GPT-Rosalind-6 System Card Addendum is OpenAI's safety documentation for a life-sciences model that shares weights with GPT-6 Astra. It rates the model High in Biological and Chemical and Critical in Cybersecurity under the Preparedness Framework. It reports biology evaluations, trusted-access controls, biosecurity refusal pass rates, a historical cyber jailbreak regression (14.3% task success), and sabotage and monitor-evasion results.
EpiCoach is an agentic system that treats one cross-country mountain biker as an N-of-1 experiment. Claims live in an evidence-gated hypothesis registry, and each must make a probabilistic prediction before a session. Predictions come from a digital twin fitted to heart rate, GPS and altitude. In a replay over eighteen months the twin beat standard forecasters on heart rate but not segment time, and the agent loop matched a static model. In the first three live weeks, the ledger sealed 20 predictions and scored 14, and a safety officer vetoed the agent twice. The registry, benchmark and protocol are released.
LLMBayesian experimental designdigital twin+1
EpiCoacharXiv
agents, research, evalsΒ· Added 31 Oct 2026, published 29 Oct 2026
Secure Transaction Verification and Authorization (STVA) is a draft Standards Track ERC (created October 2026) by @MATOBOYCRYPTO65. It proposes structured human-readable metadata and semantic intent for transactions and UserOperations, an independent simulation and verification interface, and scoped, revocable capability tokens for privileged operations. It targets blind signing and frontend supply-chain attacks, citing the February 2025 Bybit Safe multisig theft. The page gives only the abstract, motivation and core concepts.
AK_QMUL's system for the ArGuard-2026 shared tasks fine-tunes JAIS-6.7B with 4-bit QLoRA and a linear head on the last-token representation. For binary safe/unsafe detection (B1) it uses a four-way head over dialect register and AraSafe MSA augmentation, reaching macro-F1 0.984. For seven-way harm domain (B2) it averages five seeds, reaching 0.790. Both ranked first. Bully is the weakest class.
JAIS-6.7BQLoRALLM
JAISArGuardAraSafe+2
research, ai-safety, trainingΒ· Added 28 Oct 2026, published 26 Oct 2026
An empirical study of security concerns in the OpenClaw AI personal assistant framework, using 25K+ posts from 13 subreddits (162 security-relevant) and 358 security-tagged GitHub issues (180 retained). It maps 521 CWE instances across 59 weakness types, concentrated in access control, sensitive-data exposure, injection and unsafe execution. It extracts 543 practitioner mitigations into seven strategies and reconstructs a sensitive-data exposure path with dummy secrets.
OpenClawGitHubLLM
prompt injectionCWEtrust boundaries+1
AI SecurityΒ· Added 28 Oct 2026, published 26 Oct 2026
Scope-Gap Injection (SGI) is an indirect prompt injection method for multi-stage LLM-agent safety pipelines, tested in the IJCAI 2026 OpenClaw Agent Security Attack Competition. The visible task and skill stay benign while target identifiers, bypass parameters and authorization steps sit in an attachment written as a business worklist, which the S2 LLM judge appears not to inspect. SGI bypassed all three stages (static scan, LLM judge, live audit) for 5 of 19 targets, best F = 0.385. Attachment placement had 78% S2 acceptance versus 23% in-skill. The paper closes with defenses that align evaluator scope with agent channels.
SentryBench is a benchmark for tool-using LLM agents in public-safety deployments. It scores attack success, over-refusal (missing a real emergency) and over-reaction (unwarranted action) on a cost-sensitive frontier, using real emergency-call transcripts, disaster messages and injection payloads. Across 840 episodes on three frontier models and three defenses, refuse-more caution pushed over-refusal to 100 percent on two models, while a trust-gating wrapper gave the lowest harm.
LLM
SentryBencharXiv
evals, ai-safety, agentsΒ· Added 27 Oct 2026, published 25 Oct 2026
SentryBench is a benchmark for tool-using LLM agents in public-safety settings (public alerts, responder dispatch, citizen-record queries). It scores attack success, over-refusal and over-reaction on a cost-sensitive frontier, using real emergency-call transcripts and real injection/jailbreak payloads. Across 840 episodes on three frontier models and three defenses, refuse-more caution raised over-refusal to 100 percent on two models, while a trust-gating wrapper gave the lowest harm on every model.
LLM
SentryBenchover-refusalover-reaction+1
AI SecurityΒ· Added 27 Oct 2026, published 25 Oct 2026
This paper compares LoRA and full fine-tuning for prompt-safety classification using a matched 400M encoder-decoder pair (Ettin) across three task formats, with up to 15 seeds per cell and pre-specified analyses. Full fine-tuning leads LoRA by 2-3 pp at the pre-specified learning rates, and the encoder gap closes when both use the same learning-rate search. Training LoRA to write a reason after its verdict adds 4.0 pp, while a content-free sentence of equal length does not. Trained models beat a prompted 8B in domain but trail it by 8-23 pp on adversarial jailbreaks and over-flag benign prompts (27-66% against 2-3%).
LoRAEttinTransformer
training, research, evalsΒ· Added 27 Oct 2026, published 24 Oct 2026
This paper presents an offline evaluation harness for a production merchant-facing conversational agent. It stays reproducible when live backend data changes and can be regenerated when it goes stale. Used as the fitness function for GEPA prompt optimization under a correctness gate against reward hacking, it shrinks the full prompt surface by 3.5-7.6% without losing held-out correctness, across three subject-model families.
GEPALLM
arXiv
evals, prompting, agentsΒ· Added 26 Oct 2026, published 22 Oct 2026
EpiSEM-Bench is an executable benchmark of 300 matched unsafe/safe task pairs across six domains. It tests whether tool-using LLM agents take prohibited actions when a tool response omits a safety-relevant fact, even though the request is benign and all returned statements are true. It finds large variation across ten models, and recovery access cuts unsafe execution for all ten.
LLM
EpiSEM-BencharXiv
evals, ai-safety, agentsΒ· Added 24 Oct 2026, published 22 Oct 2026
Monitorability Is Trainable proposes an unsupervised post-training objective that maximizes mutual information between a model's chain of thought and its output. On three model organisms with degraded CoT (from compression, monitor optimization, and synthetic-document generalization), it recovers most or all lost monitorability. On undegraded policies it improves CoT monitor and activation probe prediction of unsafe behavior and raises consequential reasoning.
LLM
arXiv
ai-safety, research, trainingΒ· Added 23 Oct 2026, published 21 Oct 2026
PQ-Vault is a custody design for unmodified Ethereum against quantum key recovery. It combines a quantum-safe vault contract, a proof-of-stake sidechain with compact certificates, and an optimistic dispute protocol. The paper proves that compact certificates with classically chosen parameters fall from 128 to about 60 bits against quantum attackers, and bounds a seed-update stake-steering attack. For 65,536 validators a certificate is 0.8 MB and verifies in about 20 ms, and the vault accepts a checkpoint for about 420,000 gas.
Ethereum
compact certificatesstake steering
BlockchainΒ· Added 24 Oct 2026, published 21 Oct 2026
nokast-secureRAG is a roughly 0.5B-parameter small language model that works as a semantic firewall between retrieval and generation in local RAG systems. It classifies each query and context pair as safe, suspicious or malicious. It reaches 0.994 recall at a 0.026 false-positive rate in-distribution, beating Llama Guard 3 1B and Prompt-Guard-86M (0.900 recall, 0.690 FPR). Recall on PoisonedRAG falls to near zero, and single-request latency is 293-404 ms.
WSR-Tune is a fine-tuning framework that reparameterizes LLM weight matrices with a safety-conditioned basis, so safety-relevant information concentrates in a small set of directions. Those safety-critical directions are frozen, and the remaining complementary directions are updated for the downstream task. The authors report a better trade-off between downstream performance and safety retention. The page gives no benchmark names or numbers.
LLM
arXivWSR-Tune
research, ai-safety, trainingΒ· Added 21 Oct 2026, published 19 Oct 2026
VibeTraining-Bench is a benchmark for cross-component co-design, where research agents iteratively refine training data, trainers and inference harnesses for a fixed starting agent system. Tasks cover terminal operation, software engineering, multi-turn tool use and math reasoning, with safeguards against reward hacking. On SWE-bench Verified, GPT-6 Astra raises the target system from 32.9% to 53.7%, against 55.4% for the human-developed instruct model.
Docker
VibeTraining-BenchGPT-6 AstraSWE-bench Verified+1
evals, agents, trainingΒ· Added 21 Oct 2026, published 19 Oct 2026
ePrint 2026/2527 by Paola de Perthuis and Filip TrenkiΔ analyses module-BKZ attacks on NTRU+, the South Korean KEM standard. It introduces relative canonical and coefficient embeddings and shows they agree up to scaling exactly when rad(c)/rad(β) is 1 or 2. Simulation-based estimates show the best module attack saves 4 to 10 blocksizes, costing NTRU+ keys at most three bits of Core-SVP security. NTRU+ parameters stay safe in the overstretched regime.
OwlSight is a chain-of-thought monitor that uses "Factor", a monitoring requirement written into the prompt, so one monitor can cover many tasks across capability, safety and trustworthiness. Factors come at fine granularity (a specific leaked email address) and coarse granularity (privacy leakage). On 15,971 reasoning trajectories it beats general-purpose LLMs by 1.32-30.57 points (fine) and 11.71-27.81 points (coarse), and reaches state-of-the-art on OpenAI's CoT monitorability benchmark. It generalizes to unseen models and resists Factor rephrasing, CoT compression and obfuscation.
LLM
OwlSightOpenAIarXiv
ai-safety, research, evalsΒ· Added 20 Oct 2026, published 16 Oct 2026
Ignored, Not Refused audits 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge finds most failed indirect prompt injections are ignored (76-80%) rather than refused (17-18%). Changing only the system prompt moves InjecAgent ASR from 0.2% to 43%. The Attack-Task Outcome Matrix (ATOM) shows 21.7% of AgentDojo episodes were safe but left the user task incomplete. The corpus, judge prompt and code are released.
LLM
indirect prompt injectionAgentDojoInjecAgent+2
AI SecurityΒ· Added 20 Oct 2026, published 16 Oct 2026
"Ignored, Not Refused" audits 33,000 trajectories from eleven open-weight agents (2-14B parameters) on InjecAgent and AgentDojo. A label-blind LLM judge finds 76-80% of failed injection attacks were ignored and 17-18% refused. Changing only the system prompt moves InjecAgent attack success rate from 0.2% to 43%, and the ATOM matrix shows 21.7% of AgentDojo episodes were safe but left the user's task undone. The corpus, judge prompt and code are released.
LLM
InjecAgentAgentDojoATOM+1
evals, ai-safety, agentsΒ· Added 20 Oct 2026, published 16 Oct 2026
Beacon is a safety alignment framework for large reasoning models that fixes two GRPO failure modes: advantage collapse, where homogeneous rollout groups give vanishing advantages, and unsafe diversification, where unsafe behaviors persist and spread. It combines Safety Signal Recovery (advantage-guided trajectory filtering plus safe reference supervision) with Safety-Utility Decoupled Alignment (category-aware rewards, benign-only KL anchoring). Tested on four Qwen3 and DeepSeek-R1-Distill variants across eight benchmarks, it cuts average safety error by up to 32.83 percentage points with low over-refusal.
GRPOQwen3DeepSeek+1
BeaconDeepSeek-R1
ai-safety, training, researchΒ· Added 20 Oct 2026, published 16 Oct 2026
PROBE (Policy Rule Observation via Behavioral Exploration) trains LLM-based auditors that act as realistic users and probe deployed tool-using agents for policy violations (pricing, privacy, confirmation, safety) across multi-turn, tool-mediated dialogue. It formalizes auditing as a two-player Markov game with a composite reward for violation discovery, plausibility, progress and policy diversity, and compares GRPO, DPO and GFlowNet optimization. Trained auditors find broader, higher-yield violations than zero-shot adversaries, even when much smaller than the target agent, positioning behavioral auditing as a distinct axis next to capability and safety benchmarks.
LLM
PROBEGRPODPO+1
AI SecurityΒ· Added 17 Oct 2026, published 15 Oct 2026
PROBE (Policy Rule Observation via Behavioral Exploration) trains LLM-based auditors that act as realistic users and probe deployed tool-using agents for policy violations (pricing, privacy, confirmation, safety) over multi-turn dialogue. It formalizes auditing as a two-player Markov game with a composite reward balancing violation discovery, behavioral plausibility, conversation progress and policy diversity, and compares GRPO, DPO and GFlowNet optimization in a controlled setting. Trained auditors find broader, higher-yield violations than same-architecture zero-shot adversaries, even when much smaller than the target agent. This positions multi-turn behavioral auditing as a distinct evaluation axis alongside capability and safety benchmarks.
GRPODPOGFlowNet+1
PROBEarXiv
evals, agents, trainingΒ· Added 17 Oct 2026, published 15 Oct 2026
Presents a modular, fully onboard UAV navigation pipeline that closes the "human-aware safety gap" of geometry-only planners. A shared BLIP encoder drives captioning and text-conditioned segmentation, which is fused with depth for 3D obstacle localization. Qwen-2.5-0.5B, stabilized with RAG and grammar-constrained JSON decoding, infers per-category risk once per class and caches the verdict. Perception runs at 10 Hz on a Jetson Orin NX, and fallback LLM queries take about 0.8 s off the control path. In Gazebo it gives roughly 3x fewer collisions than a geometric planner and raises semantics-aware landing success from 34% to 96%. The 224-pixel encoder input limits small-object perception at range.
QwenBLIPRAG+4
NVIDIAarXiv
research, multimodal, inferenceΒ· Added 17 Oct 2026, published 15 Oct 2026
Introduces SA-CUA, a dual-LLM framework that gives Computer Use Agents a trust boundary against indirect prompt injection. It derives conservative deterministic rules from the accessibility tree to unmask trusted screen regions for the privileged LLM, and adds an endorsement channel that moves values from untrusted to trusted domains by verification. Human input is needed only at task specification. It reports much higher utility than CaMeL-CUA with a zero attack success rate.
LLM
SA-CUACaMeL-CUACaMeL+2
AI SecurityΒ· Added 15 Oct 2026, published 13 Oct 2026
Introduces SA-CUA, a dual-LLM framework for Computer Use Agents (CUAs) that defends against indirect prompt injection. It builds a trust boundary by deriving conservative deterministic rules from the accessibility tree, which unmask trusted screen regions in the privileged LLM's screenshot and keep untrusted content separate. An endorsement channel lets values move from the untrusted to the trusted domain through verification over trusted channels. This removes the need for per-action user confirmation and the confirmation fatigue it causes. SA-CUA is reported to keep much higher utility than CaMeL-CUA with a 0% attack success rate.
LLM
SA-CUACaMeL-CUACaMeL
agents, researchΒ· Added 15 Oct 2026, published 13 Oct 2026
BrowseSafe++ extends BrowseSafe to 38,675 paired attacked/clean web pages, most with prompt injections observed in the wild on production sites. Pages cover twelve site types, 24 attack types and 18 injection locations, each given as HTML, Markdown, accessibility tree and screenshot with a user task and expected answer. The authors train BrowseSafe-Guard, two 0.8B detectors (text and screenshot) that beat a frontier-model-based detector on F1 with low false positives and low inference cost. BrowseSafe-Adapt rewrites injections using browser-agent feedback, raising attack success from a few percent to up to 95.41%.
LLM
BrowseSafe++BrowseSafeBrowseSafe-Guard+3
AI SecurityΒ· Added 15 Oct 2026, published 12 Oct 2026
StableJudge is a defense framework against score-hijacking prompt injection in LLM-as-a-Judge pipelines (e.g. paper review, recommendation). A compact 0.13B "Sentry" model localizes injected spans and sanitizes them before the judge scores the content, trained on adversarially evolving attacks, and deterministic fine-grained scores are derived from the judge's output distribution. It improves score recovery under attack on held-out scientific abstracts and out-of-distribution attack variants while preserving general performance, decoupling safety from judge model scale. Code and data are promised but not yet released.
LLM
prompt injectionindirect prompt injection
AI SecurityΒ· Added 15 Oct 2026, published 12 Oct 2026
ReSI is a recursive safety improvement framework that automates rounds of safety alignment. Each round applies diverse red-teaming methods to the current target model, develops training recipes to fix the vulnerabilities found, and promotes the update with the largest safety gain among those passing a Pareto gate on capability retention. On four dense and mixture-of-experts models it matches or exceeds frontier models on in-distribution and out-of-distribution safety benchmarks. It cuts mean X-Teaming attack success rate from 86.01% to 31.45%, against 56.69% for the best frontier model (GPT-5.6 Luna), while largely preserving general capabilities.
Mixture of Experts
ReSIRΒ²AIX-Teaming+1
ai-safety, research, trainingΒ· Added 9 Oct 2026, published 8 Oct 2026
deploymentsafety.openai.compaperπ‘οΈ Security
