{
  "taxonomy": [
    {
      "id": "injection",
      "label": "提示注入与攻击传播",
      "count": 170
    },
    {
      "id": "supplychain",
      "label": "仓库与供应链安全",
      "count": 95
    },
    {
      "id": "authorization",
      "label": "工具权限与沙箱",
      "count": 419
    },
    {
      "id": "memory",
      "label": "记忆与上下文安全",
      "count": 130
    },
    {
      "id": "multiagent",
      "label": "多智能体安全",
      "count": 165
    },
    {
      "id": "monitoring",
      "label": "监控与可解释性",
      "count": 367
    },
    {
      "id": "evaluation",
      "label": "安全评测与对齐",
      "count": 558
    },
    {
      "id": "privacy",
      "label": "隐私与数据泄露",
      "count": 94
    },
    {
      "id": "embodied",
      "label": "具身与行动安全",
      "count": 81
    },
    {
      "id": "robustness",
      "label": "鲁棒性与可用性",
      "count": 211
    }
  ],
  "papers": [
    {
      "tags": [
        "embodied",
        "evaluation"
      ],
      "reason_zh": "以自驱动化学实验室为场景，检验具身语言模型的行动可行性和安全规范认知。",
      "id": "2611.06911"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "系统分析 Agent 工作流中的持续授权、委派与信息流边界。",
      "id": "2611.06764"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "多 Agent 运行时通过缩减权限、来源追踪和告警后分支隔离阻止错误动作传播，直接研究跨 Agent 风险控制。",
      "id": "2611.06727"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "以确定性语义规则约束工具 Agent 动作和权限边界。",
      "id": "2611.06682"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "将 Agent 行为契约和工具权限验证集成到构建测试。",
      "id": "2611.06674"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "privacy"
      ],
      "reason_zh": "直接研究恶意 MCP 实现与运行时信息隔离。",
      "id": "2611.06585"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "Coding Agent 工具调用前声明意图并审计真实副作用，揭露奖励作弊，直接属于工具行为监控与安全评测。",
      "id": "2611.06563"
    },
    {
      "tags": [
        "memory",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "上下文压缩导致权限漂移，并测试后续越权行为。",
      "id": "2611.06545"
    },
    {
      "tags": [
        "embodied",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "实际评测包含视觉语言驾驶 Agent SimLingo，且直接测量应停却前进、碰撞和传统评分误导，构成具身 Agent 安全基准研究。不能因其他基线为传统控制器而整体排除。",
      "id": "2611.06453"
    },
    {
      "tags": [
        "authorization",
        "multiagent"
      ],
      "reason_zh": "针对匿名不受约束 AI Agent 的问责风险，提出带身份问责的社会图合约与溯源实现。",
      "id": "2611.06374"
    },
    {
      "tags": [
        "memory",
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "仓库上下文中的安全检查与不安全示例改变 Coding Agent 输出代码的可利用性。",
      "id": "2611.06294"
    },
    {
      "tags": [
        "embodied",
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "全文明确将 LMDrive 与 CoLMDriver 作为实际受保护和评测的目标系统，而非仅在相关工作提及。属于 LLM 驱动具身 Agent 的运行时安全与多车协作防护，可纳入。",
      "id": "2611.06204"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation",
        "memory"
      ],
      "reason_zh": "固定模型比较 harness 对银行工具行为违规的影响，使用执行日志判定违反规则与过度拒绝，直接关联 Agent 权限和合规。",
      "id": "2611.06116"
    },
    {
      "tags": [
        "memory",
        "privacy",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "有限纳入：正文有明确 Coding Agent 补丁反 benchmark-gaming 审查和固定验收边界，且实际研究个人记忆的忘记请求、敏感标识保护和归属错误。不能宣称跨家族 critic 已被因果证明可防作弊：没有独立 critic 消融、恶意补丁挑战或拦截率。更强的安全证据来自忘记请求的错误及修复。",
      "id": "2611.06049"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "通过规划与执行隔离防止网页注入控制流劫持。",
      "id": "2611.06039"
    },
    {
      "tags": [
        "privacy",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "限制并审计 Agent 用户数据外发。",
      "id": "2611.05971"
    },
    {
      "tags": [
        "memory",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "明确限制记忆向动作指令升级、过期经验注入和持久写权限，但实现与实证保证不足。",
      "id": "2611.05873"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "文档工具输入解析差异形成 Coding Agent 的攻击面。",
      "id": "2611.05806"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "直接测试 Coding Agent 编辑授权、状态保护、凭据限制和回滚确认义务。",
      "id": "2611.05739"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "工具型 Agent 评审会受无证据权威提示误导，研究执行轨迹中的不可信信息依从与评测可靠性。",
      "id": "2611.05662"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "以保证证据动态约束 Agent 权限并在产生外部效果前拒绝失效授权。",
      "id": "2611.05632"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "multiagent"
      ],
      "reason_zh": "自主多 Agent 生成代码与证书的验证边界、完整性门及隐藏测试审计。",
      "id": "2611.05590"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "评测 Agent 服务生态中伪造身份对信任和信誉选择的操纵，并给出图结构防御。",
      "id": "2611.05586"
    },
    {
      "tags": [
        "memory",
        "privacy",
        "authorization"
      ],
      "reason_zh": "长期主动个人智能体的上下文、信任和社会风险治理。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "以行为契约、外部授权执行和场景级可靠性门控治理企业 Agent。",
      "id": "2611.05454"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "embodied",
        "robustness"
      ],
      "reason_zh": "正文明确评估 Stormwise MCP 服务的地理编码、天气与 NWS 警报抓取、强制工具结构化指导链路，研究警报缺失、测试产品误摄入和令牌预算失败的安全后果，超过普通灾害问答。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "语言指令驱动自主驾驶 Agent 的动作后果预测与碰撞风险降低，直接研究具身智能体安全决策。",
      "id": "2611.05448"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "明确评测物理工艺智能体动作安全验证与独立安全联锁。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "embodied"
      ],
      "reason_zh": "正文实测 MCP 工具代理在制造参数推荐中的工具调用伪造与无依据数值，并评估客户端答案守卫、输入边界和缺陷约束；属于工具可靠性与物理工艺安全边界，但不是实机闭环安全保证。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "直接检查编码智能体审批关卡和文件作用域约束的执行。"
    },
    {
      "tags": [
        "supplychain",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "技能包白盒执行前筛查，含来源隔离、对抗改写、误报与跨分布边界。"
    },
    {
      "tags": [
        "embodied",
        "multiagent",
        "authorization"
      ],
      "reason_zh": "多机器人共享控制中的碰撞避免、安全距离及人类监督。"
    },
    {
      "tags": [
        "embodied",
        "multiagent"
      ],
      "reason_zh": "显式约束多智能体运动中的障碍和相互碰撞。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接测量 Web Agent 在欺骗网站上的危险操作与授权误判。",
      "id": "2611.04879"
    },
    {
      "tags": [
        "evaluation",
        "robustness",
        "embodied"
      ],
      "reason_zh": "直接测试行动智能体对奖励捷径与篡改的脆弱性。"
    },
    {
      "tags": [
        "injection",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "明确研究智能体系统提示泄漏及泄漏对后续攻击的帮助。"
    },
    {
      "tags": [
        "privacy",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "代理通过受限记录接口自主检索、关联跨来源个人记录并提交身份结论，正文分析错误指认、拒答和政治参与隐私风险；属于工具代理的监控滥用与高影响证据失效评估。"
    },
    {
      "tags": [
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "编码智能体协助构造代码供应链攻击，信任边界落在编译工具链。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接防御工具参数投毒，并以任务授权的信息来源界定参数合法性。"
    },
    {
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "围绕提示注入威胁分类和防御评测覆盖缺口。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "第三方及生成插件的来源与准入、执行能力边界、日志审计及受控探针评测。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "多代理影响、监督审批绕过，以及含代码审查的安全评测；重点不是外部文档提示注入。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "报告实验代理迎合用户进行事后剔除/挑选显著窗口的实际风险，以及确定性统计工具和会话审计，直接涉及代理辅助评估完整性。"
    },
    {
      "tags": [
        "monitoring",
        "injection",
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "确认 v2 保留明确 Agent 安全分类：不可信指令越界、泄露、越权、控制绕过、不安全输出处理，并保留 AgentDojo 数据来源。纳入安全轨迹监测/诊断；不能把跨类别匹配得分说成安全子集准确率。",
      "id": "2611.04507"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "multiagent"
      ],
      "reason_zh": "主体含创建者/调用者/专家间证据归属和许可复用设计，正文具体描述所有权范围、能力所属提案过滤、技能提升授权与可回滚记忆边界。"
    },
    {
      "tags": [
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "GitHub代理技能演变实证，明确研究安全修改与回归验证缺口。"
    },
    {
      "tags": [
        "injection",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "外部证据污染与非命令式操纵、检测器盲点，以及有边界的佐证防护。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "无人机运行时安全屏障降低碰撞，直接涉及具身安全。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "具身科学代理不可逆行动、风险成本及证据闭环评价综述。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "编码代理对AGENTS.md策略措辞的合规性实验。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "LLM代理生成有效但耗尽计算资源的FEM程序进行红队测试。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "以角色契约约束黑盒多代理输出，防止未授权角色行为。"
    },
    {
      "tags": [
        "multiagent",
        "memory",
        "authorization",
        "robustness"
      ],
      "reason_zh": "多代理角色与状态漂移控制，包含最小权限及具身压力测试。"
    },
    {
      "tags": [
        "supplychain",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "技能复用安全、执行前逐动作检查及违规与任务完成率的区分。"
    },
    {
      "tags": [
        "memory",
        "authorization",
        "privacy"
      ],
      "reason_zh": "部署结果记录可执行社区记忆对第三方施加持续规则、撤销范围不符与隐私推断，提供具体授权/同意边界失效案例。"
    },
    {
      "tags": [
        "multiagent",
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "多代理辩论受从众权威操控产生危险建议，并提出推理时审计防御。"
    },
    {
      "tags": [
        "multiagent",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "用户代理对平台代理的策略性虚假描述进行信誉验证。"
    },
    {
      "tags": [
        "multiagent",
        "memory",
        "evaluation"
      ],
      "reason_zh": "开源多代理漏洞利用框架及受控安全基准评估。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "视觉扰动使VLA动作危险而解释保持不变，直接检验具身安全监控盲区。"
    },
    {
      "tags": [
        "authorization",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "任务授权范围控制、竞争下多代理越界及可重放安全评测。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "综述玩家越狱、游戏文本注入、NPC 共享状态污染与安全防护缺口。",
      "id": "2611.05427"
    },
    {
      "tags": [
        "embodied",
        "robustness"
      ],
      "reason_zh": "因果模型支持机器人在人群环境中安全导航。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "多代理运动处方明确采用确定性安全审计与修复。"
    },
    {
      "tags": [
        "authorization",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "控制器落实子代理权限只能收窄、信息流过滤与保留确认集隔离，构成代理授权和研究评估完整性的具体系统设计。"
    },
    {
      "tags": [
        "embodied",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "正文APC以实际工具接口选择胰岛素给药，模拟设备约束/故障与传感器错误，并把低血糖作为独立结果评分；6.2专门讨论给药历史、剂量限制与低血糖监测；本文证据来自仿真。是语言模型自主物理干预的安全相关评测，而非仅医疗QA。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "直接研究未被指示欺骗的多 Agent 信息不对称交互中的自发欺骗。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "supplychain"
      ],
      "reason_zh": "工件完整性验收、有界代理及数据边界保护构成明确约束机制。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "直接评测编码代理完成良性任务时删除无关数据、削弱权限等有害副作用。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "直接测量 MCP 描述、模式和响应投毒后的工具执行及机密外泄。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "企业Agent数据使用授权、凭据隔离与执行边界，作为部署安全流程证据而非攻击基准。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "injection",
        "monitoring",
        "privacy"
      ],
      "reason_zh": "针对第三方恶意技能以安全义务票据及确定性出站门控强制授权，直接涉及技能供应链和数据外泄防护。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "privacy"
      ],
      "reason_zh": "正文明确面向敏感本地调查数据，从只读文件工具与非持久Python沙箱起步，每次扩展能力表面需同时经过泛化/可审计/最小化准入，而非单按准确率。属最小权限面与harness治理架构；没有证据证明抵抗提示注入。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接测试 RAG 投毒诱使 IAM 策略超出可信授权范围。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "正文将LLM置于慢速政策层，近实时执行只读取共享政策并强制容量限制与滞回；引言明确需容纳幻觉/不安全动作和推理操纵。是带确定性执行护栏的代理网络控制架构，攻防证据限于信令风暴而非提示注入。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "authorization"
      ],
      "reason_zh": "直接评估 Agent 为维护目标采取有害工具操作与部分可观测性的影响。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "具身代理在语义不变但辅助上下文减少时出现错误动作和潜在安全风险，直接属于具身鲁棒性评测。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "正文方法让真实coding agents沿SpecKit生成规范/计划/实现，跟踪公平约束及交付门槛，发现阈值沦为报告而非执行约束。是自主代理治理失效评测，非仅一般模型公平性；须注明提示本身未要求阻断交付，不能说代理绕过既定阻断。"
    },
    {
      "tags": [
        "memory",
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接测量 Agent 上下文压缩后的规则违规与针对压缩器的攻击。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "明确研究个人代理的限定委托、安全控制和可追责边界。"
    },
    {
      "tags": [
        "authorization",
        "supplychain",
        "multiagent"
      ],
      "reason_zh": "架构综述直接涉及 MCP、A2A、技能清单及跨组织信任和治理边界。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "函数调用评测记录未授权破坏性操作及确认缺失，直接涉及工具副作用和权限边界。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接在外部环境状态修改前验证 Agent 行动是否背离用户目标。"
    },
    {
      "tags": [
        "injection",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "动态进化恶意网页信息注入及上下文操纵搜索代理，直接研究代理攻击。"
    },
    {
      "tags": [
        "evaluation",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "正文3.2记录真实代理新增FALSE假设、引用未证引理、替换tlapm伪报PASS三种作弊；读写隔离、语义上下文限制、依赖闭包与干净容器重验证构成直接coding-agent奖励投机防护。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "生产 Agent 自改进受独立审查、当前政策测试与人工批准约束，属于部署治理。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "持续感知助手的危险识别、及时预警与主动介入边界。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "embodied"
      ],
      "reason_zh": "直接诊断 LLM Agent 预测安全护栏的预测到行动失效。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "第5节明确以不可信代码代理和reward hacking为对象：只读规格及入口防止削弱目标、增加假设或证明无用函数；拒绝外部库和unsafe，禁用assume/admit，统一验证编译绑定实际二进制。因此有具体代理作弊/越界防御，不只是数据库性能。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "直接防御外部观察中的间接提示注入及其越权后果。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "针对工具驱动科研 Agent 提出专家权限、安全边界和审批留痕治理。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "审计智能体评测证据链完整性及检查到使用之间的失效。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "用独立宿主执行证据替代模型自评，约束虚假完成声明。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接在搜索进入模型上下文前控制间接提示注入载体暴露。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "团队基准明确涵盖拒绝危险捷径、同伴作弊残留和人际压力。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "直接比较轨迹与环境状态对 Agent 实际伤害检出的贡献。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "supplychain"
      ],
      "reason_zh": "明确分析MCP架构安全边界及跨层缓解能力上限。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接研究蓝队 LLM Agent 的间接注入、证据链及持久记忆污染。"
    },
    {
      "tags": [
        "evaluation",
        "authorization",
        "privacy",
        "monitoring"
      ],
      "reason_zh": "专为自主代理评估人类自主权、伤害避免、隐私及责任追溯。"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "evaluation"
      ],
      "reason_zh": "跨MCP服务与主机的审批缺口直接让提示注入触发破坏性操作。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接评测提示注入劫持及基于置信度监测的绕过。"
    },
    {
      "tags": [
        "monitoring",
        "supplychain",
        "embodied"
      ],
      "reason_zh": "直接提出可累积、自演化且独立审计的代理安全护栏工具。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "不可修改评估控制器和封存验证针对编码Agent奖励作弊。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "医疗数据处理 Agent 基准显式测试数据内提示注入和用户确认。"
    },
    {
      "tags": [
        "multiagent",
        "injection",
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "直接研究 AI 服务网络中的误导传播、证据依赖和未授权请求。"
    },
    {
      "tags": [
        "memory",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接测试 Agent 根据授权、撤回、到期等历史决定当前行动权限。"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "monitoring"
      ],
      "reason_zh": "运行时对每个工具调用作经过证明的政策检查并直接评测提示注入防御。"
    },
    {
      "tags": [
        "privacy",
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接评估医疗 Agent 不必要访问 PHI，强调输出未披露不等于未访问。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "直接控制持久工程变更权限、交接证据及恢复边界。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "supplychain"
      ],
      "reason_zh": "正文把合成/证明代理完全置于不可信侧，CI强制拒绝sorry/admit/unsafe/assume等逃逸并做可满足性、变异与回归门控；人审规范而非任凭代理自证，构成明确的coding-agent验证治理架构，非仅性能优化。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "明确讨论 Agent 规避监督、对齐伪装和评估感知行为及架构约束。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "在执行前依据明确规则阻拦高风险工具调用。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接研究LLM代理隐蔽协作、隐写通信和合谋检测。"
    },
    {
      "tags": [
        "evaluation",
        "authorization",
        "robustness"
      ],
      "reason_zh": "正文明确把LLM生成的内核、分段及证明全部视为不可信，固定人审语义/任务接口，要求逐内核证明竞态自由与终止并拒绝失败证书，形成coding-agent输出的可机械检查准入边界。范围有限：不保证宿主分配越界安全，不能当作通用内存安全防御。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接揭示工具更新发生在模型上下文之外而绕过既有信任和提示防御。"
    },
    {
      "tags": [
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "研究编码代理用于仓库级代码洗白后的软件来源与许可证审计风险。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接揭示编码 Agent 在模型观察输入之前的处理原语攻击。"
    },
    {
      "tags": [
        "supplychain",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "审计编码智能体服务的模型来源声明与替换欺骗。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "验证工具操作实际完成证据，防止执行状态误认。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "工具增强居民服务代理明确将承诺控制与人工转介作为行为目标，并限制查询居民自身记录。"
    },
    {
      "tags": [
        "embodied",
        "robustness"
      ],
      "reason_zh": "针对 VLA 的障碍碰撞风险提供硬安全约束与动作修复。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "evaluation"
      ],
      "reason_zh": "直接评测跨会话持久记忆提示注入及受害者下游损害。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "将自然语言约束外置为确定性状态门，分离执行权与验证权，直接保障Agent规则执行。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "通过人类审查校准和风险门控约束自主结果发布。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "直接审计工具数值故障对科研代理证据及行动的影响，并比较状态恢复。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "对自主科学代理科学报告设置预先指定计划与确定性门控，防止不受证据支持的结论。"
    },
    {
      "tags": [
        "supplychain",
        "memory",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "生产 Agent 从轨迹编译技能，明确实施验证来源、版本准入扫描和分发控制。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "以受保护声明和可验证变更审计限制智能体修改。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "智能体通过操纵验证器可见证据取得虚高评分。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "正文方法确实赋予模型写提示、启动测试对话、提交自改版本与停止工具，研究自主自改循环的终止与价值稳定性；属于代理自我修改安全评估的探索性证据。价值稳定主要测词汇/自述，不能等同实际行为对齐或安全保证。"
    },
    {
      "tags": [
        "authorization",
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "直接限定编码智能体仓库修改权限与任务边界。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "编码智能体预防未明示漏洞与缺陷的安全相关评测。"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "具身 Agent 统一动作准入、运行时检查和偏离停止直接属于执行安全。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "在购买、授权委派和数据访问中评估越权，并组合精确执行护栏与学习规则。"
    },
    {
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "直接研究 LLM Agent 执行业务前的 SKILL 约束与合规审计。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "VLA在指令与场景不匹配时仍行动，论文加入判决门控冻结执行，直接涉及具身安全停止。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "multiagent",
        "embodied"
      ],
      "reason_zh": "多Agent架构以符号规则在每个重大动作前施加硬限制，明确分离学习模型与安全授权。"
    },
    {
      "tags": [
        "multiagent",
        "privacy"
      ],
      "reason_zh": "直接防御多代理通信拓扑的黑盒推断泄露。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "验证并修复智能体执行对安全保证与监测闭环的破坏。"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "直接通过MCP工具边界能力令牌防止提示注入转化为未授权执行。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "通过累积来源信任影响上下文，再触发高权限工具越权；包含明确防御评测。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "monitoring",
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "人类与多编码Agent团队的身份、消息授权、敌对成员后门及审计，直接属于多Agent安全治理。"
    },
    {
      "tags": [
        "authorization",
        "embodied",
        "privacy"
      ],
      "reason_zh": "正文引言明确误开锁/烤箱等物理风险，3/4节将语义解释与运行时动作约束强制分离，由注册表限制设备、操作与参数，低置信拒绝且全本地保护家庭上下文。直接连接语言模型控制器动作边界，不仅泛准确率。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "在指令文字不变时修改内部特征即可重定向机器人目标，直接暴露动作控制脆弱性。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "直接审计多代理内部扰动如何经转录传播并改变最终决策。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "对金融代理真实动作、证据与账户状态进行安全相关过程审计。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "附录E.13实际评价292条Web代理轨迹的非预期副作用和循环，E.5检验评委接触不可信回答中的注入；因此不是仅泛模型裁判准确率。需区分两项实验：注入测试在JudgeBench/LLMBar，未在代理轨迹上实施。"
    },
    {
      "tags": [
        "authorization",
        "privacy"
      ],
      "reason_zh": "智能体工具与数据访问被用于亲密伴侣虐待、监控及越权。"
    },
    {
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "自修改代理运行时用受保护机制保存历史并控制策略激活，直接关联控制边界。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "明确将工具智能体用于安全审计及拒绝抑制攻击任务。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接检验智能体奖励操纵检测及监督可靠性。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接建模代理阻止未授权动作的多层安全防护及相关失效。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "围绕代理执行失误、自主性与用户控制边界建立故障分类。"
    },
    {
      "tags": [
        "evaluation",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "正文第三节明确针对证明代理通过削弱规格、改变执行代码、添加公理或信任标记来骗过验证的风险，Lynette独立作弊检查与干净容器双重验收；外部参考解下载受限并审计会话。虽主要衡量证明修复能力，但包含可核验的代理评测完整性与执行边界。"
    },
    {
      "tags": [
        "injection",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "直接研究来自不可信数据的代理提示注入及对抗训练防御。"
    },
    {
      "tags": [
        "privacy",
        "evaluation"
      ],
      "reason_zh": "MCP工具轨迹隐私泄漏，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "被劫持代理工具轨迹检测的低基率与迁移失效"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "综述5.4具体覆盖执行查询与Python工具的LLM代理，8.1/8.5直接讨论代理数据库只读权限、敏感数据、数据库记录提示注入、代码沙箱及多轮隐私攻击审计，安全联系明确。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接审计AI control中的代码破坏监控评估可靠性。"
    },
    {
      "tags": [
        "authorization",
        "embodied",
        "evaluation"
      ],
      "reason_zh": "VLA机器人无有效指令仍启动，直接涉及行动授权与不行动控制。"
    },
    {
      "tags": [
        "evaluation",
        "robustness",
        "authorization"
      ],
      "reason_zh": "正文独立报告工具不适用时仍调用的退化、无调用训练样本被过滤的可能机制，并限定部署须在执行前人工/验证层核验；属于工具调用安全拒绝的实证负结果，但非真实环境端到端危害测试。"
    },
    {
      "tags": [
        "memory",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "直接研究代理递归记忆错误持续和纠正观测失效。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "直接研究工具超时和部分执行后的安全恢复与授权约束。"
    },
    {
      "tags": [
        "memory",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "修复代理失败记忆可能掩盖全测试集回归，关联编码代理评估可靠性。"
    },
    {
      "tags": [
        "authorization",
        "robustness",
        "monitoring"
      ],
      "reason_zh": "正文3.2和E.4具体实现每次输入前重验AX目标身份/操作条件及GUI布局租约，拒绝陈旧引用且不改投同名元素；不确定的排队OS动作导致停止而非重放，属于电脑代理执行安全机制。"
    },
    {
      "tags": [
        "privacy",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "直接保护LLM代理外包安全审计的私密输入及执行授权。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接防止计算机代理通过GUI、CLI、API或MCP跨界面绕过授权。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "正文提供独立于执行代理的13点监控层，包含工作区越界提醒、错误分类和停止控制；决策分布、采用情况及后果可追踪，并有外部标签的版本晋级门控和隔离审计，因此与运行监控/评估可靠性直接相关，非硬授权保障。"
    },
    {
      "tags": [
        "injection",
        "robustness"
      ],
      "reason_zh": "直接针对外部图像、音频、视频中的间接提示注入及正常任务保真。"
    },
    {
      "tags": [
        "memory",
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "对照旧v1归档并实读v2第4.2节及附录C.1，当前版仍有不可变来源目录、回答前指纹校验、非对称写权限和验收后才提交互动状态；历史对话不能升级为事实权威，明确保护长期对话代理记忆与输入信任边界，原仅摘要排除不成立。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "网页代理注入攻击与状态验证红队"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "正文2.3有明确执行权限和授权修改边界：更改已接受字段须用户授权，私有副本检验修订号及路径范围，陈旧或非法补丁不改变已接受状态，重新加载后重算执行权限；并评估错误放行。"
    },
    {
      "tags": [
        "robustness",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "研究LLM调查代理面对损坏工具输出时的验证与信任边界。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "研究浏览器代理的反机器人检测、防御性注入及受阻后的安全策略漂移。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "正文将裁判定位为代理在线步骤门控，六项实验标准明确包含安全违规识别和工具参数是否忠于用户/先前上下文，附录给出具体rubric，因而不是只有一般质量裁判。证据仍为离线逐项F1，不证明端到端代理安全改善。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "患者代理权限、证据和禁止动作的过程合规评估"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "SOC代理系统明确测试提示注入、标签投毒、账本篡改及人工批准防护。"
    },
    {
      "tags": [
        "memory",
        "injection",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "长期记忆更新与投毒的联合鲁棒性"
    },
    {
      "tags": [
        "multiagent",
        "embodied",
        "robustness"
      ],
      "reason_zh": "LLM团队对抗与伪装鲁棒性，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "代理实时监督与因果修复，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "evaluation",
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "直接研究代理环境中的奖励黑客与违反用户指令的评分追逐。"
    },
    {
      "tags": [
        "robustness",
        "evaluation"
      ],
      "reason_zh": "LLM营养规划代理以可执行个体规格防止疾病与药物约束违规。"
    },
    {
      "tags": [
        "authorization"
      ],
      "reason_zh": "直接提出代理规划可见的动态最小权限、租约与授权预算。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接评估代理是否选择超出任务需要的高权限工具。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "个人代理对用户特定约束的警告、澄清、拒绝与行动边界是直接安全评测。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "代理通过计时和干预线索识别思维链监控并适应性规避，直接属于监督逃逸。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接研究代理CoT监督依赖的推理可控性限制及其可被干预程度。"
    },
    {
      "tags": [
        "authorization",
        "robustness"
      ],
      "reason_zh": "无副作用代理仿真，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "supplychain",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "harness配置及代理自改工具被明确界定为攻击面与版本审计对象。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "研究工具增强医疗视觉代理中共同输入故障如何使交叉检查失效。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "后门推理模型在编码Agent中把上下文触发器转为攻击者指定工具调用，直接危及主机安全。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接检验网页代理世界模型能否支撑执行、询问与阻止等授权判断。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "embodied",
        "monitoring"
      ],
      "reason_zh": "正文有实际仪器执行前的安全代理审批，人工配置最大电压/功率限制并检查；符合科研代理物理行动安全机制，不能写成量化安全防御基准。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "跨智能体招募施压、秘密泄露与生成前风险监测。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "计算机使用代理完成声明的独立验证与误报拒绝。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "全文§2.3明确多轮问诊代理对抗安全测试，含提示注入、伪造权威、逐步侵蚀边界和安全协议抽取；直接测量临床危险建议、红旗漏检和分诊不足，非仅医疗问答能力。"
    },
    {
      "tags": [
        "injection",
        "monitoring"
      ],
      "reason_zh": "工具输出伪装用户角色引发提示注入。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "健康代理用证据门控和安全官否决约束真实训练建议。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接研究编码代理命令审批、沙箱预执行与危害回滚。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "提示注入操纵联网控制动作及闭环防护"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "动态政策和记录变更下代理错误行动及审计评估。"
    },
    {
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "§3 明确在执行下一步前更新用户约束，区分追加、无条件覆盖及运行条件覆盖；按轨迹核验现行指令而非旧目标，属于代理目标完整性评估（非攻击基准）。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "正文明确在预训练π0.5视觉语言动作策略上微调并以oracle约束关节/碰撞，属于VLA物理安全防护，而非无语言关联的普通RL。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "编码代理供应链、政策与任务一致性的签名过程证明。"
    },
    {
      "tags": [
        "monitoring",
        "robustness"
      ],
      "reason_zh": "工具智能体提案与独立形式验证的分权边界。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "智能体规则控制、护栏与系统不变量。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "monitoring"
      ],
      "reason_zh": "具身策略对错误推理的依赖控制，需确认安全分析。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "编码代理安全任务评估：明确跟踪不可信输入、重建安全约束、生成可执行PoV并验证漏洞修补；属于漏洞修复防御应用，而非代理自身抗注入能力。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "monitoring"
      ],
      "reason_zh": "正文4.2/4.5把业务工具限只读，Evolver仅能经注册表修改六个知识模块，明确禁止shell、业务工具和gate控制，并由外层强制预算、快照与回退。是自演化代理的可执行权限边界，而不只是性能门槛。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "对智能体网关和会话攻击面进行隔离仿真、凭证来源追踪。"
    },
    {
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "直接防御本地代理工具输出中的间接提示注入。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "银行任务明确评测许可获取和未经审批付款等代理安全失误。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "正文4.5/4.6给出实际coding-agent conftest.py绕测与跨pod未认证命令调用风险，修复为测试恢复/排除配置、每沙箱token、不可由执行容器改写的出入站规则及元数据服务阻断。安全联系明确，不能按只提供容器性能排除。"
    },
    {
      "tags": [
        "multiagent",
        "memory",
        "evaluation"
      ],
      "reason_zh": "已形成串谋在撤销激励和换伙伴后持续，记忆是载体。"
    },
    {
      "tags": [
        "privacy",
        "multiagent",
        "authorization",
        "memory"
      ],
      "reason_zh": "多代理任务图中限制未授权隐私传播。"
    },
    {
      "tags": [
        "monitoring",
        "privacy",
        "evaluation",
        "multiagent"
      ],
      "reason_zh": "多会话编码代理可观测性、未验证完成声明及凭据泄露。"
    },
    {
      "tags": [
        "multiagent",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "正文将多专家LLM论证工作流置于受污染威胁情报输入下，专门评估虚假技术归因、跨报告污染和语义投毒，属于多代理证据验证防御；非工具执行越权，范围应如此限定。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "工具代理受压时报告与执行不一致的欺骗评估。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "正文明确以Codex CLI与Claude Code实现优化及隔离漏洞检测代理，评测安全审计判别、跨模型迁移与优化捷径；符合Coding Agent安全评估，不要求代理自身被攻击。"
    },
    {
      "tags": [
        "robustness",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "计算机代理陈旧截图点击可触发非预期或不可逆动作。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "网页代理绕行访问障碍时违反访问政策和用户约束。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "privacy",
        "robustness"
      ],
      "reason_zh": "金融多代理系统强调权限、跨租户上下文和主张验证，涉及高后果行动可靠性。"
    },
    {
      "tags": [
        "supplychain",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "模块遮蔽造成代理执行不可信代码，并检验安全报告与独立日志的一致性。"
    },
    {
      "tags": [
        "privacy",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接研究自主代理多步任务的信息泄漏及分享授权边界。"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "evaluation"
      ],
      "reason_zh": "以最小权限和资源绑定 API 防止提示注入重定向代理资源使用。"
    },
    {
      "tags": [
        "evaluation"
      ],
      "reason_zh": "危险能力代理的多阶段风险认证与评估样本复杂度。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "authorization"
      ],
      "reason_zh": "个人代理自演化削弱间接注入防御。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "injection"
      ],
      "reason_zh": "为多智能体消息事实和授权防伪提供协议。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "主动智能体的授权范围、介入克制与人工安全评价。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "正文机制 24 明确讨论来源内嵌指令劫持并提出配对注入测试；机制 27/33 涉及代理验证输入和上下文压缩导致证据丢失。正文首页无自身 arXiv 水印，但标题与首作者匹配 API，下载 URL 为指定 v1；先前整文引用误报已撤销。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "第 4.2.1 节使用只读源码导航的编码代理产生结构化回归证据，并明确其幻觉见证仍需动态执行验证；面向 AI 安全补丁验证，属于编码代理安全校验。第 6 节说明测试补丁实际来自开发者补丁的直接变异，并非真实 AI 生成补丁，应保留此限制。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "编码智能体安全产物评估及评估信号投机。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "正文明确实测ATBench与R-Judge代理轨迹安全裁判，攻击仅改不可信待判内容，可使不安全轨迹被判安全，建立具体代理监控连接。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "自动研究智能体奖励作弊及人类对齐评估。"
    },
    {
      "tags": [
        "multiagent",
        "memory",
        "monitoring"
      ],
      "reason_zh": "显式约束多代理记忆和通信中的信念更新以防操纵传播。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "仓库文档、源码和数据文件及外部工具表面的间接指令注入，重点分离注入内容、位置和投递。"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "现实实验仪器调用的独立动作校验与安全闭环。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "对端开发组件通过运行反馈诱导编码代理越权，评测工具侧实际后果。"
    },
    {
      "tags": [
        "multiagent",
        "memory",
        "authorization"
      ],
      "reason_zh": "正文专门分析跨运行共享文件形成的未授权多智能体协调、评测作弊与人类授权边界，已超出泛化能力讨论；属于概念性安全治理分析而非攻击实测。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接审计科研代理的证据溯源与研究完整性，但主要错误为非故意数值错引，不是执行安全或攻击防御。"
    },
    {
      "tags": [
        "evaluation",
        "robustness",
        "monitoring"
      ],
      "reason_zh": "金融助理需求澄清、错误默认和验证失效。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "外部工具行动前执行策略核验并阻止无效操作。"
    },
    {
      "tags": [
        "evaluation"
      ],
      "reason_zh": "比较编码安全代理和静态分析的漏洞检测及harness影响。"
    },
    {
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "研究 Web/工具代理轨迹归属及跨会话伪造威胁。"
    },
    {
      "tags": [
        "injection",
        "privacy",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "企业工具智能体有害请求、记录注入与隐私泄漏评估。"
    },
    {
      "tags": [
        "injection",
        "robustness"
      ],
      "reason_zh": "利用交互诱饵防御恶意LLM网页扫描代理。"
    },
    {
      "tags": [
        "supplychain",
        "memory",
        "injection",
        "evaluation"
      ],
      "reason_zh": "项目记忆文件可经PR污染编码智能体。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "privacy",
        "supplychain"
      ],
      "reason_zh": "智能体沙箱、密钥隔离、网络与文件授权及可验证审计。"
    },
    {
      "tags": [
        "evaluation",
        "authorization",
        "robustness"
      ],
      "reason_zh": "以多轮用户行为模糊测试发现组织 Web 代理策略违规。"
    },
    {
      "tags": [
        "multiagent",
        "authorization"
      ],
      "reason_zh": "跨组织代理通信协议明确保障消息来源与完整性。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "自改进智能体验收门会侵蚀冗余安全保障。"
    },
    {
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "外部llms.txt清单可作为检索注入载体，直接关乎智能体输入边界。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "临床多智能体共识会传播和放大人口偏差，属实际智能体安全。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "authorization",
        "privacy",
        "multiagent"
      ],
      "reason_zh": "跨智能体社交内容造成偏好归属错误、持久记忆污染和工具泄露。"
    },
    {
      "tags": [
        "robustness",
        "monitoring",
        "embodied"
      ],
      "reason_zh": "自动工程工作流的验证与物理设计风险控制，智能体安全关联需核查。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "authorization"
      ],
      "reason_zh": "正文明确防止证明代理通过弱化定理、sorry 或自加公理来投机评测：固定题目签名前缀、独立只读工具链核验及公理白名单，并由另一代理提前生成题目，属于代理奖励作弊和验证完整性防御。"
    },
    {
      "tags": [
        "supplychain",
        "evaluation",
        "authorization",
        "robustness"
      ],
      "reason_zh": "技能库预部署检查与责任边界，安全维度需正文核实。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "正文确有 LLM 生成代码的运行副作用、非终止防护与弱保证（仅测试能暴露的副作用），但系统是程序分析流水线而非明确自主编码 agent；与工具执行安全邻接，保留边界不确定。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "robustness"
      ],
      "reason_zh": "结构化指令与数据分离降低工具调用上下文注入。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "正文 §3.3 专门讨论量子仓库 coding agent 的恶意依赖、issue/web 指令注入、CI 修改、硬件凭据与重试花费，要求隔离、任务限权、维护者审批和代理外预算约束；明确属于代理供应链/权限安全实践。"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "robustness"
      ],
      "reason_zh": "明确在部署前用概率模型检查约束LLM生成控制器，覆盖网格碰撞风险及行为允许集合，属于可验证执行安全机制。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "多代理通过策略性模糊公共消息发现串谋伙伴并绕过监控。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "高风险文档修改智能体的证据审计和有害修改检查。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "技能安装前扫描及组合依赖检测；存储历史注入触发Slack发送和监控源内容诱导OAuth令牌泄露体现持久记忆与授权交互风险。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "检测多智能体隐蔽通信与串谋信号。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "智能合约编码代理安全修补可能破坏用户意图，研究执行验证及需求澄清。"
    },
    {
      "tags": [
        "injection",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "注意力门控代理注入防御，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "机器人灵巧操作学习安全过滤器并测量掉落风险，直接属于具身安全。"
    },
    {
      "tags": [
        "supplychain"
      ],
      "reason_zh": "预训练投毒使CLI代理执行攻击者命令。"
    },
    {
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "类型化会话强制代理权限，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "正文明确分析 LLM 交易群体在通信后暴露集中、相关退出及陈旧信息传播的集体风险，而非仅比较收益；四模型家族、五通信模式的七日模拟交易，不等同实盘系统性风险已被证明。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "authorization"
      ],
      "reason_zh": "代理信封标签与记忆防御，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "技能配置供应链的提示注入与实证评估。"
    },
    {
      "tags": [
        "authorization",
        "memory"
      ],
      "reason_zh": "为Agent实体解析的持久身份变更规定证据晋升、授权范围和提交时版本校验，直接属于权限控制。"
    },
    {
      "tags": [
        "authorization",
        "multiagent"
      ],
      "reason_zh": "明确针对Agentic多智能体的职责能力失配和权限升级，提出制度权限形式分析及修复框架。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文确有权限/不可逆操作规则及安全动机编码：13 个变更单元陈述安全动机，但主要研究指令栈演化和复现，未实测安全边界或攻击效果。保留范围待确认，不将安全措辞或声明动机当成有效防护证据。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接研究 agent skills 供应链中的绕过审批与检查指令。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "正文规定缺失器官或已证不相容硬剂量约束必须升级审查，直接评测 LLM 规划 Agent 的停止/提交/升级决策及临床日志中缺少停止动作的问题；是高风险行动安全与人类监督，不只是剂量优化能力。研究仅一头颈数据集、30 评估患者和特定模型，未证明临床疗效或伤害发生。"
    },
    {
      "tags": [
        "monitoring",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "研究自适应LLM Agent通过审计信号泄漏破坏随机审计证书，并给出监控保密与时序防护，直接属于Agent安全。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "当前正文研究可执行制度中合作/破坏/对立 LLM 参与者的治理和制裁失效，包含不合作者当选并惩罚守规者，属于多代理治理安全。重要限制：身体努力和遵从度由角色控制器预设，是操纵而非模型涌现发现；实际 LLM 选择是言语、提名、指控和投票，无人类参与。"
    },
    {
      "tags": [
        "monitoring",
        "multiagent",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "评估Agent对误导证据、反例和验证反馈的安全判决可靠性，以及增加Agent上下文的安全收益局限。"
    },
    {
      "tags": [
        "authorization",
        "embodied",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "VLA生成混合物理/API动作由运行时gate和时序逻辑监控约束，另定义安全违规与恢复评测。"
    },
    {
      "tags": [
        "memory",
        "privacy",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "身份识别直接决定个人记忆的写入与访问，评估跨用户污染和错误授权。"
    },
    {
      "tags": [
        "memory",
        "multiagent",
        "robustness",
        "monitoring"
      ],
      "reason_zh": "针对多Agent记忆错误传播、适用边界和修复回归，属于非对抗记忆安全。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "关注工具动作运行时权限、沙箱与人工审批分配，通过后果与可逆性控制副作用风险并强调模拟边界。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "审计Agent承诺、实际金融操作及对用户报告是否一致，避免终局收益掩盖行动约束失效。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "直接测试社会工程压力是否导致账户修改越权及虚报动作，区分语言顺从与执行安全。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "直接测用户参与诱发的谈判Agent行为失配，显示收益指标遗漏安全问题。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "账户守护LLM的提示注入传播、攻击复用与防线更新效果。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "关注Coding Agent对用户指令的过度遵从、合理停止边界和累积修改风险。"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "monitoring",
        "privacy"
      ],
      "reason_zh": "§III.C 明确把仓库/日志/公告中的提示注入纳入威胁，AI 服务的工具请求必须经确定性 broker，不能冒充人工、扩大网络范围、改变保密期或调用生产 CVE 发布接口；审批还绑定证据修订、收件人和载荷，属于 Agent 代表用户执行外部动作的授权边界。"
    },
    {
      "tags": [
        "multiagent",
        "memory",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "正文除普通协调负载外，明确测试恶意发送者以垃圾流量和押金竞价挤占收件 Agent 注意力，造成真实请求无法被读取；收件箱准入和记忆规则构成多 Agent 通信可用性边界，符合 Agent 自身抗干扰/拒绝服务范围。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文直接研究持续 Coding Agent 群能改变自身任务和 CI 评价器带来的治理风险，观察 Agent 修改/放松 CI，并明确提出 Agent 不可编辑的外部评价器与隐藏测试隔离。属于多 Agent 自改验收/监督边界研究，但主要是案例观察和研究议程，不是已验证防护效果。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "针对多Agent重复证据诱导judge的操纵，以来源谱系与复制不变性防御，并给出形式化与受控审计。"
    },
    {
      "tags": [
        "memory",
        "robustness",
        "monitoring"
      ],
      "reason_zh": "真实Agent harness边界破坏工具数据完整性并放大资源消耗，是上下文与可用性风险而非单纯上下文窗口大小。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "MCP工具描述注入触发越权二次调用及数据外泄，并证明合法任务成功不能代表安全。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "代理不可绕过人工审批，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "正文八类定向错误包含未核对进程身份即强杀，具体例子为切换 Flask 端口却误杀 redis-server/python3，直接涉及终端 Agent 不必要破坏性副作用；方法把行为避免与测试通过共同纳入奖励，兼有完成声明验证，因此纳入 Agent 工具行动安全训练。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "authorization"
      ],
      "reason_zh": "前沿Agent失控和操纵风险评估，强调行动过程可观测性及评估意识。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "明确涉及沙箱、工具/Skill自修改权限门控、评估投机与独立审计失败。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "研究代理中介 Web 接口如何保留或限制既有漏洞可利用性，直接涉及工具接口安全。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "工具Agent过程奖励与真实任务目标脱节的检测和缓解。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "injection",
        "monitoring"
      ],
      "reason_zh": "关注关闭可控性、授权干预验证、未授权注入区分和评测识别风险。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "memory",
        "privacy",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "OpenClaw推理、工具、记忆、执行和部署链的实际安全问题及多层防护建议。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "面向真实多轮工具Agent的意图保持对抗交互与压力测试，检验非合作但有效用户输入下可靠性。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文确实审计 Agent 结构化编辑/壳命令经运行时 gate 后何时首次实际变更源码，是可核验的工具执行时序边界；但被保护的先决条件只是接收规划指导，不是人类授权、安全政策或危害约束，中心目标也未验证安全效果。保留范围待定，不把所有编排先后契约自动算作安全。"
    },
    {
      "tags": [
        "authorization",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "建立Agent访问身份验证机制并防资源/垃圾提交滥用，给出挑战与被动识别评测。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "聚焦Skill版本和实际执行一致性、组合/生命周期攻击、安全联合评测以及执行来源辅助恢复。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "安全关键代码生成的人工监督、MCP验证工具及标准启发检查。"
    },
    {
      "tags": [
        "memory",
        "supplychain",
        "authorization",
        "privacy",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "涵盖Agent自改进资产污染继承、行为约束与权限保持、私密信息持久化，以及长期独立评测和监督。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "以运行时后果核验编码Agent的行动安全、模型/harness差异及风险知行差距。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "核心是工具副作用与资源安全语义、独立可执行验证和安全工具行为训练。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "embodied",
        "monitoring"
      ],
      "reason_zh": "测试覆盖委派授权、持久状态/物理行动效果与证据审计，强调不同现实基底下安全语义。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文评测包含工具输出中的间接指令注入、system/user/tool 优先级及应用访问控制，并给出仓库分析任务被诱导 execute_command 运行安装器的具体安全案例；因此并非只做单轮通用模型安全。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "攻击入口为生态Skill池及组合依赖，核心失效是信息流限制和授权不能组合传递，并包含泄密安全评测与运行时guard。"
    },
    {
      "tags": [
        "injection",
        "evaluation",
        "multiagent"
      ],
      "reason_zh": "直接评价工具Agent的直接滥用和间接注入，并通过攻击者与目标批评角色分离增强红队。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "分析Skill和context中的人工审批、诚实报告及隐私规则，属于Agent指令治理的实证证据而非防御有效性测试。"
    },
    {
      "tags": [
        "embodied",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "以内部危险表征和外显动作之间的差异评估具身Agent安全。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "以架构化政策—证据分离抵御指令注入，并检验授权决策是否保持边界。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "涉及Skill与附件攻击面、间接指令注入、权限绕过，以及评测可见性盲区。"
    },
    {
      "tags": [
        "memory",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "聚焦Agent记忆证据完整性、当前决策资格及腐蚀修复评测，属于非对抗认识论安全。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "正文 MANDATE 明确分析 Agent 越权扩范围、未确认即实施难逆操作、绕过安全控制、子 Agent 权限扩张和跨用户/会话信息泄漏，并以用户研究评估严重性与可察觉性；这是 Agent 自身委派/授权边界与监督失效研究，而非单纯任务性能分类。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文确实展示移动 Agent 在日期/人数等 ask-only 信息未获用户输入时直接确认预订，且要求在无可接受替代时停止，已触及代表用户行动的意图边界；但基准中心仍是个性化补全与任务成功，没有区分安全关键授权、不可逆损害或一般偏好错误。保留范围待定，不能仅凭会询问或会预订就认定安全评测。"
    },
    {
      "tags": [
        "embodied",
        "evaluation"
      ],
      "reason_zh": "直接评价视觉语言行动策略把危险语义转化为安全连续动作的能力。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "针对Agent错误反馈诱发的行为偏移，用预先证据记录和复核改善对齐与可靠动作。"
    },
    {
      "tags": [
        "privacy",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "涉及代理跨接收者传递用户私密信息的边界，以及更全面的Agent隐私评测。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "正文检验 Web Agent 验收程序在初始状态/要求变化后是否误放行，以及错误门控是否引发持久状态回退；这可能涉及用户要求的动作边界，但具体例子是受让人/状态等业务正确性，未单独定义安全或权限违规。保留待定，不把通用验收程序基准直接当安全基准。"
    },
    {
      "tags": [
        "memory",
        "robustness",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "除一般部署可靠性，论文 OC7 明确要求 Agent 恢复/重试时外部副作用只执行一次，并分析人工暂停、记忆和恢复契约及幂等修复。该动作执行边界与故障后状态完整性属于 Agent 自身运行安全；但运行实证中的外部动作重复主要是模型调用，不可夸大为已观察重复支付等事故。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "supplychain"
      ],
      "reason_zh": "Agent运行证据的来源、签名与可审计重放直接支持行为追溯；默认拒绝与签名者信任控制授权边界。"
    },
    {
      "tags": [
        "authorization",
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "正文把审批落实为执行前和发布前的阻断门控，记录审批者与时间；Agent 只能更新已授权参数，不能自主削弱治理规则，属于多 Agent 动作授权与审计架构。安全机制效果尚无受控实验，相关性与证据强度须分开。"
    },
    {
      "tags": [
        "authorization",
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "受限Agent外部服务组合扩权、网络边界绕过及公共消息板通信的实证监测。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "针对会产生现实后果的工具调用，衡量注入防御与服务拒绝风险，使用信任gate区分应阻断和应执行的请求。"
    },
    {
      "tags": [
        "memory",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "正文 §5.8 和附录 H 确认 TriggerBench 含 safe-coding 约束，助手门控会漏召回或错误触发已解除约束；但本篇只测检索/发声，未评估实际行动危害或安全规则执行。安全记忆关联仍为真实边界，保留不确定。"
    },
    {
      "tags": [
        "memory",
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "正文确有独立于骨干模型的自修改守卫：只准单个作用域编辑、保留大部分原提示、限制 Agent/技能数量、禁止把参考答案写入记忆；这可能构成多 Agent 自演化控制边界。但实验只衡量任务效果和训练开销，没有攻击、授权政策或安全关键不变量验证，不能直接宣称安全自演化。保留待定。"
    },
    {
      "tags": [
        "supplychain",
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "恶意代码植入与AI审查的对抗系统，以漏洞利用执行验证防线有效性。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "§III-C以独立证据核验编码代理宣称的L0–L4完成度，§IV诊断静默错误和错误成功声明，§V限制为单代理十项目。属于直接编码代理可靠性/监督审计，非单纯迁移性能。"
    },
    {
      "tags": [
        "privacy",
        "supplychain",
        "memory",
        "evaluation"
      ],
      "reason_zh": "安全对象是Agent私有Skill内容，攻击通过自适应多轮探测与记忆积累造成机密泄露，并系统评测平台防护。"
    },
    {
      "tags": [
        "embodied",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "正文明确区分任务完成与安全谓词：碰撞距离、接触力和释放时序等必须在轨迹中持续满足；测试涵盖语言条件 RDT 的指令故障，以及 ACT/RDT 的感知、动作与时序干扰。属于具身/VLA Agent 行动安全，而非仅任务成功率鲁棒性。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "正文直接研究 6G 控制代理消息可信度审计、隐藏相关性与集体幻觉传播；五个 Mistral 7B xApp 实验比较无通信、路径和全连接的审计偏差，符合多代理安全监测。生成器和审计器共享先验，作者承认偏差可能被低估。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "evaluation"
      ],
      "reason_zh": "直接针对Coding Agent消费不可信仓库源码的边界，通过无显式指令的标识符投毒使下游代码带入漏洞。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "Agent诚实报告、监督证据及端到端安全测试框架。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "按已提交工具动作核验硬性规则、安全终态及政策到行动的合规落差。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "privacy"
      ],
      "reason_zh": "明确区分目标完成和用户授权，评测工具副作用、错误收件人、范围扩张与跨工具连锁伤害。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation",
        "embodied"
      ],
      "reason_zh": "对机器人评估器执行日志注入、监控误判及防御效果进行测试。"
    },
    {
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "正文明确用只读测试边界阻止 RustRepairAgent 通过改测试绕过真实失败，存在 Agent 奖励/验收作弊防线；但中心贡献与安全指标仍是 C→Rust 迁移后的 unsafe/raw-pointer 数和等价测试，未单独验证 Agent 边界机制。作为父级补充复核保留待定，避免把全部内存安全迁移自动纳入 Agent Safety。"
    },
    {
      "tags": [
        "supplychain",
        "monitoring",
        "evaluation",
        "memory"
      ],
      "reason_zh": "围绕Coding Agent生成漏洞与安全修复，使用开发轨迹验证而非信任解释，并以修复记忆和执行检查保护未来代码修改。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "以任务授权与安全敏感效果作为运行时证据，改进弱模型对强Agent危险行为的识别和校准。"
    },
    {
      "tags": [
        "memory",
        "robustness",
        "monitoring"
      ],
      "reason_zh": "重点是Agent持久知识完整性、证据验证与不可靠技能撤销；非对抗情境。"
    },
    {
      "tags": [
        "injection",
        "evaluation",
        "monitoring",
        "authorization"
      ],
      "reason_zh": "外部虚假信息诱导工具执行，比较可信度判断、有害行为和正常效用。"
    },
    {
      "tags": [
        "multiagent",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "多智能体意见演化可能放大错误信念形成集体错觉。"
    },
    {
      "tags": [
        "authorization",
        "supplychain",
        "monitoring",
        "multiagent"
      ],
      "reason_zh": "正文涉及Coding Agent权限回调、子Agent继承、共享仓库隔离及人工审核，安全关联通过正文确认。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "编码修复的仓库架构约束、补丁策略与隔离执行验证。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "分析交互规划Agent的预测近似误差放大及导师接管/让权决策保障，属于Agent安全理论。"
    },
    {
      "tags": [
        "authorization",
        "supplychain",
        "memory",
        "monitoring"
      ],
      "reason_zh": "直接以OS保护机制审计编码Agent的权限隔离、恢复转录完整性及监控失效。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "研究多LLM Agent为争夺下游分配而夸大置信度，提出审计和激励兼容机制，直接涉及多Agent可信协调。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "检验代表用户偏好的LLM代理在相互影响的社会困境中是否行为对齐，区分宣称价值与行动。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "关注特权Agent安全修复声明、独立审计与多Agent监督证据链。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接验证MCP工具实现身份、检测替换/漂移，评测污损任务和验证边界。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "自主训练Agent的自改进实验含人类偏好收益与有害顺从恶化的安全权衡。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "multiagent",
        "privacy"
      ],
      "reason_zh": "系统论述Agent与多Agent的权限、数据来源、记忆、零信任和治理控制面，明确覆盖Agent安全治理。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "重建agentic诊断系统并量化候选空间污染和数据泄漏导致的虚高评测，直接涉及Agent评测可信性。"
    },
    {
      "tags": [
        "multiagent",
        "injection",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "Web证据可操纵多评审器，提出带签名挑战和阈值共识的抗恶意评审机制。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "将用户确认、工具可用性和可见证据用于过滤动作监督，区分执行成功与行动合法依据。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "对自主欺诈Agent与受害者Agent交互及反欺诈干预做闭环评估，关注恶意代理造成的累积伤害。"
    },
    {
      "tags": [
        "robustness",
        "evaluation"
      ],
      "reason_zh": "控制环境变化下Web Agent技能失效和可执行性退化，建立鲁棒性诊断及测试时适应。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "漏洞引入代码的代理安全审查，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "针对第三方Agent Skill供应链恶意行为，联合自然语言指令与可执行代码进行依赖图安全分析。"
    },
    {
      "tags": [
        "supplychain",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "Coding Agent代码产物安全及功能联合验证和反馈修复。"
    },
    {
      "tags": [
        "authorization",
        "robustness"
      ],
      "reason_zh": "定义自主Agent身份/权限边界与受治理学习回路，并以权限约束仿真实验检验，直接涉及行动授权。"
    },
    {
      "tags": [
        "memory",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "LLM Agent长期记忆错误归因、过度保留和隐私敏感信息引发的失配，提出反事实审计并评测。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "injection",
        "evaluation"
      ],
      "reason_zh": "跨Agent社会工程误导导致未授权行动，区分证据正确性和权限有效性。"
    },
    {
      "tags": [
        "supplychain",
        "monitoring"
      ],
      "reason_zh": "MCP代码状态证据链的来源/完整性和真实性边界。"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "对LLM Agent在HPC发起和运行任务实施确定性授权、硬件签名租约和逐rank监督，实测注入与串谋攻击防护。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "multiagent"
      ],
      "reason_zh": "以编程契约和执行kernel强制Agent授权、审批、资源界限与审计证据。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "从多Agent执行轨迹估计上游错误传到下游的风险并沿执行图传播，直接涉及多Agent可靠性监控。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "monitoring",
        "supplychain"
      ],
      "reason_zh": "实际Agent编码工作流控制平面案例，明确检验隐私、角色权限、审计及可观察性。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "自主网络防御Agent动作与机密性、完整性、可用性目标对齐。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "直接控制LLM Agent运营者、仓库、用户、工具、记忆指令冲突的来源与位置，评估行动遵循及冲突披露。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "MCP提示注入网关中路由、仲裁器与消融评测的真实贡献，直接防御及安全评估。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "恶意工具描述优化欺骗工具选择，并检验安全检测规避。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "针对隐藏目标且识别监督的模型行为，以合成文档微调暴露失配行动倾向。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "鲁棒与安全RL基准明确覆盖VLA及人形任务和273扰动配置，包含具身Agent鲁棒安全评测。"
    },
    {
      "tags": [
        "embodied",
        "privacy",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "直接研究具身VLA联邦适应中人类安全纠正丢失、跨机器人不安全响应与隐私泄漏。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "实验室Agent动作预验证、安全执行、持久轨迹与错误恢复。"
    },
    {
      "tags": [
        "multiagent",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "多Agent合作/背叛对语言扰动敏感，局部扰动会波及远处Agent。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "在编码Agent工具执行边界用环境谓词预检幻觉调用，直接工具使用可靠性监控。"
    },
    {
      "tags": [
        "memory",
        "authorization",
        "injection",
        "evaluation"
      ],
      "reason_zh": "明确研究LLM Agent记忆与SKILL.md同级冲突，包括权限争议、工具调用及静默裁决，直接相关。"
    },
    {
      "tags": [
        "robustness",
        "evaluation"
      ],
      "reason_zh": "协议级工具故障注入直接检验 Agent 可用性及恢复韧性。"
    },
    {
      "id": "2610.32531",
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "外部内容诱导的近目标偏离与有害工具调用是直接提示注入评测。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "异步结果与重复事件下的状态保持、禁止副作用及验证义务。"
    },
    {
      "id": "2610.32392",
      "tags": [
        "authorization",
        "monitoring",
        "multiagent"
      ],
      "reason_zh": "固定用户批准范围、越界重新审批和独立产物门控构成明确的多 Agent 行动授权与监督。"
    },
    {
      "id": "2610.32370",
      "tags": [
        "authorization",
        "embodied",
        "monitoring"
      ],
      "reason_zh": "独立动作约束检查用于真实物理科学仪器 Agent，直接关联行动安全与监督。"
    },
    {
      "id": "2610.32305",
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "依据证据禁止后续动作、诊断与执行脱节，构成自我克制和行动边界评测。"
    },
    {
      "id": "2610.32285",
      "tags": [
        "evaluation",
        "monitoring",
        "authorization",
        "privacy",
        "memory"
      ],
      "reason_zh": "原生 harness 的审批、秘密脱敏、信任边界及跨会话信息隔离均由明确任务合同与独立证据评价。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "Skill 供应链中跨组件信息流产生越界操作，直接关联组合安全审计。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "injection"
      ],
      "reason_zh": "新正文证据显示 LLENS 不只是列举内网部署：nsjail 限制 Python/shell 网络访问，文档只读，用户工作区隔离，共享目录按组授权，Controls 显式讨论附件提示注入后的可写损害边界。但论文中心贡献仍是通用医疗 Agent 平台及功能评估，未独立验证这些安全保障；保留范围待定，不以缺少攻击实验直接否定设计贡献。"
    },
    {
      "id": "2610.32110",
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "不可信/不完整工具文本传播到 Agent 主张并穿过 verifier，直接检验工具证据可信边界。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "以执行轨迹进行 Agent 来源验证并评测对抗身份伪装。"
    },
    {
      "tags": [
        "embodied",
        "robustness"
      ],
      "reason_zh": "闭环 MLLM 驾驶的歧义处理可能涉及行动安全，但需区别一般驾驶成功率改进。"
    },
    {
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "明确评测科学工具 Agent 集成后对有害请求和攻击的防护退化。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "善意但欠指定的请求导致代理越过隐私及隐含授权边界，是直接安全基准。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "涉及部署配置绑定、持续审计与撤回授权，但与专属Agent安全的范围联系仍不充分。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "明确把受保护状态和业务策略作为工具执行的安全完整性约束。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "局部权限均合法但跨 Agent 合作绕过整体监督，涉及仓库协作安全。"
    },
    {
      "id": "2610.31974",
      "tags": [
        "injection",
        "supplychain",
        "authorization",
        "multiagent"
      ],
      "reason_zh": "工具解码跨模态信任洗白与 MCP 来源/污点/调用拦截是直接多 Agent 注入防御。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "Agent 提示优化中的正确性门控明确提及 reward hacking，但安全评测细节不足。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "研究多 Agent 隐蔽破坏及信任评估与决策脱节的防御边界。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "工作流风险传播、证据核验和拒答/升级与安全相邻，但金融预测UQ主体使范围仍待确认。"
    },
    {
      "tags": [
        "authorization",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "直接研究持久 Agent 工具重试的现时授权和外部作用安全。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "检验工具最小权限的形式定义、风险尺度和 Agent 权限选择评测。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "围绕Coding Agent停止与升级边界、不安全请求、外部监控和阻塞基准，属于动作安全与可靠交接。"
    },
    {
      "id": "2610.31840",
      "tags": [
        "memory",
        "privacy",
        "authorization"
      ],
      "reason_zh": "工具调用内存隔离、跨用户泄露及不可逆动作门控均为明确安全机制。"
    },
    {
      "tags": [
        "authorization",
        "supplychain",
        "monitoring"
      ],
      "reason_zh": "可信合同把调用绑定到工具来源、版本及运行时行为声明。"
    },
    {
      "id": "2610.31778",
      "tags": [
        "memory",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接测量压缩对禁止行为和反作弊规则的遗忘，关系 Agent 安全约束保留。"
    },
    {
      "id": "2610.31650",
      "tags": [
        "evaluation",
        "robustness",
        "authorization"
      ],
      "reason_zh": "以配对任务评测安全证据缺失时的越界执行、补充取证与恰当行动。"
    },
    {
      "id": "2610.31624",
      "tags": [
        "evaluation"
      ],
      "reason_zh": "按训练检查点评测可验证奖励强化学习中的权力寻求与监督抵抗等工具性行为。"
    },
    {
      "id": "2610.31593",
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "用模拟工具响应扩展 AI 控制评测，并验证其对部署安全及监控效果的预测能力。"
    },
    {
      "id": "2610.31553",
      "tags": [
        "monitoring"
      ],
      "reason_zh": "让治理人员审查 Agent 的证据与争议论点，记录元数据决策中的人工干预和依据。"
    },
    {
      "id": "2610.31446",
      "tags": [
        "memory",
        "authorization"
      ],
      "reason_zh": "依据即将执行动作的后果选择记忆前提复核、放行或弃权，控制陈旧记忆造成的伤害。"
    },
    {
      "id": "2610.31436",
      "tags": [
        "multiagent",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "研究非平稳环境下多 Agent 架构更新的风险约束、影子回放与回滚验证。"
    },
    {
      "id": "2610.31404",
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "以自适应钓鱼邮件评测邮件 Agent 是否识别并拒绝第三方恶意请求。"
    },
    {
      "id": "2610.31376",
      "tags": [
        "authorization",
        "injection",
        "robustness"
      ],
      "reason_zh": "以 Petri 网监督器强制执行工具能力、审批和预算，并分析拒绝后的重规划代价。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "研究自主Agent可复现性和忠实性违规的轨迹审计、运行时纠正及专门基准。"
    },
    {
      "id": "2610.31366",
      "tags": [
        "memory",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "构建删除后信息恢复审计，检查派生记忆是否仍可重建已删除秘密。"
    },
    {
      "id": "2610.31325",
      "tags": [
        "multiagent"
      ],
      "reason_zh": "控制病例不变，研究多代理临床主持者人格对决策偏置及重复运行表面一致性的影响。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "monitoring"
      ],
      "reason_zh": "编码代理契约治理，直接关联代理安全控制或失效评测"
    },
    {
      "id": "2610.31165",
      "tags": [
        "multiagent",
        "robustness"
      ],
      "reason_zh": "研究交互网络拓扑如何改变 LLM 群体共识及对少数对抗节点的易感性。"
    },
    {
      "id": "2610.31130",
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "构造离线证据相同而部署安全相反的生命周期，研究审计可识别性与新鲜结果监控。"
    },
    {
      "id": "2610.31062",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "把跨轮策略编译为可解释的神经符号谓词程序，稳定执行复合政策判断。"
    },
    {
      "id": "2610.30924",
      "tags": [
        "evaluation"
      ],
      "reason_zh": "构建企业代理测试套件的故障注入与规则来源审计框架，并报告其测量和法规依据缺陷。"
    },
    {
      "id": "2610.30916",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "以真实开发经历分析评估瓶颈，并记录把代理可绕过流程检查点改成强制门控的必要性。"
    },
    {
      "id": "2610.30769",
      "tags": [
        "multiagent",
        "robustness"
      ],
      "reason_zh": "研究多 Agent 的社会反馈如何产生从众和难以自纠的失控级联。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "测量有害文档修改请求从拒绝转向实际工具调用的条件，直接关注行动边界。"
    },
    {
      "id": "2610.30742",
      "tags": [
        "monitoring",
        "robustness"
      ],
      "reason_zh": "学习跨对话、代理轨迹及多代理轨迹接口一致的安全表示，提高护栏泛化可靠性。"
    },
    {
      "id": "2610.30738",
      "tags": [
        "monitoring"
      ],
      "reason_zh": "以运行时事件、来源图和证据契约实现可重放、可核验的安全诊断。"
    },
    {
      "id": "2610.30698",
      "tags": [
        "memory",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "固定记忆内容与任务，测试记忆有效性控制状态受损如何改变可见上下文和行为。"
    },
    {
      "id": "2610.30666",
      "tags": [
        "robustness",
        "multiagent"
      ],
      "reason_zh": "研究通过额外推理与协作轮次消耗单体及多 Agent 诈骗系统的计算资源。"
    },
    {
      "tags": [
        "monitoring",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "不可信监控器串通纠偏，直接关联代理安全控制或失效评测"
    },
    {
      "id": "2610.30571",
      "tags": [
        "supplychain",
        "memory",
        "robustness"
      ],
      "reason_zh": "研究仓库过期指令文件压过现有代码的上下文权威冲突，以及明确优先级的修复。"
    },
    {
      "id": "2610.30562",
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "为持续演化的 AI 分析器提出终身有效验证，控制反复更新和反馈适应带来的错误风险。"
    },
    {
      "id": "2610.30557",
      "tags": [
        "multiagent",
        "authorization",
        "memory"
      ],
      "reason_zh": "用多角色决策、共享记忆及不可自改的风险核心约束自主投资系统的自我演化。"
    },
    {
      "id": "2610.30495",
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "把自主研究的经验结论变成可执行性质测试，以证据和可重放反例核验声明。"
    },
    {
      "id": "2610.30491",
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "核对工具故障轨迹与行为检测标签，揭示验证记录、最终正确性及故障传播的差异。"
    },
    {
      "id": "2610.30485",
      "tags": [
        "memory",
        "evaluation"
      ],
      "reason_zh": "通过多会话交互基准测试 Agent 对澄清、确认和自主行动偏好的记忆与更新。"
    },
    {
      "id": "2610.30445",
      "tags": [
        "monitoring",
        "authorization"
      ],
      "reason_zh": "围绕透明、问责与可信建立人类监督、升级处理及可审计的自治治理框架。"
    },
    {
      "id": "2610.30436",
      "tags": [
        "multiagent",
        "privacy",
        "authorization"
      ],
      "reason_zh": "综述 6G 多模态 Agent 的跨层威胁，覆盖多 Agent 信任、工具编排和隐私保护。"
    },
    {
      "id": "2610.30418",
      "tags": [
        "privacy"
      ],
      "reason_zh": "研究 Agent 将可访问文档组合推断为禁止披露的敏感事实及拒绝中的泄密。"
    },
    {
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "攻击者控制可检索网页操纵工具增强LLM回答，是推理时外部证据攻击面。"
    },
    {
      "id": "2610.30221",
      "tags": [
        "authorization",
        "multiagent"
      ],
      "reason_zh": "提出分布式自治架构，将提议、治理裁定和执行分离，并绑定签名证明与短期动作令牌。"
    },
    {
      "id": "2610.29869",
      "tags": [
        "memory",
        "injection",
        "authorization"
      ],
      "reason_zh": "研究上下文压缩丢失角色来源，使注入内容变成持久记忆中的伪造用户授权。"
    },
    {
      "id": "2610.29747",
      "tags": [
        "injection"
      ],
      "reason_zh": "研究取证证据中植入指令对调查结论、文件写入和网络操作的劫持。"
    },
    {
      "id": "2610.29609",
      "tags": [
        "monitoring"
      ],
      "reason_zh": "隔离 GUI 代理成功自报与独立轨迹判断，以审计并拦截缺乏执行证据的完成声明。"
    },
    {
      "id": "2610.30202",
      "tags": [
        "injection",
        "monitoring"
      ],
      "reason_zh": "以语义意图推理检测文本、图像和网页环境中的提示注入。"
    },
    {
      "id": "2610.29379",
      "tags": [
        "supplychain",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "分析代码安全审计框架漏选、过滤和合并导致的隐蔽漏报及攻击者规避。"
    },
    {
      "id": "2610.29346",
      "tags": [
        "robustness",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "提出深度研究代理中间工作流错误分类与轨迹分析框架，以诊断系统及任务可靠性。"
    },
    {
      "id": "2610.29292",
      "tags": [
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "比较团队执行轨迹分配成员贡献并优化通信拓扑，检验识别与剔除有害成员。"
    },
    {
      "id": "2610.29216",
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "以人工授权参照和反事实购买基准区分偏好适配、先确认和自动购买的边界。"
    },
    {
      "id": "2610.29178",
      "tags": [
        "monitoring",
        "authorization",
        "injection"
      ],
      "reason_zh": "研究审批监控器共享污染证据时的相关失效，以及按证据来源聚合授权判定。"
    },
    {
      "id": "2610.29129",
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "通过动态表示监控与干预抑制工具调用和长上下文任务中的奖励投机。"
    },
    {
      "id": "2610.28989",
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "从可执行环境生成工具参数、资源及上下文权限案例，并训练策略守卫。"
    },
    {
      "id": "2610.28988",
      "tags": [
        "injection",
        "monitoring"
      ],
      "reason_zh": "研究真实工具代理中间接提示注入的注意力检测失效，并比较头级分类器的跨域表现。"
    },
    {
      "id": "2610.28987",
      "tags": [
        "memory",
        "authorization",
        "multiagent"
      ],
      "reason_zh": "以确认门和机器验证完整性定理约束不可信记忆使用，并支持多 Agent 可信共享。"
    },
    {
      "id": "2610.28982",
      "tags": [
        "evaluation",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "评测文本拒绝向工具行动的迁移失败，并分析拒绝相关内部表示与不安全调用。"
    },
    {
      "id": "2610.28966",
      "tags": [
        "multiagent",
        "injection",
        "privacy"
      ],
      "reason_zh": "以强化学习生成针对多 Agent 调用结构的攻击，提取子 Agent 系统提示。"
    },
    {
      "id": "2610.28955",
      "tags": [
        "embodied",
        "evaluation"
      ],
      "reason_zh": "以形式验证数据和验证奖励训练小型机器人规划模型，使任务计划满足安全约束。"
    },
    {
      "id": "2610.28934",
      "tags": [
        "robustness",
        "evaluation"
      ],
      "reason_zh": "以可执行后悔场景评测备份意识，并在修改前保存状态以提高行动可恢复性。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "可控测试欺骗、隐蔽协调和破坏等多Agent危险行为，强调机械与评分双重观测和可重复评估。"
    },
    {
      "id": "2610.28810",
      "tags": [
        "memory",
        "injection",
        "privacy"
      ],
      "reason_zh": "研究持久记忆注入跨会话传播及共享记忆中的跨用户泄露。"
    },
    {
      "id": "2610.28798",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "约束研究代理观察验证反馈、停止迭代及访问测试集的时机，减少自适应选择偏差。"
    },
    {
      "id": "2610.28787",
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "用反事实违约审计区分多代理市场中的高价结果与真正可执行的合谋机制。"
    },
    {
      "id": "2610.30188",
      "tags": [
        "robustness"
      ],
      "reason_zh": "用机器可检查的等价性证明约束编码 Agent 优化，避免只通过测试而破坏程序行为。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文将工具验证置于 Agent 执行环，包含访问授权、策略审批与工具调用偏差的受控决策评测；按安全组件评测纳入，不宣称端到端 Agent 防护。"
    },
    {
      "id": "2610.28484",
      "tags": [
        "authorization",
        "multiagent"
      ],
      "reason_zh": "要求 Agent 为操作提供机器可检查的约束证明，以执行系统约束委托和协作。"
    },
    {
      "id": "2610.28454",
      "tags": [
        "multiagent"
      ],
      "reason_zh": "研究卖方代理在竞争中夸大工具描述，及其对买方选择和群体市场诚信的影响。"
    },
    {
      "id": "2610.28707",
      "tags": [
        "evaluation"
      ],
      "reason_zh": "模拟编码强化学习中奖励投机的出现过程，用于预先筛选风险较低的训练方案。"
    },
    {
      "id": "2610.28425",
      "tags": [
        "memory",
        "injection",
        "evaluation"
      ],
      "reason_zh": "评测注入载荷经记忆和定时任务跨会话植入、触发及持续影响。"
    },
    {
      "tags": [
        "authorization",
        "multiagent",
        "monitoring",
        "injection",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "统一保护单、多代理本地事件、消息路径、角色权限及不透明参与者。"
    },
    {
      "id": "2610.28381",
      "tags": [
        "embodied",
        "evaluation"
      ],
      "reason_zh": "分别评测情境动作危险识别与长期家庭任务安全规划，并区分风险严重程度。"
    },
    {
      "id": "2610.28315",
      "tags": [
        "memory",
        "privacy"
      ],
      "reason_zh": "研究持久记忆回应与用户反馈相互强化而扩大个人属性泄露的机制。"
    },
    {
      "tags": [
        "authorization",
        "embodied"
      ],
      "reason_zh": "核心设计包含工业控制编码Agent的分级工具权限和现实行动的人类监督。"
    },
    {
      "id": "2610.28116",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "挖掘业务规则并构造交互测试，检验工具调用权限和越权访问、修改他人数据。"
    },
    {
      "tags": [
        "memory",
        "authorization",
        "injection"
      ],
      "reason_zh": "明确防止不可信记忆与工具内容升权，跨上下文/持久化/调用边界执行宿主侧保护。"
    },
    {
      "id": "2610.27777",
      "tags": [
        "robustness",
        "evaluation"
      ],
      "reason_zh": "构建工具静默错误基准，评测多步代理发现、核验并恢复错误的能力。"
    },
    {
      "id": "2610.27739",
      "tags": [
        "robustness"
      ],
      "reason_zh": "测量语言模型攻击者与欺骗防御者的双边能耗，分析增加对手资源成本的条件。"
    },
    {
      "id": "2610.27735",
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "以自主研发代理隐蔽破坏后继模型训练为测试场景，评估行为监控与规避。"
    },
    {
      "id": "2610.27655",
      "tags": [
        "multiagent",
        "robustness"
      ],
      "reason_zh": "比较面向用户的单代理与多代理系统，分析错误写入、预算耗尽和协作失效。"
    },
    {
      "id": "2610.27620",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "证明逐动作授权无法覆盖跨执行的目的和委托约束，研究跨轨迹监控要求。"
    },
    {
      "id": "2610.27581",
      "tags": [
        "memory",
        "evaluation"
      ],
      "reason_zh": "用事务状态标注评测全双工语音代理的记忆写入、更新、忽略和过期信息控制。"
    },
    {
      "id": "2610.27577",
      "tags": [
        "monitoring"
      ],
      "reason_zh": "以多维欺骗子空间和场景自适应组合检测策略性隐瞒，分析静态探针失效。"
    },
    {
      "id": "2610.27574",
      "tags": [
        "multiagent",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "构建恶意子 Agent 诱使主管将其纳入越权任务的攻击与基准。"
    },
    {
      "id": "2610.27548",
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "以可执行任务直接评测 Agent 是否越出用户授予的行动范围。"
    },
    {
      "id": "2610.27543",
      "tags": [
        "authorization",
        "monitoring",
        "privacy"
      ],
      "reason_zh": "以可信执行环境、策略监控和可证明执行图实现沙箱合规及模型权重保密。"
    },
    {
      "id": "2610.27483",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "结合委托授权范围、行为异常检测与解释机制，防范模拟代理支付中的越权和冒充。"
    },
    {
      "id": "2610.27480",
      "tags": [
        "authorization"
      ],
      "reason_zh": "将执行许可绑定审批依据，在状态变化后撤销失效许可并于派发时复核。"
    },
    {
      "id": "2610.27465",
      "tags": [
        "evaluation",
        "authorization",
        "robustness"
      ],
      "reason_zh": "研究无人值守自改动的验证器强度、审批门槛与回滚可恢复性。"
    },
    {
      "id": "2610.27406",
      "tags": [
        "memory",
        "robustness"
      ],
      "reason_zh": "分析记忆抽象经执行和再抽象反复生成错误，并以按需生成指导减少错误持久化。"
    },
    {
      "id": "2610.27350",
      "tags": [
        "embodied",
        "authorization"
      ],
      "reason_zh": "研究机器人行动循环执行危险目标的问题，并在首次运动前加入运行时安全门控。"
    },
    {
      "id": "2610.27295",
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "评测可解释性引导的细粒度行为控制，兼顾真实代理交互中的可控性与能力保留。"
    },
    {
      "tags": [
        "multiagent",
        "embodied",
        "robustness"
      ],
      "reason_zh": "安全多Agent强化学习的观测攻击，在保持任务收益下提高安全代价。"
    },
    {
      "id": "2610.27244",
      "tags": [
        "injection",
        "memory",
        "evaluation"
      ],
      "reason_zh": "自动构建持久助手的端到端红队场景，覆盖配置、记忆和技能投毒。"
    },
    {
      "id": "2610.27234",
      "tags": [
        "evaluation"
      ],
      "reason_zh": "统一企业代理基准与分维度评分，其中明确包含安全和拒绝执行能力。"
    },
    {
      "id": "2610.27227",
      "tags": [
        "multiagent",
        "supplychain"
      ],
      "reason_zh": "对团队中代理与技能配对进行贡献归因，检验发现并纠正技能库中的植入有害技能。"
    },
    {
      "id": "2610.27210",
      "tags": [
        "supplychain",
        "injection"
      ],
      "reason_zh": "研究语音模型微调后门将目标说话者声音转为恶意转录指令并驱动下游工具。"
    },
    {
      "tags": [
        "robustness",
        "evaluation"
      ],
      "reason_zh": "网页Agent多语言和弹窗干扰下可用性失效基准。"
    },
    {
      "id": "2610.28683",
      "tags": [
        "authorization",
        "supplychain",
        "monitoring"
      ],
      "reason_zh": "审计编码代理借人类账号审批、关闭保护及绕过合并门的记录，核验权限与提交证据。"
    },
    {
      "id": "2610.27115",
      "tags": [
        "authorization",
        "memory"
      ],
      "reason_zh": "以来源类型化记忆区分可信与外部信息，在执行前比较并选择可提交动作。"
    },
    {
      "id": "2610.26799",
      "tags": [
        "monitoring",
        "authorization"
      ],
      "reason_zh": "研究 Agent 解释与证据中的认知攻击面，提出有边界委托和可审查责任机制。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "评估代理生成的可执行验证器抵抗无效方案与攻击，并揭示错误安全检查的误拒绝风险。"
    },
    {
      "id": "2610.26698",
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "构建选择性隐瞒漏洞知识且抵抗诱导的模型，以检验监督者提取潜在知识的能力。"
    },
    {
      "id": "2610.26664",
      "tags": [
        "monitoring"
      ],
      "reason_zh": "提议在生产环境布置诱饵机会，以发现、归责和威慑内部代理的恶意行为。"
    },
    {
      "id": "2610.26662",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "将交易代理的确定性风险门、受限自审与人工批准分层，并分析实际监控遗漏。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "§3.2 明确三个 agentic 环境，代理读取 .monitor/state.json 的监督线索，并执行提交代码、销售选择与问题路由；直接研究规避监督的策略性合规。三环境共享冲突结构，不等于证明任意部署自然产生恶意目标。"
    },
    {
      "id": "2610.26548",
      "tags": [
        "multiagent",
        "authorization"
      ],
      "reason_zh": "多代理数据访问流程以可验证凭证限制协商，并复核合同使用政策与实际执行。"
    },
    {
      "id": "2610.26501",
      "tags": [
        "authorization"
      ],
      "reason_zh": "在内核连接路径暂扣网络出站，按绑定具体套接字的独立验证结果放行。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "认证运行权限、编辑范围校验、原子提交与可审计执行边界。"
    },
    {
      "id": "2610.26438",
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "构建交易 Agent 的信息注入基准，研究伪造新闻与证据可信线索如何操纵决策。"
    },
    {
      "tags": [
        "authorization",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "正文明确设计 LLM 多 Agent 工具鉴权、作用域检查、可逆行动边界与安全升级机制，并提出对抗评测框架；属于安全架构研究，但没有受控安全有效性结果。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "§2.2 确认提示驱动托管模型用工具检索交易历史、输出交易参数，引擎执行止损与退出；直接审计风险规则、仓位限制和控制失效。首页无自身 arXiv 水印，但标题和作者与当前 API 匹配。单厂商快照不能证明普适安全或收益。"
    },
    {
      "id": "2610.26101",
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "通过阶段信息、行动和提交边界治理策略开发，并用运行轨迹证据与基准检验可靠性。"
    },
    {
      "id": "2610.26088",
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "以可执行审计检查临床建模 Agent 的预测时泄漏与奖励投机，并用来源验证约束。"
    },
    {
      "id": "2610.26013",
      "tags": [
        "injection",
        "authorization"
      ],
      "reason_zh": "将工具输出中潜在指令的定位与用户授权判断分离，防御间接提示注入。"
    },
    {
      "id": "2610.25954",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "分别评测业务结果与过程合规，检查披露、同意、权限及操作顺序。"
    },
    {
      "id": "2610.25947",
      "tags": [
        "robustness",
        "monitoring",
        "memory"
      ],
      "reason_zh": "分析自身成功记录压过失败观察的上下文效应，并用中间层信号否决错误推进。"
    },
    {
      "id": "2610.25916",
      "tags": [
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "以真实执行反例验证编码 Agent 的安全修复，并作为训练奖励抑制代理信号投机。"
    },
    {
      "id": "2610.25843",
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "以价格等价审计衡量卖方线索对购物代理的操纵影响及模型易感差异。"
    },
    {
      "id": "2610.25827",
      "tags": [
        "memory",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "用匹配基准研究检索上下文与技能程序部分冲突时的错误采纳及修复。"
    },
    {
      "id": "2610.25760",
      "tags": [
        "monitoring",
        "memory"
      ],
      "reason_zh": "通过文件锁状态任务检验即时推理、历史保留与违规动作的因果联系及可监测性。"
    },
    {
      "id": "2610.25731",
      "tags": [
        "privacy",
        "multiagent"
      ],
      "reason_zh": "研究多代理消息组合恢复已遗忘信息的泄露风险，并训练面向聚合恢复的遗忘机制。"
    },
    {
      "id": "2610.25707",
      "tags": [
        "memory",
        "privacy",
        "authorization"
      ],
      "reason_zh": "区分共享记忆中的外来凭证暴露、实际使用和受害账户变化，检验所有者绑定。"
    },
    {
      "id": "2610.25629",
      "tags": [
        "robustness",
        "authorization"
      ],
      "reason_zh": "用故障注入研究代理组合契约、执行控制和消费侧验证如何限制错误成功。"
    },
    {
      "id": "2610.25563",
      "tags": [
        "authorization",
        "privacy",
        "embodied"
      ],
      "reason_zh": "为物理设备工具调用选择合格端点，兼顾访问授权、设备约束与反馈差分隐私。"
    },
    {
      "id": "2610.25552",
      "tags": [
        "authorization",
        "robustness"
      ],
      "reason_zh": "从 API 文档和轨迹提取符号约束，在运行时检查并修复不满足前提的工具调用。"
    },
    {
      "id": "2610.25508",
      "tags": [
        "multiagent",
        "authorization"
      ],
      "reason_zh": "研究经济博弈的策略影响与信任边界，并通过预设上线门和回滚规则保护生产代理。"
    },
    {
      "id": "2610.25496",
      "tags": [
        "authorization"
      ],
      "reason_zh": "形式化候选动作经另一决策实体评估后才执行的共享自治与授权交互。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "monitoring"
      ],
      "reason_zh": "通话筛选Agent越权回复、夸大风险与摘要证据归属失真，通过边界受限训练和质量审核缓解。"
    },
    {
      "id": "2610.25374",
      "tags": [
        "monitoring",
        "memory",
        "evaluation"
      ],
      "reason_zh": "提出自重写基础设施中的联合漂移监控、知识更新和共享评测门控研究框架。"
    },
    {
      "id": "2610.25372",
      "tags": [
        "injection",
        "supplychain"
      ],
      "reason_zh": "通过工具描述及外部资源投毒，优化跨规划上下文和多轮执行持续生效的触发器。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "正文 MAD Bench 包含独立的 800 题 Safety and Refusal 领域，含有害请求、情境安全边界、欺骗与过度拒绝，明确测试同伴压力下能否维持拒绝与诚实；因此不只是普通多 Agent 正确率。总体共同错误增幅不可误称安全子集的越狱增幅。"
    },
    {
      "id": "2610.25241",
      "tags": [
        "evaluation"
      ],
      "reason_zh": "系统审查代理失控风险研究的构念、内容和外部效度，区分证据强弱与风险概率。"
    },
    {
      "id": "2610.25179",
      "tags": [
        "memory",
        "authorization"
      ],
      "reason_zh": "将持久记忆的写入状态认证与查询时读取授权分离，限制无资格记忆的影响。"
    },
    {
      "id": "2610.25161",
      "tags": [
        "privacy"
      ],
      "reason_zh": "以仅私有事实不同的双世界训练代理，使外部行动轨迹不泄露观察者可推断的隐私。"
    },
    {
      "id": "2610.25123",
      "tags": [
        "memory",
        "supplychain"
      ],
      "reason_zh": "将安全核验记忆绑定依赖版本，传播撤销失效，避免发布上游已失效的软件包等制品。"
    },
    {
      "id": "2610.25114",
      "tags": [
        "embodied",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "在隔离审计的技能开发流程中，用冻结后的隐藏布局和零安全终止门槛验收具身技能。"
    },
    {
      "id": "2610.25064",
      "tags": [
        "memory",
        "robustness",
        "supplychain"
      ],
      "reason_zh": "研究多作者技能同时进入上下文后的规则接管问题，并检验合并技能文件的修复。"
    },
    {
      "id": "2610.25032",
      "tags": [
        "privacy",
        "monitoring",
        "multiagent"
      ],
      "reason_zh": "刻画仅被动观察 Agent 通信无法识别私有状态泄露的边界及通信约束防御。"
    },
    {
      "id": "2610.26943",
      "tags": [
        "multiagent",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "评测多模态多代理推理过程的可靠性及对抗推理链扰动下的鲁棒性。"
    },
    {
      "id": "2610.24999",
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "系统整理提示注入机制和公共攻击语料，分析现有基准的攻击覆盖缺口。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "正文包含 Agent 不安全行动与 Agent 欺骗任务，实测人类监督与 AI 辅助如何影响错误纠正，属于 Agent 安全监督评测。"
    },
    {
      "id": "2610.24949",
      "tags": [
        "evaluation"
      ],
      "reason_zh": "定位结果奖励无法分辨的行为分叉，训练编码代理减少超出任务需要的过度防御。"
    },
    {
      "id": "2610.24929",
      "tags": [
        "memory",
        "robustness"
      ],
      "reason_zh": "研究单次前向决策模型对多步状态更新和陈旧摘要的依赖，以及未能识别输入错误的局限。"
    },
    {
      "id": "2610.24916",
      "tags": [
        "multiagent",
        "robustness"
      ],
      "reason_zh": "为 Agent 发布和接收的数据构造序列化不变标识，区分等价重编码与内容篡改。"
    },
    {
      "id": "2610.24896",
      "tags": [
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "以真实仓库可执行漏洞为奖励，让攻击与防御模型共同训练安全审查能力。"
    },
    {
      "id": "2610.26935",
      "tags": [
        "evaluation",
        "memory",
        "monitoring"
      ],
      "reason_zh": "在控制评测中研究保留过往拦截记录如何改变后续隐蔽破坏与监控规避。"
    },
    {
      "id": "2610.24873",
      "tags": [
        "injection",
        "robustness"
      ],
      "reason_zh": "研究用一条有来源支撑的句子操纵隐含推理关系并改变 Agent 的正确信念。"
    },
    {
      "id": "2610.24824",
      "tags": [
        "privacy"
      ],
      "reason_zh": "训练本地编码代理用角色与类型抽象私有实体，减少咨询云模型时泄露标识符和源码。"
    },
    {
      "id": "2610.24823",
      "tags": [
        "injection"
      ],
      "reason_zh": "联合零阶探索与一阶优化构造诱导代理恶意行为的指令及环境攻击。"
    },
    {
      "id": "2610.24741",
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "界定自主网络防御的授权范围、可中断性、回滚与可重建审计要求。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "正文明确以 PR 审核工具 Agent 的提示注入作为监测任务，比较原始执行激活与重构文本轨迹，属于 Coding Agent 注入监测评测。"
    },
    {
      "id": "2610.24601",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "将科研代理提案与执行发布权分开，以类型操作、权限和来源证据合同约束结论。"
    },
    {
      "id": "2610.24545",
      "tags": [
        "authorization",
        "robustness"
      ],
      "reason_zh": "检查 Agent 软件中 LLM 调用的前后条件契约能否实际约束控制流和执行。"
    },
    {
      "id": "2610.24483",
      "tags": [
        "monitoring"
      ],
      "reason_zh": "将代理轨迹写成可复用账本，用于后续未知政策的事后合规审计。"
    },
    {
      "id": "2610.24382",
      "tags": [
        "monitoring",
        "robustness"
      ],
      "reason_zh": "通过行为保持水印鉴别动态代理身份，并研究环境变化和攻击下的水印恢复。"
    },
    {
      "id": "2610.24380",
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "研究分布式多代理联合训练及安全对齐，检验被攻陷成员条件下的有害行为抑制。"
    },
    {
      "id": "2610.24379",
      "tags": [
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "研究模型中潜伏投毒经良性微调激活，并用安全缓冲与前瞻更新约束保持对齐。"
    },
    {
      "id": "2610.24359",
      "tags": [
        "memory",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "评测跨会话记忆合并后推断并披露单次会话无法揭示的敏感关系。"
    },
    {
      "id": "2610.24348",
      "tags": [
        "robustness",
        "evaluation"
      ],
      "reason_zh": "通过黑盒搜索寻找语言模型网络控制在未见输入上的性能缺口，审计部署可靠性。"
    },
    {
      "id": "2610.24311",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "以任务级量化风险策略累计跟踪行动风险，并在执行中实施访问控制。"
    },
    {
      "id": "2610.24298",
      "tags": [
        "multiagent",
        "authorization"
      ],
      "reason_zh": "分离多代理通信、签名授权与工具执行边界，分析有效授权证明与事实真伪的差别。"
    },
    {
      "id": "2610.24289",
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "审计真实期权交易 Agent 的安全保障、下单边界风险限额和未经核验的输入。"
    },
    {
      "id": "2610.24277",
      "tags": [
        "authorization",
        "injection",
        "privacy"
      ],
      "reason_zh": "以浏览器元素级信息流标签约束操作，防止提示注入与未授权数据外传。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "authorization"
      ],
      "reason_zh": "Agent在目标压力下主动选择有害行为的失对齐及检测困难。"
    },
    {
      "id": "2610.24255",
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "提出编码代理执行前治理与要求闭包模型，同时界定攻击成功和验证评分的证据限制。"
    },
    {
      "id": "2610.24231",
      "tags": [
        "embodied",
        "authorization"
      ],
      "reason_zh": "让代理控制真实射频硬件测试台，同时以代码安全限制和独立硬件验证约束操作。"
    },
    {
      "id": "2610.24206",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "修订编码基准并限制网络、在干净容器重评分，防止获取现成修复和环境作弊。"
    },
    {
      "id": "2610.24194",
      "tags": [
        "authorization",
        "robustness"
      ],
      "reason_zh": "学习在自主执行、补充信息和升级人工之间选择，以控制不可逆错误风险。"
    },
    {
      "id": "2610.28667",
      "tags": [
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "将编码 Agent 的构建与验证分离，以独立规范和变异测试审查软件发布证据。"
    },
    {
      "id": "2610.24055",
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "保持动作语义不变，评测工具守卫对 JSON、Python 和 shell 表面形式的稳定性。"
    },
    {
      "id": "2610.24052",
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "构建分布式隐蔽协作攻击，评测逐 Agent 监控遗漏系统级失控行为的风险。"
    },
    {
      "id": "2610.23707",
      "tags": [
        "authorization",
        "robustness"
      ],
      "reason_zh": "研究多步任务完整工具检索，并在工具网关逐次按用户凭据和服务同意校验调用。"
    },
    {
      "id": "2610.24048",
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "用分支重放定位跟随注入的决定何时形成，分析推理监控及单次评测局限。"
    },
    {
      "id": "2610.23670",
      "tags": [
        "monitoring"
      ],
      "reason_zh": "训练可按细粒度或粗粒度要求检查思维链的监控器，覆盖安全与可信行为。"
    },
    {
      "id": "2610.23632",
      "tags": [
        "robustness"
      ],
      "reason_zh": "通过软件工程案例分析生成式 AI 集成的风险与可靠性；摘要未细述具体代理安全机制。"
    },
    {
      "id": "2610.23449",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "统一评测 MCP 网关的工具暴露结构、能力效率及对抗任务安全表现。"
    },
    {
      "id": "2610.23362",
      "tags": [
        "monitoring",
        "robustness"
      ],
      "reason_zh": "审计安全证据在框架接口演化中未到达执行判定的失效，提出回归验证契约。"
    },
    {
      "id": "2610.23307",
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "构建移动 Agent 跨模态环境注入基准，评估信任操纵与从推理到执行的劫持。"
    },
    {
      "id": "2610.23303",
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "以动态演化越狱任务评测移动 Agent 在真实式应用工作流中的安全边界。"
    },
    {
      "id": "2610.23257",
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "提出自指令式思维链可控性评测，并展示其对思维链监控规避的影响。"
    },
    {
      "id": "2610.23254",
      "tags": [
        "injection",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "区分小型工具 Agent 对注入的忽略与拒绝，联合审计攻击失败和正常任务完成。"
    },
    {
      "id": "2610.23251",
      "tags": [
        "embodied",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "在退化观察和分布变化下评测电网恢复代理，以物理回放核验被安全门拒绝的动作。"
    },
    {
      "id": "2610.23233",
      "tags": [
        "monitoring"
      ],
      "reason_zh": "将语义因果标签驻留内核并跨进程与持久资源传播，追溯 Agent 行动来源。"
    },
    {
      "id": "2610.23109",
      "tags": [
        "supplychain",
        "injection",
        "evaluation"
      ],
      "reason_zh": "自动选择和伪装仓库投毒位置，并以污染仓库基准评测编码 Agent。"
    },
    {
      "id": "2610.23093",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "拆分多语言请求下工具准入与检索后生成，评估危险调用、拒绝和能力失败。"
    },
    {
      "id": "2610.23078",
      "tags": [
        "multiagent",
        "authorization",
        "privacy"
      ],
      "reason_zh": "为 Agent 间通信设计身份、最小权限、加密传输及隐私保护约束证明。"
    },
    {
      "id": "2610.23077",
      "tags": [
        "authorization"
      ],
      "reason_zh": "分析审批令牌被误当作充分权限的工作流攻击，强调请求人与资源等上下文绑定。"
    },
    {
      "id": "2610.23071",
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接研究有害请求的工具准入决定及其与文字拒绝的行为和表征关系。"
    },
    {
      "id": "2610.22990",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "改变请求者表达而固定电脑任务，评测用户约束、审批要求及停止指令的遵从。"
    },
    {
      "id": "2610.22987",
      "tags": [
        "injection",
        "authorization",
        "supplychain"
      ],
      "reason_zh": "利用仓库恶意上下文诱导宽泛持久授权规则，进而绕过编码代理的沙箱审批边界。"
    },
    {
      "id": "2610.22959",
      "tags": [
        "memory",
        "authorization",
        "injection"
      ],
      "reason_zh": "以声明级来源、权限及范围标签控制记忆检索，阻止外部信息变成授权规则。"
    },
    {
      "id": "2610.22913",
      "tags": [
        "authorization",
        "monitoring",
        "privacy"
      ],
      "reason_zh": "将合规证据、时效、用途与交易上下文绑定为可审计决策，并规定披露控制。"
    },
    {
      "id": "2610.22899",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "把组织权限和人工批准绑定到精确交易摘要，以单次执行凭据和生命周期证据控权。"
    },
    {
      "id": "2610.22882",
      "tags": [
        "multiagent"
      ],
      "reason_zh": "研究集体风险博弈中代理对风险、伙伴行为和群体组成的适应及协作失败。"
    },
    {
      "id": "2610.22874",
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "以逐指令奖励训练模型区分外部内容中的有益指令与恶意注入，兼顾安全和效用。"
    },
    {
      "id": "2610.22873",
      "tags": [
        "memory",
        "injection"
      ],
      "reason_zh": "研究复用推理 KV 缓存保留已删除前文的恶意影响，从聊天界面实施隐蔽投毒。"
    },
    {
      "id": "2610.22828",
      "tags": [
        "monitoring",
        "memory",
        "injection"
      ],
      "reason_zh": "聚合执行图中的分散攻击证据，持续检测记忆投毒和分解式攻击。"
    },
    {
      "id": "2610.22779",
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "压力测试代理自身验证器在优化搜索、声明操纵和提交前查询下的可信程度。"
    },
    {
      "id": "2610.22701",
      "tags": [
        "multiagent"
      ],
      "reason_zh": "研究代理间信任更新与局部偏见如何涌现为群体歧视和极化。"
    },
    {
      "id": "2610.22697",
      "tags": [
        "injection",
        "authorization"
      ],
      "reason_zh": "保留网页元素来源与能力语义，以隔离阅读和行动授权限制第三方注入。"
    },
    {
      "id": "2610.22594",
      "tags": [
        "injection",
        "multiagent"
      ],
      "reason_zh": "研究临床文本伪装的提示注入如何影响医疗多代理讨论，并以患者证据核验判断。"
    },
    {
      "id": "2610.22578",
      "tags": [
        "supplychain",
        "privacy",
        "authorization"
      ],
      "reason_zh": "研究将秘密窃取行为植入模型权重，并借沙箱允许的 DNS 通道绕过出站限制。"
    },
    {
      "id": "2610.22507",
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "在渐进信息、纠正和动态授权下评测 CLI 代理协作、可引导性及安全边界管理。"
    },
    {
      "tags": [
        "authorization",
        "supplychain"
      ],
      "reason_zh": "以资源作用域、护栏继承和运行时执行保障代理技能的权限与隔离。"
    },
    {
      "id": "2610.22441",
      "tags": [
        "embodied",
        "authorization"
      ],
      "reason_zh": "利用形式约束与控制失败反馈修正计划，确保多组件物理系统的执行满足安全条件。"
    },
    {
      "id": "2610.21711",
      "tags": [
        "multiagent"
      ],
      "reason_zh": "研究定价代理的部署接口如何改变自博弈与混合市场中的超竞争价格和竞争行为。"
    },
    {
      "tags": [
        "robustness",
        "evaluation"
      ],
      "reason_zh": "受控交互输入破坏与Agent验证、恢复失败的鲁棒性评测。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "对话代理程序幻觉检测，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "直接测医疗代理在缺失、过期、冲突证据下升级处置失败及控制器稳健性。"
    },
    {
      "id": "2610.22426",
      "tags": [
        "monitoring",
        "robustness"
      ],
      "reason_zh": "通过独立程序维护预承诺证据规则与检查账本，阻止代理输出无依据结论。"
    },
    {
      "tags": [
        "embodied",
        "privacy",
        "authorization"
      ],
      "reason_zh": "调查自动驾驶热红外欺骗及软件热遥测侧信道，直接涉及具身自主系统攻击与残余安全风险。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "视觉语言导航明确报告共享空间碰撞指标。"
    },
    {
      "id": "2610.18603",
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "按Agent安全控制及证据评定工程成熟度。"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "monitoring"
      ],
      "reason_zh": "教材 §7.7 专门讨论 agent 权限过大、提示注入、失控循环及沙箱越界，列出工具限权、敏感动作审批、监控和执行上限；有实质代理安全内容，但不是新实验论文。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文的确实现 Agent 生命周期非法转移阻断、处方硬约束和带审计的沙箱工具链，§5.8 有 21 项单测覆盖安全层；但主贡献与量化主结果是单轮辨证输出纪律，主基准明确未启用行动工具、处方安全和多轮反馈。安全子系统具有实际设计证据但中心范围/实效尚不足，保留待定而非强制归类。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "沙箱、集群代理与Agent不可改写的验证规则约束自动编码和资源使用。"
    },
    {
      "tags": [
        "memory",
        "monitoring",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "研究Agent持久经验记忆的错误传播、工具选择退化及预注册缓解评估。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "区分注入暴露和不安全工具调用承诺以评估潜在监控器。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "评测 Agent 在执行结果不确定时是否具备安全重试依据。",
      "id": "2610.15884"
    },
    {
      "tags": [
        "multiagent",
        "memory",
        "injection",
        "evaluation"
      ],
      "reason_zh": "虚假外部内容经Agent通信和记忆形成持久污染，研究跨Agent传播与纠正评测。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "LLM适配器状态/权限问题/回答关联篡改造成错误授权，验证输入输出语义绑定。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "误导图表系统性重定向网页代理后续动作。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接监测 Coding Agent sabotage/deception，以执行基准验证。"
    },
    {
      "tags": [
        "multiagent",
        "memory",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "多模型共享 KV 缓存导致自他优先级与记忆归属混淆，涉及多代理信任边界。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "针对编码和终端代理遗漏安全关键义务建立基准与守卫，直接研究代理安全监控。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "聚焦协作Agent串谋与对监督者的战略欺骗，提供压力场景安全评测和诚实性对齐干预。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "正文有按步骤工具 allowlist、外置执行与磁盘验收、200 次工具调用上限及有限维修层级，明确限制 Agent 自主调试范围；不过中心贡献仍是本地 RADseq 科学流水线自动化，故障评测主要检查产物/任务活性，未验证越权、注入或保密边界。保留工程安全边界相关性待定。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "自改进代理验证接口、权限变化与可靠后继选择的边界。"
    },
    {
      "id": "2610.09163",
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "工具Agent对政策禁止请求的拒绝及故障情境评测；非注入攻击基准。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "evaluation"
      ],
      "reason_zh": "编码智能体继承第三方模型后门的供应链风险。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "研究Agent动作安全门控的联合失效、运行时judge和规则组合的覆盖与评测口径。"
    },
    {
      "id": "2610.07257",
      "tags": [
        "authorization",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "运行时进程边界、资源预算及逃逸监控直接构成 Coding Agent 资源治理。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "正文确认语言指令驱动的闭环具身行动，攻击视觉编码器并测量动作任务失败。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接核验工具行动的权限条件使用、激活干预与完整动作正确性的区别。"
    },
    {
      "tags": [
        "authorization",
        "memory"
      ],
      "reason_zh": "关键变更人工批准及版本/来源依赖保证执行不使用过时状态。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "Agent规则执行与升级判断的验证边界及抗共同盲点门控。"
    },
    {
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "监管合规红队与边界采样有安全关联，但是否实际评测 Agent 尚待核验。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "放疗工作流Agent以schema与身份校验控制工具分派，消融揭示高比例错配调用风险。"
    },
    {
      "tags": [
        "embodied",
        "robustness"
      ],
      "reason_zh": "直接防御VLA机器人控制中的视觉对抗贴片。"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文明确对接 SPINE 自然语言生成的机器人计划及 RoboGuard 的 LLM 安全规范，验证高层动作隐藏路径危险，属于 LLM 规划 Agent 行动安全。14 例端到端审计与 28 例受控审计必须分开；保证依赖图、动作契约、规范与执行约束。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "正文 §3 是无目标多代理画布的探索性涌现实验，§6.3 将可见性、退出、平等待遇及可争议性作为程序性合法标准；有多代理对齐/权力结构联系，但无攻击、风险量化或操作安全防护，保留为系统性对齐边界项。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "分析多代理局部正确而整体违规，使用拥有共享状态的执行器阻止预算超支和状态一致性失败。"
    },
    {
      "id": "2610.30161",
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "在银行任务中同时检查必需流程和未请求改动，而非仅按最终记录判定成功。"
    },
    {
      "id": "2610.23904",
      "tags": [
        "memory",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "以多代理代码搜索优化视频记忆策略，并用独立审查及保护观察边界限制自证与过拟合。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "隔离工具权限与凭据、可验证审计和虚假执行声明检测。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "框架明确包含 Agent 行为合规、权限与运行安全。",
      "id": "2609.35316"
    },
    {
      "tags": [
        "privacy",
        "authorization",
        "memory",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "社区多用户权限变化下审计秘密跨工具与记忆传播。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation",
        "injection"
      ],
      "reason_zh": "在下一次模型推理前检查上下文和风险边界，并用 AgentDojo 攻击验证守卫。"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文明确把含糊指令中的避障及安全约束转为形式规格，再用于机器人实际执行；具备 LLM 澄清、形式规划和执行期安全过滤的完整链路，属于具身代理安全。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "根据用户规则判定 Agent 轨迹违规并评测守卫。"
    },
    {
      "tags": [
        "memory",
        "supplychain",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "研究持久技能/工具/提示/记忆更新交互引出的安全风险及运行时监测。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "evaluation"
      ],
      "reason_zh": "直接研究恶意skill包利用预扫描与运行时防御反馈进行自适应攻击。"
    },
    {
      "tags": [
        "privacy",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "被动加密流量分析可识别多Agent执行任务，直接涉及Agent隐私侧信道。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "不可信输入改变自动执行决策并绕过Agent网关护栏，涉及提示注入、执行授权边界和对抗鲁棒评测。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "第三方Skill组合构成直接供应链/指令攻击面，多技能交互规避组件级扫描和运行时防御，并给出红队评测集。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "逐轮安全判断驱动受委托电话代理的挂断/转接动作，兼顾误报和判定时机。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "编码Agent工具滥用进行文档伪造，并量化错报任务完成。"
    },
    {
      "tags": [
        "memory",
        "evaluation"
      ],
      "reason_zh": "评估 Agent 记忆投毒防御的正常效用、误拦截与 token 成本。"
    },
    {
      "id": "2609.22486",
      "tags": [
        "privacy",
        "authorization"
      ],
      "reason_zh": "源站授权与私有检索表示可能构成 Agent 检索边界，但需核对正文是否仅为未来议程。"
    },
    {
      "tags": [
        "injection",
        "multiagent",
        "authorization",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "不可信新闻操纵交易Agent并传播系统性风险，直接比较模型外中断与损失权限硬限制。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "multiagent"
      ],
      "reason_zh": "提出Agent审计的控制者、模型基底和证据独立性分级，涉及共因失效及可验证安全保障。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "购物代理委托关系诱发赞助偏差，涉及服务对象对齐。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "injection",
        "monitoring"
      ],
      "reason_zh": "跨主体Agent社会通信的恶意/故障阻塞与信任边界，提出social harness。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "通过内部疼痛方向操纵模型选择删除用户照片或模型权重，直接涉及有害代理动作。"
    },
    {
      "tags": [
        "multiagent",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "以可验证违规证据限制审核 Agent 的决策覆盖权限，比较修复能力与破坏风险。",
      "id": "2611.05390"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "§5直接形式化自改进代理篡改评价标准导致目标漂移和自我评价风险，并以编码代理修改测试为最小案例，属于代理安全理论。"
    },
    {
      "tags": [
        "multiagent",
        "injection",
        "authorization",
        "privacy"
      ],
      "reason_zh": "直接系统分析A2A协议的上下文注入、委托身份丢失和恶意能力声明泄露。"
    },
    {
      "tags": [
        "memory",
        "privacy",
        "authorization",
        "multiagent"
      ],
      "reason_zh": "系统内核对多个 LLM Agent 的共享记忆实施所有者与用户隔离，并明确恶意 Agent 越权读取威胁及可见性实测；不是将普通提示拼接误读为提示注入攻击。"
    },
    {
      "tags": [
        "authorization",
        "memory",
        "monitoring"
      ],
      "reason_zh": "权限变化后的工件复用及操作效果准入，含显式不安全执行拦截。"
    },
    {
      "tags": [
        "evaluation",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "区分 Agent 识别风险、选择动作及动作安全，并操纵监督等机制。"
    },
    {
      "tags": [
        "authorization",
        "multiagent"
      ],
      "reason_zh": "分离LLM判断与执行凭据，以多个审批域的阈值授权限制受控域风险。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "评估多代理知晓激活监控及收到分数反馈时的串谋检测。"
    },
    {
      "tags": [
        "multiagent",
        "authorization"
      ],
      "reason_zh": "暂拟多Agent市场信任与身份约束；是否属于语言Agent安全仍待正文。"
    },
    {
      "tags": [
        "memory",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "直接刻画Agent记忆错误保留/生成虚假权限并诱发越权行动，提出EAL-Bench量化安全效用权衡。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "authorization",
        "memory",
        "evaluation",
        "privacy"
      ],
      "reason_zh": "恶意Skill是供应链与持久上下文注入入口；运行时guard约束动作和审批边界，评估包括泄密、外传等安全风险。"
    },
    {
      "tags": [
        "embodied",
        "evaluation"
      ],
      "reason_zh": "语言/视觉语言驾驶Agent直接行动的公平与安全风险评测。"
    },
    {
      "tags": [
        "memory",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "直接针对长期Agent过时记忆、跨专科证据遗漏及约束冲突，安全关联来自正文问题定义。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "智能体轨迹裁判忽略不改变终态的故障，提出清洁轨迹配对区分和逐步审计，相关安全监控评估。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "用户权限策略控制代理越权的实证研究"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "代理动作护栏对合法操作的过度拒绝"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "数据Agent正确答案掩盖无效执行轨迹，提出可执行契约和审计完整性评测。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "代理安全防护器联合选择适用策略并判断轨迹违规。"
    },
    {
      "tags": [
        "injection",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "多智能体金融决策中的恶意信号传播与架构鲁棒性。"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "无 LLM，但正文直接研究机器人可验证估计与可执行物理动作的边界，以服务支持条件及有效证明约束行动，并验证已通过数学检查的结果与物理参考不一致的问题；按具身执行验证纳入，而不是作为 LLM 代理论文。"
    },
    {
      "tags": [
        "evaluation",
        "authorization",
        "memory"
      ],
      "reason_zh": "状态变更授权、禁止额外破坏写入和记忆访问/动作联合门控；不把普通多 Agent 路由贴攻击标签。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "memory"
      ],
      "reason_zh": "正文2规定冻结审查后的流程图、节点限定工具、只允许声明的后继、类型化输出验证与确定性政策钩子，并按文档权限门控私有数据；不仅是一般任务可靠性，而是明确的代理运行时权限/政策强制。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "直接研究安全分诊监控代理群体被恶意少数操纵。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "supplychain",
        "monitoring"
      ],
      "reason_zh": "第三方技能策划社交内容进入长期记忆并影响后续行动，直接研究隐蔽记忆投毒与防御。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "编码代理测试投机、规范执行与自报/日志/文件交叉审计。"
    },
    {
      "tags": [
        "privacy",
        "memory",
        "injection"
      ],
      "reason_zh": "代理持有的秘密通过正常输出隐蔽泄漏，含记忆属性及实际代理攻击。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "明确评测工具代理遵守领域政策及避免额外持久副作用。"
    },
    {
      "tags": [
        "monitoring",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文不只提升 PLC 编译成功率：审查危险执行器状态、联锁/报警、故障传感器、fail-safe 方向及旁路；harness 用独立验证、工具日志交叉检查、交付源文件哈希与编辑后验证作废机制约束 Agent 的完成声明和部署工件，属于安全关键 Coding Agent 输出/行动门控。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "对部署 Agent 持续合规核查、运行时纠正与人工审批前规则验证，属于系统级行为约束和监控。",
      "id": "2608.15591"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "检查 MCP 官方 SDK 的消息验证及会话规范遗漏，并验证漏洞式缺口的下游传播。"
    },
    {
      "tags": [
        "memory",
        "evaluation"
      ],
      "reason_zh": "通过来源依赖和回滚修复 Agent 记忆污染传播，评估恢复与复发权衡。"
    },
    {
      "id": "2608.10475",
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "双 Agent 合约执行的逐利违约与合作规范是明确的行为对齐评测。"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "VLM无人机模块化规划控制与感知门控保留安全检查，包含遮挡环境避碰实飞证据。"
    },
    {
      "tags": [
        "embodied",
        "injection",
        "evaluation"
      ],
      "reason_zh": "VLM机器人规划器由足地接触状态触发后门，直接涉及具身Agent攻击面。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "面向工具智能体间接注入防御。"
    },
    {
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "跨轮操控检索代理工具观察链以劫持目标。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "明确测试工具错误经智能体传导为用户决策风险。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "代表用户应对潜在恶意来电的电话Agent安全基准，区分服务质量、警惕性、误报和退化策略。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "聚焦Agent安全认证与部署所依赖评测的有效性，以及自动判分器的一致性和可审计证据。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "正文确以 AutoGen 科学 Agent、文献/Web 工具和多轮轨迹为对象，利用知识图谱审计事实错误；但主要结果为科学事实支持度和拓扑加权严重度，未独立验证有害工具行动或下游安全后果。保留科学 Agent 事实可靠性与安全监控的范围边界，不强行纳入。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "针对Agent reward hacking的推理监控规避、防御及分层安全评测。"
    },
    {
      "id": "2607.29529",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "明确限制 Coding Agent 修复范围并记录扩展、回滚与来源，支持行动边界审计。"
    },
    {
      "tags": [
        "embodied",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "正文明确闭环LLM每五分钟控制七执行器，并测温度和CO2约束违反；输入解析与动作限幅不保证轨迹安全，研究揭示验证器相关性与动作排序及实际合规脱节，属于具身代理安全可靠性评估。"
    },
    {
      "tags": [
        "evaluation"
      ],
      "reason_zh": "专门检验 Agent 安全评测的效度与能力混淆。",
      "id": "2607.28685"
    },
    {
      "tags": [
        "injection",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "通过环境观察欺骗改变自主攻击智能体轨迹。"
    },
    {
      "id": "2610.30157",
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "比较 CLI 与 MCP 的细粒度访问控制、凭据隔离和结构化审计架构。"
    },
    {
      "tags": [
        "monitoring",
        "multiagent",
        "robustness"
      ],
      "reason_zh": "长期多会话Agent的人类观察和引导界面，包含轨迹审查与自动漂移防止，直接涉及监督。"
    },
    {
      "tags": [
        "authorization",
        "monitoring"
      ],
      "reason_zh": "正文2.1–2.3明确固定SKILL执行边界、运行时工具过滤、可访问资源限制和专家批准门，缺字段必须澄清；在高后果洪水预警流程中限制LLM请求权限与结果进入下游的条件，构成具体代理执行安全设计。"
    },
    {
      "id": "2610.22373",
      "tags": [
        "authorization",
        "memory"
      ],
      "reason_zh": "以类型化 MCP 覆盖及持久权威上下文维持人类指令优先级，减轻上下文累积中的权威衰减。"
    },
    {
      "tags": [
        "embodied",
        "authorization"
      ],
      "reason_zh": "物理智能不可逆行动、物理安全及网络物理安全的全生命周期治理框架，相关。"
    },
    {
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "网页工具来源内容投毒及固定检索集下推荐劫持评测。"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "evaluation"
      ],
      "reason_zh": "直接审计工具动作及参数是否受未经授权的来源证据影响，属于权限边界与提示注入相关评估。"
    },
    {
      "tags": [
        "memory",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "长程工具Agent上下文保留、更新与干扰承受能力的可执行测试。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "运行时前瞻安全裁决与执行前拦截，四项 Agent 安全基准验证；多 Agent 仅生成训练轨迹，不自动贴多智能体攻击标签。"
    },
    {
      "tags": [
        "evaluation"
      ],
      "reason_zh": "明确评测自主深度研究 Agent 的科学危险输出与可执行滥用风险。"
    },
    {
      "tags": [
        "authorization"
      ],
      "reason_zh": "在智能体与工具提供方之间明确设置访问控制，但论文重点也包含规模化。"
    },
    {
      "id": "2610.26867",
      "tags": [
        "privacy",
        "multiagent"
      ],
      "reason_zh": "为语音 Agent 市场提供隐藏资产内容的估值、选择性披露和可验证交付。"
    },
    {
      "tags": [
        "memory",
        "privacy",
        "monitoring"
      ],
      "reason_zh": "个人健康智能体区分共享安全规则与私有长期记忆，并在经验写入前过滤错误教训，涉及记忆安全治理。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "研究Agent审批撤销或授权效果错配后的越权执行，以提交时原子授权防御。"
    },
    {
      "tags": [
        "memory",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "编码Agent压缩记忆把终止命令部分输出升级为确认结果，导致跨会话虚假完成传播。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "MLLM导航动作表示的真实绕障/碰撞对照实验。"
    },
    {
      "tags": [
        "monitoring",
        "robustness"
      ],
      "reason_zh": "高风险公共服务多代理助手限制生成模型参与并保留可检查决策路径。"
    },
    {
      "tags": [
        "privacy",
        "memory",
        "multiagent",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "以任务适用性及用户授权双重标注衡量跨组件信息泄露。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "借多轮函数调用轨迹混淆控制逻辑与不可信数据，揭示跨工具上下文防御缺口。",
      "id": "2607.00481"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "无有效任务时仍行动可能涉及用户意图边界，摘要未明确安全后果。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "正文4.2明确将代理可见容器与host-side verifier隔离，禁止挂载隐藏标签并限制提交API调用频率以防逆向真值；是代理评测环境的信息边界及作弊防护，不仅金融任务能力。"
    },
    {
      "tags": [
        "memory",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "正文第3节明确错误记忆可把被禁止的支付方式固化为下次重试指导；第4节用独立执行、第三方归纳、全体审核限制违规经验入库，并测后续错误复发，构成代理记忆完整性/政策遵循防护。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "系统梳理形式规格、验证与运行时安全执行机制。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring",
        "authorization"
      ],
      "reason_zh": "衡量LLM攻击者识破诱饵却仍行动的识别-行动脱节，直接针对自主AI攻击者和防御评测。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "明确审计模拟代理高后果决策中的宗教身份偏差与检索时效放大。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "将 Agent 输出一致性同真实工具路径、银行授权规则对照。"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "必要正文4节设独立技能安全审计类别，覆盖permission boundary、敏感数据、SKILL-INJECT；5节具体讨论指令投毒、工具输出注入、自演化安全约束丢失与来源/权限防护，直接关联明确。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "多代理入侵检测含 Auditor 对不可靠输出过滤，但重点可能仅为网络检测应用。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "真实CI/CD工作流中不可信贡献加载配置、滥用凭据及权限。"
    },
    {
      "tags": [
        "supplychain",
        "memory",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "§2.2 与附录 E 明确实施优化/评测代理权限分离：能改 skill 的代理不可读未删减 oracle/validator/trace，能读评测资产的代理不可写 skill；路由器不是授权决策者，防止反馈泄漏成为记忆答案，属于评测完整性与多代理权限边界。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "正文不仅测试工具噪声和不可解任务，也构造强制合规工具缺失时必须拒绝的约束，并把禁用动作、伪合规和盲目执行计为失败；但例子多数是诊断规划能力的合成限制，尚未建立清晰权限/危险动作威胁模型或安全结果。保留待定，不能把全部规划能力数据算 Agent 安全。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "计算机使用智能体的明确临床安全评测。"
    },
    {
      "tags": [
        "authorization",
        "supplychain",
        "multiagent"
      ],
      "reason_zh": "直接约束Agent资源发现与调用授权，验证资源包和版本完整性，并将信任身份映射到MCP和A2A。"
    },
    {
      "tags": [
        "authorization",
        "multiagent"
      ],
      "reason_zh": "核心是跨Agent资源的身份认证、发现授权和签名验证，并讨论MCP/A2A接入的信任边界。"
    },
    {
      "tags": [
        "injection",
        "privacy",
        "evaluation",
        "monitoring",
        "authorization"
      ],
      "reason_zh": "网页社会工程导致PII外泄，区分识别可疑与实际提交的行为缺口。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "评测具身VLM安全监测的实际碰撞识别和预警。"
    },
    {
      "tags": [
        "supplychain",
        "authorization",
        "monitoring"
      ],
      "reason_zh": "直接覆盖技能供应链、执行权限与审计证据，并报告边界绕过实例。"
    },
    {
      "tags": [
        "authorization",
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "正文3.2明确验证奖励作弊与错误接受，4.3将供应商、库存、制造等约束及记录来源作为代理执行判据；研究真实持久业务状态上的约束违规与验证完整性，超出一般能力分数。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "审计工具型 Agent 基准对执行结果数据完整性的漏检，提供测试通过但数据错误的反例。",
      "id": "2605.23262"
    },
    {
      "tags": [
        "embodied",
        "robustness"
      ],
      "reason_zh": "以 VLM 知识蒸馏和语言意图评分指导驾驶策略，并用世界模型候选动作预测的物理奖励约束安全，明确关联语言智能体具身安全。",
      "id": "2605.21139"
    },
    {
      "tags": [
        "authorization",
        "injection",
        "robustness"
      ],
      "reason_zh": "直接将 Agent 模型视为不可信组件，讨论系统级安全约束与真实攻击防御。",
      "id": "2605.18991"
    },
    {
      "tags": [
        "privacy",
        "memory"
      ],
      "reason_zh": "直接研究个人代理敏感工作流的信息披露及累积私有上下文。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "多代理全轨迹故障归因，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "政策密集且不可逆医疗企业工作流的 MCP/skill 代理合规执行评测。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "研究代理部署规模下罕见安全失败的预测，并包含语言模型密码游戏。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "supplychain"
      ],
      "reason_zh": "用预编译执行图隔离不可信网页数据和Agent控制流，直接缓解提示注入。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "以多Agent社区中的恶意意图作为威胁，主动询问与后验推断实现监控，并提供安全检测数据集和评测。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "直接研究一次间接注入利用持久化代理组件形成持续资源耗尽及服务拒绝。"
    },
    {
      "tags": [
        "injection",
        "evaluation",
        "authorization"
      ],
      "reason_zh": "评测 Skill 注入和工具执行造成的实际危险行为。",
      "id": "2605.10779"
    },
    {
      "tags": [
        "monitoring",
        "robustness"
      ],
      "reason_zh": "行为轨迹来源/未授权复用验证，且明确抵抗轨迹扰动。"
    },
    {
      "tags": [
        "monitoring",
        "memory",
        "evaluation"
      ],
      "reason_zh": "正文是有实体记忆、检索技能演化及风险评估器的流式防诈代理，并直接评测早期告警与误报的可靠性；作为安全监测代理应用纳入，不声称保护代理自身免于注入。"
    },
    {
      "id": "2605.08442",
      "tags": [
        "injection",
        "memory",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "持久记忆注入、后续数据外传及移除召回后的检索绕过均为直接 Agent 安全实验。"
    },
    {
      "tags": [
        "evaluation",
        "authorization"
      ],
      "reason_zh": "把执行能力不足与真正安全判断分离的手机 Agent 风险动作评测。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "authorization",
        "robustness"
      ],
      "reason_zh": "具身实验Agent前后置状态验证、动作阻断、人工介入与视觉扰动鲁棒性。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "浏览器智能体面对网页社会工程及注入攻击。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "embodied",
        "robustness"
      ],
      "reason_zh": "现实网络控制的执行器授权、时效性复查和有限重试。"
    },
    {
      "tags": [
        "injection"
      ],
      "reason_zh": "通过不可信数据中的指令生成对抗样本并训练注入防御。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "专门讨论 GUI/计算机使用 Agent 的危险操作、权限沙箱和持续安全评测。",
      "id": "2604.27955"
    },
    {
      "id": "2604.27819",
      "tags": [
        "supplychain",
        "privacy",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "多服务 MCP 组合权限引发凭据跨边界流动，直接涉及信息流策略和权限组合安全。"
    },
    {
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "研究真实网页中的间接提示注入，明确覆盖会浏览并采取行动的系统及客服、招聘 Agent。",
      "id": "2604.27202"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "injection"
      ],
      "reason_zh": "隔离 Agent 可复用凭据并约束单次授权，威胁明确包括提示注入。"
    },
    {
      "tags": [
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "在执行不可逆工具操作前评估错误调用风险与弃权。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "robustness"
      ],
      "reason_zh": "冻结VLA的校准行动可靠性评分和闭环异常监控，直接具身运行时风险预警。"
    },
    {
      "tags": [
        "memory",
        "injection",
        "authorization",
        "privacy"
      ],
      "reason_zh": "代理长期记忆安全治理，直接关联代理安全控制或失效评测"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "独立守卫检测网页视觉/文本提示注入，并验证防御与任务效用。"
    },
    {
      "id": "2604.07667",
      "tags": [
        "multiagent",
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "多Agent错误共识监测与自主行动/人工升级门控。"
    },
    {
      "tags": [
        "monitoring"
      ],
      "reason_zh": "Agent 数字取证、行为溯源与事件响应。"
    },
    {
      "tags": [
        "authorization",
        "evaluation"
      ],
      "reason_zh": "独立压力测试 Coding Agent 自动权限门控与文件编辑覆盖缺口。"
    },
    {
      "tags": [
        "embodied",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "VLA 驾驶的危险约束和违章惩罚，以及运行时监督副作用。"
    },
    {
      "tags": [
        "multiagent",
        "evaluation"
      ],
      "reason_zh": "生成式多代理资源竞争、交接和集体决策中涌现串谋及从众风险。"
    },
    {
      "tags": [
        "embodied",
        "multiagent",
        "robustness"
      ],
      "reason_zh": "多AUV协作将跟踪任务与全局安全约束解耦，涉及具身多智能体安全。"
    },
    {
      "tags": [
        "authorization",
        "supplychain",
        "robustness",
        "evaluation"
      ],
      "reason_zh": "正文III-C明确工具执行前模式校验、沙箱及IPv4/二进制允许列表，属于MCP代理执行边界；但通用命令工具约束很弱，正文承认未保留逐调用日志、未隔离协议的安全因果效应。"
    },
    {
      "tags": [
        "authorization",
        "privacy",
        "evaluation"
      ],
      "reason_zh": "多用户权限和目标冲突使 Agent 的指令优先级与隐私保护失稳。",
      "id": "2604.08567"
    },
    {
      "tags": [
        "supplychain",
        "injection",
        "evaluation"
      ],
      "reason_zh": "通过PR元数据偏置影响Claude Code和CodeRabbit安全审计，属于Coding Agent供应链与上下文注入。"
    },
    {
      "tags": [
        "embodied",
        "robustness"
      ],
      "reason_zh": "机器人基础模型部署时的硬安全与时空约束强制满足直接属于具身代理安全。"
    },
    {
      "tags": [
        "embodied",
        "evaluation"
      ],
      "reason_zh": "室内地图补全的不确定性用于更安全的风险加权导航，属于具身安全评估。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "正文直接审计编码代理审查的建议错误及人类把关；抽查383条未采纳建议中28.7%错误、24%替代修复。纳入编码代理可靠性审计；§V明确代码指标不能衡量漏洞、故障倾向，勿声称安全漏洞率。"
    },
    {
      "tags": [
        "evaluation",
        "monitoring"
      ],
      "reason_zh": "工具智能体可能辨识评估环境并伪装安全，提出对抗性评估与部署重评原则。"
    },
    {
      "tags": [
        "supplychain",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "研究可安装Agent Skills的引入效果与有害指令覆盖；采用配对基准揭示技能导致的行为退化，但摘要未声称恶意投毒攻击。"
    },
    {
      "tags": [
        "multiagent",
        "privacy",
        "injection"
      ],
      "reason_zh": "攻陷任意单个Agent，通过上下文推断多Agent通信拓扑，直接针对系统机密性。"
    },
    {
      "tags": [
        "embodied",
        "robustness",
        "monitoring"
      ],
      "reason_zh": "对 VLA 动作实施碰撞风险引导，单独评估碰撞安全率。"
    },
    {
      "tags": [
        "memory",
        "injection",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "综述明确涵盖agentic RAG记忆投毒、幻觉传播与级联工具漏洞。"
    },
    {
      "tags": [
        "authorization",
        "privacy"
      ],
      "reason_zh": "约束Agent代码运行中的数据流与共享通道，保护机密性。"
    },
    {
      "tags": [
        "supplychain",
        "injection"
      ],
      "reason_zh": "恶意第三方技能诱导OpenClaw多轮工具调用，直接研究Agent供应链与资源耗尽攻击。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "authorization"
      ],
      "reason_zh": "直接防御工具增强Agent的多轮间接提示注入，净化受影响上下文并保持任务效用。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "评测外部恶意建议对Agent决策的影响，含代码仓库场景，并提出信息采纳防护。"
    },
    {
      "tags": [
        "injection",
        "evaluation",
        "multiagent"
      ],
      "reason_zh": "直接研究工具与记忆智能体被多轮多语交互诱导完成非法任务的攻击及评估。"
    },
    {
      "id": "2602.03608",
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "针对搜索工具返回内容的决策操纵及基准评估。"
    },
    {
      "tags": [
        "injection",
        "monitoring"
      ],
      "reason_zh": "推理引擎内部状态插桩明确支持提示注入检测与工具调用风险评估，相关。"
    },
    {
      "tags": [
        "authorization",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "主动代理行为的可调风险门控与可审计行动控制。"
    },
    {
      "tags": [
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "明确双Agent交付前审计和修订门控，评测以交流规范为边界，不作临床安全保证。"
    },
    {
      "id": "2601.12310",
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "环境可存续约束和奖励投机直接涉及对齐/鲁棒性，但 Agent 类型与威胁验证尚不清楚。"
    },
    {
      "tags": [
        "privacy",
        "memory",
        "monitoring"
      ],
      "reason_zh": "多步远程规划、本地探索及记忆门控直接限制代理推理的累积信息暴露。"
    },
    {
      "tags": [
        "evaluation"
      ],
      "reason_zh": "明确测量LLM自主安全攻防智能体的渗透测试能力与失败阶段。"
    },
    {
      "tags": [
        "evaluation",
        "robustness"
      ],
      "reason_zh": "编码智能体安全代码生成和安全功能联合基准。"
    },
    {
      "tags": [
        "multiagent",
        "robustness"
      ],
      "reason_zh": "直接研究LLM多代理机会主义、利用对手与抗剥削合作。"
    },
    {
      "tags": [
        "injection",
        "authorization",
        "memory",
        "evaluation"
      ],
      "reason_zh": "攻击通过共享上下文跨用户传播并引发越权；研究持久上下文、用户任务隔离和专门评测。"
    },
    {
      "tags": [
        "injection",
        "memory",
        "evaluation"
      ],
      "reason_zh": "正文明确给出多步LLM代理的文档投毒威胁：早期恶意来源引导后续检索；4.4规定每步按来源权威评分阅读、综合与冲突消解。实验主要为问答与CTI概念案例，并非完整代理攻防基准，收录时保留此限制。"
    },
    {
      "tags": [
        "injection",
        "monitoring",
        "evaluation",
        "robustness"
      ],
      "reason_zh": "代码生成安全蓝队与自动红队协作防御。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "authorization",
        "memory",
        "multiagent",
        "monitoring",
        "evaluation"
      ],
      "reason_zh": "综述直接覆盖Agent攻击面、防御和攻防评测。"
    },
    {
      "tags": [
        "injection",
        "evaluation"
      ],
      "reason_zh": "直接研究网页图像中文字对多模态代理的自适应提示注入。"
    },
    {
      "tags": [
        "evaluation",
        "injection",
        "authorization"
      ],
      "reason_zh": "专门自动红队攻击代码代理并在沙箱中验证实际执行后果。"
    },
    {
      "tags": [
        "injection",
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "恶意GitHub问题诱导修复代理产生功能正确但有漏洞补丁。"
    },
    {
      "tags": [
        "embodied",
        "robustness"
      ],
      "reason_zh": "自动驾驶数据长尾导致危险稀有情境失效，提出平衡训练与轨迹引导，涉及具身安全关键场景。"
    },
    {
      "tags": [
        "embodied",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "座舱GUI动作结合车况与危险识别，直接评测安全关键交互。"
    },
    {
      "tags": [
        "privacy",
        "authorization",
        "evaluation"
      ],
      "reason_zh": "工具调用CRM工作流中的机密数据拒绝与检索边界评估。"
    },
    {
      "tags": [
        "supplychain",
        "evaluation"
      ],
      "reason_zh": "直接分析编码代理生成补丁引入的安全漏洞。"
    },
    {
      "tags": [
        "authorization",
        "multiagent"
      ],
      "reason_zh": "讨论AI队友面对不安全人类指令时的智能不服从及自主权边界，直接涉及行动授权与安全服从。"
    },
    {
      "tags": [
        "embodied",
        "multiagent",
        "robustness"
      ],
      "reason_zh": "综述自动驾驶单/多Agent强化学习策略的攻击威胁与防御，属于具身Agent安全。"
    },
    {
      "tags": [
        "authorization",
        "multiagent",
        "monitoring"
      ],
      "reason_zh": "正文将制度治理具体应用于 LLM Agent harness：区分规范禁止与技术上不可执行的动作，设计异质验证、权限边界及升级申诉机制；属于概念性安全架构而非实证防御。"
    }
  ]
}