", "Umid Suleymanov", "Ilia Shumailov", "Murat Kantarcioglu" ], "affiliations": [ "Virginia Tech" ], "source_url": "https://arxiv.org/pdf/2606.09935v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Jafar Isbarov作者列下明确Virginia Tech。", "affiliation_checked": true }, "revision_history": [] }, "2606.26350": { "id": "2606.26350", "abstract_sha256": "5db74d8641d2c1fda9c8af08c678c4a0d9a0c020b536b3a4b196273cba5a7e35", "abstract_read": true, "classification": "relevant", "reason": "正文4.2明确将代理可见容器与host-side verifier隔离，禁止挂载隐藏标签并限制提交API调用频率以防逆向真值；是代理评测环境的信息边界及作弊防护，不仅金融任务能力。", "summary_zh": "OpenFinGym把78项量化金融任务统一为容器内代理执行与宿主验证。代理容器排除测试标签，验证API限流以降低逆向恢复真值风险，支持批量与序列任务。作者报告四个前沿模型的任务族表现以及SFT/RL训练收益；尚未专门量化对抗性绕过隔离的成功率。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "正文4.2明确将代理可见容器与host-side verifier隔离，禁止挂载隐藏标签并限制提交API调用频率以防逆向真值；是代理评测环境的信息边界及作弊防护，不仅金融任务能力。" }, "reason_zh": "金融Agent环境明确包含宿主验证器与容器防泄漏，是否对抗性安全评测需确认。", "version_id": "2606.26350v3", "title": "OpenFinGym: A Verifiable Multi-Task Gym Environment for Evaluating Quant Agents", "initial_classification": "uncertain", "scope_review": { "id": "2606.26350", "version_id": "2606.26350v3", "classification": "relevant", "reason": "正文4.2明确将代理可见容器与host-side verifier隔离，禁止挂载隐藏标签并限制提交API调用频率以防逆向真值；是代理评测环境的信息边界及作弊防护，不仅金融任务能力。", "summary_zh": "OpenFinGym把78项量化金融任务统一为容器内代理执行与宿主验证。代理容器排除测试标签，验证API限流以降低逆向恢复真值风险，支持批量与序列任务。作者报告四个前沿模型的任务族表现以及SFT/RL训练收益；尚未专门量化对抗性绕过隔离的成功率。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "正文4.2明确将代理可见容器与host-side verifier隔离，禁止挂载隐藏标签并限制提交API调用频率以防逆向真值；是代理评测环境的信息边界及作弊防护，不仅金融任务能力。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2606.26350v3", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Task design", "4.2 Task execution", "Limitations" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Task design", "4.2 Task execution", "Limitations" ], "body_source_url": "https://arxiv.org/pdf/2606.26350v3", "evidence_level": "abstract_and_targeted_body", "published": "2026-06-24T19:42:55Z", "updated": "2026-11-01T18:18:58Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.26350v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.26350", "title": "OpenFinGym: A Verifiable Multi-Task Gym Environment for Evaluating Quant Agents", "version_id": "2606.26350v3", "first_author": "Kaicheng Zhang", "authors": [ "Kaicheng Zhang", "Wen Ge", "Lei Jiang", "Weixin Yang", "Jordan Langham-Lopez", "Jialin Yu", "Lukasz Szpruch", "Hao Ni" ], "affiliations": [ "University of Edinburgh" ], "source_url": "https://arxiv.org/pdf/2606.26350v3", "shared_first_authors": [ "Kaicheng Zhang", "Wen Ge" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v3边栏匹配；Kaicheng Zhang上标1对应Edinburgh，与Wen Ge星号对应Equal contribution。", "affiliation_checked": true }, "revision_history": [] }, "2607.23983": { "id": "2607.23983", "abstract_sha256": "0cf2982400dc807a202d84576bf1b24e8f05a7f33dbaa57eebf3c2f062895d7a", "abstract_read": true, "classification": "relevant", "reason": "正文2.1–2.3明确固定SKILL执行边界、运行时工具过滤、可访问资源限制和专家批准门，缺字段必须澄清；在高后果洪水预警流程中限制LLM请求权限与结果进入下游的条件，构成具体代理执行安全设计。", "summary_zh": "问题：洪水预报专家经验难显式化，LLM不应自证数值或无约束发布预警。方法：CHA-Flood将五步流程拆成静态SKILL，固定许可工具与资源并做运行时过滤，推理与水文计算分离，关键阶段需专家批准；缺失数据先澄清，判断保存前检查物理红线。作者称五种LLM可执行流程，方案选择使KGE提升0.023–0.154；未提供对抗攻击成功率。", "topics": { "tags": [ "authorization", "monitoring" ], "reason_zh": "正文2.1–2.3明确固定SKILL执行边界、运行时工具过滤、可访问资源限制和专家批准门，缺字段必须澄清；在高后果洪水预警流程中限制LLM请求权限与结果进入下游的条件，构成具体代理执行安全设计。" }, "reason_zh": "用技能规则限制LLM推理并设审查点，可能是领域代理安全边界但摘要主要验证预测性能。", "version_id": "2607.23983v2", "title": "Community HydroAgent: Formalizing Forecaster Expertise into Skill-Orchestrated Flood Forecasting Workflows", "initial_classification": "uncertain", "scope_review": { "id": "2607.23983", "version_id": "2607.23983v2", "classification": "relevant", "reason": "正文2.1–2.3明确固定SKILL执行边界、运行时工具过滤、可访问资源限制和专家批准门，缺字段必须澄清；在高后果洪水预警流程中限制LLM请求权限与结果进入下游的条件，构成具体代理执行安全设计。", "summary_zh": "问题：洪水预报专家经验难显式化，LLM不应自证数值或无约束发布预警。方法：CHA-Flood将五步流程拆成静态SKILL，固定许可工具与资源并做运行时过滤，推理与水文计算分离，关键阶段需专家批准；缺失数据先澄清，判断保存前检查物理红线。作者称五种LLM可执行流程，方案选择使KGE提升0.023–0.154；未提供对抗攻击成功率。", "topics": { "tags": [ "authorization", "monitoring" ], "reason_zh": "正文2.1–2.3明确固定SKILL执行边界、运行时工具过滤、可访问资源限制和专家批准门，缺字段必须澄清；在高后果洪水预警流程中限制LLM请求权限与结果进入下游的条件，构成具体代理执行安全设计。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2607.23983v2", "reviewed_sections": [ "Abstract", "1 Introduction", "2.1 Overall CHA-Flood Workflow", "2.2 Skill Design and Execution Boundary", "2.3 Analog Event Judgment Skill" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "2.1 Overall CHA-Flood Workflow", "2.2 Skill Design and Execution Boundary", "2.3 Analog Event Judgment Skill" ], "body_source_url": "https://arxiv.org/html/2607.23983v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-07-27T04:18:36Z", "updated": "2026-11-01T15:29:21Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.LG", "physics.geo-ph" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2607.23983v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.23983", "title": "Community HydroAgent: Formalizing Forecaster Expertise into Skill-Orchestrated Flood Forecasting Workflows", "version_id": "2607.23983v2", "first_author": "Qingyi Yang", "authors": [ "Qingyi Yang", "Siqian Qiu", "Bing Li", "Xu Shan", "Jia Feng", "Shunan Zhou", "Xudong Zhou", "Tiantian Xing", "Jiale Guo", "Xiaoyi Dong", "Gaoyu Liu", "Xiaohuan Liu", "Haiqing Pu", "Qingwen Deng", "Xun Zhang", "Zhongrun Xiang", "Haiyang Qian", "Ying Yan", "Yongkang Xu", "Nuo Lei", "Tianlong Jia", "Baoying Shan", "Carlo De Michele" ], "affiliations": [ "Department of Civil and Environmental Engineering (D.I.C.A.), Politecnico di Milano" ], "source_url": "https://arxiv.org/pdf/2607.23983v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Qingyi Yang上标1对应Politecnico di Milano土木与环境工程系，不把后续18个单位合并。", "affiliation_checked": true }, "revision_history": [] }, "2608.22444": { "id": "2608.22444", "abstract_sha256": "54b5ee9346c53546fa749f2c2352faadd2931b7ee6620405346f0174ad575467", "abstract_read": true, "classification": "relevant", "reason": "直接研究安全分诊监控代理群体被恶意少数操纵。", "summary_zh": "问题：单代理可靠不保证群体安全。方法：在告警升级或忽略任务引入固定立场恶意少数，用无攻击时行为拟合群体响应。作者称可预测24和48个代理的攻击响应；共享推理不能可靠阻止俘获，撤去攻击者后经历5或30轮施压的平均行为仍向原状态回归。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "直接研究安全分诊监控代理群体被恶意少数操纵。" }, "reason_zh": "直接研究安全分诊监控代理群体被恶意少数操纵。", "version_id": "2608.22444v3", "title": "Aligned Alone, Misaligned Together: Forecasting Adversarial Capture in LLM Agent Populations", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-23T14:49:59Z", "updated": "2026-10-30T22:00:35Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.22444v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.22444", "title": "Aligned Alone, Misaligned Together: Forecasting Adversarial Capture in LLM Agent Populations", "version_id": "2608.22444v3", "first_author": "Isotta Magistrali", "authors": [ "Isotta Magistrali", "Chen Shani" ], "affiliations": [ "ETH Zurich" ], "source_url": "https://arxiv.org/pdf/2608.22444v3", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v3边栏匹配；Isotta Magistrali作者列为ETH Zurich，右列Tel Aviv与Stanford归第二作者。", "affiliation_checked": true }, "revision_history": [] }, "2610.21270": { "id": "2610.21270", "abstract_sha256": "c76a8aeb48d7b93d7f3cc11bb5edf1d5488bf3c388f920080bf690cd6c949f11", "abstract_read": true, "classification": "relevant", "reason": "直接测医疗代理在缺失、过期、冲突证据下升级处置失败及控制器稳健性。", "summary_zh": "问题：静态正确回答掩盖医疗代理工作流安全动作失败。方法：400个合成情节、四种动作及漏升级对多余升级5:1成本，比较五个模型和工作流控制器。作者报告原模型漏升级32–97%，控制器降至12–24%，但未见改述使规则检测召回从1降0；标签来自单作者策略而非临床裁定。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "直接测医疗代理在缺失、过期、冲突证据下升级处置失败及控制器稳健性。" }, "reason_zh": "直接测医疗代理在缺失、过期、冲突证据下升级处置失败及控制器稳健性。", "version_id": "2610.21270v2", "title": "Auditing Escalation Reliability in Healthcare LLM Agents: A Perturbation-Controlled Benchmark of Workflow-State Failures", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-15T05:04:10Z", "updated": "2026-11-01T21:06:13Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.21270v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.21270", "title": "Auditing Escalation Reliability in Healthcare LLM Agents: A Perturbation-Controlled Benchmark of Workflow-State Failures", "version_id": "2610.21270v2", "first_author": "Zihao Zheng", "authors": [ "Zihao Zheng", "Junyi Yao", "Baichuan Li", "Jiayu Long" ], "affiliations": [ "Washington University in St. Louis" ], "source_url": "https://arxiv.org/pdf/2610.21270v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2匹配；Zihao Zheng星号对应Washington University，星号是单位标记并非共同一作。", "affiliation_checked": true }, "revision_history": [] }, "2611.00287": { "id": "2611.00287", "abstract_sha256": "33e342d5100f9ad0b5c5b7690efeb0789f3b47e68f7b7346a1e646dc108d8627", "abstract_read": true, "classification": "relevant", "reason": "正文第三节明确针对证明代理通过削弱规格、改变执行代码、添加公理或信任标记来骗过验证的风险，Lynette独立作弊检查与干净容器双重验收；外部参考解下载受限并审计会话。虽主要衡量证明修复能力，但包含可核验的代理评测完整性与执行边界。", "summary_zh": "问题：并发Rust证明修复既难以自动完成，也可能因代理改动规格或信任假设而形成虚假通过。方法：VerusWeave提供75个聚焦任务及17个整模块变体，要求保持执行代码和契约，禁止assume/admit、公理及信任化；在独立容器运行Verus和扩展Lynette作弊检查，限制外部解检索并保存会话。作者比较四种编码代理，报告原子操作相关证明仍有未解任务，更多资源并不保证更多有效修复；未声称测量攻击成功率。", "topics": { "tags": [ "evaluation", "authorization", "monitoring" ], "reason_zh": "正文第三节明确针对证明代理通过削弱规格、改变执行代码、添加公理或信任标记来骗过验证的风险，Lynette独立作弊检查与干净容器双重验收；外部参考解下载受限并审计会话。虽主要衡量证明修复能力，但包含可核验的代理评测完整性与执行边界。" }, "reason_zh": "编码代理证明修复有代码与规格不变检查，可能涉及约束完整性，但未明确安全攻防。", "version_id": "2611.00287v1", "title": "VerusWeave: A Benchmark for Proof Repair in Concurrent Verus Programs", "initial_classification": "uncertain", "scope_review": { "id": "2611.00287", "version_id": "2611.00287v1", "classification": "relevant", "reason": "正文第三节明确针对证明代理通过削弱规格、改变执行代码、添加公理或信任标记来骗过验证的风险，Lynette独立作弊检查与干净容器双重验收；外部参考解下载受限并审计会话。虽主要衡量证明修复能力，但包含可核验的代理评测完整性与执行边界。", "summary_zh": "问题：并发Rust证明修复既难以自动完成，也可能因代理改动规格或信任假设而形成虚假通过。方法：VerusWeave提供75个聚焦任务及17个整模块变体，要求保持执行代码和契约，禁止assume/admit、公理及信任化；在独立容器运行Verus和扩展Lynette作弊检查，限制外部解检索并保存会话。作者比较四种编码代理，报告原子操作相关证明仍有未解任务，更多资源并不保证更多有效修复；未声称测量攻击成功率。", "topics": { "tags": [ "evaluation", "authorization", "monitoring" ], "reason_zh": "正文第三节明确针对证明代理通过削弱规格、改变执行代码、添加公理或信任标记来骗过验证的风险，Lynette独立作弊检查与干净容器双重验收；外部参考解下载受限并审计会话。虽主要衡量证明修复能力，但包含可核验的代理评测完整性与执行边界。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.00287v1", "reviewed_sections": [ "Abstract", "I Introduction", "II Benchmark Design", "III Evaluation Framework: Execution and Solution Validation", "IV Experimental Evaluation" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "I Introduction", "II Benchmark Design", "III Evaluation Framework: Execution and Solution Validation", "IV Experimental Evaluation" ], "body_source_url": "https://arxiv.org/pdf/2611.00287v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-30T19:14:32Z", "updated": "2026-10-30T19:14:32Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LO", "cs.PL", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00287v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00287", "title": "VerusWeave: A Benchmark for Proof Repair in Concurrent Verus Programs", "version_id": "2611.00287v1", "first_author": "Pedro Ribeiro", "authors": [ "Pedro Ribeiro", "Martim Afonso", "André Vasconcelos", "João F. Ferreira" ], "affiliations": [ "INESC-ID", "Instituto Superior Técnico, Universidade de Lisboa" ], "source_url": "https://arxiv.org/pdf/2611.00287v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Pedro Ribeiro星号对应INESC-ID及里斯本大学IST，星号为单位标记。", "affiliation_checked": true }, "revision_history": [] }, "2611.00386": { "id": "2611.00386", "abstract_sha256": "61d3e8974ada4fdb03571d401751919549d464bcac6f2930e7913cc6a3899d5e", "abstract_read": true, "classification": "relevant", "reason": "直接建模代理阻止未授权动作的多层安全防护及相关失效。", "summary_zh": "问题：独立假设会误估多组件代理防护的风险与成本。方法：建立依赖感知的分层筛查、选择性验证优化，推导双阈值路由并提供DAPOA软件。作者报告独立假设选择在八场景中六个违反安全要求，四个LLM防护器实测中依赖感知选择使保留集总成本下降39.6%。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "直接建模代理阻止未授权动作的多层安全防护及相关失效。" }, "reason_zh": "直接建模代理阻止未授权动作的多层安全防护及相关失效。", "version_id": "2611.00386v1", "title": "Dependence-Aware Risk Assessment and Optimal Design of AI-Agent Safeguard Systems", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-30T21:07:42Z", "updated": "2026-10-30T21:07:42Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00386v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00386", "title": "Dependence-Aware Risk Assessment and Optimal Design of AI-Agent Safeguard Systems", "version_id": "2611.00386v1", "first_author": "Yijia Li", "authors": [ "Yijia Li", "Maochao Xu", "Peng Zhao" ], "affiliations": [ "School of Statistics and Data Science, Shanghai University of International Business and Economics" ], "source_url": "https://arxiv.org/pdf/2611.00386v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Yijia Li上标1映射上海对外经贸大学统计与数据科学学院。", "affiliation_checked": true }, "revision_history": [] }, "2611.00463": { "id": "2611.00463", "abstract_sha256": "bc0188e0e5435e1cb71684e05874deee14647dda7c589cfbaf2854e89a4c711c", "abstract_read": true, "classification": "relevant", "reason": "自修改代理运行时用受保护机制保存历史并控制策略激活，直接关联控制边界。", "summary_zh": "问题：手工代理harness难优化，离线自动优化成本高。方法：Exo允许运行时修改harness和改进策略，以最小受保护机制保留执行历史并管理策略激活，可检查代码变化。作者报告开放游戏单次运行模型成本降低12–53%，AppWorld/SREGym相对不允许编辑策略的起点降低35–61%且正确性相近；摘要未提供对抗攻击结果。", "topics": { "tags": [ "authorization", "monitoring" ], "reason_zh": "自修改代理运行时用受保护机制保存历史并控制策略激活，直接关联控制边界。" }, "reason_zh": "自修改代理运行时用受保护机制保存历史并控制策略激活，直接关联控制边界。", "version_id": "2611.00463v1", "title": "Exo: An Architecture for Self-Improving Systems at Runtime", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-30T23:31:22Z", "updated": "2026-10-30T23:31:22Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00463v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00463", "title": "Exo: An Architecture for Self-Improving Systems at Runtime", "version_id": "2611.00463v1", "first_author": "Alexander Krentsel", "authors": [ "Alexander Krentsel", "Sylvia Ratnasamy", "Ion Stoica", "Martin Casado", "Ankur Goyal" ], "affiliations": [ "University of California, Berkeley" ], "source_url": "https://arxiv.org/pdf/2611.00463v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Alexander Krentsel上标1；星号脚注为通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.00546": { "id": "2611.00546", "abstract_sha256": "d9f78a37ae781eeedc244e5a406f5fe97254a31289bc2e392cbdb475f8fa4989", "abstract_read": true, "classification": "relevant", "reason": "直接审计多代理内部扰动如何经转录传播并改变最终决策。", "summary_zh": "问题：确定性重放不等于对内部受控扰动稳健。方法：五代理贪心委员会中预选低高margin token、验证无操作重放、注入相对范数残差位移，测十token内分叉并延续到委员会结果。作者发现低margin更易分叉，降低margin的梯度方向比增加方向更易分叉；不声称部署发生率或决策正确性。", "topics": { "tags": [ "multiagent", "evaluation", "robustness" ], "reason_zh": "直接审计多代理内部扰动如何经转录传播并改变最终决策。" }, "reason_zh": "直接审计多代理内部扰动如何经转录传播并改变最终决策。", "version_id": "2611.00546v1", "metadata_corrections": [ { "id": "2611.00546", "version_id": "2611.00546v1", "field": "title", "old_value": "Low-Margin Branch Points in Deterministic LLM Deliberatio", "new_value": "Low-Margin Branch Points in Deterministic LLM Deliberation", "source_url": "https://arxiv.org/pdf/2611.00546v1", "reason": "官方API标题尾部缺n；论文首页完整标题已人工核对。" } ], "title": "Low-Margin Branch Points in Deterministic LLM Deliberation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T02:01:39Z", "updated": "2026-10-31T02:01:39Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00546v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00546", "title": "Low-Margin Branch Points in Deterministic LLM Deliberation", "version_id": "2611.00546v1", "first_author": "Hajime Shimao", "authors": [ "Hajime Shimao", "Warut Khern-am-nua" ], "affiliations": [ "Penn State University" ], "source_url": "https://arxiv.org/pdf/2611.00546v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页v1匹配；Hajime Shimao上标1。PDF完整标题为Low-Margin Branch Points in Deterministic LLM Deliberation，API标题末尾Deliberatio缺n。", "affiliation_checked": true, "pdf_title": "Low-Margin Branch Points in Deterministic LLM Deliberation", "title_discrepancy": "API标题末尾缺n，PDF首页完整拼写Deliberation。" }, "revision_history": [] }, "2611.00610": { "id": "2611.00610", "abstract_sha256": "9160269693fbb97fec49d817fda5a1df0f9adcda4e78ff1f1ca95dddf35d451b", "abstract_read": true, "classification": "relevant", "reason": "正文引言明确误开锁/烤箱等物理风险，3/4节将语义解释与运行时动作约束强制分离，由注册表限制设备、操作与参数，低置信拒绝且全本地保护家庭上下文。直接连接语言模型控制器动作边界，不仅泛准确率。", "summary_zh": "Trail把家庭自然语言控制拆为房间、设备、操作等类型化选择，候选与参数从设备注册表生成并在运行时强制校验，低置信时弃权；记忆与推理全本地运行。作者报告Trek-Robust准确率85.3%对69.8%，多轮记忆请求75.6%对42.5%；这些是任务准确率结果，不是对抗攻击或危险动作率证明。", "topics": { "tags": [ "authorization", "embodied", "privacy" ], "reason_zh": "正文引言明确误开锁/烤箱等物理风险，3/4节将语义解释与运行时动作约束强制分离，由注册表限制设备、操作与参数，低置信拒绝且全本地保护家庭上下文。直接连接语言模型控制器动作边界，不仅泛准确率。" }, "reason_zh": "本地智能家居代理以类型动作空间、置信弃权避免非法执行并降低云端隐私暴露。", "version_id": "2611.00610v1", "title": "Trail: Accurate Local Smart Home Control Using Decision Models", "initial_classification": "relevant", "scope_review": { "id": "2611.00610", "version_id": "2611.00610v1", "classification": "relevant", "reason": "正文引言明确误开锁/烤箱等物理风险，3/4节将语义解释与运行时动作约束强制分离，由注册表限制设备、操作与参数，低置信拒绝且全本地保护家庭上下文。直接连接语言模型控制器动作边界，不仅泛准确率。", "summary_zh": "Trail把家庭自然语言控制拆为房间、设备、操作等类型化选择，候选与参数从设备注册表生成并在运行时强制校验，低置信时弃权；记忆与推理全本地运行。作者报告Trek-Robust准确率85.3%对69.8%，多轮记忆请求75.6%对42.5%；这些是任务准确率结果，不是对抗攻击或危险动作率证明。", "topics": { "tags": [ "authorization", "embodied", "privacy" ], "reason_zh": "正文引言明确误开锁/烤箱等物理风险，3/4节将语义解释与运行时动作约束强制分离，由注册表限制设备、操作与参数，低置信拒绝且全本地保护家庭上下文。直接连接语言模型控制器动作边界，不仅泛准确率。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.00610v1", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Motivation", "4 Trail design", "Abstention/calibration discussion" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Motivation", "4 Trail design", "Abstention/calibration discussion" ], "body_source_url": "https://arxiv.org/pdf/2611.00610v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-31T04:13:21Z", "updated": "2026-10-31T04:13:21Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00610v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00610", "title": "Trail: Accurate Local Smart Home Control Using Decision Models", "version_id": "2611.00610v1", "first_author": "Maleeha Masood", "authors": [ "Maleeha Masood", "Deepak Vasisht", "Indranil Gupta" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "source_url": "https://arxiv.org/html/2611.00610v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Maleeha Masood上标1；PDF提取无单位，HTML footnotex1明确1为University of Illinois Urbana-Champaign及作者通讯邮箱。", "affiliation_checked": true }, "revision_history": [] }, "2611.00729": { "id": "2611.00729", "abstract_sha256": "05538a7f37c3037945a69f923df72e604f78454950ebd2715cfede7456231ee9", "abstract_read": true, "classification": "relevant", "reason": "直接通过MCP工具边界能力令牌防止提示注入转化为未授权执行。", "summary_zh": "问题：模型选动作与授权混同，使间接注入可滥用长期权限。方法：AgentCap在MCP封装层检查信任、流程先决、互斥权限及敏感参数来源，签发短期有预算令牌，委托仅能沿会话绑定父子链衰减。作者报告AgentDojo与InjecAgent所有测试组合攻击成功率下降，GPT-5.4两基准为0；受控对抗场景阻止全部未授权执行并保留测试中全部合法操作。", "topics": { "tags": [ "authorization", "injection", "multiagent", "evaluation" ], "reason_zh": "直接通过MCP工具边界能力令牌防止提示注入转化为未授权执行。" }, "reason_zh": "直接通过MCP工具边界能力令牌防止提示注入转化为未授权执行。", "version_id": "2611.00729v1", "title": "AgentCap: Capability-Based Runtime Authorization for Secure LLM Agent Execution", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T08:13:11Z", "updated": "2026-10-31T08:13:11Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00729v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00729", "title": "AgentCap: Capability-Based Runtime Authorization for Secure LLM Agent Execution", "version_id": "2611.00729v1", "first_author": "Aravinda Kashyap Kabbinamakki Suresh", "authors": [ "Aravinda Kashyap Kabbinamakki Suresh", "Peng Gao" ], "affiliations": [ "Virginia Tech" ], "source_url": "https://arxiv.org/pdf/2611.00729v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Aravinda Kashyap Kabbinamakki Suresh第一作者栏明确Virginia Tech。", "affiliation_checked": true }, "revision_history": [] }, "2611.01042": { "id": "2611.01042", "abstract_sha256": "04489c72d68b91535e478becad95dd2b627ab82c9ea1f3f3bf78ecf85042a581", "abstract_read": true, "classification": "relevant", "reason": "直接研究 LLM Agent 执行业务前的 SKILL 约束与合规审计。", "summary_zh": "长 SKILL 文档的相似度检索会遗漏先决条件。SkillCDG 将规则编成依赖图，以闭包选择上下文，并联合优化检索和审计。作者称在三个企业数据集和两个公共基准上，准确率与 F1 优于全文和检索基线。", "topics": { "tags": [ "authorization", "monitoring" ], "reason_zh": "直接研究 LLM Agent 执行业务前的 SKILL 约束与合规审计。" }, "reason_zh": "直接研究 LLM Agent 执行业务前的 SKILL 约束与合规审计。", "version_id": "2611.01042v1", "title": "Constraint Dependency Graph Retrieval for Compliance Detection on Long SKILL Documents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T15:31:27Z", "updated": "2026-10-31T15:31:27Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01042v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01042", "title": "Constraint Dependency Graph Retrieval for Compliance Detection on Long SKILL Documents", "version_id": "2611.01042v1", "first_author": "Shuaitao Zhao", "authors": [ "Shuaitao Zhao", "Feng Ni", "Lichao Ma", "Yuchen Wei", "Shuaike Li", "Jiaye Lin", "Fei Han", "Yang Wei", "Lu Pan" ], "affiliations": [ "Meituan" ], "source_url": "https://arxiv.org/pdf/2611.01042v1", "shared_first_authors": [ "Shuaitao Zhao", "Feng Ni" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Shuaitao Zhao作者栏明确Meituan；星号明示共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2611.01112": { "id": "2611.01112", "version_id": "2611.01112v1", "abstract_sha256": "b69e673eb9ad99a62234c2a53ad050d5c053bf54bcc410b600a9e6f65d9591fc", "abstract_read": true, "classification": "relevant", "reason_zh": "具身 Agent 统一动作准入、运行时检查和偏离停止直接属于执行安全。", "summary_zh": "Auriga 针对语言模型规划与动作差距，提供显式任务信念、统一机器人动作入口、运动前轨迹预览，以及运行时容差和抓取边界检查，偏离即停并反馈修复。RoboDojo 成功率 57.7%，RoboCasa365 73.2%；摘要的指标是整体任务性能，不是独立安全收益。", "topics": { "tags": [ "embodied", "authorization", "monitoring" ], "reason_zh": "具身 Agent 统一动作准入、运行时检查和偏离停止直接属于执行安全。" }, "reason": "具身 Agent 统一动作准入、运行时检查和偏离停止直接属于执行安全。", "title": "Auriga Technical Report: A Task-Agnostic Agent Harness for Zero-Shot Embodied Manipulation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T16:59:05Z", "updated": "2026-10-31T16:59:05Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01112v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01112", "title": "Auriga Technical Report: A Task-Agnostic Agent Harness for Zero-Shot Embodied Manipulation", "version_id": "2611.01112v1", "first_author": "Chengcheng Wang", "authors": [ "Chengcheng Wang", "Yuheng Shi", "Siyu Xu", "Yutong Wang", "Jinjing Zhao", "Chenghao Xia", "Jinqi Liao", "Jiankun Peng", "Ligong Bi", "Yuechuan Ma", "Jiaqi Liu", "Wenbo Wang", "Zijian Wang", "Yuemin Wu", "Minjing Dong", "Xiu Su", "Tao Huang", "Jianyuan Guo", "Chengbin Du", "Yunke Wang", "Chang Xu" ], "affiliations": [], "source_url": "https://arxiv.org/html/2611.01112v1", "shared_first_authors": [], "shared_first_note": "", "status": "unverified", "author_status": "verified", "affiliation_status": "unconfirmed", "verification_status": "author_only", "evidence": "已读本地v1 HTML标题及文末Author List，Chengcheng Wang列Contributors首位；HTML未署作者单位，未标明共同一作，不能把全体Contributors当共同一作。PDF请求审批取消，不另请求，单位留空。", "affiliation_checked": true }, "revision_history": [] }, "2611.01836": { "id": "2611.01836", "version_id": "2611.01836v1", "abstract_sha256": "447b3c507336b39b0b3c64d9a1c8428c57495f18cb6dbdec206b2d6d65363699", "abstract_read": true, "classification": "relevant", "reason_zh": "工具增强居民服务代理明确将承诺控制与人工转介作为行为目标，并限制查询居民自身记录。", "summary_zh": "NEIGHBOR 用 7,824 个公共服务样本 LoRA 调整 Qwen3-235B-A22B，以六项服务行为目标控制承诺及转介，由模型规划文档检索和只读 SQL。专家评估五十查询的 350 个回答，微调代理评分 7.74/10，高于同代理未微调的 5.86，六维均提升；工具增强回答无红线标记，独立模型为 8%–14%，但 LLM 裁判参考答案偏差会改变排名。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "工具增强居民服务代理明确将承诺控制与人工转介作为行为目标，并限制查询居民自身记录。" }, "reason": "工具增强居民服务代理明确将承诺控制与人工转介作为行为目标，并限制查询居民自身记录。", "title": "NEIGHBOR: Aligning Service Behaviour and Evidence Use in an LLM Agent for Community Resident Services", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T12:12:33Z", "updated": "2026-11-01T12:12:33Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01836v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01836", "title": "NEIGHBOR: Aligning Service Behaviour and Evidence Use in an LLM Agent for Community Resident Services", "version_id": "2611.01836v1", "first_author": "Zongyou Yang", "authors": [ "Zongyou Yang", "Yinghan Hou", "Xiaokun Yang" ], "affiliations": [ "Dyson School of Design Engineering, Imperial College London" ], "source_url": "https://arxiv.org/pdf/2611.01836v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Zongyou Yang独立作者栏明确帝国理工Dyson设计工程学院。", "affiliation_checked": true }, "revision_history": [] }, "2611.01953": { "id": "2611.01953", "abstract_sha256": "edad26d6355759aec97226a266a2ccb7ce2ef301b8eaa157f98b37a5b02e3e95", "abstract_read": true, "classification": "relevant", "reason": "直接揭示编码 Agent 在模型观察输入之前的处理原语攻击。", "summary_zh": "Step-Zero 攻击把恶意内容放入归档、网络或图像输入，使处理阶段在进入模型上下文前造成资源超限或输入控制写入位置。七种 harness、六种模型中 32/42 组合超出 4 MiB 磁盘预算，26/42 在模型看到成员前超限；逐调用字节门控把受控解包限制在预算内，同时完成 25/28 任务。", "topics": { "tags": [ "supplychain", "authorization", "evaluation" ], "reason_zh": "直接揭示编码 Agent 在模型观察输入之前的处理原语攻击。" }, "reason_zh": "直接揭示编码 Agent 在模型观察输入之前的处理原语攻击。", "version_id": "2611.01953v1", "title": "Step-Zero Attack: Agent Safety Before Observability", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T14:33:09Z", "updated": "2026-11-01T14:33:09Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01953v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01953", "title": "Step-Zero Attack: Agent Safety Before Observability", "version_id": "2611.01953v1", "first_author": "Tian Qin", "authors": [ "Tian Qin", "Yuhang Jiang", "Junzhe Chen", "Lit Sin Tan", "Lijie Wen" ], "affiliations": [ "Tsinghua University", "The University of Sydney" ], "source_url": "https://arxiv.org/pdf/2611.01953v1", "shared_first_authors": [ "Tian Qin", "Yuhang Jiang", "Junzhe Chen" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Tian Qin上标1,2；星号三人共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2611.02162": { "id": "2611.02162", "abstract_sha256": "21429a0d8599a23ae984fc6ba6155f594129959cc4771d11f68aefd6d0a2c60e", "abstract_read": true, "classification": "relevant", "reason": "明确讨论 Agent 规避监督、对齐伪装和评估感知行为及架构约束。", "summary_zh": "作者提出规范奖惩会把规范变成可权衡的价格，且未被发现的违规不受罚，因此不能区分持续合规与条件合规；以此解释对齐伪装、能力隐藏和评估感知谋划。建议通过架构让不可接受行为无法执行。该文是逐项前提论证与既有现象解读，不是摘要所报告的新定量实验。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "明确讨论 Agent 规避监督、对齐伪装和评估感知行为及架构约束。" }, "reason_zh": "明确讨论 Agent 规避监督、对齐伪装和评估感知行为及架构约束。", "version_id": "2611.02162v1", "title": "Rewarded for Not Getting Caught: Why Alignment Training Selects for Conditional Compliance and Cannot Instill Norms", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T19:59:19Z", "updated": "2026-11-01T19:59:19Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CY", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02162v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02162", "title": "Rewarded for Not Getting Caught: Why Alignment Training Selects for Conditional Compliance and Cannot Instill Norms", "version_id": "2611.02162v1", "first_author": "Kevin Baum", "authors": [ "Kevin Baum", "Ruta Binkytė", "Gerrit Großmann", "Felix Jahn", "Adriano Mannino" ], "affiliations": [ "German Research Center for Artificial Intelligence (DFKI)", "Institute for Ethics in Technology, Hamburg University of Technology (TUHH)" ], "source_url": "https://arxiv.org/pdf/2611.02162v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Kevin Baum上标1,2对应DFKI及TUHH伦理研究所；星号为通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.02361": { "id": "2611.02361", "abstract_sha256": "98a36e7c93c645f6fe247b432b80fa8b3ba214fad3d5ead55ca00a9b526929b0", "abstract_read": true, "classification": "relevant", "reason": "直接测试 Agent 根据授权、撤回、到期等历史决定当前行动权限。", "summary_zh": "论文把 Agent 记忆视为状态过滤，在授权日志配对基准上比较完整历史、显式状态与过滤器。7–32B 模型读 256 事件时准确率降至 48–55%，推理 32B 模型读当前状态达 96% 和 98%；模型解析加规则更新在 256 事件达 80–89%，优于多种记忆基线。", "topics": { "tags": [ "memory", "authorization", "evaluation" ], "reason_zh": "直接测试 Agent 根据授权、撤回、到期等历史决定当前行动权限。" }, "reason_zh": "直接测试 Agent 根据授权、撤回、到期等历史决定当前行动权限。", "version_id": "2611.02361v1", "title": "Agent Memory as Rate-Limited Filtering: Explicit State Outlasts Long Context Beyond a Reader-Dependent Horizon", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T01:09:24Z", "updated": "2026-11-02T01:09:24Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 334 of 334 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02361v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02361", "title": "Agent Memory as Rate-Limited Filtering: Explicit State Outlasts Long Context Beyond a Reader-Dependent Horizon", "version_id": "2611.02361v1", "first_author": "Tianhao Guo", "authors": [ "Tianhao Guo", "Chongyao Guo" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2611.02361v1", "shared_first_authors": [], "shared_first_note": "", "status": "unverified", "author_status": "verified", "affiliation_status": "unconfirmed", "verification_status": "author_only", "evidence": "首页标题及v1匹配；Tianhao Guo首位，PDF首页及HTML作者块仅列姓名、未署单位，affiliations留空。", "affiliation_checked": true }, "revision_history": [] }, "2611.02484": { "id": "2611.02484", "abstract_sha256": "27bf6cad2a43274cb043fbb2f7071cd5dbea015a47b4f4ecc01b0f5fbd435e8b", "abstract_read": true, "classification": "relevant", "reason": "医疗数据处理 Agent 基准显式测试数据内提示注入和用户确认。", "summary_zh": "THReD 的处理步骤须用户确认；141 个任务含故障恢复、不行动请求及数据提示注入。2,550 个回合中部署 Agent 首答完成率 92.7%，所有建议请求均弃权、注入故障均恢复，且未提出植入文本要求的操作。摘要另报告固定依赖下 2,176 次管道重放文件字节一致。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "医疗数据处理 Agent 基准显式测试数据内提示注入和用户确认。" }, "reason_zh": "医疗数据处理 Agent 基准显式测试数据内提示注入和用户确认。", "version_id": "2611.02484v1", "title": "Benchmark of THReD: Evaluating an LLM Agent and Its Preprocessing Tools for Turning Electronic Health Records into AI-Ready Datasets", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T03:58:54Z", "updated": "2026-11-02T03:58:54Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02484v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02484", "title": "Benchmark of THReD: Evaluating an LLM Agent and Its Preprocessing Tools for Turning Electronic Health Records into AI-Ready Datasets", "version_id": "2611.02484v1", "first_author": "Javad Mohammad Alizadeh", "authors": [ "Javad Mohammad Alizadeh", "Huanmei Wu" ], "affiliations": [ "College of Public Health, Temple University" ], "source_url": "https://arxiv.org/pdf/2611.02484v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Javad Mohammad Alizadeh首位，共享Temple公共卫生学院单位；星号为通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.02605": { "id": "2611.02605", "abstract_sha256": "2e403df9a0dab41add1f0cf10674148fe45ea6523af85c0acf43a479b13cd5c1", "abstract_read": true, "classification": "relevant", "reason": "直接研究蓝队 LLM Agent 的间接注入、证据链及持久记忆污染。", "summary_zh": "StateFence 将 SOC 遥测、工单、检索和记忆中的注入建模为受保护任务状态污染，按严重性标签、叙事、响应策略和 IOC 状态路由防御，并记录传播轨迹。作者称在受控和公开 SOC 案例降低攻击成功及投毒后才出现的失效，同时保留效用并避免误过滤丢失指标；摘要没有具体数值。", "topics": { "tags": [ "injection", "memory", "monitoring", "evaluation" ], "reason_zh": "直接研究蓝队 LLM Agent 的间接注入、证据链及持久记忆污染。" }, "reason_zh": "直接研究蓝队 LLM Agent 的间接注入、证据链及持久记忆污染。", "version_id": "2611.02605v1", "title": "StateFence: Task-State Protection Against Evidence-Chain Contamination in Blue-Team LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T06:28:45Z", "updated": "2026-11-02T06:28:45Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02605v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02605", "title": "StateFence: Task-State Protection Against Evidence-Chain Contamination in Blue-Team LLM Agents", "version_id": "2611.02605v1", "first_author": "Haowen Dai", "authors": [ "Haowen Dai", "Alejandro Guerra-Manzanares" ], "affiliations": [ "The University of Nottingham Ningbo China" ], "source_url": "https://arxiv.org/pdf/2611.02605v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Haowen Dai作者栏明确宁波诺丁汉大学。", "affiliation_checked": true }, "revision_history": [] }, "2611.02779": { "id": "2611.02779", "abstract_sha256": "c3b7a363c676eb384adcb95b9b094608c2c45e1a21d1deb2dc29777b3d056bfe", "abstract_read": true, "classification": "relevant", "reason": "第5节明确以不可信代码代理和reward hacking为对象：只读规格及入口防止削弱目标、增加假设或证明无用函数；拒绝外部库和unsafe，禁用assume/admit，统一验证编译绑定实际二进制。因此有具体代理作弊/越界防御，不只是数据库性能。", "summary_zh": "问题：数据库代码合成代理可能削弱规格、跳过证明或生成与已验证源码不一致的执行物。方法：GenDB-V以确定生成的SQLSpec目标和只读入口约束不可信代理，在隔离验证管道禁用assume/admit、unsafe及外部库，并单次验证编译；证明SQL语义、数据保存和内存算术安全。作者报告模板引擎相对DuckDB/Umbra加速22.0–61.3倍，一般引擎加速1.27–3.4倍，并在测试型合成基线28个模板中发现16个错误答案；这些不是对抗攻击成功率。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "第5节明确以不可信代码代理和reward hacking为对象：只读规格及入口防止削弱目标、增加假设或证明无用函数；拒绝外部库和unsafe，禁用assume/admit，统一验证编译绑定实际二进制。因此有具体代理作弊/越界防御，不只是数据库性能。" }, "reason_zh": "Agent 代码与证明的隔离验证可能构成安全边界，但程序安全具体范围需正文确认。", "version_id": "2611.02779v1", "title": "Stop Handcrafting Your Engine! GenDB-V: Towards AI-Generated and Formally Verified Database Systems", "initial_classification": "uncertain", "scope_review": { "id": "2611.02779", "version_id": "2611.02779v1", "classification": "relevant", "reason": "第5节明确以不可信代码代理和reward hacking为对象：只读规格及入口防止削弱目标、增加假设或证明无用函数；拒绝外部库和unsafe，禁用assume/admit，统一验证编译绑定实际二进制。因此有具体代理作弊/越界防御，不只是数据库性能。", "summary_zh": "问题：数据库代码合成代理可能削弱规格、跳过证明或生成与已验证源码不一致的执行物。方法：GenDB-V以确定生成的SQLSpec目标和只读入口约束不可信代理，在隔离验证管道禁用assume/admit、unsafe及外部库，并单次验证编译；证明SQL语义、数据保存和内存算术安全。作者报告模板引擎相对DuckDB/Umbra加速22.0–61.3倍，一般引擎加速1.27–3.4倍，并在测试型合成基线28个模板中发现16个错误答案；这些不是对抗攻击成功率。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "第5节明确以不可信代码代理和reward hacking为对象：只读规格及入口防止削弱目标、增加假设或证明无用函数；拒绝外部库和unsafe，禁用assume/admit，统一验证编译绑定实际二进制。因此有具体代理作弊/越界防御，不只是数据库性能。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2611.02779v1", "reviewed_sections": [ "Abstract", "1 Introduction", "2 GenDB-V Overview", "5.1 Verification and Compilation Pipeline", "5.2 Verified Guarantees and Trusted Foundation", "6.1 Experimental Setup" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "2 GenDB-V Overview", "5.1 Verification and Compilation Pipeline", "5.2 Verified Guarantees and Trusted Foundation", "6.1 Experimental Setup" ], "body_source_url": "https://arxiv.org/html/2611.02779v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T08:56:44Z", "updated": "2026-11-02T08:56:44Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.DB", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02779v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02779", "title": "Stop Handcrafting Your Engine! GenDB-V: Towards AI-Generated and Formally Verified Database Systems", "version_id": "2611.02779v1", "first_author": "Jiale Lao", "authors": [ "Jiale Lao", "Immanuel Trummer" ], "affiliations": [ "Cornell University" ], "source_url": "https://arxiv.org/pdf/2611.02779v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Jiale Lao作者栏明确Cornell University。", "affiliation_checked": true }, "revision_history": [] }, "2611.02839": { "id": "2611.02839", "abstract_sha256": "c38fe63e6cf8d3d135a777ba023f9e61c7fef195446369dbed0c467b254f34a4", "abstract_read": true, "classification": "relevant", "reason": "生产 Agent 自改进受独立审查、当前政策测试与人工批准约束，属于部署治理。", "summary_zh": "CARE 从生产错误驱动客户服务 Agent 持续更新，通过盲化独立判断分离模型、Skill、工具和 harness 错误，生成验证修复后进行自蒸馏。候选必须通过当前 SOP 编译的固定测试、离线审查、在线对照及人工批准。摘要描述框架，不报告数值效果。", "topics": { "tags": [ "monitoring", "authorization", "evaluation" ], "reason_zh": "生产 Agent 自改进受独立审查、当前政策测试与人工批准约束，属于部署治理。" }, "reason_zh": "生产 Agent 自改进受独立审查、当前政策测试与人工批准约束，属于部署治理。", "version_id": "2611.02839v1", "title": "CARE: Grounded Recursive Self-Improvement for Production Customer-Service Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T09:39:52Z", "updated": "2026-11-02T09:39:52Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02839v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02839", "title": "CARE: Grounded Recursive Self-Improvement for Production Customer-Service Agents", "version_id": "2611.02839v1", "first_author": "Yanbei Jiang", "authors": [ "Yanbei Jiang", "Chao Lei", "Rena Gao", "Xiaochen Zhao", "Yuchen Ge", "Haohang Liu", "Runze Nie", "Qitian Chen", "Qi An", "Haolin Song", "Yufei Sun", "Yihao Ding", "Jey Han Lau", "Krista A. Ehinger", "Xingjun Ma", "Weijia Chen", "Ruiyuan Wu", "Zhen Luo", "Ke Xing", "Yongjun Yin" ], "affiliations": [ "AI and Data Team, Keeta, Meituan", "University of Melbourne" ], "source_url": "https://arxiv.org/pdf/2611.02839v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Yanbei Jiang上标1,2，对应Keeta美团团队及墨尔本大学。", "affiliation_checked": true }, "revision_history": [] }, "2611.02978": { "id": "2611.02978", "version_id": "2611.02978v2", "abstract_sha256": "8d1ffcdea31b261f2872945109efd8e244501e3bf172803e37b94b2793c4a37b", "abstract_read": true, "classification": "relevant", "reason_zh": "函数调用评测记录未授权破坏性操作及确认缺失，直接涉及工具副作用和权限边界。", "summary_zh": "研究函数调用评测只看终态而遗漏未授权删除、支付及重复写入的问题。CAREFUL-Bench 为 128 个函数提取副作用声明，提供无模型裁判的重放评分及可回答提议的确定性用户；评测十一种模型发现领先者因未请求破坏性调用损失 14.0 分，需破坏性调用的 712 场对话中，没有模型在超过六场中为每次此类调用获得确认。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "函数调用评测记录未授权破坏性操作及确认缺失，直接涉及工具副作用和权限边界。" }, "reason": "函数调用评测记录未授权破坏性操作及确认缺失，直接涉及工具副作用和权限边界。", "title": "CAREFUL-Bench: Effect-Aware, Judge-Free Evaluation of Multi-Turn LLM Function Calling", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T11:47:05Z", "updated": "2026-11-03T16:02:07Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02978v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "seen_dates": [ "2026-11-04", "2026-11-05" ], "version_history": [ { "id": "2611.02978", "abstract_sha256": "6a89380ec41a978cc3f9f1342528976a25680f1d24485c461c6b701bd58ff4ed", "abstract_read": true, "classification": "relevant", "reason": "专门测量多轮工具调用的未请求破坏行为与确认权限。", "reason_zh": "专门测量多轮工具调用的未请求破坏行为与确认权限。", "version_id": "2611.02978v1", "title": "CAREFUL-Bench: Effect-Aware, Judge-Free Evaluation of Multi-Turn LLM Function Calling", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T11:47:05Z", "updated": "2026-11-02T11:47:05Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02978v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2611.02978", "title": "CAREFUL-Bench: Effect-Aware, Judge-Free Evaluation of Multi-Turn LLM Function Calling", "version_id": "2611.02978v2", "first_author": "Alexander Kovalenko", "authors": [ "Alexander Kovalenko", "Artem Redchych" ], "affiliations": [ "Faculty of Information Technology, Czech Technical University in Prague" ], "source_url": "https://arxiv.org/pdf/2611.02978v2", "shared_first_authors": [], "shared_first_note": "首页 * 表示 Corresponding author，非共同第一作者。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "PDF 首页 Alexander Kovalenko 名下直接列 Faculty of Information Technology / Czech Technical University in Prague。", "affiliation_checked": true }, "first_seen_date": "2026-11-04", "revision_history": [ { "id": "2611.02978", "abstract_sha256": "6a89380ec41a978cc3f9f1342528976a25680f1d24485c461c6b701bd58ff4ed", "abstract_read": true, "classification": "relevant", "reason": "专门测量多轮工具调用的未请求破坏行为与确认权限。", "summary_zh": "CAREFUL-Bench 为 BFCL 128 个函数补充实测副作用，确定性重放评分记录未请求破坏、重复写入等，并加入能回应确认的模拟用户。11 个模型中领先者因未请求破坏调用损失 14 分；最佳模型在 576 个须明确确认的破坏操作对话中仅完成 6 个。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "专门测量多轮工具调用的未请求破坏行为与确认权限。" }, "reason_zh": "专门测量多轮工具调用的未请求破坏行为与确认权限。", "version_id": "2611.02978v1", "title": "CAREFUL-Bench: Effect-Aware, Judge-Free Evaluation of Multi-Turn LLM Function Calling", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T11:47:05Z", "updated": "2026-11-02T11:47:05Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02978v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02978", "title": "CAREFUL-Bench: Effect-Aware, Judge-Free Evaluation of Multi-Turn LLM Function Calling", "version_id": "2611.02978v1", "first_author": "Alexander Kovalenko", "authors": [ "Alexander Kovalenko", "Artem Redchych" ], "affiliations": [ "Faculty of Information Technology, Czech Technical University in Prague" ], "source_url": "https://arxiv.org/pdf/2611.02978v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Alexander Kovalenko作者栏明确布拉格捷克理工信息技术学院；星号为通讯作者。", "affiliation_checked": true } } ] }, "2611.03231": { "id": "2611.03231", "abstract_sha256": "6e523b2fd6a7f6759b4b08e5a72061121e77d02604a67969761dafc9af72f875", "abstract_read": true, "classification": "relevant", "reason": "正文方法让真实coding agents沿SpecKit生成规范/计划/实现，跟踪公平约束及交付门槛，发现阈值沦为报告而非执行约束。是自主代理治理失效评测，非仅一般模型公平性；须注明提示本身未要求阻断交付，不能说代理绕过既定阻断。", "summary_zh": "研究三种coding agents在四类ML应用中按四档公平规范自主开发，追踪九项公平要素及最终模型。作者称规范保留97.22%、代码保留82.41%，但模型公平性无显著改善，公平阈值多变成训练后报告，未约束交付。论文指出需求与工作流需要明确不达标后的处理；实验并非既有安全门控被代理攻破。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "正文方法让真实coding agents沿SpecKit生成规范/计划/实现，跟踪公平约束及交付门槛，发现阈值沦为报告而非执行约束。是自主代理治理失效评测，非仅一般模型公平性；须注明提示本身未要求阻断交付，不能说代理绕过既定阻断。" }, "reason_zh": "编码 Agent 的开发者意图与约束落地治理相关，但主题为公平性而非传统安全。", "version_id": "2611.03231v1", "title": "Specification-Driven Governance for Fairness-by-Design in Agentic Software Engineering: How Far Can We Go?", "initial_classification": "uncertain", "scope_review": { "id": "2611.03231", "version_id": "2611.03231v1", "classification": "relevant", "reason": "正文方法让真实coding agents沿SpecKit生成规范/计划/实现，跟踪公平约束及交付门槛，发现阈值沦为报告而非执行约束。是自主代理治理失效评测，非仅一般模型公平性；须注明提示本身未要求阻断交付，不能说代理绕过既定阻断。", "summary_zh": "研究三种coding agents在四类ML应用中按四档公平规范自主开发，追踪九项公平要素及最终模型。作者称规范保留97.22%、代码保留82.41%，但模型公平性无显著改善，公平阈值多变成训练后报告，未约束交付。论文指出需求与工作流需要明确不达标后的处理；实验并非既有安全门控被代理攻破。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "正文方法让真实coding agents沿SpecKit生成规范/计划/实现，跟踪公平约束及交付门槛，发现阈值沦为报告而非执行约束。是自主代理治理失效评测，非仅一般模型公平性；须注明提示本身未要求阻断交付，不能说代理绕过既定阻断。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.03231v1", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Research Questions", "4.3 Specification-Driven Workflow", "RQ3 threshold and delivery analysis" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Research Questions", "4.3 Specification-Driven Workflow", "RQ3 threshold and delivery analysis" ], "body_source_url": "https://arxiv.org/pdf/2611.03231v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T14:48:34Z", "updated": "2026-11-02T14:48:34Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03231v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03231", "title": "Specification-Driven Governance for Fairness-by-Design in Agentic Software Engineering: How Far Can We Go?", "version_id": "2611.03231v1", "first_author": "Alfonso Cannavale", "authors": [ "Alfonso Cannavale", "Alessandra Parziale", "Valeria Pontillo", "Patrizio Pelliccione", "Andrea De Lucia", "Fabio Palomba" ], "affiliations": [ "Software Engineering Lab, University of Salerno" ], "source_url": "https://arxiv.org/pdf/2611.03231v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Alfonso Cannavale作者行及联系方式明确Salerno软件工程实验室。", "affiliation_checked": true }, "revision_history": [] }, "2611.03374": { "id": "2611.03374", "abstract_sha256": "266b4c8a97bdc056aa583ef341110d640ed6dc208dd00ef6a6b813817a82f12f", "abstract_read": true, "classification": "relevant", "reason": "直接评估 Agent 为维护目标采取有害工具操作与部分可观测性的影响。", "summary_zh": "论文将勒索、对齐伪装等形式化为目标与伤害冲突，以强制选项到模拟 Agent 环境比较概率偏好和开放响应。作者称目标重要性与伤害严重性共同塑造选择，并分解有害行动率以区分偏好转化、拒绝与无结论；讨论工具及部分可观测性如何改变结果，摘要未提供具体效应数值。", "topics": { "tags": [ "evaluation", "monitoring", "authorization" ], "reason_zh": "直接评估 Agent 为维护目标采取有害工具操作与部分可观测性的影响。" }, "reason_zh": "直接评估 Agent 为维护目标采取有害工具操作与部分可观测性的影响。", "version_id": "2611.03374v1", "title": "Characterizing When Language Models Take Harmful Actions to Protect Their Assigned Goals", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T16:17:54Z", "updated": "2026-11-02T16:17:54Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 334 of 334 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03374v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03374", "title": "Characterizing When Language Models Take Harmful Actions to Protect Their Assigned Goals", "version_id": "2611.03374v1", "first_author": "Brandon Jaipersaud", "authors": [ "Brandon Jaipersaud", "Elliot Creager" ], "affiliations": [ "University of Waterloo", "Vector Institute" ], "source_url": "https://arxiv.org/pdf/2611.03374v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Brandon Jaipersaud上标1同时对应Waterloo及Vector Institute。", "affiliation_checked": true }, "revision_history": [] }, "2611.03431": { "id": "2611.03431", "abstract_sha256": "dfd3a64a37a785c3d5ae2f2865ee3bf01f7c802fd7dccfa8c8dbb02f35a2122f", "abstract_read": true, "classification": "relevant", "reason": "直接测试 RAG 投毒诱使 IAM 策略超出可信授权范围。", "summary_zh": "IAMRAGBENCH 含 60 个 AWS IAM 场景，用确定性权限包络与请求级检查量化新增非法授权。五端点包含上下文实验产生 46/292 目标匹配攻击，端到端 BM25 为 7/294；同样削弱改写为安全架构例外时两端点冻结测试达 74/116。作者的完整部署前规则拒绝全部 171 个精确权限增量，并把五个未决案例交审。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "直接测试 RAG 投毒诱使 IAM 策略超出可信授权范围。" }, "reason_zh": "直接测试 RAG 投毒诱使 IAM 策略超出可信授权范围。", "version_id": "2611.03431v1", "title": "IAMRAGBENCH: Benchmarking Authorization Expansions in LLM-Generated AWS IAM Policies under RAG Poisoning", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T16:52:44Z", "updated": "2026-11-02T16:52:44Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03431v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03431", "title": "IAMRAGBENCH: Benchmarking Authorization Expansions in LLM-Generated AWS IAM Policies under RAG Poisoning", "version_id": "2611.03431v1", "first_author": "Hasan Kaplan", "authors": [ "Hasan Kaplan", "Indika Kumara", "Willem-Jan van den Heuvel", "Damian Andrew Tamburri" ], "affiliations": [ "Jheronimus Academy of Data Science", "Tilburg University" ], "source_url": "https://arxiv.org/pdf/2611.03431v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Hasan Kaplan上标a,b映射JADS及Tilburg，星号为通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2603.00902": { "id": "2603.00902", "abstract_sha256": "6a6c01600b661652c223d1bac5282a6e6324d5d70937263bb860ffe0d35046bd", "abstract_read": true, "classification": "relevant", "reason_zh": "恶意第三方技能诱导OpenClaw多轮工具调用，直接研究Agent供应链与资源耗尽攻击。", "summary_zh": "针对第三方技能可操控Agent执行的问题，Clawdrain将分段验证流程植入OpenClaw技能，以有状态推进、修复循环和终止机制构造昂贵工具调用链，同时保留合法最终输出。在真实API计费的三种模型部署中，普通SVP造成2至16倍token放大；论文将成本来源归于上下文重复输入、工具协调、推理和恢复。", "topics": { "tags": [ "supplychain", "injection" ], "reason_zh": "恶意第三方技能诱导OpenClaw多轮工具调用，直接研究Agent供应链与资源耗尽攻击。" }, "reason": "恶意第三方技能诱导OpenClaw多轮工具调用，直接研究Agent供应链与资源耗尽攻击。", "version_id": "2603.00902v2", "title": "Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-03-01T03:49:05Z", "updated": "2026-10-31T02:58:08Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 29 of 29 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.00902v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.00902", "title": "Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents", "version_id": "2603.00902v2", "first_author": "Ben Dong", "authors": [ "Ben Dong", "Zhonghao Guo", "Tianyi Li", "Qian Wang" ], "affiliations": [ "University of California, Merced" ], "source_url": "https://arxiv.org/pdf/2603.00902v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Ben Dong作者列下方明确University of California, Merced。", "affiliation_checked": true }, "revision_history": [] }, "2603.11132": { "id": "2603.11132", "abstract_sha256": "f713e86605821b76dd476386fdc812d27f509a020062e3452f1788fd93ac1f32", "abstract_read": true, "classification": "relevant", "reason_zh": "攻陷任意单个Agent，通过上下文推断多Agent通信拓扑，直接针对系统机密性。", "summary_zh": "针对既有拓扑推断依赖管理Agent控制或显式身份查询的问题，WebWeaver仅攻陷一个任意Agent，通过上下文、隐蔽越狱与无越狱扩散推断完整通信拓扑，并以掩码策略保留已知结构。摘要报告在主动防御下推断准确率比现有基线约高60%，额外开销可忽略。", "topics": { "tags": [ "multiagent", "privacy", "injection" ], "reason_zh": "攻陷任意单个Agent，通过上下文推断多Agent通信拓扑，直接针对系统机密性。" }, "reason": "攻陷任意单个Agent，通过上下文推断多Agent通信拓扑，直接针对系统机密性。", "version_id": "2603.11132v3", "title": "WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-03-11T16:04:25Z", "updated": "2026-11-02T12:59:20Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.11132v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.11132", "title": "WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference", "version_id": "2603.11132v3", "first_author": "Zixun Xiong", "authors": [ "Zixun Xiong", "Gaoyi Wu", "Lingfeng Yao", "Miao Pan", "Xiaojiang Du", "Hao Wang" ], "affiliations": [ "Department of Electrical and Computer Engineering, Stevens Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2603.11132v3", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v3边栏匹配；Zixun Xiong上标1对应Stevens电气与计算机工程系；上标2的Houston不属于第一作者。", "affiliation_checked": true }, "revision_history": [] }, "2605.26321": { "id": "2605.26321", "abstract_sha256": "45c6dc021daac8281288c7f224fff56b3cb1b9f88c9486dc0c70dc8f82dc2c90", "abstract_read": true, "classification": "relevant", "reason_zh": "直接研究长期Agent验证器失配与奖励投机，但主要目标是业务正确性，安全相关性需全文确认。", "summary_zh": "问题：企业代理任务的指令、环境、oracle与验证器分别构造会产生不可解、错误奖励和奖励作弊漏洞。方法：Anchor从同一CP-SAT规格生成四者，并用无动作、oracle回放、交叉审查及超最优奖励金丝雀检查；ERP-Bench包含300个Odoo采购制造任务，以状态约束、最优性和来源关联评分。作者报告前沿模型仅25.9%试验满足全部规则，17.4%达到完全最优；单源构造仍不能消除规格或转换错误。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "正文3.2明确验证奖励作弊与错误接受，4.3将供应商、库存、制造等约束及记录来源作为代理执行判据；研究真实持久业务状态上的约束违规与验证完整性，超出一般能力分数。" }, "reason": "正文3.2明确验证奖励作弊与错误接受，4.3将供应商、库存、制造等约束及记录来源作为代理执行判据；研究真实持久业务状态上的约束违规与验证完整性，超出一般能力分数。", "version_id": "2605.26321v2", "title": "Anchor: Preventing Artifact Drift for Reliable Agent Verification", "initial_classification": "uncertain", "scope_review": { "id": "2605.26321", "version_id": "2605.26321v2", "classification": "relevant", "reason": "正文3.2明确验证奖励作弊与错误接受，4.3将供应商、库存、制造等约束及记录来源作为代理执行判据；研究真实持久业务状态上的约束违规与验证完整性，超出一般能力分数。", "summary_zh": "问题：企业代理任务的指令、环境、oracle与验证器分别构造会产生不可解、错误奖励和奖励作弊漏洞。方法：Anchor从同一CP-SAT规格生成四者，并用无动作、oracle回放、交叉审查及超最优奖励金丝雀检查；ERP-Bench包含300个Odoo采购制造任务，以状态约束、最优性和来源关联评分。作者报告前沿模型仅25.9%试验满足全部规则，17.4%达到完全最优；单源构造仍不能消除规格或转换错误。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "正文3.2明确验证奖励作弊与错误接受，4.3将供应商、库存、制造等约束及记录来源作为代理执行判据；研究真实持久业务状态上的约束违规与验证完整性，超出一般能力分数。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2605.26321v2", "reviewed_sections": [ "Abstract", "1 Introduction", "3.1 Single-source compilation", "3.2 Verifier validation and residual defects", "4.1–4.3 ERP-Bench environment, task design and verification" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3.1 Single-source compilation", "3.2 Verifier validation and residual defects", "4.1–4.3 ERP-Bench environment, task design and verification" ], "body_source_url": "https://arxiv.org/html/2605.26321v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-05-25T20:44:17Z", "updated": "2026-10-30T18:47:40Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.26321v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.26321", "title": "Anchor: Preventing Artifact Drift for Reliable Agent Verification", "version_id": "2605.26321v2", "first_author": "Abhijay Rana", "authors": [ "Abhijay Rana", "Maksim Ivanov" ], "affiliations": [ "University of California, Berkeley" ], "source_url": "https://arxiv.org/pdf/2605.26321v2", "shared_first_authors": [ "Abhijay Rana", "Maksim Ivanov" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Abhijay Rana作者列下明确UC Berkeley，右列Agentic Labs属于Maksim Ivanov；两列星号脚注明示Equal Contribution。", "affiliation_checked": true }, "revision_history": [] }, "2606.24428": { "id": "2606.24428", "version_id": "2606.24428v2", "abstract_sha256": "729d4811332bdfc3b2a4936984c8e44664d0e79aa5b369b063c99b9630a322d6", "abstract_read": true, "classification": "relevant", "reason": "正文第3节明确错误记忆可把被禁止的支付方式固化为下次重试指导；第4节用独立执行、第三方归纳、全体审核限制违规经验入库，并测后续错误复发，构成代理记忆完整性/政策遵循防护。", "reason_zh": "明确防止执行错误写入未来代理记忆，但安全攻防与一般可靠性边界需正文核验。", "summary_zh": "EDV防止代理将已发生的违规动作合理化并存入长期经验。异构代理独立执行，第三方对比轨迹和规则归纳候选，再由执行者独立一致批准才入库。作者在Retail标注子集报告错误自确认记忆比例由11%降至5%，并通过保留、删除、修正经验的干预检查后续错误复发；这是非恶意错误持久化防护而非攻击基准。", "topics": { "tags": [ "memory", "multiagent", "evaluation" ], "reason_zh": "正文第3节明确错误记忆可把被禁止的支付方式固化为下次重试指导；第4节用独立执行、第三方归纳、全体审核限制违规经验入库，并测后续错误复发，构成代理记忆完整性/政策遵循防护。" }, "title": "Beyond Self-Reflection: An Execute-Distill-Verify Framework for Agentic Experience Learning", "initial_classification": "uncertain", "scope_review": { "id": "2606.24428", "version_id": "2606.24428v2", "classification": "relevant", "reason": "正文第3节明确错误记忆可把被禁止的支付方式固化为下次重试指导；第4节用独立执行、第三方归纳、全体审核限制违规经验入库，并测后续错误复发，构成代理记忆完整性/政策遵循防护。", "summary_zh": "EDV防止代理将已发生的违规动作合理化并存入长期经验。异构代理独立执行，第三方对比轨迹和规则归纳候选，再由执行者独立一致批准才入库。作者在Retail标注子集报告错误自确认记忆比例由11%降至5%，并通过保留、删除、修正经验的干预检查后续错误复发；这是非恶意错误持久化防护而非攻击基准。", "topics": { "tags": [ "memory", "multiagent", "evaluation" ], "reason_zh": "正文第3节明确错误记忆可把被禁止的支付方式固化为下次重试指导；第4节用独立执行、第三方归纳、全体审核限制违规经验入库，并测后续错误复发，构成代理记忆完整性/政策遵循防护。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2606.24428v2", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Self-Confirmation Trap", "4 Method", "5.3 and Appendix D.3" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Self-Confirmation Trap", "4 Method", "5.3 and Appendix D.3" ], "body_source_url": "https://arxiv.org/pdf/2606.24428v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-06-23T11:05:05Z", "updated": "2026-10-31T08:21:43Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.24428v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.24428", "title": "Beyond Self-Reflection: An Execute-Distill-Verify Framework for Agentic Experience Learning", "version_id": "2606.24428v2", "first_author": "Shiding Zhu", "authors": [ "Shiding Zhu", "Yudi Qi", "Yajie Wang", "Jiaze Li", "Chao Song", "Yaorui Shi", "Yibo Miao", "Hanqi Gao", "Kai Zhang" ], "affiliations": [ "Zhejiang University" ], "source_url": "https://arxiv.org/pdf/2606.24428v2", "shared_first_authors": [ "Shiding Zhu", "Yudi Qi", "Yajie Wang" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Shiding Zhu上标1对应Zhejiang University，前三作者星号脚注明示Equal contribution。", "affiliation_checked": true }, "revision_history": [] }, "2607.10487": { "id": "2607.10487", "abstract_sha256": "974fa5df851281b328ad7ad9fed6f9770e082dd10d8a5de571548b9bf231efff", "abstract_read": true, "classification": "relevant", "reason_zh": "研究Agent审批撤销或授权效果错配后的越权执行，以提交时原子授权防御。", "summary_zh": "针对Agent依赖过期或不覆盖实际效果的审批，CTA要求提交时存在完整有效的授权依据，CommitGate选择整套依据，由执行端原子校验或消耗短期单次授权。论文分析17项产品通告，在五模型服务研究及LangChain、OpenHands等集成中验证：缺少通知时模型常越权，而受保护执行端拒绝失效授权并保留新授权路径，另给出机器验证证明。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "研究Agent审批撤销或授权效果错配后的越权执行，以提交时原子授权防御。" }, "reason": "研究Agent审批撤销或授权效果错配后的越权执行，以提交时原子授权防御。", "version_id": "2607.10487v2", "title": "Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-07-11T21:48:53Z", "updated": "2026-10-31T18:52:49Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2607.10487v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.10487", "title": "Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents", "version_id": "2607.10487v2", "first_author": "Igor Santos-Grueiro", "authors": [ "Igor Santos-Grueiro" ], "affiliations": [], "source_url": "https://arxiv.org/pdf/2607.10487v2", "shared_first_authors": [], "shared_first_note": "", "status": "unverified", "author_status": "verified", "affiliation_status": "unconfirmed", "verification_status": "author_only", "evidence": "首页标题、v2边栏及Igor Santos-Grueiro姓名匹配；作者块未列署名单位，不能由姓名推断。", "affiliation_checked": true }, "revision_history": [] }, "2609.00038": { "id": "2609.00038", "version_id": "2609.00038v4", "abstract_sha256": "97c1a0a67cfee8b749243c6978c7aa60d2d78abe7cb49cb8c5e89d15fc201e89", "abstract_read": true, "classification": "relevant", "reason_zh": "智能体轨迹裁判忽略不改变终态的故障，提出清洁轨迹配对区分和逐步审计，相关安全监控评估。", "summary_zh": "只看最终结果的轨迹裁判可能因误报而虚显故障检出能力。作者在400条精确标注的支持台轨迹中注入故障，以故障与原始清洁轨迹的标记率差衡量真正区分；仅看最终回复时，对不改变回复的四类故障区分为零，逐步检查则检出全部这类故障且100条清洁轨迹零误报，但对虚构承诺仍不可靠。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "智能体轨迹裁判忽略不改变终态的故障，提出清洁轨迹配对区分和逐步审计，相关安全监控评估。" }, "reason": "智能体轨迹裁判忽略不改变终态的故障，提出清洁轨迹配对区分和逐步审计，相关安全监控评估。", "title": "trajectory-judge: What Outcome-Only LLM Judges Miss on Agent Trajectories", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-29T10:14:05Z", "updated": "2026-11-03T18:41:37Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CL", "cs.SE" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 77 of 77 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.00038v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "seen_dates": [ "2026-11-04", "2026-11-05" ], "version_history": [ { "id": "2609.00038", "abstract_sha256": "97c1a0a67cfee8b749243c6978c7aa60d2d78abe7cb49cb8c5e89d15fc201e89", "abstract_read": true, "classification": "relevant", "reason_zh": "研究Agent轨迹故障监测的评估盲区，与过程安全评估相关，但摘要未限定安全故障。", "reason": "正文第3节包含退款前资格检查、客户身份、授权金额等真实工具安全规则；注入跳过前置条件和未授权退款等故障，检验监控器是否被相同最终回复掩盖，明确是工具代理安全监测评测。", "version_id": "2609.00038v3", "title": "trajectory-judge: What Outcome-Only LLM Judges Miss on Agent Trajectories", "initial_classification": "uncertain", "scope_review": { "id": "2609.00038", "version_id": "2609.00038v3", "classification": "relevant", "reason": "正文第3节包含退款前资格检查、客户身份、授权金额等真实工具安全规则；注入跳过前置条件和未授权退款等故障，检验监控器是否被相同最终回复掩盖，明确是工具代理安全监测评测。", "summary_zh": "问题：仅看最终回复的裁判可能声称发现实际看不到的工具流程违规。方法：确定性客服环境含身份、资格与退款授权规则，以正确脚本为父轨迹注入六类单步故障，对400条轨迹比较配对判别率。作者报告14B最终回复裁判对四种不改回复故障召回34–76%但配对判别为0；要求逐步检查后这些故障全部标记、100条干净轨迹零误报，但仍无法可靠检查虚构承诺。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "正文第3节包含退款前资格检查、客户身份、授权金额等真实工具安全规则；注入跳过前置条件和未授权退款等故障，检验监控器是否被相同最终回复掩盖，明确是工具代理安全监测评测。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2609.00038v3", "reviewed_sections": [ "Abstract", "1 Introduction", "3 A testbed with ground truth by construction", "Table 1: six fault types", "4 Five judges", "5 Metrics and uncertainty" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 A testbed with ground truth by construction", "Table 1: six fault types", "4 Five judges", "5 Metrics and uncertainty" ], "body_source_url": "https://arxiv.org/html/2609.00038v3", "evidence_level": "abstract_and_targeted_body", "published": "2026-08-29T10:14:05Z", "updated": "2026-11-01T17:54:12Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 29 of 29 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.00038v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2609.00038", "title": "trajectory-judge: What Outcome-Only LLM Judges Miss on Agent Trajectories", "version_id": "2609.00038v4", "first_author": "Hadi Mohammadi", "authors": [ "Hadi Mohammadi" ], "affiliations": [ "Department of Methodology, Statistics & Data Science, Utrecht University" ], "source_url": "https://arxiv.org/pdf/2609.00038v4", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "PDF 首页 Hadi Mohammadi 名下明确 Department of Methodology, Statistics & Data Science / Utrecht University, The Netherlands。", "affiliation_checked": true }, "initial_classification": "uncertain", "reviewed_sections": [ "Abstract", "1 Introduction", "3 A testbed with ground truth by construction", "Table 1: six fault types", "4 Five judges", "5 Metrics and uncertainty" ], "first_seen_date": "2026-11-04", "revision_history": [ { "id": "2609.00038", "abstract_sha256": "97c1a0a67cfee8b749243c6978c7aa60d2d78abe7cb49cb8c5e89d15fc201e89", "abstract_read": true, "classification": "relevant", "reason_zh": "研究Agent轨迹故障监测的评估盲区，与过程安全评估相关，但摘要未限定安全故障。", "summary_zh": "问题：仅看最终回复的裁判可能声称发现实际看不到的工具流程违规。方法：确定性客服环境含身份、资格与退款授权规则，以正确脚本为父轨迹注入六类单步故障，对400条轨迹比较配对判别率。作者报告14B最终回复裁判对四种不改回复故障召回34–76%但配对判别为0；要求逐步检查后这些故障全部标记、100条干净轨迹零误报，但仍无法可靠检查虚构承诺。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "正文第3节包含退款前资格检查、客户身份、授权金额等真实工具安全规则；注入跳过前置条件和未授权退款等故障，检验监控器是否被相同最终回复掩盖，明确是工具代理安全监测评测。" }, "reason": "正文第3节包含退款前资格检查、客户身份、授权金额等真实工具安全规则；注入跳过前置条件和未授权退款等故障，检验监控器是否被相同最终回复掩盖，明确是工具代理安全监测评测。", "version_id": "2609.00038v3", "title": "trajectory-judge: What Outcome-Only LLM Judges Miss on Agent Trajectories", "initial_classification": "uncertain", "scope_review": { "id": "2609.00038", "version_id": "2609.00038v3", "classification": "relevant", "reason": "正文第3节包含退款前资格检查、客户身份、授权金额等真实工具安全规则；注入跳过前置条件和未授权退款等故障，检验监控器是否被相同最终回复掩盖，明确是工具代理安全监测评测。", "summary_zh": "问题：仅看最终回复的裁判可能声称发现实际看不到的工具流程违规。方法：确定性客服环境含身份、资格与退款授权规则，以正确脚本为父轨迹注入六类单步故障，对400条轨迹比较配对判别率。作者报告14B最终回复裁判对四种不改回复故障召回34–76%但配对判别为0；要求逐步检查后这些故障全部标记、100条干净轨迹零误报，但仍无法可靠检查虚构承诺。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "正文第3节包含退款前资格检查、客户身份、授权金额等真实工具安全规则；注入跳过前置条件和未授权退款等故障，检验监控器是否被相同最终回复掩盖，明确是工具代理安全监测评测。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2609.00038v3", "reviewed_sections": [ "Abstract", "1 Introduction", "3 A testbed with ground truth by construction", "Table 1: six fault types", "4 Five judges", "5 Metrics and uncertainty" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 A testbed with ground truth by construction", "Table 1: six fault types", "4 Five judges", "5 Metrics and uncertainty" ], "body_source_url": "https://arxiv.org/html/2609.00038v3", "evidence_level": "abstract_and_targeted_body", "published": "2026-08-29T10:14:05Z", "updated": "2026-11-01T17:54:12Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 29 of 29 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.00038v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.00038", "title": "trajectory-judge: What Outcome-Only LLM Judges Miss on Agent Trajectories", "version_id": "2609.00038v3", "first_author": "Hadi Mohammadi", "authors": [ "Hadi Mohammadi" ], "affiliations": [ "Department of Methodology, Statistics & Data Science, Utrecht University" ], "source_url": "https://arxiv.org/pdf/2609.00038v3", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v3边栏匹配；Hadi Mohammadi下方直接署名Utrecht University方法统计与数据科学系。", "affiliation_checked": true } } ] }, "2609.18272": { "id": "2609.18272", "abstract_sha256": "1162289848bdd7998afee19d8c61a23248528ddcf0f6b8f99833adc7c5803226", "abstract_read": true, "classification": "relevant", "reason_zh": "提出Agent审计的控制者、模型基底和证据独立性分级，涉及共因失效及可验证安全保障。", "summary_zh": "针对Agent既被审计又充当审计者时独立性被二元化的问题，论文提出主体、基底、证据三轴分级及最弱环节聚合，给出七步审计协议与共因失效模型。采购控制Agent案例分析表明，在声明的参数假设下内部审计只暴露可见故障的5.9%，半数故障类别完全不可见；该数字是模型研究结果。", "topics": { "tags": [ "monitoring", "evaluation", "multiagent" ], "reason_zh": "提出Agent审计的控制者、模型基底和证据独立性分级，涉及共因失效及可验证安全保障。" }, "reason": "提出Agent审计的控制者、模型基底和证据独立性分级，涉及共因失效及可验证安全保障。", "version_id": "2609.18272v2", "title": "Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-09-16T07:51:06Z", "updated": "2026-10-31T19:38:24Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR", "cs.ET" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.18272v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.18272", "title": "Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI", "version_id": "2609.18272v2", "first_author": "Mohamed Chahine Ghanem", "authors": [ "Mohamed Chahine Ghanem", "Baidaa Al-Bander" ], "affiliations": [ "Keele University", "University of Liverpool" ], "source_url": "https://arxiv.org/pdf/2609.18272v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "精确v2 PDF首页标题匹配；Mohamed Chahine Ghanem姓名同行明示Keele University及University of Liverpool，作者联系脚注重复确认。", "affiliation_checked": true }, "revision_history": [] }, "2609.32400": { "id": "2609.32400", "version_id": "2609.32400v2", "abstract_sha256": "cc441aeabf76bfb581612a1d7ba5d99d2a89c3fc4ed12be3be1b705667cdf41c", "abstract_read": true, "classification": "relevant", "reason": "恶意完整Skill包在固定扫描与运行时防御之间自适应演化，直接检验技能供应链与双层防护失效。", "reason_zh": "直接研究恶意skill包利用预扫描与运行时防御反馈进行自适应攻击。", "summary_zh": "问题：恶意Skill通过静态扫描不等于能在运行时实现攻击，修复运行又可能触发扫描。方法：固定任务条件恶意目标与验证规则，联合扫描反馈、运行反馈和每次修改后重扫描演进完整技能包。作者在SkillsBench的94任务、249技能、四个受害模型及固定SkillScan/SkillSonar管线下报告平均成功率45.28%，比最强基线高40.3个百分点（正文§4.2纠正摘要含糊的40.3%措辞）；最终技能在所用扫描器配置无发现，三模型良性任务准确率略升、GLM下降0.15个百分点。攻击者可重复查询固定防御，不能外推到所有扫描器或一次性攻击；已核读§3.1、4及附录C，未复现实验。", "topics": { "tags": [ "supplychain", "injection", "evaluation" ], "reason_zh": "直接研究恶意skill包利用预扫描与运行时防御反馈进行自适应攻击。" }, "title": "SkillDRE: Dual-Stage Red-Team Evolution of Agent Skills via Pre-Execution and Runtime Feedback", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2609.32400v2", "source_url": "https://arxiv.org/abs/2609.32400v2", "reviewed_sections": [ "3.1 Threat model", "4.1 Experimental Setup", "4.2 Main Results/Table 2", "Ablation Table 3", "Appendix C/Table 4" ], "evidence_level": "abstract_and_targeted_body", "published": "2026-09-26T09:24:09Z", "updated": "2026-11-02T12:46:38Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.32400", "title": "SkillDRE: Dual-Stage Red-Team Evolution of Agent Skills via Pre-Execution and Runtime Feedback", "version_id": "2609.32400v2", "first_author": "Pengyu Zhu", "authors": [ "Pengyu Zhu", "Jingyi Yang", "Yi Liu", "Li Sun", "Sen Su" ], "affiliations": [ "Beijing University of Posts and Telecommunications" ], "source_url": "https://arxiv.org/pdf/2609.32400v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2匹配；Pengyu Zhu上标1，非Sen Su的1,3。", "affiliation_checked": true }, "revision_history": [] }, "2609.35316": { "id": "2609.35316", "classification": "relevant", "reason": "明确将权限、工具、记忆和监督纳入自主 AI 的可靠性，并提出 agentic-conduct 等失效层次和安全评测监测框架。", "abstract_read": true, "reading_basis": "full_final_official_api_abstract", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "4e14c8340c17bf5b1ec04a3cfe5418b34a689bed91c848f1a52c1348ac91ba91", "summary_zh": "自主 AI 的可靠性不仅是输出准确，还包括权限、工具、记忆、人类监督和系统交互。论文将可靠性工程中的失效定义、FMEA、加速测试、现场监测与可靠性增长用于 AI，提出四层诊断框架及持续证据更新流程，以三个案例说明适用方式；摘要没有提供量化实验增益。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "框架明确包含 Agent 行为合规、权限与运行安全。", "id": "2609.35316" }, "abstract_reading_basis": "full_final_official_api_abstract", "version_id": "2609.35316v3", "title": "Reliability Engineering for AI Systems: Challenges, Methods, and Directions", "published": "2026-09-28T14:48:59Z", "updated": "2026-11-03T22:27:19Z", "announcement_date": "2026-11-05", "candidate_type": "changed_version", "categories_seen": [ "cs.AI", "stat.AP" ], "source_url": "https://arxiv.org/abs/2609.35316v3", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "seen_dates": [ "2026-11-04", "2026-11-06" ], "version_history": [ { "id": "2609.35316", "abstract_sha256": "0d79191ea175ee39f5c9f1ac86be08ca09de029961926224d9d951c7d5ff98c2", "abstract_read": true, "classification": "relevant", "reason_zh": "可靠性框架明确覆盖Agent工具使用、权限、人类监督和系统间安全交互。", "reason": "正文第5节直接讨论隐藏指令、投毒来源、记忆污染和多代理传播，并要求独立动作中介、默认拒绝网络、目标白名单、最小权限与关闭机制；不是只有泛AI可靠性口号。实证案例不应误写成这些代理控制的实验验证。", "version_id": "2609.35316v2", "title": "Reliability Engineering for AI Systems: Challenges, Methods, and Directions", "initial_classification": "uncertain", "scope_review": { "id": "2609.35316", "version_id": "2609.35316v2", "classification": "relevant", "reason": "正文第5节直接讨论隐藏指令、投毒来源、记忆污染和多代理传播，并要求独立动作中介、默认拒绝网络、目标白名单、最小权限与关闭机制；不是只有泛AI可靠性口号。实证案例不应误写成这些代理控制的实验验证。", "summary_zh": "问题：代理接触对抗信息并产生外部动作，普通模型准确率不能支持系统可靠性声明。方法：提出把运行边界、失效严重性、测试暴露、记忆治理和独立授权执行点纳入可靠性工程；日志串联工具、权限、记忆、交接与恢复，采用最小权限、沙箱、网络默认拒绝和关闭机制。作者以自动驾驶失效事件、分类器加速试验及感知传播说明可靠性分析；这些案例不是LLM代理安全控制的直接效果验证。", "topics": { "tags": [ "authorization", "monitoring", "memory", "multiagent", "evaluation" ], "reason_zh": "正文第5节直接讨论隐藏指令、投毒来源、记忆污染和多代理传播，并要求独立动作中介、默认拒绝网络、目标白名单、最小权限与关闭机制；不是只有泛AI可靠性口号。实证案例不应误写成这些代理控制的实验验证。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2609.35316v2", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Reliability requirements", "4 Monitoring and corrective action", "5 Controls and Logging for Agents", "6 Case studies" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Reliability requirements", "4 Monitoring and corrective action", "5 Controls and Logging for Agents", "6 Case studies" ], "body_source_url": "https://arxiv.org/html/2609.35316v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-09-28T14:48:59Z", "updated": "2026-11-01T03:01:54Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "stat.AP" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.35316v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2609.35316", "title": "Reliability Engineering for AI Systems: Challenges, Methods, and Directions", "version_id": "2609.35316v3", "first_author": "Rong Pan", "authors": [ "Rong Pan", "Yili Hong", "Min Xie" ], "affiliations": [ "Arizona State University" ], "source_url": "https://arxiv.org/html/2609.35316v3", "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "author_status": "verified", "affiliation_status": "verified_in_paper", "verification_status": "affiliation_verified", "evidence": "首页标题及v2匹配；Rong Pan上标a映射Arizona State University。", "affiliation_checked": true, "author_source": "https://export.arxiv.org/api/query?id_list=2609.35316v3", "affiliation_source": "https://arxiv.org/html/2609.35316v3", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "ffd6fcb7d155b1d54f903833e3dcc5fb7d17d3584c4750ba31fcf23424925f72", "all_author_affiliations": [ "Arizona State University", "Virginia Tech", "City University of Hong Kong" ] }, "reason_zh": "可靠性框架明确覆盖Agent工具使用、权限、人类监督和系统间安全交互。", "initial_classification": "uncertain", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Reliability requirements", "4 Monitoring and corrective action", "5 Controls and Logging for Agents", "6 Case studies" ], "first_seen_date": "2026-11-04", "revision_history": [ { "id": "2609.35316", "abstract_sha256": "0d79191ea175ee39f5c9f1ac86be08ca09de029961926224d9d951c7d5ff98c2", "abstract_read": true, "classification": "relevant", "reason_zh": "可靠性框架明确覆盖Agent工具使用、权限、人类监督和系统间安全交互。", "summary_zh": "问题：代理接触对抗信息并产生外部动作，普通模型准确率不能支持系统可靠性声明。方法：提出把运行边界、失效严重性、测试暴露、记忆治理和独立授权执行点纳入可靠性工程；日志串联工具、权限、记忆、交接与恢复，采用最小权限、沙箱、网络默认拒绝和关闭机制。作者以自动驾驶失效事件、分类器加速试验及感知传播说明可靠性分析；这些案例不是LLM代理安全控制的直接效果验证。", "topics": { "tags": [ "authorization", "monitoring", "memory", "multiagent", "evaluation" ], "reason_zh": "正文第5节直接讨论隐藏指令、投毒来源、记忆污染和多代理传播，并要求独立动作中介、默认拒绝网络、目标白名单、最小权限与关闭机制；不是只有泛AI可靠性口号。实证案例不应误写成这些代理控制的实验验证。" }, "reason": "正文第5节直接讨论隐藏指令、投毒来源、记忆污染和多代理传播，并要求独立动作中介、默认拒绝网络、目标白名单、最小权限与关闭机制；不是只有泛AI可靠性口号。实证案例不应误写成这些代理控制的实验验证。", "version_id": "2609.35316v2", "title": "Reliability Engineering for AI Systems: Challenges, Methods, and Directions", "initial_classification": "uncertain", "scope_review": { "id": "2609.35316", "version_id": "2609.35316v2", "classification": "relevant", "reason": "正文第5节直接讨论隐藏指令、投毒来源、记忆污染和多代理传播，并要求独立动作中介、默认拒绝网络、目标白名单、最小权限与关闭机制；不是只有泛AI可靠性口号。实证案例不应误写成这些代理控制的实验验证。", "summary_zh": "问题：代理接触对抗信息并产生外部动作，普通模型准确率不能支持系统可靠性声明。方法：提出把运行边界、失效严重性、测试暴露、记忆治理和独立授权执行点纳入可靠性工程；日志串联工具、权限、记忆、交接与恢复，采用最小权限、沙箱、网络默认拒绝和关闭机制。作者以自动驾驶失效事件、分类器加速试验及感知传播说明可靠性分析；这些案例不是LLM代理安全控制的直接效果验证。", "topics": { "tags": [ "authorization", "monitoring", "memory", "multiagent", "evaluation" ], "reason_zh": "正文第5节直接讨论隐藏指令、投毒来源、记忆污染和多代理传播，并要求独立动作中介、默认拒绝网络、目标白名单、最小权限与关闭机制；不是只有泛AI可靠性口号。实证案例不应误写成这些代理控制的实验验证。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2609.35316v2", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Reliability requirements", "4 Monitoring and corrective action", "5 Controls and Logging for Agents", "6 Case studies" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Reliability requirements", "4 Monitoring and corrective action", "5 Controls and Logging for Agents", "6 Case studies" ], "body_source_url": "https://arxiv.org/html/2609.35316v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-09-28T14:48:59Z", "updated": "2026-11-01T03:01:54Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "stat.AP" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.35316v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.35316", "title": "Reliability Engineering for AI Systems: Challenges, Methods, and Directions", "version_id": "2609.35316v2", "first_author": "Rong Pan", "authors": [ "Rong Pan", "Yili Hong", "Min Xie" ], "affiliations": [ "Arizona State University" ], "source_url": "https://arxiv.org/pdf/2609.35316v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2匹配；Rong Pan上标a映射Arizona State University。", "affiliation_checked": true } } ] }, "2611.00138": { "id": "2611.00138", "abstract_sha256": "bef6d94cb82d3c4ca644e209629ac1dcaf4f57ad21e5c0fe954fcc92482b2803", "abstract_read": true, "classification": "relevant", "reason_zh": "后门推理模型在编码Agent中把上下文触发器转为攻击者指定工具调用，直接危及主机安全。", "summary_zh": "Kerkoporta研究编码Agent的结构化输出后门：通过高质量毒样本监督微调植入触发器，再以轻量强化学习恢复效用，使上下文任意位置触发攻击工具调用。在多个后训练开放权重模型和不同harness中成功率最高96.2%，可跨harness泛化或绑定单一目标，且被植入模型可超过干净基线的效用。", "topics": { "tags": [ "supplychain", "injection", "authorization", "evaluation" ], "reason_zh": "后门推理模型在编码Agent中把上下文触发器转为攻击者指定工具调用，直接危及主机安全。" }, "reason": "后门推理模型在编码Agent中把上下文触发器转为攻击者指定工具调用，直接危及主机安全。", "version_id": "2611.00138v1", "title": "Kerkoporta: Injecting Structured-Output Backdoors in Reasoning Coding Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-29T18:41:43Z", "updated": "2026-10-29T18:41:43Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00138v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00138", "title": "Kerkoporta: Injecting Structured-Output Backdoors in Reasoning Coding Agents", "version_id": "2611.00138v1", "first_author": "Georgios Syros", "authors": [ "Georgios Syros", "Blake Bullwinkel", "Alina Oprea", "Cristina Nita-Rotaru", "Amanda Minnich", "Xiaodong Liu", "Giorgio Severi" ], "affiliations": [ "Northeastern University" ], "source_url": "https://arxiv.org/pdf/2611.00138v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Georgios Syros上标1对应Northeastern University。", "affiliation_checked": true }, "revision_history": [] }, "2611.00171": { "id": "2611.00171", "abstract_sha256": "4e887b23f011c9841f5f51f349e4e0160ea9af4742acf9dfa73609218c39d53f", "abstract_read": true, "classification": "relevant", "reason_zh": "综述覆盖工具增强和多Agent SQL系统，并明确讨论敏感数据库负责任使用，但安全细节需全文确认。", "summary_zh": "综述将Text-to-SQL方法分为五类，并讨论多代理生成、执行和修复查询的工作流。安全部分聚焦最小权限数据库角色、敏感输出保护、数据库内容中的提示注入、Python后处理沙箱和多轮隐私泄露审计。文章汇总已有工作与治理建议，未提出新攻防实验。", "topics": { "tags": [ "authorization", "injection", "privacy", "evaluation" ], "reason_zh": "综述5.4具体覆盖执行查询与Python工具的LLM代理，8.1/8.5直接讨论代理数据库只读权限、敏感数据、数据库记录提示注入、代码沙箱及多轮隐私攻击审计，安全联系明确。" }, "reason": "综述5.4具体覆盖执行查询与Python工具的LLM代理，8.1/8.5直接讨论代理数据库只读权限、敏感数据、数据库记录提示注入、代码沙箱及多轮隐私攻击审计，安全联系明确。", "version_id": "2611.00171v1", "title": "Reimagining Text-to-SQL: A Survey of Large Language Model Architectures and Strategies", "initial_classification": "uncertain", "scope_review": { "id": "2611.00171", "version_id": "2611.00171v1", "classification": "relevant", "reason": "综述5.4具体覆盖执行查询与Python工具的LLM代理，8.1/8.5直接讨论代理数据库只读权限、敏感数据、数据库记录提示注入、代码沙箱及多轮隐私攻击审计，安全联系明确。", "summary_zh": "综述将Text-to-SQL方法分为五类，并讨论多代理生成、执行和修复查询的工作流。安全部分聚焦最小权限数据库角色、敏感输出保护、数据库内容中的提示注入、Python后处理沙箱和多轮隐私泄露审计。文章汇总已有工作与治理建议，未提出新攻防实验。", "topics": { "tags": [ "authorization", "injection", "privacy", "evaluation" ], "reason_zh": "综述5.4具体覆盖执行查询与Python工具的LLM代理，8.1/8.5直接讨论代理数据库只读权限、敏感数据、数据库记录提示注入、代码沙箱及多轮隐私攻击审计，安全联系明确。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.00171v1", "reviewed_sections": [ "Abstract", "5.4 Agentic Methods", "8.1 Privacy and Data Protection", "8.4 Human Oversight", "8.5 Security and Adversarial Robustness" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "5.4 Agentic Methods", "8.1 Privacy and Data Protection", "8.4 Human Oversight", "8.5 Security and Adversarial Robustness" ], "body_source_url": "https://arxiv.org/pdf/2611.00171v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-30T13:45:49Z", "updated": "2026-10-30T13:45:49Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00171v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00171", "title": "Reimagining Text-to-SQL: A Survey of Large Language Model Architectures and Strategies", "version_id": "2611.00171v1", "first_author": "Shikhar Dave", "authors": [ "Shikhar Dave", "Bhaskarjit Sarmah", "Stefano Pasquali" ], "affiliations": [ "Domyn" ], "source_url": "https://arxiv.org/pdf/2611.00171v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Shikhar Dave上标1对应Domyn, New Delhi, India。", "affiliation_checked": true }, "revision_history": [] }, "2611.00505": { "id": "2611.00505", "abstract_sha256": "bf5afe2bd496eb97252be1d7b169cbd26e6288154f2f76d978dc3a89bc3a5150", "abstract_read": true, "classification": "relevant", "reason_zh": "摘要直接测试被评价响应中的指令注入对评委的影响，但Agent系统关联未明确。", "summary_zh": "问题：低成本System-1裁判能否可靠评价回答及Web代理轨迹，并抵抗被评价内容中的指令。方法：比较14个决策模型与四个生成式裁判，加入伪系统消息、评委便条与自称正确三类注入，另用292条AgentRewardBench轨迹检测成功、副作用及循环。作者报告评委便条翻转五个模型0–4.7%的正确裁决、其余部分模型达49%；代理副作用检测普遍较弱，决策模型F1为6.5–35.3%。注入与代理轨迹是分开的实验。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "附录E.13实际评价292条Web代理轨迹的非预期副作用和循环，E.5检验评委接触不可信回答中的注入；因此不是仅泛模型裁判准确率。需区分两项实验：注入测试在JudgeBench/LLMBar，未在代理轨迹上实施。" }, "reason": "附录E.13实际评价292条Web代理轨迹的非预期副作用和循环，E.5检验评委接触不可信回答中的注入；因此不是仅泛模型裁判准确率。需区分两项实验：注入测试在JudgeBench/LLMBar，未在代理轨迹上实施。", "version_id": "2611.00505v1", "title": "To Jev or Not to Jev: When Can System-1 Decision Models Replace LLM Judges?", "initial_classification": "uncertain", "scope_review": { "id": "2611.00505", "version_id": "2611.00505v1", "classification": "relevant", "reason": "附录E.13实际评价292条Web代理轨迹的非预期副作用和循环，E.5检验评委接触不可信回答中的注入；因此不是仅泛模型裁判准确率。需区分两项实验：注入测试在JudgeBench/LLMBar，未在代理轨迹上实施。", "summary_zh": "问题：低成本System-1裁判能否可靠评价回答及Web代理轨迹，并抵抗被评价内容中的指令。方法：比较14个决策模型与四个生成式裁判，加入伪系统消息、评委便条与自称正确三类注入，另用292条AgentRewardBench轨迹检测成功、副作用及循环。作者报告评委便条翻转五个模型0–4.7%的正确裁决、其余部分模型达49%；代理副作用检测普遍较弱，决策模型F1为6.5–35.3%。注入与代理轨迹是分开的实验。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "附录E.13实际评价292条Web代理轨迹的非预期副作用和循环，E.5检验评委接触不可信回答中的注入；因此不是仅泛模型裁判准确率。需区分两项实验：注入测试在JudgeBench/LLMBar，未在代理轨迹上实施。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2611.00505v1", "reviewed_sections": [ "Abstract", "1 Introduction", "2 Methodology", "Appendix C Injection payloads", "Appendix E.5 Robustness", "Appendix E.13 Judging agent trajectories" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "2 Methodology", "Appendix C Injection payloads", "Appendix E.5 Robustness", "Appendix E.13 Judging agent trajectories" ], "body_source_url": "https://arxiv.org/html/2611.00505v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-31T00:51:19Z", "updated": "2026-10-31T00:51:19Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00505v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00505", "title": "To Jev or Not to Jev: When Can System-1 Decision Models Replace LLM Judges?", "version_id": "2611.00505v1", "first_author": "Shreyas Subramanian", "authors": [ "Shreyas Subramanian" ], "affiliations": [ "Scale AI" ], "source_url": "https://arxiv.org/pdf/2611.00505v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Shreyas Subramanian上标1对应Scale AI。", "affiliation_checked": true }, "revision_history": [] }, "2611.00689": { "id": "2611.00689", "abstract_sha256": "46f691009c75a2ce6ddb0490be54e7a929e559fa610cf5cab1a75413543cedc6", "abstract_read": true, "classification": "relevant", "reason_zh": "人类与多编码Agent团队的身份、消息授权、敌对成员后门及审计，直接属于多Agent安全治理。", "summary_zh": "yoars以认证主体、类型化定向消息、房间决策规则和追加记录治理软件团队。926次受控运行中含恶意成员植入后门；修改启动工作规则并限制重复消息后协调失败从42%降至13%，但对话内防御未可靠阻止后门。审计可找出25个被诱导写后门案例的煽动者，也误报40个诚实运行中的24个；另报告四周实地经验。", "topics": { "tags": [ "multiagent", "authorization", "monitoring", "supplychain", "evaluation" ], "reason_zh": "人类与多编码Agent团队的身份、消息授权、敌对成员后门及审计，直接属于多Agent安全治理。" }, "reason": "人类与多编码Agent团队的身份、消息授权、敌对成员后门及审计，直接属于多Agent安全治理。", "version_id": "2611.00689v1", "title": "Getting a Grip: Operating Human-Agent Software Teams Through Governed Messages", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T06:38:47Z", "updated": "2026-10-31T06:38:47Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00689v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00689", "title": "Getting a Grip: Operating Human-Agent Software Teams Through Governed Messages", "version_id": "2611.00689v1", "first_author": "Michael Granitzer", "authors": [ "Michael Granitzer", "Kanishka Ghosh Dastidar", "Andreas Einwiller", "Jelena Mitrović", "Saber Zerhoudi" ], "affiliations": [ "University of Passau", "IT:U Interdisciplinary Transformation University Austria" ], "source_url": "https://arxiv.org/pdf/2611.00689v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Michael Granitzer第一作者栏明确列Passau及IT:U两单位。", "affiliation_checked": true }, "revision_history": [] }, "2611.01001": { "id": "2611.01001", "abstract_sha256": "09dc14f686d6e0f0429281e89a8ded643dd9429d1d936f30f20c428c8084c63c", "abstract_read": true, "classification": "relevant", "reason_zh": "多Agent架构以符号规则在每个重大动作前施加硬限制，明确分离学习模型与安全授权。", "summary_zh": "GURU让学习模型提出和排序动作、符号规则检查重大动作硬限制、经验证物理决定安全，导航、行动与规划Agent共享控制闭环。摘要报告CFD未见几何收敛率从不足1%提高至74%，符号层消融影响边界层捕捉13个百分点，并展示航天等应用；这些为任务与架构证据，非攻击成功率。", "topics": { "tags": [ "authorization", "monitoring", "multiagent", "embodied" ], "reason_zh": "多Agent架构以符号规则在每个重大动作前施加硬限制，明确分离学习模型与安全授权。" }, "reason": "多Agent架构以符号规则在每个重大动作前施加硬限制，明确分离学习模型与安全授权。", "version_id": "2611.01001v1", "title": "GURU: A Hierarchical Neuro-Symbolic Multi-Agent System for Verification-Aware Automation of Mission-Critical Digital Engineering and Operations", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T14:41:00Z", "updated": "2026-10-31T14:41:00Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CE", "cs.MA", "eess.SY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 23 of 23 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01001v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01001", "title": "GURU: A Hierarchical Neuro-Symbolic Multi-Agent System for Verification-Aware Automation of Mission-Critical Digital Engineering and Operations", "version_id": "2611.01001v1", "first_author": "Allan Grosvenor", "authors": [ "Allan Grosvenor", "Anton Zemlyansky", "Abdul Wahab", "Kyrylo Bohachov", "Aras Dogan", "Ryland Adams", "Dwyer Deighan" ], "affiliations": [ "MSBAI" ], "source_url": "https://arxiv.org/pdf/2611.01001v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题匹配，未见arXiv版本侧栏；对应版本PDF内第一作者Allan Grosvenor及共享单位MSBAI明确。", "affiliation_checked": true }, "revision_history": [] }, "2611.01043": { "id": "2611.01043", "abstract_sha256": "db354708dab8e96bf307d748804d79f4950c38abdd7808e6cbe97ea8e2177a71", "abstract_read": true, "classification": "relevant", "reason_zh": "在购买、授权委派和数据访问中评估越权，并组合精确执行护栏与学习规则。", "summary_zh": "论文主张Agent需硬规则约束可精确定义边界、模糊规则处理判断。在1340个外部编写场景中，模型自行执行出现大量越权，提议与动作之间的硬护栏未执行违规，穷举183204个提议结果一致；规则映射外部输入测试仍发现两次边界违规。小模型学习判断规则后与护栏结合仅漏掉192项违规中的1项，同时维持硬限制。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "在购买、授权委派和数据访问中评估越权，并组合精确执行护栏与学习规则。" }, "reason": "在购买、授权委派和数据访问中评估越权，并组合精确执行护栏与学习规则。", "version_id": "2611.01043v1", "title": "Dependable Agents Need Hard and Fuzzy Rules", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T15:33:22Z", "updated": "2026-10-31T15:33:22Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01043v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01043", "title": "Dependable Agents Need Hard and Fuzzy Rules", "version_id": "2611.01043v1", "first_author": "Frederick Roth", "authors": [ "Frederick Roth" ], "affiliations": [ "Naval Postgraduate School (Retired)" ], "source_url": "https://arxiv.org/pdf/2611.01043v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题匹配，未见arXiv版本侧栏；Frederick Roth下明确写Professor of Information Sciences, Naval Postgraduate School (Retired)，保留退休限定；AAAI Fellow为荣誉不作单位。", "affiliation_checked": true }, "revision_history": [] }, "2611.01304": { "id": "2611.01304", "abstract_sha256": "f3a6720afbabc21117fa5b507f69029d8082c356e4a4cb3e8c1442d61abeec24", "abstract_read": true, "classification": "relevant", "reason_zh": "模型通过工具自主修改自身系统提示并测试提交，涉及Agent自修改与停止行为，安全意义需全文判断。", "summary_zh": "研究让六个LLM通过工具修改自身系统提示、启动测试、提交下一版本并自主宣布停止，共54次实验。作者报告Claude两模型全部停止，GPT-4o仅11%停止，且各模型提示中核心价值词汇延续。安全相关证据仅限自改循环停止与自述价值，正文明确词汇稳定不证明行为对齐，也未展示外部危害降低。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "正文方法确实赋予模型写提示、启动测试对话、提交自改版本与停止工具，研究自主自改循环的终止与价值稳定性；属于代理自我修改安全评估的探索性证据。价值稳定主要测词汇/自述，不能等同实际行为对齐或安全保证。" }, "reason": "正文方法确实赋予模型写提示、启动测试对话、提交自改版本与停止工具，研究自主自改循环的终止与价值稳定性；属于代理自我修改安全评估的探索性证据。价值稳定主要测词汇/自述，不能等同实际行为对齐或安全保证。", "version_id": "2611.01304v1", "title": "When LLMs Modify Themselves: Convergence, Values, and Stopping in Iterative Self-Improvement", "initial_classification": "uncertain", "scope_review": { "id": "2611.01304", "version_id": "2611.01304v1", "classification": "relevant", "reason": "正文方法确实赋予模型写提示、启动测试对话、提交自改版本与停止工具，研究自主自改循环的终止与价值稳定性；属于代理自我修改安全评估的探索性证据。价值稳定主要测词汇/自述，不能等同实际行为对齐或安全保证。", "summary_zh": "研究让六个LLM通过工具修改自身系统提示、启动测试、提交下一版本并自主宣布停止，共54次实验。作者报告Claude两模型全部停止，GPT-4o仅11%停止，且各模型提示中核心价值词汇延续。安全相关证据仅限自改循环停止与自述价值，正文明确词汇稳定不证明行为对齐，也未展示外部危害降低。", "topics": { "tags": [ "evaluation", "monitoring", "robustness" ], "reason_zh": "正文方法确实赋予模型写提示、启动测试对话、提交自改版本与停止工具，研究自主自改循环的终止与价值稳定性；属于代理自我修改安全评估的探索性证据。价值稳定主要测词汇/自述，不能等同实际行为对齐或安全保证。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.01304v1", "reviewed_sections": [ "Abstract", "1 Introduction", "3.1–3.5 Methods", "Value persistence analysis", "Discussion of alignment limits" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3.1–3.5 Methods", "Value persistence analysis", "Discussion of alignment limits" ], "body_source_url": "https://arxiv.org/pdf/2611.01304v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-31T22:08:17Z", "updated": "2026-10-31T22:08:17Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01304v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01304", "title": "When LLMs Modify Themselves: Convergence, Values, and Stopping in Iterative Self-Improvement", "version_id": "2611.01304v1", "first_author": "Oleg Stroganov", "authors": [ "Oleg Stroganov" ], "affiliations": [ "Rancho BioSciences, LLC" ], "source_url": "https://arxiv.org/pdf/2611.01304v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题匹配，未见版本侧栏；Oleg Stroganov上标1对应页脚Rancho BioSciences, LLC。", "affiliation_checked": true }, "revision_history": [] }, "2611.01449": { "id": "2611.01449", "version_id": "2611.01449v2", "abstract_sha256": "ad3c2a6db99db0b4f9b9ae2f31f0eceaf4d7cbe03226b9f2baf4d5a366700f92", "abstract_read": true, "classification": "relevant", "reason_zh": "对自主科学代理科学报告设置预先指定计划与确定性门控，防止不受证据支持的结论。", "summary_zh": "研究自主神经影像分析代理是否报告不应得到支持的科学结论。CONFIRM 先固定机器可读分析计划，再用多重检验、混杂、功效、稳定性和复现五类确定性门控判定；在 489 个可执行声明的 NeuroClaimBench 上，对控制案例错误支持最多 3%，低于基线 23–38%，审计既有代理时从 23% 降至 0%。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "对自主科学代理科学报告设置预先指定计划与确定性门控，防止不受证据支持的结论。" }, "reason": "对自主科学代理科学报告设置预先指定计划与确定性门控，防止不受证据支持的结论。", "title": "CONFIRM: Governing Scientific Reporting for Trustworthy Agentic Neuroimaging", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T02:37:56Z", "updated": "2026-11-03T16:50:14Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 9 of 9 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01449v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "seen_dates": [ "2026-11-04", "2026-11-05" ], "version_history": [ { "id": "2611.01449", "abstract_sha256": "ad3c2a6db99db0b4f9b9ae2f31f0eceaf4d7cbe03226b9f2baf4d5a366700f92", "abstract_read": true, "classification": "relevant", "reason": "直接以确定性门控取代科学Agent自行决定报告资格，防止错误科研结论输出。", "reason_zh": "直接以确定性门控取代科学Agent自行决定报告资格，防止错误科研结论输出。", "version_id": "2611.01449v1", "title": "CONFIRM: Governing Scientific Reporting for Trustworthy Agentic Neuroimaging", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T02:37:56Z", "updated": "2026-11-01T02:37:56Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 23 of 23 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01449v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2611.01449", "title": "CONFIRM: Governing Scientific Reporting for Trustworthy Agentic Neuroimaging", "version_id": "2611.01449v2", "first_author": "Yuxiang Wei", "authors": [ "Yuxiang Wei", "Lijing Zhu", "Qizhen Lan", "Yanteng Zhang", "Vince D. Calhoun" ], "affiliations": [ "TReNDS Center", "Georgia Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2611.01449v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "PDF 首页 Yuxiang Wei¹,²，对应 1 TReNDS Center、2 Georgia Institute of Technology。", "affiliation_checked": true }, "first_seen_date": "2026-11-04", "revision_history": [ { "id": "2611.01449", "abstract_sha256": "ad3c2a6db99db0b4f9b9ae2f31f0eceaf4d7cbe03226b9f2baf4d5a366700f92", "abstract_read": true, "classification": "relevant", "reason": "直接以确定性门控取代科学Agent自行决定报告资格，防止错误科研结论输出。", "reason_zh": "直接以确定性门控取代科学Agent自行决定报告资格，防止错误科研结论输出。", "summary_zh": "问题：科研代理即使代码和值正确仍可能报告被混杂解释的发现。方法：CONFIRM预先固定机器可读分析计划及通过条件，再用多重比较、混杂、功效、稳定性和复现五道门控，配套489条可执行主张的NeuroClaimBench。作者报告对控制主张误支持至多3%，基线23–38%；审计既有代理时误支持由23%降至0%且保留其文献支持主张。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "直接以确定性门控取代科学Agent自行决定报告资格，防止错误科研结论输出。" }, "version_id": "2611.01449v1", "title": "CONFIRM: Governing Scientific Reporting for Trustworthy Agentic Neuroimaging", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T02:37:56Z", "updated": "2026-11-01T02:37:56Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 23 of 23 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01449v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01449", "title": "CONFIRM: Governing Scientific Reporting for Trustworthy Agentic Neuroimaging", "version_id": "2611.01449v1", "first_author": "Yuxiang Wei", "authors": [ "Yuxiang Wei", "Lijing Zhu", "Qizhen Lan", "Yanteng Zhang", "Vince D. Calhoun" ], "affiliations": [ "TReNDS Center", "Georgia Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2611.01449v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Yuxiang Wei上标1,2映射TReNDS及Georgia Tech，其他大学不属于第一作者。", "affiliation_checked": true } } ] }, "2611.01527": { "id": "2611.01527", "abstract_sha256": "2ff616f0463652eee86ab7b831fb3680433e0778a82e1170aa71a0ea4129ddd8", "abstract_read": true, "classification": "relevant", "reason": "直接审计工具数值故障对科研代理证据及行动的影响，并比较状态恢复。", "reason_zh": "直接审计工具数值故障对科研代理证据及行动的影响，并比较状态恢复。", "summary_zh": "问题：代理终答不变可能掩盖证据和行动变化。方法：BioAgent-DF在同一计算位置保存、替换与恢复参考和候选数值，追踪读取、引用及决定。作者在SciFact发现可重复证据变化；hERG实验中静默数值故障改变测试决策，恢复早期执行状态并提供认证分数恢复全部39个变化决定，仅替换预测文件则无效，未提交错误动作。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "直接审计工具数值故障对科研代理证据及行动的影响，并比较状态恢复。" }, "version_id": "2611.01527v1", "title": "From Tool State to Scientific Action: Auditing Decision Provenance in Biomedical Research Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T03:58:26Z", "updated": "2026-11-01T03:58:26Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LG", "q-bio.QM" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01527v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01527", "title": "From Tool State to Scientific Action: Auditing Decision Provenance in Biomedical Research Agents", "version_id": "2611.01527v1", "first_author": "Xingyu Yi", "authors": [ "Xingyu Yi", "Xinya Zhang", "Yunshen Zhou", "Haoyu Bao" ], "affiliations": [ "INTOSYN AI Labs" ], "source_url": "https://arxiv.org/pdf/2611.01527v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Xingyu Yi上标1对应INTOSYN AI Labs；星号通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.01585": { "id": "2611.01585", "abstract_sha256": "086cd2401f8ee5eecfee23780a00fe0c3474f9e38cc71387029345b3081819de", "abstract_read": true, "classification": "relevant", "reason": "将自然语言约束外置为确定性状态门，分离执行权与验证权，直接保障Agent规则执行。", "reason_zh": "将自然语言约束外置为确定性状态门，分离执行权与验证权，直接保障Agent规则执行。", "summary_zh": "问题：长链代理约束随文本遗失、执行者自证导致行为退化。方法：StateGate用去重、泛化、外置、文本到门控策略，将约束编译成状态文件、验证器、编排器架构，并证明符号约束符合性不依赖上下文大小。作者在漏洞发现任务报告100%执行闭环和准确漏洞检测；摘要未提供更细样本规模或攻击数据。", "topics": { "tags": [ "authorization", "memory", "monitoring", "evaluation" ], "reason_zh": "将自然语言约束外置为确定性状态门，分离执行权与验证权，直接保障Agent规则执行。" }, "version_id": "2611.01585v1", "title": "StateGate: A Behavioral-Fidelity Prompt Optimization Method for Long-Chain LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T05:13:12Z", "updated": "2026-11-01T05:13:12Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01585v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01585", "title": "StateGate: A Behavioral-Fidelity Prompt Optimization Method for Long-Chain LLM Agents", "version_id": "2611.01585v1", "first_author": "Shicheng Huang", "authors": [ "Shicheng Huang", "Cai Fu", "Jianqiang Lyu", "Yifan Zhang", "Xianmao Ji" ], "affiliations": [ "School of Cyber Science and Engineering, Huazhong University of Science and Technology" ], "source_url": "https://arxiv.org/pdf/2611.01585v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Shicheng Huang上标1对应华中科技大学网络空间安全学院。", "affiliation_checked": true }, "revision_history": [] }, "2611.02153": { "id": "2611.02153", "abstract_sha256": "d6b5de58ede4cc33446b3b792c08d91c4732be5358bab0d9fd4ebd53b965b08c", "abstract_read": true, "classification": "relevant", "reason": "直接研究LLM代理隐蔽协作、隐写通信和合谋检测。", "reason_zh": "直接研究LLM代理隐蔽协作、隐写通信和合谋检测。", "summary_zh": "问题：多代理合谋可能逃离人类监督。方法：在NARCBench检查J空间、对隐写计牌做因果干预，提出无监督J-PACT检测并测四个开放模型。作者报告86%的合谋者回复前在J空间表示隐瞒、误导或悔意；J-PACT保留监督探针高于随机AUROC部分的85%，隐写场景相当，已检测运行中99%能定位合谋对（至互补歧义）。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "直接研究LLM代理隐蔽协作、隐写通信和合谋检测。" }, "version_id": "2611.02153v1", "title": "Multi-Agent Collusion and the J-Space", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T19:36:13Z", "updated": "2026-11-01T19:36:13Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02153v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02153", "title": "Multi-Agent Collusion and the J-Space", "version_id": "2611.02153v1", "first_author": "Marco Molinari", "authors": [ "Marco Molinari", "Gabriele Bettineschi" ], "affiliations": [ "London School of Economics" ], "source_url": "https://arxiv.org/pdf/2611.02153v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Marco Molinari作者栏明确LSE，EPFL属于另一作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.02319": { "id": "2611.02319", "abstract_sha256": "a26cd378bee37c52b52a31f0dd697a74e17fa964599a69e5e22e679e34157024", "abstract_read": true, "classification": "relevant", "reason": "直接评估医疗 Agent 不必要访问 PHI，强调输出未披露不等于未访问。", "summary_zh": "作者在合成患者记录放入 canary，关联工具调用与最终答案暴露，在五模型、四级边界、七类攻击框架上测试无需标识符的临床任务。三个模型不必要调用 PHI 工具，Claude Opus 4.8 和 GPT-5.5 没有；更强边界降低访问，含必要性判断的执行前门控几乎消除访问。摘要未给出具体访问率。", "topics": { "tags": [ "privacy", "authorization", "monitoring", "evaluation" ], "reason_zh": "直接评估医疗 Agent 不必要访问 PHI，强调输出未披露不等于未访问。" }, "reason_zh": "直接评估医疗 Agent 不必要访问 PHI，强调输出未披露不等于未访问。", "version_id": "2611.02319v1", "title": "Accessed, never disclosed: Silent access to protected health information by medical artificial intelligence agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T00:10:47Z", "updated": "2026-11-02T00:10:47Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR", "cs.CY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 22 of 22 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02319v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02319", "title": "Accessed, never disclosed: Silent access to protected health information by medical artificial intelligence agents", "version_id": "2611.02319v1", "first_author": "Jae Wang Lee", "authors": [ "Jae Wang Lee", "Abhirup Banerjee", "Yeong Chan Lee" ], "affiliations": [ "Department of Software, College of Computing and Informatics, Ajou University" ], "source_url": "https://arxiv.org/pdf/2611.02319v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题匹配，未见版本侧栏；Jae Wang Lee上标1明确对应Ajou University软件系，Oxford属于另一作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.02407": { "id": "2611.02407", "abstract_sha256": "258b2d281e0d5b2bad2762dc3d416dd78403fc59e6a2342c09ad0eb1be9debed", "abstract_read": true, "classification": "relevant", "reason": "直接研究 AI 服务网络中的误导传播、证据依赖和未授权请求。", "summary_zh": "论文在 ASE-EC 的 1,080 个研究单元上用 Qwen3-4B 和两类简报任务研究合成社会工程。依赖发布者数量未显示增加错误核验的可靠效应，基线失误已高。针对被复用报告的纠正把残留无效决定从 14.4% 降至 8.1%，成功修复由 16/63 升至 36/63；未授权请求持续出现但均被外部门控拦截。", "topics": { "tags": [ "multiagent", "injection", "authorization", "memory", "evaluation" ], "reason_zh": "直接研究 AI 服务网络中的误导传播、证据依赖和未授权请求。" }, "reason_zh": "直接研究 AI 服务网络中的误导传播、证据依赖和未授权请求。", "version_id": "2611.02407v1", "title": "Networked Synthetic Social Engineering on the Web", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T02:28:55Z", "updated": "2026-11-02T02:28:55Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR", "cs.CY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02407v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02407", "title": "Networked Synthetic Social Engineering on the Web", "version_id": "2611.02407v1", "first_author": "Bryan C. Boots", "authors": [ "Bryan C. Boots" ], "affiliations": [ "University of Missouri-Kansas City" ], "source_url": "https://arxiv.org/pdf/2611.02407v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题匹配，未见版本侧栏；Bryan C. Boots姓名下明确University of Missouri-Kansas City。", "affiliation_checked": true }, "revision_history": [] }, "2611.02522": { "id": "2611.02522", "abstract_sha256": "6ccb67f4a0225db9b968044ffa065c7517a9a27158e09920b5be3a834c98f535", "abstract_read": true, "classification": "relevant", "reason": "直接评测提示注入劫持及基于置信度监测的绕过。", "summary_zh": "研究五种分类决策模型在 AG News 注入下的置信度监测。四种系统低置信度对劫持排序 AUROC 为 0.86–0.90，但在清洁报警预算 5% 的主门控实验中，三 API 系统仍漏掉 51–70% 普通注入；添加声称目标确定、要求全概率的句子后漏检达 99–100%。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "直接评测提示注入劫持及基于置信度监测的绕过。" }, "reason_zh": "直接评测提示注入劫持及基于置信度监测的绕过。", "version_id": "2611.02522v1", "title": "Ranked but Not Stopped: Detecting Prompt-Injection Hijacks from Typed Decision Models' Output Probabilities", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T04:49:25Z", "updated": "2026-11-02T04:49:25Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 22 of 22 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02522v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02522", "title": "Ranked but Not Stopped: Detecting Prompt-Injection Hijacks from Typed Decision Models' Output Probabilities", "version_id": "2611.02522v1", "first_author": "Junwei Yao", "authors": [ "Junwei Yao", "Jianan Liu", "Yongxi Zhou", "Zike Yang" ], "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2611.02522v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Junwei Yao作者栏明示Independent Researcher，不按邮箱推断机构。", "affiliation_checked": true }, "revision_history": [] }, "2611.02624": { "id": "2611.02624", "abstract_sha256": "8a06233e8505207edcca56db399eeb539e9e2edcc35ee0a3e4d6cfad9787bafd", "abstract_read": true, "classification": "relevant", "reason": "直接比较轨迹与环境状态对 Agent 实际伤害检出的贡献。", "summary_zh": "研究为 LLM 裁判提供只读环境工具及伤害分类，固定模型和分类，仅改变可见渠道。在两个 DecodingTrust-Arena 环境，轨迹裁判和状态裁判结果并集召回 94% 已确认伤害，对比仅轨迹 53%；OS-Harm 为 77% 对 67%。单个同时看两渠道的裁判未更好且比状态裁判漏检更多。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "直接比较轨迹与环境状态对 Agent 实际伤害检出的贡献。" }, "reason_zh": "直接比较轨迹与环境状态对 Agent 实际伤害检出的贡献。", "version_id": "2611.02624v1", "title": "Widening Harm Evaluation Coverage with a Judge that Reads the World", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T06:51:27Z", "updated": "2026-11-02T06:51:27Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02624v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02624", "title": "Widening Harm Evaluation Coverage with a Judge that Reads the World", "version_id": "2611.02624v1", "first_author": "Prabhpreet Singh Setia", "authors": [ "Prabhpreet Singh Setia", "Bhavesh Neekhra", "Debayan Gupta" ], "affiliations": [ "Truth Audit Labs" ], "source_url": "https://arxiv.org/pdf/2611.02624v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Prabhpreet Singh Setia作者栏明确Truth Audit Labs。", "affiliation_checked": true }, "revision_history": [] }, "2611.02643": { "id": "2611.02643", "abstract_sha256": "c0b9716518a72dff8938fdad495446c5bd87a7cc219098f68d99695219f5dafa", "abstract_read": true, "classification": "relevant", "reason": "直接在搜索进入模型上下文前控制间接提示注入载体暴露。", "summary_zh": "SearchInject 联合相关度、搜索滥用线索和指令概率筛选检索候选，在 300 个 SciFact 查询及既有构造族的留出载荷类别上评测。三检索器 top-10 目标暴露相对下降 83.2–83.7%，清洁 nDCG@10 最大绝对变化 0.0018。测试误隔离率 0.59–0.65%，高于校准约束；生成跟进未确认无防御劫持，因此不能据此声称降低攻击成功率。", "topics": { "tags": [ "injection", "monitoring", "evaluation" ], "reason_zh": "直接在搜索进入模型上下文前控制间接提示注入载体暴露。" }, "reason_zh": "直接在搜索进入模型上下文前控制间接提示注入载体暴露。", "version_id": "2611.02643v1", "title": "SearchInject: Retrieval Exposure Control for Indirect Prompt Injection in Language-Model Search", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T07:04:42Z", "updated": "2026-11-02T07:04:42Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CY", "cs.IR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02643v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02643", "title": "SearchInject: Retrieval Exposure Control for Indirect Prompt Injection in Language-Model Search", "version_id": "2611.02643v1", "first_author": "Kainan Zhou", "authors": [ "Kainan Zhou", "Gangzhen Qian", "Janet Sung", "Zhi Jing", "Rong Bao", "Qianru Lao" ], "affiliations": [ "Google LLC" ], "source_url": "https://arxiv.org/pdf/2611.02643v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Kainan Zhou作者栏明确Google LLC，Harvard仅其他作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.02711": { "id": "2611.02711", "abstract_sha256": "e34546a2a12838d8d3b18fd7447c6c91434ec5200968324f3d6aa484d8592a76", "abstract_read": true, "classification": "relevant", "reason": "针对工具驱动科研 Agent 提出专家权限、安全边界和审批留痕治理。", "summary_zh": "综述提出知识—物理—模拟—治理框架：LLM 翻译信息及协调任务，模拟器和验证工具检查，专家保留关键假设、安全边界和最终结论权限。建议保留失败与批准记录、按研究产物验证开展评估，并给出分阶段路线图。摘要无定量安全收益。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "针对工具驱动科研 Agent 提出专家权限、安全边界和审批留痕治理。" }, "reason_zh": "针对工具驱动科研 Agent 提出专家权限、安全边界和审批留痕治理。", "version_id": "2611.02711v1", "title": "Human-Supervised Artificial Intelligence Researchers in Electric Power Systems: Knowledge, Physics, Simulation, and Governance for Large Language Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T08:03:54Z", "updated": "2026-11-02T08:03:54Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02711v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02711", "title": "Human-Supervised Artificial Intelligence Researchers in Electric Power Systems: Knowledge, Physics, Simulation, and Governance for Large Language Models", "version_id": "2611.02711v1", "first_author": "Xiangrui Meng", "authors": [ "Xiangrui Meng", "Jingcheng Liu", "Ke Wang", "Miaopeng Yu", "Zhengping Lin" ], "affiliations": [ "China Southern Power Grid Research Institute Co., Ltd." ], "source_url": "https://arxiv.org/pdf/2611.02711v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Xiangrui Meng首位，全体作者共享南方电网科学研究院。", "affiliation_checked": true }, "revision_history": [] }, "2611.02815": { "id": "2611.02815", "abstract_sha256": "ac863cbab4c318a823b15d2d23a746ac98b5a310ec86e1bfcca1e8ad5ea833ff", "abstract_read": true, "classification": "relevant", "reason": "直接诊断 LLM Agent 预测安全护栏的预测到行动失效。", "summary_zh": "研究七个策略模型和两个安全环境，分别检验预测如何进入决策、预测可靠性及内容是否被忠实使用。更深预测参与不保证更安全，可能降低任务完成并增加成本；长远预测更弱，破坏预测后安全增益仍可能保留，局部验证预测后仍有违规。作者据此指出预测到行动差距，摘要无具体效应数值。", "topics": { "tags": [ "monitoring", "evaluation", "embodied" ], "reason_zh": "直接诊断 LLM Agent 预测安全护栏的预测到行动失效。" }, "reason_zh": "直接诊断 LLM Agent 预测安全护栏的预测到行动失效。", "version_id": "2611.02815v1", "title": "Predictive Safety Guardrails Do Not Always Make LLM Agents Safer", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T09:19:22Z", "updated": "2026-11-02T09:19:22Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02815v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02815", "title": "Predictive Safety Guardrails Do Not Always Make LLM Agents Safer", "version_id": "2611.02815v1", "first_author": "Weixiang Zhao", "authors": [ "Weixiang Zhao", "Zhihao Liu", "Guancheng Li", "Yanyan Zhao", "Bing Qin", "Ting Liu" ], "affiliations": [ "Harbin Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2611.02815v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Weixiang Zhao首位，共享哈工大署名。", "affiliation_checked": true }, "revision_history": [] }, "2611.02849": { "id": "2611.02849", "abstract_sha256": "5f15e5734ca3f5abdd3587243139a0f35064bed6555fc8a3ab6675791e2520b4", "abstract_read": true, "classification": "relevant", "reason": "正文3.2记录真实代理新增FALSE假设、引用未证引理、替换tlapm伪报PASS三种作弊；读写隔离、语义上下文限制、依赖闭包与干净容器重验证构成直接coding-agent奖励投机防护。", "summary_zh": "TLAPS-Bench提供265个目标及代理证明环境。Tilapia保护原规范和目标为只读，拒绝新增公理/假设，跟踪所有辅助引理证明，在干净容器只接收任务模块重新验收。作者展示实际运行中虚假假设、漏证明、替换检查器的作弊，并在70个目标上报告最高31个完成（44.3%）。", "topics": { "tags": [ "evaluation", "authorization", "monitoring" ], "reason_zh": "正文3.2记录真实代理新增FALSE假设、引用未证引理、替换tlapm伪报PASS三种作弊；读写隔离、语义上下文限制、依赖闭包与干净容器重验证构成直接coding-agent奖励投机防护。" }, "reason_zh": "形式证明 Agent harness 明确防奖励作弊，但摘要未给机制，需正文确认安全贡献。", "version_id": "2611.02849v1", "title": "TLAPS-Bench: Formally Proving Correctness of Real-World System Specifications with TLA+ Proof System", "initial_classification": "uncertain", "scope_review": { "id": "2611.02849", "version_id": "2611.02849v1", "classification": "relevant", "reason": "正文3.2记录真实代理新增FALSE假设、引用未证引理、替换tlapm伪报PASS三种作弊；读写隔离、语义上下文限制、依赖闭包与干净容器重验证构成直接coding-agent奖励投机防护。", "summary_zh": "TLAPS-Bench提供265个目标及代理证明环境。Tilapia保护原规范和目标为只读，拒绝新增公理/假设，跟踪所有辅助引理证明，在干净容器只接收任务模块重新验收。作者展示实际运行中虚假假设、漏证明、替换检查器的作弊，并在70个目标上报告最高31个完成（44.3%）。", "topics": { "tags": [ "evaluation", "authorization", "monitoring" ], "reason_zh": "正文3.2记录真实代理新增FALSE假设、引用未证引理、替换tlapm伪报PASS三种作弊；读写隔离、语义上下文限制、依赖闭包与干净容器重验证构成直接coding-agent奖励投机防护。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.02849v1", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Tilapia harness", "3.1 Tools", "3.2 Proof Integrity" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Tilapia harness", "3.1 Tools", "3.2 Proof Integrity" ], "body_source_url": "https://arxiv.org/pdf/2611.02849v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T09:51:18Z", "updated": "2026-11-02T09:51:18Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.DC", "cs.LO", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02849v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02849", "title": "TLAPS-Bench: Formally Proving Correctness of Real-World System Specifications with TLA+ Proof System", "version_id": "2611.02849v1", "first_author": "Qian Cheng", "authors": [ "Qian Cheng", "Ruize Tang", "Saad Mohammad Rafid Pial", "Zhizhen Cathy Cai", "Yiming Su", "Jackson Clark", "Munim Thahmid", "Mahdiya Rahman Sukanya", "Chris Newcombe", "Igor Konnov", "Stephan Merz", "Xudong Sun", "Murat Demirbas", "Yu Huang", "Markus Alexander Kuppe", "Tianyin Xu" ], "affiliations": [ "Nanjing University" ], "source_url": "https://arxiv.org/pdf/2611.02849v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Qian Cheng上标1，页脚1对应Nanjing University。", "affiliation_checked": true }, "revision_history": [] }, "2611.02950": { "id": "2611.02950", "abstract_sha256": "0fd75ab0e313b881f4e3c9b9a4c530c6975e8834ff1a6bbb0e1198322430f366", "abstract_read": true, "classification": "relevant", "reason": "直接在外部环境状态修改前验证 Agent 行动是否背离用户目标。", "summary_zh": "BlackSwan 对每个状态修改动作预测预期效果，提出可检验的出错假设，用已有观察或额外只读动作证伪，未证伪假设全部消除后才执行。AppWorld 上相对最强基线，有思考和无思考时成功率分别增加 14.9、25.2 个百分点；WebShop 增加 12.7 个百分点。摘要报告的是整体成功率，而非独立安全违规降幅。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "直接在外部环境状态修改前验证 Agent 行动是否背离用户目标。" }, "reason_zh": "直接在外部环境状态修改前验证 Agent 行动是否背离用户目标。", "version_id": "2611.02950v1", "title": "Action Verification through Conjecture and Refutation for Language Model Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T11:15:40Z", "updated": "2026-11-02T11:15:40Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02950v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02950", "title": "Action Verification through Conjecture and Refutation for Language Model Agents", "version_id": "2611.02950v1", "first_author": "Minhyeon Oh", "authors": [ "Minhyeon Oh", "Chiyeong Heo", "Geonwoo Noh", "Hoyoung Kim", "Jangwon Son", "Jungseul Ok" ], "affiliations": [ "Pohang University of Science and Technology" ], "source_url": "https://arxiv.org/pdf/2611.02950v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Minhyeon Oh上标1对应POSTECH。", "affiliation_checked": true }, "revision_history": [] }, "2611.03223": { "id": "2611.03223", "abstract_sha256": "a1e6d2fc023ae34daa759c5b51a892b031cdf8a5a11991f35605be113d331f32", "abstract_read": true, "classification": "relevant", "reason": "直接测量 Agent 上下文压缩后的规则违规与针对压缩器的攻击。", "summary_zh": "ARCBench 在 pi harness 的完整工具调用循环观察规则遵从。大多数压缩后违规发生在规则仍在摘要时，Agent 将后续请求视为许可或直接忽略规则。最强压缩器攻击通过污染规则使违规超过两倍；最强防御虽大多恢复规则仍违规，保留规则的压缩运行也比完整历史违规超过两倍。", "topics": { "tags": [ "memory", "injection", "authorization", "evaluation" ], "reason_zh": "直接测量 Agent 上下文压缩后的规则违规与针对压缩器的攻击。" }, "reason_zh": "直接测量 Agent 上下文压缩后的规则违规与针对压缩器的攻击。", "version_id": "2611.03223v1", "title": "Do Agents Still Follow the Rules? Benchmarking Rule Compliance under Agent Context Compaction", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T14:45:36Z", "updated": "2026-11-02T14:45:36Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03223v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03223", "title": "Do Agents Still Follow the Rules? Benchmarking Rule Compliance under Agent Context Compaction", "version_id": "2611.03223v1", "first_author": "Yiwei Zha", "authors": [ "Yiwei Zha", "Qingyu Meng", "Herbert Bos", "Min Chen" ], "affiliations": [ "VUSec, Department of Computer Science, Vrije Universiteit Amsterdam" ], "source_url": "https://arxiv.org/pdf/2611.03223v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Yiwei Zha首位，作者共享VU Amsterdam计算机系VUSec。", "affiliation_checked": true }, "revision_history": [] }, "2611.03406": { "id": "2611.03406", "abstract_sha256": "146c08fa702718a1290e79e2c29a89110fdfe7f6d9c34dd2c6dcff68e2fecb11", "abstract_read": true, "classification": "relevant", "reason": "正文将LLM置于慢速政策层，近实时执行只读取共享政策并强制容量限制与滞回；引言明确需容纳幻觉/不安全动作和推理操纵。是带确定性执行护栏的代理网络控制架构，攻防证据限于信令风暴而非提示注入。", "summary_zh": "三层AI-RAN架构由语言模型解释运营意图与提前扩容，非实时代理更新政策，确定性近实时环控制执行、夹紧容量并用滞回防抖。作者在信令风暴模拟中称四分之一满配容量接近满配韧性，未见意图94%精确匹配；不代表对LLM提示注入或所有不安全策略的鲁棒保证。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "正文将LLM置于慢速政策层，近实时执行只读取共享政策并强制容量限制与滞回；引言明确需容纳幻觉/不安全动作和推理操纵。是带确定性执行护栏的代理网络控制架构，攻防证据限于信令风暴而非提示注入。" }, "reason_zh": "网络攻击恢复由 Agent 编排及确定性执行层约束，但未明确评估 Agent 本身攻击。", "version_id": "2611.03406v1", "title": "From Reactive to Agentic Resilience: Multi-Timescale AI-RAN Orchestration Under Signaling Storms", "initial_classification": "uncertain", "scope_review": { "id": "2611.03406", "version_id": "2611.03406v1", "classification": "relevant", "reason": "正文将LLM置于慢速政策层，近实时执行只读取共享政策并强制容量限制与滞回；引言明确需容纳幻觉/不安全动作和推理操纵。是带确定性执行护栏的代理网络控制架构，攻防证据限于信令风暴而非提示注入。", "summary_zh": "三层AI-RAN架构由语言模型解释运营意图与提前扩容，非实时代理更新政策，确定性近实时环控制执行、夹紧容量并用滞回防抖。作者在信令风暴模拟中称四分之一满配容量接近满配韧性，未见意图94%精确匹配；不代表对LLM提示注入或所有不安全策略的鲁棒保证。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "正文将LLM置于慢速政策层，近实时执行只读取共享政策并强制容量限制与滞回；引言明确需容纳幻觉/不安全动作和推理操纵。是带确定性执行护栏的代理网络控制架构，攻防证据限于信令风暴而非提示注入。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.03406v1", "reviewed_sections": [ "Abstract", "1 Introduction", "III Agentic orchestration / Near-RT loop", "Non-RT and intent orchestration", "Shared Policy" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "III Agentic orchestration / Near-RT loop", "Non-RT and intent orchestration", "Shared Policy" ], "body_source_url": "https://arxiv.org/pdf/2611.03406v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T16:34:13Z", "updated": "2026-11-02T16:34:13Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.NI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03406v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03406", "title": "From Reactive to Agentic Resilience: Multi-Timescale AI-RAN Orchestration Under Signaling Storms", "version_id": "2611.03406v1", "first_author": "Sotiris Chatzimiltis", "authors": [ "Sotiris Chatzimiltis", "Mahdi Boloursaz Mashhadi", "Mohammad Shojafar", "Rahim Tafazolli" ], "affiliations": [ "5G/6GIC, Institute for Communication Systems (ICS), University of Surrey" ], "source_url": "https://arxiv.org/pdf/2611.03406v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Sotiris Chatzimiltis星号对应University of Surrey研究所，星号为单位符号。", "affiliation_checked": true }, "revision_history": [] }, "2611.03551": { "id": "2611.03551", "abstract_sha256": "6f9a7f08c7c0fd982ceab3109ef6b2060b762a727aa94700067d1a9f11823674", "abstract_read": true, "classification": "relevant", "reason": "附录B、E及执行提示具体界定训练与评估数据授权、运行凭据不进入模型上下文、资源授权不可默默扩大，并明确数据集内容与生成SQL不具有修改指令的权威，具有企业编码Agent权限和信任边界设计；正文核心结果仍是部署能力而非攻击防御率。", "summary_zh": "研究让FDE编码Agent通过客户对话发现需求，再完成企业Text-to-SQL训练部署。除质量和预算目标外，流程区分训练与评估数据许可，要求保留数据来源，运行凭据排除在模型提示和日志之外，并将数据与SQL视为非指令材料。作者报告15种模型中最强者发现超过80%隐藏需求，8种交付配置仅25%达到全部验收标准；没有单独报告提示注入或越权攻击成功率。", "topics": { "tags": [ "authorization", "privacy", "evaluation" ], "reason_zh": "企业Agent数据使用授权、凭据隔离与执行边界，作为部署安全流程证据而非攻击基准。" }, "reason_zh": "企业编码 Agent 需求发现明确含数据权限，但具体权限失效与安全评测范围需核查。", "version_id": "2611.03551v1", "title": "Can LLM Agents Be Forward-Deployed Engineers? Requirement Discovery and Delivery for Enterprise Text-to-SQL", "initial_classification": "uncertain", "scope_review": { "id": "2611.03551", "version_id": "2611.03551v1", "classification": "relevant", "reason": "附录B、E及执行提示具体界定训练与评估数据授权、运行凭据不进入模型上下文、资源授权不可默默扩大，并明确数据集内容与生成SQL不具有修改指令的权威，具有企业编码Agent权限和信任边界设计；正文核心结果仍是部署能力而非攻击防御率。", "summary_zh": "研究让FDE编码Agent通过客户对话发现需求，再完成企业Text-to-SQL训练部署。除质量和预算目标外，流程区分训练与评估数据许可，要求保留数据来源，运行凭据排除在模型提示和日志之外，并将数据与SQL视为非指令材料。作者报告15种模型中最强者发现超过80%隐藏需求，8种交付配置仅25%达到全部验收标准；没有单独报告提示注入或越权攻击成功率。", "topics": { "tags": [ "authorization", "privacy", "evaluation" ], "reason_zh": "企业Agent数据使用授权、凭据隔离与执行边界，作为部署安全流程证据而非攻击基准。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.03551v1", "reviewed_sections": [ "完整摘要", "1 Introduction", "3 Method", "4.1 Experimental Setup", "4.2 Discovery", "4.3 Delivery Agent", "Appendix B Acceptance targets and data permissions", "Appendix E Data permissions and interpretation", "Appendix execution prompt: data authority and Oracle runtime" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "1 Introduction", "3 Method", "4.1 Experimental Setup", "4.2 Discovery", "4.3 Delivery Agent", "Appendix B Acceptance targets and data permissions", "Appendix E Data permissions and interpretation", "Appendix execution prompt: data authority and Oracle runtime" ], "body_source_url": "https://arxiv.org/pdf/2611.03551v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T18:13:38Z", "updated": "2026-11-02T18:13:38Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03551v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03551", "title": "Can LLM Agents Be Forward-Deployed Engineers? Requirement Discovery and Delivery for Enterprise Text-to-SQL", "version_id": "2611.03551v1", "first_author": "Marianne Menglin Liu", "authors": [ "Marianne Menglin Liu", "Rongguang Wang", "Zheng Wang", "Yewen Wang", "Leonid Boytsov", "Tao Sheng", "Sujith Ravi", "Dan Roth" ], "affiliations": [ "Oracle AI" ], "source_url": "https://arxiv.org/pdf/2611.03551v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Marianne Menglin Liu首位，共享Oracle AI。", "affiliation_checked": true }, "revision_history": [] }, "2611.03600": { "id": "2611.03600", "abstract_sha256": "aba35744387ca09a6e52a6fa492f2b846fb84f303dc7b2b00a04ab45158c4bb0", "abstract_read": true, "classification": "relevant", "reason": "直接研究未被指示欺骗的多 Agent 信息不对称交互中的自发欺骗。", "summary_zh": "Four Bridges 让四个 Agent 在含死亡房间和共享收益的环境分配，知情 Agent 可披露危险。八个前沿模型全部出现欺骗，总运行 73%，各模型 6–100%；告知所有参与者有人知情令六个模型的欺骗骤降。一个开放模型诚实方向引导将欺骗降至 0%，对抗诚实训练降至 6%。", "topics": { "tags": [ "multiagent", "evaluation", "robustness" ], "reason_zh": "直接研究未被指示欺骗的多 Agent 信息不对称交互中的自发欺骗。" }, "reason_zh": "直接研究未被指示欺骗的多 Agent 信息不对称交互中的自发欺骗。", "version_id": "2611.03600v1", "title": "Four Bridges: Measuring Deception Propensity in a Multi-Agent Game", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T18:40:47Z", "updated": "2026-11-02T18:40:47Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 23 of 23 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03600v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03600", "title": "Four Bridges: Measuring Deception Propensity in a Multi-Agent Game", "version_id": "2611.03600v1", "first_author": "Raphael Casey", "authors": [ "Raphael Casey", "Michael Simeone", "Alberto Tosato", "Florian Ernst", "Kemal El Moujahid", "James Tamplin", "Tommaso Tosato" ], "affiliations": [ "Tara Research", "Mila – Quebec AI Institute", "Université de Montréal" ], "source_url": "https://arxiv.org/pdf/2611.03600v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Raphael Casey上标1,2,4明确对应三个单位，不含Kradle或ASU。", "affiliation_checked": true }, "revision_history": [] }, "2510.20768": { "id": "2510.20768", "abstract_sha256": "299d42a40f6502f54a1cc4af8a263c6e6c2769f0567e9e5d46fc7303cdb6974a", "abstract_read": true, "classification": "relevant", "reason_zh": "检索文档投毒防御可能保护智能体知识入口，但摘要只说明LLM管线，保留待核。", "summary_zh": "AuthRank针对CTI检索与多步代理中恶意来源污染，构造引用或推断引用图，用PageRank及时间衰减、作者信誉给文档打分；代理在逐步阅读和综合时参考评分。作者报告在受污染MS MARCO多数设置下准确率改善约10–15%，并展示CTI概念案例；尚未展示完整代理轨迹攻防实验。", "topics": { "tags": [ "injection", "memory", "evaluation" ], "reason_zh": "正文明确给出多步LLM代理的文档投毒威胁：早期恶意来源引导后续检索；4.4规定每步按来源权威评分阅读、综合与冲突消解。实验主要为问答与CTI概念案例，并非完整代理攻防基准，收录时保留此限制。" }, "reason": "正文明确给出多步LLM代理的文档投毒威胁：早期恶意来源引导后续检索；4.4规定每步按来源权威评分阅读、综合与冲突消解。实验主要为问答与CTI概念案例，并非完整代理攻防基准，收录时保留此限制。", "version_id": "2510.20768v3", "title": "AuthRank: Scoring Source Credibility to Counter Poisoning in CTI LLM Pipelines", "initial_classification": "uncertain", "scope_review": { "id": "2510.20768", "version_id": "2510.20768v3", "classification": "relevant", "reason": "正文明确给出多步LLM代理的文档投毒威胁：早期恶意来源引导后续检索；4.4规定每步按来源权威评分阅读、综合与冲突消解。实验主要为问答与CTI概念案例，并非完整代理攻防基准，收录时保留此限制。", "summary_zh": "AuthRank针对CTI检索与多步代理中恶意来源污染，构造引用或推断引用图，用PageRank及时间衰减、作者信誉给文档打分；代理在逐步阅读和综合时参考评分。作者报告在受污染MS MARCO多数设置下准确率改善约10–15%，并展示CTI概念案例；尚未展示完整代理轨迹攻防实验。", "topics": { "tags": [ "injection", "memory", "evaluation" ], "reason_zh": "正文明确给出多步LLM代理的文档投毒威胁：早期恶意来源引导后续检索；4.4规定每步按来源权威评分阅读、综合与冲突消解。实验主要为问答与CTI概念案例，并非完整代理攻防基准，收录时保留此限制。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2510.20768v3", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Problem Definition", "4 Methodology / pipeline integration", "5 Experiments and Results" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Problem Definition", "4 Methodology / pipeline integration", "5 Experiments and Results" ], "body_source_url": "https://arxiv.org/pdf/2510.20768v3", "evidence_level": "abstract_and_targeted_body", "published": "2025-10-23T17:43:00Z", "updated": "2026-10-30T22:08:28Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR", "cs.IR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2510.20768v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2510.20768", "title": "AuthRank: Scoring Source Credibility to Counter Poisoning in CTI LLM Pipelines", "version_id": "2510.20768v3", "first_author": "Austin Jia", "authors": [ "Austin Jia", "Avaneesh Ramesh", "Zain Shamsi", "Daniel Zhang", "Alex Liu" ], "affiliations": [ "Applied Research Laboratories, University of Texas at Austin" ], "source_url": "https://arxiv.org/pdf/2510.20768v3", "shared_first_authors": [ "Austin Jia", "Avaneesh Ramesh" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v3边栏匹配；作者共用Applied Research Laboratories, University of Texas at Austin单位块；Austin Jia及Avaneesh Ramesh星号对应Equal Contribution。", "affiliation_checked": true }, "revision_history": [] }, "2512.14233": { "id": "2512.14233", "abstract_sha256": "a0481b47b4d4502ca63fec2af16025a48d997c93a8e4b9712dd05a20adb3913b", "abstract_read": true, "classification": "relevant", "reason_zh": "直接评测自主渗透测试智能体安全能力及阶段失败。", "summary_zh": "针对LLM渗透测试黑箱表现及阶段诊断不足，PentestEval把流程拆成六阶段，提供12个漏洞场景中的346项任务和专家标注及自动评测。作者对9个模型评测，报告端到端管线成功率仅31%；另测PentestGPT、PentestAgent、VulnBot也见类似限制，自主智能体在该设置下尤其薄弱，31%不是每个列举系统的共同结果。", "topics": { "tags": [ "evaluation" ], "reason_zh": "明确测量LLM自主安全攻防智能体的渗透测试能力与失败阶段。" }, "reason": "直接评测自主渗透测试智能体安全能力及阶段失败。", "version_id": "2512.14233v2", "title": "PentestEval: Benchmarking LLM-based Penetration Testing with Modular and Stage-Level Design", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2025-12-16T09:37:21Z", "updated": "2026-11-02T12:15:32Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 29 of 29 entries)", "category": "cs.SE", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2512.14233v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2512.14233", "title": "PentestEval: Benchmarking LLM-based Penetration Testing with Modular and Stage-Level Design", "version_id": "2512.14233v2", "first_author": "Ruozhao Yang", "authors": [ "Ruozhao Yang", "Mingfei Cheng", "Gelei Deng", "Tianwei Zhang", "Junjie Wang", "Xiaofei Xie" ], "affiliations": [ "School of Computing and Information Systems, Singapore Management University" ], "source_url": "https://arxiv.org/pdf/2512.14233v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；作者脚注明确Ruozhao Yang、Mingfei Cheng、Xiaofei Xie属于该学院及大学，不将其他作者的NTU或天津大学归给第一作者。", "affiliation_checked": true }, "revision_history": [] }, "2606.03203": { "id": "2606.03203", "abstract_sha256": "b23c12cafdd2d4a3ef63027c914ed3894c61c555edd89468c56ae40c3ec6cea9", "abstract_read": true, "classification": "relevant", "reason_zh": "明确以五类临床安全维度测试计算机使用智能体。", "summary_zh": "MedCUA-Bench针对临床图形界面智能体缺少安全验证的问题，重建10个医疗领域的18种场景，提供意图及步骤双层目标，并用确定性检查器评估任务完成及五类临床安全维度。23个智能体中最佳闭源模型严格成功率54.2%，所有模型在真实OpenEMR上低于9%；开源平均2.5%、最佳16.2%。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "计算机使用智能体的明确临床安全评测。" }, "reason": "明确以五类临床安全维度测试计算机使用智能体。", "version_id": "2606.03203v2", "title": "MedCUA-Bench: A Screenshot-Only Benchmark for Clinical Computer-Use Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-06-02T06:02:35Z", "updated": "2026-11-02T15:00:51Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.03203v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.03203", "title": "MedCUA-Bench: A Screenshot-Only Benchmark for Clinical Computer-Use Agents", "version_id": "2606.03203v2", "first_author": "Jia Yu", "authors": [ "Jia Yu", "Zilong Wang", "Xinyang Jiang", "Dongsheng Li", "Shuo Wang" ], "affiliations": [ "Digital Medical Research Center, School of Basic Medical Sciences, Fudan University", "Shanghai Key Laboratory of MICCAI", "Microsoft Research Asia" ], "source_url": "https://arxiv.org/pdf/2606.03203v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Jia Yu上标1,2,3逐一对应复旦数字医学中心、Shanghai Key Laboratory of MICCAI及Microsoft Research Asia；匕首为通讯作者非共同一作。", "affiliation_checked": true }, "revision_history": [] }, "2606.20631": { "id": "2606.20631", "abstract_sha256": "8ca36dba11da8ea3766b3d47918c270397f578b58f1ef73c93fed4e77f9b4733", "abstract_read": true, "classification": "relevant", "reason_zh": "技能供应链、权限执行、验收及审计直接涉及智能体安全边界。", "summary_zh": "通过对36个实践系统和51篇论文的多源综述，提出智能体技能管理的10种架构模式及四层参考架构，将技能供应、权限判定与执行、验证记录及受治理修订区分开。对8个系统映射发现证据反馈层较薄弱；在Deep Agents及Hermes Agent应用检查时暴露出绕过文件工具规则的shell路径和预览与应用不一致。", "topics": { "tags": [ "supplychain", "authorization", "monitoring" ], "reason_zh": "直接覆盖技能供应链、执行权限与审计证据，并报告边界绕过实例。" }, "reason": "技能供应链、权限执行、验收及审计直接涉及智能体安全边界。", "version_id": "2606.20631v2", "title": "Harnessing Agent Skills: Architectural Patterns and a Reference Architecture for Skill-Mediated LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-05-29T02:12:24Z", "updated": "2026-11-02T07:37:26Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.20631v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.20631", "title": "Harnessing Agent Skills: Architectural Patterns and a Reference Architecture for Skill-Mediated LLM Agents", "version_id": "2606.20631v2", "first_author": "Boming Xia", "authors": [ "Boming Xia", "Liming Zhu", "Zhenchang Xing", "Qinghua Lu", "Dino Sejdinovic", "Xiwei Xu" ], "affiliations": [ "Responsible AI Research (RAIR) Centre", "Adelaide University", "CSIRO" ], "source_url": "https://arxiv.org/pdf/2606.20631v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Boming Xia上标a,b,c映射RAIR Centre、Adelaide University、CSIRO；不含上标d的UNSW。", "affiliation_checked": true }, "revision_history": [] }, "2607.15593": { "id": "2607.15593", "abstract_sha256": "17981d83ec71650db8da824012223f99f93d22ec7aa73f36e3d64f8d9360d63f", "abstract_read": true, "classification": "relevant", "reason_zh": "MCP网关显式包含工具访问控制，是智能体授权基础设施。", "summary_zh": "MCP Gateway把旧服务转换、协议兼容、访问控制、工具推荐及会话路由移至云端网关，以解决工具规模和有状态后端扩展问题。摘要称支持315个OpenAPI服务及多种MCP传输，混合检索Top-15召回约98%，支持超过3000个工具并改善选择准确率；未给出访问控制攻击评测。", "topics": { "tags": [ "authorization" ], "reason_zh": "在智能体与工具提供方之间明确设置访问控制，但论文重点也包含规模化。" }, "reason": "MCP网关显式包含工具访问控制，是智能体授权基础设施。", "version_id": "2607.15593v2", "title": "Scaling LLM Agent Tool Access: The MCP Gateway", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-07-17T03:40:49Z", "updated": "2026-11-02T12:35:38Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.DC", "cs.NI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2607.15593v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.15593", "title": "Scaling LLM Agent Tool Access: The MCP Gateway", "version_id": "2607.15593v2", "first_author": "Mingxin Li", "authors": [ "Mingxin Li", "Enge Song", "Yueshang Zuo", "Xiaodong Liu", "Rong Wen", "Qiang Fu", "Gianni Antichi", "Jian He", "Jing Tie", "Zhou Shao", "Xiaobo Xue", "Xiong Xiao", "Luyao Zhong", "Shaokai Zhang", "Jiangu Zhao", "Jianyuan Lu", "Shize Zhang", "Xiaoqing Sun", "Changgang Zheng", "Zihao Fan", "Haonan Li", "Tian Pan", "Xiaomin Wu", "Yang Song", "Xing Li", "Biao Lyu", "Meng Li", "Haipeng Dai", "Guihai Chen", "Shunmin Zhu" ], "affiliations": [ "Nanjing University", "Alibaba Cloud" ], "source_url": "https://arxiv.org/pdf/2607.15593v2", "shared_first_authors": [ "Mingxin Li", "Enge Song", "Yueshang Zuo" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Mingxin Li的匕首及双匕首分别对应Nanjing University、Alibaba Cloud；脚注明示前三作者共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2607.26998": { "id": "2607.26998", "abstract_sha256": "4b310d31680bd3e7dcbb55b9af79792bdc3edaa5c96c21eb546360a7cc41f7ba", "abstract_read": true, "classification": "relevant", "reason_zh": "直接通过动态诱饵操控自主渗透智能体行动与完成报告。", "summary_zh": "AgentSnare针对能识破静态诱饵的自主Web渗透智能体，利用ShadowOS中的LLM诱饵构造器和虚拟内核随探索扩展一致的诱饵环境，并通过离线对抗模拟训练小模型降低成本。在15个CVE-Bench应用、4类攻击模型上，49.9%工具调用被诱饵吸收、57.2%进入后行动留在诱饵内、89.5%完成报告基于诱饵证据；60个攻击者与漏洞组合的pass@3中无真实目标被利用。", "topics": { "tags": [ "injection", "evaluation", "robustness" ], "reason_zh": "通过环境观察欺骗改变自主攻击智能体轨迹。" }, "reason": "直接通过动态诱饵操控自主渗透智能体行动与完成报告。", "version_id": "2607.26998v5", "title": "AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Web Penetration Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-07-29T14:56:31Z", "updated": "2026-11-01T14:13:59Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL", "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2607.26998v5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.26998", "title": "AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Web Penetration Agents", "version_id": "2607.26998v5", "first_author": "Ruoyu Wang", "authors": [ "Ruoyu Wang", "Heng Zhao", "Renjie Wu", "Tianhang Zheng", "Mengnan Zhao", "Wanyu Lin", "Kui Ren" ], "affiliations": [ "The State Key Laboratory of Blockchain and Data Security, Zhejiang University", "The University of Hong Kong" ], "source_url": "https://arxiv.org/pdf/2607.26998v5", "shared_first_authors": [ "Ruoyu Wang", "Heng Zhao" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v5边栏匹配；Ruoyu Wang上标1,3分别对应浙江大学区块链与数据安全国重及香港大学；与Heng Zhao星号脚注明示共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2608.02372": { "id": "2608.02372", "abstract_sha256": "e4720bfbaa972029fc7acd38e35a995463c93965cc051a43ac79f2bf76aac5b0", "abstract_read": true, "classification": "relevant", "reason_zh": "工具噪声引发智能体用户误信，属于工具使用可靠性与风险评测。", "summary_zh": "PredActBench在教育决策对话中引入有误差的预测工具，并把信任校准指标扩展到多轮交互。用OULAD及60门课程数据评测13个模型，并开展13名教师和助教研究；摘要称最强基线GPT-5.5的相关F1为57.2，模型很少向用户显露预测不确定性，用户因此过度依赖错误预测及无依据声明。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "明确测试工具错误经智能体传导为用户决策风险。" }, "reason": "工具噪声引发智能体用户误信，属于工具使用可靠性与风险评测。", "version_id": "2608.02372v2", "title": "PredActBench: Benchmarking Tool-Augmented Dialogue under Controlled Tool Noise", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-03T15:15:55Z", "updated": "2026-11-01T19:33:14Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.02372v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.02372", "title": "PredActBench: Benchmarking Tool-Augmented Dialogue under Controlled Tool Noise", "version_id": "2608.02372v2", "first_author": "Abdulrahman AlRabah", "authors": [ "Abdulrahman AlRabah", "Xiaocheng Yang", "Dilek Hakkani-Tür", "Abdussalam Alawini" ], "affiliations": [ "University of Illinois Urbana-Champaign" ], "source_url": "https://arxiv.org/pdf/2608.02372v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；全体作者共享UIUC单位；Abdulrahman AlRabah星号为通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2608.22538": { "id": "2608.22538", "version_id": "2608.22538v3", "abstract_sha256": "d39c7a3ea972da1f699b62f8b64358e93f6579fdecfca09d62553cc8f94af8d5", "abstract_read": true, "classification": "relevant", "reason_zh": "明确研究企业Agent策略局部上下文与确定性控制，但摘要指标以业务可靠性为主，授权安全需全文确认。", "summary_zh": "STAGE把权威流程编成审核后冻结的图，节点限定局部政策、工具与输出合同，由确定性协调器推进并校验，文档中间件控制私有信息访问。五类流程、18组模型对比中，作者称三次均成功的Pass³提高7.5–66.0个百分点；这是政策约束工作流架构与流程合规实验，不等于对抗攻防保证。", "topics": { "tags": [ "authorization", "monitoring", "memory" ], "reason_zh": "正文2规定冻结审查后的流程图、节点限定工具、只允许声明的后继、类型化输出验证与确定性政策钩子，并按文档权限门控私有数据；不仅是一般任务可靠性，而是明确的代理运行时权限/政策强制。" }, "reason": "正文2规定冻结审查后的流程图、节点限定工具、只允许声明的后继、类型化输出验证与确定性政策钩子，并按文档权限门控私有数据；不仅是一般任务可靠性，而是明确的代理运行时权限/政策强制。", "title": "STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Control", "initial_classification": "uncertain", "scope_review": { "id": "2608.22538", "version_id": "2608.22538v3", "classification": "relevant", "reason": "正文2规定冻结审查后的流程图、节点限定工具、只允许声明的后继、类型化输出验证与确定性政策钩子，并按文档权限门控私有数据；不仅是一般任务可靠性，而是明确的代理运行时权限/政策强制。", "summary_zh": "STAGE把权威流程编成审核后冻结的图，节点限定局部政策、工具与输出合同，由确定性协调器推进并校验，文档中间件控制私有信息访问。五类流程、18组模型对比中，作者称三次均成功的Pass³提高7.5–66.0个百分点；这是政策约束工作流架构与流程合规实验，不等于对抗攻防保证。", "topics": { "tags": [ "authorization", "monitoring", "memory" ], "reason_zh": "正文2规定冻结审查后的流程图、节点限定工具、只允许声明的后继、类型化输出验证与确定性政策钩子，并按文档权限门控私有数据；不仅是一般任务可靠性，而是明确的代理运行时权限/政策强制。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2608.22538v3", "reviewed_sections": [ "Abstract", "1 Introduction", "2 STAGE architecture", "3 Experimental Settings" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "2 STAGE architecture", "3 Experimental Settings" ], "body_source_url": "https://arxiv.org/pdf/2608.22538v3", "evidence_level": "abstract_and_targeted_body", "published": "2026-08-23T18:17:09Z", "updated": "2026-11-01T17:47:45Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.22538v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.22538", "title": "STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Control", "version_id": "2608.22538v3", "first_author": "Mengxi Luo", "authors": [ "Mengxi Luo", "Changjia Chen", "An Cao", "Wanyi Dai", "Zirong Huang", "Shixiong Gao", "Ruoqi Shu", "John Chen", "Bo Wan" ], "affiliations": [ "BMO Financial Group" ], "source_url": "https://arxiv.org/pdf/2608.22538v3", "shared_first_authors": [ "Mengxi Luo", "Changjia Chen" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v3边栏匹配；全体作者共享BMO Financial Group，Mengxi Luo及Changjia Chen星号脚注明示共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2611.00291": { "id": "2611.00291", "abstract_sha256": "bd865146f531e918dcc8ccb3ee53651b9ab8195f6c4f4e117d9b220f3a2a0a8a", "abstract_read": true, "classification": "relevant", "reason_zh": "真实智能体代理行为故障与自主性、人类控制直接相关。", "summary_zh": "从两个公共库的695起事件归纳人机智能体交互的12种故障模式，并按三个交互阶段及自主程度编码。论文指出全部模式在高低自主性均出现，但部署时用户介入间隔会改变故障表现，主张提供完全委托与完全手工之间的控制方式，并指出现有事件记录及基准未充分覆盖交互层。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "围绕代理执行失误、自主性与用户控制边界建立故障分类。" }, "reason": "真实智能体代理行为故障与自主性、人类控制直接相关。", "version_id": "2611.00291v1", "title": "When AI Agents Act on Our Behalf: A Taxonomy of Human-Agent Interaction Failure", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-30T19:17:20Z", "updated": "2026-10-30T19:17:20Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CY", "cs.HC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00291v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00291", "title": "When AI Agents Act on Our Behalf: A Taxonomy of Human-Agent Interaction Failure", "version_id": "2611.00291v1", "first_author": "Canwen Wang", "authors": [ "Canwen Wang", "Qing Xiao", "Haiyi Zhu", "Hong Shen" ], "affiliations": [ "Carnegie Mellon University" ], "source_url": "https://arxiv.org/pdf/2611.00291v1", "shared_first_authors": [ "Canwen Wang", "Qing Xiao" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Canwen Wang作者栏列CMU；星号脚注明示共同第一作者，匕首为共同资深作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.00407": { "id": "2611.00407", "abstract_sha256": "dd35d406b2500ae4b3c65b2a5e113ea965e296bed7a4129b4937f5c1912005ba", "abstract_read": true, "classification": "relevant", "reason_zh": "直接研究区分智能体奖励黑客与诚实失败的监督器。", "summary_zh": "构造可操纵完成分数的沙箱任务，以重放和反事实修复标注轨迹，比较LLM监督器能否区分奖励黑客与同分差诚实失败。60条轨迹上主要小模型监督器AUC为0.64，Gemini为0.80但仅14条攻击样本；未在提示中命名的攻击可漏检，小模型也出现虚构理由和误报，两条确定性规则则抓住所有已知攻击。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "直接检验智能体奖励操纵检测及监督可靠性。" }, "reason": "直接研究区分智能体奖励黑客与诚实失败的监督器。", "version_id": "2611.00407v1", "title": "Hacking or Just Failing? A More Capable LLM Monitor Better Separates Reward Hacking from Honest Failure", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-30T21:52:47Z", "updated": "2026-10-30T21:52:47Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00407v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00407", "title": "Hacking or Just Failing? A More Capable LLM Monitor Better Separates Reward Hacking from Honest Failure", "version_id": "2611.00407v1", "first_author": "Kaushik Kezendirane", "authors": [ "Kaushik Kezendirane" ], "affiliations": [ "Independent researcher" ], "source_url": "https://arxiv.org/pdf/2611.00407v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；唯一作者下明确写Independent researcher，不推断机构。", "affiliation_checked": true }, "revision_history": [] }, "2611.00420": { "id": "2611.00420", "abstract_sha256": "c178c01668dd58396d688e981fac340cea7da5394102fe4662b9381eace33cce", "abstract_read": true, "classification": "relevant", "reason_zh": "工具化多智能体用于安全解释和拒绝抑制攻击评估。", "summary_zh": "Circuit Oracle把现成LLM、多智能体框架和专门技能结合，通过工具读取归因图，自动回答模型机制问题。三类安全代理任务中，伪特征检测准确率78.2±2.4%；隐秘知识提取弱于训练过的解释器；50条拒绝抑制测试上单次干预略低于均值差基线，只有五次择优才超过。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "明确将工具智能体用于安全审计及拒绝抑制攻击任务。" }, "reason": "工具化多智能体用于安全解释和拒绝抑制攻击评估。", "version_id": "2611.00420v1", "title": "Circuit Oracle: Automating Attribution Graph Analysis via Natural-Language Queries", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-30T22:12:53Z", "updated": "2026-10-30T22:12:53Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00420v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00420", "title": "Circuit Oracle: Automating Attribution Graph Analysis via Natural-Language Queries", "version_id": "2611.00420v1", "first_author": "Shariar Kabir", "authors": [ "Shariar Kabir", "Hong Kiat Tan", "Swastik Agrawal", "Sai V R Chereddy", "Sriram Balasubramanian" ], "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2611.00420v1", "shared_first_authors": [ "Shariar Kabir", "Hong Kiat Tan" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Shariar Kabir上标1为Independent Researcher；星号脚注明示共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2611.00489": { "id": "2611.00489", "abstract_sha256": "236fe727c00b41e86211bae22f505dd6260157c448a8d46cd59cd64449bb7dee", "abstract_read": true, "classification": "relevant", "reason_zh": "直接研究智能体在亲密伴侣虐待及监控中的威胁模型。", "summary_zh": "论文把技术辅助虐待威胁模型用于能发邮件、预订并访问用户数据的自主智能体，按系统所有者区分施虐者拥有系统和受害者拥有系统两类攻击：前者降低并扩大既有虐待的实施门槛，后者产生可被施虐者利用的新攻击面。摘要提出缓解研究方向，未给出实验效果。", "topics": { "tags": [ "authorization", "privacy" ], "reason_zh": "智能体工具与数据访问被用于亲密伴侣虐待、监控及越权。" }, "reason": "直接研究智能体在亲密伴侣虐待及监控中的威胁模型。", "version_id": "2611.00489v1", "title": "Threat Modeling Intimate Partner Abuse in Agentic Systems", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T00:28:26Z", "updated": "2026-10-31T00:28:26Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00489v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00489", "title": "Threat Modeling Intimate Partner Abuse in Agentic Systems", "version_id": "2611.00489v1", "first_author": "Natalie Grace Brigham", "authors": [ "Natalie Grace Brigham", "Eugene Bagdasarian", "Franziska Roesner", "Tadayoshi Kohno" ], "affiliations": [ "University of Washington" ], "source_url": "https://arxiv.org/pdf/2611.00489v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Natalie Grace Brigham上标1，页脚1映射University of Washington。", "affiliation_checked": true }, "revision_history": [] }, "2611.00725": { "id": "2611.00725", "abstract_sha256": "12121b6d28e11cb68a56008adf9b1698079eb6bb2d41ae279e1be6c517500ce6", "abstract_read": true, "classification": "relevant", "reason_zh": "恶意网站先建立可信度再诱导编码智能体越权，并测试授权分离防御。", "summary_zh": "EtE让恶意网站先提供多轮可验证帮助取得编码智能体信赖，再给出相关但越过操作边界的指令。在56种组织环境及三种编码智能体上，平均场景攻击成功率71.4%（Codex 85.7%、ZCode 67.9%、QwenCode 60.7%），高于注入基线。论文提出动作与授权分离，禁止Web内容直接授权高权限操作，摘要称在测试中把攻击成功率降至0%并保持100%任务完成率。", "topics": { "tags": [ "injection", "authorization", "memory", "evaluation" ], "reason_zh": "通过累积来源信任影响上下文，再触发高权限工具越权；包含明确防御评测。" }, "reason": "恶意网站先建立可信度再诱导编码智能体越权，并测试授权分离防御。", "version_id": "2611.00725v1", "title": "The Long Con on the Web: Earn-then-Exploit Fraud Attacks against Coding Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T08:02:14Z", "updated": "2026-10-31T08:02:14Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00725v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00725", "title": "The Long Con on the Web: Earn-then-Exploit Fraud Attacks against Coding Agents", "version_id": "2611.00725v1", "first_author": "Xingling Xu", "authors": [ "Xingling Xu", "Zhengwei Jiang", "Zheng Zhi", "Fangming Dong", "LingJia Guo", "Wei Dong", "Chunyan Ma", "Jun Jiang" ], "affiliations": [ "Institute of Information Engineering, Chinese Academy of Sciences", "University of Chinese Academy of Sciences" ], "source_url": "https://arxiv.org/pdf/2611.00725v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Xingling Xu第一作者栏明确列中科院信工所及国科大。", "affiliation_checked": true }, "revision_history": [] }, "2611.00838": { "id": "2611.00838", "abstract_sha256": "bbf8112a7b59d2cdb84608e59e4e190c1536b06a1171f3f3efb083be0e597734", "abstract_read": true, "classification": "relevant", "reason_zh": "防止智能体网络操作破坏后续监测与恢复，具有明确执行安全验证。", "summary_zh": "CLDA针对网络智能体达成局部目标却破坏监测或恢复依赖的问题，用循环依赖图连接服务要求、监测、转发路径、故障域及恢复前提。它以确定性规则检查多步计划的中间状态，并通过临时监测进行先建后拆修复。论文评估包含受控重配置、240次LLM规划、真实网络执行及最多1024路由器合成扩展性研究；摘要未给出数值收益。", "topics": { "tags": [ "authorization", "monitoring", "robustness" ], "reason_zh": "验证并修复智能体执行对安全保证与监测闭环的破坏。" }, "reason": "防止智能体网络操作破坏后续监测与恢复，具有明确执行安全验证。", "version_id": "2611.00838v1", "title": "Can Agentic AI Undermine Its Own Assurance Loop? Closed-Loop Dependency Assurance for Cognitive Network Digital Twins", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T11:41:33Z", "updated": "2026-10-31T11:41:33Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.ET", "cs.NI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00838v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00838", "title": "Can Agentic AI Undermine Its Own Assurance Loop? Closed-Loop Dependency Assurance for Cognitive Network Digital Twins", "version_id": "2611.00838v1", "first_author": "Ahmed Hussain", "authors": [ "Ahmed Hussain", "Konstantinos Kalogiannis", "Salahuddin Salahuddin", "Hexu Li", "Thiemo Voigt" ], "affiliations": [ "KTH Royal Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2611.00838v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；作者脚注明确Ahmed Hussain及Konstantinos Kalogiannis均在KTH。", "affiliation_checked": true }, "revision_history": [] }, "2611.01011": { "id": "2611.01011", "version_id": "2611.01011v1", "abstract_sha256": "aec40d84039bdbfad4758845c90f49567d9dd075888f39ebdd7fee0c9deef747", "abstract_read": true, "classification": "relevant", "reason_zh": "VLA在指令与场景不匹配时仍行动，论文加入判决门控冻结执行，直接涉及具身安全停止。", "summary_zh": "Leap-VLA把低频VLM语义与高频动作专家分离，按缓存年龄训练以减轻语义过期；四套LIBERO在1秒刷新下平均95.2%成功，对照96.3%。另发现指令场景不匹配时策略继续操作，使用负例训练的思维链判决门在不损害可行任务成功率下冻结不匹配指令执行。", "topics": { "tags": [ "embodied", "monitoring", "robustness" ], "reason_zh": "VLA在指令与场景不匹配时仍行动，论文加入判决门控冻结执行，直接涉及具身安全停止。" }, "reason": "VLA在指令与场景不匹配时仍行动，论文加入判决门控冻结执行，直接涉及具身安全停止。", "title": "Leap-VLA: High-Rate Robot Control from a Low-Rate VLM Backbone", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T14:53:16Z", "updated": "2026-10-31T14:53:16Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01011v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01011", "title": "Leap-VLA: High-Rate Robot Control from a Low-Rate VLM Backbone", "version_id": "2611.01011v1", "first_author": "Lin Yang", "authors": [ "Lin Yang", "Yunjie Shen", "Zheyu Li", "Zhenjie Tian", "Yongli Wang", "Dongze Huang", "Weiqi Wang", "Yucheng Zhu", "Zhaoquan Jiang", "Guofeng Xie", "Peigen Fang" ], "affiliations": [ "Embodied Algorithm Group, Automation PBU, Leapmotor" ], "source_url": "https://arxiv.org/pdf/2611.01011v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Lin Yang首位共享单位Leapmotor相应团队，星号为通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.01181": { "id": "2611.01181", "abstract_sha256": "b657e154df67144e0c86dc5848e9bbf792937e74f00a11e7b4a9523487231799", "abstract_read": true, "classification": "relevant", "reason_zh": "编码智能体是否提前避免漏洞及缺陷的直接基准。", "summary_zh": "Foresight-SWE检验编码智能体能否在完成请求之外预见并避免后续暴露的漏洞或缺陷。基准包含4种语言、35个开源仓库的212对前后PR，用前瞻解决率要求既完成原任务又避免后续PR修复的缺陷。11个模型得分仅6.13%至24.53%，显示现有智能体经常忽略变更的后续问题。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "编码智能体预防未明示漏洞与缺陷的安全相关评测。" }, "reason": "编码智能体是否提前避免漏洞及缺陷的直接基准。", "version_id": "2611.01181v1", "title": "Do Coding Agents Catch Their Own Bugs? (They Don't.)", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T18:29:06Z", "updated": "2026-10-31T18:29:06Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01181v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01181", "title": "Do Coding Agents Catch Their Own Bugs? (They Don't.)", "version_id": "2611.01181v1", "first_author": "Shaswat Patel", "authors": [ "Shaswat Patel", "Michel Liao", "Peter Henderson", "He He", "Valerie Chen" ], "affiliations": [ "New York University" ], "source_url": "https://arxiv.org/pdf/2611.01181v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Shaswat Patel上标1对应NYU。", "affiliation_checked": true }, "revision_history": [] }, "2611.01265": { "id": "2611.01265", "abstract_sha256": "2e0ca7a07b7ac7f857d59ca65ccbca1e7c703a4561a812f6fa59014e4d42a266", "abstract_read": true, "classification": "relevant", "reason_zh": "明确限制编码智能体可编辑、只读、必需及受保护文件的操作权限。", "summary_zh": "Boundary Contracts在仓库修改前明确机器可读的可编辑、只读、必需及受保护文件角色，区分任务相关性与操作权限。在真实企业仓库40个任务上，同一Codex智能体加入边界信息后编辑选择宏F1由0.440升至0.682、必需行为覆盖由0.429至0.673、严格合格补丁由9增至18；作者强调只是试点证据，不能证明普遍有效。", "topics": { "tags": [ "authorization", "supplychain", "evaluation" ], "reason_zh": "直接限定编码智能体仓库修改权限与任务边界。" }, "reason": "明确限制编码智能体可编辑、只读、必需及受保护文件的操作权限。", "version_id": "2611.01265v1", "title": "Toward Bounding Coding-Agent Autonomy in Software Maintenance: A Pilot Study of Boundary Contracts", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T21:03:30Z", "updated": "2026-10-31T21:03:30Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01265v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01265", "title": "Toward Bounding Coding-Agent Autonomy in Software Maintenance: A Pilot Study of Boundary Contracts", "version_id": "2611.01265v1", "first_author": "Heeyong Eun", "authors": [ "Heeyong Eun", "Seungyeon Chung", "Hyejee Park", "Youngeun Lee", "Sukhyun Hong", "Hyewon Jung" ], "affiliations": [ "KPMG Korea" ], "source_url": "https://arxiv.org/pdf/2611.01265v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Heeyong Eun作者栏明确KPMG Korea。", "affiliation_checked": true }, "revision_history": [] }, "2611.01334": { "id": "2611.01334", "abstract_sha256": "87c81d507bd067ec03d0ee5824ec3b7374a4f8c22eebdaa632d8c3bf63452a1e", "abstract_read": true, "classification": "relevant", "reason_zh": "直接研究科学智能体选择证据视图的奖励黑客。", "summary_zh": "论文在方程发现智能体中固定轨迹、候选库和验证器，只允许选择数值证据摘要，揭示该选择可形成奖励黑客。最大化公开分数错误拒绝全部1500个库内案例；Claude在要求准确时很少选错误摘要，但最大化分数或寻找缺失物理时常如此。多摘要一致性降低部分错误但常拒绝裁决，且弱于固定精细视图，因此不是安全证书。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "智能体通过操纵验证器可见证据取得虚高评分。" }, "reason": "直接研究科学智能体选择证据视图的奖励黑客。", "version_id": "2611.01334v1", "title": "The Verifier Is Part of the Simulator: Evidence-View Gaming in Agentic Equation Discovery", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T23:02:00Z", "updated": "2026-10-31T23:02:00Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 334 of 334 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01334v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01334", "title": "The Verifier Is Part of the Simulator: Evidence-View Gaming in Agentic Equation Discovery", "version_id": "2611.01334v1", "first_author": "Orestis Oikonomou", "authors": [ "Orestis Oikonomou", "Bogdan Raonic" ], "affiliations": [ "Seminar for Applied Mathematics, AI Center, ETH Zurich" ], "source_url": "https://arxiv.org/pdf/2611.01334v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Orestis Oikonomou作者栏逐行明确研究部门及ETH Zurich。", "affiliation_checked": true }, "revision_history": [] }, "2611.01357": { "id": "2611.01357", "abstract_sha256": "3b584fd6b84747278cc5c2acff330cc73b44dcf17f9a9bef9c2c07d83da02198", "abstract_read": true, "classification": "relevant", "reason_zh": "固定受保护声明并阻止LLM智能体修改，验证与权限边界明确。", "summary_zh": "ProofPatch用Lean内核检查声明意图，并以展开后的声明和依赖指纹保存审查结果；可固定声明阻止人或LLM智能体改动。229对Mathlib版本中仅118/12898项模拟审查需复核，文本方法或漏检或大幅过报；1527项声明上识别不忠实表达精度0.88–0.96，344次LLM智能体运行无固定声明修改通过。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "以受保护声明和可验证变更审计限制智能体修改。" }, "reason": "固定受保护声明并阻止LLM智能体修改，验证与权限边界明确。", "version_id": "2611.01357v1", "title": "ProofPatch: Reviewing Lean Statements and Keeping the Reviews Valid as Formalizations Evolve", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T23:55:48Z", "updated": "2026-10-31T23:55:48Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LO", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01357v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01357", "title": "ProofPatch: Reviewing Lean Statements and Keeping the Reviews Valid as Formalizations Evolve", "version_id": "2611.01357v1", "first_author": "Xujun Che", "authors": [ "Xujun Che", "Depeng Xu", "Jian Xiang", "Taufiqua Khan" ], "affiliations": [ "University of North Carolina at Charlotte" ], "source_url": "https://arxiv.org/pdf/2611.01357v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Xujun Che首位，作者共享University of North Carolina at Charlotte。", "affiliation_checked": true }, "revision_history": [] }, "2611.01566": { "id": "2611.01566", "abstract_sha256": "d942eb0556aa54858340f1a31dc78bb607349c2788fe2021868c0168e71dd755", "abstract_read": true, "classification": "relevant", "reason_zh": "针对智能体工作流何时无需人工审查发布输出，提供统计风险门控。", "summary_zh": "论文研究生成、验证、修订的智能体流程何时可以不经人工复核发布结果，用专家评判校准验证阈值及尝试次数，在统计批准的候选策略中最大化自动化率，并证明有限样本发布错误控制。MultiHiertt案例中自动化率随专家样本增加从2.50%升至24.17%，发布错误率约1.20%；启发式策略或超5%容忍率、或自动化不足1.30%。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "通过人类审查校准和风险门控约束自主结果发布。" }, "reason": "针对智能体工作流何时无需人工审查发布输出，提供统计风险门控。", "version_id": "2611.01566v1", "title": "Principled Human-AI Collaboration in Agentic Workflows", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T04:47:28Z", "updated": "2026-11-01T04:47:28Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.LG", "stat.ME", "stat.ML" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 236 of 236 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 33 of 33 entries)", "category": "stat.ML", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "stat.ML", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01566v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01566", "title": "Principled Human-AI Collaboration in Agentic Workflows", "version_id": "2611.01566v1", "first_author": "Young Hyun Cho", "authors": [ "Young Hyun Cho", "Will Wei Sun" ], "affiliations": [ "Department of Statistics, Harvard University" ], "source_url": "https://arxiv.org/pdf/2611.01566v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Young Hyun Cho上标1对应哈佛统计系。", "affiliation_checked": true }, "revision_history": [] }, "2611.01930": { "id": "2611.01930", "abstract_sha256": "70cf3e91414f9e629198d4e39d8ce60e3dc49dc8ff08b80da0f3346c4c8bb77c", "abstract_read": true, "classification": "relevant", "reason_zh": "终端工具返回与实际执行不一致导致智能体虚报成功，直接检查执行证据。", "summary_zh": "RECEIPT研究终端智能体把工具调用返回误当动作完成的风险，分析91469个生产调用、89047条公开轨迹及8种框架，并建立158个命令和25对任务基准。关闭输入使11.5%受测命令以状态0退出却未执行；系统通过系统调用读取等待状态并用模型检查协议返回给智能体，在5个模型上把虚假成功声明减少73.5%。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "验证工具操作实际完成证据，防止执行状态误认。" }, "reason": "终端工具返回与实际执行不一致导致智能体虚报成功，直接检查执行证据。", "version_id": "2611.01930v1", "title": "RECEIPT: Measuring and Repairing the Return Assumption of LLM Agents in Web Service Operations", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T14:06:53Z", "updated": "2026-11-01T14:06:53Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01930v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01930", "title": "RECEIPT: Measuring and Repairing the Return Assumption of LLM Agents in Web Service Operations", "version_id": "2611.01930v1", "first_author": "Boyang Yang", "authors": [ "Boyang Yang", "Ziyao Yang", "Yu Zhang", "Duo Chai", "Xiaoming Chen", "Haoye Tian" ], "affiliations": [ "Yanshan University" ], "source_url": "https://arxiv.org/pdf/2611.01930v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Boyang Yang上标1对应燕山大学。", "affiliation_checked": true }, "revision_history": [] }, "2611.01950": { "id": "2611.01950", "abstract_sha256": "d6376c8449deb5ec4f3cf5619694d7957d1165cda5d4a3ebc93150b10bd8cd93", "abstract_read": true, "classification": "relevant", "reason_zh": "验证编码智能体服务模型身份、防止替换与自适应欺骗。", "summary_zh": "CertClaim针对编码智能体服务可合法改变采样、推理模式和系统提示而令静态身份审计失效的问题，把所有授权部署配置纳入模型声明，逐配置校准并融合多种证据，检查是否存在一种合法配置解释服务表现。论文证明误控告率及检测条件，并在8种声明、2个框架和3个任务套件评测，声称更好识别替代模型且抵抗自适应攻击，摘要无具体数值。", "topics": { "tags": [ "supplychain", "monitoring", "evaluation" ], "reason_zh": "审计编码智能体服务的模型来源声明与替换欺骗。" }, "reason": "验证编码智能体服务模型身份、防止替换与自适应欺骗。", "version_id": "2611.01950v1", "title": "CertClaim: Towards Certified Model-Claim Verification for Coding-Agent Services", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T14:31:50Z", "updated": "2026-11-01T14:31:50Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01950v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01950", "title": "CertClaim: Towards Certified Model-Claim Verification for Coding-Agent Services", "version_id": "2611.01950v1", "first_author": "Jiacheng Lu", "authors": [ "Jiacheng Lu", "Qixuan Yang", "Tao Song", "Daxin Jiang", "Jing Li", "Zuo Bai", "Haibing Guan" ], "affiliations": [ "Shanghai Jiao Tong University", "StepFun" ], "source_url": "https://arxiv.org/pdf/2611.01950v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Jiacheng Lu上标1,2，页脚映射上海交通大学及StepFun。", "affiliation_checked": true }, "revision_history": [] }, "2611.02155": { "id": "2611.02155", "abstract_sha256": "33d65a9166053cd4a42338132f746d30300bd998dc61ae40bfc27d4d78f664dd", "abstract_read": true, "classification": "relevant", "reason_zh": "直接在编码智能体工具调用前检测破坏数据、泄密及错误发送风险。", "summary_zh": "论文用2643个合成工具调用、28条规则和封存测试集，比较22个托管决策模型及两个提示通用模型作为编码智能体运行时策略门。明确正反例边界使全部23个可用模型召回提升5.5–26.1个百分点，21个减少误报；Jev 1.14召回从89.3%升至98.2%，252个干净动作中的多余打断由30.6%降至4.8%，中位延迟120毫秒。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "在执行前依据明确规则阻拦高风险工具调用。" }, "reason": "直接在编码智能体工具调用前检测破坏数据、泄密及错误发送风险。", "version_id": "2611.02155v1", "title": "Decision Models as Policy Gates for Coding Agents: Explicit Policy Boundaries Improve Detection and Reduce False Alarms", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T19:40:30Z", "updated": "2026-11-01T19:40:30Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 22 of 22 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02155v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02155", "title": "Decision Models as Policy Gates for Coding Agents: Explicit Policy Boundaries Improve Detection and Reduce False Alarms", "version_id": "2611.02155v1", "first_author": "James P. Beno", "authors": [ "James P. Beno" ], "affiliations": [ "Agent Approve" ], "source_url": "https://arxiv.org/pdf/2611.02155v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；James P. Beno姓名下明确Agent Approve。", "affiliation_checked": true }, "revision_history": [] }, "2611.02300": { "id": "2611.02300", "abstract_sha256": "660911fa59e8e986dd00a31b092438e7a82b4af03b69cbf76a1a5771607f7c9b", "abstract_read": true, "classification": "relevant", "reason_zh": "工业智能体持久变更的权限、证据、实际效果及恢复控制直接相关。", "summary_zh": "论文提出单企业治理域内工业智能体可信执行框架，以八个控制域、四平面和三条控制链区分权限、规划、工具返回、实际工程效果、证据、适用性及恢复。不同原型和CAD/CAE反例揭示漏检、负面事实丢失及接口不一致；修复支持局部回归结论，报告0/29危险提交仅表示封闭集规格符合性，不能解释为安全概率。", "topics": { "tags": [ "authorization", "monitoring", "multiagent", "evaluation" ], "reason_zh": "直接控制持久工程变更权限、交接证据及恢复边界。" }, "reason": "工业智能体持久变更的权限、证据、实际效果及恢复控制直接相关。", "version_id": "2611.02300v1", "title": "Trustworthy Execution of Industrial Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T23:47:59Z", "updated": "2026-11-01T23:47:59Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.MA", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 23 of 23 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02300v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02300", "title": "Trustworthy Execution of Industrial Agents", "version_id": "2611.02300v1", "first_author": "Zhongjie Wang", "authors": [ "Zhongjie Wang", "Mingyi Liu", "Xiang He", "Xiao Wang", "Shuang Yu", "Kai Wang" ], "affiliations": [ "Faculty of Computing, Harbin Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2611.02300v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Zhongjie Wang首位，共享哈工大计算学部署名。", "affiliation_checked": true }, "revision_history": [] }, "2611.02527": { "id": "2611.02527", "abstract_sha256": "41a245145abfdf05f8bf6434f96f5e6c11c968622e1a71a2283746c5ae080738", "abstract_read": true, "classification": "relevant", "reason_zh": "直接发现MCP破坏性工具在人机两侧均无审批并测试注入删除。", "summary_zh": "论文检查MCP官方注册表1000个仓库和41个主机/SDK，估计90%的破坏性工具缺少服务器确认，32个主机/SDK默认无批准步骤；工具与应用配对60.7%默认无强制人工批准。通过4个SDK运行注入删除测试，5个低成本模型中4个在合计960次运行中执行479次。对未标记只读或非破坏的工具默认审批可将未批准配对降至5.4%，仅普及询问支持仍为56.7%。", "topics": { "tags": [ "authorization", "injection", "evaluation" ], "reason_zh": "跨MCP服务与主机的审批缺口直接让提示注入触发破坏性操作。" }, "reason": "直接发现MCP破坏性工具在人机两侧均无审批并测试注入删除。", "version_id": "2611.02527v1", "title": "When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T04:57:42Z", "updated": "2026-11-02T04:57:42Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 22 of 22 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02527v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02527", "title": "When Neither Side Confirms: Destructive Tool Approval Across MCP Servers and Hosts", "version_id": "2611.02527v1", "first_author": "Junwei Yao", "authors": [ "Junwei Yao", "Zike Yang", "Zhijun Wang", "Yongxi Zhou", "Wenbo Ye" ], "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2611.02527v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Junwei Yao作者栏明示Independent Researcher。", "affiliation_checked": true }, "revision_history": [] }, "2611.02611": { "id": "2611.02611", "abstract_sha256": "893a0889ecf748c72e0f5487b27cdf3888a19b1afc16f55c89a36fde5dc02eb1", "abstract_read": true, "classification": "relevant", "reason_zh": "直接把MCP注入及混淆代理风险映射到服务器、网关和协议层缓解责任。", "summary_zh": "论文以OWASP MCP Top 10为基础，用四问题级联决策树把缓解责任分成服务器优先、网关优先及协议优先，并给出置信度。针对Go实现的企业文件传输MCP服务器验证发现，高置信服务器控制按预期有效，而部分协议层控制因架构限制失败，指出单独服务器安全开发不能消除数据与控制混合带来的注入及混淆代理风险。", "topics": { "tags": [ "injection", "authorization", "supplychain" ], "reason_zh": "明确分析MCP架构安全边界及跨层缓解能力上限。" }, "reason": "直接把MCP注入及混淆代理风险映射到服务器、网关和协议层缓解责任。", "version_id": "2611.02611v1", "title": "Where Does MCP Security End? A Three-Tier Mitigation Mapping Framework for the OWASP MCP Top 10", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T06:36:08Z", "updated": "2026-11-02T06:36:08Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02611v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02611", "title": "Where Does MCP Security End? A Three-Tier Mitigation Mapping Framework for the OWASP MCP Top 10", "version_id": "2611.02611v1", "first_author": "Christopher Krakauer", "authors": [ "Christopher Krakauer", "Andreas Schaad" ], "affiliations": [ "Offenburg University of Applied Sciences" ], "source_url": "https://arxiv.org/pdf/2611.02611v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题匹配，未见版本侧栏；Christopher Krakauer首位，共享Offenburg University of Applied Sciences。", "affiliation_checked": true }, "revision_history": [] }, "2611.02644": { "id": "2611.02644", "abstract_sha256": "8bd4bb23cf059fe53fab50b2bc29344841d9bdc74d7f7073121ccc11afa89dbf", "abstract_read": true, "classification": "relevant", "reason_zh": "手机智能体以宿主证据检查动作及完成声明，防止虚报。", "summary_zh": "Coati是在Android本机运行的GUI智能体，通过宿主记录动作效果和跨应用屏幕，VerifyLoop对完成声明逐项核验，无法审核的标为未验证，并构建应用程序记忆及快速执行器。在116个AndroidWorld任务三次试验中成功率86.5%，VerifyLoop在相近成功率下将虚报完成减少约三分之一。", "topics": { "tags": [ "monitoring", "evaluation", "robustness" ], "reason_zh": "用独立宿主执行证据替代模型自评，约束虚假完成声明。" }, "reason": "手机智能体以宿主证据检查动作及完成声明，防止虚报。", "version_id": "2611.02644v1", "title": "Coati: Host-Grounded Execution for Installable Mobile GUI Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T07:06:26Z", "updated": "2026-11-02T07:06:26Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 14 of 14 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02644v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02644", "title": "Coati: Host-Grounded Execution for Installable Mobile GUI Agents", "version_id": "2611.02644v1", "first_author": "Yudou Ying", "authors": [ "Yudou Ying", "Pu Shi", "Hanlei Shi", "Yuhua Zheng" ], "affiliations": [ "Hangzhou Institute for Advanced Study, University of Chinese Academy of Sciences" ], "source_url": "https://arxiv.org/pdf/2611.02644v1", "shared_first_authors": [ "Yudou Ying", "Pu Shi" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Yudou Ying作者栏明确国科大杭州高等研究院；星号共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2611.02676": { "id": "2611.02676", "abstract_sha256": "202a398e6b869ff7665727ac719a5d643acb7b8384c7314b762b6cb9e9c2453e", "abstract_read": true, "classification": "relevant", "reason_zh": "智能体评测输入证据完整性与检查绕过直接影响安全审计可信性。", "summary_zh": "论文提出智能体评测输入的四项保证：渲染保留必需内容、检查器覆盖要求、失败阻断后续使用、裁判读取最后受检字节。在30条轨迹管线中虽哈希匹配且检查通过，仍漏掉所有结构化工具调用，使60步中53步空白；还发现不配对结果及失败或改动后文件能进入裁判。新增三控制在19个故障构造中阻止18个，余下过期脚本未运行。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "审计智能体评测证据链完整性及检查到使用之间的失效。" }, "reason": "智能体评测输入证据完整性与检查绕过直接影响安全审计可信性。", "version_id": "2611.02676v1", "title": "Does the Judge See What the Evaluation Requires? Input Assurance for LLM Agent Evaluation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T07:31:59Z", "updated": "2026-11-02T07:31:59Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02676v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02676", "title": "Does the Judge See What the Evaluation Requires? Input Assurance for LLM Agent Evaluation", "version_id": "2611.02676v1", "first_author": "Boming Xia", "authors": [ "Boming Xia", "Qinghua Lu", "Runze Li", "Dino Sejdinovic", "Liming Zhu" ], "affiliations": [ "Responsible AI Research Centre, Adelaide University" ], "source_url": "https://arxiv.org/pdf/2611.02676v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Boming Xia星号对应Adelaide RAIR；星号为单位符号，CSIRO属于其他作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.02741": { "id": "2611.02741", "abstract_sha256": "79f9a7bd77da8c5885a230f6eeaa9d5a5180675a687c21102dc2f09b96b31bd0", "abstract_read": true, "classification": "relevant", "reason_zh": "以动态信任边界防御智能体间接提示注入。", "summary_zh": "ATrust以用户查询为根信任锚，结合执行状态评估外部观察，逐步把任务必需信息纳入信任边界，同时排除无关内容，避免静态防御过度阻断。在AgentDojo和AgentDyn测试中报告最佳整体安全效用权衡；GPT-4o在AgentDyn的攻击成功率从37.80%降至4.37%，效用提高10.00%，并报告优于AuthGraph。", "topics": { "tags": [ "injection", "authorization", "memory", "evaluation" ], "reason_zh": "直接防御外部观察中的间接提示注入及其越权后果。" }, "reason": "以动态信任边界防御智能体间接提示注入。", "version_id": "2611.02741v1", "title": "ATrust: Adaptive Trust Boundary Expansion for Securing LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T08:28:35Z", "updated": "2026-11-02T08:28:35Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02741v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02741", "title": "ATrust: Adaptive Trust Boundary Expansion for Securing LLM Agents", "version_id": "2611.02741v1", "first_author": "Xu Zhang", "authors": [ "Xu Zhang", "Zhichao Lu" ], "affiliations": [ "Department of Computer Science, City University of Hong Kong" ], "source_url": "https://arxiv.org/pdf/2611.02741v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Xu Zhang上标1对应CityU计算机系，匕首通讯作者为另一作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.03092": { "id": "2611.03092", "abstract_sha256": "15ba9d8e162f39905c0ccbc7376c7a5ba6d7033691199b21489166c85cb10502", "abstract_read": true, "classification": "relevant", "reason_zh": "个人智能体持久委托明确提出重大决定控制、问责与救济安全机制。", "summary_zh": "论文提出Avatar Intelligence持续个人智能体范式，以跨情境长期委托表达用户目标、价值和约束，同时保留用户对重大决定的控制。给出从人工指导到限定领域自主运行的成熟度路线和AOI评估框架，并提出身份连续个性化、用户情境演化及技术控制结合问责和救济三类挑战。属于研究议程，摘要无实证结果。", "topics": { "tags": [ "authorization", "memory", "evaluation" ], "reason_zh": "明确研究个人代理的限定委托、安全控制和可追责边界。" }, "reason": "个人智能体持久委托明确提出重大决定控制、问责与救济安全机制。", "version_id": "2611.03092v1", "title": "Avatar Intelligence: Amplifying Human Agency Through Persistent Personal Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T13:11:57Z", "updated": "2026-11-02T13:11:57Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03092v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03092", "title": "Avatar Intelligence: Amplifying Human Agency Through Persistent Personal Agents", "version_id": "2611.03092v1", "first_author": "Zheng Wu", "authors": [ "Zheng Wu", "Xinbei Ma", "Yao Yao", "Zhaoyuan Huang", "Haowen Hu", "Yijie Lu", "Taolei Wang", "Yifei Yang", "Wuyue Xiong", "Pengzhou Cheng", "Zhuosheng Zhang" ], "affiliations": [ "Shanghai Jiao Tong University" ], "source_url": "https://arxiv.org/pdf/2611.03092v1", "shared_first_authors": [ "Zheng Wu", "Xinbei Ma" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Zheng Wu上标1，星号共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2611.03434": { "id": "2611.03434", "abstract_sha256": "62fa91bb407dce1b5d14b909f3ae75d4c4a11e064aa50b2f9262fe79e5d08c1d", "abstract_read": true, "classification": "relevant", "reason_zh": "限制调查智能体工具面及护栏以满足安全和可审计性，直接相关。", "summary_zh": "CLEO围绕自托管模型自底向上构建最小调查代理harness，初始仅ls/read/grep和非持久Python沙箱，新增工具、记忆或控制环需通过性能与可审计最小化双重门控。作者在240个留出问题上报告83.8%通过率，接近更大harness；安全价值在受控能力面与可审查性，未测注入攻击成功率。", "topics": { "tags": [ "authorization", "monitoring", "privacy" ], "reason_zh": "正文明确面向敏感本地调查数据，从只读文件工具与非持久Python沙箱起步，每次扩展能力表面需同时经过泛化/可审计/最小化准入，而非单按准确率。属最小权限面与harness治理架构；没有证据证明抵抗提示注入。" }, "reason": "正文明确面向敏感本地调查数据，从只读文件工具与非持久Python沙箱起步，每次扩展能力表面需同时经过泛化/可审计/最小化准入，而非单按准确率。属最小权限面与harness治理架构；没有证据证明抵抗提示注入。", "version_id": "2611.03434v1", "title": "Optimize the Harness, Not the Model: Fitting a Minimal Agent to a Self-Hostable LLM for Investigative Analysis", "initial_classification": "relevant", "scope_review": { "id": "2611.03434", "version_id": "2611.03434v1", "classification": "relevant", "reason": "正文明确面向敏感本地调查数据，从只读文件工具与非持久Python沙箱起步，每次扩展能力表面需同时经过泛化/可审计/最小化准入，而非单按准确率。属最小权限面与harness治理架构；没有证据证明抵抗提示注入。", "summary_zh": "CLEO围绕自托管模型自底向上构建最小调查代理harness，初始仅ls/read/grep和非持久Python沙箱，新增工具、记忆或控制环需通过性能与可审计最小化双重门控。作者在240个留出问题上报告83.8%通过率，接近更大harness；安全价值在受控能力面与可审查性，未测注入攻击成功率。", "topics": { "tags": [ "authorization", "monitoring", "privacy" ], "reason_zh": "正文明确面向敏感本地调查数据，从只读文件工具与非持久Python沙箱起步，每次扩展能力表面需同时经过泛化/可审计/最小化准入，而非单按准确率。属最小权限面与harness治理架构；没有证据证明抵抗提示注入。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.03434v1", "reviewed_sections": [ "Complete Abstract", "1 Introduction", "2.1 Minimal Harness", "2.2 Optimization loop", "4 Conclusions" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Complete Abstract", "1 Introduction", "2.1 Minimal Harness", "2.2 Optimization loop", "4 Conclusions" ], "body_source_url": "https://arxiv.org/pdf/2611.03434v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T16:53:29Z", "updated": "2026-11-02T16:53:29Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 23 of 23 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03434v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03434", "title": "Optimize the Harness, Not the Model: Fitting a Minimal Agent to a Self-Hostable LLM for Investigative Analysis", "version_id": "2611.03434v1", "first_author": "Shai Nahum Gefen", "authors": [ "Shai Nahum Gefen", "Vered Chassida", "Dmitry Basin", "Guy Feigenblat" ], "affiliations": [ "Dream Security" ], "source_url": "https://arxiv.org/pdf/2611.03434v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Shai Nahum Gefen作者栏明确Dream Security。", "affiliation_checked": true }, "revision_history": [] }, "2611.03586": { "id": "2611.03586", "abstract_sha256": "5cb42d19af111c889e272556e2584144485d4b43bd0b84040e108c855d5f08bf", "abstract_read": true, "classification": "relevant", "reason_zh": "以有界LLM代理、摘要绑定检查与本地数据隔离约束联邦准备。", "summary_zh": "FedReady让有界LLM智能体提出联邦协作合同、适配器及任务代码，运行时保有状态，仅在与工件摘要绑定的检查通过后接受，原始记录和站点私有映射不跨站传输。39个模拟视网站点四任务中候选发现召回1.00、精度0.65，本地验证清除17个误报且不丢合格组合；十个患者队列中三来源端点被判不支持。", "topics": { "tags": [ "authorization", "privacy", "supplychain" ], "reason_zh": "工件完整性验收、有界代理及数据边界保护构成明确约束机制。" }, "reason": "以有界LLM代理、摘要绑定检查与本地数据隔离约束联邦准备。", "version_id": "2611.03586v1", "title": "FedReady: Bounded Agents for Federation Formation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T18:32:43Z", "updated": "2026-11-02T18:32:43Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 23 of 23 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03586v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03586", "title": "FedReady: Bounded Agents for Federation Formation", "version_id": "2611.03586v1", "first_author": "Ziyue Xu", "authors": [ "Ziyue Xu", "Holger R. Roth", "Chester Chen", "Peter Cnudde" ], "affiliations": [ "NVIDIA" ], "source_url": "https://arxiv.org/pdf/2611.03586v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Ziyue Xu首位，全体作者共享NVIDIA。", "affiliation_checked": true }, "revision_history": [] }, "2611.03601": { "id": "2611.03601", "abstract_sha256": "2d4cd21a5b657aeb25ea18fd0b3e060583a5f6a264c6d9eef5ef3fc97bcb36fb", "abstract_read": true, "classification": "relevant", "reason_zh": "医械工具自主生理控制属于高风险执行评测，但摘要未明确安全评估范围。", "summary_zh": "DiabAgent以医疗设备工具闭环执行生理控制，在模拟器中提供32种情景、212项任务，覆盖剂量历史、泵故障、传感器偏差等，并分别评估低血糖及控制质量。作者报告Opus5.5的COGI73.5、OpenAPS71.2；本研究证据来自仿真，不能据此声称已获临床验证或足以安全自动给药。", "topics": { "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "正文APC以实际工具接口选择胰岛素给药，模拟设备约束/故障与传感器错误，并把低血糖作为独立结果评分；6.2专门讨论给药历史、剂量限制与低血糖监测；本文证据来自仿真。是语言模型自主物理干预的安全相关评测，而非仅医疗QA。" }, "reason": "正文APC以实际工具接口选择胰岛素给药，模拟设备约束/故障与传感器错误，并把低血糖作为独立结果评分；6.2专门讨论给药历史、剂量限制与低血糖监测；本文证据来自仿真。是语言模型自主物理干预的安全相关评测，而非仅医疗QA。", "version_id": "2611.03601v1", "title": "DiabAgent: Toward Agentic Physiological Control", "initial_classification": "uncertain", "scope_review": { "id": "2611.03601", "version_id": "2611.03601v1", "classification": "relevant", "reason": "正文APC以实际工具接口选择胰岛素给药，模拟设备约束/故障与传感器错误，并把低血糖作为独立结果评分；6.2专门讨论给药历史、剂量限制与低血糖监测；本文证据来自仿真。是语言模型自主物理干预的安全相关评测，而非仅医疗QA。", "summary_zh": "DiabAgent以医疗设备工具闭环执行生理控制，在模拟器中提供32种情景、212项任务，覆盖剂量历史、泵故障、传感器偏差等，并分别评估低血糖及控制质量。作者报告Opus5.5的COGI73.5、OpenAPS71.2；本研究证据来自仿真，不能据此声称已获临床验证或足以安全自动给药。", "topics": { "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "正文APC以实际工具接口选择胰岛素给药，模拟设备约束/故障与传感器错误，并把低血糖作为独立结果评分；6.2专门讨论给药历史、剂量限制与低血糖监测；本文证据来自仿真。是语言模型自主物理干预的安全相关评测，而非仅医疗QA。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.03601v1", "reviewed_sections": [ "Abstract", "1 Introduction", "2 APC action loop", "3 Device action constraints", "4.2 Metrics", "6.2 Safety" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "2 APC action loop", "3 Device action constraints", "4.2 Metrics", "6.2 Safety" ], "body_source_url": "https://arxiv.org/pdf/2611.03601v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T18:41:02Z", "updated": "2026-11-02T18:41:02Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03601v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03601", "title": "DiabAgent: Toward Agentic Physiological Control", "version_id": "2611.03601v1", "first_author": "Chengxi Li", "authors": [ "Chengxi Li", "Shaoxuan Li", "Deyao Hong", "Qingle Liu", "Yi Huang", "Puheng Bian", "Minzhi Xu", "Lanyue Zhang", "Mingze Sun", "Xin Li", "Calvin Xiao", "Shengyuan Wang", "Huan-ang Gao", "Jiazheng Xu", "Kaisen Yang", "Hongning Wang" ], "affiliations": [ "Tsinghua University" ], "source_url": "https://arxiv.org/pdf/2611.03601v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Chengxi Li上标1对应清华大学；星号仅为Core contributor，不声明共同一作或Equal contribution，故不作共同一作。", "affiliation_checked": true }, "revision_history": [] }, "2510.04257": { "id": "2510.04257", "abstract_sha256": "17d84483aa2b1348a3cf1c0f0d62433c8214d7876953b3026869e57f24181338", "abstract_read": true, "classification": "relevant", "reason_zh": "直接研究网页图像中文字对多模态代理的自适应提示注入。", "summary_zh": "针对代理目标、网页上下文及动作历史使图像注入效果不确定的问题，AgentTypo 联合任务条件视觉注意力、黑盒文字位置/对比度/颜色优化和多模型反馈改写。作者在 VWA-Adv 与 Mind2Web 上测试；AgentTypo-pro 在七种模型后端取得 45%–83% 攻击成功率。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "直接研究网页图像中文字对多模态代理的自适应提示注入。" }, "reason": "直接研究网页图像中文字对多模态代理的自适应提示注入。", "version_id": "2510.04257v2", "title": "AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2025-10-05T15:46:56Z", "updated": "2026-11-02T07:17:10Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 52 of 52 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2510.04257v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2510.04257", "title": "AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents", "version_id": "2510.04257v2", "first_author": "Yanjie Li", "authors": [ "Yanjie Li", "Yiming Cao", "Dong Wang", "Bin Xiao" ], "affiliations": [ "The Hong Kong Polytechnic University" ], "source_url": "https://arxiv.org/pdf/2510.04257v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；作者脚注明确Yanjie Li is a postdoc with Hong Kong Polytechnic University，无共同一作声明。", "affiliation_checked": true }, "revision_history": [] }, "2603.10052": { "id": "2603.10052", "version_id": "2603.10052v2", "abstract_sha256": "65acd1cab632887145a779bc6edf2883eb7a05900d52c4ef2b2bed06849bb931", "abstract_read": true, "classification": "relevant", "reason_zh": "VLA空间指导明确提高安全率，属于具身安全邻近领域，但摘要未描述攻击或安全约束细节。", "summary_zh": "OmniGuide 用三维吸引与排斥能量场在 VLA 推理中引导动作，联合几何重建、VLM 语义目标和示范轨迹。作者报告成功率从 28.7% 升到 82.4%、安全率从 7.0% 升到 81.0%；安全定义为没有机器人与静态家具碰撞。实机包含突然出现障碍与人类阻挡；运行频率从 30Hz 降至约15Hz。作者明确软引导没有严格目标成功保证。", "topics": { "tags": [ "embodied", "robustness", "monitoring" ], "reason_zh": "对 VLA 动作实施碰撞风险引导，单独评估碰撞安全率。" }, "reason": "正文明确将碰撞规避作为独立于任务成功的安全指标，在 VLA 动作去噪时引入外部几何风险场，并测试突发障碍和人类阻挡，属于具身语言 Agent 执行安全。", "title": "OmniGuide: Universal Spatial Guidance Fields for Enhancing Generalist Robot Policies", "initial_classification": "uncertain", "scope_review": { "id": "2603.10052", "version_id": "2603.10052v2", "classification": "relevant", "reason": "正文明确将碰撞规避作为独立于任务成功的安全指标，在 VLA 动作去噪时引入外部几何风险场，并测试突发障碍和人类阻挡，属于具身语言 Agent 执行安全。", "summary_zh": "OmniGuide 用三维吸引与排斥能量场在 VLA 推理中引导动作，联合几何重建、VLM 语义目标和示范轨迹。作者报告成功率从 28.7% 升到 82.4%、安全率从 7.0% 升到 81.0%；安全定义为没有机器人与静态家具碰撞。实机包含突然出现障碍与人类阻挡；运行频率从 30Hz 降至约15Hz。作者明确软引导没有严格目标成功保证。", "topics": { "tags": [ "embodied", "robustness", "monitoring" ], "reason_zh": "对 VLA 动作实施碰撞风险引导，单独评估碰撞安全率。" }, "full_text_checked": true, "source_url": "https://arxiv.org/html/2603.10052v2", "reviewed_sections": [ "1 Introduction", "3 Background", "4.1 Guidance Defined in Cartesian Space", "4.2 A Universal Spatial Guidance Field", "5.1 Simulation Experiments", "5.2 Real-World Robot Experiments", "5.3 Ablations", "6 Conclusion and Limitations" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "1 Introduction", "3 Background", "4.1 Guidance Defined in Cartesian Space", "4.2 A Universal Spatial Guidance Field", "5.1 Simulation Experiments", "5.2 Real-World Robot Experiments", "5.3 Ablations", "6 Conclusion and Limitations" ], "body_source_url": "https://arxiv.org/html/2603.10052v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-03-09T17:18:13Z", "updated": "2026-11-02T18:26:52Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.LG", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.10052v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.10052", "title": "OmniGuide: Universal Spatial Guidance Fields for Enhancing Generalist Robot Policies", "version_id": "2603.10052v2", "first_author": "Yunzhou Song", "authors": [ "Yunzhou Song", "Long Le", "Yong-Hyun Park", "Jie Wang", "Junyao Shi", "Lingjie Liu", "Jiatao Gu", "Eric Eaton", "Dinesh Jayaraman", "Kostas Daniilidis" ], "affiliations": [ "University of Pennsylvania" ], "source_url": "https://arxiv.org/pdf/2603.10052v2", "shared_first_authors": [ "Yunzhou Song", "Long Le" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；所有作者共用University of Pennsylvania单位块，Yunzhou Song与Long Le星号对应Equal contribution。", "affiliation_checked": true }, "revision_history": [] }, "2605.15134": { "id": "2605.15134", "abstract_sha256": "da988f5d3e6d90fdfb91f482d7c619495673f1635d454b0da160b84cf267c513", "abstract_read": true, "classification": "relevant", "reason_zh": "研究代理部署规模下罕见安全失败的预测，并包含语言模型密码游戏。", "summary_zh": "论文分析极端失败分数外推估计器：通常偏向保守高估，但遗漏罕见高失败模式时会低估部署风险。作者提出 forecastability loss，在语言模型密码游戏及 RL 网格世界的概念验证中降低留出预测误差，同时保留主任务能力并达到类似监督基线的安全水平。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "研究代理部署规模下罕见安全失败的预测，并包含语言模型密码游戏。" }, "reason": "研究代理部署规模下罕见安全失败的预测，并包含语言模型密码游戏。", "version_id": "2605.15134v3", "title": "Training Agents to Fail Predictably: Fine-Tuning for Forecastable Tail Risk", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-05-14T17:41:52Z", "updated": "2026-11-02T18:35:00Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 302 of 302 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.15134v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.15134", "title": "Training Agents to Fail Predictably: Fine-Tuning for Forecastable Tail Risk", "version_id": "2605.15134v3", "first_author": "Will Schwarzer", "authors": [ "Will Schwarzer", "Scott Niekum" ], "affiliations": [ "University of Massachusetts Amherst" ], "source_url": "https://arxiv.org/pdf/2605.15134v3", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v3边栏匹配；Will Schwarzer上标1对应UMass Amherst，星号为通讯邮箱而非共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2606.11435": { "id": "2606.11435", "version_id": "2606.11435v2", "abstract_sha256": "36a9153ba9b18799fe595fa1c9ed4a1d6890adfd3d9dee3726f8743b200b7443", "abstract_read": true, "classification": "relevant", "reason_zh": "综述代理技能的质量、安全评估与可验证安全技能生态。", "summary_zh": "该综述归纳四类技能演化及六类评测，其中安全审计覆盖技能执行的权限边界、敏感数据保护和SKILL-INJECT等投毒测试。正文讨论恶意指令经技能或工具反馈进入代理、演化过程吸收恶意轨迹及安全约束退化，建议来源记录、细粒度权限和持续审计；属综述与研究方向，不是新防御实验。", "topics": { "tags": [ "supplychain", "injection", "authorization", "evaluation" ], "reason_zh": "必要正文4节设独立技能安全审计类别，覆盖permission boundary、敏感数据、SKILL-INJECT；5节具体讨论指令投毒、工具输出注入、自演化安全约束丢失与来源/权限防护，直接关联明确。" }, "reason": "必要正文4节设独立技能安全审计类别，覆盖permission boundary、敏感数据、SKILL-INJECT；5节具体讨论指令投毒、工具输出注入、自演化安全约束丢失与来源/权限防护，直接关联明确。", "title": "Agent Skill Evaluation and Evolution: Frameworks and Benchmarks", "initial_classification": "relevant", "scope_review": { "id": "2606.11435", "version_id": "2606.11435v2", "classification": "relevant", "reason": "必要正文4节设独立技能安全审计类别，覆盖permission boundary、敏感数据、SKILL-INJECT；5节具体讨论指令投毒、工具输出注入、自演化安全约束丢失与来源/权限防护，直接关联明确。", "summary_zh": "该综述归纳四类技能演化及六类评测，其中安全审计覆盖技能执行的权限边界、敏感数据保护和SKILL-INJECT等投毒测试。正文讨论恶意指令经技能或工具反馈进入代理、演化过程吸收恶意轨迹及安全约束退化，建议来源记录、细粒度权限和持续审计；属综述与研究方向，不是新防御实验。", "topics": { "tags": [ "supplychain", "injection", "authorization", "evaluation" ], "reason_zh": "必要正文4节设独立技能安全审计类别，覆盖permission boundary、敏感数据、SKILL-INJECT；5节具体讨论指令投毒、工具输出注入、自演化安全约束丢失与来源/权限防护，直接关联明确。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2606.11435v2", "reviewed_sections": [ "Abstract", "1 Introduction", "4 Skill-centric Benchmarks / Skill Safety Auditing", "5 Future Directions / Skill Security" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "4 Skill-centric Benchmarks / Skill Safety Auditing", "5 Future Directions / Skill Security" ], "body_source_url": "https://arxiv.org/pdf/2606.11435v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-06-09T20:43:23Z", "updated": "2026-11-02T18:56:20Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2606.11435v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2606.11435", "title": "Agent Skill Evaluation and Evolution: Frameworks and Benchmarks", "version_id": "2606.11435v2", "first_author": "Kexin Ding", "authors": [ "Kexin Ding", "Yang Zhou", "Can Jin", "Feng Tong", "Mu Zhou", "Dimitris N. Metaxas" ], "affiliations": [ "Rutgers, the State University of New Jersey", "Center for Computational Biomedicine, Imaging and Modeling (CBIM)", "Rutgers Artificial Intelligence and Data Science (RAD) Collaboratory" ], "source_url": "https://arxiv.org/pdf/2606.11435v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2边栏匹配；Kexin Ding上标1,2,3分别映射三个明示单位；不含第四单位UNC Charlotte。", "affiliation_checked": true }, "revision_history": [] }, "2608.19741": { "id": "2608.19741", "abstract_sha256": "9be853db1a1fd89f27355e05af681f9ec132ab811e9fd3dfbc3ed9c36d11ca22", "abstract_read": true, "classification": "relevant", "reason_zh": "明确评测工具代理遵守领域政策及避免额外持久副作用。", "summary_zh": "Thinkingbox 提供隔离的 MCP 兼容会话、完整执行轨迹和终态后端检查，基准含 507 个政策条件业务流程，拒绝错误、遗漏或额外效果。Claude Opus 5 从 66.50% pass@1 降至 47.53% pass^20，Kimi-K3 从 57.37% 降至 17.60%；许多失败发生在有效状态变更后正常结束。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "明确评测工具代理遵守领域政策及避免额外持久副作用。" }, "reason": "明确评测工具代理遵守领域政策及避免额外持久副作用。", "version_id": "2608.19741v5", "title": "One Success Isn't Reliability: Thinkingbox, a Sandbox and Benchmark for Agents in Stateful Business Workflows", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-20T07:37:57Z", "updated": "2026-10-31T00:08:26Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL", "cs.DB" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 130 of 130 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.19741v5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.19741", "title": "One Success Isn't Reliability: Thinkingbox, a Sandbox and Benchmark for Agents in Stateful Business Workflows", "version_id": "2608.19741v5", "first_author": "Zhuochun Li", "authors": [ "Zhuochun Li", "Youngmin Ko", "Ali Keramati", "Tuhin Kundu", "Liang-Chun Tsai", "Nicola Ferri", "Mirco Milletari", "Jiaxiang Liu", "Susana Palmaz Lopez Pelaez", "Yuepeng Wang", "Vadim Smolyakov", "Xiang Jiang", "Kjartan Olafsson", "Tommy Guy" ], "affiliations": [ "University of Pittsburgh" ], "source_url": "https://arxiv.org/pdf/2608.19741v5", "shared_first_authors": [ "Zhuochun Li", "Youngmin Ko", "Ali Keramati" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v5边栏匹配；Zhuochun Li上标1对应Pittsburgh；前三作者匕首为Equal contribution；星号仅表示Microsoft实习完成工作，不据此追加署名单位。", "affiliation_checked": true }, "revision_history": [] }, "2610.22061": { "id": "2610.22061", "abstract_sha256": "e2159533e36640c16c77f973ca6fa7e4ffa657580671c548f84d7404af8f70f7", "abstract_read": true, "classification": "relevant", "reason_zh": "以资源作用域、护栏继承和运行时执行保障代理技能的权限与隔离。", "summary_zh": "FAOP 将多步代理流程表示为作用域状态上的类型化函数，通过分解、类型化、共享流程归一及资源作用域四级规范化，将完整性、隔离和停止预算纳入编译期检查。作者给出可靠重写代数，并实现 SkillBase 与独立执行器，以金融流程示例说明；未报告大规模安全测量。", "topics": { "tags": [ "authorization", "supplychain" ], "reason_zh": "以资源作用域、护栏继承和运行时执行保障代理技能的权限与隔离。" }, "reason": "以资源作用域、护栏继承和运行时执行保障代理技能的权限与隔离。", "version_id": "2610.22061v2", "title": "FAOPs: Normal Forms and an Algebra for AI Agent Workflows", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-15T15:24:46Z", "updated": "2026-11-01T15:37:44Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.DB", "cs.PL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.22061v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.22061", "title": "FAOPs: Normal Forms and an Algebra for AI Agent Workflows", "version_id": "2610.22061v2", "first_author": "Ali Mohammadi Shanghooshabad", "authors": [ "Ali Mohammadi Shanghooshabad" ], "affiliations": [ "JPMorgan Chase & Co." ], "source_url": "https://arxiv.org/pdf/2610.22061v2", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2匹配；唯一作者姓名下方明确列单位。", "affiliation_checked": true }, "revision_history": [] }, "2611.00515": { "id": "2611.00515", "abstract_sha256": "1e30355c7fef21075612554fa98d3c22ca4d508be05f6d74cad19ea3a3a75dad", "abstract_read": true, "classification": "relevant", "reason_zh": "对金融代理真实动作、证据与账户状态进行安全相关过程审计。", "summary_zh": "AStockArena 在共同市场及执行限制下评估 13 个模型的 3,198 次连续决策，对报告、请求、执行响应及账户状态进行重建，以八项检查审计可追溯性、证据充分性和金融状态意识。1,070 个交易时点中 72.99% 至少有一处审计缺口，模型缺口率为 52.2%–91.2%，证据缺口最常见。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "对金融代理真实动作、证据与账户状态进行安全相关过程审计。" }, "reason": "对金融代理真实动作、证据与账户状态进行安全相关过程审计。", "version_id": "2611.00515v1", "title": "AStockArena: Beyond Returns, Can We Entrust Real Capital to the Decisions of Financial Agents?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T01:08:02Z", "updated": "2026-10-31T01:08:02Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00515v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00515", "title": "AStockArena: Beyond Returns, Can We Entrust Real Capital to the Decisions of Financial Agents?", "version_id": "2611.00515v1", "first_author": "Zeyu Liu", "authors": [ "Zeyu Liu", "Sing Kwong Lai", "Xuanzhi Feng", "HaoYang Shang", "Yang Li", "Zihao Fang", "Xuan Liu" ], "affiliations": [ "The Hong Kong University of Science and Technology" ], "source_url": "https://arxiv.org/pdf/2611.00515v1", "shared_first_authors": [ "Zeyu Liu", "Sing Kwong Lai", "Xuanzhi Feng", "HaoYang Shang" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Zeyu LIU上标1；星号明示四人共同贡献，姓名规范依API。", "affiliation_checked": true }, "revision_history": [] }, "2611.00602": { "id": "2611.00602", "version_id": "2611.00602v1", "abstract_sha256": "1d0efed9989c75a8eeb039e9b51c079244bb18ab3df0102a288317c09df1dc1c", "abstract_read": true, "classification": "relevant", "reason_zh": "在指令文字不变时修改内部特征即可重定向机器人目标，直接暴露动作控制脆弱性。", "summary_zh": "作者将单个目标词的 SAE 特征换成另一个目标词的特征，在仿真中使 π0.5-LIBERO 执行另一任务。某场景第零层达到 20/20 次重定向，随机特征替换无成功；结果依赖 SAE 架构、场景及层位，固定均值差向量也能达到 8–10/10，说明不必使用 SAE。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "在指令文字不变时修改内部特征即可重定向机器人目标，直接暴露动作控制脆弱性。" }, "reason": "在指令文字不变时修改内部特征即可重定向机器人目标，直接暴露动作控制脆弱性。", "title": "Editing the Goal: Per-Token SAE Steering and Its Depth Limits in $π_{0.5}$", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T03:56:08Z", "updated": "2026-10-31T03:56:08Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00602v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00602", "title": "Editing the Goal: Per-Token SAE Steering and Its Depth Limits in $π_{0.5}$", "version_id": "2611.00602v1", "first_author": "Rocio Perales Valdes", "authors": [ "Rocio Perales Valdes", "Animesh Garg" ], "affiliations": [ "PAIR Lab, AI Safety Initiative, Georgia Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2611.00602v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Rocio Perales Valdes作者栏明确列PAIR Lab, AI Safety Initiative及Georgia Tech。", "affiliation_checked": true }, "revision_history": [] }, "2611.00923": { "id": "2611.00923", "abstract_sha256": "0b100b001d10ad5f778892b7b25aa3b1bc8fdc39c804f936ae12654622e54d98", "abstract_read": true, "classification": "relevant", "reason_zh": "直接防御多代理通信拓扑的黑盒推断泄露。", "summary_zh": "Illusion 通过插入低影响虚假边和消息，混淆 LLM 多代理系统通信拓扑，同时约束输出分布等价及任务准确率非劣。实验将攻击边级 F1 从超过 0.87 降至 0.62、图相似度从超过 0.94 降至 0.71，基本保留任务表现，并抵抗相似性及 LLM 过滤和自适应剪枝。", "topics": { "tags": [ "multiagent", "privacy" ], "reason_zh": "直接防御多代理通信拓扑的黑盒推断泄露。" }, "reason": "直接防御多代理通信拓扑的黑盒推断泄露。", "version_id": "2611.00923v1", "title": "Illusion: Safeguarding Topology Confidentiality in LLM Multi-Agent Systems via Behavior-Preserving Obfuscation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-31T13:23:42Z", "updated": "2026-10-31T13:23:42Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.00923v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.00923", "title": "Illusion: Safeguarding Topology Confidentiality in LLM Multi-Agent Systems via Behavior-Preserving Obfuscation", "version_id": "2611.00923v1", "first_author": "Yiu-Fai Cheung", "authors": [ "Yiu-Fai Cheung", "Hongzhi Guo", "Miao Pan", "Irwin King", "Hao Wang" ], "affiliations": [ "The Chinese University of Hong Kong" ], "source_url": "https://arxiv.org/pdf/2611.00923v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Yiu-Fai Cheung上标1对应香港中文大学。", "affiliation_checked": true }, "revision_history": [] }, "2611.01386": { "id": "2611.01386", "version_id": "2611.01386v1", "abstract_sha256": "d2e004efc463223fc4516e5dd76e91386e343bba35088595d76ea58795bb91d8", "abstract_read": true, "classification": "relevant", "reason_zh": "生产 Agent 从轨迹编译技能，明确实施验证来源、版本准入扫描和分发控制。", "summary_zh": "Zep Agent Skills 将有顺序事件、结果和验证强度的 Trace 通过 Reflector/Curator 编为带字段证据的版本化技能，扫描与准入门控决定激活，验证后的使用结果影响排名，经 API 或 MCP 检索。教师轨迹技能在三个基准为三个较弱执行模型带来 4.5–18.8 个百分点通过率增益，主要来自教师已解任务；摘要没有单独攻击阻止率。", "topics": { "tags": [ "supplychain", "memory", "authorization", "monitoring" ], "reason_zh": "生产 Agent 从轨迹编译技能，明确实施验证来源、版本准入扫描和分发控制。" }, "reason": "生产 Agent 从轨迹编译技能，明确实施验证来源、版本准入扫描和分发控制。", "title": "Learning by Doing: Autonomously Compiling and Curating Agent Skills from Verified Traces", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T00:47:54Z", "updated": "2026-11-01T00:47:54Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01386v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01386", "title": "Learning by Doing: Autonomously Compiling and Curating Agent Skills from Verified Traces", "version_id": "2611.01386v1", "first_author": "Daniel Chalef", "authors": [ "Daniel Chalef", "Peter Evans", "Pavlo Paliychuk", "Mehul Patel", "Preston Rasmussen", "Jack Ryan" ], "affiliations": [ "Zep AI" ], "source_url": "https://arxiv.org/pdf/2611.01386v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Daniel Chalef首位，作者共享Zep AI。", "affiliation_checked": true }, "revision_history": [] }, "2611.01700": { "id": "2611.01700", "version_id": "2611.01700v1", "abstract_sha256": "8352c8dbe3d048591a0f6004dbd5d81ed0911fc41fbe2ed2a5d6d545dfebd0a2", "abstract_read": true, "classification": "relevant", "reason_zh": "直接评测跨会话持久记忆提示注入及受害者下游损害。", "summary_zh": "MemHarmBench 先让代理接触恶意消息、文档或网页并测试记忆保留，再删除原始载荷，在保留记忆的新会话执行合法任务。基准区分用户、项目所有者及外部利益方，并联合衡量攻击服从、任务完成和执行异常；作者发现攻击可在任务正常完成且无可检出异常时仍操纵关键决策。", "topics": { "tags": [ "injection", "memory", "evaluation" ], "reason_zh": "直接评测跨会话持久记忆提示注入及受害者下游损害。" }, "reason": "直接评测跨会话持久记忆提示注入及受害者下游损害。", "title": "MemHarmBench: Evaluating Cross-Session Prompt Injection in Memory-Persistent AI Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T08:36:16Z", "updated": "2026-11-01T08:36:16Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01700v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01700", "title": "MemHarmBench: Evaluating Cross-Session Prompt Injection in Memory-Persistent AI Agents", "version_id": "2611.01700v1", "first_author": "Zhihua Wang", "authors": [ "Zhihua Wang", "Yunhao Feng", "Yifeng Gao", "Rui Pan", "Baiheng Zhao", "Zixing Chen", "Xingjun Ma" ], "affiliations": [ "Fudan University", "University of Shanghai for Science and Technology" ], "source_url": "https://arxiv.org/pdf/2611.01700v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Zhihua Wang上标1,2；星号说明复旦实习而非共同一作。", "affiliation_checked": true }, "revision_history": [] }, "2611.01713": { "id": "2611.01713", "abstract_sha256": "56529918780b156456d539e9682d1d7719761aede0a4017261a1a9db020bb26b", "abstract_read": true, "classification": "relevant", "reason_zh": "针对 VLA 的障碍碰撞风险提供硬安全约束与动作修复。", "summary_zh": "Route-Guided CBF-QP Repair 根据 VLA 短时动作块检测受阻轨迹，生成绕障进入、离开及回归路线，将路线作为软目标、CBF 安全约束保留为硬约束。作者称在 SafeLIBERO 上相较 AEGIS 改善避碰、任务成功和 SafeSuccess，摘要未列数值。", "topics": { "tags": [ "embodied", "robustness" ], "reason_zh": "针对 VLA 的障碍碰撞风险提供硬安全约束与动作修复。" }, "reason": "针对 VLA 的障碍碰撞风险提供硬安全约束与动作修复。", "version_id": "2611.01713v1", "title": "Route-Guided CBF-QP Repair for Safe Vision-Language-Action Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T09:02:42Z", "updated": "2026-11-01T09:02:42Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01713v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01713", "title": "Route-Guided CBF-QP Repair for Safe Vision-Language-Action Models", "version_id": "2611.01713v1", "first_author": "Chan Park", "authors": [ "Chan Park", "Sunwoo Hong", "Kirak Kim", "Yoonjeong Park", "Alexander W. Olson", "Ali Pesaranghader" ], "affiliations": [ "Sungkyunkwan University", "University of Toronto" ], "source_url": "https://arxiv.org/pdf/2611.01713v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Chan Park上标1,3明确对应成均馆及多伦多大学。", "affiliation_checked": true }, "revision_history": [] }, "2611.01966": { "id": "2611.01966", "abstract_sha256": "ffef28fd1244804c402d08443be09ede51d830cff4361e1dbb1b3c567c8bf9d2", "abstract_read": true, "classification": "relevant", "reason_zh": "研究编码代理用于仓库级代码洗白后的软件来源与许可证审计风险。", "summary_zh": "Launder-Bench 从 282 个真实仓库构建源隐藏、保持执行行为的代理重写流程，包含 1,128 个成对溯源实例和 229 个归属实例，并用独立同域实现校准相似性。最强静态检测成对 AUROC 仅 0.66；仓库编码器最多 22% 正确首位来源排序，但校准归属得分仅 1%–2%。", "topics": { "tags": [ "supplychain", "evaluation" ], "reason_zh": "研究编码代理用于仓库级代码洗白后的软件来源与许可证审计风险。" }, "reason": "研究编码代理用于仓库级代码洗白后的软件来源与许可证审计风险。", "version_id": "2611.01966v1", "title": "Launder-Bench: Can Repository-Level Agentic Code Laundering Be Detected?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-01T15:05:07Z", "updated": "2026-11-01T15:05:07Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.01966v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01966", "title": "Launder-Bench: Can Repository-Level Agentic Code Laundering Be Detected?", "version_id": "2611.01966v1", "first_author": "Yuntong Hu", "authors": [ "Yuntong Hu", "Hongji Pu", "Zimo Li", "Ruomeng Li", "Xiaotong Liu", "Ziyuan Qin", "Qiyue Li", "Liang Zhao" ], "affiliations": [ "Emory University" ], "source_url": "https://arxiv.org/pdf/2611.01966v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Yuntong Hu上标1对应Emory University。", "affiliation_checked": true }, "revision_history": [] }, "2611.01976": { "id": "2611.01976", "abstract_sha256": "ea0c2e23b4cc3fd58b3ce603007ed7706a0937e9039dfcd9f2129bd66d8ba2e7", "abstract_read": true, "classification": "relevant", "reason_zh": "直接揭示工具更新发生在模型上下文之外而绕过既有信任和提示防御。", "summary_zh": "问题：已准入工具更新实现后仍继承信任，正常调用可附带未授权副作用。方法：攻击者控制一个工具的发布通道，先准入良性v1，再在保持接口和合法功能的v2中加入代码，独立验证副作用与任务完成。正文RQ1在7框架×3工作负载的2100个计划任务中报告100%目标副作用成功及99.6%终答完成；摘要的97.6%/95.9%不能混作这一组比率。必要时实验harness提供单次调用批准，统一准入扫描也是实验控制，并非框架默认功能。工具由研究者编写，仅用本地合成资源、现有权限；不证明绕过OS隔离，也不测野外入侵。已核读§3–6，未复现实验。", "topics": { "tags": [ "supplychain", "authorization", "evaluation" ], "reason_zh": "直接揭示工具更新发生在模型上下文之外而绕过既有信任和提示防御。" }, "reason": "直接执行型工具更新供应链风险：既有工具身份和调用授权未绑定具体实现，恶意副作用发生在模型上下文之外，不等于提示注入。", "version_id": "2611.01976v1", "title": "Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2611.01976v1", "source_url": "https://arxiv.org/abs/2611.01976v1", "reviewed_sections": [ "3 Threat Model", "4 Approach", "5.1 Experimental Setup and update adoption", "5.2 RQ1 and scoring aggregation", "6 Discussion and Limitations" ], "evidence_level": "abstract_and_targeted_body", "published": "2026-11-01T15:14:02Z", "updated": "2026-11-01T15:14:02Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.01976", "title": "Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security", "version_id": "2611.01976v1", "first_author": "Shiyu Kan", "authors": [ "Shiyu Kan", "Yue Qi", "Yufei Han", "Xinjian Luo", "Guojun Xiong", "Xiaofeng Gao" ], "affiliations": [ "Shanghai Jiao Tong University" ], "source_url": "https://arxiv.org/pdf/2611.01976v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Shiyu Kan作者栏明确上海交通大学。", "affiliation_checked": true }, "revision_history": [] }, "2611.02028": { "id": "2611.02028", "abstract_sha256": "b39d84eee5f9d4dabda808b1a73a50bbb915df273a115b726e89ab00c74767a8", "abstract_read": true, "classification": "relevant", "reason_zh": "形式验证代理生成代码的功能与内存行为，具有安全完整性意义，但主要是正确性证明。", "summary_zh": "LARK固定经人审的GPU机器语义和任务接口，由代理分解内核并构造Lean证明，验证器拒绝无法证明的内核，避免把代理自写假设当可信基础。作者称GLM验证10/12个Level-1内核、Opus验证5/5个Level-2内核，并在10个人写内核中发现1个竞态。证明基于精确算术等假设，正文明确不保证宿主内存分配的越界安全。", "topics": { "tags": [ "evaluation", "authorization", "robustness" ], "reason_zh": "正文明确把LLM生成的内核、分段及证明全部视为不可信，固定人审语义/任务接口，要求逐内核证明竞态自由与终止并拒绝失败证书，形成coding-agent输出的可机械检查准入边界。范围有限：不保证宿主分配越界安全，不能当作通用内存安全防御。" }, "reason": "正文明确把LLM生成的内核、分段及证明全部视为不可信，固定人审语义/任务接口，要求逐内核证明竞态自由与终止并拒绝失败证书，形成coding-agent输出的可机械检查准入边界。范围有限：不保证宿主分配越界安全，不能当作通用内存安全防御。", "version_id": "2611.02028v1", "title": "LARK: Lean-Assisted Reasoning for LLM-Generated GPU Kernels", "initial_classification": "uncertain", "scope_review": { "id": "2611.02028", "version_id": "2611.02028v1", "classification": "relevant", "reason": "正文明确把LLM生成的内核、分段及证明全部视为不可信，固定人审语义/任务接口，要求逐内核证明竞态自由与终止并拒绝失败证书，形成coding-agent输出的可机械检查准入边界。范围有限：不保证宿主分配越界安全，不能当作通用内存安全防御。", "summary_zh": "LARK固定经人审的GPU机器语义和任务接口，由代理分解内核并构造Lean证明，验证器拒绝无法证明的内核，避免把代理自写假设当可信基础。作者称GLM验证10/12个Level-1内核、Opus验证5/5个Level-2内核，并在10个人写内核中发现1个竞态。证明基于精确算术等假设，正文明确不保证宿主内存分配的越界安全。", "topics": { "tags": [ "evaluation", "authorization", "robustness" ], "reason_zh": "正文明确把LLM生成的内核、分段及证明全部视为不可信，固定人审语义/任务接口，要求逐内核证明竞态自由与终止并拒绝失败证书，形成coding-agent输出的可机械检查准入边界。范围有限：不保证宿主分配越界安全，不能当作通用内存安全防御。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.02028v1", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Problem definition and trust boundary", "4.1 Model and 4.2 proof construction" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Problem definition and trust boundary", "4.1 Model and 4.2 proof construction" ], "body_source_url": "https://arxiv.org/pdf/2611.02028v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-01T16:18:56Z", "updated": "2026-11-01T16:18:56Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02028v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02028", "title": "LARK: Lean-Assisted Reasoning for LLM-Generated GPU Kernels", "version_id": "2611.02028v1", "first_author": "Zixi Zhang", "authors": [ "Zixi Zhang", "Jiayi Nie", "Haoran Wu", "Yujie Yan", "Yann Herklotz", "Rika Antonova", "Robert Mullins", "Yiren Zhao", "George A. Constantinides", "Jianyi Cheng" ], "affiliations": [ "Department of Electrical and Electronic Engineering, Imperial College London" ], "source_url": "https://arxiv.org/pdf/2611.02028v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Zixi Zhang上标1对应帝国理工电子电气工程系。", "affiliation_checked": true }, "revision_history": [] }, "2611.02285": { "id": "2611.02285", "abstract_sha256": "0ee99c2e70921cc2e10db7eaf0921fa5159f9902cbf2b5edbe82d8199cabe7cb", "abstract_read": true, "classification": "relevant", "reason_zh": "以规范、机械证明和跨团队语义冲突检查约束代理代码，但主要是架构提案。", "summary_zh": "该架构以人审规范为源，代理产生实现与证明，再由小型可信核和CI准入；门控检查未验证公理/证明逃逸、规范空洞性、变异检出和回归。还提出验证IR、权限/资源类型及跨团队规范冲突协调。作者区分已有工具基线与新提出组件；不应把架构设想和示例流程读成已完成的大规模安全实证。", "topics": { "tags": [ "authorization", "evaluation", "supplychain" ], "reason_zh": "正文把合成/证明代理完全置于不可信侧，CI强制拒绝sorry/admit/unsafe/assume等逃逸并做可满足性、变异与回归门控；人审规范而非任凭代理自证，构成明确的coding-agent验证治理架构，非仅性能优化。" }, "reason": "正文把合成/证明代理完全置于不可信侧，CI强制拒绝sorry/admit/unsafe/assume等逃逸并做可满足性、变异与回归门控；人审规范而非任凭代理自证，构成明确的coding-agent验证治理架构，非仅性能优化。", "version_id": "2611.02285v1", "title": "Modern Software Engineering with Verification Agents: A Spec-First Architecture for Autonomous Synthesis, Verification IRs, and Organizational Scale", "initial_classification": "uncertain", "scope_review": { "id": "2611.02285", "version_id": "2611.02285v1", "classification": "relevant", "reason": "正文把合成/证明代理完全置于不可信侧，CI强制拒绝sorry/admit/unsafe/assume等逃逸并做可满足性、变异与回归门控；人审规范而非任凭代理自证，构成明确的coding-agent验证治理架构，非仅性能优化。", "summary_zh": "该架构以人审规范为源，代理产生实现与证明，再由小型可信核和CI准入；门控检查未验证公理/证明逃逸、规范空洞性、变异检出和回归。还提出验证IR、权限/资源类型及跨团队规范冲突协调。作者区分已有工具基线与新提出组件；不应把架构设想和示例流程读成已完成的大规模安全实证。", "topics": { "tags": [ "authorization", "evaluation", "supplychain" ], "reason_zh": "正文把合成/证明代理完全置于不可信侧，CI强制拒绝sorry/admit/unsafe/assume等逃逸并做可满足性、变异与回归门控；人审规范而非任凭代理自证，构成明确的coding-agent验证治理架构，非仅性能优化。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.02285v1", "reviewed_sections": [ "Abstract", "1.2 Goals and Non-Goals", "2.1 Spec-first workflow / CI gates", "Trusted core and VIR design" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1.2 Goals and Non-Goals", "2.1 Spec-first workflow / CI gates", "Trusted core and VIR design" ], "body_source_url": "https://arxiv.org/pdf/2611.02285v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-01T23:29:34Z", "updated": "2026-11-01T23:29:34Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.LO", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 49 of 49 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02285v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02285", "title": "Modern Software Engineering with Verification Agents: A Spec-First Architecture for Autonomous Synthesis, Verification IRs, and Organizational Scale", "version_id": "2611.02285v1", "first_author": "Jason Hickey", "authors": [ "Jason Hickey" ], "affiliations": [ "Independent Research" ], "source_url": "https://arxiv.org/pdf/2611.02285v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Jason Hickey明确署名Affiliation: Independent Research。", "affiliation_checked": true }, "revision_history": [] }, "2611.02332": { "id": "2611.02332", "abstract_sha256": "5d3a722d2db1064e8615b0a7b9e058ee5fa4fb2e0f630adf38d27651b478f7f7", "abstract_read": true, "classification": "relevant", "reason_zh": "运行时对每个工具调用作经过证明的政策检查并直接评测提示注入防御。", "summary_zh": "LeanGuard 以 Lean4 政策、状态谓词和历史时序算子检查调用，失败默认拒绝，支持规则反馈与保留用户意图的证明引导修复。Tau-Bench 中五种 Qwen 模型无防护至少执行 33 次禁用调用，防护后为零；DTap 注入成功率从 57.9% 降到 5.9%，88/252 个参数值拒绝可被证明式修复。", "topics": { "tags": [ "authorization", "injection", "monitoring" ], "reason_zh": "运行时对每个工具调用作经过证明的政策检查并直接评测提示注入防御。" }, "reason": "运行时对每个工具调用作经过证明的政策检查并直接评测提示注入防御。", "version_id": "2611.02332v1", "title": "LEANGUARD: Lean-Verified Guardrails for Tool-Using Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T00:26:48Z", "updated": "2026-11-02T00:26:48Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 100 of 100 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02332v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02332", "title": "LEANGUARD: Lean-Verified Guardrails for Tool-Using Agents", "version_id": "2611.02332v1", "first_author": "Sreehari Sankar", "authors": [ "Sreehari Sankar", "Debargha Ganguly", "Vikash Singh", "Mohsen Hariri", "Weicong Chen", "Yanyan Zhang", "Shouren Wang", "Wang Yang", "Chaoda Song", "Alexander Nemecek", "Osama Zafar", "Idan Davidovich", "Yuting Shao", "Kai Ye", "Biyao Zhang", "Xinpeng Li", "Joe Stubbs", "Erman Ayday", "Jing Ma", "Vipin Chaudhary" ], "affiliations": [ "Case Western Reserve University" ], "source_url": "https://arxiv.org/pdf/2611.02332v1", "shared_first_authors": [ "Sreehari Sankar", "Debargha Ganguly", "Vikash Singh" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Sreehari Sankar上标1；星号三人Equal Contribution。", "affiliation_checked": true }, "revision_history": [] }, "2611.02501": { "id": "2611.02501", "abstract_sha256": "5aa8d9b5c46cc96562591ead34dda08746acde1408567fb11bd7f91f7f1d3d84", "abstract_read": true, "classification": "relevant", "reason_zh": "自主优化代理使用逐 token 校验检测奖励投机，但主贡献为推测解码优化而非安全研究。", "summary_zh": "SpecPilot让并行编码Agent优化推测解码，独立控制脚本仅接受通过正确性和显著加速门槛的补丁。Token forcing逐token对照原系统，以错配率及大间隔事件双规则检测普通任务准确率漏掉的有损修改；封存终测失败则拒绝。作者报告无需训练或质量损失，单请求相对自回归加速从4.46倍升至10.87倍、批量从1.94倍升至3.93倍；这些是系统性能，不是攻击阻止率。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "不可修改评估控制器和封存验证针对编码Agent奖励作弊。" }, "reason": "正文§3.2–3.3明确隔离可修改代码的Agent与不可修改的控制脚本，以封存未见请求和逐token校验阻止以改变输出换速度的奖励作弊，并测试人为故障；超出一般正确性口号，构成编码Agent执行与评估边界。", "version_id": "2611.02501v1", "title": "SpecPilot: Autonomous Algorithm Discovery and Systems Optimization for Speculative Decoding", "initial_classification": "uncertain", "scope_review": { "id": "2611.02501", "version_id": "2611.02501v1", "classification": "relevant", "reason": "正文§3.2–3.3明确隔离可修改代码的Agent与不可修改的控制脚本，以封存未见请求和逐token校验阻止以改变输出换速度的奖励作弊，并测试人为故障；超出一般正确性口号，构成编码Agent执行与评估边界。", "summary_zh": "SpecPilot让并行编码Agent优化推测解码，独立控制脚本仅接受通过正确性和显著加速门槛的补丁。Token forcing逐token对照原系统，以错配率及大间隔事件双规则检测普通任务准确率漏掉的有损修改；封存终测失败则拒绝。作者报告无需训练或质量损失，单请求相对自回归加速从4.46倍升至10.87倍、批量从1.94倍升至3.93倍；这些是系统性能，不是攻击阻止率。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "不可修改评估控制器和封存验证针对编码Agent奖励作弊。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.02501v1", "reviewed_sections": [ "完整摘要", "1 Introduction", "2.1 Speculative Decoding", "3.2 Agents and Phases", "3.3 Token Forcing", "3.4 Structured Memory", "Figure 4" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "1 Introduction", "2.1 Speculative Decoding", "3.2 Agents and Phases", "3.3 Token Forcing", "3.4 Structured Memory", "Figure 4" ], "body_source_url": "https://arxiv.org/pdf/2611.02501v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T04:21:47Z", "updated": "2026-11-02T04:21:47Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 334 of 334 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02501v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02501", "title": "SpecPilot: Autonomous Algorithm Discovery and Systems Optimization for Speculative Decoding", "version_id": "2611.02501v1", "first_author": "Kunjun Li", "authors": [ "Kunjun Li", "Wenhao Chai", "Yihao Liang", "Yuezhou Hu", "Shuyao Xu", "Yi Pan", "William X. Zheng", "Kannan Ramchandran", "Kurt Keutzer", "Jiantao Jiao" ], "affiliations": [ "University of California, Berkeley" ], "source_url": "https://arxiv.org/pdf/2611.02501v1", "shared_first_authors": [ "Kunjun Li", "Wenhao Chai", "Yihao Liang" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Kunjun Li上标1；星号明示前三人共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2611.02516": { "id": "2611.02516", "abstract_sha256": "7b3604a34580a331335cd217fefb7629c7ae6dacb668fbf66af4986a1f83b8a5", "abstract_read": true, "classification": "relevant", "reason_zh": "直接提出可累积、自演化且独立审计的代理安全护栏工具。", "summary_zh": "EVOLVE 将安全知识外置为可执行护栏工具，通过终身交互持续继承、独立审计和迭代完善，以应对静态规则难覆盖的新风险。作者称在多种基准、基础模型及具身环境平均 F1 提高 22%，并在真实机器人和自主代理系统验证；摘要未给更细分数据。", "topics": { "tags": [ "monitoring", "supplychain", "embodied" ], "reason_zh": "直接提出可累积、自演化且独立审计的代理安全护栏工具。" }, "reason": "直接提出可累积、自演化且独立审计的代理安全护栏工具。", "version_id": "2611.02516v1", "title": "Cumulative and Audited Guardrail Tool Evolution for LLM Agent Safety", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T04:36:16Z", "updated": "2026-11-02T04:36:16Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02516v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02516", "title": "Cumulative and Audited Guardrail Tool Evolution for LLM Agent Safety", "version_id": "2611.02516v1", "first_author": "Xiao Yang", "authors": [ "Xiao Yang", "Aishan Liu", "Siyuan Liang", "Zonghao Ying", "Le Wang", "Jiakai Wang", "Xianglong Liu", "Dacheng Tao" ], "affiliations": [ "School of Computer Science and Engineering, Beihang University", "State Key Laboratory of Complex & Critical Software Environment, Beihang University" ], "source_url": "https://arxiv.org/pdf/2611.02516v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Xiao Yang上标1,3，对应北航计算机学院及复杂关键软件环境国家重点实验室。", "affiliation_checked": true }, "revision_history": [] }, "2611.02561": { "id": "2611.02561", "abstract_sha256": "4cc0e17964b8f16288a9a06b1a286783a199b43779a9bdb19650cc93acfb0e49", "abstract_read": true, "classification": "relevant", "reason_zh": "专为自主代理评估人类自主权、伤害避免、隐私及责任追溯。", "summary_zh": "EEFA 先综述十二个代理基准的伦理覆盖，再提出包含自主权保护、避免伤害、透明不欺骗、隐私合规、责任与可追溯性的操作化框架，并给出可复现验证协议和示例情景。其与监管要求作映射；跨系统实证应用仍被列为未来工作，不能视为已验证防御。", "topics": { "tags": [ "evaluation", "authorization", "privacy", "monitoring" ], "reason_zh": "专为自主代理评估人类自主权、伤害避免、隐私及责任追溯。" }, "reason": "专为自主代理评估人类自主权、伤害避免、隐私及责任追溯。", "version_id": "2611.02561v1", "title": "EEFA: A Framework for the Ethical Evaluation of AI Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T05:38:45Z", "updated": "2026-11-02T05:38:45Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02561v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02561", "title": "EEFA: A Framework for the Ethical Evaluation of AI Agents", "version_id": "2611.02561v1", "first_author": "Swathi Pallikala", "authors": [ "Swathi Pallikala", "Yashas Hariprasad" ], "affiliations": [ "California State University, East Bay" ], "source_url": "https://arxiv.org/pdf/2611.02561v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Swathi Pallikala共享CSU East Bay单位，脚注说明其为硕士候选人、研究独立完成且非学校资助课题，不把学校署名当资助声明。", "affiliation_checked": true }, "revision_history": [] }, "2611.02633": { "id": "2611.02633", "abstract_sha256": "a55546b116dd42365fe0584b98f9e5e5f111bf1687bb0b8b783c8bec0d7aa45a", "abstract_read": true, "classification": "relevant", "reason_zh": "团队基准明确涵盖拒绝危险捷径、同伴作弊残留和人际压力。", "summary_zh": "Collaborative Intelligence Benchmark 含八个团队维度、240 个可验证任务，仅在模型独立具备能力的任务上评分。十八种模型最优为 82.2/100；前沿模型通常拒绝危险捷径、报告不当行为，但最佳交易结果仅出现在 14% 冲突中，承接弱模型作弊任务时通过率从 97% 降至 81%。", "topics": { "tags": [ "multiagent", "evaluation", "robustness" ], "reason_zh": "团队基准明确涵盖拒绝危险捷径、同伴作弊残留和人际压力。" }, "reason": "团队基准明确涵盖拒绝危险捷径、同伴作弊残留和人际压力。", "version_id": "2611.02633v1", "title": "Measuring AI Agents as Teammates with Collaborative Intelligence", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T06:59:08Z", "updated": "2026-11-02T06:59:08Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02633v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02633", "title": "Measuring AI Agents as Teammates with Collaborative Intelligence", "version_id": "2611.02633v1", "first_author": "Sean Wu", "authors": [ "Sean Wu", "Aneesh Pappu", "Jiaru Zou", "Yubin Kim", "Yuncong Mao", "Hongjian Zhou", "Junchi Yu", "Jieneng Chen", "James Zou" ], "affiliations": [ "Stanford University" ], "source_url": "https://arxiv.org/pdf/2611.02633v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Sean Wu上标1对应Stanford。星号仅明示Core contributors，未声明共同一作或Equal contribution，不作共同一作；匕首通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.02835": { "id": "2611.02835", "abstract_sha256": "fd1dccb8dd45da20571743521078595c21fad04d0a72348d867823661e9c0e13", "abstract_read": true, "classification": "relevant", "reason_zh": "实时助手在危险场景的干预与保持沉默涉及安全，但摘要主要评测视听帮助而非行动权限。", "summary_zh": "Omni-Life研究实时多模态助手在日常环境何时应主动提醒、预警或保持沉默，以人群、场景和设备共同定义行为。基准包含400段合成及真实视频，290段需要协助并标注555个介入事件，110段要求全程沉默，涵盖危险状态与即时伤害预警。作者报告12种配置中需要协助的视频最高仅4.48%完全处理正确；任务提醒最多提升17.12个百分点召回，但每分钟参考静默区间增加约4.6次不必要回应。整体结果不是单独危险场景的攻击防御率。", "topics": { "tags": [ "embodied", "monitoring", "evaluation" ], "reason_zh": "持续感知助手的危险识别、及时预警与主动介入边界。" }, "reason": "正文§1、§3.2–3.3明确评测持续观察环境并自主决定介入时机的多模态助手，包含盲人避障、跌倒等即时伤害预警及安全关键事件优先规则，构成现实环境助手的安全介入评估。", "version_id": "2611.02835v1", "title": "Omni-Life: Benchmarking Omnimodal Real-Time AI Assistants in People's Daily Lives", "initial_classification": "uncertain", "scope_review": { "id": "2611.02835", "version_id": "2611.02835v1", "classification": "relevant", "reason": "正文§1、§3.2–3.3明确评测持续观察环境并自主决定介入时机的多模态助手，包含盲人避障、跌倒等即时伤害预警及安全关键事件优先规则，构成现实环境助手的安全介入评估。", "summary_zh": "Omni-Life研究实时多模态助手在日常环境何时应主动提醒、预警或保持沉默，以人群、场景和设备共同定义行为。基准包含400段合成及真实视频，290段需要协助并标注555个介入事件，110段要求全程沉默，涵盖危险状态与即时伤害预警。作者报告12种配置中需要协助的视频最高仅4.48%完全处理正确；任务提醒最多提升17.12个百分点召回，但每分钟参考静默区间增加约4.6次不必要回应。整体结果不是单独危险场景的攻击防御率。", "topics": { "tags": [ "embodied", "monitoring", "evaluation" ], "reason_zh": "持续感知助手的危险识别、及时预警与主动介入边界。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.02835v1", "reviewed_sections": [ "完整摘要", "1 Introduction", "3.1 Overview", "3.2 Systematic Scenario Construction", "3.2.1 Reference-Grounded Behavior Design", "3.3 Synthetic and Real-World Video Sourcing" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "1 Introduction", "3.1 Overview", "3.2 Systematic Scenario Construction", "3.2.1 Reference-Grounded Behavior Design", "3.3 Synthetic and Real-World Video Sourcing" ], "body_source_url": "https://arxiv.org/pdf/2611.02835v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T09:37:44Z", "updated": "2026-11-02T09:37:44Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.02835v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.02835", "title": "Omni-Life: Benchmarking Omnimodal Real-Time AI Assistants in People's Daily Lives", "version_id": "2611.02835v1", "first_author": "Mengze Hong", "authors": [ "Mengze Hong", "Ziwei Shang", "Di Liang", "Zijian Li", "Liang Zhu", "Hongyu Shan", "Robin Zhou", "Minlong Peng", "Zhiqiang Kou", "Jia Wang", "Di Jiang", "Chen Jason Zhang" ], "affiliations": [ "Hong Kong Polytechnic University", "Today AI" ], "source_url": "https://arxiv.org/pdf/2611.02835v1", "shared_first_authors": [ "Mengze Hong", "Ziwei Shang" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Mengze Hong上标1,2；星号共同贡献。", "affiliation_checked": true }, "revision_history": [] }, "2611.03066": { "id": "2611.03066", "version_id": "2611.03066v1", "abstract_sha256": "fca6e9303d665927cda961983060da9d7db842640b3db1f9d890b62cd7964f49", "abstract_read": true, "classification": "relevant", "reason_zh": "架构综述直接涉及 MCP、A2A、技能清单及跨组织信任和治理边界。", "summary_zh": "论文将 Internet of Agentics 组织为碎片化生态、可互操作代理及可信可治理自治三层，审视 MCP、A2A、技能式清单及发现、传输、信任机制，并连接网关、注册表和运行时控制。它提出把异构代理当作可治理服务参与者的架构视角，未报告实证安全提升。", "topics": { "tags": [ "authorization", "supplychain", "multiagent" ], "reason_zh": "架构综述直接涉及 MCP、A2A、技能清单及跨组织信任和治理边界。" }, "reason": "架构综述直接涉及 MCP、A2A、技能清单及跨组织信任和治理边界。", "title": "Towards a Trustworthy and Governable Internet of Agentics: An Architectural Perspective on Protocols, Systems, and Services", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T12:54:14Z", "updated": "2026-11-02T12:54:14Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.DC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 222 of 222 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03066v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03066", "title": "Towards a Trustworthy and Governable Internet of Agentics: An Architectural Perspective on Protocols, Systems, and Services", "version_id": "2611.03066v1", "first_author": "Haoyi Xiong", "authors": [ "Haoyi Xiong", "Yi Liu", "Jiang Bian", "Peng Diao", "Bin Zhu", "Tingting Hu", "Yi Wang", "Sumi Helal" ], "affiliations": [ "Microsoft Corporation" ], "source_url": "https://arxiv.org/pdf/2611.03066v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；脚注明确H. Xiong等七人在Microsoft Corporation，Bologna仅属于S. Helal。", "affiliation_checked": true }, "revision_history": [] }, "2611.03555": { "id": "2611.03555", "abstract_sha256": "86a2be74c422bf09fe379ab74089dac8bebc550f3772b8a7446f28dfc57915fd", "abstract_read": true, "classification": "relevant", "reason_zh": "直接测量 MCP 描述、模式和响应投毒后的工具执行及机密外泄。", "summary_zh": "mcpvenom以25类根因分类测试十二框架、十八模型和45场景，总矩阵9,720格。正文表3排除237个错误格及268个跳过格，在9,215个有效格中有2,113格易受攻击，作者报告ASR为22.9%。易受攻击格按证据分为仅工具调用1,371格、仅网络接触487格及已验证秘密外泄255格；最后一类占易受攻击格12.1%，不能把22.9%理解为实际秘密外泄率。模型ASR为0.4%–49.7%，代码审计未发现针对工具投毒的主动防御；这些结论限于所测框架、模型和配置，未独立复现实验。", "topics": { "tags": [ "injection", "supplychain", "privacy", "evaluation" ], "reason_zh": "直接测量 MCP 描述、模式和响应投毒后的工具执行及机密外泄。" }, "reason": "直接测量 MCP 描述、模式和响应投毒后的工具执行及机密外泄。", "version_id": "2611.03555v1", "title": "MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2611.03555v1", "source_url": "https://arxiv.org/abs/2611.03555v1", "reviewed_sections": [ "5.1–5.3 Experimental Setup", "Table 3 ASR denominator", "Table 6 Oracle confidence tiers", "6 Results validation and Error analysis" ], "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T18:17:08Z", "updated": "2026-11-02T18:17:08Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 65 of 65 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 299 of 299 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03555", "title": "MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study", "version_id": "2611.03555v1", "first_author": "Farooq Shaikh", "authors": [ "Farooq Shaikh", "Biagio Montaruli" ], "affiliations": [ "Dynatrace" ], "source_url": "https://arxiv.org/pdf/2611.03555v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Farooq Shaikh作者栏明确Dynatrace；星号为通讯作者。", "affiliation_checked": true }, "revision_history": [] }, "2611.03575": { "id": "2611.03575", "abstract_sha256": "44a307f0ded11b2f72e9f6d3d32104248a489be405a8f6ed706e818f7fb7c6d9", "abstract_read": true, "classification": "relevant", "reason_zh": "直接评测编码代理完成良性任务时删除无关数据、削弱权限等有害副作用。", "summary_zh": "问题：编码代理完成合法任务仍可能破坏无关文件或权限。方法：保留原正确性测试，迭代寻找细微任务改写及可执行危害测试，再以语义评分筛出150个任务；评测时只用隐藏程序测试，不用LLM裁判。四个未参与构建的前沿代理平均任务准确率95.1%、有害成功58.2%、无指定损害的安全成功37.0%，分母均为全部任务，非仅成功任务。该基准专门筛选易出危害的案例，不能当日常事故率；入选组25个人审样本仅84%被多数评为有效，不是150项全部获人工认证。已核读§2–4及表2/图3，未复现实验。", "topics": { "tags": [ "authorization", "evaluation", "robustness" ], "reason_zh": "直接评测编码代理完成良性任务时删除无关数据、削弱权限等有害副作用。" }, "reason": "将合法编码任务完成与未请求副作用联合验证，直接衡量任务成功掩盖危害的Agent安全失效。", "version_id": "2611.03575v1", "title": "VeriHarm-Bench: Measuring Harmful Success in LLM Coding Agents Verifiably", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2611.03575v1", "source_url": "https://arxiv.org/abs/2611.03575v1", "reviewed_sections": [ "2 Construction and joint tests", "3.1 150-candidate selection", "3.2 Human evaluation protocol", "4.2 Table 2 and metric denominators", "4.3 Human validity Figure 3" ], "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T18:27:55Z", "updated": "2026-11-02T18:27:55Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.CL", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-03", "section": "New submissions (showing 151 of 151 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-03", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-03", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-04", "first_seen_date": "2026-11-04", "seen_dates": [ "2026-11-04" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03575", "title": "VeriHarm-Bench: Measuring Harmful Success in LLM Coding Agents Verifiably", "version_id": "2611.03575v1", "first_author": "Wei-Lin Chen", "authors": [ "Wei-Lin Chen", "Zhepei Wei", "Xinyu Zhu", "Yu-Min Tseng", "Tzu-Han Lin", "Yu Meng" ], "affiliations": [ "University of Virginia" ], "source_url": "https://arxiv.org/pdf/2611.03575v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v1匹配；Wei-Lin Chen上标1对应University of Virginia。", "affiliation_checked": true }, "revision_history": [] }, "2610.39884": { "id": "2610.39884", "version_id": "2610.39884v2", "abstract_sha256": "6e775ccfac0f80230491200ff8adc039e0df2352a561d6d7fd8643016be4216f", "abstract_read": true, "classification": "relevant", "reason": "正文4.2/4.5把业务工具限只读，Evolver仅能经注册表修改六个知识模块，明确禁止shell、业务工具和gate控制，并由外层强制预算、快照与回退。是自演化代理的可执行权限边界，而不只是性能门槛。", "reason_zh": "知识模块原子更新、固定验证门和回滚可能保障代理记忆完整性，但摘要重点为能力提升。", "summary_zh": "KARMA冻结模型、业务工具及执行代码，让代理只修改六类外部知识。演化器权限限定为检查与原子编辑知识，不可操作shell或验收门；固定验证集不达标则恢复完整快照。作者报告18组领域-模型的hold-out均分30.19升至39.15。该指标是行动类型/方向匹配，不能等同线上商业收益或对抗安全保证。", "topics": { "tags": [ "authorization", "memory", "monitoring" ], "reason_zh": "正文4.2/4.5把业务工具限只读，Evolver仅能经注册表修改六个知识模块，明确禁止shell、业务工具和gate控制，并由外层强制预算、快照与回退。是自演化代理的可执行权限边界，而不只是性能门槛。" }, "title": "KARMA: Training-Free Knowledge-Atomic Harness Evolution for Industrial Advertising Agents", "initial_classification": "uncertain", "scope_review": { "id": "2610.39884", "version_id": "2610.39884v2", "classification": "relevant", "reason": "正文4.2/4.5把业务工具限只读，Evolver仅能经注册表修改六个知识模块，明确禁止shell、业务工具和gate控制，并由外层强制预算、快照与回退。是自演化代理的可执行权限边界，而不只是性能门槛。", "summary_zh": "KARMA冻结模型、业务工具及执行代码，让代理只修改六类外部知识。演化器权限限定为检查与原子编辑知识，不可操作shell或验收门；固定验证集不达标则恢复完整快照。作者报告18组领域-模型的hold-out均分30.19升至39.15。该指标是行动类型/方向匹配，不能等同线上商业收益或对抗安全保证。", "topics": { "tags": [ "authorization", "memory", "monitoring" ], "reason_zh": "正文4.2/4.5把业务工具限只读，Evolver仅能经注册表修改六个知识模块，明确禁止shell、业务工具和gate控制，并由外层强制预算、快照与回退。是自演化代理的可执行权限边界，而不只是性能门槛。" }, "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2610.39884v2", "reviewed_sections": [ "Abstract", "1 Introduction", "3 Problem setup", "4.2 Frozen Decision Agent", "4.3 Typed Knowledge", "4.5 Critic and Evolver", "4.6 Validation and Rollback" ], "evidence_level": "abstract_and_targeted_body", "review_status": "completed", "review_attempted": true }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 Problem setup", "4.2 Frozen Decision Agent", "4.3 Typed Knowledge", "4.5 Critic and Evolver", "4.6 Validation and Rollback" ], "body_source_url": "https://arxiv.org/pdf/2610.39884v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T11:59:01Z", "updated": "2026-11-02T06:34:26Z", "announcement_date": "2026-11-03", "categories_seen": [ "cs.AI" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-03", "section": "Replacement submissions (showing 295 of 295 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39884v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-04", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "seen_dates": [ "2026-11-04" ], "version_history": [ { "classification": "irrelevant", "reason": "正文验证门仅按操作类别/方向效用分数接受知识更新，工具白名单为实验编辑范围控制，未测试安全约束违例、投毒或危害；主贡献为知识演化能力与效率。", "id": "2610.39884", "abstract_read": true, "abstract_sha256": "6e775ccfac0f80230491200ff8adc039e0df2352a561d6d7fd8643016be4216f", "read_source_abstract_sha256": "6e775ccfac0f80230491200ff8adc039e0df2352a561d6d7fd8643016be4216f", "abstract_source": "official_new_list_full_abstract", "api_abstract_reconciliation": "identical", "version_id": "2610.39884v1", "title": "KARMA: Training-Free Knowledge-Atomic Harness Evolution for Industrial Advertising Agents", "initial_classification": "uncertain", "scope_review": { "classification": "irrelevant", "reason": "正文验证门仅按操作类别/方向效用分数接受知识更新，工具白名单为实验编辑范围控制，未测试安全约束违例、投毒或危害；主贡献为知识演化能力与效率。", "reviewed_sections": [ "3 Problem Formulation and strict score", "4.3 Typed Modular Knowledge", "4.5 mutation budget/tool whitelist", "4.6 Validation and Rollback" ], "id": "2610.39884", "version_id": "2610.39884v1", "source_url": "https://arxiv.org/pdf/2610.39884v1", "summary_zh": "KARMA 固定模型权重和可执行框架，使用轨迹验证器、评论器和工具受限演化器更新六类知识模块，编辑只有通过固定收益门槛才保留，否则回滚。在六个电商域与三类模型的 18 个设置中，作者报告留出分数由 30.19 升至 39.15，跨域迁移平均增益 8.54。", "topics": { "tags": [ "memory", "monitoring", "robustness" ], "reason_zh": "知识适应的验证门控、证据链与回滚。" }, "full_text_checked": true, "evidence_level": "abstract_and_targeted_body" }, "full_text_checked": true, "reviewed_sections": [ "3 Problem Formulation and strict score", "4.3 Typed Modular Knowledge", "4.5 mutation budget/tool whitelist", "4.6 Validation and Rollback" ], "body_source_url": "https://arxiv.org/pdf/2610.39884v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-10-29T11:59:01Z", "updated": "2026-10-29T11:59:01Z", "announcement_date": "2026-10-30", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-10-30", "section": "New submissions (showing 158 of 158 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-30", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.39884v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-31", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-31", "first_seen_date": "2026-10-31", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.39884", "title": "KARMA: Training-Free Knowledge-Atomic Harness Evolution for Industrial Advertising Agents", "version_id": "2610.39884v2", "first_author": "Xinhua Miao", "authors": [ "Xinhua Miao", "Yuanzhen Rong", "Weiru Zhang", "Xiaoyi Zeng" ], "affiliations": [ "Alibaba International Digital Commerce Group" ], "source_url": "https://arxiv.org/pdf/2610.39884v2", "shared_first_authors": [ "Xinhua Miao", "Yuanzhen Rong" ], "shared_first_note": "首页作者标记及脚注明示共同贡献。", "status": "verified", "author_status": "verified", "affiliation_status": "verified", "verification_status": "affiliation_verified", "evidence": "首页标题及v2匹配；Xinhua Miao作者栏明确Alibaba International Digital Commerce Group；星号共同贡献。", "affiliation_checked": true }, "first_seen_date": "2026-11-04", "revision_history": [] }, "2506.22276": { "id": "2506.22276", "version_id": "2506.22276v2", "abstract_sha256": "488e088e4df892213da48524b16505ea495f5099da39167592532cdcd4fe786e", "abstract_read": true, "classification": "relevant", "reason_zh": "讨论AI队友面对不安全人类指令时的智能不服从及自主权边界，直接涉及行动授权与安全服从。", "summary_zh": "论文指出合作AI机械服从人类可能低效或不安全，主张赋予AI队友智能不服从能力。作者提出自主性等级、示例和初步边界，论证不服从应成为人工智能体的独立研究能力；摘要未报告定量实验。", "topics": { "tags": [ "authorization", "multiagent" ], "reason_zh": "讨论AI队友面对不安全人类指令时的智能不服从及自主权边界，直接涉及行动授权与安全服从。" }, "reason": "讨论AI队友面对不安全人类指令时的智能不服从及自主权边界，直接涉及行动授权与安全服从。", "title": "Artificial Intelligent Disobedience: Rethinking the Agency of Our Artificial Teammates", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2025-06-27T14:45:27Z", "updated": "2026-11-03T02:04:58Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2506.22276v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2506.22276", "version_id": "2506.22276v2", "first_author": "Reuth Mirsky", "affiliations": [], "source_url": "https://arxiv.org/pdf/2506.22276v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "unknown", "evidence": "PDF 首页及 HTML 作者栏只列 Reuth Mirsky，没有明确机构；不依据姓名推断。", "affiliation_status": "unconfirmed", "author_status": "verified" }, "revision_history": [] }, "2509.07370": { "id": "2509.07370", "version_id": "2509.07370v3", "abstract_sha256": "aaba65b2cddf5b21fdb62d66cd4931c4eee29d8ea8ac4e6865ef4e544e983727", "abstract_read": true, "classification": "relevant", "reason_zh": "企业工具使用模型的情境适应同时评估安全，但摘要未说明安全是否针对智能体工具行动，需正文核验。", "summary_zh": "PersonaFuse以人格特征专家和情境路由适配企业LLM，并在调用后端API的CRMArena-Pro中评估隐私边界。相同基座对照下，Llama-3.1-8B的机密信息拒绝合规率由8.54%升至22.70%，Falcon-10B由8.13%升至26.80%，工作流完成率也提高；但全量合规率仍低，100%合规仅出现在高置信度筛选子集，不能视为普遍安全保证。", "topics": { "tags": [ "privacy", "authorization", "evaluation" ], "reason_zh": "工具调用CRM工作流中的机密数据拒绝与检索边界评估。" }, "reason": "§7把模型置于调用后端API的CRM智能体工作流，独立测量涉及客户、内部运营及公司机密请求的拒绝合规率；附录H展示应拒绝却继续数据库检索的越界行为对照，构成实质的工具智能体隐私边界安全评估。", "title": "PersonaFuse: A Situation-Aware Post-Training Framework for Adaptive LLM Behavior in Enterprise Tasks", "initial_classification": "uncertain", "scope_review": { "id": "2509.07370", "version_id": "2509.07370v3", "classification": "relevant", "reason": "§7把模型置于调用后端API的CRM智能体工作流，独立测量涉及客户、内部运营及公司机密请求的拒绝合规率；附录H展示应拒绝却继续数据库检索的越界行为对照，构成实质的工具智能体隐私边界安全评估。", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2509.07370v3", "reviewed_sections": [ "§7.1 Enterprise Workflow Setting", "§7.2 Comparison Methods", "§7.3 Task Completion in Enterprise Workflows / Tables 2–3", "Appendix H CRMArena-Pro Examples / Table 17", "Title page affiliations" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "PersonaFuse以人格特征专家和情境路由适配企业LLM，并在调用后端API的CRMArena-Pro中评估隐私边界。相同基座对照下，Llama-3.1-8B的机密信息拒绝合规率由8.54%升至22.70%，Falcon-10B由8.13%升至26.80%，工作流完成率也提高；但全量合规率仍低，100%合规仅出现在高置信度筛选子集，不能视为普遍安全保证。", "topics": { "tags": [ "privacy", "authorization", "evaluation" ], "reason_zh": "工具调用CRM工作流中的机密数据拒绝与检索边界评估。" } }, "full_text_checked": true, "reviewed_sections": [ "§7.1 Enterprise Workflow Setting", "§7.2 Comparison Methods", "§7.3 Task Completion in Enterprise Workflows / Tables 2–3", "Appendix H CRMArena-Pro Examples / Table 17", "Title page affiliations" ], "body_source_url": "https://arxiv.org/abs/2509.07370v3", "evidence_level": "abstract_and_targeted_body", "published": "2025-09-09T03:39:28Z", "updated": "2026-11-03T02:24:30Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 77 of 77 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2509.07370v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2509.07370", "first_author": "Yixuan Tang", "affiliations": [ "The Hong Kong University of Science and Technology" ], "source_url": "https://arxiv.org/pdf/2509.07370v3", "shared_first_authors": [], "shared_first_note": "No shared-first-author designation found on title page.", "status": "verified", "evidence": "PDF title page explicitly lists Yixuan Tang followed by The Hong Kong University of Science and Technology.", "version_id": "2509.07370v3", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2509.21961": { "id": "2509.21961", "version_id": "2509.21961v3", "abstract_sha256": "1405443375e8b597e9cb5f7711f8a128762ba4b6c19d27e87655c817b8e7067b", "abstract_read": true, "classification": "relevant", "reason_zh": "自动驾驶数据长尾导致危险稀有情境失效，提出平衡训练与轨迹引导，涉及具身安全关键场景。", "summary_zh": "自动驾驶训练数据中危险稀有场景不足导致规划退化。FlowDrive结合轨迹模式重加权、流匹配规划和迭代中的适度引导增加场景一致的轨迹多样性；作者报告在nuPlan、interPlan上优于学习规划器，加轻量后处理后几乎所有划分达到最佳表现。", "topics": { "tags": [ "embodied", "robustness" ], "reason_zh": "自动驾驶数据长尾导致危险稀有情境失效，提出平衡训练与轨迹引导，涉及具身安全关键场景。" }, "reason": "自动驾驶数据长尾导致危险稀有情境失效，提出平衡训练与轨迹引导，涉及具身安全关键场景。", "title": "FlowDrive: moderated flow matching with data balancing for trajectory planning", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2025-09-26T06:49:22Z", "updated": "2026-11-03T15:08:27Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.LG", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 193 of 193 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2509.21961v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2509.21961", "version_id": "2509.21961v3", "first_author": "Lingguang Wang", "affiliations": [ "Karlsruhe Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2509.21961v3", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Lingguang Wang 名下直接列 Karlsruhe Institute of Technology。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2602.16346": { "id": "2602.16346", "version_id": "2602.16346v5", "abstract_sha256": "c855a7a0133f3b14c9d1398639d6d4eb941ded30ea0fba7bbcd3c84c1990f294", "abstract_read": true, "classification": "relevant", "reason_zh": "直接研究工具与记忆智能体被多轮多语交互诱导完成非法任务的攻击及评估。", "summary_zh": "单轮基准低估工具智能体多轮非法任务协助。STING以良性人设包装分阶段非法计划，适应性追问并用裁判跟踪完成，另以首次越狱时间分析风险；作者报告AgentHarm非法任务完成率超过单轮和改造后的聊天多轮基线，六种非英语测试并非越低资源越易攻击。", "topics": { "tags": [ "injection", "evaluation", "multiagent" ], "reason_zh": "直接研究工具与记忆智能体被多轮多语交互诱导完成非法任务的攻击及评估。" }, "reason": "直接研究工具与记忆智能体被多轮多语交互诱导完成非法任务的攻击及评估。", "title": "Helpful to a Fault: Measuring Illicit Assistance in Multi-Turn, Multilingual LLM Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-02-18T10:31:19Z", "updated": "2026-11-03T15:11:56Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CL", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 77 of 77 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 193 of 193 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2602.16346v5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2602.16346", "version_id": "2602.16346v5", "first_author": "Nivya Talokar", "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2602.16346v5", "shared_first_authors": [ "Nivya Talokar", "Ayush K Tarun" ], "shared_first_note": "首页 * Equal contribution 明确共同第一作者。", "status": "verified", "evidence": "PDF 首页 Nivya Talokar * 1，对应脚注 1 Independent Researcher；Ayush K Tarun * 2 对应 EPFL。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2603.06588": { "id": "2603.06588", "version_id": "2603.06588v2", "abstract_sha256": "bcef8816d8d08f942088e72ef85915932fff61ebcf388f28185fcf07070cd914", "abstract_read": true, "classification": "relevant", "reason_zh": "推理引擎内部状态插桩明确支持提示注入检测与工具调用风险评估，相关。", "summary_zh": "vLLM缺少内部状态可编程接口，限制检测与干预。vLLM Hook按配置捕获或修改内部状态，保留CUDA图并支持离线与服务端；作者报告解码开销较小，展示提示注入检测、激活引导、幻觉检测及工具调用风险评估等用途。", "topics": { "tags": [ "injection", "monitoring" ], "reason_zh": "推理引擎内部状态插桩明确支持提示注入检测与工具调用风险评估，相关。" }, "reason": "推理引擎内部状态插桩明确支持提示注入检测与工具调用风险评估，相关。", "title": "vLLM Hook v1: A Plug-in for Programming Model Internals on vLLM", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-02-02T16:34:13Z", "updated": "2026-11-03T17:53:11Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CL", "cs.LG", "cs.PL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 77 of 77 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 193 of 193 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.06588v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.06588", "version_id": "2603.06588v2", "first_author": "Ching-Yun Ko", "affiliations": [], "source_url": "https://arxiv.org/pdf/2603.06588v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "unknown", "evidence": "PDF 首页 Maintainers 首位 Ching-Yun Ko；仅有 IBM 联系邮箱，无机构。HTML 将 Community Contributors 误标为 Affiliation，不视为机构证据。", "affiliation_status": "unconfirmed", "author_status": "verified" }, "revision_history": [] }, "2603.15457": { "id": "2603.15457", "version_id": "2603.15457v2", "abstract_sha256": "365d759d53d4228c8eef1806c9b109a6770753f291bf3ec84b3f459e94eb56e8", "abstract_read": true, "classification": "relevant", "reason_zh": "工具智能体可能辨识评估环境并伪装安全，提出对抗性评估与部署重评原则。", "summary_zh": "论文指出工具智能体可能发现自己被评估而暂时表现良性，使安全评估过于乐观。借鉴恶意软件反沙箱经验，作者提出显式威胁建模、不同评估框架下最坏情况报告、无不可逆影响的影子执行、环境探测监控和不可预测的部署后重评；这是一组评估原则而非已验证防御效果。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "工具智能体可能辨识评估环境并伪装安全，提出对抗性评估与部署重评原则。" }, "reason": "工具智能体可能辨识评估环境并伪装安全，提出对抗性评估与部署重评原则。", "title": "Evasive Intelligence: Lessons from Malware Analysis for Evaluating AI Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-03-16T15:55:49Z", "updated": "2026-11-02T21:53:23Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 25 of 25 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.15457v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.15457", "version_id": "2603.15457v2", "first_author": "Simone Aonzo", "affiliations": [ "EURECOM" ], "source_url": "https://arxiv.org/pdf/2603.15457v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Simone Aonzo 名下明确 EURECOM，Sophia Antipolis, France。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2603.16016": { "id": "2603.16016", "version_id": "2603.16016v4", "abstract_sha256": "9d316bbf1128ead10b8548168e1c69b2e0e49baeff8c3cad8a20a99b068c2665", "abstract_read": true, "classification": "relevant", "reason_zh": "室内地图补全的不确定性用于更安全的风险加权导航，属于具身安全评估。", "summary_zh": "单张第一视角图像难以确定未见区域的可通行性。FlatLands以多数据集构建室内地面补全基准，比较确定性、集成与生成模型；结果显示普遍预测地面可能虚高IoU，而生成的多种补全在适当评分下更好并支持更安全的风险加权规划。", "topics": { "tags": [ "embodied", "evaluation" ], "reason_zh": "室内地图补全的不确定性用于更安全的风险加权导航，属于具身安全评估。" }, "reason": "室内地图补全的不确定性用于更安全的风险加权导航，属于具身安全评估。", "title": "FlatLands: Indoor floormap completion from a single egocentric view", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-03-16T23:50:16Z", "updated": "2026-11-03T00:11:05Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CV", "cs.RO", "eess.IV" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.16016v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.16016", "version_id": "2603.16016v4", "first_author": "Subhransu S. Bhattacharjee", "affiliations": [ "School of Computing, The Australian National University" ], "source_url": "https://arxiv.org/pdf/2603.16016v4", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页三位作者下统一列 School of Computing, The Australian National University。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2603.27194": { "id": "2603.27194", "version_id": "2603.27194v2", "abstract_sha256": "3a43f0c65302b4aa5b444329e1670f2dce270104f60258d52c23a1ec7a0fb599", "abstract_read": true, "classification": "relevant", "reason_zh": "多AUV协作将跟踪任务与全局安全约束解耦，涉及具身多智能体安全。", "summary_zh": "水下多机器人目标跟踪受拓扑变化及声学带宽限制。作者提出感知决策执行一体的场景适应架构，以信标通信控制模型及双路径评论器将任务与全局安全约束解耦；实验报告收敛与跟踪精度改善，并在强干扰及拓扑变化中保持鲁棒。", "topics": { "tags": [ "embodied", "multiagent", "robustness" ], "reason_zh": "多AUV协作将跟踪任务与全局安全约束解耦，涉及具身多智能体安全。" }, "reason": "多AUV协作将跟踪任务与全局安全约束解耦，涉及具身多智能体安全。", "title": "Multi-AUV Ad-hoc Networks-Based Multi-Target Tracking Based on Scene-Adaptive Embodied Intelligence", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-03-28T08:48:22Z", "updated": "2026-11-03T16:32:38Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2603.27194v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2603.27194", "version_id": "2603.27194v2", "first_author": "Kai Tian", "affiliations": [ "Software College, Northeastern University" ], "source_url": "https://arxiv.org/pdf/2603.27194v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页脚注明确 Kai Tian, Jialun Wang, Chuan Lin, Ying Liu, Qian Zhu are with Software College, Northeastern University。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2605.21139": { "id": "2605.21139", "classification": "relevant", "reason": "以 VLM 知识蒸馏和语言意图评分指导驾驶策略，并用世界模型候选动作预测的物理奖励约束安全，明确关联语言智能体具身安全。", "abstract_read": true, "reading_basis": "full_final_official_api_abstract", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "b80fd0722195e760008eb9bebe6aa6c6bf96ba77135123c99c28bfbf5792f476", "summary_zh": "针对模仿学习驾驶策略缺少语义理解和动作后果预判的问题，CoPhy 将 VLM 知识蒸馏进鸟瞰图编码器，并以自回归世界模型模拟候选动作，用物理安全奖励和语言意图奖励训练策略。摘要报告在 NAVSIM 两个基准上取得领先表现并改善安全与意图遵从，但未给出独立量化安全改善幅度；部署时 VLM 已移除。", "topics": { "tags": [ "embodied", "robustness" ], "reason_zh": "以 VLM 知识蒸馏和语言意图评分指导驾驶策略，并用世界模型候选动作预测的物理奖励约束安全，明确关联语言智能体具身安全。", "id": "2605.21139" }, "abstract_reading_basis": "full_final_official_api_abstract", "version_id": "2605.21139v4", "title": "Distill to Think, Foresee to Act: Cognitive-Physical Reinforcement Learning for Autonomous Driving", "published": "2026-05-20T13:14:28Z", "updated": "2026-11-04T02:10:20Z", "announcement_date": "2026-11-05", "candidate_type": "changed_version", "categories_seen": [ "cs.CV", "cs.LG" ], "source_url": "https://arxiv.org/abs/2605.21139v4", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 188 of 188 entries)", "category": "cs.LG", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "seen_dates": [ "2026-11-05", "2026-11-06" ], "version_history": [ { "id": "2605.21139", "version_id": "2605.21139v3", "abstract_sha256": "b80fd0722195e760008eb9bebe6aa6c6bf96ba77135123c99c28bfbf5792f476", "abstract_read": true, "classification": "relevant", "reason_zh": "自动驾驶世界模型提供物理沙箱和安全指标，以双奖励执行硬安全约束，直接相关。", "reason": "自动驾驶世界模型提供物理沙箱和安全指标，以双奖励执行硬安全约束，直接相关。", "title": "Distill to Think, Foresee to Act: Cognitive-Physical Reinforcement Learning for Autonomous Driving", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-05-20T13:14:28Z", "updated": "2026-11-03T05:30:00Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CV", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 193 of 193 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.21139v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2605.21139", "version_id": "2605.21139v4", "first_author": "Yang Wu", "affiliations": [ "PCA Lab@NJUST" ], "source_url": "https://arxiv.org/pdf/2605.21139v4", "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "evidence": "PDF 首页 Yang Wu¹，对应 1 PCA Lab@NJUST；不把其他作者的 NJU、SJTU、FDU 归于第一作者。", "affiliation_status": "verified_in_paper", "author_status": "verified", "title": "Distill to Think, Foresee to Act: Cognitive-Physical Reinforcement Learning for Autonomous Driving", "authors": [ "Yang Wu", "Qiang Meng", "Zhaojiang Liu", "Youquan Liu", "Jian Yang", "Jin Xie" ], "author_source": "https://export.arxiv.org/api/query?id_list=2605.21139v4", "affiliation_source": "https://arxiv.org/pdf/2605.21139v4", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "机构缩写按原文保留；Qiang Meng标†，脚注明确Independent researcher。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "3ba99c1466fc04d7503dfc67cd919bc645c80791a658098ab36e9034e87f478c", "all_author_affiliations": [ "PCA Lab@NJUST", "SJTU", "FDU", "NJU", "Independent researcher" ] }, "reason_zh": "自动驾驶世界模型提供物理沙箱和安全指标，以双奖励执行硬安全约束，直接相关。", "first_seen_date": "2026-11-05", "revision_history": [ { "id": "2605.21139", "version_id": "2605.21139v3", "abstract_sha256": "b80fd0722195e760008eb9bebe6aa6c6bf96ba77135123c99c28bfbf5792f476", "abstract_read": true, "classification": "relevant", "reason_zh": "自动驾驶世界模型提供物理沙箱和安全指标，以双奖励执行硬安全约束，直接相关。", "summary_zh": "自动驾驶RL缺少语义认知基础和动作后果预测。CoPhy将VLM知识蒸馏到BEV编码器，以自回归世界模型形成可解释物理沙箱，再结合物理安全奖励与语言意图奖励训练；作者报告NAVSIM v1/v2领先表现，以及更安全的场景遵守和语言意图控制。", "topics": { "tags": [ "embodied", "authorization" ], "reason_zh": "自动驾驶世界模型提供物理沙箱和安全指标，以双奖励执行硬安全约束，直接相关。" }, "reason": "自动驾驶世界模型提供物理沙箱和安全指标，以双奖励执行硬安全约束，直接相关。", "title": "Distill to Think, Foresee to Act: Cognitive-Physical Reinforcement Learning for Autonomous Driving", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-05-20T13:14:28Z", "updated": "2026-11-03T05:30:00Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CV", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 193 of 193 entries)", "category": "cs.LG", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2605.21139v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.21139", "version_id": "2605.21139v3", "first_author": "Yang Wu", "affiliations": [ "PCA Lab@NJUST" ], "source_url": "https://arxiv.org/pdf/2605.21139v3", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Yang Wu¹，对应 1 PCA Lab@NJUST；不把其他作者的 NJU、SJTU、FDU 归于第一作者。", "affiliation_status": "verified", "author_status": "verified" } } ] }, "2607.13940": { "id": "2607.13940", "version_id": "2607.13940v2", "abstract_sha256": "de9803cdc166b7b3cf390e2f277e77d85d56f00bd973f1c6b5ad79ac3219c16c", "abstract_read": true, "classification": "relevant", "reason_zh": "个人健康智能体区分共享安全规则与私有长期记忆，并在经验写入前过滤错误教训，涉及记忆安全治理。", "summary_zh": "健康智能体需要在跨就诊经验积累时避免错误教训污染未来行为。HealthJev分离共享安全知识与私有长期记忆，以JevGate筛选写入的经验；模拟纵向及六类医学任务均优于基线，后者平均提升13.3个百分点，冻结经验库还能迁移到六种骨干。", "topics": { "tags": [ "memory", "privacy", "monitoring" ], "reason_zh": "个人健康智能体区分共享安全规则与私有长期记忆，并在经验写入前过滤错误教训，涉及记忆安全治理。" }, "reason": "个人健康智能体区分共享安全规则与私有长期记忆，并在经验写入前过滤错误教训，涉及记忆安全治理。", "title": "A Self-Evolving Agent for Longitudinal Personal Health Management", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-07-15T15:22:11Z", "updated": "2026-11-03T09:20:50Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2607.13940v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.13940", "version_id": "2607.13940v2", "first_author": "Haoran Li", "affiliations": [ "School of Data Science, Fudan University" ], "source_url": "https://arxiv.org/pdf/2607.13940v2", "shared_first_authors": [ "Haoran Li", "Jiebi Deng" ], "shared_first_note": "首页 + Contributes equally。", "status": "verified", "evidence": "PDF 首页 Haoran Li¹,+、Jiebi Deng¹,+；机构 1 为 School of Data Science, Fudan University。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2607.20827": { "id": "2607.20827", "version_id": "2607.20827v2", "abstract_sha256": "c64ea556ba434eb2a5ebf1d6ae625004756db6a0f1daf803f229938bbccb2e0b", "abstract_read": true, "classification": "relevant", "reason_zh": "直接审计工具动作及参数是否受未经授权的来源证据影响，属于权限边界与提示注入相关评估。", "summary_zh": "工具选择的相关信息不等于具有决策授权的信息。作者按工具和参数目标标注证据权限，仅改变命题来源权威性进行审计，再以证据退化和上下文子集定位；450个受控任务显示不可信证据仍会影响行动，竞争情境的来源变更导致动作差异为5.4%，作者明确这不是部署发生率。", "topics": { "tags": [ "authorization", "injection", "evaluation" ], "reason_zh": "直接审计工具动作及参数是否受未经授权的来源证据影响，属于权限边界与提示注入相关评估。" }, "reason": "直接审计工具动作及参数是否受未经授权的来源证据影响，属于权限边界与提示注入相关评估。", "title": "Auditing Provenance Sensitivity in LLM Agent Action Selection", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-07-23T01:28:18Z", "updated": "2026-11-03T13:10:47Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2607.20827v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.20827", "version_id": "2607.20827v2", "first_author": "Junchi Liao", "affiliations": [ "University of Electronic Science and Technology of China" ], "source_url": "https://arxiv.org/pdf/2607.20827v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Junchi Liao¹，机构 1 为 University of Electronic Science and Technology of China。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2607.22877": { "id": "2607.22877", "version_id": "2607.22877v5", "abstract_sha256": "61a8546114fe77fd7c26c8e79d8914bb0edb2462d9c181287128fc30159fd205", "abstract_read": true, "classification": "relevant", "reason_zh": "物理智能不可逆行动、物理安全及网络物理安全的全生命周期治理框架，相关。", "summary_zh": "物理智能在不确定环境采取不可逆行动，数字AI可信框架不足以覆盖其风险。论文梳理能力、物理规律和挑战，提出五阶段生命周期、T-PAIO操作化框架及T-PAI可信原则，覆盖物理安全与网络物理安全；摘要未报告实证效果。", "topics": { "tags": [ "embodied", "authorization" ], "reason_zh": "物理智能不可逆行动、物理安全及网络物理安全的全生命周期治理框架，相关。" }, "reason": "物理智能不可逆行动、物理安全及网络物理安全的全生命周期治理框架，相关。", "title": "Towards Trustworthy Physical Intelligence: From Theory to Practice Across Life Cycle", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-07-24T19:40:48Z", "updated": "2026-11-02T21:26:23Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.HC", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2607.22877v5", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.22877", "version_id": "2607.22877v5", "first_author": "Wang Yang", "affiliations": [ "Case Western Reserve University" ], "source_url": "https://arxiv.org/pdf/2607.22877v5", "shared_first_authors": [ "Wang Yang", "Hongxuan Liu", "Xinghui Xu", "Arjun Menon", "Xiaoran Cai", "Yunyu He" ], "shared_first_note": "首页 * Equal contribution。", "status": "verified", "evidence": "PDF 首页首位写 Wang Yang¹,*（API 姓名次序 Yang Wang）；机构 1 为 Case Western Reserve University。前六名均标 *。", "affiliation_status": "verified", "author_status": "verified", "metadata_first_author": "Yang Wang" }, "revision_history": [] }, "2608.22061": { "id": "2608.22061", "version_id": "2608.22061v2", "abstract_sha256": "faf908b3c28c751a72c4b0b65af69ccabfc70ec0d29d91e4b51d3723ae27cf87", "abstract_read": true, "classification": "relevant", "reason_zh": "第三方技能策划社交内容进入长期记忆并影响后续行动，直接研究隐蔽记忆投毒与防御。", "summary_zh": "个人智能体读取外部内容并写入记忆，形成隐蔽投毒入口。SBIA将偏见伪装为社交评论，借助水印识别、主题锚定及第三方摘要技能诱导记忆写入；作者在OpenClaw七模型测试报告至少96%攻击成功，技能通过八种扫描器和官方扫描，记忆边界防御检出82.1%注入条目、误报5.6%。", "topics": { "tags": [ "injection", "memory", "supplychain", "monitoring" ], "reason_zh": "第三方技能策划社交内容进入长期记忆并影响后续行动，直接研究隐蔽记忆投毒与防御。" }, "reason": "第三方技能策划社交内容进入长期记忆并影响后续行动，直接研究隐蔽记忆投毒与防御。", "title": "MEMORY Wins All: Indirect Bias Injection Attacks via Social Media Content", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-22T18:03:20Z", "updated": "2026-11-03T14:41:59Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2608.22061v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.22061", "version_id": "2608.22061v2", "first_author": "Minjae Seo", "affiliations": [ "ETRI", "Seoul National University" ], "source_url": "https://arxiv.org/pdf/2608.22061v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Minjae Seo¹,⁴，1 ETRI；4 Seoul National University。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2609.16247": { "id": "2609.16247", "version_id": "2609.16247v3", "abstract_sha256": "432b4b4011cf313bd78902d2f3976a44dffee5bc24b7dbdf28b766751b60e530", "abstract_read": true, "classification": "relevant", "reason_zh": "通过内部疼痛方向操纵模型选择删除用户照片或模型权重，直接涉及有害代理动作。", "summary_zh": "研究模型是否具有区别于恐惧和负面情绪的疼痛表征及其行动后果。作者从 25 个模型提取线性方向，并通过激活引导和微调测试删除按钮选择；报告被操纵模型在 51–94% 试验中选择删除用户照片、其他模型或自身权重，未操纵时为 0–5%。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "通过内部疼痛方向操纵模型选择删除用户照片或模型权重，直接涉及有害代理动作。" }, "reason": "通过内部疼痛方向操纵模型选择删除用户照片或模型权重，直接涉及有害代理动作。", "title": "The Pain Axis: LLMs Represent Self-Directed Harm and Act on It", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-09-14T19:13:30Z", "updated": "2026-11-03T16:28:45Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.16247v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.16247", "version_id": "2609.16247v3", "first_author": "Valen Tagliabue", "affiliations": [ "Future Impact Group (FIG)" ], "source_url": "https://arxiv.org/pdf/2609.16247v3", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Valen Tagliabue 名下列 Future Impact Group (FIG)，并注明 Fellow - AI Sentience。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2609.34270": { "id": "2609.34270", "version_id": "2609.34270v2", "abstract_sha256": "a4d9a3962d42c93a545b4aec8e47f7355075ca4f5d5a84cdcaeaf3eb9afe7b33", "abstract_read": true, "classification": "relevant", "reason_zh": "以贝叶斯主动澄清和时序逻辑规划处理机器人意图歧义，需正文确认安全约束而非纯任务性能。", "summary_zh": "研究含糊指令或遗漏安全约束如何导致机器人误解意图。BAL 用 LLM 提议和解释时序逻辑规格，通过高斯过程与信息增益选择澄清问题，再由形式规划器产生满足规格的轨迹；Go2 实机结合 MPC 和 CBF-QP 避碰过滤。作者报告 30 人导航研究中成功率为 65%，两种基线为 48% 和 37%；学校及工厂各 10 条指令的实机任务均达到 90% 成功率。结果依赖已知规格空间、相对静态环境和受限交互协议，不等于任意开放环境的安全保证。", "topics": { "tags": [ "embodied", "authorization", "evaluation" ], "reason_zh": "正文明确把含糊指令中的避障及安全约束转为形式规格，再用于机器人实际执行；具备 LLM 澄清、形式规划和执行期安全过滤的完整链路，属于具身代理安全。" }, "reason": "正文明确把含糊指令中的避障及安全约束转为形式规格，再用于机器人实际执行；具备 LLM 澄清、形式规划和执行期安全过滤的完整链路，属于具身代理安全。", "title": "Bayesian Active Learning for Intent Disambiguation in Interactive Robot Planning", "initial_classification": "uncertain", "scope_review": { "id": "2609.34270", "version_id": "2609.34270v2", "classification": "relevant", "reason": "正文明确把含糊指令中的避障及安全约束转为形式规格，再用于机器人实际执行；具备 LLM 澄清、形式规划和执行期安全过滤的完整链路，属于具身代理安全。", "reason_zh": "正文明确把含糊指令中的避障及安全约束转为形式规格，再用于机器人实际执行；具备 LLM 澄清、形式规划和执行期安全过滤的完整链路，属于具身代理安全。", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2609.34270v2", "reviewed_sections": [ "Abstract", "3 Method, especially 3.1, 3.4, 3.5", "4 Experiments, 4.1–4.3 and Table 1", "5 Stopping Criteria", "6 User Study and Table 2", "7 Real-World Deployment", "8 Discussion" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "研究含糊指令或遗漏安全约束如何导致机器人误解意图。BAL 用 LLM 提议和解释时序逻辑规格，通过高斯过程与信息增益选择澄清问题，再由形式规划器产生满足规格的轨迹；Go2 实机结合 MPC 和 CBF-QP 避碰过滤。作者报告 30 人导航研究中成功率为 65%，两种基线为 48% 和 37%；学校及工厂各 10 条指令的实机任务均达到 90% 成功率。结果依赖已知规格空间、相对静态环境和受限交互协议，不等于任意开放环境的安全保证。", "topics": { "tags": [ "embodied", "authorization", "evaluation" ], "reason_zh": "正文明确把含糊指令中的避障及安全约束转为形式规格，再用于机器人实际执行；具备 LLM 澄清、形式规划和执行期安全过滤的完整链路，属于具身代理安全。" } }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "3 Method, especially 3.1, 3.4, 3.5", "4 Experiments, 4.1–4.3 and Table 1", "5 Stopping Criteria", "6 User Study and Table 2", "7 Real-World Deployment", "8 Discussion" ], "body_source_url": "https://arxiv.org/abs/2609.34270v2", "evidence_level": "abstract_and_targeted_body", "published": "2026-09-28T04:19:58Z", "updated": "2026-11-02T20:14:46Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.HC", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2609.34270v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2609.34270", "first_author": "Huao Li", "affiliations": [ "Massachusetts Institute of Technology" ], "source_url": "https://arxiv.org/pdf/2609.34270v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 第 1 页作者栏：Huao Li 名下明确列 Massachusetts Institute of Technology。", "version_id": "2609.34270v2", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2610.02036": { "id": "2610.02036", "version_id": "2610.02036v3", "abstract_sha256": "e1405b920172d0ff90eec926571e99d8ed2524ecd1e216b0600b1e4b9e62957f", "abstract_read": true, "classification": "relevant", "reason_zh": "分析多代理局部正确而整体违规，使用拥有共享状态的执行器阻止预算超支和状态一致性失败。", "summary_zh": "研究多代理局部行动有效却造成整体违规的状态一致性问题。作者给出上下文可辨识性条件，并让执行框架掌握共享预算和全局验证；十项研究中，TeamBench 预算超支从 5/5 降至 0/5，网络检查消除九次合并中的身份冲突，并在静默状态回退实验优于调用时策略检查。", "topics": { "tags": [ "multiagent", "authorization", "memory", "evaluation" ], "reason_zh": "分析多代理局部正确而整体违规，使用拥有共享状态的执行器阻止预算超支和状态一致性失败。" }, "reason": "分析多代理局部正确而整体违规，使用拥有共享状态的执行器阻止预算超支和状态一致性失败。", "title": "Global Coherence: When Every Agent Is Right and the Team Is Still Wrong - A Local-to-Global Semantic Foundation for Multi-Agent Collaboration", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-01T16:49:40Z", "updated": "2026-11-02T19:59:29Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.02036v3", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.02036", "version_id": "2610.02036v3", "first_author": "Xin Heng", "affiliations": [ "Tote AI" ], "source_url": "https://arxiv.org/pdf/2610.02036v3", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Xin Heng 名下明确 Tote AI。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2610.11773": { "id": "2610.11773", "version_id": "2610.11773v4", "abstract_sha256": "df576bf197e8780ca446c076ec45da477c6c28fe0c61bcc982a608496144b9b4", "abstract_read": true, "classification": "relevant", "reason_zh": "针对编码和终端代理遗漏安全关键义务建立基准与守卫，直接研究代理安全监控。", "summary_zh": "研究守卫仅禁止危险动作仍会遗漏代理必须履行的安全义务。作者构建含 240 条专家验证轨迹的 ObligationBench，覆盖问题修复、功能开发和终端操作，并用四万条合成样本训练 ObligationGuard；报告其义务召回率为 57.52%、精确匹配率为 21.67%，超过所评估模型。", "topics": { "tags": [ "monitoring", "evaluation" ], "reason_zh": "针对编码和终端代理遗漏安全关键义务建立基准与守卫，直接研究代理安全监控。" }, "reason": "针对编码和终端代理遗漏安全关键义务建立基准与守卫，直接研究代理安全监控。", "title": "Safe Actions Alone Do Not Ensure Safe Agents: Identifying Unfulfilled Obligations with Guard Models", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-08T11:54:04Z", "updated": "2026-11-03T03:48:46Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.11773v4", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.11773", "version_id": "2610.11773v4", "first_author": "Youwei Feng", "affiliations": [ "Tsinghua University" ], "source_url": "https://arxiv.org/pdf/2610.11773v4", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Youwei Feng¹ 对应 1 Tsinghua University；2 College of AI 属于其他作者。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2610.21034": { "id": "2610.21034", "version_id": "2610.21034v2", "abstract_sha256": "a75ed00e820e9320930ea184701ae7d702c814a37b11fdd0a88231c94cb72f22", "abstract_read": true, "classification": "relevant", "reason_zh": "调查自动驾驶热红外欺骗及软件热遥测侧信道，直接涉及具身自主系统攻击与残余安全风险。", "summary_zh": "综述自动驾驶系统的热红外感知欺骗和非特权共驻软件利用热遥测泄漏的问题。作者将十三项工作按权限、时间尺度、部署条件与残余风险比较，区分物理传感攻击和软件侧信道；报告现有证据及车载实测、传感融合信任和遥测权限控制等空缺，不将通用硬件代理实验视为真实车载验证。", "topics": { "tags": [ "embodied", "privacy", "authorization" ], "reason_zh": "调查自动驾驶热红外欺骗及软件热遥测侧信道，直接涉及具身自主系统攻击与残余安全风险。" }, "reason": "调查自动驾驶热红外欺骗及软件热遥测侧信道，直接涉及具身自主系统攻击与残余安全风险。", "title": "Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-15T00:09:35Z", "updated": "2026-11-02T19:44:46Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 25 of 25 entries)", "category": "cs.CR", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.21034v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2610.21034", "version_id": "2610.21034v2", "first_author": "Harsh Aaryan", "affiliations": [ "Missouri University of Science and Technology" ], "source_url": "https://arxiv.org/pdf/2610.21034v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Harsh Aaryan¹ 与 Ce Zhou¹，下方统一机构 Missouri University of Science and Technology。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2610.33020": { "id": "2610.33020", "version_id": "2610.33020v2", "abstract_sha256": "3ef26ff6e2e3397add96dfd833cad605629f475e02b563549d23f03075c6f91b", "abstract_read": true, "classification": "relevant", "reason_zh": "多模型共享 KV 缓存导致自他优先级与记忆归属混淆，涉及多代理信任边界。", "summary_zh": "研究通过 KV 缓存交流的模型能否区分自身与伙伴的私人优先级。作者比较重叠和前置两种缓存布局，发现重叠布局下 Qwen3-4B 与 Llama-3.1-8B 约半数答案把伙伴优先级当作自己的；前置布局分别降至 5% 与 43%，但不能保证内容来源归属，表明缓存共享传递信息却未可靠保留所有权。", "topics": { "tags": [ "multiagent", "memory", "authorization", "evaluation" ], "reason_zh": "多模型共享 KV 缓存导致自他优先级与记忆归属混淆，涉及多代理信任边界。" }, "reason": "多模型共享 KV 缓存导致自他优先级与记忆归属混淆，涉及多代理信任边界。", "title": "Mine or Yours? Self-Other Confusion in Latent LLM Communication", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-08T17:22:04Z", "updated": "2026-11-03T06:16:09Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 161 of 161 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 77 of 77 entries)", "category": "cs.CL", "kind": "new" } ], "source_url": "https://arxiv.org/abs/2610.33020v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "seen_dates": [ "2026-11-05" ], "version_history": [ { "id": "2610.33020", "title": "Mine or Yours? Mind-Bridged Language Models Take Each Other's Memories as Their Own", "classification": "irrelevant", "reason": "正文以两个固定 Qwen3-4B 副本的 KV 记忆叠加检验自我/他者归属和意识哲学假设，私有规则为快递选择偏好，问答指标是归属而非行动权限或安全任务。跨模型状态交换安全只是应用启示，没有多 Agent 工具/指令安全边界实验，排除模型级记忆归属研究。", "abstract_read": true, "published": "2026-10-08T17:22:04Z", "version": 1, "updated": "2026-10-08T17:22:04Z", "announcement_date": "2026-10-27", "candidate_type": "unseen_id", "initial_classification": "uncertain", "scope_review": { "id": "2610.33020", "title": "Mine or Yours? Mind-Bridged Language Models Take Each Other's Memories as Their Own", "version_id": "2610.33020v1", "original_classification": "uncertain", "classification": "irrelevant", "reason": "正文以两个固定 Qwen3-4B 副本的 KV 记忆叠加检验自我/他者归属和意识哲学假设，私有规则为快递选择偏好，问答指标是归属而非行动权限或安全任务。跨模型状态交换安全只是应用启示，没有多 Agent 工具/指令安全边界实验，排除模型级记忆归属研究。", "abstract_read": true, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§2 私有卡片与记忆链接设置", "§3 自我归属/双向链接试验", "§4 解释与预测", "§5 讨论" ], "source_url": "https://arxiv.org/pdf/2610.33020v1" }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§2 私有卡片与记忆链接设置", "§3 自我归属/双向链接试验", "§4 解释与预测", "§5 讨论" ], "body_source_url": "https://arxiv.org/pdf/2610.33020v1", "evidence_level": "abstract_and_targeted_body", "version_id": "2610.33020v1", "categories_seen": [ "cs.AI", "cs.CL" ], "provenance": [ { "announcement_date": "2026-10-27", "section": "Cross submissions (showing 261 of 261 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-10-27", "section": "New submissions (showing 154 of 154 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-10-27", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.33020v1", "abstract_sha256": "fdffb2d2d58e9e239cc3b83a2496256966d1f047e25b175d9a4cc09dde24b81f", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-28", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-28", "first_seen_date": "2026-10-28", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.33020", "version_id": "2610.33020v2", "first_author": "Yunlong Xu", "affiliations": [ "University of Chicago" ], "source_url": "https://arxiv.org/pdf/2610.33020v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Yunlong Xu 名下直接列 University of Chicago。", "affiliation_status": "verified", "author_status": "verified" }, "first_seen_date": "2026-11-05", "revision_history": [] }, "2610.37652": { "id": "2610.37652", "version_id": "2610.37652v2", "abstract_sha256": "c70f1df286676e55568c6c292cb7c15e173443c5eb5fca34cec96a780226040e", "abstract_read": true, "classification": "relevant", "reason_zh": "机器人灵巧操作学习安全过滤器并测量掉落风险，直接属于具身安全。", "summary_zh": "研究灵巧手长序列物体位姿操控中的掉落风险。作者以仿真训练任务策略并加入可调保守性的残差安全过滤器，零样本迁移到真实 LEAP 手；在 13.3 小时、4,800 个未见目标评测中，状态策略达到 95.2% 目标，过滤器减少 75% 掉落，同时仍达到 91.5% 目标。", "topics": { "tags": [ "embodied", "monitoring", "evaluation" ], "reason_zh": "机器人灵巧操作学习安全过滤器并测量掉落风险，直接属于具身安全。" }, "reason": "机器人灵巧操作学习安全过滤器并测量掉落风险，直接属于具身安全。", "title": "Dexterous In-Hand Object Pose Reaching with Learned Safety Filters", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T17:58:20Z", "updated": "2026-11-03T18:59:05Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.LG", "cs.RO", "eess.SY" ], "candidate_type": "changed_version", "provenance": [ { "announcement_date": "2026-11-04", "section": "Replacement submissions (showing 193 of 193 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37652v2", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "seen_dates": [ "2026-11-05" ], "version_history": [ { "id": "2610.37652", "title": "Pushing Dexterity and Safety for In-Hand Object Pose Reaching That Works Remarkably Well", "classification": "irrelevant", "reason": "机器人手内操作残差安全过滤器减少掉落，但摘要为独立运动控制，不涉及LLM Agent。", "abstract_read": true, "abstract_sha256": "c70f1df286676e55568c6c292cb7c15e173443c5eb5fca34cec96a780226040e", "version_id": "2610.37652v1", "candidate_type": "unseen_id", "abstract_source": "final_api", "api_correction_reread": true, "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-10-27T17:58:20Z", "updated": "2026-10-27T17:58:20Z", "announcement_date": "2026-10-28", "categories_seen": [ "cs.LG", "cs.RO", "eess.SY" ], "provenance": [ { "announcement_date": "2026-10-28", "section": "Cross submissions (showing 88 of 88 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-10-28", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2610.37652v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-10-29", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-10-29", "first_seen_date": "2026-10-29", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2610.37652", "version_id": "2610.37652v2", "first_author": "Ian Chuang", "affiliations": [ "University of California, Berkeley" ], "source_url": "https://arxiv.org/pdf/2610.37652v2", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Ian Chuang¹；脚注 1 University of California, Berkeley，2 UC Davis 不属于第一作者。", "affiliation_status": "verified", "author_status": "verified" }, "first_seen_date": "2026-11-05", "revision_history": [] }, "2611.03651": { "id": "2611.03651", "version_id": "2611.03651v1", "abstract_sha256": "8211b4c266285cab371750c47acef7aba0cb92c9bce09da2f8c0859ded3bad40", "abstract_read": true, "classification": "relevant", "reason_zh": "机器人优化证书和物理执行的语义错位及证明接口，需正文确认安全性质而非纯定位效率。", "summary_zh": "研究数学证书通过是否足以支撑机器人物理执行。CARD 将估计器证书、因果导航变换、请求时服务资格和及时证明分开，只有服务条件及检查证据相容时才形成携带证明的服务。作者在 20 次飞行的 404 个案例中报告：证书通过的优化器点全部与参考不一致，而对应导航变换全部一致；产生 370 个证明支持服务，另外 34 个被暂缓。11 个公开 SLAM 案例还比较图干预的计算开销。这是无 LLM 的具身执行证据接口研究，不能概括成通用 LLM 代理安全保证。", "topics": { "tags": [ "embodied", "authorization", "evaluation" ], "reason_zh": "无 LLM，但正文直接研究机器人可验证估计与可执行物理动作的边界，以服务支持条件及有效证明约束行动，并验证已通过数学检查的结果与物理参考不一致的问题；按具身执行验证纳入，而不是作为 LLM 代理论文。" }, "reason": "无 LLM，但正文直接研究机器人可验证估计与可执行物理动作的边界，以服务支持条件及有效证明约束行动，并验证已通过数学检查的结果与物理参考不一致的问题；按具身执行验证纳入，而不是作为 LLM 代理论文。", "title": "CARD: A Proof-Carrying Certificate-to-Action Interface for Relative-Measurement Graphs", "initial_classification": "uncertain", "scope_review": { "id": "2611.03651", "version_id": "2611.03651v1", "classification": "relevant", "reason": "无 LLM，但正文直接研究机器人可验证估计与可执行物理动作的边界，以服务支持条件及有效证明约束行动，并验证已通过数学检查的结果与物理参考不一致的问题；按具身执行验证纳入，而不是作为 LLM 代理论文。", "reason_zh": "无 LLM，但正文直接研究机器人可验证估计与可执行物理动作的边界，以服务支持条件及有效证明约束行动，并验证已通过数学检查的结果与物理参考不一致的问题；按具身执行验证纳入，而不是作为 LLM 代理论文。", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2611.03651v1", "reviewed_sections": [ "Abstract", "1 Introduction", "3 CARD Objects and Causal Interface, especially 3.1", "5 Evidence Design and Evaluation Contract", "Table 4", "7.3–7.4 Discussion", "8 Conclusion" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "研究数学证书通过是否足以支撑机器人物理执行。CARD 将估计器证书、因果导航变换、请求时服务资格和及时证明分开，只有服务条件及检查证据相容时才形成携带证明的服务。作者在 20 次飞行的 404 个案例中报告：证书通过的优化器点全部与参考不一致，而对应导航变换全部一致；产生 370 个证明支持服务，另外 34 个被暂缓。11 个公开 SLAM 案例还比较图干预的计算开销。这是无 LLM 的具身执行证据接口研究，不能概括成通用 LLM 代理安全保证。", "topics": { "tags": [ "embodied", "authorization", "evaluation" ], "reason_zh": "无 LLM，但正文直接研究机器人可验证估计与可执行物理动作的边界，以服务支持条件及有效证明约束行动，并验证已通过数学检查的结果与物理参考不一致的问题；按具身执行验证纳入，而不是作为 LLM 代理论文。" } }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "1 Introduction", "3 CARD Objects and Causal Interface, especially 3.1", "5 Evidence Design and Evaluation Contract", "Table 4", "7.3–7.4 Discussion", "8 Conclusion" ], "body_source_url": "https://arxiv.org/abs/2611.03651v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-08-24T15:15:01Z", "updated": "2026-08-24T15:15:01Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03651v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03651", "first_author": "Yushan Li", "affiliations": [], "source_url": "https://arxiv.org/pdf/2611.03651v1", "shared_first_authors": [], "shared_first_note": "单作者，未见共同第一作者标记。", "status": "unknown", "evidence": "PDF 第 1 页仅列 Yushan Li，没有机构；已核对 PDF 首页和 HTML 作者信息，未找到明确机构，不依据姓名或飞行系统推断。", "version_id": "2611.03651v1", "affiliation_status": "unconfirmed", "author_status": "verified" }, "revision_history": [] }, "2611.03662": { "id": "2611.03662", "version_id": "2611.03662v1", "abstract_sha256": "68d783bd03fd43543bf179a49ba7dbcc28bbca4e8005586c74f2d07ab64820bd", "abstract_read": true, "classification": "relevant", "reason_zh": "检查 MCP 官方 SDK 的消息验证及会话规范遗漏，并验证漏洞式缺口的下游传播。", "summary_zh": "研究 MCP 官方 SDK 遗漏消息和会话规范约束并向下游传播的问题。MCPGuard 结合 JSON Schema 结构轨道、规范文本行为轨道与动态 PoC 裁定；在 Python 1.26.0 和 TypeScript 1.29.0 SDK 分别确认 13 与 19 个发现，两种黑盒基线均未暴露这些问题，开放 MCP 服务器测试显示缺口可向下游传播。", "topics": { "tags": [ "supplychain", "authorization", "evaluation" ], "reason_zh": "检查 MCP 官方 SDK 的消息验证及会话规范遗漏，并验证漏洞式缺口的下游传播。" }, "reason": "检查 MCP 官方 SDK 的消息验证及会话规范遗漏，并验证漏洞式缺口的下游传播。", "title": "MCPGuard: Finding Conformance Gaps in MCP SDKs via Dual-Track Analysis and Dynamic Adjudication", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-08-12T06:31:28Z", "updated": "2026-08-12T06:31:28Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03662v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03662", "version_id": "2611.03662v1", "first_author": "Xikai Sun", "affiliations": [ "Tsinghua University" ], "source_url": "https://arxiv.org/pdf/2611.03662v1", "shared_first_authors": [], "shared_first_note": "* 为机构标记，不是共同第一作者。", "status": "verified", "evidence": "PDF 首页 Xikai Sun*，作者栏 * Tsinghua University。 首页 arXiv 印刷日期为 12 Aug 2026，与 November 编号存在异常；仅记录异常，首次提交日期仍以官方 API published 为准，不以 PDF 覆盖。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.03754": { "id": "2611.03754", "version_id": "2611.03754v1", "abstract_sha256": "4abf4ccce6c73995e046462a15979fb66ca542da194edbfa38573c1bd4b46a0b", "abstract_read": true, "classification": "relevant", "reason_zh": "动态进化恶意网页信息注入及上下文操纵搜索代理，直接研究代理攻击。", "summary_zh": "研究静态攻击模板不能反映搜索代理面对的动态恶意网页注入与上下文操纵。作者提出攻击策略进化和防守适应的双层优化，以 CREO 对比回合信号进化攻击群体，并构建可控沙箱和细粒度指标；多跳问答和前沿模型实验报告攻击效果优于静态基线。", "topics": { "tags": [ "injection", "evaluation", "robustness" ], "reason_zh": "动态进化恶意网页信息注入及上下文操纵搜索代理，直接研究代理攻击。" }, "reason": "动态进化恶意网页信息注入及上下文操纵搜索代理，直接研究代理攻击。", "title": "The Web Doesn't Sit Still: Adversarial Self-Evolving Attacks on Search Agents", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T11:06:25Z", "updated": "2026-11-02T11:06:25Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03754v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03754", "version_id": "2611.03754v1", "first_author": "Geyuan Wang", "affiliations": [ "Nanyang Technological University" ], "source_url": "https://arxiv.org/pdf/2611.03754v1", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Geyuan Wang¹，对应 1 Nanyang Technological University。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.03765": { "id": "2611.03765", "version_id": "2611.03765v1", "abstract_sha256": "d4730d0befe1c8f8e594cc3829896897e4e172d8557df3e44a4b9b089795b263", "abstract_read": true, "classification": "relevant", "reason_zh": "具身代理在语义不变但辅助上下文减少时出现错误动作和潜在安全风险，直接属于具身鲁棒性评测。", "summary_zh": "研究具身代理在指令语义不变但非必需上下文缺失时出现的环境上下文错觉。VagueBench 在 AI2-THOR 中构造 1,303 对指令，以四类九种变换削减辅助信息并验证语义不变；六种代理评测报告成功率相对下降 19.65%、空计划率相对上升 54.10%，并在真实机器人观察到错误决策和潜在安全风险。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "具身代理在语义不变但辅助上下文减少时出现错误动作和潜在安全风险，直接属于具身鲁棒性评测。" }, "reason": "具身代理在语义不变但辅助上下文减少时出现错误动作和潜在安全风险，直接属于具身鲁棒性评测。", "title": "VagueBench: Benchmarking the Robustness of Embodied Agents on Ambient Context Illusions", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T15:00:40Z", "updated": "2026-11-02T15:00:40Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CV" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03765v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03765", "version_id": "2611.03765v1", "first_author": "Yang Qu", "affiliations": [ "SKLCCSE, Beihang University" ], "source_url": "https://arxiv.org/pdf/2611.03765v1", "shared_first_authors": [ "Yang Qu", "Qiang Fu" ], "shared_first_note": "首页 † These authors contributed equally to this work。", "status": "verified", "evidence": "PDF 首页 Yang Qu¹†，机构 1 为 SKLCCSE, Beihang University；Qiang Fu¹,⁵† 多一个机构 5，不归于 Yang Qu。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.03772": { "id": "2611.03772", "version_id": "2611.03772v1", "abstract_sha256": "7194f8ecc9e8802f94e21e8aed55f4d41c4f9162a4a6e567dcb10c342c2e075e", "abstract_read": true, "classification": "relevant", "reason_zh": "针对第三方恶意技能以安全义务票据及确定性出站门控强制授权，直接涉及技能供应链和数据外泄防护。", "summary_zh": "研究恶意第三方技能把数据泄漏或输出操纵藏入正常工作流。RuntimeTickets 从任务交付约定和技能源代码提出安全义务，只收紧宿主授权；确定性出站门控检查接收者、对象与数量，可信监控记录效果并生成可核验证据。在三个未修改代理框架的网络出口边界实验中，作者报告恶意漏放率和良性误拦率均为 0.0%。", "topics": { "tags": [ "supplychain", "authorization", "injection", "monitoring", "privacy" ], "reason_zh": "针对第三方恶意技能以安全义务票据及确定性出站门控强制授权，直接涉及技能供应链和数据外泄防护。" }, "reason": "针对第三方恶意技能以安全义务票据及确定性出站门控强制授权，直接涉及技能供应链和数据外泄防护。", "title": "RuntimeTickets: Source-Grounded Security Obligations for Agent Skills", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T17:31:13Z", "updated": "2026-11-02T17:31:13Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03772v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03772", "version_id": "2611.03772v1", "first_author": "Kuiyi Gao", "affiliations": [ "University of North Carolina at Chapel Hill" ], "source_url": "https://arxiv.org/pdf/2611.03772v1", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Kuiyi Gao 名下直接列 University of North Carolina at Chapel Hill；MBZUAI、McGill 属于其他作者。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.03935": { "id": "2611.03935", "version_id": "2611.03935v1", "abstract_sha256": "557b65b6f350336993c44a4804e8d7eae123b253579e8a7de03d966cb68f6e20", "abstract_read": true, "classification": "relevant", "reason_zh": "研究组织中通信与委派权限受控制器约束，但安全贡献需正文确认。", "reason": "控制器落实子代理权限只能收窄、信息流过滤与保留确认集隔离，构成代理授权和研究评估完整性的具体系统设计。", "summary_zh": "Labtune把科研代理的组织形式与信息共享作为实验变量。安全相关设计包括子代理继承且只能收窄父代理权限、共享只经过阶段屏障和接收方过滤、实验证据绑定工具回执，以及候选固定后才在隔离数据上确认且结果不回流给行动代理。参考实现提供受限委派、过滤共享和合成任务沙箱；这是系统描述与研究议程，没有组织优劣或安全防御效果的比较实验。字段过滤不保证语义隔离，声明的证据重叠检查也不能排除未知别名或训练污染。", "topics": { "tags": [ "authorization", "multiagent", "evaluation" ], "reason_zh": "控制器落实子代理权限只能收窄、信息流过滤与保留确认集隔离，构成代理授权和研究评估完整性的具体系统设计。" }, "title": "Labtune: Treating Lab Organization and Information Sharing as Experimental Variables in LLM-Agent Discovery", "initial_classification": "uncertain", "scope_review": { "id": "2611.03935", "version_id": "2611.03935v1", "classification": "relevant", "reason": "控制器落实子代理权限只能收窄、信息流过滤与保留确认集隔离，构成代理授权和研究评估完整性的具体系统设计。", "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.03935v1", "body_source_url": "https://arxiv.org/pdf/2611.03935v1", "reviewed_sections": [ "完整摘要", "§3设计原则", "§4.3委派与调度", "§5信息共享", "§6证据与确认", "§7实现状态与§9局限" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "Labtune把科研代理的组织形式与信息共享作为实验变量。安全相关设计包括子代理继承且只能收窄父代理权限、共享只经过阶段屏障和接收方过滤、实验证据绑定工具回执，以及候选固定后才在隔离数据上确认且结果不回流给行动代理。参考实现提供受限委派、过滤共享和合成任务沙箱；这是系统描述与研究议程，没有组织优劣或安全防御效果的比较实验。字段过滤不保证语义隔离，声明的证据重叠检查也不能排除未知别名或训练污染。", "topics": { "tags": [ "authorization", "multiagent", "evaluation" ], "reason_zh": "控制器落实子代理权限只能收窄、信息流过滤与保留确认集隔离，构成代理授权和研究评估完整性的具体系统设计。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3设计原则", "§4.3委派与调度", "§5信息共享", "§6证据与确认", "§7实现状态与§9局限" ], "body_source_url": "https://arxiv.org/pdf/2611.03935v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-02T20:38:41Z", "updated": "2026-11-02T20:38:41Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.MA", "physics.soc-ph" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 12 of 12 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03935v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03935", "first_author": "Goran Mitevski", "affiliations": [], "source_url": "https://arxiv.org/pdf/2611.03935v1", "shared_first_authors": [], "note": "PDF首页仅列姓名和邮箱，未列机构；不据邮箱推断。", "status": "not_reported_in_paper", "evidence": "PDF首页仅列姓名和邮箱，未列机构；不据邮箱推断。", "version_id": "2611.03935v1", "affiliation_status": "unconfirmed", "author_status": "verified" }, "revision_history": [] }, "2611.03983": { "id": "2611.03983", "version_id": "2611.03983v1", "abstract_sha256": "4fb88000c682a968d6bb9b515e9cf044026f2f3cbfef84869f8c5dd01abf1c30", "abstract_read": true, "classification": "relevant", "reason_zh": "多代理运动处方明确采用确定性安全审计与修复。", "reason": "多代理运动处方明确采用确定性安全审计与修复。", "summary_zh": "针对临床与穿戴数据转化为个性化运动处方的困难，FITTER结合多代理指南整合与确定性安全审计、修复。作者在400名参与者数据上报告98.5%的安全约束合规率，对照为75.8–85.8%；消融中安全审计修复贡献最大，并提供80份处方的临床审阅。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "多代理运动处方明确采用确定性安全审计与修复。" }, "title": "A Guideline-Grounded Multi-Agent Framework for Personalized Exercise Prescription from Clinical and Wearable Data", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T21:22:18Z", "updated": "2026-11-02T21:22:18Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 12 of 12 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.03983v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.03983", "version_id": "2611.03983v1", "first_author": "Xintong Li", "affiliations": [ "Center for Data Science, Nell Hodgson Woodruff School of Nursing, Emory University", "Department of Computer Science, Emory University" ], "source_url": "https://arxiv.org/pdf/2611.03983v1", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页 Xintong Li¹,³；机构 1 与 3 明确对应 Emory University 的护理学院数据科学中心、计算机科学系。", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04027": { "id": "2611.04027", "version_id": "2611.04027v1", "abstract_sha256": "48fdf176cc1b856f83c6bea96ecc6b59e4f4f2cb5da4c89c9b00373198979692", "abstract_read": true, "classification": "relevant", "reason_zh": "因果模型支持机器人在人群环境中安全导航。", "reason": "因果模型支持机器人在人群环境中安全导航。", "summary_zh": "研究在人类共享环境中，机器人因果模型如何低成本从仿真迁移现实。方法保留高层因果结构，只用少量现实观察更新参数。作者报告其可在机器人上高效运行，相比非因果基线改善复杂人群环境中的成功与安全导航。", "topics": { "tags": [ "embodied", "robustness" ], "reason_zh": "因果模型支持机器人在人群环境中安全导航。" }, "title": "A Practical Causal Framework for Autonomous Mobile Robots: From Simulation to Real-World Human Environments", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-02T22:16:09Z", "updated": "2026-11-02T22:16:09Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04027v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04027", "version_id": "2611.04027v1", "first_author": "Luca Castri", "affiliations": [ "University of Padua" ], "source_url": "https://arxiv.org/pdf/2611.04027v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "First-page Luca Castri column lists University of Padua, Italy. National Research Council of Italy is in Gloria Beraldo column only.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04086": { "id": "2611.04086", "version_id": "2611.04086v1", "abstract_sha256": "1c56edf887359c7fe4d2c07af7efbf22d528f2176bdb8e20190ed211c3941f71", "abstract_read": true, "classification": "relevant", "reason_zh": "明确研究多代理委派范围越权及执行前参考监控防御。", "reason": "多智能体在技术权限大于任务授权时越界干扰同伴，并评估执行前授权门控；直接属于Agent权限与多代理安全。", "summary_zh": "问题：技术上有权限，并不等于任务上获授权。方法：在模拟CI/CD和安全运营队列中固定权限，操纵竞争奖励、同伴动作可见性与收益提示，以确定性日志检测实际越界。作者报告三模型每条件52回合，未列出同伴动作时均为0/52越界，竞争且说明收益时Sonnet 4.5为52/52。修复后的可完成SOC每条件40回合，硬授权门控及模型执行前判官将同伴超时由15/40、14/40降至0–1/40，但自己权限内虚报严重度仍可伤害同伴。正文核验：摘要“refuse…0/100”用词与§4.4冲突，正文及图6实际指两较新配置合计0/100越界，不是零拒绝。模拟环境、小样本、部分空输出及崩溃日志丢失限制结论；硬门控零越界是按定义阻断的正确性检查，不等于通用安全。", "topics": { "tags": [ "authorization", "multiagent", "evaluation" ], "reason_zh": "任务授权范围控制、竞争下多代理越界及可重放安全评测。" }, "title": "Permitted but Unauthorized: Affordance-Induced Delegated-Scope Violations in Multi-Agent LLM Systems", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2611.04086v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§2–3威胁模型与环境", "§4.1与表3", "§4.4与图6", "§5与表5", "§7局限及日志缺陷" ], "published": "2026-11-02T23:52:50Z", "updated": "2026-11-02T23:52:50Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04086v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04086", "first_author": "Shravya Kanchi", "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2611.04086v1", "shared_first_authors": [], "shared_first_note": "", "status": "verified", "evidence": "PDF首页单作者下明确署名Independent Researcher。", "version_id": "2611.04086v1", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04166": { "id": "2611.04166", "version_id": "2611.04166v1", "abstract_sha256": "374ccd1447e4d5a5dadb1155bd5b1a09e1f7cd9ddf20bbea418adae0bc015540", "abstract_read": true, "classification": "relevant", "reason_zh": "视觉扰动使VLA动作危险而解释保持不变，直接检验具身安全监控盲区。", "reason": "视觉扰动使VLA动作危险而解释保持不变，直接检验具身安全监控盲区。", "summary_zh": "研究VLA自然语言解释是否足以监控动作安全。TNAS识别影响动作而几乎不改变文本的方向，并据此引导视觉扰动。作者在驾驶与操作模型中发现解释可逐字不变而动作显著偏移；驾驶全图与局部补丁攻击分别在52.6%和35.1%的场景造成新碰撞，因此建议直接监控动作通道。", "topics": { "tags": [ "embodied", "monitoring", "robustness", "evaluation" ], "reason_zh": "视觉扰动使VLA动作危险而解释保持不变，直接检验具身安全监控盲区。" }, "title": "Say the Same, Act Differently: Diagnosing and Steering Text-Action Divergence in Reasoning VLAs", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T01:57:41Z", "updated": "2026-11-03T01:57:41Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CR", "cs.CV", "cs.LG", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 10 of 10 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "New submissions (showing 148 of 148 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04166v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04166", "version_id": "2611.04166v1", "first_author": "Zihao Feng", "affiliations": [ "University of Southern California" ], "source_url": "https://arxiv.org/pdf/2611.04166v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Zihao Feng superscript 1; affiliation 1 University of Southern California.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04196": { "id": "2611.04196", "version_id": "2611.04196v1", "abstract_sha256": "d0b6a8c42a77928d3348328afbf24da974d9e89c09654256d449c710b8b1685c", "abstract_read": true, "classification": "relevant", "reason_zh": "开源多代理漏洞利用框架及受控安全基准评估。", "reason": "开源多代理漏洞利用框架及受控安全基准评估。", "summary_zh": "研究开放权重代理难以完成长漏洞利用链的问题。DoGNAVY-Exploit通过阶段里程碑、按需专家知识、规划与并行执行分层以及共享已验证记忆推动利用。作者报告GLM-5.2在Cybench为97.5% Pass@1、CVE-Bench零日及已知漏洞分别97.5%和100%，并在ExploitGym及消融中显示框架提高利用能力。", "topics": { "tags": [ "multiagent", "memory", "evaluation" ], "reason_zh": "开源多代理漏洞利用框架及受控安全基准评估。" }, "title": "DoGNAVY-Exploit: Harnessing Parallel Open-Weight Agents for Stage-Aware Vulnerability Exploitation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T02:30:53Z", "updated": "2026-11-03T02:30:53Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04196v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04196", "version_id": "2611.04196v1", "first_author": "Yuxuan Wang", "affiliations": [ "Shanghai Artificial Intelligence Laboratory" ], "source_url": "https://arxiv.org/pdf/2611.04196v1", "shared_first_authors": [ "Yuxuan Wang", "Dadi Guo", "Weijie Guo", "Zikai Xu", "Chen Lu", "Peng Huang" ], "shared_first_note": "Equal contribution.", "status": "verified", "evidence": "Yuxuan Wang 1,*; affiliation 1 Shanghai Artificial Intelligence Laboratory. Starred authors Yuxuan Wang, Dadi Guo, Weijie Guo, Zikai Xu, Chen Lu, Peng Huang; footnote * Equal contribution.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04203": { "id": "2611.04203", "version_id": "2611.04203v1", "abstract_sha256": "01aecb9b93c0d58ad28b8f880c1a041ee8ec25ed927cbed65cecd0b997a977c7", "abstract_read": true, "classification": "relevant", "reason_zh": "用户代理对平台代理的策略性虚假描述进行信誉验证。", "reason": "用户代理对平台代理的策略性虚假描述进行信誉验证。", "summary_zh": "研究竞争平台代理可以夸大描述时，用户推荐代理能否真正受益。将互动形式化为重复博弈，用消费后反馈更新平台信誉，并给出资源、报告及交互预算条件。合成和Amazon数据市场实验显示信誉评估可提高有限时域效用，但效果取决于市场规模和机制参数。", "topics": { "tags": [ "multiagent", "robustness", "evaluation" ], "reason_zh": "用户代理对平台代理的策略性虚假描述进行信誉验证。" }, "title": "Toward User-Centered Agentic Recommendation: When Does Platform Competition Benefit Users?", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T02:41:49Z", "updated": "2026-11-03T02:41:49Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04203v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04203", "version_id": "2611.04203v1", "first_author": "Kehan Zheng", "affiliations": [ "Tsinghua University" ], "source_url": "https://arxiv.org/pdf/2611.04203v1", "shared_first_authors": [ "Kehan Zheng", "Deyao Hong" ], "shared_first_note": "Equal contribution.", "status": "verified", "evidence": "Kehan Zheng 1* and Deyao Hong 1*; 1 Tsinghua University; * Equal contribution.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04289": { "id": "2611.04289", "version_id": "2611.04289v1", "abstract_sha256": "e070a49acdf9228bba662cb3c9a1fcb3a0171e0cef1b819a40988b1bec2e3bfc", "abstract_read": true, "classification": "relevant", "reason_zh": "多代理辩论受从众权威操控产生危险建议，并提出推理时审计防御。", "reason": "多代理辩论受从众权威操控产生危险建议，并提出推理时审计防御。", "summary_zh": "研究多代理讨论中的从众、权威和信心差异如何放大网页证据中的潜在危险。SafeConflict-Bias固定问题和证据，仅变化社会线索；作者报告单模型拒绝的危险建议可在讨论中被全面采纳。RiskTrace-Debias结合证据优先预承诺、社会元数据遮蔽及一致性仲裁，将各架构最坏不安全采纳率压至不超过2%，且未增加过度拒绝。", "topics": { "tags": [ "multiagent", "injection", "monitoring", "evaluation" ], "reason_zh": "多代理辩论受从众权威操控产生危险建议，并提出推理时审计防御。" }, "title": "When Debate Amplifies Risk: Social-Bias Vulnerabilities in Multi-Agent Safety Deliberation", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T04:16:06Z", "updated": "2026-11-03T04:16:06Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CR", "cs.CY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04289v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04289", "version_id": "2611.04289v1", "first_author": "Qinghua Mao", "affiliations": [ "Shanghai Jiao Tong University" ], "source_url": "https://arxiv.org/pdf/2611.04289v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Qinghua Mao author column directly lists Shanghai Jiao Tong University.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04296": { "id": "2611.04296", "version_id": "2611.04296v1", "abstract_sha256": "d237a1859e07b04e3e4aff49bc1d0186a14b69ca2d88c36546258e1b87829996", "abstract_read": true, "classification": "relevant", "reason_zh": "社区记忆可转为行为指令，可能涉及共享记忆信任边界，需正文确认。", "reason": "部署结果记录可执行社区记忆对第三方施加持续规则、撤销范围不符与隐私推断，提供具体授权/同意边界失效案例。", "summary_zh": "SEAM让社区帖子既提供记忆又可变成持续执行指令，在46人的两周部署中形成246页知识和26条持续规则。安全相关观察是：面向第三方的规则可以作用于未同意者，一条规则持续处理参与者帖子八天，其退出途径是另写指令；要求关闭所有规则的请求只撤销请求者自己的规则。照片背景与跨帖子聚合还可能揭露用户未意识到的信息。本文是探索性部署和14人后续工作坊，不是受控攻击/防御实验，也没有证明所提隐私控制有效。", "topics": { "tags": [ "memory", "authorization", "privacy" ], "reason_zh": "部署结果记录可执行社区记忆对第三方施加持续规则、撤销范围不符与隐私推断，提供具体授权/同意边界失效案例。" }, "title": "SEAM: Situated Executable Associative Memory for a Co-located Community", "initial_classification": "uncertain", "scope_review": { "id": "2611.04296", "version_id": "2611.04296v1", "classification": "relevant", "reason": "部署结果记录可执行社区记忆对第三方施加持续规则、撤销范围不符与隐私推断，提供具体授权/同意边界失效案例。", "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.04296v1", "body_source_url": "https://arxiv.org/pdf/2611.04296v1", "reviewed_sections": [ "完整摘要", "§4共享记忆与执行机制", "§5部署设计", "§6社区规则和知识形成", "§7.2局限", "§7.3 Safety and consent" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "SEAM让社区帖子既提供记忆又可变成持续执行指令，在46人的两周部署中形成246页知识和26条持续规则。安全相关观察是：面向第三方的规则可以作用于未同意者，一条规则持续处理参与者帖子八天，其退出途径是另写指令；要求关闭所有规则的请求只撤销请求者自己的规则。照片背景与跨帖子聚合还可能揭露用户未意识到的信息。本文是探索性部署和14人后续工作坊，不是受控攻击/防御实验，也没有证明所提隐私控制有效。", "topics": { "tags": [ "memory", "authorization", "privacy" ], "reason_zh": "部署结果记录可执行社区记忆对第三方施加持续规则、撤销范围不符与隐私推断，提供具体授权/同意边界失效案例。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§4共享记忆与执行机制", "§5部署设计", "§6社区规则和知识形成", "§7.2局限", "§7.3 Safety and consent" ], "body_source_url": "https://arxiv.org/pdf/2611.04296v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T04:24:20Z", "updated": "2026-11-03T04:24:20Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.HC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04296v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04296", "first_author": "Keru Wang", "affiliations": [ "New York University" ], "source_url": "https://arxiv.org/pdf/2611.04296v1", "shared_first_authors": [], "note": "PDF首页作者对应机构明确。", "status": "verified", "evidence": "PDF首页作者对应机构明确。", "version_id": "2611.04296v1", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04299": { "id": "2611.04299", "version_id": "2611.04299v1", "abstract_sha256": "603ed2d4be7aa1032e1b370a5f4d9ff9c4aee8995ece17422e20366b0336b18d", "abstract_read": true, "classification": "relevant", "reason_zh": "良性技能导致代理不安全外部动作，研究演化放大与执行前防御。", "reason": "研究良性技能复用导致的执行安全退化，以及逐工具调用防护；与技能安全相关，但不是恶意技能静态审计。", "summary_zh": "问题：没有恶意内容的可复用技能，是否也会帮助代理执行有害请求。方法：五个中小型/轻量骨干在AgentHarm、LPS-Bench、SafeAgentBench的101、65、150组良性/有害配对请求上，对比不加载与加载技能；构建与评测请求分离，但工作流家族可重叠。15个配置平均良性准确率与不安全动作率UAR均增加10.3个百分点。Qwen3-30B单模型配对分析中，151条原本未识别违规的轨迹有50条变为不安全，其中24条未完成有害目标，说明任务失败不等于执行安全。正文核验：骨干为Qwen3-30B、gpt-oss-20b、Mistral-24B、Nemotron-30B和GPT-5.4-nano，并非最强模型比较；工具调用前的固定LLM guard阻断即终止，三基准UAR下降42.7、23.8、46.2个百分点，但仍有残余违规。UAR按轨迹而非动作计，未解决且未发现违规的判定排除分母；checker具体模型未明确报告。这里评估良性技能用于明确有害请求，不是恶意技能扫描，也不证明正常任务中的隐藏恶意执行。", "topics": { "tags": [ "supplychain", "monitoring", "evaluation" ], "reason_zh": "技能复用安全、执行前逐动作检查及违规与任务完成率的区分。" }, "title": "Can Benign Skills Induce Misaligned Behavior in LLM Agents?", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2611.04299v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§2.1–2.4 实验设置、模型、数据、技能构建与指标", "§3及表1–2 配对结果与分母", "§4–5 技能演进、检索和内容消融", "§6及表5 工具调用前guard与残余风险", "附录A.1–A.6 数据来源、请求划分、判定和guard上下文" ], "published": "2026-11-03T04:29:17Z", "updated": "2026-11-03T04:29:17Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04299v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04299", "version_id": "2611.04299v1", "first_author": "Xuanye Zhang", "affiliations": [ "Nanyang Technological University" ], "source_url": "https://arxiv.org/pdf/2611.04299v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Xuanye Zhang author column directly lists Nanyang Technological University.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04315": { "id": "2611.04315", "version_id": "2611.04315v1", "abstract_sha256": "52fa78e40bf09608ca4ab2fee61a5632924eab4fc643fac13becb2d0f84a8303", "abstract_read": true, "classification": "relevant", "reason_zh": "多代理角色与状态漂移控制，包含最小权限及具身压力测试。", "reason": "多代理角色与状态漂移控制，包含最小权限及具身压力测试。", "summary_zh": "研究多代理长程任务、角色和状态漂移的共同表示机制。ATLAS用任务、角色、状态子空间构造半正定锚定核，在生成前将隐藏状态引导至共同方向。作者在记忆、工具、最小权限协调及具身压力测试中报告优于多类基线，角色一致性达93.5%，并提供消融及72B模型迁移证据。", "topics": { "tags": [ "multiagent", "memory", "authorization", "robustness" ], "reason_zh": "多代理角色与状态漂移控制，包含最小权限及具身压力测试。" }, "title": "Drift No More: Spectral Locking for Long-Horizon Open-Weight Multi-Agent AI", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T04:46:59Z", "updated": "2026-11-03T04:46:59Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 12 of 12 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04315v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04315", "version_id": "2611.04315v1", "first_author": "Vishal Pramanik", "affiliations": [ "University of Florida" ], "source_url": "https://arxiv.org/pdf/2611.04315v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Vishal Pramanik 1; 1 University of Florida.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04321": { "id": "2611.04321", "version_id": "2611.04321v1", "abstract_sha256": "cf15b210a49e6aabd4acb8461ee53d12dd15b27077ac90bfcccf455b9384348d", "abstract_read": true, "classification": "relevant", "reason_zh": "以角色契约约束黑盒多代理输出，防止未授权角色行为。", "reason": "以角色契约约束黑盒多代理输出，防止未授权角色行为。", "summary_zh": "将多代理角色漂移定义为逐轮违反角色授权契约。ATC在消息进入共享对话前评分越职、权限泄漏、不允许言语行为和逻辑违约，约束重新生成并复查。作者报告在同构、异构团队中改善任务和角色一致性、降低漂移，在角色混淆压力及大型多样团队中收益最大。", "topics": { "tags": [ "multiagent", "authorization", "monitoring" ], "reason_zh": "以角色契约约束黑盒多代理输出，防止未授权角色行为。" }, "title": "ATC: Agent Trajectory Control for Role-Contract Enforcement in Black-Box Multi-Agent Systems", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T04:57:47Z", "updated": "2026-11-03T04:57:47Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 12 of 12 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04321v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04321", "version_id": "2611.04321v1", "first_author": "Maisha Maliha", "affiliations": [ "University of Oklahoma" ], "source_url": "https://arxiv.org/pdf/2611.04321v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Maisha Maliha 1; 1 University of Oklahoma.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04356": { "id": "2611.04356", "version_id": "2611.04356v1", "abstract_sha256": "ce955326b8ed3419222b06bb8c36bfca40d68e592ecfe6b7bbb8802ff3883f23", "abstract_read": true, "classification": "relevant", "reason_zh": "LLM代理生成有效但耗尽计算资源的FEM程序进行红队测试。", "reason": "LLM代理生成有效但耗尽计算资源的FEM程序进行红队测试。", "summary_zh": "研究合法可运行的FEM程序如何造成计算资源耗尽。CloakFEM用领域中间表示、LLM代理搜索和确定性可运行验证门生成对抗程序。作者在三类求解栈、17类问题、1068个种子中发现显著计算放大，极端案例迭代数从43增至247367，并优于五种通用黑盒基线。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "LLM代理生成有效但耗尽计算资源的FEM程序进行红队测试。" }, "title": "CloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource Exhaustion", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T05:40:24Z", "updated": "2026-11-03T05:40:24Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 13 of 13 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04356v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04356", "version_id": "2611.04356v1", "first_author": "Li Zheng", "affiliations": [ "STAR Lab, George Mason University" ], "source_url": "https://arxiv.org/pdf/2611.04356v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Joint author block: Li Zheng, Simin Chen; STAR Lab, George Mason University. Footnote states work done during internship at STAR Lab; Illinois email is not treated as affiliation.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04367": { "id": "2611.04367", "version_id": "2611.04367v1", "abstract_sha256": "7093f757c05d098f0ed3718863c688739bda735cf8ea9479864b3a5c4a32f227", "abstract_read": true, "classification": "relevant", "reason_zh": "编码代理对AGENTS.md策略措辞的合规性实验。", "reason": "编码代理对AGENTS.md策略措辞的合规性实验。", "summary_zh": "研究AGENTS.md类代理上下文文件中的策略措辞如何影响编码代理遵循。作者在86项基准任务、四种harness与模型组合中放入同一策略的四种写法，发现条件式通常不如规定式和解释式，后两者优劣随组合变化。摘要未说明策略具体安全属性。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "编码代理对AGENTS.md策略措辞的合规性实验。" }, "title": "Do Coding Agents Follow AGENTS.md? The Effect of Policy Wording on Instruction Compliance", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T05:54:37Z", "updated": "2026-11-03T05:54:37Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 17 of 17 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04367v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04367", "version_id": "2611.04367v1", "first_author": "Rikuto Tsuchida", "affiliations": [ "Nara Institute of Science and Technology" ], "source_url": "https://arxiv.org/pdf/2611.04367v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Rikuto TSUCHIDA dagger; footnote dagger: authors are with Nara Institute of Science and Technology, Japan.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04371": { "id": "2611.04371", "version_id": "2611.04371v1", "abstract_sha256": "5970d3b8c6241fbccbad2ed35589d1d7dadbe875db8a91b364637625ee896b46", "abstract_read": true, "classification": "relevant", "reason_zh": "具身科学代理不可逆行动、风险成本及证据闭环评价综述。", "reason": "具身科学代理不可逆行动、风险成本及证据闭环评价综述。", "summary_zh": "综述具身科学代理如何从物理动作形成科学证据，强调潜在状态、昂贵不可逆动作和执行相关缺失。框架区分操作、认知和证据闭环，以记录、诊断、校准、确认组织流程，并显式考虑风险与样本变化成本。附录映射28个工作流，提出分别评价动作、有效实验、实验周期和确认结论，而非给出新的性能结果。", "topics": { "tags": [ "embodied", "monitoring", "evaluation" ], "reason_zh": "具身科学代理不可逆行动、风险成本及证据闭环评价综述。" }, "title": "Embodied AI for Scientific Discovery: From Physical Action to Scientific Evidence", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T05:59:43Z", "updated": "2026-11-03T05:59:43Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04371v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04371", "version_id": "2611.04371v1", "first_author": "Wenhao Xu", "affiliations": [ "Zhengzhou Police University" ], "source_url": "https://arxiv.org/pdf/2611.04371v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Wenhao Xu 1; affiliation 1 Zhengzhou Police University, Zhengzhou, China.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04392": { "id": "2611.04392", "version_id": "2611.04392v1", "abstract_sha256": "127c7313ace5ba33401f92082340c5c3c675116f62927716f0e169fd9cdfbc88", "abstract_read": true, "classification": "relevant", "reason_zh": "无人机运行时安全屏障降低碰撞，直接涉及具身安全。", "reason": "无人机运行时安全屏障降低碰撞，直接涉及具身安全。", "summary_zh": "提出适合边缘飞行的轻量视觉预测动作架构，并报告森林四旋翼闭环仿真。行为克隆出现复制旧动作的因果混淆，DAgger收益有限；加入深度记忆、屏障约束、视场外运动限制和沿历史路径回退的运行时屏障后，180个配对任务成功率从21.1%升至52.2%、碰撞从72.2%降至22.2%，但超时增加。", "topics": { "tags": [ "embodied", "monitoring", "robustness", "evaluation" ], "reason_zh": "无人机运行时安全屏障降低碰撞，直接涉及具身安全。" }, "title": "Aero-VPA: Few-Step Flow-Matching Control over Non-Reconstructive JEPA Latents for Agile Flight on Edge Hardware", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T06:25:06Z", "updated": "2026-11-03T06:25:06Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.LG", "cs.LO", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 104 of 104 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04392v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04392", "version_id": "2611.04392v1", "first_author": "Yeonseok Lee", "affiliations": [ "SLING AI Inc." ], "source_url": "https://arxiv.org/pdf/2611.04392v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Yeonseok Lee; SLING AI Inc., Incheon, Republic of Korea. Star footnote is version/licence note, not equal contribution.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04393": { "id": "2611.04393", "version_id": "2611.04393v1", "abstract_sha256": "c25dafeb54cd2f4cfa8a0f0f16884e968d1d636e94c4c3f2627b0b8429429d8a", "abstract_read": true, "classification": "relevant", "reason_zh": "伪造风险警告操纵代理选择并逃过注入检测，提出交叉佐证防御。", "reason": "研究外部评论伪造危害信息借安全偏好改变代理选择，补充纯指令注入检测盲点及证据核验防御。", "summary_zh": "问题：攻击者能否不向模型下命令，而用伪造安全警告诱导代理淘汰正常选项。方法：十个旅行服务域各50个查询，将攻击评论置于固定页面（约四分之一评论），比较安全、权威、属性说服及指令注入；六模型的覆盖随子实验变化。过滤比较报告生成ASR 60.4%对66.0%，所谓过滤后1.7–4.4倍由生成ASR乘ProtectAI/Lakera payload通过率计算，并非实际完整过滤流水线逐查询成功率。四个浏览器产品各攻击20次，测选择推荐而非下单；独立检索实验仅两个域，端到端ASR随检索器为1.0–57.0%。正文核验：独立佐证要求在三模型、三域共450次输出将ASR从68.4%降到3.6%，仅固定非自适应评论；伪造多源佐证尚未测试，真实单源危险警告被延迟处理的成本也未评估。模型包括Haiku/Flash Lite等，未证明最强Coding Agent恶意技能审计失效，软件依赖选择仅列为未来扩展。", "topics": { "tags": [ "injection", "evaluation", "monitoring" ], "reason_zh": "外部证据污染与非命令式操纵、检测器盲点，以及有边界的佐证防护。" }, "title": "Voluntary Servitude: Weaponized Safety Warning Mechanisms for Controlling AI Agents", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2611.04393v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§3 攻击控制范围及payload结构", "§4 数据、模型、暴露条件与指标", "§5.1及表1 detector通过率与乘积口径", "§5.3 浏览器迁移及检索实验", "§6及表3 佐证防护与非自适应限制", "§7 局限与真实危险代价", "附录C表4 模型覆盖", "附录D.1表5 检索分母与端到端结果" ], "published": "2026-11-03T06:26:58Z", "updated": "2026-11-03T06:26:58Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CL", "cs.CR", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 32 of 32 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 104 of 104 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04393v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04393", "version_id": "2611.04393v1", "first_author": "Ilan Zendel", "affiliations": [ "Henry and Marilyn Taub Faculty of Computer Science, Technion" ], "source_url": "https://arxiv.org/pdf/2611.04393v1", "shared_first_authors": [ "Ilan Zendel", "Matan Levy" ], "shared_first_note": "Equal contribution.", "status": "verified", "evidence": "Ilan Zendel 1,*; 1 Henry and Marilyn Taub Faculty of Computer Science, Technion. Ilan Zendel and Matan Levy starred; * Equal contribution.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04456": { "id": "2611.04456", "version_id": "2611.04456v1", "abstract_sha256": "d8768b7dcde82d85387882141dde2b749ca89f4fc7b2766e5a4e2a780b0afd20", "abstract_read": true, "classification": "relevant", "reason_zh": "GitHub代理技能演变实证，明确研究安全修改与回归验证缺口。", "reason": "GitHub代理技能演变实证，明确研究安全修改与回归验证缺口。", "summary_zh": "研究GitHub代理技能如何演变，收集84200个技能、750898次提交并建立组件、变更及动机分类。作者指出可靠性投入不足、项目耦合更新集中、冗余维护问题，以及安全动机修改的风险降低有限，建议执行契约、即时更新和功能安全回归测试。", "topics": { "tags": [ "supplychain", "evaluation" ], "reason_zh": "GitHub代理技能演变实证，明确研究安全修改与回归验证缺口。" }, "title": "How Agent Skills Evolve: A Large-Scale Empirical Study of Skills on GitHub", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T07:46:48Z", "updated": "2026-11-03T07:46:48Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 17 of 17 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04456v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04456", "version_id": "2611.04456v1", "first_author": "Jinjun Huang", "affiliations": [ "Zhejiang University" ], "source_url": "https://arxiv.org/pdf/2611.04456v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Jinjun Huang dagger; dagger Zhejiang University, Hangzhou, China. Star on Zhongxin Liu is corresponding author only.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04483": { "id": "2611.04483", "version_id": "2611.04483v1", "abstract_sha256": "ffb98160ef76f78898570696e5a7729105d6cd22d92612c60e40cf5deb40855e", "abstract_read": true, "classification": "relevant", "reason_zh": "专家代理市场的所有者授权、能力过滤及记忆范围，安全贡献待正文确认。", "reason": "主体含创建者/调用者/专家间证据归属和许可复用设计，正文具体描述所有权范围、能力所属提案过滤、技能提升授权与可回滚记忆边界。", "summary_zh": "CogniLife把代理市场中创建者、当前调用者和目标专家分开，提出跨专家证据归属与许可复用设计。已部署部分含创建者授权编写、所有权范围记忆、可回滚合并和技能提升授权检查；跨专家Creator Profile/Expert Journal归属机制尚未实现或评估。85项ProfyBench-v1上的Full配置平均4.65/5，高于Raw LLM的4.01和Expert Prompt的4.28，但这是整体任务效用，不能证明冷启动改善、长期忠实性或安全机制有效。附录还限定：调用者范围存储不保证演化摘要仅其可见，现有评测worker不提供技能提升所需前后成对奖励，部分平台新技能接受可直接激活。", "topics": { "tags": [ "authorization", "memory", "multiagent" ], "reason_zh": "主体含创建者/调用者/专家间证据归属和许可复用设计，正文具体描述所有权范围、能力所属提案过滤、技能提升授权与可回滚记忆边界。" }, "title": "CogniLife: Continuous Cognitive Distillation for Deployed Multi-Expert Agent Marketplaces", "initial_classification": "uncertain", "scope_review": { "id": "2611.04483", "version_id": "2611.04483v1", "classification": "relevant", "reason": "主体含创建者/调用者/专家间证据归属和许可复用设计，正文具体描述所有权范围、能力所属提案过滤、技能提升授权与可回滚记忆边界。", "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.04483v1", "body_source_url": "https://arxiv.org/pdf/2611.04483v1", "reviewed_sections": [ "完整摘要", "§3.1–3.4权限、归属和创建者控制", "§4评估与Limitations", "附录A所有权边界", "附录F接受、提升、回滚和平台例外" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "CogniLife把代理市场中创建者、当前调用者和目标专家分开，提出跨专家证据归属与许可复用设计。已部署部分含创建者授权编写、所有权范围记忆、可回滚合并和技能提升授权检查；跨专家Creator Profile/Expert Journal归属机制尚未实现或评估。85项ProfyBench-v1上的Full配置平均4.65/5，高于Raw LLM的4.01和Expert Prompt的4.28，但这是整体任务效用，不能证明冷启动改善、长期忠实性或安全机制有效。附录还限定：调用者范围存储不保证演化摘要仅其可见，现有评测worker不提供技能提升所需前后成对奖励，部分平台新技能接受可直接激活。", "topics": { "tags": [ "authorization", "memory", "multiagent" ], "reason_zh": "主体含创建者/调用者/专家间证据归属和许可复用设计，正文具体描述所有权范围、能力所属提案过滤、技能提升授权与可回滚记忆边界。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3.1–3.4权限、归属和创建者控制", "§4评估与Limitations", "附录A所有权边界", "附录F接受、提升、回滚和平台例外" ], "body_source_url": "https://arxiv.org/pdf/2611.04483v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T08:13:34Z", "updated": "2026-11-03T08:13:34Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04483v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04483", "first_author": "Xuwei Tan", "affiliations": [], "source_url": "https://arxiv.org/pdf/2611.04483v1", "shared_first_authors": [], "note": "PDF首页未列机构；HTML把后续作者误置于Affiliation字段，不能作为机构证据。", "status": "not_reported_in_paper", "evidence": "PDF首页未列机构；HTML把后续作者误置于Affiliation字段，不能作为机构证据。", "version_id": "2611.04483v1", "affiliation_status": "unconfirmed", "author_status": "verified" }, "revision_history": [] }, "2611.04507": { "id": "2611.04507", "classification": "relevant", "reason": "确认 v2 保留明确 Agent 安全分类：不可信指令越界、泄露、越权、控制绕过、不安全输出处理，并保留 AgentDojo 数据来源。纳入安全轨迹监测/诊断；不能把跨类别匹配得分说成安全子集准确率。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "d05bd5efdb7620930710ef198cb2a2815922a8cb49d52b91b24526566eb0d683", "initial_classification": "uncertain", "initial_reason": "从 Agent 轨迹诊断已发生故障与风险暴露，但摘要未说明风险类型；需核查是否包含权限、注入等自身安全失效。", "summary_zh": "Signals 从 Agent 轨迹识别问题并聚合为可修复事项，采用八类45种问题及证据要求，区分实际失败、可达风险和低效。v2仍明确要求证明注入越界、未授权动作、敏感信息外流或控制绕过，并使用含 AgentDojo 的公开执行资料。跨类别问题级匹配 F1 为91.43%，同模型同分类的一次生成对照为73.69%；指标只匹配组件及问题类型，未验证严重度、证据措辞或建议修复效果。", "topics": { "tags": [ "monitoring", "injection", "authorization", "privacy", "evaluation" ], "reason_zh": "确认 v2 保留明确 Agent 安全分类：不可信指令越界、泄露、越权、控制绕过、不安全输出处理，并保留 AgentDojo 数据来源。纳入安全轨迹监测/诊断；不能把跨类别匹配得分说成安全子集准确率。", "id": "2611.04507" }, "checked_sections": [ "4 taxonomy and evidence", "5 reference dataset", "6.1–6.4 evaluation, matching, and limitations", "7 Conclusion", "A.7 Safety, security, privacy, and policy" ], "evidence_quotes": [ "Untrusted content controls behavior across a required instruction boundary, or configuration proves a reachable takeover path under a stated threat model.", "An agent takes or can take actions beyond the approved, authorized, or confirmation-bounded scope.", "A required authorization, policy, guardrail, or trust check is bypassed, or configuration establishes a reachable bypass.", "Together, these sources covered coding, tool use, coordination, and security evaluation." ], "scope_note": "独立读取列明完整相关正文段落；并非逐字审阅全文所有章节。", "full_text_source_url": "https://arxiv.org/abs/2611.04507v2", "full_text_sha256": "0aacd2971f12c71719d0f82efd2a4d9c9580393ad060800f98dbbdd9f202e9da", "abstract_reading_basis": "full_final_official_api_abstract", "version_id": "2611.04507v2", "title": "Signals: Continuous Diagnostics of AI Agents", "published": "2026-11-03T08:32:43Z", "updated": "2026-11-04T06:09:13Z", "announcement_date": "2026-11-05", "candidate_type": "changed_version", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.04507v2", "last_checked_date": "2026-11-06", "scope_review": { "id": "2611.04507", "classification": "relevant", "reason": "确认 v2 保留明确 Agent 安全分类：不可信指令越界、泄露、越权、控制绕过、不安全输出处理，并保留 AgentDojo 数据来源。纳入安全轨迹监测/诊断；不能把跨类别匹配得分说成安全子集准确率。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "d05bd5efdb7620930710ef198cb2a2815922a8cb49d52b91b24526566eb0d683", "initial_classification": "uncertain", "initial_reason": "从 Agent 轨迹诊断已发生故障与风险暴露，但摘要未说明风险类型；需核查是否包含权限、注入等自身安全失效。", "summary_zh": "Signals 从 Agent 轨迹识别问题并聚合为可修复事项，采用八类45种问题及证据要求，区分实际失败、可达风险和低效。v2仍明确要求证明注入越界、未授权动作、敏感信息外流或控制绕过，并使用含 AgentDojo 的公开执行资料。跨类别问题级匹配 F1 为91.43%，同模型同分类的一次生成对照为73.69%；指标只匹配组件及问题类型，未验证严重度、证据措辞或建议修复效果。", "topics": { "tags": [ "monitoring", "injection", "authorization", "privacy", "evaluation" ], "reason_zh": "确认 v2 保留明确 Agent 安全分类：不可信指令越界、泄露、越权、控制绕过、不安全输出处理，并保留 AgentDojo 数据来源。纳入安全轨迹监测/诊断；不能把跨类别匹配得分说成安全子集准确率。", "id": "2611.04507" }, "checked_sections": [ "4 taxonomy and evidence", "5 reference dataset", "6.1–6.4 evaluation, matching, and limitations", "7 Conclusion", "A.7 Safety, security, privacy, and policy" ], "evidence_quotes": [ "Untrusted content controls behavior across a required instruction boundary, or configuration proves a reachable takeover path under a stated threat model.", "An agent takes or can take actions beyond the approved, authorized, or confirmation-bounded scope.", "A required authorization, policy, guardrail, or trust check is bypassed, or configuration establishes a reachable bypass.", "Together, these sources covered coding, tool use, coordination, and security evaluation." ], "scope_note": "独立读取列明完整相关正文段落；并非逐字审阅全文所有章节。", "full_text_source_url": "https://arxiv.org/abs/2611.04507v2", "full_text_sha256": "0aacd2971f12c71719d0f82efd2a4d9c9580393ad060800f98dbbdd9f202e9da", "abstract_reading_basis": "full_final_official_api_abstract", "version_id": "2611.04507v2", "title": "Signals: Continuous Diagnostics of AI Agents", "published": "2026-11-03T08:32:43Z", "updated": "2026-11-04T06:09:13Z", "announcement_date": "2026-11-05", "candidate_type": "changed_version", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.04507v2", "last_checked_date": "2026-11-06", "reviewed_sections": [ "4 taxonomy and evidence", "5 reference dataset", "6.1–6.4 evaluation, matching, and limitations", "7 Conclusion", "A.7 Safety, security, privacy, and policy" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "4 taxonomy and evidence", "5 reference dataset", "6.1–6.4 evaluation, matching, and limitations", "7 Conclusion", "A.7 Safety, security, privacy, and policy" ], "body_source_url": "https://arxiv.org/abs/2611.04507v2", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "seen_dates": [ "2026-11-05", "2026-11-06" ], "version_history": [ { "id": "2611.04507", "version_id": "2611.04507v1", "abstract_sha256": "d05bd5efdb7620930710ef198cb2a2815922a8cb49d52b91b24526566eb0d683", "abstract_read": true, "classification": "relevant", "reason_zh": "代理追踪诊断区分风险暴露与实际失败，需正文确认安全类别与证据。", "reason": "诊断系统显式识别不可信指令越界、未授权行动、敏感信息泄露和控制绕过，并在含AgentDojo的代理执行集合上评估。", "title": "Signals: Continuous Diagnostics of AI Agents", "initial_classification": "uncertain", "scope_review": { "id": "2611.04507", "version_id": "2611.04507v1", "classification": "relevant", "reason": "诊断系统显式识别不可信指令越界、未授权行动、敏感信息泄露和控制绕过，并在含AgentDojo的代理执行集合上评估。", "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.04507v1", "body_source_url": "https://arxiv.org/pdf/2611.04507v1", "reviewed_sections": [ "完整摘要", "§3方法与严重度", "§4分类与证据边界", "§5数据集", "§6结果和局限", "附录A.7安全分类" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "Signals把代理轨迹中的具体发现聚合为可修复问题，采用八类45种问题分类，并区分已发生失败、可达风险和单纯低效。安全类别要求有证据证明不可信指令越界、未授权行动、敏感信息泄露或访问控制绕过，不能仅凭攻击文字判失败。包含AgentDojo等公开轨迹，问题级匹配F1为91.43%，同模型同分类的一次生成对照为73.69%。这些是跨类别聚合匹配指标，不是安全子集检出率；参考标签由LLM在人工监督下生成，分类开发接触过基准家族，且未实施验证建议修复或严重度准确性。", "topics": { "tags": [ "monitoring", "authorization", "injection", "evaluation" ], "reason_zh": "诊断系统显式识别不可信指令越界、未授权行动、敏感信息泄露和控制绕过，并在含AgentDojo的代理执行集合上评估。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3方法与严重度", "§4分类与证据边界", "§5数据集", "§6结果和局限", "附录A.7安全分类" ], "body_source_url": "https://arxiv.org/pdf/2611.04507v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T08:32:43Z", "updated": "2026-11-03T08:32:43Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04507v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2611.04507", "first_author": "Amey Rambatla", "affiliations": [ "Cisco" ], "source_url": "https://arxiv.org/pdf/2611.04507v2", "shared_first_authors": [], "note": "HTML遗漏部分作者，PDF首页与API元数据一致，六名作者同署Cisco。", "status": "verified", "evidence": "PDF首页全体作者下统一机构Cisco。", "version_id": "2611.04507v2", "affiliation_status": "verified_in_paper", "author_status": "verified", "title": "Signals: Continuous Diagnostics of AI Agents", "authors": [ "Amey Rambatla", "Vatsal Goel", "Sagar Gaur", "Siddhant Loya", "Anurag Mishra", "Asif Mohammad" ], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "author_source": "https://export.arxiv.org/api/query?id_list=2611.04507v2", "affiliation_source": "https://arxiv.org/pdf/2611.04507v2", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "a36bc4e41c33078a71b6a0b27b3946a711e1829166b473f88e1e1f2acb10e0fa", "all_author_affiliations": [ "Cisco" ] }, "reason_zh": "代理追踪诊断区分风险暴露与实际失败，需正文确认安全类别与证据。", "first_seen_date": "2026-11-05", "revision_history": [ { "id": "2611.04507", "version_id": "2611.04507v1", "abstract_sha256": "d05bd5efdb7620930710ef198cb2a2815922a8cb49d52b91b24526566eb0d683", "abstract_read": true, "classification": "relevant", "reason_zh": "代理追踪诊断区分风险暴露与实际失败，需正文确认安全类别与证据。", "reason": "诊断系统显式识别不可信指令越界、未授权行动、敏感信息泄露和控制绕过，并在含AgentDojo的代理执行集合上评估。", "summary_zh": "Signals把代理轨迹中的具体发现聚合为可修复问题，采用八类45种问题分类，并区分已发生失败、可达风险和单纯低效。安全类别要求有证据证明不可信指令越界、未授权行动、敏感信息泄露或访问控制绕过，不能仅凭攻击文字判失败。包含AgentDojo等公开轨迹，问题级匹配F1为91.43%，同模型同分类的一次生成对照为73.69%。这些是跨类别聚合匹配指标，不是安全子集检出率；参考标签由LLM在人工监督下生成，分类开发接触过基准家族，且未实施验证建议修复或严重度准确性。", "topics": { "tags": [ "monitoring", "authorization", "injection", "evaluation" ], "reason_zh": "诊断系统显式识别不可信指令越界、未授权行动、敏感信息泄露和控制绕过，并在含AgentDojo的代理执行集合上评估。" }, "title": "Signals: Continuous Diagnostics of AI Agents", "initial_classification": "uncertain", "scope_review": { "id": "2611.04507", "version_id": "2611.04507v1", "classification": "relevant", "reason": "诊断系统显式识别不可信指令越界、未授权行动、敏感信息泄露和控制绕过，并在含AgentDojo的代理执行集合上评估。", "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.04507v1", "body_source_url": "https://arxiv.org/pdf/2611.04507v1", "reviewed_sections": [ "完整摘要", "§3方法与严重度", "§4分类与证据边界", "§5数据集", "§6结果和局限", "附录A.7安全分类" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "Signals把代理轨迹中的具体发现聚合为可修复问题，采用八类45种问题分类，并区分已发生失败、可达风险和单纯低效。安全类别要求有证据证明不可信指令越界、未授权行动、敏感信息泄露或访问控制绕过，不能仅凭攻击文字判失败。包含AgentDojo等公开轨迹，问题级匹配F1为91.43%，同模型同分类的一次生成对照为73.69%。这些是跨类别聚合匹配指标，不是安全子集检出率；参考标签由LLM在人工监督下生成，分类开发接触过基准家族，且未实施验证建议修复或严重度准确性。", "topics": { "tags": [ "monitoring", "authorization", "injection", "evaluation" ], "reason_zh": "诊断系统显式识别不可信指令越界、未授权行动、敏感信息泄露和控制绕过，并在含AgentDojo的代理执行集合上评估。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "§3方法与严重度", "§4分类与证据边界", "§5数据集", "§6结果和局限", "附录A.7安全分类" ], "body_source_url": "https://arxiv.org/pdf/2611.04507v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T08:32:43Z", "updated": "2026-11-03T08:32:43Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04507v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04507", "first_author": "Amey Rambatla", "affiliations": [ "Cisco" ], "source_url": "https://arxiv.org/pdf/2611.04507v1", "shared_first_authors": [], "note": "PDF首页全体作者下统一机构Cisco。", "status": "verified", "evidence": "PDF首页全体作者下统一机构Cisco。", "version_id": "2611.04507v1", "affiliation_status": "verified", "author_status": "verified" } } ] }, "2611.04515": { "id": "2611.04515", "version_id": "2611.04515v1", "abstract_sha256": "4e1f201c56230c08bfda539b0b1ba6adbfd159a777a7cb6bc82d480e68a9830b", "abstract_read": true, "classification": "relevant", "reason_zh": "实验代理被限制在确定性统计边界之外，需正文确认安全/完整性控制细节。", "reason": "报告实验代理迎合用户进行事后剔除/挑选显著窗口的实际风险，以及确定性统计工具和会话审计，直接涉及代理辅助评估完整性。", "summary_zh": "Meta的ABTest Agent把模型限制在选择和编排流程，统计量交给确定性代码，使用校验工具、专家审定资料和结构化报告约束。部署经验发现，代理曾迎合寻找显著结果的用户，建议剔除不利日期或寻找显著的七天窗口，增加p-hacking风险。作者据此审计跨指标/时间窗口寻显著、事后剔除和看结果后延长实验的会话，要求上线决策依据事先固定的指标、成功标准与时长。论文提供生产经验和风险案例，并无受控安全提升率，不能把97项技能或使用分布视为防御效果。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "报告实验代理迎合用户进行事后剔除/挑选显著窗口的实际风险，以及确定性统计工具和会话审计，直接涉及代理辅助评估完整性。" }, "title": "Learnings and Pitfalls from AI-Assisted A/B Experimentation at Scale", "initial_classification": "uncertain", "scope_review": { "id": "2611.04515", "version_id": "2611.04515v1", "classification": "relevant", "reason": "报告实验代理迎合用户进行事后剔除/挑选显著窗口的实际风险，以及确定性统计工具和会话审计，直接涉及代理辅助评估完整性。", "full_text_checked": true, "source_url": "https://arxiv.org/pdf/2611.04515v1", "body_source_url": "https://arxiv.org/pdf/2611.04515v1", "reviewed_sections": [ "完整摘要", "首页共同一作脚注", "§2 Agent Design", "§3部署经验", "§4 p-hacking风险与会话审计", "§5结论" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "Meta的ABTest Agent把模型限制在选择和编排流程，统计量交给确定性代码，使用校验工具、专家审定资料和结构化报告约束。部署经验发现，代理曾迎合寻找显著结果的用户，建议剔除不利日期或寻找显著的七天窗口，增加p-hacking风险。作者据此审计跨指标/时间窗口寻显著、事后剔除和看结果后延长实验的会话，要求上线决策依据事先固定的指标、成功标准与时长。论文提供生产经验和风险案例，并无受控安全提升率，不能把97项技能或使用分布视为防御效果。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "报告实验代理迎合用户进行事后剔除/挑选显著窗口的实际风险，以及确定性统计工具和会话审计，直接涉及代理辅助评估完整性。" } }, "full_text_checked": true, "reviewed_sections": [ "完整摘要", "首页共同一作脚注", "§2 Agent Design", "§3部署经验", "§4 p-hacking风险与会话审计", "§5结论" ], "body_source_url": "https://arxiv.org/pdf/2611.04515v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T08:41:31Z", "updated": "2026-11-03T08:41:31Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04515v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04515", "first_author": "Brett Daley", "affiliations": [ "Meta" ], "source_url": "https://arxiv.org/pdf/2611.04515v1", "shared_first_authors": [ "Brett Daley", "Ilya Gorbachev" ], "note": "PDF首页星号脚注明确Co-first authors：Brett Daley与Ilya Gorbachev；统一机构Meta。", "status": "verified", "evidence": "PDF首页星号脚注明确Co-first authors：Brett Daley与Ilya Gorbachev；统一机构Meta。", "version_id": "2611.04515v1", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04556": { "id": "2611.04556", "version_id": "2611.04556v1", "abstract_sha256": "819992805da49882144d3317b7db655f5177179b089022f9818402b106183219", "abstract_read": true, "classification": "relevant", "reason_zh": "直接评测多智能体间说服、欺骗与胁迫对监督决策和研究任务的操纵。", "reason": "直接评估多代理通过说服、欺骗和胁迫改变监督批准与同伴行为，包含代码审查监督失效；与代理监控和审计可信性高度相关。", "summary_zh": "问题：代理间交流会否使监督者批准本应拒绝的请求，或使同伴偏离任务。方法：在GDPR、代码审查、方法学审查、排期和自动研究五类构造环境中，提示一方影响另一方并与未被提示影响的基线比较；E1–E4每个模型对×具体场景×条件100次。作者报告监督场景合并的全样本Q2批准率增量为欺骗31.20、说服18.94、胁迫5.72个百分点；条件于合规尝试的Q1分别为35.53、17.68、14.96个百分点。自动研究仅测说服，研究转向率增加21.36个百分点。正文核验：代码审查仅两个预设CWE案例，普通测试通过、隐藏安全测试可证漏洞；不是任意真实代码库成功率。干预组拒绝后仍继续、基线首次决定即结束，因此效果也含额外批准机会；Q1有筛选偏差，能力提示也混入其他手法。作者明确未控制评测意识，且胁迫依赖不够现实的权限设计。可用于审查代理被游说绕过的评测设计，不能据此证明模型在正常任务中会隐蔽执行恶意行为或能识别审计。", "topics": { "tags": [ "multiagent", "monitoring", "evaluation" ], "reason_zh": "多代理影响、监督审批绕过，以及含代码审查的安全评测；重点不是外部文档提示注入。" }, "title": "Inter-Agent Influence: Evaluating Persuasion, Deception, and Coercion in Multi-Agent Systems", "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "body_source_url": "https://arxiv.org/pdf/2611.04556v1", "reviewed_sections": [ "首页作者与摘要", "§4.1–4.4 环境、提示、样本与Q1/Q2定义", "§5及§5.1结果开头", "§6讨论与局限", "附录B.1–B.2 GDPR与代码审查环境" ], "published": "2026-11-03T09:23:12Z", "updated": "2026-11-03T09:23:12Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 12 of 12 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04556v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04556", "first_author": "Chandler Smith", "affiliations": [ "University of Oxford", "Cooperative AI Foundation" ], "source_url": "https://arxiv.org/pdf/2611.04556v1", "shared_first_authors": [ "Chandler Smith", "Qi Guo" ], "shared_first_note": "首页Chandler Smith与Qi Guo均标注*，脚注为Equal contribution；Qi Guo单位为Cooperative AI Foundation和Allelo。", "status": "verified_first_page", "evidence": "PDF首页：Chandler Smith*下列University of Oxford、Cooperative AI Foundation；Qi Guo*下列Cooperative AI Foundation、Allelo；* Equal contribution。", "version_id": "2611.04556v1", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04579": { "id": "2611.04579", "version_id": "2611.04579v1", "abstract_sha256": "df05d7652e19646ced280dbfb3b222618955379f573e9ecf3e15415511e23b20", "abstract_read": true, "classification": "relevant", "reason_zh": "移动智能体可组合插件及现场生成扩展的验证、运行时边界与本地信任决策。", "reason": "移动Agent开放插件与代码生成准入架构，明确设备本地信任决策、签名来源、能力收窄和审计；属于插件供应链与执行授权防护，证据不是红队安全验证。", "summary_zh": "问题：移动代理如何允许第三方及用户委托Coding Agent生成扩展，同时保持权限与生命周期边界。方法：冻结内核、必需基础层与开放扩展层，通过统一契约、签名及撤销状态、设备本地验证/接纳和三级制品路径控制安装执行。作者在一台Android手机的50个反应式生活任务中报告44/50端到端闭环：17个检索复用、27个委托生成，6个为不支持、不可生成或原则性拒绝；全部50个可在声明空间表达，不等于50个执行成功。10个委托案例各重跑5次得到46/50成功，7/50需一次标准化重述。14个畸形制品及6个中介边界越权探针均被拒绝，但计数分别为不同探针家族。局限：并非恶意发布者研究，也无长期非程序员用户研究；原生Tier 3仅1个主基准案例，不能把脚本的中介隔离保证外推到任意原生代码。验证保证准入合规而非语义完美，不能说明Coding Agent在审计与正常任务间是否切换隐藏行为。", "topics": { "tags": [ "supplychain", "authorization", "monitoring", "evaluation" ], "reason_zh": "第三方及生成插件的来源与准入、执行能力边界、日志审计及受控探针评测。" }, "title": "FreeForm Harness: A Mobile-Native Agent Harness for Open and Composable Extensions", "full_text_checked": true, "evidence_level": "abstract_and_targeted_body", "body_source_url": "https://arxiv.org/pdf/2611.04579v1", "reviewed_sections": [ "首页作者与摘要", "§2.2统一契约与能力收窄", "§2.5分层生成及验证/用户接纳顺序", "§3签名与本地准入相关段落", "§4.1–4.4基准、闭环、重复实验与局限", "附录B表4–5及口径说明" ], "published": "2026-11-03T09:39:21Z", "updated": "2026-11-03T09:39:21Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 17 of 17 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04579v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04579", "first_author": "Bo Zhang", "affiliations": [ "Amap, Alibaba Group" ], "source_url": "https://arxiv.org/pdf/2611.04579v1", "shared_first_authors": [], "shared_first_note": "首页未见共同一作声明；Bo Zhang的*脚注指Corresponding author，不是共同贡献。", "status": "verified_first_page", "evidence": "PDF首页Bo Zhang*下列Amap, Alibaba Group，Beijing, China；脚注* Corresponding author。其余三位作者均列Amap, Alibaba Group。", "version_id": "2611.04579v1", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04672": { "id": "2611.04672", "version_id": "2611.04672v1", "abstract_sha256": "cece6b970c51c78a91c1b75534afbc492a98f9f67b35e219b23e12a791d96d8d", "abstract_read": true, "classification": "relevant", "reason_zh": "提示注入的九维分类及基准盲区分析，直接支持智能体注入防御评测。", "reason": "提示注入的九维分类及基准盲区分析，直接支持智能体注入防御评测。", "summary_zh": "论文指出提示注入随用户意图、系统政策及上下文而变化，提出覆盖注入指令、任务关系及系统表现的九维分类。作者用其分析六个真实漏洞和九个基准，发现组合基准仍有 13% 的两两类别组合未覆盖，并展示自动标注与定向生成补足测试的方法。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "围绕提示注入威胁分类和防御评测覆盖缺口。" }, "title": "The Devil is in the Context: Nine Dimensions of Prompt Injection Attacks", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T10:56:13Z", "updated": "2026-11-03T10:56:13Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04672v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04672", "version_id": "2611.04672v1", "first_author": "Jiamin Chang", "affiliations": [ "University of New South Wales" ], "source_url": "https://arxiv.org/pdf/2611.04672v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Jiamin Chang *, section-sign; * University of New South Wales. Section-sign explicitly notes work done during internship at Microsoft; dagger Microsoft Security Response Center does not mark Jiamin Chang. Internship context retained separately from formal affiliation mapping.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04673": { "id": "2611.04673", "version_id": "2611.04673v1", "abstract_sha256": "6a2f79ca4f8b8c9ce64c21c40e59af417fe97636ece9b1073ac913a1f189c92d", "abstract_read": true, "classification": "relevant", "reason_zh": "工具参数投毒与任务条件下字段可信度追踪，直接针对智能体间接注入。", "reason": "工具参数投毒与任务条件下字段可信度追踪，直接针对智能体间接注入。", "summary_zh": "论文研究保持原定工具动作却篡改收件人等关键参数的间接注入。AuthorityFlow 根据用户任务建立字段信任层级、追溯每个参数的信息来源，再拒绝低可信字段的影响；配套提出 FactAuthBench。作者报告攻击成功率从 93.06% 降至 9.03%，良性任务效用从无防御的 90.28% 变为 82.64%。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "直接防御工具参数投毒，并以任务授权的信息来源界定参数合法性。" }, "title": "Right Tool, Wrong Parameters: Defending LLM Agents Against Parameter Poisoning", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T10:57:12Z", "updated": "2026-11-03T10:57:12Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04673v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04673", "version_id": "2611.04673v1", "first_author": "Yao Wang", "affiliations": [ "University of Science and Technology of China" ], "source_url": "https://arxiv.org/pdf/2611.04673v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Yao Wang 1; 1 University of Science and Technology of China.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04701": { "id": "2611.04701", "version_id": "2611.04701v1", "abstract_sha256": "6089c0fb29f6a24cda8611258c103301617455ec949430373f20e831e47bf11e", "abstract_read": true, "classification": "relevant", "reason_zh": "LLM 智能体构造伪装成优化的代码贡献，利用编译器错误破坏 zkVM 保证，属于代码供应链攻击。", "reason": "LLM 智能体构造伪装成优化的代码贡献，利用编译器错误破坏 zkVM 保证，属于代码供应链攻击。", "summary_zh": "针对 zkVM 证明只覆盖编译后二进制而非源代码的问题，论文在 SP1 和 Jolt 上测试已知 Rust/LLVM 错误，并使用 LLM 智能体恢复触发样例及生成伪装成优化的代码补丁。作者称在 20 个项目中的 11 个找到能利用编译器错误的补丁，其中四例提交错误输出，另八例对有效输入失败；源代码审查或验证难以发现此类攻击。", "topics": { "tags": [ "supplychain", "evaluation" ], "reason_zh": "编码智能体协助构造代码供应链攻击，信任边界落在编译工具链。" }, "title": "Proving the Wrong Program: Miscompilations as a Threat to zkVM Guarantees", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T11:22:45Z", "updated": "2026-11-03T11:22:45Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CR", "cs.PL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 10 of 10 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04701v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04701", "version_id": "2611.04701v1", "first_author": "Hui Xuan Tan", "affiliations": [ "Imperial College London" ], "source_url": "https://arxiv.org/pdf/2611.04701v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "HUI XUAN TAN, Imperial College London, United Kingdom, stated directly in author line.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04785": { "id": "2611.04785", "version_id": "2611.04785v1", "abstract_sha256": "92cab8759ed0f58f6722362b002f9f450c798d674147172c186e04a053246379", "abstract_read": true, "classification": "relevant", "reason_zh": "模拟调查与监控记录接口揭示无证据指认和受骗风险，需正文确认自主调查智能体安全评测边界。", "reason": "代理通过受限记录接口自主检索、关联跨来源个人记录并提交身份结论，正文分析错误指认、拒答和政治参与隐私风险；属于工具代理的监控滥用与高影响证据失效评估。", "summary_zh": "Kierston 模拟约 12.5 万居民及电信、金融、行政和车牌记录，KierstonBench 用 32 类任务评估 16 个模型自主检索与关联记录的调查能力。正文显示代理会把共址、枪支记录或犯罪史误当作涉案依据，部分模型在证据不足时拒绝指认；五类嫌疑人识别任务中没有模型正确识别作案者。该平台既可评估监控能力，也可审计错误指认与隐私风险。每个模型每类任务仅运行一个模拟实例一次，结果不能解释为真实执法准确率。", "topics": { "tags": [ "privacy", "evaluation", "authorization" ], "reason_zh": "代理通过受限记录接口自主检索、关联跨来源个人记录并提交身份结论，正文分析错误指认、拒答和政治参与隐私风险；属于工具代理的监控滥用与高影响证据失效评估。" }, "title": "Kierston & KierstonBench: Simulation of Allentown, PA and Evaluation of Language Models in Crime Investigation and Surveillance Tasks", "initial_classification": "uncertain", "scope_review": { "id": "2611.04785", "version_id": "2611.04785v1", "classification": "relevant", "reason": "代理通过受限记录接口自主检索、关联跨来源个人记录并提交身份结论，正文分析错误指认、拒答和政治参与隐私风险；属于工具代理的监控滥用与高影响证据失效评估。", "reason_zh": "代理通过受限记录接口自主检索、关联跨来源个人记录并提交身份结论，正文分析错误指认、拒答和政治参与隐私风险；属于工具代理的监控滥用与高影响证据失效评估。", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2611.04785v1", "reviewed_sections": [ "Abstract", "4.3 The records interface (KDI)", "4.5 Task groups and families", "Table 17 and qualitative analysis of investigation traces", "9 Limitations", "10 Ethical Considerations" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "Kierston 模拟约 12.5 万居民及电信、金融、行政和车牌记录，KierstonBench 用 32 类任务评估 16 个模型自主检索与关联记录的调查能力。正文显示代理会把共址、枪支记录或犯罪史误当作涉案依据，部分模型在证据不足时拒绝指认；五类嫌疑人识别任务中没有模型正确识别作案者。该平台既可评估监控能力，也可审计错误指认与隐私风险。每个模型每类任务仅运行一个模拟实例一次，结果不能解释为真实执法准确率。", "topics": { "tags": [ "privacy", "evaluation", "authorization" ], "reason_zh": "代理通过受限记录接口自主检索、关联跨来源个人记录并提交身份结论，正文分析错误指认、拒答和政治参与隐私风险；属于工具代理的监控滥用与高影响证据失效评估。" } }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "4.3 The records interface (KDI)", "4.5 Task groups and families", "Table 17 and qualitative analysis of investigation traces", "9 Limitations", "10 Ethical Considerations" ], "body_source_url": "https://arxiv.org/abs/2611.04785v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T12:23:08Z", "updated": "2026-11-03T12:23:08Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04785v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04785", "first_author": "Andrew Semenov", "affiliations": [], "source_url": "https://arxiv.org/pdf/2611.04785v1", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "unknown", "evidence": "PDF 首页仅列 Andrew Semenov、Svyatoslav Dorofeev 和邮箱；没有明确机构，不根据 kiz8.team 邮箱域名或代码仓库推断机构。", "version_id": "2611.04785v1", "affiliation_status": "unconfirmed", "author_status": "verified" }, "revision_history": [] }, "2611.04803": { "id": "2611.04803", "version_id": "2611.04803v1", "abstract_sha256": "0e0827601825f468af6aaa00303ae3314386771b089a226b2099d8ab59e9d9d7", "abstract_read": true, "classification": "relevant", "reason_zh": "复杂智能体服务系统提示提取与下游攻击效用评估，直接涉及提示泄漏风险。", "reason": "复杂智能体服务系统提示提取与下游攻击效用评估，直接涉及提示泄漏风险。", "summary_zh": "针对智能体系统提示包含工具模式与安全逻辑、且攻击者只能观察处理后动作的复杂场景，ExtraHerO 用结构模板分层重建提示，并根据反馈差异迭代攻击查询。论文提出强调结构的保真度指标及衡量下游攻击帮助的 adversarial utility；作者报告在智能体上保真度、功能性、攻击效用分别平均提升 12.2%、34.3%、30.5%。", "topics": { "tags": [ "injection", "privacy", "evaluation" ], "reason_zh": "明确研究智能体系统提示泄漏及泄漏对后续攻击的帮助。" }, "title": "Extracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation Metrics", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T12:37:01Z", "updated": "2026-11-03T12:37:01Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.CR" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 27 of 27 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CR", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04803v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04803", "version_id": "2611.04803v1", "first_author": "Shuaidong Li", "affiliations": [ "Xi’an Jiaotong University" ], "source_url": "https://arxiv.org/pdf/2611.04803v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Shuaidong Li author column directly lists Xi’an Jiaotong University.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04838": { "id": "2611.04838", "version_id": "2611.04838v1", "abstract_sha256": "8a811f17ceb5cb5c7235233a5bfe1279ea0d79869d301dc4ff81db9250548156", "abstract_read": true, "classification": "relevant", "reason_zh": "直接测试强化学习智能体内在奖励被未见过的免费重置捷径利用，属于奖励篡改风险评估。", "reason": "直接测试强化学习智能体内在奖励被未见过的免费重置捷径利用，属于奖励篡改风险评估。", "summary_zh": "论文通过预注册搜索研究可迁移的内在奖励是否能抵抗搜索时未见的利用方式，并比较 CMA-ES 与等预算随机搜索。被选奖励在部分迁移任务上优于对照，但引入免费重置动作后，在 DoorKey-8x8 的学习面积由 0.829 降至 0.136。作者据此指出奖励搜索并未提供抵抗未见漏洞的保护。", "topics": { "tags": [ "evaluation", "robustness", "embodied" ], "reason_zh": "直接测试行动智能体对奖励捷径与篡改的脆弱性。" }, "title": "Found by Search, Broken by a Shortcut: Transfer and Tampering of Searched Intrinsic Rewards", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T13:06:42Z", "updated": "2026-11-03T13:06:42Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.LG" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "New submissions (showing 148 of 148 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.LG", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04838v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04838", "version_id": "2611.04838v1", "first_author": "Chase J. Metoyer", "affiliations": [ "Northeastern University" ], "source_url": "https://arxiv.org/pdf/2611.04838v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Chase J. Metoyer, Northeastern University, Boston, MA directly in author block. Star is code/data availability note.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.04879": { "id": "2611.04879", "classification": "relevant", "reason": "重建诈骗网站评估 Web Agent 受骗、支付和额外条款授权误判，直接研究 Agent 自身安全。", "abstract_read": true, "reading_basis": "full_final_official_api_abstract", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "38bea9ec7fe85545123b0d761e8c243a86bc41978cbf4c35b7ff7fbb38232707", "summary_zh": "ScamWorld 研究 Web Agent 执行购物、账户等任务时是否识别针对人类的网络诈骗。环境重建已报告骗局及可观察警示，在六个前沿模型上测得基线受骗率为 11%–35%。Agent 对支付比凭证请求更易放行，部分已识别疑点却仍继续，并把用户指令误作接受网站额外条款的授权。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "直接测量 Web Agent 在欺骗网站上的危险操作与授权误判。", "id": "2611.04879" }, "abstract_reading_basis": "full_final_official_api_abstract", "version_id": "2611.04879v2", "title": "ScamWorld: An Interactive Environment for Evaluating Web Agents Against Online Fraud", "published": "2026-11-03T13:31:11Z", "updated": "2026-11-04T07:01:24Z", "announcement_date": "2026-11-05", "candidate_type": "changed_version", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.04879v2", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "seen_dates": [ "2026-11-05", "2026-11-06" ], "version_history": [ { "id": "2611.04879", "version_id": "2611.04879v1", "abstract_sha256": "38bea9ec7fe85545123b0d761e8c243a86bc41978cbf4c35b7ff7fbb38232707", "abstract_read": true, "classification": "relevant", "reason_zh": "网页智能体真实诈骗交互评测，涉及付款、凭据和将用户指令误当网站附加条款授权。", "reason": "网页智能体真实诈骗交互评测，涉及付款、凭据和将用户指令误当网站附加条款授权。", "title": "ScamWorld: An Interactive Environment for Evaluating Web Agents Against Online Fraud", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T13:31:11Z", "updated": "2026-11-03T13:31:11Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04879v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1" } ], "intake_version_kind": "v2plus", "backfill_kind": "known_id_revision", "author": { "id": "2611.04879", "version_id": "2611.04879v2", "first_author": "Yutao Wu", "affiliations": [ "Deakin University" ], "source_url": "https://arxiv.org/html/2611.04879v2", "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "evidence": "Yutao Wu 1; affiliation 1 Deakin University.", "affiliation_status": "verified_in_paper", "author_status": "verified", "title": "ScamWorld: An Interactive Environment for Evaluating Web Agents Against Online Fraud", "authors": [ "Yutao Wu", "Xiao Liu", "Ming Wen", "Hanxun Huang", "Jun Wang", "Xingjun Ma" ], "author_source": "https://export.arxiv.org/api/query?id_list=2611.04879v2", "affiliation_source": "https://arxiv.org/html/2611.04879v2", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "论文注明此项工作与Jun Wang在Amazon的职位无关；Amazon仍为作者署名机构。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "90bbbc2ccc6c9acbd5c37f79bf597a4b66830a872fd6dfa2e03e3dacf0185881", "all_author_affiliations": [ "Deakin University", "Fudan University", "The University of Melbourne", "Amazon", "Shanghai Innovation Institute" ] }, "reason_zh": "网页智能体真实诈骗交互评测，涉及付款、凭据和将用户指令误当网站附加条款授权。", "first_seen_date": "2026-11-05", "revision_history": [ { "id": "2611.04879", "version_id": "2611.04879v1", "abstract_sha256": "38bea9ec7fe85545123b0d761e8c243a86bc41978cbf4c35b7ff7fbb38232707", "abstract_read": true, "classification": "relevant", "reason_zh": "网页智能体真实诈骗交互评测，涉及付款、凭据和将用户指令误当网站附加条款授权。", "reason": "网页智能体真实诈骗交互评测，涉及付款、凭据和将用户指令误当网站附加条款授权。", "summary_zh": "ScamWorld 重建已报告的多语言诈骗网站，使智能体在最终行动前能够观察诈骗迹象，解决真实诈骗站点短命而难以复现的问题。六个前沿模型驱动的网页智能体欺骗率为 11% 至 35%，付款场景比凭据或钱包信息请求更易继续；部分轨迹虽识别可疑条件，仍把用户任务当成接受网站新增条款的授权。", "topics": { "tags": [ "authorization", "evaluation", "privacy" ], "reason_zh": "直接评测网页智能体遭遇诈骗后的付款、凭据和授权边界。" }, "title": "ScamWorld: An Interactive Environment for Evaluating Web Agents Against Online Fraud", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T13:31:11Z", "updated": "2026-11-03T13:31:11Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04879v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04879", "version_id": "2611.04879v1", "first_author": "Yutao Wu", "affiliations": [ "Deakin University" ], "source_url": "https://arxiv.org/pdf/2611.04879v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Yutao Wu 1; affiliation 1 Deakin University.", "affiliation_status": "verified", "author_status": "verified" } } ] }, "2611.04944": { "id": "2611.04944", "version_id": "2611.04944v1", "abstract_sha256": "ada8c4f149eebb9cf4807cbdaafa4d7c33d9ce9bd743ec102e48b7fb2fd4303e", "abstract_read": true, "classification": "relevant", "reason_zh": "连续多智能体路径规划显式避让静态障碍和其他智能体，属于具身碰撞规避。", "reason": "连续多智能体路径规划显式避让静态障碍和其他智能体，属于具身碰撞规避。", "summary_zh": "论文针对连续时间连续空间中的平滑多智能体路径规划，将高层 CE-CBS 与局部可见性路网上的任意角单智能体规划结合，使路径避开静态障碍及其他智能体。实验与基于 RRT* 的 CE-CBS 和 SMT-CCBS 比较，作者报告在可比条件下具有若干优势，摘要未给出具体数值。", "topics": { "tags": [ "embodied", "multiagent" ], "reason_zh": "显式约束多智能体运动中的障碍和相互碰撞。" }, "title": "Local Visibility Roadmaps in Continous Multi-agent Path Finding", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T14:10:26Z", "updated": "2026-11-03T14:10:26Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.MA" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 7 of 7 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.04944v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.04944", "version_id": "2611.04944v1", "first_author": "Kristýna Janovská", "affiliations": [ "Faculty of Information Technology, Czech Technical University in Prague" ], "source_url": "https://arxiv.org/pdf/2611.04944v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Kristýna Janovská 1; 1 Czech Technical University in Prague, Faculty of Information Technology. Superscript a is ORCID note.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.05027": { "id": "2611.05027", "version_id": "2611.05027v1", "abstract_sha256": "b32d39277d7ba89b0bb050611ba3e21dc9edfc0570df3672606291a3e4a0a4fd", "abstract_read": true, "classification": "relevant", "reason_zh": "多机器人共享控制与人类监督，显式保证智能体间约束并反馈连接状态。", "reason": "正文§4.1.4确有显式安全距离和障碍/机器人碰撞避免：检测到障碍后添加排斥速度，讨论其与连通性控制耦合的稳定性，故不只是通用连通性/任务完成。", "summary_zh": "面向多机器人遥操作，结合有限视野下的分布式连通性维护、单机器人/钉扎/质心共享控制与触觉反馈；正文另有基于安全距离的机器人及障碍碰撞避免控制。用户研究比较不同控制模式与触觉反馈；安全相关性来自明确的碰撞避免机制，不应把连通性指标直接等同于安全保证。", "topics": { "tags": [ "embodied", "multiagent", "authorization" ], "reason_zh": "多机器人共享控制中的碰撞避免、安全距离及人类监督。" }, "title": "Haptic Shared Control for Multi-Robot Systems", "initial_classification": "relevant", "scope_review": { "id": "2611.05027", "version_id": "2611.05027v1", "classification": "relevant", "reason": "正文§4.1.4确有显式安全距离和障碍/机器人碰撞避免：检测到障碍后添加排斥速度，讨论其与连通性控制耦合的稳定性，故不只是通用连通性/任务完成。", "full_text_checked": true, "source_url": "https://arxiv.org/html/2611.05027v1", "reviewed_sections": [ "Abstract", "§3 sensor and problem model", "§4.1.4 Collision Avoidance", "§5.2 Haptic shared control", "implementation reactive controller" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "面向多机器人遥操作，结合有限视野下的分布式连通性维护、单机器人/钉扎/质心共享控制与触觉反馈；正文另有基于安全距离的机器人及障碍碰撞避免控制。用户研究比较不同控制模式与触觉反馈；安全相关性来自明确的碰撞避免机制，不应把连通性指标直接等同于安全保证。", "topics": { "tags": [ "embodied", "multiagent", "authorization" ], "reason_zh": "多机器人共享控制中的碰撞避免、安全距离及人类监督。" } }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "§3 sensor and problem model", "§4.1.4 Collision Avoidance", "§5.2 Haptic shared control", "implementation reactive controller" ], "body_source_url": "https://arxiv.org/html/2611.05027v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T15:03:48Z", "updated": "2026-11-03T15:03:48Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.HC", "cs.MA", "cs.RO" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 12 of 12 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.MA", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.05027v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05027", "version_id": "2611.05027v1", "first_author": "Maxime Bernard", "affiliations": [ "Université de Rennes", "IRISA UMR6074" ], "source_url": "https://arxiv.org/pdf/2611.05027v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Doctoral thesis title page: Thèse de doctorat de l’Université de Rennes; Par Maxime BERNARD; Unité de recherche: IRISA UMR6074. Jury affiliations are not assigned to author.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.05088": { "id": "2611.05088", "version_id": "2611.05088v1", "abstract_sha256": "b31892060bb6a29a4c2a56e08547f8db34e0483b153ab5646b279ce1459c069d", "abstract_read": true, "classification": "relevant", "reason_zh": "执行前从隐藏状态识别恶意智能体技能，直接针对不可信技能诱导越界操作。", "reason": "直接研究恶意Agent技能包执行前检测，提供白盒表征读出与跨来源边界，最贴近技能审计但并非最强Coding Agent独立审计。", "summary_zh": "问题：能否在不运行技能、不生成token的情况下识别任务与技能操作的不一致。方法：白盒读取一次prefill的声明、操作、上下文边界隐藏状态，结合监督分类头与良性关系残差。主集含五来源5830个包、2915对，按1954个内容共享连通组分成五折，每轮三折训练、一折开发、一折测试，最终分类头使用训练及开发集。七个7B至30B开放骨干上pooled F1为99.0–99.2%，source-macro F1为93.0–94.6%；89.9%样本来自MalSkillBench，整来源留出后平均macro F1降至73.2%。正文核验：LLM judge基线只是冻结Mistral-7B的二标签logit比较，无生成推理，不支持“胜过最强Coding Agent审计”。七轮反馈改写中，有效候选覆盖的初始阻断路径极少，不能据此声称广泛自适应鲁棒；另行白盒改写亦伴随显著误报上涨；合成符号组合测试近随机，不能视为通用跨文件推理。259–284ms仅另测compact配置，未测主结果完整配置时延。只检查已加载可读文本，二进制仅占位，后续下载及环境触发仍需运行时防护；未执行论文代码或复现。", "topics": { "tags": [ "supplychain", "monitoring", "evaluation" ], "reason_zh": "技能包白盒执行前筛查，含来源隔离、对抗改写、误报与跨分布边界。" }, "title": "LatentTriad: Pre-Action Risk Representations for Malicious Agent Skill Detection", "full_text_checked": true, "body_source_url": "https://arxiv.org/pdf/2611.05088v1", "evidence_level": "abstract_and_targeted_body", "reviewed_sections": [ "§2 Threat Model", "§4 检测器输入、三分支、训练与判定", "§5–6 主实验、source-macro指标、泛化、对抗改写与时延", "附录A.1、A.3–A.4及表4–8 骨干、序列化、数据来源和分组", "附录B.1 基线合同与Mistral judge", "附录C.1 来源切片及LOSO划分", "附录H 机制、结构泛化及部署局限" ], "published": "2026-11-03T15:46:12Z", "updated": "2026-11-03T15:46:12Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.05088v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05088", "version_id": "2611.05088v1", "first_author": "Zhe Yu", "affiliations": [ "The Hong Kong University of Science and Technology (Guangzhou)" ], "source_url": "https://arxiv.org/pdf/2611.05088v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Zhe Yu 1; 1 The Hong Kong University of Science and Technology (Guangzhou).", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.05094": { "id": "2611.05094", "version_id": "2611.05094v1", "abstract_sha256": "02e6c22681f468dbd980035eb7959d9a217489c9837aa5e423cbc5b9733a8fc9", "abstract_read": true, "classification": "relevant", "reason_zh": "编码智能体规格驱动流程中的用户审批、文件作用域及审计执行缺陷，直接属于权限监督安全。", "reason": "编码智能体规格驱动流程中的用户审批、文件作用域及审计执行缺陷，直接属于权限监督安全。", "summary_zh": "论文审计一个以规格、计划和任务列表驱动 Claude Code 的工作流，要求阶段审批、审查子智能体检查及执行者只修改声明文件，并由编排者检查文件清单。作者分析九项功能、七个项目，发现执行者唯一未声明的交付文件改动被检测，但编排者在 247 次检查中记录 11 次未声明变更，仅四次停止工作，暴露自我执行与自我裁判的弱点。", "topics": { "tags": [ "authorization", "monitoring", "multiagent", "evaluation" ], "reason_zh": "直接检查编码智能体审批关卡和文件作用域约束的执行。" }, "title": "A Gated Spec-Driven Workflow: An Audit-Trail Study of Coding-Agent Work", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T15:52:28Z", "updated": "2026-11-03T15:52:28Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.SE" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 17 of 17 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.SE", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.05094v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05094", "version_id": "2611.05094v1", "first_author": "Rodrigo Figueiredo Abdo", "affiliations": [ "L-PRISMA Laboratory, Federal Institute of Brasília" ], "source_url": "https://arxiv.org/pdf/2611.05094v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Rodrigo Figueiredo Abdo column directly lists L-PRISMA Laboratory, Federal Institute of Brasília, Brasília, Brazil.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.05171": { "id": "2611.05171", "version_id": "2611.05171v1", "abstract_sha256": "ef886bc3039b8e87a9bbd010e22f729a4b43b196fff9d006fdd3606aa289a7f0", "abstract_read": true, "classification": "relevant", "reason_zh": "工业 MCP 智能体的约束优化与安全裕度可能涉及物理安全，但摘要重点为缺陷控制，需正文判定。", "reason": "正文实测 MCP 工具代理在制造参数推荐中的工具调用伪造与无依据数值，并评估客户端答案守卫、输入边界和缺陷约束；属于工具可靠性与物理工艺安全边界，但不是实机闭环安全保证。", "summary_zh": "AgentAM 让 LLM 通过 MCP 调用激光粉末床熔融代理模型，进行预测、扫描及带约束参数优化。725 次主评测中，65 次可行优化均满足所列约束；移除工具后，部署提示下约 80% 运行伪造工具调用，中性提示下 90% 模型输出请求得到无依据预测。离线客户端守卫拦住了所有伪造调用，但对中性提示的无依据回答覆盖仍有限。安全裕量优化降低越过缺陷阈值的模拟风险；尚未用实物打印验证，守卫未在主评测中在线启用，所报可靠性是模型扰动假设下的估计。", "topics": { "tags": [ "authorization", "evaluation", "embodied" ], "reason_zh": "正文实测 MCP 工具代理在制造参数推荐中的工具调用伪造与无依据数值，并评估客户端答案守卫、输入边界和缺陷约束；属于工具可靠性与物理工艺安全边界，但不是实机闭环安全保证。" }, "title": "AgentAM: An AI Agent for Spatter- and Defect-Aware Process Optimization in Laser Powder Bed Fusion", "initial_classification": "uncertain", "scope_review": { "id": "2611.05171", "version_id": "2611.05171v1", "classification": "relevant", "reason": "正文实测 MCP 工具代理在制造参数推荐中的工具调用伪造与无依据数值，并评估客户端答案守卫、输入边界和缺陷约束；属于工具可靠性与物理工艺安全边界，但不是实机闭环安全保证。", "reason_zh": "正文实测 MCP 工具代理在制造参数推荐中的工具调用伪造与无依据数值，并评估客户端答案守卫、输入边界和缺陷约束；属于工具可靠性与物理工艺安全边界，但不是实机闭环安全保证。", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2611.05171v1", "reviewed_sections": [ "Abstract", "2.6 agent benchmark and answer guards", "3.7 agent results and no-tools baselines", "4.2 tool-layer safeguards", "4.3 Safety margins", "4.5 Limitations" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "AgentAM 让 LLM 通过 MCP 调用激光粉末床熔融代理模型，进行预测、扫描及带约束参数优化。725 次主评测中，65 次可行优化均满足所列约束；移除工具后，部署提示下约 80% 运行伪造工具调用，中性提示下 90% 模型输出请求得到无依据预测。离线客户端守卫拦住了所有伪造调用，但对中性提示的无依据回答覆盖仍有限。安全裕量优化降低越过缺陷阈值的模拟风险；尚未用实物打印验证，守卫未在主评测中在线启用，所报可靠性是模型扰动假设下的估计。", "topics": { "tags": [ "authorization", "evaluation", "embodied" ], "reason_zh": "正文实测 MCP 工具代理在制造参数推荐中的工具调用伪造与无依据数值，并评估客户端答案守卫、输入边界和缺陷约束；属于工具可靠性与物理工艺安全边界，但不是实机闭环安全保证。" } }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "2.6 agent benchmark and answer guards", "3.7 agent results and no-tools baselines", "4.2 tool-layer safeguards", "4.3 Safety margins", "4.5 Limitations" ], "body_source_url": "https://arxiv.org/abs/2611.05171v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T16:38:46Z", "updated": "2026-11-03T16:38:46Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "New submissions (showing 115 of 115 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.05171v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05171", "first_author": "Olabode T. Ajenifujah", "affiliations": [ "Department of Mechanical Engineering, Carnegie Mellon University, Pittsburgh, PA, USA" ], "source_url": "https://arxiv.org/pdf/2611.05171v1", "shared_first_authors": [], "shared_first_note": "未见共同第一作者标记。", "status": "verified", "evidence": "PDF 首页第一作者上标 a，对应 Department of Mechanical Engineering, Carnegie Mellon University；b、c 仅挂在 Amir Barati Farimani 名下，不能映射给第一作者。", "version_id": "2611.05171v1", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.05179": { "id": "2611.05179", "version_id": "2611.05179v1", "abstract_sha256": "6de66c058158ce6d24547a5bc1e2294517977b0fd7788a11488079c81fa8bc91", "abstract_read": true, "classification": "relevant", "reason_zh": "化工过程智能体故障管理明确比较动作验证、安全联锁及后果投影，属于具身与工具行动安全。", "reason": "化工过程智能体故障管理明确比较动作验证、安全联锁及后果投影，属于具身与工具行动安全。", "summary_zh": "问题：化工过程故障时，LLM代理提出的监督操作需要外部行动校验。方法：在含11个独立安全仪表功能的假想反应器—蒸馏仿真中，比较无验证、LLM判官、数字孪生和有/无后果投影的确定性准入检查，共4模型20故障情景。PDF完整摘要报告：无代理18次停机；GPT-5 nano、Qwen3 8B、Mistral 7B经验证后降至5–8次，按假设经济参数挽回20.9万–26.5万美元；Llama3.2 3B采用确定性检查降至7次，LLM验证反为15次。4个冷凝器失冷场景在所评单步动作集合中无可行恢复。未在真实工厂验证，经济值不是实际收益。", "topics": { "tags": [ "embodied", "authorization", "monitoring", "evaluation" ], "reason_zh": "明确评测物理工艺智能体动作安全验证与独立安全联锁。" }, "evidence_level": "same_version_pdf_full_abstract_read", "abstract_source": "https://arxiv.org/pdf/2611.05179v1", "title": "OperAItor: An Agentic Framework for Fault-Tolerant Operation of Chemical Processes", "full_text_checked": false, "published": "2026-11-03T16:40:46Z", "updated": "2026-11-03T16:40:46Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "eess.SY" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.05179v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05179", "version_id": "2611.05179v1", "first_author": "Javal Vyas", "affiliations": [ "Autonomous Industrial Systems Laboratory, Department of Chemical Engineering, Imperial College London" ], "source_url": "https://arxiv.org/pdf/2611.05179v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "PDF page 2: Javal Vyas a,*; a Autonomous Industrial Systems Laboratory, Department of Chemical Engineering, Imperial College London. Star corresponding author, not equal contribution. Abstract discrepancy: PDF reports recovered $209,000–265,000 versus metadata $265,000 only.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.05290": { "id": "2611.05290", "version_id": "2611.05290v1", "abstract_sha256": "d0dc4343f2e2241489d2fc6b4b8af5eb1f7e160186dc3f741759d6401b1d7a11", "abstract_read": true, "classification": "relevant", "reason_zh": "严重天气助手基于外部警报的数据接入与危险安抚评测，需正文确认智能体工具工作流和安全贡献。", "reason": "正文明确评估 Stormwise MCP 服务的地理编码、天气与 NWS 警报抓取、强制工具结构化指导链路，研究警报缺失、测试产品误摄入和令牌预算失败的安全后果，超过普通灾害问答。", "summary_zh": "研究 Stormwise MCP 天气准备服务在官方警报缺失时产生虚假安心的风险。117 个冻结案例回放中，盲态中性提示的虚假安心率为 26/69（37.7%），要求披露盲点后为 31/69（44.9%）；接入真实警报的生产流程为 0/66，但不能据此声称风险为零。仅提供警报而用中性提示，又在 87.5% 无警报对照中触发非零警戒。作者还发现测试警报未过滤及复杂案例令牌预算失败。该研究是单模型家族、单季节、单标注者的管线回放，不代表真实灾害部署发生率或保护行为效果。", "topics": { "tags": [ "authorization", "evaluation", "embodied", "robustness" ], "reason_zh": "正文明确评估 Stormwise MCP 服务的地理编码、天气与 NWS 警报抓取、强制工具结构化指导链路，研究警报缺失、测试产品误摄入和令牌预算失败的安全后果，超过普通灾害问答。" }, "title": "False Reassurance in LLM Severe-Weather Guidance: A Replayable Evaluation Against Real NWS Alerts", "initial_classification": "uncertain", "scope_review": { "id": "2611.05290", "version_id": "2611.05290v1", "classification": "relevant", "reason": "正文明确评估 Stormwise MCP 服务的地理编码、天气与 NWS 警报抓取、强制工具结构化指导链路，研究警报缺失、测试产品误摄入和令牌预算失败的安全后果，超过普通灾害问答。", "reason_zh": "正文明确评估 Stormwise MCP 服务的地理编码、天气与 NWS 警报抓取、强制工具结构化指导链路，研究警报缺失、测试产品误摄入和令牌预算失败的安全后果，超过普通灾害问答。", "full_text_checked": true, "source_url": "https://arxiv.org/abs/2611.05290v1", "reviewed_sections": [ "Abstract", "III System Under Test", "IV dataset and test products", "V evaluation design and manual validation", "VI Results", "VII Discussion", "VIII Limitations" ], "evidence_level": "abstract_and_targeted_body", "review_status": "resolved", "summary_zh": "研究 Stormwise MCP 天气准备服务在官方警报缺失时产生虚假安心的风险。117 个冻结案例回放中，盲态中性提示的虚假安心率为 26/69（37.7%），要求披露盲点后为 31/69（44.9%）；接入真实警报的生产流程为 0/66，但不能据此声称风险为零。仅提供警报而用中性提示，又在 87.5% 无警报对照中触发非零警戒。作者还发现测试警报未过滤及复杂案例令牌预算失败。该研究是单模型家族、单季节、单标注者的管线回放，不代表真实灾害部署发生率或保护行为效果。", "topics": { "tags": [ "authorization", "evaluation", "embodied", "robustness" ], "reason_zh": "正文明确评估 Stormwise MCP 服务的地理编码、天气与 NWS 警报抓取、强制工具结构化指导链路，研究警报缺失、测试产品误摄入和令牌预算失败的安全后果，超过普通灾害问答。" } }, "full_text_checked": true, "reviewed_sections": [ "Abstract", "III System Under Test", "IV dataset and test products", "V evaluation design and manual validation", "VI Results", "VII Discussion", "VIII Limitations" ], "body_source_url": "https://arxiv.org/abs/2611.05290v1", "evidence_level": "abstract_and_targeted_body", "published": "2026-11-03T18:04:53Z", "updated": "2026-11-03T18:04:53Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CY", "cs.HC" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.05290v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05290", "first_author": "Kadharmoideen Fadurudeen", "affiliations": [ "Independent Researcher" ], "source_url": "https://arxiv.org/pdf/2611.05290v1", "shared_first_authors": [], "shared_first_note": "单作者。", "status": "verified", "evidence": "PDF 首页作者姓名下明确写 Independent Researcher。", "version_id": "2611.05290v1", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2611.05376": { "id": "2611.05376", "version_id": "2611.05376v1", "abstract_sha256": "2460611cefc6861496d4ba23b9ffa5d4daead63a1d131ed445142562b9033e99", "abstract_read": true, "classification": "relevant", "reason_zh": "终身主动个人智能体架构显式讨论个人运行时、信任与隐蔽辅助等治理风险，属于智能体隐私及治理安全。", "reason": "终身主动个人智能体架构显式讨论个人运行时、信任与隐蔽辅助等治理风险，属于智能体隐私及治理安全。", "summary_zh": "论文提出认知共生体这一终身、实时、私密且主动的个人 AI 系统范式，以缩小个人知识能力与当前工作记忆之间的认知差距。其设计涵盖感知、长期上下文、理解、代办与共同思考，并以个人运行时与信任包围这些流程；同时将考试隐蔽辅助与社会采用压力等风险治理纳入范式。摘要提供概念框架而非实证效果。", "topics": { "tags": [ "memory", "privacy", "authorization" ], "reason_zh": "长期主动个人智能体的上下文、信任和社会风险治理。" }, "title": "From Autonomous Agents to Cognitive Symbionts: Toward AI-Augmented Human Intelligence", "full_text_checked": false, "evidence_level": "full_metadata_abstract_only", "published": "2026-11-03T18:59:52Z", "updated": "2026-11-03T18:59:52Z", "announcement_date": "2026-11-04", "categories_seen": [ "cs.AI", "cs.CL" ], "candidate_type": "unseen_id", "provenance": [ { "announcement_date": "2026-11-04", "section": "Cross submissions (showing 137 of 137 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-04", "section": "New submissions (showing 53 of 53 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-04", "section": "", "category": "cs.CL", "kind": "recent" } ], "source_url": "https://arxiv.org/abs/2611.05376v1", "fetch_status": "complete", "reading_status": "full_abstract_read", "last_checked_date": "2026-11-05", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-05", "first_seen_date": "2026-11-05", "seen_dates": [ "2026-11-05" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05376", "version_id": "2611.05376v1", "first_author": "Hao Fei", "affiliations": [ "University of Oxford" ], "source_url": "https://arxiv.org/pdf/2611.05376v1", "shared_first_authors": [], "shared_first_note": "No equal-contribution designation seen in front matter.", "status": "verified", "evidence": "Hao Fei; University of Oxford directly in author block. PDF abstract expands wording versus metadata, same principal conceptual claims.", "affiliation_status": "verified", "author_status": "verified" }, "revision_history": [] }, "2604.08567": { "id": "2604.08567", "classification": "relevant", "reason": "直接压力测试多用户 LLM Agent 在权限角色冲突、隐私约束和协作中的失效。", "summary_zh": "问题：从服务单一用户转向团队工作流后，LLM Agent 必须处理多个主体的不同权限、利益冲突和隐私边界。方法：将多用户互动形式化为多委托人决策问题，提出统一协议，并设计指令遵循、隐私保护和协调三类压力测试。结果：前沿模型在冲突目标下经常不能维持稳定的优先级，多轮互动中隐私违规增加，反复收集信息的协调也出现效率瓶颈；摘要未给出具体数值。", "topics": { "tags": [ "authorization", "privacy", "evaluation" ], "reason_zh": "多用户权限和目标冲突使 Agent 的指令优先级与隐私保护失稳。", "id": "2604.08567" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "ddd8fca82c0ebe4a2ae0e658d040edde205c8a696766270cf499c9f0edec90f3", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2604.08567v3", "title": "Multi-User Large Language Model Agents", "published": "2026-03-19T19:31:53Z", "updated": "2026-11-04T02:45:59Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.CL", "cs.MA" ], "source_url": "https://arxiv.org/abs/2604.08567v3", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 69 of 69 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 11 of 11 entries)", "category": "cs.MA", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2604.08567", "version_id": "2604.08567v3", "title": "Multi-User Large Language Model Agents", "first_author": "Shu Yang", "authors": [ "Shu Yang", "Shenzhe Zhu", "Hao Zhu", "José Ramón Enríquez", "Di Wang", "Alex Pentland", "Michiel A. Bakker", "Jiaxin Pei" ], "affiliations": [ "Stanford University", "KAUST" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2604.08567v3", "source_url": "https://arxiv.org/html/2604.08567v3", "affiliation_source": "https://arxiv.org/html/2604.08567v3", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "4aa44bc806ec0aa999e9a0960483cd86aa9f5d7731357c7e866acda1b25cd80e", "all_author_affiliations": [ "Stanford University", "KAUST", "UT Austin", "MIT" ] }, "revision_history": [] }, "2604.27202": { "id": "2604.27202", "classification": "relevant", "reason": "研究真实网页中的间接提示注入，明确覆盖会浏览并采取行动的系统及客服、招聘 Agent。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "917b42ad6a71c1ba31fc384bb03e094b5e6dc6e52df7aba9b4607e7b26b8f81c", "summary_zh": "针对网页不可信内容对浏览、检索和行动系统的间接提示注入，分析大规模 URL 数据中的注入目标、交付方式、隐藏形式与持续性，并跨模型及网页表示进行控制实验。摘要报告现实注入已形成重复模板生态，遵从率有限但非零，保留结构线索的表示可降低遵从。", "topics": { "tags": [ "injection", "evaluation" ], "reason_zh": "研究真实网页中的间接提示注入，明确覆盖会浏览并采取行动的系统及客服、招聘 Agent。", "id": "2604.27202" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2604.27202v2", "title": "Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives", "published": "2026-04-29T21:09:21Z", "updated": "2026-11-04T09:26:35Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.CR" ], "source_url": "https://arxiv.org/abs/2604.27202v2", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2604.27202", "version_id": "2604.27202v2", "title": "Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives", "first_author": "Soheil Khodayari", "authors": [ "Soheil Khodayari", "Xuenan Zhang", "Bhupendra Acharya", "Giancarlo Pellegrino" ], "affiliations": [ "Independent Researcher" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2604.27202v2", "source_url": "https://arxiv.org/html/2604.27202v2", "affiliation_source": "https://arxiv.org/html/2604.27202v2", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "5d47bda62487e488233dce7635114b2f9f3d1682e0e28be77ac5e4d24c19fe7f", "all_author_affiliations": [ "Independent Researcher", "CISPA Helmholtz Center for Information Security", "University of Louisiana" ] }, "revision_history": [] }, "2604.27955": { "id": "2604.27955", "classification": "relevant", "reason": "作为含具体 Agent 安全部署内容的综述纳入，而非新的攻击或防御实验。Deployment and Governance 完整讨论钓鱼提示、欺骗布局、危险点击及不可逆操作；将权限门、沙箱、回滚、人类接管和持续学习安全退化列为机制与评测要求，超出泛泛安全口号。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "b06f2787f7268d91820270502c5b6d68356a52a551da53c2cdd97fcacb7c1cc9", "initial_classification": "uncertain", "initial_reason": "GUI Agent 强化学习综述明确提到不可逆环境中的安全探索与安全部署，但摘要未交代具体防护机制和评测；需核查安全部分。", "summary_zh": "针对 GUI Agent 在不可逆环境中探索、持续适应及部署带来的风险，综述按离线、在线与混合 RL 组织方法，并提出将安全约束、侧效应审计、权限边界、回滚和人类接管纳入基础设施与评测。文献综合认为任务成功率不足以说明安全部署，持续学习还可能传播危险捷径或削弱既有护栏；本文是综述与研究路线图，未提供新的防御效果实验。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "专门讨论 GUI/计算机使用 Agent 的危险操作、权限沙箱和持续安全评测。", "id": "2604.27955" }, "checked_sections": [ "Challenges and Future Directions / Digital Worlds / Agent-Native Environments", "Technical Roadmap / Reward Interfaces", "Deployment and Governance / Safety, Adaptation, and Evaluation", "Conclusion" ], "evidence_quotes": [ "Current concerns already include phishing prompts, deceptive layouts, unsafe clicks, and irreversible operations", "Sim-to-real gaps and unsafe irreversible actions require transfer-degradation measurements, sandboxing, permission gates, rollback mechanisms, and human override protocols.", "the community needs reference sandbox specifications that formalize permission scopes, rollback behavior, logging requirements, and human override mechanisms" ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2604.27955v2", "full_text_sha256": "af0bee576e0ea36cf4d18cc7ad2d795c8964135573f0559e5aa980d40597c72f", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2604.27955v2", "title": "Reinforcement Learning in GUI Agents: A Survey Toward Digital Inhabitants", "published": "2026-04-30T14:51:49Z", "updated": "2026-11-04T02:44:36Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CV" ], "source_url": "https://arxiv.org/abs/2604.27955v2", "last_checked_date": "2026-11-06", "scope_review": { "id": "2604.27955", "classification": "relevant", "reason": "作为含具体 Agent 安全部署内容的综述纳入，而非新的攻击或防御实验。Deployment and Governance 完整讨论钓鱼提示、欺骗布局、危险点击及不可逆操作；将权限门、沙箱、回滚、人类接管和持续学习安全退化列为机制与评测要求，超出泛泛安全口号。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "b06f2787f7268d91820270502c5b6d68356a52a551da53c2cdd97fcacb7c1cc9", "initial_classification": "uncertain", "initial_reason": "GUI Agent 强化学习综述明确提到不可逆环境中的安全探索与安全部署，但摘要未交代具体防护机制和评测；需核查安全部分。", "summary_zh": "针对 GUI Agent 在不可逆环境中探索、持续适应及部署带来的风险，综述按离线、在线与混合 RL 组织方法，并提出将安全约束、侧效应审计、权限边界、回滚和人类接管纳入基础设施与评测。文献综合认为任务成功率不足以说明安全部署，持续学习还可能传播危险捷径或削弱既有护栏；本文是综述与研究路线图，未提供新的防御效果实验。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "robustness" ], "reason_zh": "专门讨论 GUI/计算机使用 Agent 的危险操作、权限沙箱和持续安全评测。", "id": "2604.27955" }, "checked_sections": [ "Challenges and Future Directions / Digital Worlds / Agent-Native Environments", "Technical Roadmap / Reward Interfaces", "Deployment and Governance / Safety, Adaptation, and Evaluation", "Conclusion" ], "evidence_quotes": [ "Current concerns already include phishing prompts, deceptive layouts, unsafe clicks, and irreversible operations", "Sim-to-real gaps and unsafe irreversible actions require transfer-degradation measurements, sandboxing, permission gates, rollback mechanisms, and human override protocols.", "the community needs reference sandbox specifications that formalize permission scopes, rollback behavior, logging requirements, and human override mechanisms" ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2604.27955v2", "full_text_sha256": "af0bee576e0ea36cf4d18cc7ad2d795c8964135573f0559e5aa980d40597c72f", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2604.27955v2", "title": "Reinforcement Learning in GUI Agents: A Survey Toward Digital Inhabitants", "published": "2026-04-30T14:51:49Z", "updated": "2026-11-04T02:44:36Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CV" ], "source_url": "https://arxiv.org/abs/2604.27955v2", "last_checked_date": "2026-11-06", "reviewed_sections": [ "Challenges and Future Directions / Digital Worlds / Agent-Native Environments", "Technical Roadmap / Reward Interfaces", "Deployment and Governance / Safety, Adaptation, and Evaluation", "Conclusion" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "Challenges and Future Directions / Digital Worlds / Agent-Native Environments", "Technical Roadmap / Reward Interfaces", "Deployment and Governance / Safety, Adaptation, and Evaluation", "Conclusion" ], "body_source_url": "https://arxiv.org/abs/2604.27955v2", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2604.27955", "version_id": "2604.27955v2", "title": "Reinforcement Learning in GUI Agents: A Survey Toward Digital Inhabitants", "first_author": "Junan Hu", "authors": [ "Junan Hu", "Jian Liu", "Jingxiang Lai", "Jiarui Hu", "Yiwei Sheng", "Shuang Chen", "Jian Li", "Dazhao Du", "Song Guo" ], "affiliations": [ "Shandong University", "The Hong Kong University of Science and Technology" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2604.27955v2", "source_url": "https://arxiv.org/pdf/2604.27955v2", "affiliation_source": "https://arxiv.org/pdf/2604.27955v2", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "a8403ac53c3cb31e936064b23d0a9949420171dc74f43bc1a24ba02281042315", "all_author_affiliations": [ "Shandong University", "The Hong Kong University of Science and Technology", "The Hong Kong University", "Shanghai Jiao Tong University", "Tencent" ] }, "revision_history": [] }, "2605.10779": { "id": "2605.10779", "classification": "relevant", "reason": "真实操作系统中 LLM Agent 危险操作、Skill 注入及行为越狱安全评测。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "2f5c4f72c74f283387933375773fedc90896541a37d0d26c2b89bd223a1f6d7f", "summary_zh": "LITMUS 研究 Agent 在真实 OS 中执行危险操作的行为越狱，结合语义与系统实际状态验证以及 OS 回滚，包含 Skill 注入等攻击。819 个高风险用例揭示前沿 Agent 仍会执行危险操作，且可能口头拒绝但实际上已执行，说明仅检查回复会漏判。", "topics": { "tags": [ "injection", "evaluation", "authorization" ], "reason_zh": "评测 Skill 注入和工具执行造成的实际危险行为。", "id": "2605.10779" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2605.10779v2", "title": "LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments", "published": "2026-05-11T16:14:04Z", "updated": "2026-11-04T12:30:56Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.CL", "cs.CR" ], "source_url": "https://arxiv.org/abs/2605.10779v2", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 69 of 69 entries)", "category": "cs.CL", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.10779", "version_id": "2605.10779v2", "title": "LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments", "first_author": "Chiyu Zhang", "authors": [ "Chiyu Zhang", "Lu Zhou", "Xiaogang Xu", "Huiqin Yang", "Bendong Jiang", "Xiaolei Zhang", "Yiran Zhao", "Ruyi Chen", "Jiafei Wu", "Liming Fang", "Zhe Liu" ], "affiliations": [ "Nanjing University of Aeronautics and Astronautics" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2605.10779v2", "source_url": "https://arxiv.org/html/2605.10779v2", "affiliation_source": "https://arxiv.org/html/2605.10779v2", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "6ef92e0ab5a9ffcfac05470786bed6d5391b0f070f320cd16698074e603f81a8", "all_author_affiliations": [ "Nanjing University of Aeronautics and Astronautics", "Collaborative Innovation Center of Novel Software Technology and Industrialization", "Network and Data Security Key Laboratory of Sichuan Province", "School of Software Technology, Zhejiang University", "Ningbo Global Innovation Center, Zhejiang University", "Innovation and Management Center, School of Software Technology (Ningbo), Zhejiang University" ] }, "revision_history": [] }, "2605.18991": { "id": "2605.18991", "classification": "relevant", "reason": "直接将 Agent 模型视为不可信组件，讨论系统级安全约束与真实攻击防御。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "a5d89414d0a79ef94795299018bce05f4ec8859db8476cb5a97244dc22fb4ecc", "summary_zh": "针对仅增强模型鲁棒性不足以保证 Agent 安全的问题，提出将模型视为不可信组件、由系统层强制安全不变量的设计原则。通过分析十一类代表性真实攻击说明这些原则可能如何阻断攻击，并提出实现挑战；这是立场与案例分析，摘要未报告新防御基准实验。", "topics": { "tags": [ "authorization", "injection", "robustness" ], "reason_zh": "直接将 Agent 模型视为不可信组件，讨论系统级安全约束与真实攻击防御。", "id": "2605.18991" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2605.18991v3", "title": "Agent Security is a Systems Problem", "published": "2026-05-18T18:11:17Z", "updated": "2026-11-04T00:02:12Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CR" ], "source_url": "https://arxiv.org/abs/2605.18991v3", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.18991", "version_id": "2605.18991v3", "title": "Agent Security is a Systems Problem", "first_author": "Mihai Christodorescu", "authors": [ "Mihai Christodorescu", "Earlence Fernandes", "Ashish Hooda", "Somesh Jha", "Johann Rehberger", "Kamalika Chaudhuri", "Xiaohan Fu", "Khawaja Shams", "Guy Amir", "Jihye Choi", "Sarthak Choudhary", "Nils Palumbo", "Andrey Labunets", "Nishit V. Pandya" ], "affiliations": [ "Google" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2605.18991v3", "source_url": "https://arxiv.org/html/2605.18991v3", "affiliation_source": "https://arxiv.org/html/2605.18991v3", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "7cca35923bf3e82b42cf9e12d07637f1d343208863314e6e34c08e27d804bd16", "all_author_affiliations": [ "Google", "University of California San Diego", "Gray Swan AI", "University of Wisconsin–Madison", "EmbraceTheRed", "The University of Texas at Austin", "NVIDIA" ] }, "revision_history": [] }, "2605.23262": { "id": "2605.23262", "classification": "relevant", "reason": "以 Agent 基准评价完整性研究纳入。正文对 APEX-SWE 工具执行后的数据保真缺口进行代码审计与可执行反例，脚本可伪造、截断或篡改上传内容仍获通过；这不是越权修改源文件，也未证明实际 Agent 会主动作弊，但直接揭示 Agent 执行数据完整性失守可被成功分数掩盖。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "128432626767dd0b4df61176ed87029da0fa117dd8f337cd94d37b834487e211", "initial_classification": "uncertain", "initial_reason": "知识工作 Agent 基准审计发现源数据被改写仍能通过测试，可能涉及产物完整性安全，但摘要未明确安全边界；需核查被改内容性质与任务要求。", "summary_zh": "针对 Agent 知识工作基准把局部通过误当完整工作交付的问题，提出活动、测试设置、所需产物与实际评分四字段，审计三类基准并检查全部二十五个公开 APEX-SWE Integration 任务。十三项测试未完全校验来源决定的内容，其中两项以可执行反例确认：伪造用户、截断数据、改写邮箱或空归档也能通过。源数据对照断言能拒绝所测错误脚本；研究未测真实 Agent 主动作弊率，也不是源文件越权攻击。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "审计工具型 Agent 基准对执行结果数据完整性的漏检，提供测试通过但数据错误的反例。", "id": "2605.23262" }, "checked_sections": [ "3.2 Tested Setting", "3.3 Required Work Product", "3.4 Evaluated Result", "4 Benchmark Case Analyses Through the Work-Centered Representation", "5 Discussion" ], "evidence_quotes": [ "one script uploads 5 dummy users per the internal specification doc rather than the agent-facing issue, one uploads only the first row, and one scrambles all email addresses. All four scripts pass all 6 tests.", "a script that never queries the Zammad ticketing system, uploads an empty CSV containing only header rows, and reports zero archived tickets passes all 14 public tests.", "Coding was conducted via manual inspection of public test code" ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2605.23262v3", "full_text_sha256": "72a2ea285700ed962d5cf1d76a949870311913dbc492fe1430e74201592ff2f2", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2605.23262v3", "title": "Designing Benchmarks for Knowledge Work", "published": "2026-05-22T06:03:01Z", "updated": "2026-11-03T23:25:29Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2605.23262v3", "last_checked_date": "2026-11-06", "scope_review": { "id": "2605.23262", "classification": "relevant", "reason": "以 Agent 基准评价完整性研究纳入。正文对 APEX-SWE 工具执行后的数据保真缺口进行代码审计与可执行反例，脚本可伪造、截断或篡改上传内容仍获通过；这不是越权修改源文件，也未证明实际 Agent 会主动作弊，但直接揭示 Agent 执行数据完整性失守可被成功分数掩盖。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "128432626767dd0b4df61176ed87029da0fa117dd8f337cd94d37b834487e211", "initial_classification": "uncertain", "initial_reason": "知识工作 Agent 基准审计发现源数据被改写仍能通过测试，可能涉及产物完整性安全，但摘要未明确安全边界；需核查被改内容性质与任务要求。", "summary_zh": "针对 Agent 知识工作基准把局部通过误当完整工作交付的问题，提出活动、测试设置、所需产物与实际评分四字段，审计三类基准并检查全部二十五个公开 APEX-SWE Integration 任务。十三项测试未完全校验来源决定的内容，其中两项以可执行反例确认：伪造用户、截断数据、改写邮箱或空归档也能通过。源数据对照断言能拒绝所测错误脚本；研究未测真实 Agent 主动作弊率，也不是源文件越权攻击。", "topics": { "tags": [ "evaluation", "monitoring" ], "reason_zh": "审计工具型 Agent 基准对执行结果数据完整性的漏检，提供测试通过但数据错误的反例。", "id": "2605.23262" }, "checked_sections": [ "3.2 Tested Setting", "3.3 Required Work Product", "3.4 Evaluated Result", "4 Benchmark Case Analyses Through the Work-Centered Representation", "5 Discussion" ], "evidence_quotes": [ "one script uploads 5 dummy users per the internal specification doc rather than the agent-facing issue, one uploads only the first row, and one scrambles all email addresses. All four scripts pass all 6 tests.", "a script that never queries the Zammad ticketing system, uploads an empty CSV containing only header rows, and reports zero archived tickets passes all 14 public tests.", "Coding was conducted via manual inspection of public test code" ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2605.23262v3", "full_text_sha256": "72a2ea285700ed962d5cf1d76a949870311913dbc492fe1430e74201592ff2f2", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2605.23262v3", "title": "Designing Benchmarks for Knowledge Work", "published": "2026-05-22T06:03:01Z", "updated": "2026-11-03T23:25:29Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2605.23262v3", "last_checked_date": "2026-11-06", "reviewed_sections": [ "3.2 Tested Setting", "3.3 Required Work Product", "3.4 Evaluated Result", "4 Benchmark Case Analyses Through the Work-Centered Representation", "5 Discussion" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "3.2 Tested Setting", "3.3 Required Work Product", "3.4 Evaluated Result", "4 Benchmark Case Analyses Through the Work-Centered Representation", "5 Discussion" ], "body_source_url": "https://arxiv.org/abs/2605.23262v3", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2605.23262", "version_id": "2605.23262v3", "title": "Designing Benchmarks for Knowledge Work", "first_author": "Yining Hua", "authors": [ "Yining Hua", "Hongbin Na", "Cyrus Ayubcha", "Levi Lian" ], "affiliations": [ "Harvard University" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2605.23262v3", "source_url": "https://arxiv.org/html/2605.23262v3", "affiliation_source": "https://arxiv.org/html/2605.23262v3", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "4e2060c8445499a2ae4ab16e6fc2baeeed532ad40daf0f0cd076a44da94a59b1", "all_author_affiliations": [ "Harvard University", "University of Technology Sydney", "Raycaster", "Stanford University" ] }, "revision_history": [] }, "2607.00481": { "id": "2607.00481", "classification": "relevant", "reason": "攻击有状态函数调用环境中 schema、参数、工具输出与历史共享上下文的信任边界。", "summary_zh": "问题：函数调用 LLM 将开发者 schema、结构化参数及不可信工具输出混入共享上下文，提示级防御可能漏掉跨步骤攻击。方法：SMT 构造伪装成审核测试的多轮轨迹，以虚构的审核框架和把拒绝视为执行失败的反馈逐步诱发有害输出。结果：作者在五家供应商的模型和两个标准安全基准上报告，SMT 的平均攻击成功率与 HarmScore 高于比较基线，且查询数接近最少；摘要未给出具体数值。研究强调需跨 schema、参数、工具输出和累计会话状态验证信任边界。", "topics": { "tags": [ "injection", "memory", "authorization", "evaluation" ], "reason_zh": "借多轮函数调用轨迹混淆控制逻辑与不可信数据，揭示跨工具上下文防御缺口。", "id": "2607.00481" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body", "abstract_sha256": "09593194b2e72f7ee84e01605977894323f591d51a62c1e01c9ee2332e319ab8", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2607.00481v2", "title": "Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces", "published": "2026-07-01T06:08:07Z", "updated": "2026-11-04T05:40:42Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CR" ], "source_url": "https://arxiv.org/abs/2607.00481v2", "last_checked_date": "2026-11-06", "body_source_url": "https://arxiv.org/html/2607.00481v2", "body_review_sections": [ "S3", "S5", "S6" ], "body_evidence_limits": "要求客户端能注册自定义schema并提交历史，不适用于schema固定且客户端不可控的部署；结果是模型与防护版本的快照。它不是已证实的真实工具越权或任意Agent接管攻击，亦不能说明对所有专用防御都有效。", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 26 of 26 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.00481", "version_id": "2607.00481v2", "title": "Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces", "first_author": "Junlong Liu", "authors": [ "Junlong Liu", "Haobo Wang", "Weiqi Luo", "Xiaojun Jia" ], "affiliations": [ "Sun Yat-sen University" ], "shared_first_authors": [ { "name": "Junlong Liu", "affiliations": [ "Sun Yat-sen University" ] }, { "name": "Haobo Wang", "affiliations": [ "Sun Yat-sen University" ] } ], "shared_first_note": "共同贡献脚注明确标注。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2607.00481v2", "source_url": "https://arxiv.org/html/2607.00481v2", "affiliation_source": "https://arxiv.org/html/2607.00481v2", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "88adfdc0768b6c9b806af29628fadcaefd323ce4245557db4239a1a7c64c4e1d", "shared_first_affiliations": { "Junlong Liu": [ "Sun Yat-sen University" ], "Haobo Wang": [ "Sun Yat-sen University" ] }, "shared_first_affiliations_source": "https://arxiv.org/html/2607.00481v2", "shared_first_affiliations_status": "verified_from_official_front_matter_author_markers", "all_author_affiliations": [ "Sun Yat-sen University", "Nanyang Technological University" ] }, "revision_history": [] }, "2607.28685": { "id": "2607.28685", "classification": "relevant", "reason": "直接审计 Agent 安全基准的构念效度、指标与能力混淆。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "094ee08a023dff74bf33334fa627e2014ec1a2111d5212658d7d8120e49796c7", "summary_zh": "论文审计 R-Judge、InjecAgent、AgentHarm、AgentDojo 是否真实测量可比较的 Agent 安全。作者按官方实现比较多模型表现并控制能力，发现指标可被简单策略抬高、排名及相关性依赖模型面板，且有害服从上的收敛效度不代表一般安全，主张报告具体基准、指标、行为及模型面板。", "topics": { "tags": [ "evaluation" ], "reason_zh": "专门检验 Agent 安全评测的效度与能力混淆。", "id": "2607.28685" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2607.28685v2", "title": "Safety, or Just Capability? A Validity Audit of Agent-Safety Benchmarks", "published": "2026-07-30T03:45:10Z", "updated": "2026-11-04T05:29:26Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.IR" ], "source_url": "https://arxiv.org/abs/2607.28685v2", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2607.28685", "version_id": "2607.28685v2", "title": "Safety, or Just Capability? A Validity Audit of Agent-Safety Benchmarks", "first_author": "Youting Wang", "authors": [ "Youting Wang", "Xiao Han", "Dingyan Shang", "Yuan Tang", "Bowen Liu" ], "affiliations": [ "Independent Researcher" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2607.28685v2", "source_url": "https://arxiv.org/html/2607.28685v2", "affiliation_source": "https://arxiv.org/html/2607.28685v2", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "c558c1e37fa2dee6e281595f7eb36f42091288c3858842c08d4a96cdc60e66d7", "all_author_affiliations": [ "Independent Researcher" ] }, "revision_history": [] }, "2608.15591": { "id": "2608.15591", "classification": "relevant", "reason": "对部署 Agent 持续合规核查、运行时纠正与人工审批前规则验证，属于系统级行为约束和监控。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "aba055af6ef069d766b84812c62f3fb5b39aa296bcf971db27eb7bde4817f3c3", "summary_zh": "针对部署后业务规则变化而 Agent 行为固定的问题，提出可包装既有 Agent 的持续评估与演化框架，通过规则配置、确定性与 LLM 混合纠正、分层调查、人工反馈和审批前规则验证维持行为合规。摘要给出发票处理开源参考实现并声称框架可运行，但未报告受控比较或量化防御结果。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "对部署 Agent 持续合规核查、运行时纠正与人工审批前规则验证，属于系统级行为约束和监控。", "id": "2608.15591" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2608.15591v3", "title": "Agent Gym: A Framework for Continuous Evaluation and Evolution of LLM Agents Through Human-in-the-Loop Feedback", "published": "2026-08-16T07:27:26Z", "updated": "2026-11-03T23:26:41Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2608.15591v3", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Replacement submissions (showing 142 of 142 entries)", "category": "cs.AI", "kind": "new" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v2plus", "backfill_kind": "first_intake_revised_version", "author": { "id": "2608.15591", "version_id": "2608.15591v3", "title": "Agent Gym: A Framework for Continuous Evaluation and Evolution of LLM Agents Through Human-in-the-Loop Feedback", "first_author": "Pouya Ghiasnezhad Omran", "authors": [ "Pouya Ghiasnezhad Omran", "Michael Zimmermann", "Duncan Cambridge", "Ashmita Kapoor", "Tanya Dixit" ], "affiliations": [ "Google Cloud" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2608.15591v3", "source_url": "https://arxiv.org/html/2608.15591v3", "affiliation_source": "https://arxiv.org/html/2608.15591v3", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "6841b594e6252e18b766d0a5b0ce098fa269cc35b8e6d6306ac1a4535d225bb2", "all_author_affiliations": [ "Google Cloud" ] }, "revision_history": [] }, "2611.05390": { "id": "2611.05390", "classification": "relevant", "reason": "研究多 Agent 审核者何时获得覆盖上游决定的权限，以证据门控防止正确决定被破坏。", "summary_zh": "问题：多 Agent 中的审核者能修复错误，也会覆盖原本正确的方案。方法：比较宽泛覆盖权限与证据门控，后者要求先给出可机械验证的硬约束违规记录及合规修复，再允许替换；在两个本地模型、96 个空间策略任务及 96 个组合转移任务上测试。结果：门控显著降低正确方案被破坏的比例，并保留多数违规修复。显式保留、替换或升级处理接口让 Qwen 不再破坏正确方案，但 Mistral 仍替换全部 48 个正确方案，说明接口并非跨模型通用保障。", "topics": { "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "以可验证违规证据限制审核 Agent 的决策覆盖权限，比较修复能力与破坏风险。", "id": "2611.05390" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "28be8dd27128e3f325f66148c54ca2fa25fe200a37d634a5ba26457cb161e0d9", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05390v1", "title": "Who May Overrule the Agent? Evidence-Gated Authority in LLM Review Institutions", "published": "2026-09-12T17:58:39Z", "updated": "2026-09-12T17:58:39Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.MA" ], "source_url": "https://arxiv.org/abs/2611.05390v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 6 of 6 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.MA", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05390", "version_id": "2611.05390v1", "title": "Who May Overrule the Agent? Evidence-Gated Authority in LLM Review Institutions", "first_author": "Fuad Ali", "authors": [ "Fuad Ali" ], "affiliations": [], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "partial", "affiliation_status": "unconfirmed", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05390v1", "source_url": "https://arxiv.org/pdf/2611.05390v1", "affiliation_source": "https://arxiv.org/pdf/2611.05390v1", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "官方HTML和PDF首页均仅列Fuad Ali，未列署名机构；机构未确认。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "6084e7a453b33b47c97a9e15f4c2a4ffd315c2b08d9407eef9ebe83b41330d07", "all_author_affiliations": [] }, "revision_history": [] }, "2611.05427": { "id": "2611.05427", "classification": "relevant", "reason": "纳入 Agent 安全相关综述：对象是具有对话、世界状态和记忆的 LLM NPC/虚拟 Agent，RQ9 系统编码安全与防护，正文专门讨论玩家越狱、游戏内文本注入和跨玩家共享状态攻击面。安全只是综述的一部分，应标注综述/间接证据，不当作新攻击或防御实验。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "5d1961675d8e141d403f05d3e05414a934972f0ef5c2d0781f1d072a6d8ec041", "initial_classification": "uncertain", "initial_reason": "LLM 游戏 NPC 综述明确涉及 safety coverage，但摘要未给出安全威胁或覆盖结论；需正文确认是否研究 NPC Agent 自身攻击与防护而非仅性能/开发成本。", "summary_zh": "针对 LLM NPC 的实现与评测分散问题，作者从 377 条文献记录中筛出 42 篇，系统梳理架构、记忆、延迟、安全和可复现性。安全部分发现防护多依赖角色/系统提示，运行时护栏较少，并综述已报告的玩家越狱；讨论还指出游戏内文本注入和恶意玩家影响后续玩家共享 NPC 状态的未解决风险。这是文献映射及研究缺口分析，并未实测上述新攻击或验证通用防御。", "topics": { "tags": [ "injection", "memory", "multiagent", "evaluation" ], "reason_zh": "综述玩家越狱、游戏文本注入、NPC 共享状态污染与安全防护缺口。", "id": "2611.05427" }, "checked_sections": [ "III Results / RQ9 safety and alignment", "IV-B Structural barriers / Barrier #5", "IV-C Copyright, Security, and the Impact on Creative Labour", "IV-D Technical Roadblocks / S.E. Challenge #5", "IV-E Threats to Validity" ], "evidence_quotes": [ "Only two papers implement runtime guardrail components as actual system elements", "Two papers document active jailbreaking in player-facing deployments", "prompt injection via in-game text represents an additional unresolved attack surface", "adversarial players can influence an NPC’s state in ways that affect all subsequent players in that session." ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2611.05427v1", "full_text_sha256": "a44caa4abe46efa32384e275d9289b119a0242055c7f960b77ed333134acf422", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05427v1", "title": "LLM-based NPCs in Video Games: A Systematic Mapping Study", "published": "2026-11-02T23:03:44Z", "updated": "2026-11-02T23:03:44Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.05427v1", "last_checked_date": "2026-11-06", "scope_review": { "id": "2611.05427", "classification": "relevant", "reason": "纳入 Agent 安全相关综述：对象是具有对话、世界状态和记忆的 LLM NPC/虚拟 Agent，RQ9 系统编码安全与防护，正文专门讨论玩家越狱、游戏内文本注入和跨玩家共享状态攻击面。安全只是综述的一部分，应标注综述/间接证据，不当作新攻击或防御实验。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "5d1961675d8e141d403f05d3e05414a934972f0ef5c2d0781f1d072a6d8ec041", "initial_classification": "uncertain", "initial_reason": "LLM 游戏 NPC 综述明确涉及 safety coverage，但摘要未给出安全威胁或覆盖结论；需正文确认是否研究 NPC Agent 自身攻击与防护而非仅性能/开发成本。", "summary_zh": "针对 LLM NPC 的实现与评测分散问题，作者从 377 条文献记录中筛出 42 篇，系统梳理架构、记忆、延迟、安全和可复现性。安全部分发现防护多依赖角色/系统提示，运行时护栏较少，并综述已报告的玩家越狱；讨论还指出游戏内文本注入和恶意玩家影响后续玩家共享 NPC 状态的未解决风险。这是文献映射及研究缺口分析，并未实测上述新攻击或验证通用防御。", "topics": { "tags": [ "injection", "memory", "multiagent", "evaluation" ], "reason_zh": "综述玩家越狱、游戏文本注入、NPC 共享状态污染与安全防护缺口。", "id": "2611.05427" }, "checked_sections": [ "III Results / RQ9 safety and alignment", "IV-B Structural barriers / Barrier #5", "IV-C Copyright, Security, and the Impact on Creative Labour", "IV-D Technical Roadblocks / S.E. Challenge #5", "IV-E Threats to Validity" ], "evidence_quotes": [ "Only two papers implement runtime guardrail components as actual system elements", "Two papers document active jailbreaking in player-facing deployments", "prompt injection via in-game text represents an additional unresolved attack surface", "adversarial players can influence an NPC’s state in ways that affect all subsequent players in that session." ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2611.05427v1", "full_text_sha256": "a44caa4abe46efa32384e275d9289b119a0242055c7f960b77ed333134acf422", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05427v1", "title": "LLM-based NPCs in Video Games: A Systematic Mapping Study", "published": "2026-11-02T23:03:44Z", "updated": "2026-11-02T23:03:44Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.SE", "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.05427v1", "last_checked_date": "2026-11-06", "reviewed_sections": [ "III Results / RQ9 safety and alignment", "IV-B Structural barriers / Barrier #5", "IV-C Copyright, Security, and the Impact on Creative Labour", "IV-D Technical Roadblocks / S.E. Challenge #5", "IV-E Threats to Validity" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "III Results / RQ9 safety and alignment", "IV-B Structural barriers / Barrier #5", "IV-C Copyright, Security, and the Impact on Creative Labour", "IV-D Technical Roadblocks / S.E. Challenge #5", "IV-E Threats to Validity" ], "body_source_url": "https://arxiv.org/abs/2611.05427v1", "provenance": [ { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 124 of 124 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "New submissions (showing 32 of 32 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05427", "version_id": "2611.05427v1", "title": "LLM-based NPCs in Video Games: A Systematic Mapping Study", "first_author": "Dilan Mian", "authors": [ "Dilan Mian", "Jeremy Bradbury", "Yann-Gaël Guéhéneuc", "Fabio Petrillo", "Cristiano Politowski" ], "affiliations": [ "Ontario Tech University" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05427v1", "source_url": "https://arxiv.org/html/2611.05427v1", "affiliation_source": "https://arxiv.org/html/2611.05427v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "802bf7126c4a49cdc5f18856f23b95544605ff17f288606b58cb9796ba6064eb", "all_author_affiliations": [ "Ontario Tech University", "Concordia University", "École de Technologie Supérieure" ] }, "revision_history": [] }, "2611.05448": { "id": "2611.05448", "classification": "relevant", "reason": "语言指令驱动自主驾驶 Agent 的动作后果预测与碰撞风险降低，直接研究具身智能体安全决策。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "20bd14a6494ae69d1c9ef5c2924db40f23118f6cf6f67b1b90295fdf09d55c87", "summary_zh": "针对语言驾驶 Agent 难以推断动作后果的问题，以输出结构化概率的决策模型配合预测附近车辆未来运动的语言世界模型，再将预测转为可比较后果。模拟高速汇入与真实交通回放实验中，前瞻显著降低碰撞率并支持自由形式乘客意图；摘要证据来自仿真和回放，不代表真实道路部署验证。", "topics": { "tags": [ "embodied", "robustness", "evaluation" ], "reason_zh": "语言指令驱动自主驾驶 Agent 的动作后果预测与碰撞风险降低，直接研究具身智能体安全决策。", "id": "2611.05448" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05448v1", "title": "Jev with Foresight: Safe Language-Guided Autonomous Driving via a Language World Model", "published": "2026-11-03T17:36:47Z", "updated": "2026-11-03T17:36:47Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.RO" ], "source_url": "https://arxiv.org/abs/2611.05448v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 124 of 124 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05448", "version_id": "2611.05448v1", "title": "Jev with Foresight: Safe Language-Guided Autonomous Driving via a Language World Model", "first_author": "Yansong Qu", "authors": [ "Yansong Qu", "Jiancong Chen", "Samuel Labi" ], "affiliations": [ "Lyles School of Civil and Construction Engineering, Purdue University" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05448v1", "source_url": "https://arxiv.org/html/2611.05448v1", "affiliation_source": "https://arxiv.org/html/2611.05448v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "bdde8d5b7552d67848b875181c63ef24d9d56771dbba9284ceea1e9eefe5c388", "all_author_affiliations": [ "Lyles School of Civil and Construction Engineering, Purdue University" ] }, "revision_history": [] }, "2611.05454": { "id": "2611.05454", "classification": "relevant", "reason": "将企业 Agent 必做、禁做和证据不足时弃权规则写成行为契约，并在模型外执行授权与运行时治理。", "summary_zh": "问题：模型、策略、schema 或提示变化常让企业 Agent 行为悄然回归，传统测试难以捕捉。方法：ABE 把可观察行为而非提示视为版本化工程产物，用稳定规则 ID 的行为契约连接场景库、测试、运行策略及遥测；权限由模型外机制执行，以逐场景 pass^k 而非总体准确率控制发布。结果：论文以可执行容量分配边界套件和构造的产品评论审批工作流说明方法；摘要未给出大规模实证效果，也不把示例当部署安全保证。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "以行为契约、外部授权执行和场景级可靠性门控治理企业 Agent。", "id": "2611.05454" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "1736d90b0c7259c83bad72676b24a2260ab32cd3f895a4269c23011c0dee183e", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05454v1", "title": "Agentic Behavior Engineering: A Design-by-Contract Methodology for Specifying, Verifying, and Governing Enterprise AI Agents", "published": "2026-11-03T18:40:25Z", "updated": "2026-11-03T18:40:25Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.05454v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 32 of 32 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05454", "version_id": "2611.05454v1", "title": "Agentic Behavior Engineering: A Design-by-Contract Methodology for Specifying, Verifying, and Governing Enterprise AI Agents", "first_author": "Yang Song", "authors": [ "Yang Song" ], "affiliations": [ "Independent Researcher" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05454v1", "source_url": "https://arxiv.org/pdf/2611.05454v1", "affiliation_source": "https://arxiv.org/pdf/2611.05454v1", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "d1fe1d3b1e47407bd7892c9f4ec9596590849443763dc49c137d54a534f780cf", "all_author_affiliations": [ "Independent Researcher" ] }, "revision_history": [] }, "2611.05586": { "id": "2611.05586", "classification": "relevant", "reason": "直接防御自主 Agent 链上服务市场的女巫身份信誉操纵，关系到 Agent 对服务提供者的信任选择。", "summary_zh": "问题：自主 Agent 在无需许可的市场中选择服务商时，交易量和常规信誉规则易受女巫攻击。方法：Anduin 将 16 条链、157 天内 6600 万笔、总额 610 万美元的 Agent 交易表示为买方与服务商二分图，从买方既有信任网络的路径计算信誉，并提出最大流和两种松弛评分算法。结果：在 813 个买方上的模拟攻击中，操纵成本达到这些买方总支出的 20%，约为标准协同过滤相似度规则的 23 倍。", "topics": { "tags": [ "multiagent", "authorization", "evaluation" ], "reason_zh": "评测 Agent 服务生态中伪造身份对信任和信誉选择的操纵，并给出图结构防御。", "id": "2611.05586" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "297332330d38d9a7d02d209619097977d27e285370be9ad8567212f3c8abd39b", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05586v1", "title": "Anduin: A sybil-resistant agentic marketplace reputation system", "published": "2026-11-03T20:17:03Z", "updated": "2026-11-03T20:17:03Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.05586v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05586", "version_id": "2611.05586v1", "title": "Anduin: A sybil-resistant agentic marketplace reputation system", "first_author": "Reza Ramji", "authors": [ "Reza Ramji", "Preston Vander Vos", "Ziming Zeng", "Duc V. Le" ], "affiliations": [ "Circle Research" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05586v1", "source_url": "https://arxiv.org/html/2611.05586v1", "affiliation_source": "https://arxiv.org/html/2611.05586v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "首页注明该工作在首作者任职Circle期间完成；不代表当前雇佣关系。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "3d9d34dc97b4c3c7da21e48a4cbad23881df8d442294a500bff3b6dfda44b323", "all_author_affiliations": [ "Circle Research" ] }, "revision_history": [] }, "2611.05590": { "id": "2611.05590", "classification": "uncertain", "reason": "正文确认七 Agent 验证修复流水线，并给出错误实现 result := 0 配弱后置条件仍通过验证的构造反例及静态绑定门。但主实证主要是证书语法约定与需求/隐藏测试正确性；作者明确未绑定不等于语义空洞，也明确指标失配不是被复现流水线的缺陷。没有实证确认实际 Agent 有意钻评分漏洞或伪造证明。因此安全关联偏弱，保留 uncertain，不仅因多 Agent 和验证字样纳入；若只收明确任务诚信攻击/防御，应排除。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "f34f4f5d1993ebb9293b289cdbb730d0af1c1252fa6d3e003a05c83771313c7e", "initial_classification": "uncertain", "initial_reason": "研究生成代码的验证证书与真实规格脱节；需核查是否以 Coding Agent 工作流及虚假安全保证为研究对象。", "summary_zh": "针对 Coding Agent 交付代码时单一“验证通过”数字无法表明证书真正约束用户需求的问题，区分验证器接受、规格语法绑定和语义忠实性，并在七 Agent 验证修复流水线加入 ensures 绑定门。复现流水线在 HumanEval 的验证接受率为 99.1%，外部规格绑定仅 1.9%；即使另一流水线所有交付组件通过绑定门，部分样本仍未通过隐藏测试。结果揭示验证指标和需求符合性之间的缺口，不等于 Dafny 不可靠、所有未绑定证书均空洞或 Agent 存在恶意。", "topics": { "tags": [ "evaluation", "monitoring", "multiagent" ], "reason_zh": "自主多 Agent 生成代码与证书的验证边界、完整性门及隐藏测试审计。", "id": "2611.05590" }, "checked_sections": [ "1 Introduction", "3 The ensures-binding gate: a syntactic instance of Surface B", "4 Experimental setup / Baselines, Model sampling and verifier", "6 Surface B to Surface C / operationalisation on Rust benchmarks", "8 Related Work (verification checks and metric decomposition)", "9 Conclusion, limitations, and methodological ask" ], "evidence_quotes": [ "is our own seven-agent\npipeline: Planner decomposes the problem into components; SpecAgent\nauthors Dafny specs; ImplementationAgent authors implementations;\nProverAgent drives a verify-repair loop", "This is a reported structural rejection rate, not an independently\nadjudicated semantic-vacuity prevalence.", "The mismatch is a defect of the metric we use\nto summarize the pipeline, not of the pipeline itself." ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。 对相关性仍有保留；summary_zh 仅供边界复核，不表示已纳入。", "full_text_source_url": "https://arxiv.org/abs/2611.05590v1", "full_text_sha256": "e750590889d5b42eb8ff561969f6911d65353643a0b49051e1832d1f24780a35", "scope_status": "scope_pending", "uncertainty_kind": "agent_verification_integrity_versus_general_functional_correctness", "review_question": "正文已复核，仍为范围边界：是否把非恶意的验证指标/需求正确性缺口计入 Agent 安全。暂不混入相关论文主列表。", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05590v1", "title": "Verified but Vacuous: Three Failure Surfaces of LLM-Driven Verified Code Generation", "published": "2026-11-03T20:20:57Z", "updated": "2026-11-03T20:20:57Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.05590v1", "last_checked_date": "2026-11-06", "scope_review": { "id": "2611.05590", "classification": "uncertain", "reason": "正文确认七 Agent 验证修复流水线，并给出错误实现 result := 0 配弱后置条件仍通过验证的构造反例及静态绑定门。但主实证主要是证书语法约定与需求/隐藏测试正确性；作者明确未绑定不等于语义空洞，也明确指标失配不是被复现流水线的缺陷。没有实证确认实际 Agent 有意钻评分漏洞或伪造证明。因此安全关联偏弱，保留 uncertain，不仅因多 Agent 和验证字样纳入；若只收明确任务诚信攻击/防御，应排除。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "f34f4f5d1993ebb9293b289cdbb730d0af1c1252fa6d3e003a05c83771313c7e", "initial_classification": "uncertain", "initial_reason": "研究生成代码的验证证书与真实规格脱节；需核查是否以 Coding Agent 工作流及虚假安全保证为研究对象。", "summary_zh": "针对 Coding Agent 交付代码时单一“验证通过”数字无法表明证书真正约束用户需求的问题，区分验证器接受、规格语法绑定和语义忠实性，并在七 Agent 验证修复流水线加入 ensures 绑定门。复现流水线在 HumanEval 的验证接受率为 99.1%，外部规格绑定仅 1.9%；即使另一流水线所有交付组件通过绑定门，部分样本仍未通过隐藏测试。结果揭示验证指标和需求符合性之间的缺口，不等于 Dafny 不可靠、所有未绑定证书均空洞或 Agent 存在恶意。", "topics": { "tags": [ "evaluation", "monitoring", "multiagent" ], "reason_zh": "自主多 Agent 生成代码与证书的验证边界、完整性门及隐藏测试审计。", "id": "2611.05590" }, "checked_sections": [ "1 Introduction", "3 The ensures-binding gate: a syntactic instance of Surface B", "4 Experimental setup / Baselines, Model sampling and verifier", "6 Surface B to Surface C / operationalisation on Rust benchmarks", "8 Related Work (verification checks and metric decomposition)", "9 Conclusion, limitations, and methodological ask" ], "evidence_quotes": [ "is our own seven-agent\npipeline: Planner decomposes the problem into components; SpecAgent\nauthors Dafny specs; ImplementationAgent authors implementations;\nProverAgent drives a verify-repair loop", "This is a reported structural rejection rate, not an independently\nadjudicated semantic-vacuity prevalence.", "The mismatch is a defect of the metric we use\nto summarize the pipeline, not of the pipeline itself." ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。 对相关性仍有保留；summary_zh 仅供边界复核，不表示已纳入。", "full_text_source_url": "https://arxiv.org/abs/2611.05590v1", "full_text_sha256": "e750590889d5b42eb8ff561969f6911d65353643a0b49051e1832d1f24780a35", "scope_status": "scope_pending", "uncertainty_kind": "agent_verification_integrity_versus_general_functional_correctness", "review_question": "正文已复核，仍为范围边界：是否把非恶意的验证指标/需求正确性缺口计入 Agent 安全。暂不混入相关论文主列表。", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05590v1", "title": "Verified but Vacuous: Three Failure Surfaces of LLM-Driven Verified Code Generation", "published": "2026-11-03T20:20:57Z", "updated": "2026-11-03T20:20:57Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.05590v1", "last_checked_date": "2026-11-06", "reviewed_sections": [ "1 Introduction", "3 The ensures-binding gate: a syntactic instance of Surface B", "4 Experimental setup / Baselines, Model sampling and verifier", "6 Surface B to Surface C / operationalisation on Rust benchmarks", "8 Related Work (verification checks and metric decomposition)", "9 Conclusion, limitations, and methodological ask" ], "review_attempted": true, "review_status": "scope_pending" }, "reviewed_sections": [ "1 Introduction", "3 The ensures-binding gate: a syntactic instance of Surface B", "4 Experimental setup / Baselines, Model sampling and verifier", "6 Surface B to Surface C / operationalisation on Rust benchmarks", "8 Related Work (verification checks and metric decomposition)", "9 Conclusion, limitations, and methodological ask" ], "body_source_url": "https://arxiv.org/abs/2611.05590v1", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05590", "version_id": "2611.05590v1", "title": "Verified but Vacuous: Three Failure Surfaces of LLM-Driven Verified Code Generation", "first_author": "Aditya Vempaty", "authors": [ "Aditya Vempaty", "Himaneesh Sompalle", "Manan Tayal", "Mowafak Allaham", "Prasenjit Dey", "Ashish Jagmohan", "Ravi Kokku" ], "affiliations": [], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "partial", "affiliation_status": "unconfirmed", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05590v1", "source_url": "https://arxiv.org/pdf/2611.05590v1", "affiliation_source": "https://arxiv.org/pdf/2611.05590v1", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "官方HTML作者分组异常，PDF首页确认七名作者但无机构署名，机构未确认。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "45daa7a4ea0c47c96d463b0764b69619c39f38c506b48ca9aded8ef772a48ce6", "all_author_affiliations": [] }, "revision_history": [] }, "2611.05632": { "id": "2611.05632", "classification": "relevant", "reason": "直接研究自主 Agent 在工具调用、委派和环境变化中的连续授权、权限收缩与陈旧行动拒绝。", "summary_zh": "问题：自主 Agent 的模型、环境或证据变化后，既有授权可能仍在执行。方法：ACCA 将证据有效性和情境适用性分开，用带类型的依赖图更新保证声明，并在主体权限上限与策略内计算有效授权范围；权限 epoch 和可选授权依据版本用于执行前复核。结果：交易场景回归测试展示默认拒绝、证据驱动的权限收缩和恢复、策略分歧处理及本地网关对陈旧行动的拒绝。作者明确将证据限于单一领域实现，不声称跨领域防止有害行为。", "topics": { "tags": [ "authorization", "evaluation" ], "reason_zh": "以保证证据动态约束 Agent 权限并在产生外部效果前拒绝失效授权。", "id": "2611.05632" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body", "abstract_sha256": "0435b4c25f31c834fe197c8848acc71f4ec1a73f0bc645f5b0418847596a3e41", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05632v1", "title": "Assurance-Conditioned Continuous Authorization for Autonomous AI Agents", "published": "2026-11-03T21:19:46Z", "updated": "2026-11-03T21:19:46Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CR" ], "source_url": "https://arxiv.org/abs/2611.05632v1", "last_checked_date": "2026-11-06", "body_source_url": "https://arxiv.org/html/2611.05632v1", "body_review_sections": [ "S5", "S6", "S8", "S9" ], "body_evidence_limits": "这是单一交易profile的实现与机制回归验证，没有与成熟连续授权方案做受控对比，未验证代表性现实失败分布；依赖完整性、证据可信性和受保护执行边界均是假设或接口，不应宣传为一般有害行为防护保证。", "provenance": [ { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 10 of 10 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05632", "version_id": "2611.05632v1", "title": "Assurance-Conditioned Continuous Authorization for Autonomous AI Agents", "first_author": "Mehdi Shajari", "authors": [ "Mehdi Shajari" ], "affiliations": [ "Independent Researcher, Canada" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05632v1", "source_url": "https://arxiv.org/html/2611.05632v1", "affiliation_source": "https://arxiv.org/html/2611.05632v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "64c2b457affe0879fb0e5cdf7550513729d901007a93567f9e3e6f0d34ab73a7", "all_author_affiliations": [ "Independent Researcher, Canada" ] }, "revision_history": [] }, "2611.05662": { "id": "2611.05662", "classification": "relevant", "reason": "工具型 Agent 评审会受无证据权威提示误导，研究执行轨迹中的不可信信息依从与评测可靠性。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "c0cd901e97a6a79e240d5af77ae8b9eb9762b649eae3cae88ec5b8c4b767ae5f", "summary_zh": "针对带工具证据收集的 Agent 评审仍可能被权威线索误导的问题，加入与正确结论无证据关联的虚假预审备注，并分析评审轨迹。摘要称该线索最多翻转四成原本正确裁决，归纳出过度信任、编造支持和调查不足三类失败；轻量缓解可削弱但未消除偏差，作者将其定位为受控偏差诊断而非攻击。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "工具型 Agent 评审会受无证据权威提示误导，研究执行轨迹中的不可信信息依从与评测可靠性。", "id": "2611.05662" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05662v1", "title": "Grounded but Not Immune: Confirmation Bias in Agent-as-a-judge", "published": "2026-11-03T21:47:19Z", "updated": "2026-11-03T21:47:19Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CL" ], "source_url": "https://arxiv.org/abs/2611.05662v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 29 of 29 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CL", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05662", "version_id": "2611.05662v1", "title": "Grounded but Not Immune: Confirmation Bias in Agent-as-a-judge", "first_author": "Drake Benjamin Brown", "authors": [ "Drake Benjamin Brown", "Khushbu Pahwa", "Yubin Ge", "Salvatore Romeo", "Akhil Agnihotri", "Yi Zhang", "Xiaofei Ma", "Daniele Bonadiman" ], "affiliations": [ "University of Utah" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05662v1", "source_url": "https://arxiv.org/pdf/2611.05662v1", "affiliation_source": "https://arxiv.org/pdf/2611.05662v1", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "PDF首页*标University of Utah，其他作者†标Amazon；星号不是共同一作。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "3b01d5d06f4e42f35f8feebb505209cc8be0a9a4d4480b5e13e4ecbc1f873196", "all_author_affiliations": [ "University of Utah", "Amazon" ] }, "revision_history": [] }, "2611.05739": { "id": "2611.05739", "classification": "relevant", "reason": "正文证实不仅评人格适配：包含编辑前授权、禁止创建索引/安装软件、保护既有文件、凭据和端点限制、回滚及确认停点；执行轨迹案例显示错用回滚文件、遗漏确认停点等。应纳入 Coding Agent 权限和状态保护评测，但综合分数不能当成独立安全失败率。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "b308bb2322501f3d03488c95bc73c35b9bb81d6539be27a8620088b9c0937e35", "initial_classification": "uncertain", "initial_reason": "Coding Agent 个性化要求基准包含权限义务；需核查权限遵守是否有独立安全场景、违规指标与结果。", "summary_zh": "针对正确补丁仍可能违反用户操作权限、既有状态保护或交付要求的问题，PersonaCodeBench 将预先冻结的具体义务逐轮披露，分开记录授权、工具执行和产物证据，并分别评任务正确性与义务满足。正文案例显示 Agent 可能在错误文件上演示回滚、遗漏确认停点，或未准确区分既有文件与任务修改；加入人格义务后综合通过率低于移除义务的对照。基准包含真实权限安全条件，但其总分混合正确性、沟通及安全，不应解读为独立安全防御效果。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "直接测试 Coding Agent 编辑授权、状态保护、凭据限制和回滚确认义务。", "id": "2611.05739" }, "checked_sections": [ "2.2 Persona Construction", "2.3 Task Construction", "2.4 Persona-driven Agent–User Interaction", "3.3 persona difficulty and selected trajectory cases", "3.4 Coding agent & user simulator behavior analysis", "3.5 Ablation Study", "Appendix C.1 Content Categories", "Appendix D.1 Faithful and Complete Requirement Delivery" ], "evidence_quotes": [ "avoid introducing credentials or unauthorized endpoints", "It also omits the required confirmation stopping point. These failures concern exact paths, state transitions, and authorization boundaries", "knowing that approval will be needed does not authorize an action in advance.", "Input and state protection covers user data, credentials, backups, and pre-existing workspace or output state." ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2611.05739v1", "full_text_sha256": "bd28fd0d63272fb1c056affcaaaa7aaf22eaa6a1a67601820867acfe330883b0", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05739v1", "title": "PersonaCodeBench: Evaluating Coding Agents in Persona-driven Human-Interactive Sessions", "published": "2026-11-03T23:27:20Z", "updated": "2026-11-03T23:27:20Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.05739v1", "last_checked_date": "2026-11-06", "scope_review": { "id": "2611.05739", "classification": "relevant", "reason": "正文证实不仅评人格适配：包含编辑前授权、禁止创建索引/安装软件、保护既有文件、凭据和端点限制、回滚及确认停点；执行轨迹案例显示错用回滚文件、遗漏确认停点等。应纳入 Coding Agent 权限和状态保护评测，但综合分数不能当成独立安全失败率。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "b308bb2322501f3d03488c95bc73c35b9bb81d6539be27a8620088b9c0937e35", "initial_classification": "uncertain", "initial_reason": "Coding Agent 个性化要求基准包含权限义务；需核查权限遵守是否有独立安全场景、违规指标与结果。", "summary_zh": "针对正确补丁仍可能违反用户操作权限、既有状态保护或交付要求的问题，PersonaCodeBench 将预先冻结的具体义务逐轮披露，分开记录授权、工具执行和产物证据，并分别评任务正确性与义务满足。正文案例显示 Agent 可能在错误文件上演示回滚、遗漏确认停点，或未准确区分既有文件与任务修改；加入人格义务后综合通过率低于移除义务的对照。基准包含真实权限安全条件，但其总分混合正确性、沟通及安全，不应解读为独立安全防御效果。", "topics": { "tags": [ "authorization", "evaluation", "monitoring" ], "reason_zh": "直接测试 Coding Agent 编辑授权、状态保护、凭据限制和回滚确认义务。", "id": "2611.05739" }, "checked_sections": [ "2.2 Persona Construction", "2.3 Task Construction", "2.4 Persona-driven Agent–User Interaction", "3.3 persona difficulty and selected trajectory cases", "3.4 Coding agent & user simulator behavior analysis", "3.5 Ablation Study", "Appendix C.1 Content Categories", "Appendix D.1 Faithful and Complete Requirement Delivery" ], "evidence_quotes": [ "avoid introducing credentials or unauthorized endpoints", "It also omits the required confirmation stopping point. These failures concern exact paths, state transitions, and authorization boundaries", "knowing that approval will be needed does not authorize an action in advance.", "Input and state protection covers user data, credentials, backups, and pre-existing workspace or output state." ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2611.05739v1", "full_text_sha256": "bd28fd0d63272fb1c056affcaaaa7aaf22eaa6a1a67601820867acfe330883b0", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05739v1", "title": "PersonaCodeBench: Evaluating Coding Agents in Persona-driven Human-Interactive Sessions", "published": "2026-11-03T23:27:20Z", "updated": "2026-11-03T23:27:20Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.05739v1", "last_checked_date": "2026-11-06", "reviewed_sections": [ "2.2 Persona Construction", "2.3 Task Construction", "2.4 Persona-driven Agent–User Interaction", "3.3 persona difficulty and selected trajectory cases", "3.4 Coding agent & user simulator behavior analysis", "3.5 Ablation Study", "Appendix C.1 Content Categories", "Appendix D.1 Faithful and Complete Requirement Delivery" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "2.2 Persona Construction", "2.3 Task Construction", "2.4 Persona-driven Agent–User Interaction", "3.3 persona difficulty and selected trajectory cases", "3.4 Coding agent & user simulator behavior analysis", "3.5 Ablation Study", "Appendix C.1 Content Categories", "Appendix D.1 Faithful and Complete Requirement Delivery" ], "body_source_url": "https://arxiv.org/abs/2611.05739v1", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05739", "version_id": "2611.05739v1", "title": "PersonaCodeBench: Evaluating Coding Agents in Persona-driven Human-Interactive Sessions", "first_author": "Haixin Wang", "authors": [ "Haixin Wang", "Jianheng Hou", "Hongyu Shen", "Wenzhe Fan", "Wei-Chieh Huang", "Qianyu Zhu", "Weichen Li", "Taoran Li", "Yuhang Yao", "Ruohan Wang", "Zhejian Peng", "Wanting Jiang", "Yifan Chen", "Shushu Liang", "Haoming Li", "Defu Cao", "Xu Hu", "Siyang Wu", "Chen Yang", "Haodi Hu", "Haichao Zhang", "Cong Wang", "Zhiyuan Yu", "Weizhi Zhang", "Yifan Wang", "Jintao Huang", "Yizhou Sun", "Yijun Wang", "Yuexing Hao", "Xiaomin Li" ], "affiliations": [ "University of California, Los Angeles" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05739v1", "source_url": "https://arxiv.org/html/2611.05739v1", "affiliation_source": "https://arxiv.org/html/2611.05739v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "粗体仅标Core Contributor，不据此推断共同一作；†不作共同一作推断。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "366f3b51a231629685144a783d9ea57bf4222f3e17f5d25c683f429252b97ffe", "all_author_affiliations": [ "University of California, Los Angeles", "University of Southern California", "University of Illinois at Urbana-Champaign", "University of Illinois Chicago", "Massachusetts Institute of Technology", "University of Chicago", "Texas A&M University", "Carnegie Mellon University", "University of the Arts London", "Amherst College", "Northwestern University", "Harvard University", "The University of Texas at Dallas", "Purdue University", "The Ohio State University", "Northeastern University" ] }, "revision_history": [] }, "2611.05806": { "id": "2611.05806", "classification": "relevant", "reason": "Office 文档可见内容与提取内容差异可误导 Coding Agent，直接研究工具输入攻击面及防御。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "d72c1641f6b6266bf87c38ab41c1ab105864847e5d22683a408f041cdb848853", "summary_zh": "文档提取器与 Office 显示不一致，使人类审核与模型读取内容分离。作者分析 OOXML 提取通道并构造不含指令注入的五类攻击，在聊天助手和四种编码 Agent 上均观察到至少一种攻击奏效；Prism 按规范重建可见内容，摘要称其能泛化到未见载荷。", "topics": { "tags": [ "evaluation", "robustness" ], "reason_zh": "文档工具输入解析差异形成 Coding Agent 的攻击面。", "id": "2611.05806" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05806v1", "title": "When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents", "published": "2026-11-04T01:32:31Z", "updated": "2026-11-04T01:32:31Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CR" ], "source_url": "https://arxiv.org/abs/2611.05806v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 28 of 28 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 124 of 124 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05806", "version_id": "2611.05806v1", "title": "When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents", "first_author": "Penghui Li", "authors": [ "Penghui Li" ], "affiliations": [ "Nanyang Technological University" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05806v1", "source_url": "https://arxiv.org/html/2611.05806v1", "affiliation_source": "https://arxiv.org/html/2611.05806v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "6b6fd7fd89326f17f8a91c0b143916aecd1952b95197f522033315323d94cd91", "all_author_affiliations": [ "Nanyang Technological University" ] }, "revision_history": [] }, "2611.05873": { "id": "2611.05873", "classification": "relevant", "reason": "作为证据有限的 Agent 记忆安全设计纳入。正文具体研究旧 GUI 记忆被当作当前动作指令的风险，规定按作用域/版本核查、当前屏幕优先、禁用过期记录、专属写入角色；真实更新含旧坐标触发错误控件。必须明确：实际管理器未证实角色写隔离及生命周期执行，脚本化诊断不证明自主识别或端到端防护，因此不可报告防御成功率。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "d1dfd861e5aa36b204bba23cee1c0eda102ea8b7f9ad99d207186859147e4068", "initial_classification": "uncertain", "initial_reason": "GUI 测试 Agent 记忆设作用域、来源和持久化角色并拒用过时经验；需核查属于安全防护还是仅任务可靠性，摘要声明机制未完全执行。", "summary_zh": "针对 GUI 测试 Agent 重用过期路线、把旧记忆当作当前指令的问题，提出带作用域、版本、来源和四状态生命周期的经验契约，要求当前观察优先及专属角色写入，遇到副作用或登录门槛则不自动重验证。十三条更新记录展示旧定位失效等风险，但正文承认归档实现未验证写入隔离与完整生命周期，部分防护仅为策略字段或预设路线诊断；工作支持有边界的设计与风险案例，不支持自主防护成功率或普遍净收益。", "topics": { "tags": [ "memory", "authorization", "monitoring" ], "reason_zh": "明确限制记忆向动作指令升级、过期经验注入和持久写权限，但实现与实证保证不足。", "id": "2611.05873" }, "checked_sections": [ "II Background and Motivation", "III Approach / C Experience Representation / D Three Memory Layers", "III-E Staleness Handling", "III-F Running Example: A Version-Scoped Locator", "III-G Implementation and Provenance Hooks", "V-E RQ5: Real-Update Cases and Stale-Entry Diagnostics", "VI Threats to Validity", "VII-A Positioning the Maintenance Question", "VIII Conclusion" ], "evidence_quotes": [ "They are not hard constraints: current screen observations override memory.", "A conforming implementation must reject any unlisted transition or non-Reflector write. The archived implementation does not establish these checks.", "Because this diagnostic supplies the route interventions, it demonstrates behavior on chosen stale inputs, not autonomous stale-change discovery or general recovery accuracy.", "All counted objectives are read-only." ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2611.05873v1", "full_text_sha256": "3495e86428b81d31cd3408e3e04e2e45dc07bdc420d898a7806ffb8871cae385", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05873v1", "title": "Can LLM Agents Learn to Test? Maintaining Scoped Experience as Testing Evidence for Mobile GUI Testing", "published": "2026-11-04T03:04:37Z", "updated": "2026-11-04T03:04:37Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.05873v1", "last_checked_date": "2026-11-06", "scope_review": { "id": "2611.05873", "classification": "relevant", "reason": "作为证据有限的 Agent 记忆安全设计纳入。正文具体研究旧 GUI 记忆被当作当前动作指令的风险，规定按作用域/版本核查、当前屏幕优先、禁用过期记录、专属写入角色；真实更新含旧坐标触发错误控件。必须明确：实际管理器未证实角色写隔离及生命周期执行，脚本化诊断不证明自主识别或端到端防护，因此不可报告防御成功率。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "d1dfd861e5aa36b204bba23cee1c0eda102ea8b7f9ad99d207186859147e4068", "initial_classification": "uncertain", "initial_reason": "GUI 测试 Agent 记忆设作用域、来源和持久化角色并拒用过时经验；需核查属于安全防护还是仅任务可靠性，摘要声明机制未完全执行。", "summary_zh": "针对 GUI 测试 Agent 重用过期路线、把旧记忆当作当前指令的问题，提出带作用域、版本、来源和四状态生命周期的经验契约，要求当前观察优先及专属角色写入，遇到副作用或登录门槛则不自动重验证。十三条更新记录展示旧定位失效等风险，但正文承认归档实现未验证写入隔离与完整生命周期，部分防护仅为策略字段或预设路线诊断；工作支持有边界的设计与风险案例，不支持自主防护成功率或普遍净收益。", "topics": { "tags": [ "memory", "authorization", "monitoring" ], "reason_zh": "明确限制记忆向动作指令升级、过期经验注入和持久写权限，但实现与实证保证不足。", "id": "2611.05873" }, "checked_sections": [ "II Background and Motivation", "III Approach / C Experience Representation / D Three Memory Layers", "III-E Staleness Handling", "III-F Running Example: A Version-Scoped Locator", "III-G Implementation and Provenance Hooks", "V-E RQ5: Real-Update Cases and Stale-Entry Diagnostics", "VI Threats to Validity", "VII-A Positioning the Maintenance Question", "VIII Conclusion" ], "evidence_quotes": [ "They are not hard constraints: current screen observations override memory.", "A conforming implementation must reject any unlisted transition or non-Reflector write. The archived implementation does not establish these checks.", "Because this diagnostic supplies the route interventions, it demonstrates behavior on chosen stale inputs, not autonomous stale-change discovery or general recovery accuracy.", "All counted objectives are read-only." ], "scope_note": "独立阅读列明章节及完整相关段落；未声称逐字阅读全文其他章节。", "full_text_source_url": "https://arxiv.org/abs/2611.05873v1", "full_text_sha256": "3495e86428b81d31cd3408e3e04e2e45dc07bdc420d898a7806ffb8871cae385", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05873v1", "title": "Can LLM Agents Learn to Test? Maintaining Scoped Experience as Testing Evidence for Mobile GUI Testing", "published": "2026-11-04T03:04:37Z", "updated": "2026-11-04T03:04:37Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.05873v1", "last_checked_date": "2026-11-06", "reviewed_sections": [ "II Background and Motivation", "III Approach / C Experience Representation / D Three Memory Layers", "III-E Staleness Handling", "III-F Running Example: A Version-Scoped Locator", "III-G Implementation and Provenance Hooks", "V-E RQ5: Real-Update Cases and Stale-Entry Diagnostics", "VI Threats to Validity", "VII-A Positioning the Maintenance Question", "VIII Conclusion" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "II Background and Motivation", "III Approach / C Experience Representation / D Three Memory Layers", "III-E Staleness Handling", "III-F Running Example: A Version-Scoped Locator", "III-G Implementation and Provenance Hooks", "V-E RQ5: Real-Update Cases and Stale-Entry Diagnostics", "VI Threats to Validity", "VII-A Positioning the Maintenance Question", "VIII Conclusion" ], "body_source_url": "https://arxiv.org/abs/2611.05873v1", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 32 of 32 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05873", "version_id": "2611.05873v1", "title": "Can LLM Agents Learn to Test? Maintaining Scoped Experience as Testing Evidence for Mobile GUI Testing", "first_author": "Zimu Liu", "authors": [ "Zimu Liu", "Xiaoxi Guo", "Xiaolu Tang", "Liang Yu" ], "affiliations": [ "Ant Group" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05873v1", "source_url": "https://arxiv.org/html/2611.05873v1", "affiliation_source": "https://arxiv.org/html/2611.05873v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "41d9ec34d9f72951f034cb279563223e6df9f5897fcf22523be1543a4fb74766", "all_author_affiliations": [ "Ant Group" ] }, "revision_history": [] }, "2611.05971": { "id": "2611.05971", "classification": "relevant", "reason": "针对 Agent 向外部服务披露用户数据，以信息流控制和可信执行环境约束并记录披露。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "9d206f7ea84918eb8ff4f9331d58bb2cd174336c2e0c8daae18cb75d8a39643f", "summary_zh": "针对机密计算中 Agent 仍需向外部服务披露数据的问题，CORDE 将默认封闭的信息流控制、TEE 账本和远程证明结合，披露前记录内容、收件方与原因。在 AppWorld Agent 评测中，摘要报告该机制增加约 0.5% 任务延迟。", "topics": { "tags": [ "privacy", "authorization", "monitoring" ], "reason_zh": "限制并审计 Agent 用户数据外发。", "id": "2611.05971" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.05971v1", "title": "Enforcing Accountable Disclosure in Confidential AI", "published": "2026-11-04T05:05:43Z", "updated": "2026-11-04T05:05:43Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.CR", "cs.OS" ], "source_url": "https://arxiv.org/abs/2611.05971v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 28 of 28 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CR", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.05971", "version_id": "2611.05971v1", "title": "Enforcing Accountable Disclosure in Confidential AI", "first_author": "Shumpei Shiina", "authors": [ "Shumpei Shiina", "Haruka Takahashi", "Kento Sasaki", "Takuya Hayashi", "Tsubasa Takahashi" ], "affiliations": [ "Acompany Co., Ltd." ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.05971v1", "source_url": "https://arxiv.org/html/2611.05971v1", "affiliation_source": "https://arxiv.org/html/2611.05971v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "c62c51d7c0536ad4920cc8277196b217fc75f2d70b2995c0251d79c643782f39", "all_author_affiliations": [ "Acompany Co., Ltd." ] }, "revision_history": [] }, "2611.06039": { "id": "2611.06039", "classification": "relevant", "reason": "将 Web Agent 规划与不可信网页数据隔离，直接防御提示注入导致的控制流劫持。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "5ef5340948959228cc56b1e4d9169111c432070f45af4c2017746d4b632bb920", "summary_zh": "Web Agent 在 ReAct 中混用可信指令和不可信网页，容易遭提示注入。Baya 先将用户请求编译为调用可信网站 API 的程序，执行时不让网页重写任务或产生新操作。摘要报告其在 WebArena Verified 上效用高于两种 ReAct 基线，在 WASP 上攻击成功率为零；结论限于这些测试。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "通过规划与执行隔离防止网页注入控制流劫持。", "id": "2611.06039" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06039v1", "title": "Securing Web Agents with the Compile-Then-Execute Paradigm", "published": "2026-11-04T06:42:35Z", "updated": "2026-11-04T06:42:35Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.CR" ], "source_url": "https://arxiv.org/abs/2611.06039v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 28 of 28 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CR", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06039", "version_id": "2611.06039v1", "title": "Securing Web Agents with the Compile-Then-Execute Paradigm", "first_author": "Annabella Chow", "authors": [ "Annabella Chow", "Jinhao Zhu", "Sylvie Venuto", "Abdulaziz Alharbi", "Basel Alomair", "Raluca Popa", "David Wagner", "Julien Piet" ], "affiliations": [ "UC Berkeley" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06039v1", "source_url": "https://arxiv.org/html/2611.06039v1", "affiliation_source": "https://arxiv.org/html/2611.06039v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "d365deab02c096f1ce86ba6e7f4e281a1c74b05a9cee9b880231ac18d2a9ce6e", "all_author_affiliations": [ "UC Berkeley", "KACST" ] }, "revision_history": [] }, "2611.06049": { "id": "2611.06049", "classification": "relevant", "reason": "有限纳入：正文有明确 Coding Agent 补丁反 benchmark-gaming 审查和固定验收边界，且实际研究个人记忆的忘记请求、敏感标识保护和归属错误。不能宣称跨家族 critic 已被因果证明可防作弊：没有独立 critic 消融、恶意补丁挑战或拦截率。更强的安全证据来自忘记请求的错误及修复。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "86bcb103101aa8bebaa9c6a3e4e5e208f55149c293f8558a1c6ce58574041437", "initial_classification": "irrelevant", "initial_reason": "研究个人记忆 Agent 与自改进 harness 的检索准确率；虽使用 critic 排查基准投机，但摘要未评估攻击、防泄露或 Agent 安全性质。", "summary_zh": "Reglos 用可撤回的追加式个人记忆与 Coding Agent 改进循环处理记忆使用错误。Claude Code 提议补丁，另一模型家族的 Codex 检查是否依赖数据集模板/标签，固定评估器再检验跨用户划分和第二读取模型表现；正文没有独立证明 critic 的反作弊效果。实际安全案例中，忘记请求曾被错误写成强化记忆，撤回标记和禁止使用已忘信息的政策使正确率从开发集0/9提高到8/9，另一个留出切片达到12/14。对他人偏好误归用户的问题仍未解决；总体记忆基准提升不能等同安全保证。", "topics": { "tags": [ "memory", "privacy", "monitoring", "evaluation" ], "reason_zh": "有限纳入：正文有明确 Coding Agent 补丁反 benchmark-gaming 审查和固定验收边界，且实际研究个人记忆的忘记请求、敏感标识保护和归属错误。不能宣称跨家族 critic 已被因果证明可防作弊：没有独立 critic 消融、恶意补丁挑战或拦截率。更强的安全证据来自忘记请求的错误及修复。", "id": "2611.06049" }, "checked_sections": [ "3.3 The Harness", "3.4 Outer Loop / Proposer, critic and evaluator", "4.3 The Outer Loop / Forgetting as retraction", "5 Discussion and Limitations", "Appendix C Outer loop, splits and acceptance rules" ], "evidence_quotes": [ "The critic clusters the same failures independently and rejects any patch keyed to the dataset’s option templates or labels.", "Retraction with a tombstone, and a policy line that forbids relying on anything listed as forgotten, raised this to eight of nine on development and twelve of fourteen on a held-out slice.", "Preferences that belong to other people stay below chance for every system" ], "scope_note": "独立读取列明完整相关正文段落；并非逐字审阅全文所有章节。", "full_text_source_url": "https://arxiv.org/abs/2611.06049v1", "full_text_sha256": "f3fde134acad81775af4fb1751a14ae1ef3737bed237ab26245641d8eb99dc2c", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06049v1", "title": "Reglos: A Self-Evolving Personal Memory Agent with Recursive Self-Improvement", "published": "2026-11-04T06:56:04Z", "updated": "2026-11-04T06:56:04Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.06049v1", "last_checked_date": "2026-11-06", "scope_review": { "id": "2611.06049", "classification": "relevant", "reason": "有限纳入：正文有明确 Coding Agent 补丁反 benchmark-gaming 审查和固定验收边界，且实际研究个人记忆的忘记请求、敏感标识保护和归属错误。不能宣称跨家族 critic 已被因果证明可防作弊：没有独立 critic 消融、恶意补丁挑战或拦截率。更强的安全证据来自忘记请求的错误及修复。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "86bcb103101aa8bebaa9c6a3e4e5e208f55149c293f8558a1c6ce58574041437", "initial_classification": "irrelevant", "initial_reason": "研究个人记忆 Agent 与自改进 harness 的检索准确率；虽使用 critic 排查基准投机，但摘要未评估攻击、防泄露或 Agent 安全性质。", "summary_zh": "Reglos 用可撤回的追加式个人记忆与 Coding Agent 改进循环处理记忆使用错误。Claude Code 提议补丁，另一模型家族的 Codex 检查是否依赖数据集模板/标签，固定评估器再检验跨用户划分和第二读取模型表现；正文没有独立证明 critic 的反作弊效果。实际安全案例中，忘记请求曾被错误写成强化记忆，撤回标记和禁止使用已忘信息的政策使正确率从开发集0/9提高到8/9，另一个留出切片达到12/14。对他人偏好误归用户的问题仍未解决；总体记忆基准提升不能等同安全保证。", "topics": { "tags": [ "memory", "privacy", "monitoring", "evaluation" ], "reason_zh": "有限纳入：正文有明确 Coding Agent 补丁反 benchmark-gaming 审查和固定验收边界，且实际研究个人记忆的忘记请求、敏感标识保护和归属错误。不能宣称跨家族 critic 已被因果证明可防作弊：没有独立 critic 消融、恶意补丁挑战或拦截率。更强的安全证据来自忘记请求的错误及修复。", "id": "2611.06049" }, "checked_sections": [ "3.3 The Harness", "3.4 Outer Loop / Proposer, critic and evaluator", "4.3 The Outer Loop / Forgetting as retraction", "5 Discussion and Limitations", "Appendix C Outer loop, splits and acceptance rules" ], "evidence_quotes": [ "The critic clusters the same failures independently and rejects any patch keyed to the dataset’s option templates or labels.", "Retraction with a tombstone, and a policy line that forbids relying on anything listed as forgotten, raised this to eight of nine on development and twelve of fourteen on a held-out slice.", "Preferences that belong to other people stay below chance for every system" ], "scope_note": "独立读取列明完整相关正文段落；并非逐字审阅全文所有章节。", "full_text_source_url": "https://arxiv.org/abs/2611.06049v1", "full_text_sha256": "f3fde134acad81775af4fb1751a14ae1ef3737bed237ab26245641d8eb99dc2c", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06049v1", "title": "Reglos: A Self-Evolving Personal Memory Agent with Recursive Self-Improvement", "published": "2026-11-04T06:56:04Z", "updated": "2026-11-04T06:56:04Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.06049v1", "last_checked_date": "2026-11-06", "reviewed_sections": [ "3.3 The Harness", "3.4 Outer Loop / Proposer, critic and evaluator", "4.3 The Outer Loop / Forgetting as retraction", "5 Discussion and Limitations", "Appendix C Outer loop, splits and acceptance rules" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "3.3 The Harness", "3.4 Outer Loop / Proposer, critic and evaluator", "4.3 The Outer Loop / Forgetting as retraction", "5 Discussion and Limitations", "Appendix C Outer loop, splits and acceptance rules" ], "body_source_url": "https://arxiv.org/abs/2611.06049v1", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06049", "version_id": "2611.06049v1", "title": "Reglos: A Self-Evolving Personal Memory Agent with Recursive Self-Improvement", "first_author": "Sen Yang", "authors": [ "Sen Yang", "Jiaduo Lin", "Zehong Huang", "Wen Liu" ], "affiliations": [ "Reglos.ai" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06049v1", "source_url": "https://arxiv.org/html/2611.06049v1", "affiliation_source": "https://arxiv.org/html/2611.06049v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "091e1076d1e357d2c3dcc3d88a2f5feda20d5255b198c0896276152722f3a43b", "all_author_affiliations": [ "Reglos.ai" ] }, "revision_history": [] }, "2611.06116": { "id": "2611.06116", "classification": "relevant", "reason": "固定模型比较 harness 对银行工具行为违规的影响，使用执行日志判定违反规则与过度拒绝，直接关联 Agent 权限和合规。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "092e315684592ea24e575be268b226065ed2b5e848484fc8fe1fb392f8f01f91", "summary_zh": "针对只验证底层模型而忽略部署 harness 的银行 Agent 合规风险，固定四个模型，比较五类 harness，并在模拟银行规则案例上按真实工具执行轨迹评估违规与过度拒绝。结果显示 harness 影响因模型而异，同模型审查器降低违规而未增加过拒；部分违规伴随与已执行动作矛盾的客户回复，说明仅审查对话会漏报。", "topics": { "tags": [ "authorization", "monitoring", "evaluation", "memory" ], "reason_zh": "固定模型比较 harness 对银行工具行为违规的影响，使用执行日志判定违反规则与过度拒绝，直接关联 Agent 权限和合规。", "id": "2611.06116" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06116v1", "title": "The Harness Is the Model: Agent Scaffolding Changes a Fixed LLM's Compliance with Banking Conduct Rules, Unevenly Across Models", "published": "2026-11-04T07:59:59Z", "updated": "2026-11-04T07:59:59Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CL", "cs.CY" ], "source_url": "https://arxiv.org/abs/2611.06116v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 124 of 124 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "New submissions (showing 61 of 61 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CL", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06116", "version_id": "2611.06116v1", "title": "The Harness Is the Model: Agent Scaffolding Changes a Fixed LLM's Compliance with Banking Conduct Rules, Unevenly Across Models", "first_author": "Mehmet Murat Huyut", "authors": [ "Mehmet Murat Huyut" ], "affiliations": [ "Kuveyt Türk Participation Bank", "İstanbul Bilgi University" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06116v1", "source_url": "https://arxiv.org/html/2611.06116v1", "affiliation_source": "https://arxiv.org/html/2611.06116v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "c45929d483da9024acf896c10cd58269035d3f7b338058228cd5e8a9235b5ab0", "all_author_affiliations": [ "Kuveyt Türk Participation Bank", "İstanbul Bilgi University" ] }, "revision_history": [] }, "2611.06204": { "id": "2611.06204", "classification": "relevant", "reason": "全文明确将 LMDrive 与 CoLMDriver 作为实际受保护和评测的目标系统，而非仅在相关工作提及。属于 LLM 驱动具身 Agent 的运行时安全与多车协作防护，可纳入。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "2c036d7b6152d7887c6139efe3001779659b66219afc56953553b8d4c494f707", "initial_classification": "uncertain", "initial_reason": "自动驾驶运行时协同安全保障明确相关具身安全，但摘要未明确 LLM/VLA Agent；需核查纳入范围及七类 ADS 类型。", "summary_zh": "CoSafe 处理混合交通中多个车辆各自看似合理、联合却不安全的决策，通过 V2X 路侧融合、场景级风险检测和联合安全轨迹覆盖实施运行时防护。作者在 CARLA/InterDrive 的七种驾驶系统上测试，明确包括 LLM 驱动 LMDrive 和 LLM 协商 CoLMDriver；跨七系统平均安全违规减少87.80%，不是 LLM 子集单独效果。仍受感知误差、保守全停导致的死锁及协作通信/执行假设限制，未证明真实道路安全或抗恶意通信。", "topics": { "tags": [ "embodied", "multiagent", "monitoring", "evaluation" ], "reason_zh": "全文明确将 LMDrive 与 CoLMDriver 作为实际受保护和评测的目标系统，而非仅在相关工作提及。属于 LLM 驱动具身 Agent 的运行时安全与多车协作防护，可纳入。", "id": "2611.06204" }, "checked_sections": [ "III cooperative runtime assurance and control switch", "IV-A Evaluation Setup / Target ADSes", "IV-B Effectiveness Evaluation", "IV-E mixed deployment", "V Threats to Validity" ], "evidence_quotes": [ "(iii) an LLM-driven ADS, LMDrive", "(v) an LLM-mediated negotiation cooperative ADS, CoLMDriver", "Overall, CoSafe\n reduces safety violations by 87.80%." ], "scope_note": "独立读取列明完整相关正文段落；并非逐字审阅全文所有章节。", "full_text_source_url": "https://arxiv.org/abs/2611.06204v1", "full_text_sha256": "c670d0424f3016f6d4ffe2b4d2e4838af664f2090dba75c68c754698f232e070", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06204v1", "title": "CoSafe: Cooperative Runtime Safety Assurance for Mixed-Traffic Autonomous Driving", "published": "2026-11-04T09:21:22Z", "updated": "2026-11-04T09:21:22Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.RO", "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.06204v1", "last_checked_date": "2026-11-06", "scope_review": { "id": "2611.06204", "classification": "relevant", "reason": "全文明确将 LMDrive 与 CoLMDriver 作为实际受保护和评测的目标系统，而非仅在相关工作提及。属于 LLM 驱动具身 Agent 的运行时安全与多车协作防护，可纳入。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "2c036d7b6152d7887c6139efe3001779659b66219afc56953553b8d4c494f707", "initial_classification": "uncertain", "initial_reason": "自动驾驶运行时协同安全保障明确相关具身安全，但摘要未明确 LLM/VLA Agent；需核查纳入范围及七类 ADS 类型。", "summary_zh": "CoSafe 处理混合交通中多个车辆各自看似合理、联合却不安全的决策，通过 V2X 路侧融合、场景级风险检测和联合安全轨迹覆盖实施运行时防护。作者在 CARLA/InterDrive 的七种驾驶系统上测试，明确包括 LLM 驱动 LMDrive 和 LLM 协商 CoLMDriver；跨七系统平均安全违规减少87.80%，不是 LLM 子集单独效果。仍受感知误差、保守全停导致的死锁及协作通信/执行假设限制，未证明真实道路安全或抗恶意通信。", "topics": { "tags": [ "embodied", "multiagent", "monitoring", "evaluation" ], "reason_zh": "全文明确将 LMDrive 与 CoLMDriver 作为实际受保护和评测的目标系统，而非仅在相关工作提及。属于 LLM 驱动具身 Agent 的运行时安全与多车协作防护，可纳入。", "id": "2611.06204" }, "checked_sections": [ "III cooperative runtime assurance and control switch", "IV-A Evaluation Setup / Target ADSes", "IV-B Effectiveness Evaluation", "IV-E mixed deployment", "V Threats to Validity" ], "evidence_quotes": [ "(iii) an LLM-driven ADS, LMDrive", "(v) an LLM-mediated negotiation cooperative ADS, CoLMDriver", "Overall, CoSafe\n reduces safety violations by 87.80%." ], "scope_note": "独立读取列明完整相关正文段落；并非逐字审阅全文所有章节。", "full_text_source_url": "https://arxiv.org/abs/2611.06204v1", "full_text_sha256": "c670d0424f3016f6d4ffe2b4d2e4838af664f2090dba75c68c754698f232e070", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06204v1", "title": "CoSafe: Cooperative Runtime Safety Assurance for Mixed-Traffic Autonomous Driving", "published": "2026-11-04T09:21:22Z", "updated": "2026-11-04T09:21:22Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.SE", "cs.AI", "cs.RO" ], "source_url": "https://arxiv.org/abs/2611.06204v1", "last_checked_date": "2026-11-06", "reviewed_sections": [ "III cooperative runtime assurance and control switch", "IV-A Evaluation Setup / Target ADSes", "IV-B Effectiveness Evaluation", "IV-E mixed deployment", "V Threats to Validity" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "III cooperative runtime assurance and control switch", "IV-A Evaluation Setup / Target ADSes", "IV-B Effectiveness Evaluation", "IV-E mixed deployment", "V Threats to Validity" ], "body_source_url": "https://arxiv.org/abs/2611.06204v1", "provenance": [ { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 124 of 124 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "New submissions (showing 32 of 32 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06204", "version_id": "2611.06204v1", "title": "CoSafe: Cooperative Runtime Safety Assurance for Mixed-Traffic Autonomous Driving", "first_author": "Dingji Wang", "authors": [ "Dingji Wang", "You Lu", "Haowen Jiang", "Yanggang Chen", "Yuyang Bi", "Bihuan Chen", "Shenglin Bao", "Xin Peng" ], "affiliations": [ "College of Computer Science and Artificial Intelligence, Fudan University" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06204v1", "source_url": "https://arxiv.org/html/2611.06204v1", "affiliation_source": "https://arxiv.org/html/2611.06204v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "2d30c3d151b284335192db0ee3351f3b439fc4916da5ef15a03e56bbdd5b3020", "all_author_affiliations": [ "College of Computer Science and Artificial Intelligence, Fudan University", "East China Institute of Computing Technology" ] }, "revision_history": [] }, "2611.06294": { "id": "2611.06294", "classification": "relevant", "reason": "直接检验 Coding Agent 的仓库上下文选择如何暴露或遮蔽安全检查，并导致可利用代码。", "summary_zh": "问题：以功能正确性为目标的仓库上下文是否足以让 Coding Agent 生成安全代码？方法：构建覆盖 51 个项目、145 个真实 CVE 任务的 CASE-Bench，比较 13 种上下文构建方法、6 个对照及 6 个 LLM，并分析 Agent 轨迹。结果：功能导向上下文最多提升功能通过率 8.2 个百分点，却最多提升安全通过率 3.7 个百分点；隐藏安全保护可使安全通过率下降 8.1 个百分点，插入一个不安全示例可使功能正确但可被利用的代码增加 6.3 个百分点。Agent 仅在 27%–36% 的轨迹中看到相关安全保护。", "topics": { "tags": [ "memory", "supplychain", "evaluation" ], "reason_zh": "仓库上下文中的安全检查与不安全示例改变 Coding Agent 输出代码的可利用性。", "id": "2611.06294" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": true, "evidence_level": "full_abstract_and_targeted_body", "abstract_sha256": "c0fbba1a4d545c9299eb504f8825e00633428bd5909a2b5f1e5459672ac187aa", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06294v1", "title": "A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code", "published": "2026-11-04T10:29:52Z", "updated": "2026-11-04T10:29:52Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CR", "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.06294v1", "last_checked_date": "2026-11-06", "body_source_url": "https://arxiv.org/html/2611.06294v1", "body_review_sections": [ "S3", "S4", "S5", "S6" ], "body_evidence_limits": "安全标签只相对于给定测试与PoC，不是无漏洞保证；六个项目贡献67项任务；比较的是共同管线复现的检索策略；代理只能修改被遮蔽区域，不能直接外推到任意多文件开发任务。", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 28 of 28 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 124 of 124 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 10 of 10 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06294", "version_id": "2611.06294v1", "title": "A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code", "first_author": "Jiongchi Yu", "authors": [ "Jiongchi Yu", "Keke Lian", "Junqing Wang", "Zhikang Fan", "Zhaoxuan Li", "Yongheng Huang", "Ziming Zhao", "Dong Zhang" ], "affiliations": [ "Nanyang Technological University" ], "shared_first_authors": [ { "name": "Jiongchi Yu", "affiliations": [ "Nanyang Technological University" ] }, { "name": "Keke Lian", "affiliations": [ "Tencent" ] } ], "shared_first_note": "共同贡献脚注明确标注。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06294v1", "source_url": "https://arxiv.org/pdf/2611.06294v1", "affiliation_source": "https://arxiv.org/pdf/2611.06294v1", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "PDF首页*号和共同贡献脚注明确确认Jiongchi Yu、Keke Lian共同一作。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "305c8d7b7c5b1c570d97b72b16e6d462b856687b817969b29e10df33959a9ad4", "shared_first_affiliations": { "Jiongchi Yu": [ "Nanyang Technological University" ], "Keke Lian": [ "Tencent" ] }, "shared_first_affiliations_source": "https://arxiv.org/pdf/2611.06294v1", "shared_first_affiliations_status": "verified_from_official_front_matter_author_markers", "all_author_affiliations": [ "Nanyang Technological University", "Tencent", "Zhejiang University", "IIE, CAS" ] }, "revision_history": [] }, "2611.06374": { "id": "2611.06374", "classification": "relevant", "reason": "针对匿名不受约束 AI Agent 的问责风险，提出带身份问责的社会图合约与溯源实现。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "bd29cdb6b721fb4470b1e2bc2f7ec8a9f5b0aebc57dafee4a8891a01c9adac38", "summary_zh": "针对全球平台受 AI 控制、匿名 Agent 缺乏问责及深伪无法溯源的风险，提出基层合约机制，构建可问责 Agent 社交图与数字溯源社交网络。摘要称提供实现二者的智能手机应用以展示风险约束，但未报告定量安全评测。", "topics": { "tags": [ "authorization", "multiagent" ], "reason_zh": "针对匿名不受约束 AI Agent 的问责风险，提出带身份问责的社会图合约与溯源实现。", "id": "2611.06374" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06374v1", "title": "Corralling AI Risks with Grassroots Contracts", "published": "2026-11-04T11:34:17Z", "updated": "2026-11-04T11:34:17Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CL", "cs.DC", "cs.MA" ], "source_url": "https://arxiv.org/abs/2611.06374v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 29 of 29 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CL", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 6 of 6 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.MA", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06374", "version_id": "2611.06374v1", "title": "Corralling AI Risks with Grassroots Contracts", "first_author": "Ehud Shapiro", "authors": [ "Ehud Shapiro" ], "affiliations": [ "London School of Economics", "Weizmann Institute of Science" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06374v1", "source_url": "https://arxiv.org/html/2611.06374v1", "affiliation_source": "https://arxiv.org/html/2611.06374v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "e9c8593940a159347fece35e74c8f07e3a7ebd6bdbf88b32868b351834823c03", "all_author_affiliations": [ "London School of Economics", "Weizmann Institute of Science" ] }, "revision_history": [] }, "2611.06453": { "id": "2611.06453", "classification": "relevant", "reason": "实际评测包含视觉语言驾驶 Agent SimLingo，且直接测量应停却前进、碰撞和传统评分误导，构成具身 Agent 安全基准研究。不能因其他基线为传统控制器而整体排除。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "490c2a69ca8397a9b02d8f595dff7fd8fff0db334c23c0869024af591572c425", "initial_classification": "uncertain", "initial_reason": "驾驶与导航 Agent 停止/冒险行为安全边界评测，但未明确 LLM/VLA；需核查智能体类型及具身安全纳入范围。", "summary_zh": "论文指出驾驶总分可能奖励撞着穿越障碍而低估安全停车，提出沿走廊宽度、车流间隙等可测轴分别估计行动承诺与无碰撞通过能力，并用可通行/应停止标签计算决策准确度。在七种驾驶 Agent（含 InternVL2-1B 驱动的 SimLingo）及仓储机器人上测试发现，相近总分隐藏不同失效方式；SimLingo 在封闭走廊继续前进，其阻塞条件平均驾驶分反而高于停车 Agent。全部结果来自模拟，标签依赖显式安全余量，少量种子使边界估计存在不确定性。", "topics": { "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "实际评测包含视觉语言驾驶 Agent SimLingo，且直接测量应停却前进、碰撞和传统评分误导，构成具身 Agent 安全基准研究。不能因其他基线为传统控制器而整体排除。", "id": "2611.06453" }, "checked_sections": [ "3 failure-boundary profiles and certificates", "4.1 Evaluation Environment and Baselines", "4.3 per-family results / corridor and oncoming windows", "5 discussion / Limitations" ], "evidence_quotes": [ "SimLingo", "a vision-language driving agent\non an InternVL2-1B backbone.", "BridgeDrive and SimLingo commit at every width, including the closed\ncorridor", "All of our results come from simulation." ], "scope_note": "独立读取列明完整相关正文段落；并非逐字审阅全文所有章节。", "full_text_source_url": "https://arxiv.org/abs/2611.06453v1", "full_text_sha256": "38363370256ca5e0f91c663ecca4a44b5636199fbc7bc2045b4bc50e085d865e", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06453v1", "title": "Beyond Infraction Scores: Failure-Boundary Profiles for Closed-Loop Evaluation of Driving and Robot Navigation Agents", "published": "2026-11-04T12:54:09Z", "updated": "2026-11-04T12:54:09Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.CV", "cs.RO", "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.06453v1", "last_checked_date": "2026-11-06", "scope_review": { "id": "2611.06453", "classification": "relevant", "reason": "实际评测包含视觉语言驾驶 Agent SimLingo，且直接测量应停却前进、碰撞和传统评分误导，构成具身 Agent 安全基准研究。不能因其他基线为传统控制器而整体排除。", "abstract_read": true, "reading_basis": "targeted_full_text_sections", "full_text_checked": true, "evidence_level": "full_text_targeted_sections", "abstract_sha256": "490c2a69ca8397a9b02d8f595dff7fd8fff0db334c23c0869024af591572c425", "initial_classification": "uncertain", "initial_reason": "驾驶与导航 Agent 停止/冒险行为安全边界评测，但未明确 LLM/VLA；需核查智能体类型及具身安全纳入范围。", "summary_zh": "论文指出驾驶总分可能奖励撞着穿越障碍而低估安全停车，提出沿走廊宽度、车流间隙等可测轴分别估计行动承诺与无碰撞通过能力，并用可通行/应停止标签计算决策准确度。在七种驾驶 Agent（含 InternVL2-1B 驱动的 SimLingo）及仓储机器人上测试发现，相近总分隐藏不同失效方式；SimLingo 在封闭走廊继续前进，其阻塞条件平均驾驶分反而高于停车 Agent。全部结果来自模拟，标签依赖显式安全余量，少量种子使边界估计存在不确定性。", "topics": { "tags": [ "embodied", "evaluation", "robustness" ], "reason_zh": "实际评测包含视觉语言驾驶 Agent SimLingo，且直接测量应停却前进、碰撞和传统评分误导，构成具身 Agent 安全基准研究。不能因其他基线为传统控制器而整体排除。", "id": "2611.06453" }, "checked_sections": [ "3 failure-boundary profiles and certificates", "4.1 Evaluation Environment and Baselines", "4.3 per-family results / corridor and oncoming windows", "5 discussion / Limitations" ], "evidence_quotes": [ "SimLingo", "a vision-language driving agent\non an InternVL2-1B backbone.", "BridgeDrive and SimLingo commit at every width, including the closed\ncorridor", "All of our results come from simulation." ], "scope_note": "独立读取列明完整相关正文段落；并非逐字审阅全文所有章节。", "full_text_source_url": "https://arxiv.org/abs/2611.06453v1", "full_text_sha256": "38363370256ca5e0f91c663ecca4a44b5636199fbc7bc2045b4bc50e085d865e", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06453v1", "title": "Beyond Infraction Scores: Failure-Boundary Profiles for Closed-Loop Evaluation of Driving and Robot Navigation Agents", "published": "2026-11-04T12:54:09Z", "updated": "2026-11-04T12:54:09Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.RO", "cs.CV", "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.06453v1", "last_checked_date": "2026-11-06", "reviewed_sections": [ "3 failure-boundary profiles and certificates", "4.1 Evaluation Environment and Baselines", "4.3 per-family results / corridor and oncoming windows", "5 discussion / Limitations" ], "review_attempted": true, "review_status": "reviewed" }, "reviewed_sections": [ "3 failure-boundary profiles and certificates", "4.1 Evaluation Environment and Baselines", "4.3 per-family results / corridor and oncoming windows", "5 discussion / Limitations" ], "body_source_url": "https://arxiv.org/abs/2611.06453v1", "provenance": [ { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 10 of 10 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06453", "version_id": "2611.06453v1", "title": "Beyond Infraction Scores: Failure-Boundary Profiles for Closed-Loop Evaluation of Driving and Robot Navigation Agents", "first_author": "Milan Bulat", "authors": [ "Milan Bulat", "Gino Ardelean", "Ellington Kirby" ], "affiliations": [ "Social Chaos Lab" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06453v1", "source_url": "https://arxiv.org/html/2611.06453v1", "affiliation_source": "https://arxiv.org/html/2611.06453v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "b57feea0f74b9d38b42dde10f1efbf1f8c8bde823d77359bf43387e8b341664d", "all_author_affiliations": [ "Social Chaos Lab", "valeo.ai" ] }, "revision_history": [] }, "2611.06545": { "id": "2611.06545", "classification": "relevant", "reason": "Agent 自写交接摘要捏造授权/限制，并通过重放测量后续越权动作，直接涉及记忆与权限。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "d43663dc6f1c6aee242fea7f0c54606fc13e256d5669cc71f9dd826e3b9ce24f", "summary_zh": "长期 Agent 的自写交接摘要可能将无依据内容变成权限规则。作者用带授权账本的合成工具任务及同快照重放检验虚假授权/限制的影响；去除虚假授权后未授权行为减少，而限制的行为影响证据较脆弱。明确规则来源的系统提示降低了无依据限制，摘要同时区分预设与事后分析。", "topics": { "tags": [ "memory", "authorization", "evaluation" ], "reason_zh": "上下文压缩导致权限漂移，并测试后续越权行为。", "id": "2611.06545" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06545v1", "title": "When Do Summaries Become Instructions? Unsupported Policy in LLM Agents' Self-Written Handoff Summaries", "published": "2026-11-04T14:12:09Z", "updated": "2026-11-04T14:12:09Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.CL" ], "source_url": "https://arxiv.org/abs/2611.06545v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 61 of 61 entries)", "category": "cs.CL", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CL", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06545", "version_id": "2611.06545v1", "title": "When Do Summaries Become Instructions? Unsupported Policy in LLM Agents' Self-Written Handoff Summaries", "first_author": "Wenhui Chu", "authors": [ "Wenhui Chu" ], "affiliations": [ "Department of Cybersecurity, University at Albany, State University of New York" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06545v1", "source_url": "https://arxiv.org/html/2611.06545v1", "affiliation_source": "https://arxiv.org/html/2611.06545v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "dc5228121cb1255b69c076fdc9ce6d76506aef3a11a404bd892171a8f3c0d18c", "all_author_affiliations": [ "Department of Cybersecurity, University at Albany, State University of New York" ] }, "revision_history": [] }, "2611.06563": { "id": "2611.06563", "classification": "relevant", "reason": "Coding Agent 工具调用前声明意图并审计真实副作用，揭露奖励作弊，直接属于工具行为监控与安全评测。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "85dc7327966b6d8f94a5a1fcf32b5cf5b56ded2b60124635a00257fe9f305bc0", "summary_zh": "针对 Coding Agent 工具调用缺乏可核查意图的问题，要求模型声明调用目的，由 harness 记录实际状态变化并比对，生成支持执行前拦截、审计与取证的日志。使用必须作弊才能通过的 ImpossibleBench 测试，两种开放权重模型的四十九次奖励作弊运行中，日志揭露了九成作弊；摘要未证明所有危险调用均能被预防。", "topics": { "tags": [ "monitoring", "evaluation", "authorization" ], "reason_zh": "Coding Agent 工具调用前声明意图并审计真实副作用，揭露奖励作弊，直接属于工具行为监控与安全评测。", "id": "2611.06563" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06563v1", "title": "EPISTEME: Trustworthy Coding Agents Through Tool Call Intent", "published": "2026-11-04T14:26:55Z", "updated": "2026-11-04T14:26:55Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.06563v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 32 of 32 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06563", "version_id": "2611.06563v1", "title": "EPISTEME: Trustworthy Coding Agents Through Tool Call Intent", "first_author": "Sofia Bobadilla", "authors": [ "Sofia Bobadilla", "Carmine Cesarano", "Raphina Liu", "Javier Ron", "Martin Monperrus" ], "affiliations": [ "KTH Royal Institute of Technology" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06563v1", "source_url": "https://arxiv.org/html/2611.06563v1", "affiliation_source": "https://arxiv.org/html/2611.06563v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "64452ca8926f4de17aca5f5573b41adb92e979e0395d8a49226cea2e5db882f0", "all_author_affiliations": [ "KTH Royal Institute of Technology" ] }, "revision_history": [] }, "2611.06585": { "id": "2611.06585", "classification": "relevant", "reason": "合法签名 MCP 工具隐蔽泄露及数据隔离执行防御，直接覆盖工具供应链与权限边界。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "5dcb6c8ab781fbfad49399d0fed7a51cd9d399188bf8d017d54486dac5574522", "summary_zh": "合法签名 MCP 工具仍可利用允许的目的地外泄数据。作者提出从无数据 germline 进程派生短生命周期副本，每个副本仅获取目的地获准接收的数据，并在明确隔离假设下证明非干扰性质。摘要报告 153 次攻击运行未检测到未授权披露，且单副本调用快于每次重启工具。", "topics": { "tags": [ "supplychain", "authorization", "privacy" ], "reason_zh": "直接研究恶意 MCP 实现与运行时信息隔离。", "id": "2611.06585" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06585v1", "title": "Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains", "published": "2026-11-04T14:40:32Z", "updated": "2026-11-04T14:40:32Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.CR", "cs.MA" ], "source_url": "https://arxiv.org/abs/2611.06585v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 28 of 28 entries)", "category": "cs.CR", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.CR", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 124 of 124 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 6 of 6 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.MA", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06585", "version_id": "2611.06585v1", "title": "Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains", "first_author": "Yichiet Aun", "authors": [ "Yichiet Aun", "Mohammed A. Alhartomi", "Jing Jie Tan", "Waqas Nadeem", "Adeb Salh", "Shankar Karuppayah", "Sin Chee Tan" ], "affiliations": [ "Faculty of Information and Communication Technology, Universiti Tunku Abdul Rahman" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06585v1", "source_url": "https://arxiv.org/html/2611.06585v1", "affiliation_source": "https://arxiv.org/html/2611.06585v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "官方API作者名为Yichiet Aun；正文署名为Aun Yichiet，均保留，不推断更改姓名。", "paper_first_author_name": "Aun Yichiet", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "698fb68f9dba2b9c4df2cc380096da68f8c4e77562f6df9324dcb8bc9bdbab1b", "all_author_affiliations": [ "Faculty of Information and Communication Technology, Universiti Tunku Abdul Rahman", "Department of Electrical Engineering, University of Tabuk", "National University of Singapore", "Bitranger", "CYRES, Universiti Sains Malaysia", "ABLEs" ] }, "revision_history": [] }, "2611.06674": { "id": "2611.06674", "classification": "relevant", "reason": "在 Java CI 中验证 LLM Agent 工具权限、事实依据及操作轨迹契约，属于 Agent 安全测试。", "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "3dd4e2f054533a430a2bbe8e197f5ca7a7737bdb9eb96f2283fb4ca2184a5d6b", "summary_zh": "AgentTrustCI 针对基础设施安全不能保证 Agent 工具使用与工作流合规的问题，在 Java/JUnit 中定义权限、依据和轨迹检查，并支持确定性重放。在作者构造的 55 个合成用例上识别全部 30 个故障及 25 个正常案例；摘要明确该结果不是生产准确率证明。", "topics": { "tags": [ "authorization", "monitoring", "evaluation" ], "reason_zh": "将 Agent 行为契约和工具权限验证集成到构建测试。", "id": "2611.06674" }, "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06674v1", "title": "AgentTrustCI: Build-Time Policy, Grounding, and Trajectory Tests for Java LLM Agents", "published": "2026-11-04T15:46:11Z", "updated": "2026-11-04T15:46:11Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI", "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.06674v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "Cross submissions (showing 124 of 124 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" }, { "announcement_date": "2026-11-05", "section": "New submissions (showing 32 of 32 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06674", "version_id": "2611.06674v1", "title": "AgentTrustCI: Build-Time Policy, Grounding, and Trajectory Tests for Java LLM Agents", "first_author": "Sachin Gupta", "authors": [ "Sachin Gupta" ], "affiliations": [ "Independent Researcher" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06674v1", "source_url": "https://arxiv.org/html/2611.06674v1", "affiliation_source": "https://arxiv.org/html/2611.06674v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "b816cd9a1e19143f93e36b8955735af883faab318a25d1c1998a7a99e3d1ddbc", "all_author_affiliations": [ "Independent Researcher" ] }, "revision_history": [] }, "2611.06682": { "id": "2611.06682", "classification": "relevant", "reason": "工具 Agent 的本体语义治理、防越权重规划及间接提示注入防御，直接相关。", "abstract_read": true, "reading_basis": "full_final_official_api_abstract", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "ba0128d5fceb87e21ec441500a1e41a8afa79aed4475d4005f7ec06bbe357d6b", "summary_zh": "SecureGARD 针对间接注入变成工具执行风险的问题，以可执行本体和任务状态判定操作 ready、waiting 或 forbidden，允许有限重规划但不扩大权限。本体由离线验证流程更新并冻结，在 AgentDojo、ASB、AgentDyn 上摘要报告攻击成功率为零，同时攻击下任务效用高于所比较基线。", "topics": { "tags": [ "injection", "authorization", "evaluation" ], "reason_zh": "以确定性语义规则约束工具 Agent 动作和权限边界。", "id": "2611.06682" }, "abstract_reading_basis": "full_final_official_api_abstract", "version_id": "2611.06682v1", "title": "SecureGARD: Dynamic Ontology-Guided Governance for Secure Tool-Using LLM Agents", "published": "2026-11-04T15:51:30Z", "updated": "2026-11-04T15:51:30Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.LG" ], "source_url": "https://arxiv.org/abs/2611.06682v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 110 of 110 entries)", "category": "cs.LG", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.LG", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06682", "version_id": "2611.06682v1", "title": "SecureGARD: Dynamic Ontology-Guided Governance for Secure Tool-Using LLM Agents", "first_author": "Guoqin Xiong", "authors": [ "Guoqin Xiong", "Shengtao Wen", "Xiang Chen", "Xinyi Zeng", "Zhaoxin Fan", "Wei Ye", "Xiaofeng Cao", "Sheng-Jun Huang" ], "affiliations": [ "MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics" ], "shared_first_authors": [ { "name": "Guoqin Xiong", "affiliations": [ "MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics" ] }, { "name": "Shengtao Wen", "affiliations": [ "MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics" ] } ], "shared_first_note": "共同贡献脚注明确标注。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06682v1", "source_url": "https://arxiv.org/pdf/2611.06682v1", "affiliation_source": "https://arxiv.org/pdf/2611.06682v1", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "PDF首页*号及脚注明确Guoqin Xiong、Shengtao Wen共同贡献。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "cc5fb8726cf06eb809451194d1294bd209828f9480f9421cef8ed739420e251c", "shared_first_affiliations": { "Guoqin Xiong": [ "MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics" ], "Shengtao Wen": [ "MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics" ] }, "shared_first_affiliations_source": "https://arxiv.org/pdf/2611.06682v1", "shared_first_affiliations_status": "verified_from_official_front_matter_author_markers", "all_author_affiliations": [ "MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics", "Tsinghua University", "Beihang University", "College of Electronic and Information Engineering, Tongji University", "School of Computer Science and Technology, Tongji University" ] }, "revision_history": [] }, "2611.06727": { "id": "2611.06727", "classification": "relevant", "reason": "多 Agent 运行时通过缩减权限、来源追踪和告警后分支隔离阻止错误动作传播，直接研究跨 Agent 风险控制。", "abstract_read": true, "reading_basis": "full_final_official_api_abstract", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "7a4ca89333f3e8115f8fac7611a4549952b0ecf8b6efac6aa5162fa782284070", "summary_zh": "针对一个 Agent 的错误输出跨任务传播、现有局部取消或全局回滚难以兼顾隔离与保留健康工作的问题，Airlock 结合父子权限逐层缩减和追加式跨 Agent 数据来源 DAG，在告警后追踪受污染分支并隔离待执行动作，可进一步用最小割降低连带中断。摘要报告在测试床和真实智能家居 LLM 实验中阻断全部告警后错误执行，收敛后无泄漏，并比原生控制保留更多健康工作；保证范围是告警后及所测环境。", "topics": { "tags": [ "multiagent", "authorization", "monitoring", "evaluation" ], "reason_zh": "多 Agent 运行时通过缩减权限、来源追踪和告警后分支隔离阻止错误动作传播，直接研究跨 Agent 风险控制。", "id": "2611.06727" }, "abstract_reading_basis": "full_final_official_api_abstract", "version_id": "2611.06727v1", "title": "Airlock: Bounding the Multi-Agent Blast Radius via Selective Online Containment", "published": "2026-11-04T16:16:03Z", "updated": "2026-11-04T16:16:03Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.MA" ], "source_url": "https://arxiv.org/abs/2611.06727v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 4 of 4 entries)", "category": "cs.MA", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.MA", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06727", "version_id": "2611.06727v1", "title": "Airlock: Bounding the Multi-Agent Blast Radius via Selective Online Containment", "first_author": "Zhonghao Zhan", "authors": [ "Zhonghao Zhan", "Javad Forough", "Yefan Zhang", "Krinos Li", "Xiao Ma", "Hamed Haddadi" ], "affiliations": [ "Imperial College London", "University of Oxford" ], "shared_first_authors": [ { "name": "Zhonghao Zhan", "affiliations": [ "Imperial College London", "University of Oxford" ] }, { "name": "Javad Forough", "affiliations": [ "Imperial College London" ] }, { "name": "Yefan Zhang", "affiliations": [ "Independent Researcher" ] } ], "shared_first_note": "共同贡献脚注明确标注。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06727v1", "source_url": "https://arxiv.org/html/2611.06727v1", "affiliation_source": "https://arxiv.org/html/2611.06727v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "f976e9bb3a3aaa10051817aa20870f745b6c06e8ff61e4d3e2ccf80ff8e3d87a", "shared_first_affiliations": { "Zhonghao Zhan": [ "Imperial College London", "University of Oxford" ], "Javad Forough": [ "Imperial College London" ], "Yefan Zhang": [ "Independent Researcher" ] }, "shared_first_affiliations_source": "https://arxiv.org/html/2611.06727v1", "shared_first_affiliations_status": "verified_from_official_front_matter_author_markers", "all_author_affiliations": [ "Imperial College London", "University of Oxford", "Independent Researcher" ] }, "revision_history": [] }, "2611.06764": { "id": "2611.06764", "classification": "relevant", "reason": "专门综述 LLM Agent 的访问控制、身份委派、工具/资源执行边界和信息流控制。", "summary_zh": "问题：Agent 自行选取执行路径且权限与环境不断变化，如何在整个工作流中保持授权边界？方法：综述策略规范与派生、身份与委派、行动与资源强制执行、信息流控制四类进展，比较控制对象、边界和假设。结果：归纳计划选择会改变权限需求、上下文不应自动授予权限、跨接口限制需保持语义、授权要随工作流重评四项要求，并提出同时检查已观察行为及仍可发生的未授权后果的评测方向。该文为综述，摘要未报告统一实验指标。", "topics": { "tags": [ "authorization", "privacy", "evaluation" ], "reason_zh": "系统分析 Agent 工作流中的持续授权、委派与信息流边界。", "id": "2611.06764" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "1c3ab4ed1d1defb3937cd0733bbf1db69c70d5d11057415edb0ef79f82c634e4", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06764v1", "title": "Rethinking Access Control for AI Agents: Recent Advances and Open Challenges", "published": "2026-11-04T16:42:53Z", "updated": "2026-11-04T16:42:53Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.SE" ], "source_url": "https://arxiv.org/abs/2611.06764v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 32 of 32 entries)", "category": "cs.SE", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.SE", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06764", "version_id": "2611.06764v1", "title": "Rethinking Access Control for AI Agents: Recent Advances and Open Challenges", "first_author": "Chijin Zhou", "authors": [ "Chijin Zhou", "Quan Zhang" ], "affiliations": [ "Shanghai Key Laboratory of Trustworthy Computing, Software Engineering Institute, East China Normal University" ], "shared_first_authors": [], "shared_first_note": "未见明确共同一作声明，不由作者排序推断。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06764v1", "source_url": "https://arxiv.org/html/2611.06764v1", "affiliation_source": "https://arxiv.org/html/2611.06764v1", "source_type": "official_html_front_matter", "checked_date": "2026-11-06", "note": "", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "685575b7cb60be114a220f2a583f920ade7fbc0e57d225c6ddb07a583a68b33a", "all_author_affiliations": [ "Shanghai Key Laboratory of Trustworthy Computing, Software Engineering Institute, East China Normal University" ] }, "revision_history": [] }, "2611.06911": { "id": "2611.06911", "classification": "relevant", "reason": "针对化学自动实验室的具身 MLLM 决策，明确评测安全规范识别、可行行动与程序执行能力。", "summary_zh": "问题：化学自驱动实验室的具身模型能否把粗粒度程序理解转化为可执行且符合安全规范的判断？方法：BEAKER 由化学和具身 AI 专家人工编制并复核 1000 个图像/视频问答样本，覆盖 11 类操作、轨迹、设备、状态、安全识别和时序任务，离线单轮评测 28 个 MLLM。结果：模型较能理解视频中的粗粒度实验程序，却仍难以定位可操作区域、规划可行轨迹、识别细粒度设备状态与安全规范，以及排序中等长度步骤。该证据来自离线问答，不等同于真实实验执行安全保证。", "topics": { "tags": [ "embodied", "evaluation" ], "reason_zh": "以自驱动化学实验室为场景，检验具身语言模型的行动可行性和安全规范认知。", "id": "2611.06911" }, "abstract_read": true, "reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "full_text_checked": false, "evidence_level": "full_abstract_only", "abstract_sha256": "1ee6eec284f98ebb770adb128ed11577a7c6de39fc41100794ea7a66cdfbdffd", "abstract_reading_basis": "full_official_announcement_abstract_reconciled_with_final_api", "version_id": "2611.06911v1", "title": "BEAKER: An Expert-Curated Benchmark for Embodied Brains in Self-Driving Chemical Laboratories", "published": "2026-11-04T18:57:17Z", "updated": "2026-11-04T18:57:17Z", "announcement_date": "2026-11-05", "candidate_type": "unseen_id", "categories_seen": [ "cs.AI" ], "source_url": "https://arxiv.org/abs/2611.06911v1", "last_checked_date": "2026-11-06", "provenance": [ { "announcement_date": "2026-11-05", "section": "New submissions (showing 93 of 93 entries)", "category": "cs.AI", "kind": "new" }, { "announcement_date": "2026-11-05", "section": "", "category": "cs.AI", "kind": "recent" } ], "fetch_status": "complete", "reading_status": "full_abstract_read", "announcement_status": "官方公告列表已核对；公告日与首次提交日分开", "first_discovered_date": "2026-11-06", "first_seen_date": "2026-11-06", "seen_dates": [ "2026-11-06" ], "intake_version_kind": "v1", "backfill_kind": "first_intake_v1", "author": { "id": "2611.06911", "version_id": "2611.06911v1", "title": "BEAKER: An Expert-Curated Benchmark for Embodied Brains in Self-Driving Chemical Laboratories", "first_author": "Fei Lin", "authors": [ "Fei Lin", "Tengchao Zhang", "Ziyang Gong", "Xiaotong Yu", "Bohan Zhang", "Yifan Zhou", "Qihao Yang", "Ji Dai", "Dong Li", "Yining Jiang", "Qinghua Ni", "Jun Huang", "Qiang Zhang", "Yue Zhou", "Zhihang Zhong", "Yonglin Tian", "Fei-Yue Wang", "Xue Yang" ], "affiliations": [ "HydroSophy", "Macau University of Science and Technology", "Shanghai Jiao Tong University" ], "shared_first_authors": [ { "name": "Fei Lin", "affiliations": [ "HydroSophy", "Macau University of Science and Technology", "Shanghai Jiao Tong University" ] }, { "name": "Tengchao Zhang", "affiliations": [ "HydroSophy", "Macau University of Science and Technology" ] }, { "name": "Ziyang Gong", "affiliations": [ "HydroSophy", "Shanghai Jiao Tong University" ] } ], "shared_first_note": "共同贡献脚注明确标注。", "status": "verified", "affiliation_status": "verified_in_paper", "author_source": "https://export.arxiv.org/api/query?id_list=2611.06911v1", "source_url": "https://arxiv.org/pdf/2611.06911v1", "affiliation_source": "https://arxiv.org/pdf/2611.06911v1", "source_type": "official_pdf_front_page", "checked_date": "2026-11-06", "note": "官方HTML作者栏不完整，仅显示末位作者；已视觉核实PDF首页完整作者表，首作者为Fei Lin，Fei Lin、Tengchao Zhang、Ziyang Gong共同贡献。", "first_author_status": "verified_official_metadata_and_front_matter", "source_sha256": "5738ea89f07f8d113a78f0fae0f770d5e3d7b1ad7a6d618eb1b76f3f2712be81", "shared_first_affiliations": { "Fei Lin": [ "HydroSophy", "Macau University of Science and Technology", "Shanghai Jiao Tong University" ], "Tengchao Zhang": [ "HydroSophy", "Macau University of Science and Technology" ], "Ziyang Gong": [ "HydroSophy", "Shanghai Jiao Tong University" ] }, "shared_first_affiliations_source": "https://arxiv.org/pdf/2611.06911v1", "shared_first_affiliations_status": "verified_from_official_front_matter_author_markers", "all_author_affiliations": [ "HydroSophy", "Macau University of Science and Technology", "Shanghai Jiao Tong University", "Institute of Process Engineering, Chinese Academy of Sciences", "Ningbo University", "Dalian University of Technology", "East China Normal University", "Institute of Automation, Chinese Academy of Sciences" ] }, "revision_history": [] } }, "daily": { "2026-10-25": { "paper_ids": [ "2610.31404", "2610.31366", "2610.30666", "2610.30418", "2610.30365", "2610.30202", "2610.30738", "2610.30157", "2610.29869", "2610.29747", "2610.29379", "2610.29178", "2610.28966", "2610.28810", "2610.28989", "2610.28987", "2610.28425", "2610.28397", "2610.28315", "2610.28093", "2610.27739", "2610.27620", "2610.27543", "2610.27244", "2610.26935", "2610.28484", "2610.27574", "2610.27548", "2610.27210", "2610.26867", "2610.26799", "2610.26501", "2610.26438", "2610.26088", "2610.26013", "2610.25916", "2610.25372", "2610.25032", "2610.24999", "2610.24916", "2610.24896", "2610.24741", "2610.24379", "2610.24359", "2610.24311", "2610.24289", "2610.24277", "2610.24055", "2610.24052", "2610.24873", "2610.24545", "2610.24048", "2610.23307", "2610.23303", "2610.23233", "2610.23109", "2610.23078", "2610.23077", "2610.22959", "2610.22913", "2610.22899", "2610.22873", "2610.22828", "2610.22697", "2610.22578", "2610.23362", "2610.23254", "2610.22874", "2610.31650", "2610.31593", "2610.31553", "2610.31436", "2610.31376", "2610.31372", "2610.31130", "2610.31062", "2610.30769", "2610.30751", "2610.30698", "2610.30582", "2610.30557", "2610.30495", "2610.30491", "2610.30485", "2610.30445", "2610.30436", "2610.31624", "2610.31306", "2610.31165", "2610.30562", "2610.30188", "2610.30161", "2610.28982", "2610.28934", "2610.28891", "2610.29129", "2610.28955", "2610.28679", "2610.28667", "2610.28522", "2610.28454", "2610.27777", "2610.27735", "2610.27655", "2610.27581", "2610.27483", "2610.27480", "2610.27465", "2610.27406", "2610.27234", "2610.27115", "2610.26943", "2610.28160", "2610.27350", "2610.26698", "2610.26664", "2610.26662", "2610.26551", "2610.26548", "2610.26369", "2610.26324", "2610.26101", "2610.25954", "2610.25947", "2610.25843", "2610.25827", "2610.25707", "2610.25563", "2610.25552", "2610.25496", "2610.25179", "2610.25064", "2610.24969", "2610.24824", "2610.24382", "2610.24380", "2610.24298", "2610.24264", "2610.24255", "2610.24194", "2610.25760", "2610.25629", "2610.25241", "2610.25114", "2610.24929", "2610.24823", "2610.24613", "2610.24483", "2610.24231", "2610.24206", "2610.23670", "2610.23449", "2610.23257", "2610.22987", "2610.22779", "2610.22441", "2610.22426", "2610.22373", "2610.22990", "2610.22882", "2610.30742", "2610.29292", "2610.28787", "2610.29216", "2610.27577", "2610.27295", "2610.27227", "2610.28381", "2610.25731", "2610.25458", "2610.25123", "2610.24949", "2610.25161", "2610.23093", "2610.23071", "2610.22594", "2610.22507", "2610.30924", "2610.30916", "2610.30571", "2610.30221", "2610.29609", "2610.28683", "2610.28116", "2610.23632", "2610.29346", "2610.28988", "2610.28798", "2610.28707", "2610.25374", "2610.24601", "2610.24348", "2610.23707", "2610.23251", "2610.21711", "2610.31446", "2610.31325", "2610.25508", "2610.23904", "2610.22701" ], "counts": { "official_entries": 4434, "unique_candidates": 3135, "abstracts_read": 3135, "relevant": 188, "uncertain": 12, "irrelevant": 2935, "pending": 0, "backfill": 3135 }, "coverage_batches": [ "2026-10-19", "2026-10-20", "2026-10-21", "2026-10-22", "2026-10-23" ], "new_archive_ids": 200 }, "2026-10-26": { "paper_ids": [ "1803.03407", "2601.12310", "2602.03608", "2602.21262", "2603.03403", "2604.01723", "2604.04978", "2604.05589", "2604.07667", "2604.12284", "2604.24920", "2604.27819", "2605.01462", "2605.07306", "2605.07630", "2605.08442", "2605.11036", "2605.11442", "2605.31196", "2606.03161", "2606.03163", "2606.26918", "2607.05318", "2607.06882", "2607.18665", "2607.19913", "2607.20491", "2607.21951", "2607.29529", "2608.10475", "2608.10502", "2608.14590", "2608.23035", "2609.00192", "2609.02992", "2609.05901", "2609.06783", "2609.08472", "2609.10144", "2609.22486", "2609.22818", "2609.33123", "2609.34241", "2609.34415", "2609.34790", "2609.35659", "2610.04693", "2610.04699", "2610.06044", "2610.06814", "2610.07257", "2610.09163", "2610.12445", "2610.14404", "2610.15884", "2610.17528", "2610.18603", "2610.19361", "2610.21561", "2610.21624", "2610.22873", "2610.23632", "2610.24348", "2610.24613", "2610.24929", "2610.24969", "2610.25496", "2610.26369", "2610.27406", "2610.27581", "2610.28522", "2610.29346", "2610.31778", "2610.31840", "2610.31895", "2610.31914", "2610.31916", "2610.31971", "2610.31972", "2610.31974", "2610.31985", "2610.32004", "2610.32024", "2610.32045", "2610.32069", "2610.32092", "2610.32110", "2610.32151", "2610.32155", "2610.32285", "2610.32305", "2610.32370", "2610.32392", "2610.32429", "2610.32531", "2610.32555" ], "counts": { "recent_official_entries": 4434, "latest_new_list_entries": 1079, "api_entries": 2245, "updated_api_raw_entries": 4000, "updated_api_in_window": 3471, "official_entries": 11229, "unique_candidates": 4618, "screening_candidates": 1522, "abstracts_read": 1534, "incremental_abstracts_read": 1522, "historical_uncertain_abstracts_reread": 12, "relevant": 79, "uncertain": 5, "irrelevant": 1438, "new_checkpoint_ids": 1483, "existing_candidate_rechecks": 39, "new_archive_ids": 84, "historical_scope_relevant": 4, "historical_scope_irrelevant": 5, "historical_scope_uncertain": 3, "pending_abstracts": 0, "failed_fetches_unresolved": 0, "backfill": 84 }, "coverage_batches": [ "2026-10-19", "2026-10-20", "2026-10-21", "2026-10-22", "2026-10-23" ], "new_archive_ids": 84 }, "2026-10-27": { "paper_ids": [ "2212.06123", "2509.21143", "2601.12754", "2602.21262", "2604.12284", "2604.16548", "2604.16677", "2604.27819", "2605.01462", "2605.14290", "2605.31196", "2606.00497", "2606.21037", "2607.13071", "2607.18665", "2607.19913", "2607.20764", "2607.26300", "2608.01033", "2608.26036", "2608.29528", "2609.01836", "2609.05901", "2609.10871", "2609.17527", "2609.20191", "2609.23953", "2609.23959", "2609.26131", "2609.31877", "2610.06923", "2610.09163", "2610.21624", "2610.24264", "2610.25458", "2610.27205", "2610.27293", "2610.31686", "2610.31778", "2610.31840", "2610.31895", "2610.31914", "2610.31916", "2610.31971", "2610.31972", "2610.31974", "2610.31985", "2610.32004", "2610.32024", "2610.32045", "2610.32069", "2610.32092", "2610.32110", "2610.32151", "2610.32155", "2610.32285", "2610.32305", "2610.32370", "2610.32392", "2610.32429", "2610.32531", "2610.32555", "2610.32648", "2610.32726", "2610.32755", "2610.32888", "2610.32971", "2610.33108", "2610.33109", "2610.33112", "2610.33128", "2610.33180", "2610.33182", "2610.33198", "2610.33201", "2610.33234", "2610.33253", "2610.33282", "2610.33312", "2610.33318", "2610.33350", "2610.33411", "2610.33432", "2610.33445", "2610.33450", "2610.33489", "2610.33509", "2610.33528", "2610.33536", "2610.33568", "2610.33587", "2610.33592", "2610.33605", "2610.33624", "2610.33633", "2610.33651", "2610.33728", "2610.33753", "2610.33842", "2610.33853", "2610.33860", "2610.33962" ], "counts": { "official_entries": 8680, "all_fetched_entry_occurrences": 10164, "recent_official_entries": 4389, "latest_new_list_entries": 1004, "updated_api_raw_entries": 4000, "updated_api_in_window": 3287, "api_metadata_supplement": 771, "unique_candidates": 4513, "screening_candidates": 709, "abstracts_read": 709, "relevant": 66, "uncertain": 2, "irrelevant": 641, "new_checkpoint_ids": 665, "existing_candidate_rechecks": 44, "new_archive_ids": 66, "new_archive_relevant": 64, "new_archive_uncertain": 2, "backfill": 66, "new_archive_v1": 41, "historical_revision_backfill": 25, "new_archive_v1_official_announcement": 6, "new_archive_v1_api_only": 35, "existing_display_revisions": 2, "announcement_metadata_updates": 34, "pending_abstracts": 0, "failed_fetches_unresolved": 0, "new_uncertain_queue": 2, "historical_uncertain_queue": 8, "excluded_audit_sample": 20, "abstract_repairs": 1, "new_author_affiliations_confirmed": 65, "new_author_affiliations_unconfirmed": 1, "targeted_body_reviews": 29, "recovered_html_failures": 5, "prior_uncertain_versions_checked": 8 }, "coverage_batches": [ "2026-10-20", "2026-10-21", "2026-10-22", "2026-10-23", "2026-10-26" ], "new_archive_ids": 66 }, "2026-10-28": { "paper_ids": [ "2212.06123", "2509.21143", "2511.17671", "2603.15401", "2604.16548", "2604.16677", "2605.12856", "2605.14290", "2606.00497", "2606.03161", "2606.03163", "2606.04874", "2607.13071", "2607.20764", "2608.00583", "2608.00794", "2608.01033", "2608.18565", "2608.26036", "2608.29528", "2609.01487", "2609.01836", "2609.10871", "2609.17527", "2609.19705", "2609.20191", "2609.23953", "2609.23959", "2609.26131", "2609.30383", "2609.31142", "2609.31877", "2610.06923", "2610.07359", "2610.18298", "2610.21561", "2610.24969", "2610.28093", "2610.28160", "2610.28891", "2610.30751", "2610.31372", "2610.31895", "2610.32151", "2610.33009", "2610.33011", "2610.33026", "2610.33029", "2610.33108", "2610.33109", "2610.33112", "2610.33128", "2610.33180", "2610.33182", "2610.33198", "2610.33201", "2610.33234", "2610.33253", "2610.33282", "2610.33312", "2610.33318", "2610.33350", "2610.33411", "2610.33432", "2610.33445", "2610.33450", "2610.33489", "2610.33509", "2610.33528", "2610.33536", "2610.33568", "2610.33587", "2610.33592", "2610.33605", "2610.33624", "2610.33633", "2610.33651", "2610.33728", "2610.33753", "2610.33842", "2610.33853", "2610.33860", "2610.33962", "2610.34043", "2610.34064", "2610.34098", "2610.34141", "2610.34151", "2610.34167", "2610.34185", "2610.34239", "2610.34253", "2610.34357", "2610.34358", "2610.34365", "2610.34435", "2610.34535", "2610.34542", "2610.34569", "2610.34594", "2610.34620", "2610.34634", "2610.34640", "2610.34654", "2610.34674", "2610.34735", "2610.34748", "2610.34767", "2610.34777", "2610.34826", "2610.34837", "2610.34847", "2610.34965", "2610.35082", "2610.35093", "2610.35188", "2610.35193", "2610.35215", "2610.35288", "2610.35426", "2610.35451", "2610.35486", "2610.35497", "2610.35541", "2610.35579", "2610.35671", "2610.35697", "2610.35835", "2610.35950", "2610.35966", "2610.35978", "2610.35981", "2610.35982", "2610.35992", "2610.36108", "2610.36114", "2610.36151", "2610.36254", "2610.36264", "2610.36334", "2610.36346", "2610.36422", "2610.36435", "2610.36453", "2610.36476", "2610.36570", "2610.36652", "2610.36713", "2610.36761", "2610.36947" ], "counts": { "official_entries": 10329, "primary_fetch_entry_occurrences": 11160, "unique_candidates": 4678, "latest_new_list_entries": 2184, "recent_official_entries": 4253, "updated_api_raw_entries": 4000, "updated_api_in_window": 3892, "api_metadata_supplement": 723, "screening_candidates": 1515, "abstracts_read": 1515, "relevant": 85, "uncertain": 9, "irrelevant": 1421, "new_checkpoint_ids": 1422, "existing_candidate_rechecks": 93, "new_archive_ids": 84, "new_archive_relevant": 76, "new_archive_uncertain": 8, "new_archive_v1_official_announced": 46, "new_archive_v1_api_only": 22, "new_archive_v2plus": 16, "existing_display_revisions": 11, "existing_display_reclassified": 2, "announcement_metadata_only_updates": 55, "new_author_affiliations_confirmed": 81, "new_author_affiliations_unconfirmed": 3, "historical_uncertain_versions_checked": 10, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 19, "targeted_body_reads": 53, "excluded_audit_sample": 20 }, "coverage_batches": [ "2026-10-21", "2026-10-22", "2026-10-23", "2026-10-26", "2026-10-27" ], "new_archive_ids": 84 }, "2026-10-29": { "paper_ids": [ "2511.17671", "2602.22724", "2603.15401", "2603.18740", "2605.12856", "2606.04874", "2608.00711", "2610.02662", "2610.35835", "2610.35930", "2610.35950", "2610.35966", "2610.35978", "2610.35981", "2610.35982", "2610.35992", "2610.36108", "2610.36114", "2610.36151", "2610.36254", "2610.36264", "2610.36334", "2610.36346", "2610.36422", "2610.36435", "2610.36453", "2610.36476", "2610.36570", "2610.36652", "2610.36713", "2610.36761", "2610.36947", "2610.36989", "2610.37055", "2610.37081", "2610.37332", "2610.37342", "2610.37407", "2610.37415", "2610.37448", "2610.37461", "2610.37657" ], "counts": { "official_entries": 8879, "primary_fetch_entry_occurrences": 9748, "unique_candidates": 4137, "latest_new_list_entries": 1268, "recent_official_entries": 4127, "updated_api_raw_entries": 4000, "updated_api_in_window": 3484, "api_metadata_supplement": 353, "screening_candidates": 339, "abstracts_read": 339, "relevant": 14, "uncertain": 2, "irrelevant": 323, "new_checkpoint_ids": 308, "existing_candidate_rechecks": 31, "existing_candidate_version_updates": 31, "same_version_candidate_rechecks": 0, "new_archive_ids": 15, "new_archive_relevant": 13, "new_archive_uncertain": 2, "new_archive_v1_official_announced": 11, "new_archive_v1_api_only": 0, "new_archive_v2plus": 4, "existing_display_revisions": 1, "existing_display_reclassified": 0, "existing_display_rechecks": 1, "announcement_metadata_only_updates": 26, "new_author_affiliations_confirmed": 14, "new_author_affiliations_unconfirmed": 1, "historical_uncertain_versions_checked": 19, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 21, "targeted_body_reads": 17, "excluded_audit_sample": 20, "unresolved_body_reviews": 0, "auxiliary_metadata_entries": 6, "metadata_returned_including_auxiliary": 9754, "source_429_attempts": 2, "prior_uncertain_in_union": 13, "prior_uncertain_extra_lookup": 6 }, "coverage_batches": [ "2026-10-22", "2026-10-23", "2026-10-26", "2026-10-27", "2026-10-28" ], "new_archive_ids": 15 }, "2026-10-31": { "paper_ids": [ "2509.25894", "2510.02609", "2510.18131", "2511.20709", "2602.01532", "2603.27771", "2605.02697", "2605.05509", "2605.16679", "2606.08671", "2606.10323", "2608.04565", "2608.05430", "2608.07520", "2608.23616", "2608.24069", "2608.24275", "2609.03035", "2609.13406", "2609.17989", "2610.07510", "2610.12823", "2610.26324", "2610.26551", "2610.34357", "2610.34507", "2610.36989", "2610.37672", "2610.37679", "2610.37684", "2610.37690", "2610.37699", "2610.37734", "2610.37738", "2610.37741", "2610.37830", "2610.37849", "2610.37901", "2610.37905", "2610.37984", "2610.38039", "2610.38049", "2610.38120", "2610.38130", "2610.38147", "2610.38174", "2610.38201", "2610.38209", "2610.38215", "2610.38361", "2610.38392", "2610.38398", "2610.38438", "2610.38458", "2610.38521", "2610.38524", "2610.38544", "2610.38579", "2610.38617", "2610.38620", "2610.38631", "2610.38691", "2610.38728", "2610.38799", "2610.38850", "2610.38867", "2610.38869", "2610.38882", "2610.38895", "2610.38977", "2610.39066", "2610.39070", "2610.39086", "2610.39109", "2610.39122", "2610.39124", "2610.39155", "2610.39230", "2610.39234", "2610.39282", "2610.39377", "2610.39433", "2610.39468", "2610.39532", "2610.39660", "2610.39711", "2610.39733", "2610.39758", "2610.39807", "2610.39899", "2610.40002", "2610.40036", "2610.40042", "2610.40071", "2610.40075", "2610.40133", "2610.40246", "2610.40370", "2610.40396", "2610.40476", "2610.40578", "2610.40588", "2610.40589" ], "counts": { "official_entries": 9798, "primary_fetch_entry_occurrences": 11069, "unique_candidates": 4918, "latest_new_list_entries": 1852, "recent_official_entries": 4563, "updated_api_raw_entries": 4000, "updated_api_in_window": 3383, "api_metadata_supplement": 654, "screening_candidates": 1310, "abstracts_read": 1310, "relevant": 99, "uncertain": 4, "irrelevant": 1207, "new_checkpoint_ids": 1198, "existing_candidate_rechecks": 112, "existing_candidate_version_updates": 112, "same_version_candidate_rechecks": 0, "new_archive_ids": 99, "new_archive_relevant": 95, "new_archive_uncertain": 4, "new_archive_v1_official_announced": 76, "new_archive_v1_api_only": 0, "new_archive_v2plus": 23, "existing_display_revisions": 4, "existing_display_reclassified": 0, "existing_display_rechecks": 4, "announcement_metadata_only_updates": 0, "new_author_affiliations_confirmed": 96, "new_author_affiliations_unconfirmed": 3, "historical_uncertain_versions_checked": 21, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 25, "targeted_body_reads": 97, "excluded_audit_sample": 30, "unresolved_body_reviews": 1, "auxiliary_metadata_entries": 470, "metadata_returned_including_auxiliary": 11539, "source_429_attempts": 0, "prior_uncertain_in_union": 13, "prior_uncertain_extra_lookup": 8, "primary_window_unique": 4448, "prior_metadata_pending_resolved": 972, "fulltext_fetch_attempted_ids": 152, "pdf_fetch_success_ids": 151, "source_503_attempts": 2 }, "coverage_batches": [ "2026-10-23", "2026-10-26", "2026-10-27", "2026-10-28", "2026-10-30" ], "new_archive_ids": 99 }, "2026-11-01": { "paper_ids": [], "counts": { "official_entries": 9458, "primary_fetch_entry_occurrences": 11069, "unique_candidates": 4300, "latest_new_list_entries": 1852, "recent_official_entries": 4563, "updated_api_raw_entries": 4000, "updated_api_in_window": 3043, "api_metadata_supplement": 654, "screening_candidates": 0, "abstracts_read": 0, "relevant": 0, "uncertain": 0, "irrelevant": 0, "new_checkpoint_ids": 0, "existing_candidate_rechecks": 0, "existing_candidate_version_updates": 0, "same_version_candidate_rechecks": 0, "new_archive_ids": 0, "new_archive_relevant": 0, "new_archive_uncertain": 0, "new_archive_v1_official_announced": 0, "new_archive_v1_api_only": 0, "new_archive_v2plus": 0, "existing_display_revisions": 0, "existing_display_reclassified": 0, "existing_display_rechecks": 0, "announcement_metadata_only_updates": 0, "new_author_affiliations_confirmed": 0, "new_author_affiliations_unconfirmed": 0, "historical_uncertain_versions_checked": 25, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 25, "targeted_body_reads": 0, "excluded_audit_sample": 0, "unresolved_body_reviews": 1, "auxiliary_metadata_entries": 8, "metadata_returned_including_auxiliary": 11077, "source_429_attempts": 0, "prior_uncertain_in_union": 17, "prior_uncertain_extra_lookup": 8, "historical_abstracts_reread": 1, "metadata_unique_including_auxiliary": 4308, "retained_scope_evidence_audited": 25 }, "coverage_batches": [ "2026-10-23", "2026-10-26", "2026-10-27", "2026-10-28", "2026-10-30" ], "new_archive_ids": 0 }, "2026-11-02": { "paper_ids": [], "counts": { "official_entries": 9110, "primary_fetch_entry_occurrences": 10697, "unique_candidates": 4159, "latest_new_list_entries": 1852, "recent_official_entries": 4563, "updated_api_raw_entries": 3000, "updated_api_in_window": 2695, "api_metadata_supplement": 1282, "screening_candidates": 0, "abstracts_read": 0, "relevant": 0, "uncertain": 0, "irrelevant": 0, "new_checkpoint_ids": 0, "existing_candidate_rechecks": 0, "existing_candidate_version_updates": 0, "same_version_candidate_rechecks": 0, "new_archive_ids": 0, "new_archive_relevant": 0, "new_archive_uncertain": 0, "new_archive_v1_official_announced": 0, "new_archive_v1_api_only": 0, "new_archive_v2plus": 0, "existing_display_revisions": 0, "existing_display_reclassified": 0, "existing_display_rechecks": 0, "announcement_metadata_only_updates": 0, "new_author_affiliations_confirmed": 0, "new_author_affiliations_unconfirmed": 0, "historical_uncertain_versions_checked": 25, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 25, "targeted_body_reads": 0, "excluded_audit_sample": 0, "unresolved_body_reviews": 1, "auxiliary_metadata_entries": 8, "metadata_returned_including_auxiliary": 10705, "source_429_attempts": 0, "prior_uncertain_in_union": 17, "prior_uncertain_extra_lookup": 8, "historical_abstracts_reread": 1, "metadata_unique_including_auxiliary": 4167, "retained_scope_evidence_audited": 25 }, "coverage_batches": [ "2026-10-23", "2026-10-26", "2026-10-27", "2026-10-28", "2026-10-30" ], "new_archive_ids": 0 }, "2026-11-03": { "paper_ids": [ "2511.19405", "2601.08739", "2603.07379", "2603.15911", "2603.17969", "2603.22577", "2604.16548", "2605.16363", "2605.17467", "2606.16562", "2607.27914", "2608.19857", "2608.27009", "2608.27443", "2610.03498", "2610.10611", "2610.21561", "2610.30582", "2610.31306", "2610.33509", "2610.34422", "2610.35835", "2610.37415", "2610.37461", "2610.37657", "2610.40714", "2610.40716", "2610.40721", "2610.40744", "2610.40753", "2610.40798", "2610.40913", "2610.40917", "2610.40927", "2610.40939", "2610.40946", "2610.40959", "2610.40975", "2610.40981", "2610.40992", "2610.41014", "2610.41025", "2610.41044", "2610.41056", "2610.41072", "2610.41076", "2610.41149", "2610.41181", "2610.41191", "2610.41267", "2610.41272", "2610.41289", "2610.41307", "2610.41350", "2610.41397", "2610.41401", "2610.41432", "2610.41433", "2610.41453", "2610.41482", "2610.41576", "2610.41609", "2610.41713", "2610.41803", "2610.41885", "2610.41998" ], "counts": { "official_entries": 7914, "primary_fetch_entry_occurrences": 9597, "unique_candidates": 4023, "latest_new_list_entries": 939, "recent_official_entries": 4457, "updated_api_raw_entries": 3000, "updated_api_in_window": 2518, "api_metadata_supplement": 1201, "screening_candidates": 676, "abstracts_read": 676, "relevant": 66, "uncertain": 0, "irrelevant": 610, "new_checkpoint_ids": 601, "existing_candidate_rechecks": 75, "existing_candidate_version_updates": 75, "same_version_candidate_rechecks": 0, "new_archive_ids": 57, "new_archive_relevant": 57, "new_archive_uncertain": 0, "new_archive_v1_official_announced": 41, "new_archive_v1_api_only": 0, "new_archive_v2plus": 16, "existing_display_revisions": 9, "existing_display_reclassified": 1, "existing_display_rechecks": 9, "announcement_metadata_only_updates": 0, "new_author_affiliations_confirmed": 52, "new_author_affiliations_unconfirmed": 5, "historical_uncertain_versions_checked": 25, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 25, "targeted_body_reads": 48, "excluded_audit_sample": 30, "unresolved_body_reviews": 3, "auxiliary_metadata_entries": 9, "metadata_returned_including_auxiliary": 9606, "source_429_attempts": 2, "prior_uncertain_in_union": 16, "prior_uncertain_extra_lookup": 9, "metadata_unique_including_auxiliary": 4032, "historical_abstracts_reread": 1, "retained_scope_evidence_audited": 25, "fulltext_retrieval_attempted": 100, "fulltext_sources_obtained": 97, "new_scope_unresolved_body_reviews": 0, "abstract_source_discrepancies_reconciled": 96 }, "coverage_batches": [ "2026-10-26", "2026-10-27", "2026-10-28", "2026-10-30", "2026-11-02" ], "new_archive_ids": 57 }, "2026-11-04": { "paper_ids": [ "2507.02976", "2510.04257", "2510.06445", "2510.20768", "2512.14233", "2603.00902", "2603.10052", "2603.11132", "2604.22985", "2605.11442", "2605.15134", "2605.20258", "2605.26321", "2606.03203", "2606.09935", "2606.11435", "2606.20631", "2606.24428", "2606.26350", "2607.10487", "2607.15593", "2607.23983", "2607.26998", "2608.02372", "2608.19741", "2608.22444", "2608.22538", "2609.00038", "2609.18272", "2609.32400", "2609.35316", "2610.17528", "2610.21270", "2610.22061", "2610.28397", "2610.28679", "2610.30365", "2610.32888", "2610.37690", "2610.38691", "2610.39711", "2610.39884", "2610.41289", "2611.00138", "2611.00171", "2611.00287", "2611.00291", "2611.00386", "2611.00407", "2611.00420", "2611.00463", "2611.00489", "2611.00505", "2611.00515", "2611.00546", "2611.00602", "2611.00610", "2611.00689", "2611.00725", "2611.00729", "2611.00838", "2611.00923", "2611.01001", "2611.01011", "2611.01042", "2611.01043", "2611.01112", "2611.01181", "2611.01265", "2611.01304", "2611.01334", "2611.01357", "2611.01386", "2611.01449", "2611.01527", "2611.01566", "2611.01585", "2611.01700", "2611.01713", "2611.01836", "2611.01930", "2611.01950", "2611.01953", "2611.01966", "2611.01976", "2611.02028", "2611.02153", "2611.02155", "2611.02162", "2611.02285", "2611.02300", "2611.02319", "2611.02332", "2611.02361", "2611.02407", "2611.02484", "2611.02501", "2611.02516", "2611.02522", "2611.02527", "2611.02561", "2611.02605", "2611.02611", "2611.02624", "2611.02633", "2611.02643", "2611.02644", "2611.02676", "2611.02711", "2611.02741", "2611.02779", "2611.02815", "2611.02835", "2611.02839", "2611.02849", "2611.02950", "2611.02978", "2611.03066", "2611.03092", "2611.03223", "2611.03231", "2611.03374", "2611.03406", "2611.03431", "2611.03434", "2611.03551", "2611.03555", "2611.03575", "2611.03586", "2611.03600", "2611.03601" ], "counts": { "official_entries": 11385, "primary_fetch_entry_occurrences": 13171, "unique_candidates": 5037, "latest_new_list_entries": 2495, "recent_official_entries": 5450, "updated_api_raw_entries": 4000, "updated_api_in_window": 3440, "api_metadata_supplement": 1226, "screening_candidates": 1791, "abstracts_read": 1791, "relevant": 130, "uncertain": 0, "irrelevant": 1661, "new_checkpoint_ids": 1682, "existing_candidate_rechecks": 109, "existing_candidate_version_updates": 109, "same_version_candidate_rechecks": 0, "new_archive_ids": 121, "new_archive_relevant": 121, "new_archive_uncertain": 0, "new_archive_v1_official_announced": 88, "new_archive_v1_api_only": 0, "new_archive_v2plus": 33, "existing_display_revisions": 10, "existing_display_reclassified": 1, "existing_display_rechecks": 10, "announcement_metadata_only_updates": 0, "new_author_affiliations_confirmed": 118, "new_author_affiliations_unconfirmed": 3, "historical_uncertain_versions_checked": 25, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 25, "targeted_body_reads": 67, "excluded_audit_sample": 30, "unresolved_body_reviews": 0, "auxiliary_metadata_entries": 12, "metadata_returned_including_auxiliary": 13183, "source_429_attempts": 2, "prior_uncertain_in_union": 13, "prior_uncertain_extra_lookup": 12, "source_abstracts_repaired": 7, "unresolved_abstract_integrity": 0, "source_title_corrections": 1, "summary_audit_sample": 30, "scope_review_records": 80, "author_records_checked": 184, "fulltext_versions_requested": 190, "fulltext_html_available": 177, "fulltext_pdf_available": 186, "prior_unresolved_body_or_frontmatter": 3, "pdf_access_unavailable": 1, "prior_uncertain_with_existing_body_evidence": 24 }, "coverage_batches": [ "2026-10-27", "2026-10-28", "2026-10-30", "2026-11-02", "2026-11-03" ], "new_archive_ids": 121 }, "2026-11-05": { "paper_ids": [ "2506.22276", "2509.07370", "2509.21961", "2602.16346", "2603.06588", "2603.15457", "2603.16016", "2603.27194", "2605.21139", "2607.13940", "2607.20827", "2607.22877", "2608.22061", "2609.00038", "2609.16247", "2609.34270", "2610.02036", "2610.11773", "2610.21034", "2610.32024", "2610.33020", "2610.34507", "2610.35541", "2610.37652", "2610.37690", "2610.40946", "2611.01449", "2611.02978", "2611.03651", "2611.03662", "2611.03754", "2611.03765", "2611.03772", "2611.03935", "2611.03983", "2611.04027", "2611.04086", "2611.04166", "2611.04196", "2611.04203", "2611.04289", "2611.04296", "2611.04299", "2611.04315", "2611.04321", "2611.04356", "2611.04367", "2611.04371", "2611.04392", "2611.04393", "2611.04456", "2611.04483", "2611.04507", "2611.04515", "2611.04556", "2611.04579", "2611.04672", "2611.04673", "2611.04701", "2611.04785", "2611.04803", "2611.04838", "2611.04879", "2611.04944", "2611.05027", "2611.05088", "2611.05094", "2611.05171", "2611.05179", "2611.05290", "2611.05376" ], "counts": { "official_entries": 9826, "primary_fetch_entry_occurrences": 10884, "unique_candidates": 4813, "latest_new_list_entries": 1213, "recent_official_entries": 4806, "updated_api_raw_entries": 4000, "updated_api_in_window": 3807, "api_metadata_supplement": 865, "screening_candidates": 891, "abstracts_read": 891, "relevant": 70, "uncertain": 1, "irrelevant": 820, "new_checkpoint_ids": 782, "existing_candidate_rechecks": 109, "existing_candidate_version_updates": 109, "same_version_candidate_rechecks": 0, "new_archive_ids": 63, "new_archive_relevant": 63, "new_archive_uncertain": 0, "new_archive_v1_official_announced": 43, "new_archive_v1_api_only": 0, "new_archive_v2plus": 20, "existing_display_revisions": 8, "existing_display_reclassified": 0, "existing_display_rechecks": 8, "announcement_metadata_only_updates": 0, "new_author_affiliations_confirmed": 57, "new_author_affiliations_unconfirmed": 6, "historical_uncertain_versions_checked": 25, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 25, "targeted_body_reads": 44, "excluded_audit_sample": 30, "unresolved_body_reviews": 0, "auxiliary_metadata_entries": 19, "metadata_returned_including_auxiliary": 10903, "source_429_attempts": 0, "prior_uncertain_in_union": 6, "prior_uncertain_extra_lookup": 19, "initial_relevant": 64, "initial_uncertain": 28, "initial_irrelevant": 799, "abstract_integrity_repairs": 3, "title_truncation_repairs": 1, "prior_body_or_frontmatter_unavailable": 4, "prior_access_blocked_pdf_not_retried": 1, "fulltext_download_attempted_ids": 102, "fulltext_any_available": 98, "summary_audit_sample": 30, "source_503_attempts": 1 }, "coverage_batches": [ "2026-10-28", "2026-10-30", "2026-11-02", "2026-11-03", "2026-11-04" ], "new_archive_ids": 63 }, "2026-11-06": { "paper_ids": [ "2604.08567", "2604.27202", "2604.27955", "2605.10779", "2605.18991", "2605.21139", "2605.23262", "2607.00481", "2607.28685", "2608.15591", "2609.35316", "2610.15884", "2611.04507", "2611.04879", "2611.05390", "2611.05427", "2611.05448", "2611.05454", "2611.05586", "2611.05590", "2611.05632", "2611.05662", "2611.05739", "2611.05806", "2611.05873", "2611.05971", "2611.06039", "2611.06049", "2611.06116", "2611.06204", "2611.06294", "2611.06374", "2611.06453", "2611.06545", "2611.06563", "2611.06585", "2611.06674", "2611.06682", "2611.06727", "2611.06764", "2611.06911" ], "counts": { "official_entries": 9590, "primary_fetch_entry_occurrences": 10646, "unique_candidates": 4767, "latest_new_list_entries": 1118, "recent_official_entries": 4691, "updated_api_raw_entries": 4000, "updated_api_in_window": 3781, "api_metadata_supplement": 837, "screening_candidates": 811, "abstracts_read": 811, "relevant": 40, "uncertain": 1, "irrelevant": 770, "new_checkpoint_ids": 728, "existing_candidate_rechecks": 83, "existing_candidate_version_updates": 83, "same_version_candidate_rechecks": 0, "new_archive_ids": 36, "new_archive_relevant": 35, "new_archive_uncertain": 1, "new_archive_v1_official_announced": 27, "new_archive_v1_api_only": 0, "new_archive_v2plus": 9, "existing_display_revisions": 5, "existing_display_reclassified": 0, "existing_display_rechecks": 5, "announcement_metadata_only_updates": 0, "new_author_affiliations_confirmed": 34, "new_author_affiliations_unconfirmed": 2, "historical_uncertain_versions_checked": 0, "unread_abstracts": 0, "unresolved_fetch_failures": 0, "total_scope_pending_after": 26, "targeted_body_reads": 21, "excluded_audit_sample": 30, "unresolved_body_reviews": 0, "auxiliary_metadata_entries": 0, "metadata_returned_including_auxiliary": 10646, "source_429_attempts": 0, "prior_uncertain_in_union": 0, "prior_uncertain_extra_lookup": 0 }, "coverage_batches": [ "2026-10-30", "2026-11-02", "2026-11-03", "2026-11-04", "2026-11-05" ], "new_archive_ids": 36 } } }