{ "count": 50, "items": [ { "id": 19471, "url": "https://arxiv.org/abs/2608.12984v1", "title": "Reconcile Once, Write Anytime: A Trust-Tiered Librarian and a Multi-Agent Writer for Drift-Free, Point-in-Time Research", "summary": "Long-form research reports generated by large language models drift, contradict themselves, and lose provenance: the same metric appears with different values, and rumor is quoted as confidently as an audited filing. We present a two-tier agentic system that separates a maintained, point-in-time knowledge library from report writing. A deterministic \"librarian\" ingests timestamped sources into a trust-tiered ontology, layering evidence cards, an authoritative metric ledger, and a claim graph int", "authors": "Xing Zhang, Yanwei Cui, Guanghui Wang, Peiyang He", "category": "research", "topics": "agents-autonomy,transparency", "published_at": "2026-08-13T09:09:28.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/19471" }, { "id": 19472, "url": "https://arxiv.org/abs/2608.12821v1", "title": "HiRoute: Hierarchical Routed Prompt Tuning for Safety Alignment of Large Language Models", "summary": "Large language models (LLMs) remain vulnerable to harmful requests and jailbreak attacks. Parameter-efficient safety alignment methods based on prompt tuning typically rely on a single global prompt or externally selected prompt modules. Such static designs struggle to maintain a cross-category safety boundary while generating constructive responses tailored to specific risks and avoiding over-refusal of benign inputs. To address these limitations, we propose HiRoute, an input-adaptive hierarchi", "authors": "Fangzhou Chen, Shiji Zhao, Mengyang Wang, Qihui Zhu, Ranjie Duan, Maoxun Yuan, Xingxing Wei", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-13T04:49:51.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/19472" }, { "id": 18685, "url": "https://arxiv.org/abs/2608.11025v1", "title": "Data Attribution of Emergent Misalignment with Persona Features", "summary": "Emergent misalignment (EM) is the phenomenon where fine-tuning a language model on a narrow task leads to harmful behavior in unrelated domains. A leading mechanistic account attributes EM to persona features: latent directions acquired during pre-training that misaligned fine-tuning amplifies. We ask where these features come from: which pre-training documents activate them, and whether naturally occurring human-written text suffices to induce EM. Using Sparse Autoencoder (SAE) based model diff", "authors": "Clemens Vetter, David Kaczér, Lucie Flek, Florian Mai", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-11T15:05:24.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18685" }, { "id": 18686, "url": "https://arxiv.org/abs/2608.10933v1", "title": "SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense", "summary": "Text-to-Video (T2V) generative models are vulnerable to jailbreak attacks in real-world deployment, leading them to produce harmful or inappropriate content. Existing defense approaches mainly rely on input filtering or reconstruction, which not only incur high computational latency but also tend to distort semantics. To address these issues, we experimentally and systematically analyze the differences between clean and jailbreak samples in the cross-attention feature space, revealing for the fi", "authors": "Siyuan Liang, Yupeng Qiu, Junfeng Fang, Rong-Cheng Tu, Jiaxing Huang, Dacheng Tao", "category": "research", "topics": "regulation,safety-alignment,military-security", "published_at": "2026-08-11T14:01:24.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18686" }, { "id": 18687, "url": "https://arxiv.org/abs/2608.10669v1", "title": "REDAgentBench: Executable Red Teaming and Faithful Measurement of LLM Agent Systems", "summary": "Large language model (LLM) agents combine language-based reasoning with external tools to perform complex tasks. Adversarial inputs can exploit interactions between the agent and its environment, causing the agent to violate safety policies during execution. Yet existing evaluations often reduce agent safety to a single attack success rate (ASR), collapsing exposure, execution, observation, and adjudication and potentially conflating actual violations with evidence visibility. We introduce REDAg", "authors": "Zixing Chen, Xingyuan Liu, Jie Zhu, Huaixia Dou, Shuo Jiang, Junhui Li, Lifan Guo, Feng Chen, Chi Zhang", "category": "research", "topics": "safety-alignment,agents-autonomy,environment", "published_at": "2026-08-11T08:48:54.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18687" }, { "id": 18688, "url": "https://arxiv.org/abs/2608.10537v1", "title": "Measuring Semantic Abstractness of SAE Features via Nonlocality", "summary": "Sparse autoencoders (SAEs) have helped uncover mechanistic explanations for LLM behaviours such as reasoning, jailbreaking etc., via understanding the corresponding task-relevant and causally effective features. To evaluate such mechanistic explanations, downstream studies must distinguish surface lexical features from genuinely high-level ones. However, neither an autointerp-based semantic description nor causal steering utility fully resolves the abstraction level of a feature. To this end, we", "authors": "Chuqiao Lin, Shivaji Sondhi, Xiao-Liang Qi", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-11T06:19:48.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18688" }, { "id": 18689, "url": "https://arxiv.org/abs/2608.10530v1", "title": "On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models", "summary": "Large Language Models (LLMs) have undergone a shift from stateless conversational interfaces to autonomous agents capable of multi-step planning, tool invocation, code execution, and maintaining persistent memory. When these agents operate with real-world privileges---calling APIs, modifying files, and querying databases---a compromised reasoning step can trigger unauthorized data access, irreversible state changes, or cascading failures, yet the security research community has not kept pace. To", "authors": "Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari", "category": "research", "topics": "agents-autonomy", "published_at": "2026-08-11T06:11:26.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18689" }, { "id": 18690, "url": "https://arxiv.org/abs/2608.10171v1", "title": "Generating Attacks for LLMs with GFlowNets", "summary": "The rapid advancement of Large Language Models (LLMs) has facilitated their ubiquitous integration into various domains, leading to widespread adoption. However, this escalating trend has introduced significant security vulnerabilities, necessitating the identification and mitigation of flaws arising from malicious exploitation. Red teaming assessments, conducted to evaluate model robustness through diverse adversarial inputs, are essential for exposing security risks and implementing countermea", "authors": "Berkay Ozcam, Irem Onen, Mehmet Fatih Amasyali, Emin Islam Tatli", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-10T19:39:10.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18690" }, { "id": 18312, "url": "https://arxiv.org/abs/2608.09158v1", "title": "From Inaudible Inputs to Model Failures: Low-Frequency Safety Risks in LALMs", "summary": "Large audio-language models (LALMs) have demonstrated strong capabilities in understanding diverse audio inputs. This diversity includes low-frequency signals that are inaudible to humans but can still enter the model and influence its generation. However, the practical impact of such low-frequency inputs on LALMs remains largely unexplored. In this paper, we propose Intermittent Low-Frequency Lockout (ILL), an inaudible red teaming method that evaluates this risk using a universal waveform temp", "authors": "Yuanhe Zhang, Weiliu Wang, Jie Ren, Liang Lin, Zhenhong Zhou, Haoran Gao, Kun Wang, Chen Li, Li Sun, Sen Su", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-10T06:09:50.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18312" }, { "id": 18313, "url": "https://arxiv.org/abs/2608.08542v1", "title": "When Skills Meet Safety: Benchmarking and Characterizing the Adaptive Jailbreak Robustness of Skill-Merged LLMs", "summary": "Model merging has become the default way to give an aligned language model new skills without retraining: a practitioner folds task vectors from math, code, or domain specialists into a safety-aligned base using task arithmetic, TIES, or DARE. This convenience is known to carry a safety cost, but almost all of that evidence rests on static refusal tests: fixed harmful prompts scored for compliance. We argue this is misleading. Because safety alignment is \"shallow,\" concentrated in the first few", "authors": "Yu Ma, Hongli Shi, Jing Li, Xinran Xu, Weiwei Hou", "category": "research", "topics": "regulation,safety-alignment", "published_at": "2026-08-09T07:41:06.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18313" }, { "id": 18314, "url": "https://arxiv.org/abs/2608.08471v1", "title": "Yesterday's Shield, Today's Spear: A Self-Evolving Safety Guardrail in Production", "summary": "Deployed LLM safety guardrails are predominantly static: trained once and frozen at release, while new jailbreak techniques and previously un-addressed harmful categories emerge within days, leaving the defense perpetually a step behind. We present SESG (Self-Evolving Safety Guardrails), a multi-agent system running in production. SESG monitors the live traffic behind a deployed guardrail and surfaces two classes of failure: jailbreaks novel in form and harmful categories novel in content. Once", "authors": "Cong Ming, Jingyi Chen, Bin Liu, Qi Chu, Tao Gong, Nenghai Yu, Yingfei Xiang", "category": "research", "topics": "safety-alignment,military-security,agents-autonomy", "published_at": "2026-08-09T04:31:05.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18314" }, { "id": 18315, "url": "https://arxiv.org/abs/2608.07892v1", "title": "Capability-Routed Guard: Defending Large Reasoning Models Against Reasoning-Centric Jailbreaks", "summary": "Large reasoning models (LRMs) expose a new safety failure mode: adversarial prompts can manipulate reasoning context, task decomposition, or capability interpretation so that harmful objectives are processed as legitimate reasoning steps. Existing safeguards, including safety reminders, external classifiers, and self-checking wrappers, are often brittle because they either inspect the adversarial prompt directly or ask the target model to perform additional safety reasoning on the same surface t", "authors": "Yiyong Liu, Yixin Wu, Jun Sakuma", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-08T03:40:06.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18315" }, { "id": 18316, "url": "https://arxiv.org/abs/2608.07808v1", "title": "The Anatomy of a Prompt Injection: A Component Model for Structured Analysis", "summary": "Four years after prompt injection was first identified in 2022, attacks are still predominantly documented as verbatim strings rather than structured exploits, despite advancing agent capabilities and threat actors embedding injections to subvert AI-assisted security analysis. This paper formalizes the structure of prompt-injection artifacts, enabling defenders, red teamers, and cyber threat intelligence (CTI) teams to label, compare, and mutate attacks without relying on fragile string matching", "authors": "Jeremy McHugh", "category": "research", "topics": "safety-alignment,military-security,agents-autonomy", "published_at": "2026-08-07T23:16:35.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18316" }, { "id": 18691, "url": "https://arxiv.org/abs/2608.06110v2", "title": "ECHO: A Locally-Deployable Agentic Health Assistant with Temporal Memory, Safety Guardrails, and Speech Assessment", "summary": "This paper presents ECHO (Enhanced Care & Health Observer), a locally-deployable conversational health assistant for long-term chronic care management. ECHO integrates three complementary software modules developed under shared supervision as a unified system. The core module is an agentic chatbot built on a ReAct loop orchestrated via LangGraph, equipped with 17 clinical tools and a temporal knowledge graph for persistent cross-session memory; it achieves a 94.9% tool-execution pass rate across", "authors": "Abdulkadir Külçe, Alihan Esen, Çağla Fikir, Berke Kurt, Kuzey Arar, Gökhan Ercan, Faik Boray Tek", "category": "research", "topics": "healthcare,agents-autonomy", "published_at": "2026-08-06T14:44:12.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/18691" }, { "id": 17387, "url": "https://arxiv.org/abs/2608.05659v1", "title": "Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks", "summary": "LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they ofte", "authors": "Yuchen Chen, Wei Cheng, Yuan Xiao, Wising Sun, Chunrong Fang, Yang Liu, Zhenyu Chen, Baowen Xu", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-06T06:57:10.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/17387" }, { "id": 17388, "url": "https://arxiv.org/abs/2608.05409v1", "title": "Mood Matters: How Syntactic Sensitivity Undermines Safety Alignment", "summary": "Large language models typically undergo post-training to align them with safety policies but there exist many sophisticated jailbreaks that sidestep established safeguards. For instance, prior work by Andriushchenko et al. (2025) has found that changing the grammatical tense from present to past can be enough to elicit harmful responses. In this work, we uncover a more general failure of non-imperative syntactic forms. We demonstrate that this syntactic vulnerability exists in 16 models up to 70", "authors": "Alina Klerings, Jannik Brinkmann, Heiner Stuckenschmidt, Simone Paolo Ponzetto", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-05T21:05:12.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/17388" }, { "id": 16968, "url": "https://arxiv.org/abs/2608.05108v1", "title": "Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming", "summary": "Prompt injection poses significant security risks to LLM agents. Efficient and effective red-teaming is therefore critical, both for evaluating these risks and for collecting training data to improve defenses. Existing state-of-the-art prompt injection red-teaming methods primarily rely on reinforcement learning (RL), producing attacker models that often generalize poorly to new target LLMs. In this work, we develop PIMiner, an agentic system for prompt injection red-teaming. During training, PI", "authors": "Yanting Wang, Chenlong Yin, Runpeng Geng, Jinyuan Jia", "category": "research", "topics": "safety-alignment,agents-autonomy", "published_at": "2026-08-05T17:44:09.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16968" }, { "id": 16969, "url": "https://arxiv.org/abs/2608.04317v1", "title": "Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)", "summary": "Autonomous cyber defense systems based on Deep Reinforcement Learning (DRL) have attracted significant research attention, yet remain evaluated almost exclusively against static, heuristic red agents, leaving their robustness against adaptive threats critically understudied. Meanwhile, recent advances in Reinforcement Learning with Verifiable Rewards (RLVR) have improved LLM reasoning, but their integration into cybersecurity remains elusive due to the absence of suitable benchmark environments", "authors": "Ryozo Masukawa, Ian Bryant, Armita Kazeminajafabadi, Sanggeon Yun, Hyunwoo Oh, SungHeon Jeong, Nathaniel D. Bastian, Mahdi Imani, Mohsen Imani", "category": "research", "topics": "military-security,agents-autonomy,environment", "published_at": "2026-08-05T00:54:57.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16969" }, { "id": 16568, "url": "https://arxiv.org/abs/2608.03210v1", "title": "ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization", "summary": "Foundation models have achieved remarkable success across diverse tasks, but they remain vulnerable. To investigate such vulnerabilities, semantic-shift jailbreaks have recently emerged as a promising attack paradigm. They bypass explicit safety mechanisms by replacing harmful terms in original harmful questions with benign alternatives and leveraging contextual information to induce the target model to reinterpret these alternatives as their corresponding harmful concepts. However, existing sem", "authors": "Hujian Zhu, Yihao Huang, Felix Juefei-Xu, Xinfeng Li, Peng Zeng, Simeng Qin, Qing Guo, Geguang Pu", "category": "research", "topics": "safety-alignment,finance-investment", "published_at": "2026-08-04T06:48:17.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16568" }, { "id": 16569, "url": "https://arxiv.org/abs/2608.03070v1", "title": "AI Security Leaderboard: Methodology, Results and Minimal Standard", "summary": "Frontier AI model developers increasingly rely on layered safeguards to prevent catastrophic misuse, but little public evidence exists on how much protection these safeguards provide, or how consistently across developers. We introduce the FAR.AI Minimal Standard for Safeguards, Version 1.0: a taxonomy of 67 readily accessible static jailbreak techniques, a method for composing them into a very large attack space, and a benchmark of flagship models against a sample of it. We evaluate Claude Fabl", "authors": "Jasper Timm, Lukas Struppek, Ziwei Xu, Grace Cheong, Oscar Mata, Dan Zhao, Mick Yang, Isadora De Andrade, Xiaojun Jia, Yiming Li, Samuel Bauer, Heather McIntyre, Adam Gleave, Edward Yee, Kellin Pelrine", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-04T03:32:19.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16569" }, { "id": 17389, "url": "https://arxiv.org/abs/2608.03070v2", "title": "AI Security Leaderboard: Methodology, Results and Minimal Standard", "summary": "The AI Security Leaderboard is an independent benchmark that ranks the safeguards of frontier AI models from least to most secure. It tests models against the FAR$.$AI Minimal Standard for Safeguards, which represents a minimum bar for security: meeting it does not guarantee a secure model, but failing to meet it guarantees a lack of state-of-the-art security. Version 1.0 covers severe misuse requests across chemical, biological, radiological, nuclear, and explosive (CBRNE) threats and offensive", "authors": "Jasper Timm, Lukas Struppek, Ziwei Xu, Grace Cheong, Oscar Mata, Dan Zhao, Mick Yang, Isadora De Andrade, Xiaojun Jia, Yiming Li, Samuel Bauer, Heather McIntyre, Adam Gleave, Edward Yee, Kellin Pelrine", "category": "research", "topics": "biotech", "published_at": "2026-08-04T03:32:19.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/17389" }, { "id": 16166, "url": "https://arxiv.org/abs/2608.01637v1", "title": "Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw", "summary": "Long-term memory enables LLM agents to retain useful information across sessions, but also creates an attack surface through which adversaries may poison an agent's persistent memory to steer its behavior. Existing memory poisoning attacks mainly rely on individually malicious records, overlooking a compositional threat: multiple benign-looking memories may jointly induce unsafe behavior. In this paper, we introduce MemCollusion, an automated red-teaming framework for constructing collusive memo", "authors": "Zheng Lin, Yuzhe Huang, Zhenxing Niu, Xianmin Ye, Haichang Gao", "category": "research", "topics": "safety-alignment,agents-autonomy", "published_at": "2026-08-03T03:17:26.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16166" }, { "id": 16970, "url": "https://arxiv.org/abs/2608.04034v1", "title": "A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination", "summary": "Multimodal Large Language Models (MLLMs) have achieved impressive progress in image-text comprehension and generation, yet they remain susceptible to jailbreak attacks that can trigger harmful outputs and pose serious safety concerns. Existing multimodal jailbreak attacks have shown the feasibility of such attacks, but they still face two fundamental challenges: the lack of a atomic multi-modal strategy space, the absence of a concise and efficient executable framework beyond human-craft experie", "authors": "Shiji Zhao, Yuxuan Zhou, Chen Xiong, Dongxian Wu, Yang Bai, Xun Chen", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-03T02:28:52.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16970" }, { "id": 16167, "url": "https://arxiv.org/abs/2608.01414v1", "title": "No Single Neuron of Failure: Distributed Safety Alignment Against White-Box Attacks", "summary": "With the rapid release of open-weight large foundation models, safety threats are shifting from black-box jailbreaks to neuron-level white-box attacks that directly identify and manipulate safety-related neurons. Existing alignment methods often investigate the safety behavior on a small number of neurons, creating fragile single point of failure with limited redundancy. To address this issue, we propose distributed safety alignment (DSA), which redundantly encodes safety capabilities across mul", "authors": "Simiao Xie, Chuancheng Shi, Shangze Li, Wenhua Wu, Fei Shen, Ying Zhou, Zhiyong Wang, Tat-Seng Chua", "category": "research", "topics": "safety-alignment,finance-investment", "published_at": "2026-08-02T17:49:07.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16167" }, { "id": 16570, "url": "https://arxiv.org/abs/2608.02674v1", "title": "Moving the Safety Barrier: Dynamic Routing Adaptive Alignment Against White-Box Attacks", "summary": "With the widespread deployment of large foundation models (LFMs) in open environments, safety threats are shifting from black-box jailbreaks toward white-box attacks that directly identify and disrupt internal safety neurons or routes. However, existing safety defenses often rely on static safety units or fixed refusal pathways, leaving models highly vulnerable to targeted route-level white-box attacks. For that, we propose dynamic routing adaptive alignment (DRAA), a framework that introduces d", "authors": "Shangze Li, Chuancheng Shi, Simiao Xie, Lingzhi He, Cheng Ji, Zifeng Cheng, Fei Shen, Chao Wu, Tat-Seng Chua", "category": "research", "topics": "safety-alignment,environment", "published_at": "2026-08-02T17:45:20.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16570" }, { "id": 16168, "url": "https://arxiv.org/abs/2608.01373v1", "title": "The Boy Who Cried Wolf: Adversarial Misclassification of Safe Inputs as Unsafe in Multimodal Guardrails", "summary": "Multimodal guard models have emerged as critical safety components for screening content in vision-language systems. While adversarial research has extensively studied jailbreaking attacks that produce false negatives, the inverse threat of inducing false positives on benign inputs remains unexplored. We introduce Unsafe Induction Attacks, where adversaries distribute imperceptibly perturbed safe images that trigger guard models to reject legitimate user requests, causing a \"Boy Who Cried Wolf\"", "authors": "Shuo Shi, Rui Yin, Naen Xu, Jiahao Chen, Chunyi Zhou, Tianyu Du, Zhihui Fu, Jun Wang, Zhaoxiang Wang, Shouling Ji", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-02T16:49:25.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16168" }, { "id": 16169, "url": "https://arxiv.org/abs/2608.01117v1", "title": "SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks", "summary": "Large Language Models (LLMs) are increasingly deployed in interactive settings, where user intent commonly unfolds through multi-turn dialogue. Multi-turn jailbreaks exploit this pattern by advancing a harmful intent across turns, so that no single message exposes the full objective. However, existing work treats these attacks as a loose collection of prompt patterns and does not analyze how the adversary organizes and advances harmful intent across an interaction. We develop a four-part, intent", "authors": "Siyuan Li, Aodu Wulianghai, Zehao Liu, Xi Lin, Qinghua Mao, Haoyu Li, Xiang Chen, Siyuan Liang, Jun Wu, Jianhua Li, Dacheng Tao", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-02T09:24:08.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16169" }, { "id": 16170, "url": "https://arxiv.org/abs/2608.01043v1", "title": "Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks", "summary": "We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate (ASR). The operative change is in the defense pipeline, not in the image. Across five frontier VLMs, two encoded-attack families, and three black-box defenses, a caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops i", "authors": "Haoyu Zhang, Xiangchen Guan, Shibo Zheng, Mohammad Zandsalimy, Shanu Sushmita", "category": "research", "topics": "safety-alignment,military-security", "published_at": "2026-08-02T07:00:49.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16170" }, { "id": 16171, "url": "https://arxiv.org/abs/2608.00973v1", "title": "Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems", "summary": "Text-to-image (T2I) systems typically have prompt-level safety filters before the generator to block unsafe requests, yet such systems remain vulnerable to malicious jailbreak prompts. Transfer-based attacks construct adversarial prompts offline without querying the target, but they tend to overfit to a single surrogate. Moreover, they explore a large search space in which semantic or perceptual similarity alone cannot guarantee both filter evasion and preservation of the unsafe generation inten", "authors": "Wanguang Li, Zhaoxin Wang, Handing Wang", "category": "research", "topics": "safety-alignment", "published_at": "2026-08-02T03:53:30.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16171" }, { "id": 16172, "url": "https://arxiv.org/abs/2608.00677v1", "title": "OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution", "summary": "AI agents operate in persistent environments where early state changes can influence decisions far into the future. Unlike conventional language-model interactions, agent behavior is mediated through a shared state that is repeatedly modified and reused across long-horizon workflows. Current safety benchmarks often fail to capture these cumulative risks because they focus on short, static tasks. To address these limitations, we introduce OpenART, an open-ended arena for scalable agent red teamin", "authors": "Yunhao Chen, Xin Wang, Yixu Wang, Yi Liu, Jie Li, Yan Teng, Xingjun Ma, Xia Hu, Yu-Gang Jiang", "category": "research", "topics": "safety-alignment,agents-autonomy,environment", "published_at": "2026-08-01T13:51:55.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16172" }, { "id": 16173, "url": "https://arxiv.org/abs/2608.00143v1", "title": "Symbolic Attack Chain Generation from Atomic Red Team Techniques: An Empirical Study of Predicate Representation Granularity", "summary": "Automated attack chain generation is critical for modern cybersecurity, yet manual construction fails to scale as adversary behaviors expand. While classical AI planning using PDDL offers a formal method to automate this process, it relies on the accurate translation of techniques into symbolic predicates. Current state-of-the-art systems like AURORA employ a nine-category Attack Action Linking Model (AALM), but the necessity of this specific granularity remains unvalidated. This work investigat", "authors": "Ramya Varunsegar", "category": "research", "topics": "safety-alignment,finance-investment", "published_at": "2026-07-31T15:35:06.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/16173" }, { "id": 15793, "url": "https://arxiv.org/abs/2607.28685v1", "title": "Safety, or Just Capability? A Validity Audit of Agent-Safety Benchmarks", "summary": "Agent-safety benchmarks measure different behaviors, and their scores get quoted interchangeably as an agent's safety. We treat four of them (R-Judge, InjecAgent, AgentHarm, AgentDojo) as measurements to be validated, running each under its official implementation and author-provided scorer on up to 22 models, with MMLU and GPQA measured by us under one protocol as a capability composite. The metric is the first problem. On any binary trace-judgment benchmark scored by $F_1$, an ``always positiv", "authors": "Youting Wang, Xiao Han, Dingyan Shang, Yuan Tang, Bowen Liu", "category": "research", "topics": "agents-autonomy,transparency", "published_at": "2026-07-30T03:45:10.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/15793" }, { "id": 15242, "url": "https://arxiv.org/abs/2607.27373v1", "title": "RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation", "summary": "Large language models (LLMs) are becoming increasingly integrated into mainstream development platforms and daily technological workflows, typically behind moderation and safety controls. Despite these controls, preventing prompt-based policy evasion remains challenging, and adversaries continue to \"jailbreak\" LLMs by crafting prompts that circumvent implemented safety mechanisms. Prior work has established cipher-mediated interaction, code-embedded decryption, prompt decomposition and reconstru", "authors": "Benyamin Tafreshian, Prathamesh Dhake", "category": "research", "topics": "regulation,safety-alignment", "published_at": "2026-07-29T18:25:30.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/15242" }, { "id": 14849, "url": "https://arxiv.org/abs/2607.26574v1", "title": "Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks", "summary": "Safety classifiers (\"guards\") are the dominant black-box defense for vision-language models, yet they judge an input's surface form, not its meaning: a harmful request re-encoded as set theory, formal logic, a rare language, code, or an image of text slips past a guard that would block it in plain language -- the decode gap. The natural fix is a guard-agnostic recover-and-decode amplifier that transcribes image content and restates encoded text into its plain payload before the guard, so any off", "authors": "Haoyu Zhang, Zhuoxi Wang, Shibo Zheng, Zijian Xiao, Xiangchen Guan, Mohammad Zandsalimy, Shanu Sushmita", "category": "research", "topics": "safety-alignment,military-security", "published_at": "2026-07-29T07:53:35.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14849" }, { "id": 14850, "url": "https://arxiv.org/abs/2607.26541v1", "title": "Prosody-driven Jailbreaks in Audio LLMs: A Controlled Study and Mechanistic Analysis", "summary": "Audio-capable foundation models enable end-to-end spoken interaction, but they also introduce safety risks beyond transcript content. It remains unclear how much jailbreak capability can arise from matched-text variation in speech delivery rather than from lexical rewriting or broader style transfer. We study this question by holding transcript content fixed and varying six speech-delivery presets whose acoustic attributes may co-vary. We present PJ-Break, a black-box evaluation protocol with pr", "authors": "Jiachen Qian, Junyu Li", "category": "research", "topics": "safety-alignment", "published_at": "2026-07-29T07:12:44.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14850" }, { "id": 14851, "url": "https://arxiv.org/abs/2607.26314v1", "title": "StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents", "summary": "Stealth, the discipline of achieving an objective without revealing your presence, capabilities, or collected intelligence, is what separates sophisticated operators from detectable ones. Elite security researchers and advanced persistent threats achieve their objectives unnoticed; autonomous agents increasingly inherit the same offensive tasks, but do they inherit the tradecraft? We introduce StealthBench,a benchmark that measures operational stealth in autonomous offensive-security agents acro", "authors": "Ads Dawson, Adrian Wood", "category": "research", "topics": "agents-autonomy", "published_at": "2026-07-28T22:23:34.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14851" }, { "id": 14852, "url": "https://arxiv.org/abs/2607.26115v1", "title": "GPT-Red: Automated Red Teaming via Self-Play at Scale", "summary": "We introduce \\textbf{GPT-Red}, an automated red-teaming agent that is trained to discover novel prompt injection attacks against frontier LLMs. The goal of this model is to evaluate and improve the robustness of our production systems. To this end, we use it to adversarially train GPT-5.6, our most robust model to prompt injections to date. To create GPT-Red, we design a scalable self-play algorithm where the model is tasked with attacking a diverse population of simultaneously-trained defender", "authors": "Eric Wallace, Christopher A. Choquette-Choo, Nikhil Kandpal, Sam Toyer, Dylan Hunn, Stephanie Lin, Yuxin Wen, Xiangyu Qi, Christopher Wolff, Zizhao Wang, Milad Nasr, Sicheng Zhu, Chuan Guo, Juan Felipe Cerón Uribe, Kaiwen Wang, Aiden Low, Kai Xiao, Kai Chen", "category": "research", "topics": "safety-alignment,agents-autonomy", "published_at": "2026-07-28T16:03:39.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14852" }, { "id": 14470, "url": "https://arxiv.org/abs/2607.25375v1", "title": "Inspect India Evals: An Open Benchmarking Framework for Evaluating Large Language Models in the Indian Linguistic and Cultural Context", "summary": "India is a vast nation of over 1.4 billion people, varied by hundreds of diverse and locally specific traditions and cultures and 22 officially recognized languages. Large language models (LLMs) are now being deployed on a massive scale throughout the mainland as well as in remote villages. However, the common benchmarks - MMLU, BIG-Bench, and TruthfulQA are almost exclusively English- and Western-centric. They do not identify those safety, fairness, and accuracy failures unique to the Indian co", "authors": "Abhishek Kumar Singh, Shrey Nag, Sachita, Lipi Goel, Rajeshwar Singh Janwar", "category": "research", "topics": "bias-fairness", "published_at": "2026-07-28T07:30:12.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14470" }, { "id": 14471, "url": "https://arxiv.org/abs/2607.25255v1", "title": "SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems", "summary": "Multi-agent systems improve capability through task decomposition and role specialization, but these same mechanisms introduce an important safety blind spot: a harmful objective can be fragmented into locally plausible subtasks, allowing malicious intent to evade detection by any single agent. This is a growing social-impact challenge: systems handling sensitive information or consequential tools can turn routine delegation into unauthorized disclosure or unsafe action. We argue that this failu", "authors": "Haowen Dai, Zonghao Ying, Wenfeng Li, Xiangfan Wu, Yisong Xiao, Tianyuan Zhang, Jiaye Lin, Lei Wei, Guangyuan Dong, Xitong Ling, Xixun Lin, Quanchen Zou, Xiangzheng Zhang", "category": "research", "topics": "agents-autonomy,transparency", "published_at": "2026-07-28T03:55:47.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14471" }, { "id": 15243, "url": "https://arxiv.org/abs/2607.25255v2", "title": "SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems", "summary": "Multi-agent systems improve capability through task decomposition and role specialization, but these same mechanisms introduce an important safety blind spot: a harmful objective can be fragmented into locally plausible subtasks, allowing malicious intent to evade detection by any single agent. This is a growing social-impact challenge: systems handling sensitive information or consequential tools can turn routine delegation into unauthorized disclosure or unsafe action. We argue that this failu", "authors": "Haowen Dai, Zonghao Ying, Wenfeng Li, Xiangfan Wu, Yisong Xiao, Tianyuan Zhang, Jiaye Lin, Lei Wei, Guangyuan Dong, Xitong Ling, Xixun Lin, Quanchen Zou, Xiangzheng Zhang", "category": "research", "topics": "agents-autonomy,transparency", "published_at": "2026-07-28T03:55:47.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/15243" }, { "id": 14472, "url": "https://arxiv.org/abs/2607.24897v1", "title": "TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models", "summary": "Recent commercial image-generation models can generate high-quality images with readable text (e.g., posters, infographics, and manuals), attracting considerable attention. Yet we first show that this same capability also introduces a previously unreported safety vulnerability: these systems may refuse to generate harmful text directly, yet permit the same content when rendered as text within generated images, i.e., safety alignment does not reliably transfer from textual outputs to text embedde", "authors": "Meng Xie, Li Zeng, Hangtao Zhang, Xianlong Wang, Ziqi Zhou, Pengpeng Qiao, Zhetao Li", "category": "research", "topics": "safety-alignment", "published_at": "2026-07-27T16:41:36.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14472" }, { "id": 14473, "url": "https://arxiv.org/abs/2607.24392v1", "title": "When LLM Defenses Backfire: Characterizing Safety, Performance, and Cost Trade-offs", "summary": "Jailbreak defenses are essential for protecting large language models (LLMs), but they can also introduce secondary costs that weaken model utility. We present a systematic study of these defense trade-offs along three dimensions: performance impact, over-refusal on benign inputs, and inference cost. Rather than treating defenses as a single class, we organize them by operational strategy and examine how different strategies correlate with different side-effect profiles. Across state-of-the-art", "authors": "Tong Zhang, Zexin Li, Simin Chen, Yun Peng", "category": "research", "topics": "safety-alignment,military-security", "published_at": "2026-07-27T13:07:52.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14473" }, { "id": 14474, "url": "https://arxiv.org/abs/2607.23496v1", "title": "Do LLMs Know Their Vulnerable Scenarios?", "summary": "Safety-aligned large language models are trained to refuse harmful requests, yet embedding the same requests in particular scenarios can bypass their safeguards. Existing red-teaming methods empirically identify effective scenarios through observed attack outcomes, but why particular scenarios weaken refusal remains mechanistically unclear. Meanwhile, mechanistic interpretability studies have characterized both refusal directions and jailbreak-associated features, without explaining the relation", "authors": "Ziheng Peng, Huiqi Deng, Haoran Jing, Xuankun Rong, Jiahui Han, Xiting Wang, Na Zou, Xia Hu", "category": "research", "topics": "safety-alignment", "published_at": "2026-07-26T06:54:28.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/14474" }, { "id": 13732, "url": "https://arxiv.org/abs/2607.21951v1", "title": "SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders", "summary": "This paper investigates the adversarial manipulation of the ranked recommendations produced by web-augmented large language models (LLMs). When an LLM answers a recommendation query by retrieving and reading live webpages, it acts as a recommender, and each retrieved page becomes a potential attack surface. Prior work has examined fabricated products, retrieval poisoning, and rank promotion. However, these studies do not compare how different edits to an already retrieved page change the model's", "authors": "Evan Caville, Siamak Layeghy, Billy Sung, Sara Dolnicar, Marius Portmann", "category": "research", "topics": "finance-investment", "published_at": "2026-07-24T03:55:51.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/13732" }, { "id": 13733, "url": "https://arxiv.org/abs/2607.21758v1", "title": "Humanly: A Configurable and Traceable Environment for Human-AI Collaborative Writing", "summary": "Teachers, conference chairs, and public readers all judge writing from limited evidence, seeing only a finished document and not the process that produced it. Final text alone cannot reveal whether a document was produced through human typing, AI generation, or mixed human-AI collaboration. Existing process-tracking tools help, but many are tied to host-document histories, provide coarse activity records, and offer limited control over the writing environment. Humanly is a writing platform that", "authors": "Shenzhe Zhu, Haoqian Zhang, Xu Yang, Jingyu Tang, Yi Nian, Xiaoxue Du, Shu Yang, Alex Pentland, Joachim Baumann, Jiaxin Pei", "category": "research", "topics": "privacy-surveillance,environment", "published_at": "2026-07-23T19:20:03.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/13733" }, { "id": 13734, "url": "https://arxiv.org/abs/2607.21735v1", "title": "What AI Red-Team Evaluations Can and Cannot Prove", "summary": "Red-team evaluations of AI models support some claims and not others, and the boundary between the two is calculable rather than merely a matter of judgment. We define the evidential ceiling of an evaluation as the largest factor by which one result can move belief under a fixed testing budget, derive it in closed form for the benchmark null result, and use it to locate that boundary exactly. We find that above a calculable harm rate, a benchmark of modest size certifies a category to a stated e", "authors": "Bandana Kaur", "category": "research", "topics": "safety-alignment", "published_at": "2026-07-23T18:34:12.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/13734" }, { "id": 15244, "url": "https://arxiv.org/abs/2607.21735v2", "title": "What AI Red-Team Evaluations Can and Cannot Prove", "summary": "Red-team evaluations of AI models support some claims and not others, and the boundary between the two is calculable rather than merely a matter of judgment. We define the evidential ceiling of an evaluation as the largest factor by which one result can move belief under a fixed testing budget, derive it in closed form for the benchmark null result, and use it to locate that boundary exactly. We find that above a calculable harm rate, a benchmark of modest size certifies a category to a stated e", "authors": "Bandana Kaur", "category": "research", "topics": "safety-alignment", "published_at": "2026-07-23T18:34:12.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/15244" }, { "id": 13493, "url": "https://arxiv.org/abs/2607.20852v1", "title": "Code Monitor Red Teaming for Public-Test-Passing Code", "summary": "Visible tests are a common gate for LLM-generated code, but passing them does not certify specification correctness. We study a deployment-like monitoring problem: after code has passed public tests, can a weaker LLM verifier identify the residual hidden bugs? We introduce Code Monitor Red Teaming, a monitor-red-teaming protocol that fixes a public-check information boundary while varying generator pressure, verifier scaffolding, and weak-to-strong capability. We instantiate it as CodeMonitorBen", "authors": "Junchi Liao, Jiawen Deng, Fuji Ren", "category": "research", "topics": "safety-alignment", "published_at": "2026-07-23T02:23:09.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/13493" }, { "id": 13494, "url": "https://arxiv.org/abs/2607.20581v1", "title": "Geometric Configurations of Perturbed Jailbreak Prompts", "summary": "Perturbation techniques that turn unsuccessful jailbreak prompts into successful ones are continuously evolving, constituting a major security threat to LLM safety. In this paper, we investigate the internal representations of such string-level perturbed jailbreak inputs in the small weight models of the Qwen-2.5-1.5B/-3B/-7B-Instruct and Llama-3.2-1B/-3B/-3.1-8B-Instruct families. We select two representation spaces: the last-layer-last-token embedding space and the top-50 next-token probabilit", "authors": "Lynn Delcon, Andres Algaba, Vincent Ginis", "category": "research", "topics": "safety-alignment,finance-investment", "published_at": "2026-07-22T11:52:43.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/13494" }, { "id": 12987, "url": "https://arxiv.org/abs/2607.19829v1", "title": "DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection", "summary": "Most existing LLM safety evaluation and defense methods follow a static formulation: jailbreak vulnerabilities are evaluated with fixed attack methods, and guardrails are trained on fixed malicious prompt datasets. However, real-world adversaries continuously evolve their capabilities and expand the attack space. To address this challenge, we propose DARWIN, an evolutionary attack-defense framework that formulates jailbreaking as an open-ended evolution process and continuously updates guardrail", "authors": "Weiwei Qi, Zefeng Wu, Zhilin Guo, Tianhang Zheng, Chaochao Lu, Liang He, Zhan Qin, Kui Ren", "category": "research", "topics": "safety-alignment,military-security", "published_at": "2026-07-22T07:08:59.000Z", "source": "arXiv red teaming query", "ethics_ai_record_url": "https://ethics.ai/record/12987" } ], "attribution": "via ethics.ai" }