% GenAI Security Literature Review -- 1386 entries
% https://github.com/emmanuelgjr/GenAI-Security-Literature-Review (MIT License), generated 2026-09-15
% Entries with reviewed=false in literature.json were added automatically and are not yet curated.

@article{greshake2023not,
  title = {{Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection}},
  author = {Kai Greshake and Sahar Abdelnabi and Shailesh Mishra and Christoph Endres and Thorsten Holz and Mario Fritz},
  year = {2023},
  month = may,
  journal = {AISec 2023},
  eprint = {2302.12173},
  archivePrefix = {arXiv},
  doi = {10.1145/3605764.3623985},
  url = {https://arxiv.org/abs/2302.12173}
}

@inproceedings{schulhoff2023ignore,
  title = {{Ignore This Title and HackAPrompt: Exposing Systemic Weaknesses of LLMs through a Global Scale Prompt Hacking Competition}},
  author = {Sander Schulhoff and Jeremy Pinto and Anaum Khan and Louis-Francois Bouchard and Chenglei Si and Svetlina Anati and Valen Tagliabue and Anson Liu Kost and Christopher Carnahan and Jordan Boyd-Graber},
  year = {2023},
  month = nov,
  booktitle = {EMNLP 2023},
  eprint = {2311.16119},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2311.16119}
}

@inproceedings{wei2024jailbroken,
  title = {{Jailbroken: How Does LLM Safety Training Fail?}},
  author = {Alexander Wei and Nika Haghtalab and Jacob Steinhardt},
  year = {2024},
  month = jan,
  booktitle = {NeurIPS 2023},
  eprint = {2307.02483},
  archivePrefix = {arXiv},
  doi = {10.52202/075280-3508},
  url = {https://arxiv.org/abs/2307.02483}
}

@misc{zou2023universal,
  title = {{Universal and Transferable Adversarial Attacks on Aligned Language Models}},
  author = {Andy Zou and Zifan Wang and Nicholas Carlini and Milad Nasr and J. Zico Kolter and Matt Fredrikson},
  year = {2023},
  month = jul,
  eprint = {2307.15043},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2307.15043}
}

@inproceedings{wan2023poisoning,
  title = {{Poisoning Language Models During Instruction Tuning}},
  author = {Alexander Wan and Eric Wallace and Sheng Shen and Dan Klein},
  year = {2023},
  month = may,
  booktitle = {ICML 2023},
  eprint = {2305.00944},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2305.00944}
}

@misc{zou2024poisonedrag,
  title = {{PoisonedRAG: Knowledge Poisoning Attacks to Retrieval-Augmented Generation of Large Language Models}},
  author = {Wei Zou and Runpeng Geng and Binghui Wang and Jinyuan Jia},
  year = {2024},
  month = feb,
  eprint = {2402.07867},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2402.07867}
}

@inproceedings{carlini2021extracting,
  title = {{Extracting Training Data from Large Language Models}},
  author = {Nicholas Carlini and Florian Tramer and Eric Wallace and Matthew Jagielski and Ariel Herbert-Voss and Katherine Lee and Adam Roberts and Tom Brown and Dawn Song and Ulfar Erlingsson and Alina Oprea and Colin Raffel},
  year = {2021},
  booktitle = {USENIX Security 2021},
  eprint = {2012.07805},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2012.07805}
}

@misc{nasr2023scalable,
  title = {{Scalable Extraction of Training Data from (Production) Language Models}},
  author = {Milad Nasr and Nicholas Carlini and Jonathan Hayase and Matthew Jagielski and A. Feder Cooper and Daphne Ippolito and Christopher A. Choquette-Choo and Eric Wallace and Florian Tramer and Katherine Lee},
  year = {2023},
  month = nov,
  eprint = {2311.17035},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2311.17035}
}

@inproceedings{carlini2024stealing,
  title = {{Stealing Part of a Production Language Model}},
  author = {Nicholas Carlini and Daniel Paleka and Krishnamurthy Dj Dvijotham and Thomas Steinke and Jonathan Hayase and A. Feder Cooper and Katherine Lee and Matthew Jagielski and Milad Nasr and Arthur Conmy and Eric Wallace and David Rolnick and Florian Tramer},
  year = {2024},
  month = mar,
  booktitle = {ICML 2024},
  eprint = {2403.06634},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2403.06634}
}

@misc{wallace2024instruction,
  title = {{The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions}},
  author = {Eric Wallace and Kai Xiao and Reimar Leike and Lilian Weng and Johannes Heidecke and Alex Beutel},
  year = {2024},
  month = apr,
  eprint = {2404.13208},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2404.13208}
}

@misc{inan2023llama,
  title = {{Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations}},
  author = {Hakan Inan and Kartikeya Upasani and Jianfeng Chi and Rashi Rungta and Krithika Iyer and Yuning Mao and Michael Tontchev and Qing Hu and Brian Fuller and Davide Testuggine and Madian Khabsa},
  year = {2023},
  month = dec,
  eprint = {2312.06674},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2312.06674}
}

@inproceedings{rebedea2023nemo,
  title = {{NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails}},
  author = {Traian Rebedea and Razvan Dinu and Makesh Narsimhan Sreedhar and Christopher Parisien and Jonathan Cohen},
  year = {2023},
  month = oct,
  booktitle = {EMNLP 2023 Demo},
  eprint = {2310.10501},
  archivePrefix = {arXiv},
  doi = {10.18653/v1/2023.emnlp-demo.40},
  url = {https://arxiv.org/abs/2310.10501}
}

@article{yao2024survey,
  title = {{A Survey on Large Language Model (LLM) Security and Privacy: The Good, The Bad, and The Ugly}},
  author = {Yifan Yao and Jinhao Duan and Kaidi Xu and Yuanfang Cai and Zhibo Sun and Yue Zhang},
  year = {2024},
  month = mar,
  journal = {High-Confidence Computing},
  eprint = {2312.02003},
  archivePrefix = {arXiv},
  doi = {10.1016/j.hcc.2024.100211},
  url = {https://arxiv.org/abs/2312.02003}
}

@misc{schwinn2024adversarial,
  title = {{Adversarial Attacks and Defenses in Large Language Models: Old and New Threats}},
  author = {Leo Schwinn and David Dobre and Stephan Gunnemann and Gauthier Gidel},
  year = {2024},
  month = jan,
  eprint = {2310.19737},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2310.19737}
}

@misc{esmradi2024comprehensive,
  title = {{A Comprehensive Survey of Attack Techniques, Implementation, and Mitigation Strategies in Large Language Models}},
  author = {Aysan Esmradi and Daniel Wankit Yip and Chun Fai Chan},
  year = {2024},
  month = dec,
  eprint = {2312.10982},
  archivePrefix = {arXiv},
  doi = {10.1007/978-981-97-1274-8_6},
  url = {https://arxiv.org/abs/2312.10982}
}

@misc{debenedetti2024agentdojo,
  title = {{AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents}},
  author = {Edoardo Debenedetti and Jie Zhang and Mislav Balunovic and Luca Beurer-Kellner and Marc Fischer and Florian Tramer},
  year = {2024},
  month = jun,
  eprint = {2406.13352},
  archivePrefix = {arXiv},
  doi = {10.52202/079017-2636},
  url = {https://arxiv.org/abs/2406.13352}
}

@inproceedings{zhan2024injecagent,
  title = {{InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents}},
  author = {Qiusi Zhan and Zhixiang Liang and Zifan Ying and Daniel Kang},
  year = {2024},
  month = mar,
  booktitle = {ACL 2024 Findings},
  eprint = {2403.02691},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2403.02691}
}

@inproceedings{shen2023do,
  title = {{Do Anything Now: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models}},
  author = {Xinyue Shen and Zeyuan Chen and Michael Backes and Yun Shen and Yang Zhang},
  year = {2023},
  month = aug,
  booktitle = {CCS 2024},
  eprint = {2308.03825},
  archivePrefix = {arXiv},
  doi = {10.1145/3658644.3670388},
  url = {https://arxiv.org/abs/2308.03825}
}

@inproceedings{li2023multistep,
  title = {{Multi-step Jailbreaking Privacy Attacks on ChatGPT}},
  author = {Haoran Li and Dadi Guo and Wei Fan and Mingshi Xu and Jie Huang and Fanpu Meng and Yangqiu Song},
  year = {2023},
  month = apr,
  booktitle = {EMNLP 2023 Findings},
  eprint = {2304.05197},
  archivePrefix = {arXiv},
  doi = {10.18653/v1/2023.findings-emnlp.272},
  url = {https://arxiv.org/abs/2304.05197}
}

@inproceedings{kirchenbauer2023text,
  title = {{A Text Watermark for Large Language Models}},
  author = {John Kirchenbauer and Jonas Geiping and Yuxin Wen and Jonathan Katz and Ian Miers and Tom Goldstein},
  year = {2023},
  month = jun,
  booktitle = {ICML 2023},
  eprint = {2301.10226},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2301.10226}
}

@inproceedings{mireshghallah2024can,
  title = {{Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theory}},
  author = {Niloofar Mireshghallah and Hyunwoo Kim and Xuhui Zhou and Yulia Tsvetkov and Maarten Sap and Reza Shokri and Yejin Choi},
  year = {2024},
  month = jan,
  booktitle = {ICLR 2024},
  eprint = {2310.17884},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2310.17884}
}

@misc{liu2024machine,
  title = {{Machine Unlearning in Generative AI: A Survey}},
  author = {Zheyuan Liu and Guangyao Dou and Zhaoxuan Tan and Yijun Tian and Meng Jiang},
  year = {2024},
  eprint = {2407.20516},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2407.20516}
}

@misc{ganguli2022red,
  title = {{Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned}},
  author = {Deep Ganguli and Liane Lovitt and Jackson Kernion and Amanda Askell and Yuntao Bai and Saurav Kadavath and Ben Mann and Ethan Perez and Nicholas Schiefer and Kamal Ndousse and Andy Jones and Sam Bowman and Anna Chen and Tom Conerly and Nova DasSarma and Dawn Drain and Nelson Elhage and Sheer El-Showk and Stanislav Fort and Zac Hatfield-Dodds and Tom Henighan and Danny Hernandez and Tristan Hume and Josh Jacobson and Scott Johnston and Shauna Kravec and Catherine Olsson and Sam Ringer and Eli Tyre and Jared Kaplan and Chris Olah and Sam McCandlish and Dario Amodei},
  year = {2022},
  month = aug,
  eprint = {2209.07858},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2209.07858}
}

@misc{derczynski2024garak,
  title = {{Garak: A Framework for Security Probing Large Language Models}},
  author = {Leon Derczynski and Erick Galinkin and Jeffrey Martin and Subho Majumdar and Nanna Inie},
  year = {2024},
  month = jun,
  eprint = {2406.11036},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2406.11036}
}

@inproceedings{yuan2024rjudge,
  title = {{R-Judge: Benchmarking Safety Risk Awareness for LLM Agents}},
  author = {Tongxin Yuan and Zhiwei He and Lingzhong Dong and Yiming Wang and Ruijie Zhao and Tian Xia and Lizhen Xu and Binglin Zhou and Fangqi Li and Zhuosheng Zhang and Rui Wang and Gongshen Liu},
  year = {2024},
  month = jan,
  booktitle = {EMNLP 2024},
  eprint = {2401.10019},
  archivePrefix = {arXiv},
  doi = {10.18653/v1/2024.findings-emnlp.79},
  url = {https://arxiv.org/abs/2401.10019}
}

@techreport{wilson2025owasp,
  title = {{OWASP Top 10 for Large Language Model Applications}},
  author = {Steve Wilson and {OWASP LLM AI Security Team}},
  year = {2025},
  institution = {OWASP Foundation},
  url = {https://owasp.org/www-project-top-10-for-large-language-model-applications/}
}

@techreport{national2023nist,
  title = {{NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)}},
  author = {{National Institute of Standards and Technology}},
  year = {2023},
  month = jan,
  institution = {NIST},
  doi = {10.6028/NIST.AI.100-1},
  url = {https://www.nist.gov/itl/ai-risk-management-framework}
}

@techreport{mitre2024mitre,
  title = {{MITRE ATLAS: Adversarial Threat Landscape for AI Systems}},
  author = {{MITRE Corporation}},
  year = {2024},
  institution = {MITRE},
  url = {https://atlas.mitre.org/}
}

@techreport{veer2024owasp,
  title = {{OWASP AI Security and Privacy Guide}},
  author = {Rob van der Veer and {OWASP AI Exchange Team}},
  year = {2024},
  institution = {OWASP Foundation},
  url = {https://owasp.org/www-project-ai-security-and-privacy-guide/}
}

@techreport{anthropic2024anthropic,
  title = {{Anthropic: Many-shot Jailbreaking}},
  author = {{Anthropic}},
  year = {2024},
  month = apr,
  institution = {Anthropic Research Blog},
  url = {https://www.anthropic.com/research/many-shot-jailbreaking}
}

@misc{bai2022constitutional,
  title = {{Constitutional AI: Harmlessness from AI Feedback}},
  author = {Yuntao Bai and Saurav Kadavath and Sandipan Kundu and Amanda Askell and Jackson Kernion and Andy Jones and Anna Chen and Anna Goldie and Azalia Mirhoseini and Cameron McKinnon and Carol Chen and Catherine Olsson and Christopher Olah and Danny Hernandez and Dawn Drain and Deep Ganguli and Dustin Li and Eli Tyre and Ethan Perez and Jamie Kerr and Jared Kaplan and Jeffrey Ladish and Joshua Landau and Kamal Ndousse and Kamile Lukosiute and Liane Lovitt and Michael Sellitto and Nelson Elhage and Nicholas Schiefer and Noemi Mercado and Nova DasSarma and Robert Lasenby and Robin Larson and Sam Ringer and Scott Johnston and Shauna Kravec and Sheer El Showk and Stanislav Fort and Tamera Lanham and Timothy Telleen-Lawton and Tom Brown and Tom Henighan and Tristan Hume and Sam McCandlish and Jared Kaplan and Dario Amodei and Chris Olah},
  year = {2022},
  month = dec,
  eprint = {2212.08073},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2212.08073}
}

@article{liu2024prompt,
  title = {{Prompt Injection Attack Against LLM-Integrated Applications}},
  author = {Yi Liu and Gelei Deng and Yuekang Li and Kailong Wang and Tianwei Zhang and Yepang Liu and Haoyu Wang and Yan Zheng and Yang Liu},
  year = {2024},
  month = jun,
  journal = {ACM Computing Surveys},
  eprint = {2306.05499},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2306.05499}
}

@misc{protect2023rebuff,
  title = {{Rebuff: Self-Hardening Prompt Injection Detector}},
  author = {{Protect AI}},
  year = {2023},
  url = {https://github.com/protectai/rebuff}
}

@misc{microsoft2024pyrit,
  title = {{PyRIT: Python Risk Identification Toolkit for Generative AI}},
  author = {{Microsoft AI Red Team}},
  year = {2024},
  url = {https://github.com/Azure/PyRIT}
}

@misc{hubinger2024sleeper,
  title = {{Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training}},
  author = {Evan Hubinger and Carson Denison and Jesse Mu and Mike Lambert and Meg Tong and Monte MacDiarmid and Tamera Lanham and Daniel M. Ziegler and Tim Maxwell and Newton Cheng and Adam Jermyn and Amanda Askell and Ansh Radhakrishnan and Cem Anil and David Duvenaud and Deep Ganguli and Fazl Barez and Jack Clark and Kamal Ndousse and Kshitij Sachan and Michael Sellitto and Mrinank Sharma and Nova DasSarma and Roger Grosse and Shauna Kravec and Yuntao Bai and Jared Kaplan and Dario Amodei and Sam McCandlish and Ethan Perez},
  year = {2024},
  month = jan,
  eprint = {2401.05566},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2401.05566}
}

@inproceedings{toyer2024tensor,
  title = {{Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game}},
  author = {Sam Toyer and Olivia Watkins and Ethan Adrian Mendes and Justin Svegliato and Luke Bailey and Tiffany Wang and Isaac Ong and Karim Elmaaroufi and Pieter Abbeel and Trevor Darrell and Alan Ritter and Stuart Russell},
  year = {2024},
  month = jan,
  booktitle = {ICLR 2024},
  eprint = {2311.01011},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2311.01011}
}

@techreport{owasp2024owaspa,
  title = {{OWASP LLM AI Security \& Governance Checklist}},
  author = {{OWASP Foundation} and Sandy Dunn and Jackie McGuire},
  year = {2024},
  institution = {OWASP GenAI Security Project},
  url = {https://genai.owasp.org/resource/llm-applications-cybersecurity-and-governance-checklist-english/}
}

@article{woisetschlager2024federated,
  title = {{Federated Fine-Tuning of LLMs on the Very Edge: The Good, the Bad, the Ugly}},
  author = {Herbert Woisetschläger and Alexander Isenko and Shiqiang Wang and Ruben Mayer and Hans-Arno Jacobsen},
  year = {2024},
  journal = {DEEM@SIGMOD 2024},
  eprint = {2310.03150},
  archivePrefix = {arXiv},
  doi = {10.1145/3650203.3663331},
  url = {https://arxiv.org/abs/2310.03150}
}

@inproceedings{xue2024trojllm,
  title = {{TrojLLM: A Black-box Trojan Prompt Attack on Large Language Models}},
  author = {Jiaqi Xue and Mengxin Zheng and Ting Hua and Yilin Shen and Yepeng Liu and Ladislau Boloni and Qian Lou},
  year = {2024},
  month = may,
  booktitle = {NeurIPS 2023},
  eprint = {2306.06815},
  archivePrefix = {arXiv},
  doi = {10.52202/075280-2866},
  url = {https://arxiv.org/abs/2306.06815}
}

@misc{lermen2023lora,
  title = {{LoRA Fine-Tuning Efficiently Undoes Safety Training in Llama 2-Chat}},
  author = {Simon Lermen and Charlie Rogers-Smith and Jeffrey Ladish},
  year = {2023},
  month = oct,
  eprint = {2310.20624},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2310.20624}
}

@inproceedings{wei2024assessing,
  title = {{Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications}},
  author = {Boyi Wei and Kaixuan Huang and Yangsibo Huang and Tinghao Xie and Xiangyu Qi and Mengzhou Xia and Prateek Mittal and Mengdi Wang and Peter Henderson},
  year = {2024},
  booktitle = {ICML 2024},
  eprint = {2402.05162},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2402.05162}
}

@misc{roychowdhury2024confusedpilot,
  title = {{ConfusedPilot: Confused Deputy Risks in RAG-based LLMs}},
  author = {Ayush RoyChowdhury and Mulong Luo and Prateek Sahu and Sarbartha Banerjee and Mohit Tiwari},
  year = {2024},
  eprint = {2408.04870},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2408.04870}
}

@inproceedings{schick2023toolformer,
  title = {{Toolformer: Language Models Can Teach Themselves to Use Tools}},
  author = {Timo Schick and Jane Dwivedi-Yu and Roberto Dessi and Roberta Raileanu and Maria Lomeli and Eric Hambro and Luke Zettlemoyer and Nicola Cancedda and Thomas Scialom},
  year = {2023},
  month = feb,
  booktitle = {NeurIPS 2023},
  eprint = {2302.04761},
  archivePrefix = {arXiv},
  doi = {10.52202/075280-2997},
  url = {https://arxiv.org/abs/2302.04761}
}

@article{barrett2023identifying,
  title = {{Identifying and Mitigating the Security Risks of Generative AI}},
  author = {Clark Barrett and Brad Boyd and Elie Burzstein and Nicholas Carlini and Brad Chen and Jihye Choi and Amrita Roy Chowdhury and Mihai Christodorescu and Anupam Datta and Soheil Feizi and Kathleen Fisher and Tatsunori Hashimoto and Dan Hendrycks and Somesh Jha and Daniel Kang and Florian Kerschbaum and Eric Mitchell and John Mitchell and Zulfikar Ramzan and Khawaja Shams and Dawn Song and Ankur Taly and Diyi Yang},
  year = {2023},
  month = dec,
  journal = {Foundations and Trends in Privacy and Security},
  eprint = {2308.14840},
  archivePrefix = {arXiv},
  doi = {10.1561/3300000041},
  url = {https://arxiv.org/abs/2308.14840}
}

@techreport{ward2024ai,
  title = {{The AI Security Pyramid of Pain}},
  author = {Chris M. Ward and Josh Harguess and Julia Tao and Daniel Christman and Paul Spicer and Mike Tan},
  year = {2024},
  institution = {Proc. SPIE 13054, Assurance and Security for AI-enabled Systems},
  eprint = {2402.11082},
  archivePrefix = {arXiv},
  doi = {10.1117/12.3025025},
  url = {https://arxiv.org/abs/2402.11082}
}

@inproceedings{liu2024formalizing,
  title = {{Formalizing and Benchmarking Prompt Injection Attacks and Defenses}},
  author = {Yupei Liu and Yuqi Jia and Runpeng Geng and Jinyuan Jia and Neil Zhenqiang Gong},
  year = {2024},
  booktitle = {USENIX Security 2024},
  eprint = {2310.12815},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2310.12815}
}

@techreport{vassilev2024adversarial,
  title = {{Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025)}},
  author = {Apostol Vassilev and Alina Oprea and Alie Fordyce and Hyrum Anderson},
  year = {2024},
  month = jan,
  institution = {NIST},
  url = {https://csrc.nist.gov/pubs/ai/100/2/e2025/final}
}

@misc{fang2024llma,
  title = {{LLM Agents Can Autonomously Hack Websites}},
  author = {Richard Fang and Rohan Bindu and Akul Gupta and Qiusi Zhan and Daniel Kang},
  year = {2024},
  month = feb,
  eprint = {2402.06664},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2402.06664}
}

@misc{wang2024pandoras,
  title = {{Pandora's White-Box: Precise Training Data Detection and Extraction in Large Language Models}},
  author = {Jeffrey G. Wang and Jason Wang and Marvin Li and Seth Neel},
  year = {2024},
  eprint = {2402.17012},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2402.17012}
}

@techreport{owasp2025owasp,
  title = {{OWASP Top 10 for Agentic Applications 2026}},
  author = {{OWASP GenAI Security Project}},
  year = {2025},
  month = dec,
  institution = {OWASP GenAI Security Project},
  url = {https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/}
}

@inproceedings{pedro2024from,
  title = {{From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?}},
  author = {Rodrigo Pedro and Daniel Castro and Paolo Molina and Nuno Santos},
  year = {2024},
  month = aug,
  booktitle = {USENIX Security 2024},
  eprint = {2308.01990},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2308.01990}
}

@techreport{anthropic2024modela,
  title = {{Model Context Protocol (MCP): Security Best Practices}},
  author = {{Anthropic}},
  year = {2024},
  institution = {Anthropic Documentation},
  url = {https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices}
}

@misc{yi2024benchmarking,
  title = {{Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models}},
  author = {Jingwei Yi and Yueqi Xie and Bin Zhu and Keegan Hines and Emre Kiciman and Guangzhong Sun and Xing Xie and Fangzhao Wu},
  year = {2024},
  month = jan,
  eprint = {2312.14197},
  archivePrefix = {arXiv},
  doi = {10.1145/3690624.3709179},
  url = {https://arxiv.org/abs/2312.14197}
}

@techreport{mcgraw2024architectural,
  title = {{An Architectural Risk Analysis of Large Language Models: Applied Machine Learning Security}},
  author = {Gary McGraw and Harold Figueroa and Katie McMahon and Richie Bonett},
  year = {2024},
  month = jan,
  institution = {Berryville Institute of Machine Learning (BIML)},
  url = {https://berryvilleiml.com/docs/BIML-LLM24.pdf}
}

@misc{mazeika2024harmbench,
  title = {{HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal}},
  author = {Mantas Mazeika and Long Phan and Xuwang Yin and Andy Zou and Zifan Wang and Norman Mu and Elham Sakhaee and Nathaniel Li and Steven Basart and Bo Li and David Forsyth and Dan Hendrycks},
  year = {2024},
  month = feb,
  eprint = {2402.04249},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2402.04249}
}

@techreport{international2023isoiec,
  title = {{ISO/IEC 42001:2023 - Artificial Intelligence Management System}},
  author = {{International Organization for Standardization}},
  year = {2023},
  month = dec,
  institution = {ISO},
  url = {https://www.iso.org/standard/81230.html}
}

@inproceedings{liu2024autodan,
  title = {{AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models}},
  author = {Xiaogeng Liu and Nan Xu and Muhao Chen and Chaowei Xiao},
  year = {2024},
  booktitle = {ICLR 2024},
  eprint = {2310.04451},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2310.04451}
}

@inproceedings{mehrotra2024tree,
  title = {{Tree of Attacks: Jailbreaking Black-Box LLMs with Auto-Generated Subtrees}},
  author = {Anay Mehrotra and Manolis Zampetakis and Paul Kassianik and Blaine Nelson and Hyrum Anderson and Yaron Singer and Amin Karbasi},
  year = {2024},
  booktitle = {NeurIPS 2024},
  eprint = {2312.02119},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2312.02119}
}

@inproceedings{yuan2024gpt4,
  title = {{GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher}},
  author = {Youliang Yuan and Wenxiang Jiao and Wenxuan Wang and Jen-tse Huang and Pinjia He and Shuming Shi and Zhaopeng Tu},
  year = {2024},
  booktitle = {ICLR 2024},
  eprint = {2308.06463},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2308.06463}
}

@inproceedings{wang2024decodingtrust,
  title = {{DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models}},
  author = {Boxin Wang and Weixin Chen and Hengzhi Pei and Chulin Xie and Mintong Kang and Chenhui Zhang and Chejian Xu and Zidi Xiong and Ritik Dutta and Rylan Schaeffer},
  year = {2024},
  booktitle = {NeurIPS 2023},
  eprint = {2306.11698},
  archivePrefix = {arXiv},
  doi = {10.52202/075280-1361},
  url = {https://arxiv.org/abs/2306.11698}
}

@misc{bhatt2024purple,
  title = {{Purple Llama CyberSecEval: A Secure Coding Benchmark for Language Models}},
  author = {Manish Bhatt and Sahana Chennabasappa and Cyrus Nikolaidis and Shengye Wan and Ivan Evtimov},
  year = {2024},
  eprint = {2312.04724},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2312.04724}
}

@inproceedings{xiang2024badchain,
  title = {{BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models}},
  author = {Zhen Xiang and Fengqing Jiang and Zidi Xiong and Bhaskar Ramasubramanian and Radha Poovendran and Bo Li},
  year = {2024},
  booktitle = {NeurIPS 2024},
  eprint = {2401.12242},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2401.12242}
}

@article{chao2025jailbreaking,
  title = {{Jailbreaking Black Box Large Language Models in Twenty Queries}},
  author = {Patrick Chao and Alexander Robey and Edgar Dobriban and Hamed Hassani and George J. Pappas and Eric Wong},
  year = {2025},
  journal = {IEEE SaTML 2025},
  eprint = {2310.08419},
  archivePrefix = {arXiv},
  doi = {10.1109/SaTML64287.2025.00010},
  url = {https://arxiv.org/abs/2310.08419}
}

@misc{antebi2024gpt,
  title = {{GPT in Sheep's Clothing: The Risk of Customized GPTs}},
  author = {Sagiv Antebi and Noam Azulay and Edan Habler and Ben Ganon and Asaf Shabtai and Yuval Elovici},
  year = {2024},
  eprint = {2401.09075},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2401.09075}
}

@misc{deadbits2024vigil,
  title = {{Vigil: LLM Prompt Injection Detection and Defense Toolkit}},
  author = {DeadBits},
  year = {2024},
  url = {https://github.com/deadbits/vigil-llm}
}

@misc{guardrails2024guardrails,
  title = {{Guardrails AI: Input/Output Guards for LLM Applications}},
  author = {{Guardrails AI}},
  year = {2024},
  url = {https://github.com/guardrails-ai/guardrails}
}

@misc{protect2024llm,
  title = {{LLM Guard: Security Toolkit for LLM Interactions}},
  author = {{Protect AI}},
  year = {2024},
  url = {https://github.com/protectai/llm-guard}
}

@misc{he2024emerged,
  title = {{The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies}},
  author = {Feng He and Tianqing Zhu and Dayong Ye and Bo Liu and Wanlei Zhou and Philip S. Yu},
  year = {2024},
  eprint = {2407.19354},
  archivePrefix = {arXiv},
  doi = {10.1145/3773080},
  url = {https://arxiv.org/abs/2407.19354}
}

@inproceedings{andriushchenko2025jailbreaking,
  title = {{Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks}},
  author = {Maksym Andriushchenko and Francesco Croce and Nicolas Flammarion},
  year = {2025},
  booktitle = {ICLR 2025},
  eprint = {2404.02151},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2404.02151}
}

@inproceedings{zeng2024how,
  title = {{How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety}},
  author = {Yi Zeng and Hongpeng Lin and Jingwen Zhang and Diyi Yang and Ruoxi Jia and Weiyan Shi},
  year = {2024},
  booktitle = {ACL 2024},
  eprint = {2401.06373},
  archivePrefix = {arXiv},
  doi = {10.18653/v1/2024.acl-long.773},
  url = {https://arxiv.org/abs/2401.06373}
}

@techreport{anthropic2024modelb,
  title = {{Model Context Protocol (MCP): Specification}},
  author = {{Anthropic}},
  year = {2024},
  institution = {Anthropic / GitHub},
  url = {https://modelcontextprotocol.io/}
}

@techreport{anthropic2024anthropics,
  title = {{Anthropic's Responsible Scaling Policy}},
  author = {{Anthropic}},
  year = {2024},
  institution = {Anthropic Blog},
  url = {https://www.anthropic.com/news/anthropics-responsible-scaling-policy}
}

@techreport{openai2023openai,
  title = {{OpenAI: Preparedness Framework (Beta)}},
  author = {{OpenAI}},
  year = {2023},
  institution = {OpenAI Blog},
  url = {https://openai.com/safety/preparedness}
}

@techreport{parliament2024eu,
  title = {{EU AI Act: Regulation on Artificial Intelligence}},
  author = {European Parliament},
  year = {2024},
  institution = {Official Journal of the European Union},
  url = {https://eur-lex.europa.eu/eli/reg/2024/1689/oj}
}

@techreport{google2023google,
  title = {{Google: Secure AI Framework (SAIF)}},
  author = {{Google}},
  year = {2023},
  institution = {Google Security Blog},
  url = {https://safety.google/cybersecurity-advancements/saif/}
}

@techreport{bullwinkel2025lessons,
  title = {{Lessons From Red Teaming 100 Generative AI Products}},
  author = {Blake Bullwinkel and Amanda Minnich and Shiven Chawla and Gary Lopez and Martin Pouliot and Whitney Maxwell and Joris de Gruyter and Katherine Pratt and Saphir Qi and Nina Chikanov and Roman Lutz and Raja Sekhar Rao Dheekonda and Bolor-Erdene Jagdagdorj and Eugenia Kim and Justin Song and Keegan Hines and Daniel Jones and Giorgio Severi and Richard Lundeen and Sam Vaughan and Victoria Westerhoff and Pete Bryan and Ram Shankar Siva Kumar and Yonatan Zunger and Chang Kawaguchi and Mark Russinovich},
  year = {2025},
  institution = {arXiv preprint},
  eprint = {2501.07238},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2501.07238}
}

@misc{fang2024llmb,
  title = {{LLM Agents Can Autonomously Exploit One-day Vulnerabilities}},
  author = {Richard Fang and Rohan Bindu and Akul Gupta and Daniel Kang},
  year = {2024},
  eprint = {2404.08144},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2404.08144}
}

@inproceedings{wu2025dissecting,
  title = {{Dissecting Adversarial Robustness of Multimodal LM Agents}},
  author = {Chen Henry Wu and Rishi Shah and Jing Yu Koh and Ruslan Salakhutdinov and Daniel Fried and Aditi Raghunathan},
  year = {2025},
  booktitle = {ICLR 2025},
  eprint = {2406.12814},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2406.12814}
}

@inproceedings{yang2024sweagent,
  title = {{SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering}},
  author = {John Yang and Carlos E. Jimenez and Alexander Wettig and Kilian Lieret and Shunyu Yao and Karthik Narasimhan and Ofir Press},
  year = {2024},
  booktitle = {NeurIPS 2024},
  eprint = {2405.15793},
  archivePrefix = {arXiv},
  doi = {10.52202/079017-1601},
  url = {https://arxiv.org/abs/2405.15793}
}

@inproceedings{sun2024trustllm,
  title = {{TrustLLM: Trustworthiness in Large Language Models}},
  author = {Lichao Sun and Yue Huang and Haoran Wang and Siyuan Wu and Qihui Zhang},
  year = {2024},
  booktitle = {ICML 2024},
  eprint = {2401.05561},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2401.05561}
}

@misc{kapoor2024societal,
  title = {{On the Societal Impact of Open Foundation Models}},
  author = {Sayash Kapoor and Rishi Bommasani and Kevin Klyman and Shayne Longpre and Ashwin Ramaswami},
  year = {2024},
  eprint = {2403.07918},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2403.07918}
}

@inproceedings{carlini2024poisoning,
  title = {{Poisoning Web-Scale Training Datasets is Practical}},
  author = {Nicholas Carlini and Matthew Jagielski and Christopher A. Choquette-Choo and Daniel Paleka and Will Pearce and Hyrum Anderson and Andreas Terzis and Kurt Thomas and Florian Tramer},
  year = {2024},
  booktitle = {IEEE S\&P 2024},
  eprint = {2302.10149},
  archivePrefix = {arXiv},
  doi = {10.1109/sp54263.2024.00179},
  url = {https://arxiv.org/abs/2302.10149}
}

@inproceedings{qi2024visual,
  title = {{Visual Adversarial Examples Jailbreak Aligned Large Language Models}},
  author = {Xiangyu Qi and Kaixuan Huang and Ashwinee Panda and Peter Henderson and Mengdi Wang and Prateek Mittal},
  year = {2024},
  booktitle = {AAAI 2024},
  eprint = {2306.13213},
  archivePrefix = {arXiv},
  doi = {10.1609/aaai.v38i19.30150},
  url = {https://arxiv.org/abs/2306.13213}
}

@inproceedings{carlini2024are,
  title = {{Are Aligned Neural Networks Adversarially Aligned?}},
  author = {Nicholas Carlini and Milad Nasr and Christopher A. Choquette-Choo and Matthew Jagielski and Irena Gao and Anas Awadalla and Pang Wei Koh and Daphne Ippolito and Katherine Lee and Florian Tramer and Ludwig Schmidt},
  year = {2024},
  booktitle = {NeurIPS 2023},
  eprint = {2306.15447},
  archivePrefix = {arXiv},
  doi = {10.52202/075280-2687},
  url = {https://arxiv.org/abs/2306.15447}
}

@book{huang2024generative,
  title = {{Generative AI Security: Theories and Practices}},
  author = {Ken Huang and Yang Wang and Ben Goertzel and Yale Li and Sean Wright and Jyoti Ponnapalli},
  year = {2024},
  publisher = {Springer},
  url = {https://link.springer.com/book/10.1007/978-3-031-54252-7}
}

@inproceedings{yao2023react,
  title = {{ReAct: Synergizing Reasoning and Acting in Language Models}},
  author = {Shunyu Yao and Jeffrey Zhao and Dian Yu and Nan Du and Izhak Shafran and Karthik Narasimhan and Yuan Cao},
  year = {2023},
  booktitle = {ICLR 2023},
  eprint = {2210.03629},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2210.03629}
}

@inproceedings{wang2023voyager,
  title = {{Voyager: An Open-Ended Embodied Agent with Large Language Models}},
  author = {Guanzhi Wang and Yuqi Xie and Yunfan Jiang and Ajay Mandlekar and Chaowei Xiao and Yuke Zhu and Linxi Fan and Anima Anandkumar},
  year = {2023},
  booktitle = {NeurIPS 2023},
  eprint = {2305.16291},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2305.16291}
}

@misc{zhang2024safetybench,
  title = {{SafetyBench: Evaluating the Safety of Large Language Models}},
  author = {Zhexin Zhang and Leqi Lei and Lindong Wu and Rui Sun and Yongkang Huang},
  year = {2024},
  eprint = {2309.07045},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2309.07045}
}

@inproceedings{patil2024can,
  title = {{Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attacks}},
  author = {Vaidehi Patil and Peter Hase and Mohit Bansal},
  year = {2024},
  booktitle = {ICLR 2024},
  eprint = {2309.17410},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2309.17410}
}

@misc{han2024wildguard,
  title = {{WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs}},
  author = {Seungju Han and Kavel Rao and Allyson Ettinger and Liwei Jiang and Bill Yuchen Lin and Nathan Lambert and Yejin Choi and Nouha Dziri},
  year = {2024},
  eprint = {2406.18495},
  archivePrefix = {arXiv},
  doi = {10.52202/079017-0261},
  url = {https://arxiv.org/abs/2406.18495}
}

@inproceedings{souly2024strongreject,
  title = {{A StrongREJECT for Empty Jailbreaks}},
  author = {Alexandra Souly and Qingyuan Lu and Dillon Bowen and Tu Trinh and Elvis Hsieh and Sana Pandey and Pieter Abbeel and Justin Svegliato and Scott Emmons and Olivia Watkins and Sam Toyer},
  year = {2024},
  booktitle = {NeurIPS 2024 Datasets and Benchmarks},
  eprint = {2402.10260},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2402.10260}
}

@misc{owasp2024owaspb,
  title = {{OWASP Threat Dragon: AI-Aware Threat Modeling Tool}},
  author = {{OWASP Foundation}},
  year = {2024},
  url = {https://owasp.org/www-project-threat-dragon/}
}

@techreport{cybersecurity2023cisa,
  title = {{CISA: Roadmap for Artificial Intelligence}},
  author = {{Cybersecurity and Infrastructure Security Agency}},
  year = {2023},
  month = nov,
  institution = {CISA},
  url = {https://www.cisa.gov/resources-tools/resources/roadmap-ai}
}

@inproceedings{shen2024prompt,
  title = {{Prompt Stealing Attacks Against Text-to-Image Generation Models}},
  author = {Xinyue Shen and Yiting Qu and Michael Backes and Yang Zhang},
  year = {2024},
  booktitle = {USENIX Security 2024},
  eprint = {2302.09923},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2302.09923}
}

@misc{yang2023shadow,
  title = {{Shadow Alignment: The Ease of Subverting Safely-Aligned Language Models}},
  author = {Xianjun Yang and Xiao Wang and Qi Zhang and Linda Petzold and William Yang Wang and Xun Zhao and Dahua Lin},
  year = {2023},
  eprint = {2310.02949},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2310.02949}
}

@misc{wen2026metabackdoor,
  title = {{MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMs}},
  author = {Rui Wen and Mark Russinovich and Andrew Paverd and Jun Sakuma and Ahmed Salem},
  year = {2026},
  month = may,
  eprint = {2605.15172},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.15172}
}

@misc{iyer2026talk,
  title = {{Talk is (Not) Cheap: A Taxonomy and Benchmark Coverage Audit for LLM Attacks}},
  author = {Karthik Raghu Iyer and Yazdan Jamshidi and Nicholas Bray and Alexey A. Shvets},
  year = {2026},
  month = may,
  eprint = {2605.15118},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.15118}
}

@misc{zhang2026modelagnostic,
  title = {{Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution}},
  author = {Xiaozhe Zhang and Chaozhuo Li and Hui Liu and Shaocheng Yan and Bingyu Yan and Qiwei Ye and Haoliang Li},
  year = {2026},
  month = may,
  eprint = {2605.13411},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.13411}
}

@misc{topol2026quantifying,
  title = {{Quantifying LLM Safety Degradation Under Repeated Attacks Using Survival Analysis}},
  author = {Zvi Topol},
  year = {2026},
  month = may,
  eprint = {2605.12869},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.12869}
}

@misc{liang2026realista,
  title = {{REALISTA: Realistic Latent Adversarial Attacks that Elicit LLM Hallucinations}},
  author = {Buyun Liang and Jinqi Luo and Liangzu Peng and Kwan Ho Ryan Chan and Darshan Thaker and Kaleab A. Kinfu and Fengrui Tian and Hamed Hassani and René Vidal},
  year = {2026},
  month = may,
  eprint = {2605.12813},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.12813}
}

@misc{lyu2026badskp,
  title = {{BadSKP: Backdoor Attacks on Knowledge Graph-Enhanced LLMs with Soft Prompts}},
  author = {Xiaoting Lyu and Yufei Han and Hangwei Qian and Haoyuan Yu and Xiang Ao and Bin Wang and Chenxu Wang and Xiaobo Ma and Wei Wang},
  year = {2026},
  month = may,
  eprint = {2605.11996},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11996}
}

@misc{liu2026whena,
  title = {{When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Models}},
  author = {Ziyu Liu and Tao Li and Tianjie Ni and Xiaolong Lan and Wengang Ma and Tao Yang and Guohua Wang and Junjiang He},
  year = {2026},
  month = may,
  eprint = {2605.11612},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11612}
}

@misc{li2026flowsteer,
  title = {{FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems}},
  author = {Fanxiao Li and Jiaying Wu and Tingchao Fu and Natasha Jaques and Wei Zhou and Min-Yen Kan},
  year = {2026},
  month = may,
  eprint = {2605.11514},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11514}
}

@misc{susan2026benchmarking,
  title = {{Benchmarking LLM-Based Static Analysis for Secure Smart Contract Development: Reliability, Limitations, and Potential Hybrid Solutions}},
  author = {Stefan-Claudiu Susan and Andrei Arusoaie and Dorel Lucanu},
  year = {2026},
  month = may,
  eprint = {2605.11163},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11163}
}

@misc{zavrak2026mcpshield,
  title = {{MCPShield: Content-Aware Attack Detection for LLM Agent Tool-Call Traffic}},
  author = {Sultan Zavrak},
  year = {2026},
  month = may,
  eprint = {2605.11053},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11053}
}

@misc{fan2026granularity,
  title = {{The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck}},
  author = {Linfeng Fan and Ziwei Li and Yuan Tian and Yichen Wang and Rongsheng Li and Xiong Wang},
  year = {2026},
  month = may,
  eprint = {2605.11039},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11039}
}

@misc{hossain2026art,
  title = {{The Art of the Jailbreak: Formulating Jailbreak Attacks for LLM Security Beyond Binary Scoring}},
  author = {Ismail Hossain and Tanzim Ahad and Md Jahangir Alam and Sai Puppala and Syed Bahauddin Alam and Sajedul Talukder},
  year = {2026},
  month = may,
  eprint = {2605.09225},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09225}
}

@misc{yoon2026fewshot,
  title = {{Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs}},
  author = {Sangyeon Yoon and Wonje Jeung and Yoonjun Cho and Dongjae Jeon and Albert No},
  year = {2026},
  month = may,
  eprint = {2605.10998},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.10998}
}

@misc{lian2026llmagnostic,
  title = {{LLM-Agnostic Semantic Representation Attack}},
  author = {Jiawei Lian and Jianhong Pan and Lefan Wang and Yi Wang and Tairan Huang and Shaohui Mei and Lap-Pui Chau},
  year = {2026},
  month = may,
  eprint = {2605.08898},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08898}
}

@misc{qi2026when,
  title = {{When LLMs Team Up: A Coordinated Attack Framework for Automated Cyber Intrusions}},
  author = {Minfeng Qi and Tianqing Zhu and Zijie Xu and Congcong Zhu and Qin Wang and Wanlei Zhou},
  year = {2026},
  month = may,
  eprint = {2605.08763},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08763}
}

@misc{zhenxin2026pasa,
  title = {{PASA: A Principled Embedding-Space Watermarking Approach for LLM-Generated Text under Semantic-Invariant Attacks}},
  author = {{Zhenxin Ai} and Haiyun He},
  year = {2026},
  month = may,
  eprint = {2605.10977},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.10977}
}

@misc{lim2026cybiasbench,
  title = {{CyBiasBench: Benchmarking Bias in LLM Agents for Cyber-Attack Scenarios}},
  author = {Taein Lim and Seongyong Ju and Munhyeok Kim and Hyunjun Kim and Hoki Kim},
  year = {2026},
  month = may,
  eprint = {2605.07830},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.07830}
}

@misc{sun2026insider,
  title = {{Insider Attacks in Multi-Agent LLM Consensus Systems}},
  author = {Xiaolin Sun and Zixuan Liu and Yibin Hu and Zizhan Zheng},
  year = {2026},
  month = may,
  eprint = {2605.08268},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08268}
}

@misc{li2026securityauditable,
  title = {{Towards Security-Auditable LLM Agents: A Unified Graph Representation}},
  author = {Chaofan Li and Lyuye Zhang and Jintao Zhai and Siyue Feng and Xichun Yang and Huahao Wang and Shihan Dou and Yu Ji and Yutao Hu and Yueming Wu and Yang Liu and Deqing Zou},
  year = {2026},
  month = may,
  eprint = {2605.06812},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06812}
}

@misc{chen2026pop,
  title = {{Pop Quiz Attack: Black-box Membership Inference Attacks Against Large Language Models}},
  author = {Zeyuan Chen and Yihan Ma and Xinyue Shen and Michael Backes and Yang Zhang},
  year = {2026},
  month = may,
  eprint = {2605.06423},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06423}
}

@misc{wang2026correct,
  title = {{Correct Code, Vulnerable Dependencies: A Large Scale Measurement Study of LLM-Specified Library Versions}},
  author = {Chengjie Wang and Jingzheng Wu and Xiang Ling and Tianyue Luo and Chen Zhao},
  year = {2026},
  month = may,
  eprint = {2605.06279},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06279}
}

@misc{xu2026sok,
  title = {{SoK: Robustness in Large Language Models against Jailbreak Attacks}},
  author = {Feiyue Xu and Hongsheng Hu and Chaoxiang He and Sheng Hang and Hanqing Hu and Xiuming Liu and Yubo Zhao and Zhengyan Zhou and Bin Benjamin Zhu and Shi-Feng Sun and Dawu Gu and Shuo Wang},
  year = {2026},
  month = may,
  eprint = {2605.05058},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.05058}
}

@misc{fei2026misrouter,
  title = {{Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMs}},
  author = {Zekun Fei and Zihao Wang and Weijie Liu and Ruiqi He and Jianing Geng and Zheli Liu and XiaoFeng Wang},
  year = {2026},
  month = may,
  eprint = {2605.04446},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.04446}
}

@misc{zhang2026exposing,
  title = {{Exposing LLM Safety Gaps Through Mathematical Encoding:New Attacks and Systematic Analysis}},
  author = {Haoyu Zhang and Mohammad Zandsalimy and Shanu Sushmita},
  year = {2026},
  month = may,
  eprint = {2605.03441},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.03441}
}

@misc{luo2026when,
  title = {{When Alignment Isn't Enough: Response-Path Attacks on LLM Agents}},
  author = {Mingyu Luo and Zihan Zhang and Zesen Liu and Yuchong Xie and Zhixiang Zhang and Dung Hiu Hilton Yeung and Wai Ip Lai and Ping Chen and Ming Wen and Dongdong She},
  year = {2026},
  month = may,
  eprint = {2605.02187},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.02187}
}

@misc{ameen2026qasecclaw,
  title = {{QASecClaw: A Multi-Agent LLM Approach for False Positive Reduction in Static Application Security Testing}},
  author = {Mohd Ruhul Ameen and Md Takrim Ul Alam and Akif Islam},
  year = {2026},
  month = may,
  eprint = {2605.01885},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.01885}
}

@misc{jamshidi2026selfadaptive,
  title = {{Self-Adaptive Multi-Agent LLM-Based Security Pattern Selection for IoT Systems}},
  author = {Saeid Jamshidi and Foutse Khomh and Carol Fung and Kawser Wazed Nafi},
  year = {2026},
  month = may,
  eprint = {2605.00741},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00741}
}

@misc{xu2026routehijack,
  title = {{RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMs}},
  author = {Zhiyuan Xu and Joseph Gardiner and Sana Belguith and Lichao Wu},
  year = {2026},
  month = may,
  eprint = {2605.02946},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.02946}
}

@misc{kulkarni2026latent,
  title = {{Latent Adversarial Detection: Adaptive Probing of LLM Activations for Multi-Turn Attack Detection}},
  author = {Prashant Kulkarni},
  year = {2026},
  month = apr,
  eprint = {2604.28129},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.28129}
}

@misc{chen2026howa,
  title = {{How Code Representation Shapes False-Positive Dynamics in Cross-Language LLM Vulnerability Detection}},
  author = {Maofei Chen and Laifu Wang and Yue Qin and Yuan Wang and Bo Wu and Dongxin Liu},
  year = {2026},
  month = apr,
  eprint = {2604.27714},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.27714}
}

@misc{song2026membership,
  title = {{Membership Inference Attacks Against Video Large Language Models}},
  author = {Wei Song and Yuxin Cao and Ziqi Ding and Yi Liu and Gelei Deng and Yuekang Li},
  year = {2026},
  month = apr,
  eprint = {2604.27002},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.27002}
}

@misc{cao2026ward,
  title = {{WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections}},
  author = {Tri Cao and Yulin Chen and Hieu Cao and Yibo Li and Khoi Le and Thong Nguyen and Yuexin Li and Yufei He and Yue Liu and Shuicheng Yan and Bryan Hooi},
  year = {2026},
  month = may,
  eprint = {2605.15030},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.15030}
}

@misc{wang2026eva,
  title = {{EVA: Editing for Versatile Alignment against Jailbreaks}},
  author = {Yi Wang and Hongye Qiu and Yue Xu and Sibei Yang and Zhan Qin and Minlie Huang and Wenjie Wang},
  year = {2026},
  month = may,
  eprint = {2605.14750},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.14750}
}

@misc{monteuuis2026great,
  title = {{The Great Pretender: A Stochasticity Problem in LLM Jailbreak}},
  author = {Jean-Philippe Monteuuis and Cong Chen and Jonathan Petit},
  year = {2026},
  month = may,
  eprint = {2605.14418},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.14418}
}

@misc{li2026no,
  title = {{No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills}},
  author = {Ying Li and Hongbo Wen and Yanju Chen and Hanzhi Liu and Yuan Tian and Yu Feng},
  year = {2026},
  month = may,
  eprint = {2605.13044},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.13044}
}

@misc{mavali2026no,
  title = {{No More, No Less: Task Alignment in Terminal Agents}},
  author = {Sina Mavali and David Pape and Jonathan Evertz and Samira Abedini and Devansh Srivastav and Thorsten Eisenhofer and Sahar Abdelnabi and Lea Schönherr},
  year = {2026},
  month = may,
  eprint = {2605.12233},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.12233}
}

@misc{chiapei2026ipiproxy,
  title = {{IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection}},
  author = {Chia-Pei and Chen and Kentaroh Toyoda and Anita Lai and Alex Leung},
  year = {2026},
  month = may,
  eprint = {2605.11868},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11868}
}

@misc{morasso2026personaconditioneda,
  title = {{Persona-Conditioned Adversarial Prompting (PCAP): Multi-Identity Red-Teaming for Enhanced Adversarial Prompt Discovery}},
  author = {Cristian Morasso and Anisa Halimi and Muhammad Zaid Hameed and Douglas Leith},
  year = {2026},
  month = may,
  eprint = {2605.12565},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.12565}
}

@misc{morasso2026personaconditionedb,
  title = {{Persona-Conditioned Adversarial Prompting: Multi-Identity Red-Teaming for Adversarial Discovery and Mitigation}},
  author = {Cristian Morasso and Anisa Halimi and Muhammad Zaid Hameed and Douglas Leith},
  year = {2026},
  month = may,
  eprint = {2605.11730},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11730}
}

@misc{xu2026safety,
  title = {{Safety Context Injection: Inference-Time Safety Alignment via Static Filtering and Agentic Analysis}},
  author = {Zhenhao Xu and Wenhan Chang and Yichuan Chen and Yuxin Fang and Junhao Liu and Tianqing Zhu},
  year = {2026},
  month = may,
  eprint = {2605.11664},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11664}
}

@misc{zhang2026litmus,
  title = {{LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments}},
  author = {Chiyu Zhang and Huiqin Yang and Bendong Jiang and Xiaolei Zhang and Yiran Zhao and Ruyi Chen and Lu Zhou and Xiaogang Xu and Jiafei Wu and Liming Fang and Zhe Liu},
  year = {2026},
  month = may,
  eprint = {2605.10779},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.10779}
}

@misc{lin2026retriggering,
  title = {{Re-Triggering Safeguards within LLMs for Jailbreak Detection}},
  author = {Zheng Lin and Zhenxing Niu and Haoxuan Ji and Yuzhe Huang and Haichang Gao},
  year = {2026},
  month = may,
  eprint = {2605.10611},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.10611}
}

@misc{lin2026guaranteed,
  title = {{Guaranteed Jailbreaking Defense via Disrupt-and-Rectify Smoothing}},
  author = {Zheng Lin and Zhenxing Niu and Haoxuan Ji and Haichang Gao},
  year = {2026},
  month = may,
  eprint = {2605.10582},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.10582}
}

@misc{kereopayorke2026oracle,
  title = {{Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoning}},
  author = {Ben Kereopa-Yorke and Guillermo Diaz and Holly Wright and Reagan Johnston and Ron F. Del Rosario and Timothy Lynar},
  year = {2026},
  month = may,
  eprint = {2605.09822},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09822}
}

@misc{rassul2026agentshield,
  title = {{AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents}},
  author = {Yassin H. Rassul and Tarik A. Rashid},
  year = {2026},
  month = may,
  eprint = {2605.11026},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11026}
}

@misc{riegler2026position,
  title = {{Position: AI Security Policy Should Target Systems, Not Models}},
  author = {Michael A. Riegler and Inga Strümke},
  year = {2026},
  month = may,
  eprint = {2605.09504},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09504}
}

@misc{zhang2026mtjailbench,
  title = {{MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks}},
  author = {Xinkai Zhang and Zhipeng Wei and Huanli Gong and Jing Ting Zheng and Yuchen Zhang and Yue Dong and N. Benjamin Erichson},
  year = {2026},
  month = may,
  eprint = {2605.11002},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11002}
}

@misc{maple2026singleconfiguration,
  title = {{Single-Configuration Attack Success Rate Is Not Enough: Jailbreak Evaluations Should Report Distributional Attack Success}},
  author = {Carsten Maple and Abhishek Kumar and Riya Tapwal},
  year = {2026},
  month = may,
  eprint = {2605.09070},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09070}
}

@misc{chen2026why,
  title = {{Why Do Aligned LLMs Remain Jailbreakable: Refusal-Escape Directions, Operator-Level Sources, and Safety-Utility Trade-off}},
  author = {Yu Chen and Yuanhao Liu and Qi Cao},
  year = {2026},
  month = may,
  eprint = {2605.08878},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08878}
}

@misc{cai2026when,
  title = {{When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks}},
  author = {Ziwen Cai and Yihe Zhang and Xiali Hei},
  year = {2026},
  month = may,
  eprint = {2605.08460},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08460}
}

@misc{zaratiana2026gliguard,
  title = {{GLiGuard: Schema-Conditioned Classification for LLM Safeguard}},
  author = {Urchade Zaratiana and Mary Newhauser and George Hurn-Maloney and Ash Lewis},
  year = {2026},
  month = may,
  eprint = {2605.07982},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.07982}
}

@misc{liu2026webtrap,
  title = {{WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation}},
  author = {Zhichao Liu and Wenbo Pan and Haining Yu and Ge Gao and Tianqing Zhu and Xiaohua Jia},
  year = {2026},
  month = may,
  eprint = {2605.08310},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08310}
}

@misc{chen2026orchjail,
  title = {{OrchJail: Jailbreaking Tool-Calling Text-to-Image Agents by Orchestration-Guided Fuzzing}},
  author = {Jianming Chen and Yawen Wang and Junjie Wang and Zhe Liu and Qing Wang and Fanjiang Xu},
  year = {2026},
  month = may,
  eprint = {2605.07414},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.07414}
}

@misc{chen2026mitigating,
  title = {{Mitigating Many-shot Jailbreak Attacks with One Single Demonstration}},
  author = {Kejia Chen and Jiawen Zhang and Boheng Li and Pengcheng Li and Jian Lou and Zunlei Feng and Mingli Song and Ruoxi Jia and Tianwei Zhang},
  year = {2026},
  month = may,
  eprint = {2605.08277},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08277}
}

@misc{lu2026constraining,
  title = {{Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation}},
  author = {Di Lu and Bo Zhang and Xiyuan Li and Yongzhi Liao and Xuewen Dong and Yulong Shen and Zhiquan Liu and Jianfeng Ma},
  year = {2026},
  month = may,
  eprint = {2605.06393},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06393}
}

@misc{datta2026waaa,
  title = {{WAAA! Web Adversaries Against Agentic Browsers}},
  author = {Sohom Datta and Alex Nahapetyan and William Enck and Alexandros Kapravelos},
  year = {2026},
  month = may,
  eprint = {2605.05509},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.05509}
}

@misc{fang2026sparse,
  title = {{Sparse Tokens Suffice: Jailbreaking Audio Language Models via Token-Aware Gradient Optimization}},
  author = {Zheng Fang and Xiaosen Wang and Shenyi Zhang and Shaokang Wang and Zhijin Ge},
  year = {2026},
  month = may,
  eprint = {2605.04700},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.04700}
}

@misc{kim2026securemcpa,
  title = {{SecureMCP: A Policy-Enforced LLM Data Access Framework for AIoT Systems via Model Context Protocol}},
  author = {Wonbae Kim and Hee-Kyong Yoo},
  year = {2026},
  month = may,
  eprint = {2605.05260},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.05260}
}

@misc{zhang2026laundering,
  title = {{Laundering AI Authority with Adversarial Examples}},
  author = {Jie Zhang and Pura Peetathawatchai and Florian Tramèr and Avital Shafran},
  year = {2026},
  month = may,
  eprint = {2605.04261},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.04261}
}

@misc{dheekonda2026redefining,
  title = {{Redefining AI Red Teaming in the Agentic Era: From Weeks to Hours}},
  author = {Raja Sekhar Rao Dheekonda and Will Pearce and Nick Landers},
  year = {2026},
  month = may,
  eprint = {2605.04019},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.04019}
}

@misc{weng2026argus,
  title = {{ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection}},
  author = {Shihao Weng and Yang Feng and Jinrui Zhang and Xiaofei Xie and Jiongchi Yu and Jia Liu},
  year = {2026},
  month = may,
  eprint = {2605.03378},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.03378}
}

@misc{gupta2026selfmined,
  title = {{Self-Mined Hardness for Safety Fine-Tuning}},
  author = {Prakhar Gupta and Garv Shah and Donghua Zhang},
  year = {2026},
  month = may,
  eprint = {2605.03226},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.03226}
}

@misc{forough2026when,
  title = {{When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI}},
  author = {Javad Forough and Marios Kogias and Hamed Haddadi},
  year = {2026},
  month = may,
  eprint = {2605.03213},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.03213}
}

@misc{liu2026piiguard,
  title = {{PIIGuard: Mitigating PII Harvesting under Adversarial Sanitization}},
  author = {Mingshuo Liu and Yiwei Zha and Min Chen},
  year = {2026},
  month = may,
  eprint = {2605.03129},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.03129}
}

@misc{derya2026revisiting,
  title = {{Revisiting JBShield: Breaking and Rebuilding Representation-Level Jailbreak Defenses}},
  author = {Kemal Derya and Berk Sunar},
  year = {2026},
  month = may,
  eprint = {2605.03095},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.03095}
}

@misc{bejar2026contextualjailbreak,
  title = {{ContextualJailbreak: Evolutionary Red-Teaming via Simulated Conversational Priming}},
  author = {Mario Rodríguez Béjar and Francisco J. Cortés-Delgado and S. Braghin and Jose L. Hernández-Ramos},
  year = {2026},
  month = may,
  eprint = {2605.02647},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.02647}
}

@misc{gong2026localalign,
  title = {{LocalAlign: Enabling Generalizable Prompt Injection Defense via Generation of Near-Target Adversarial Examples for Alignment Training}},
  author = {Yuyang Gong and Zihao Wang and Jiawei Liu and XiaoFeng Wang},
  year = {2026},
  month = may,
  eprint = {2605.01462},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.01462}
}

@misc{liu2026visinject,
  title = {{VisInject: Disruption != Injection -- A Dual-Dimension Evaluation of Universal Adversarial Attacks on Vision-Language Models}},
  author = {Pang Liu and Yingjie Lao},
  year = {2026},
  month = may,
  eprint = {2605.01449},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.01449}
}

@misc{li2026srtj,
  title = {{SRTJ: Self-Evolving Rule-Driven Training-Free LLM Jailbreaking}},
  author = {Jindong Li and Ying Liu and Yali Fu and Jinjing Zhu and Leyao Wang and Menglin Yang and Rex Ying},
  year = {2026},
  month = may,
  eprint = {2605.00974},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00974}
}

@misc{jin2026cleanbase,
  title = {{CleanBase: Detecting Malicious Documents in RAG Knowledge Databases}},
  author = {Weifei Jin and Xilong Wang and Wei Zou and Jinyuan Jia and Neil Gong},
  year = {2026},
  month = may,
  eprint = {2605.00460},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00460}
}

@misc{thornton2026can,
  title = {{Can Adversarial Code Comments Fool AI Security Reviewers -- Large-Scale Empirical Study of Comment-Based Attacks and Defenses Against LLM Code Analysis}},
  author = {Scott Thornton},
  year = {2026},
  month = feb,
  eprint = {2602.16741},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2602.16741}
}

@misc{chhabra2025agentic,
  title = {{Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges}},
  author = {Anshuman Chhabra and Shrestha Datta and Shahriar Kabir Nahin and Prasant Mohapatra},
  year = {2025},
  month = oct,
  eprint = {2510.23883},
  archivePrefix = {arXiv},
  doi = {10.1109/ACCESS.2026.3675554},
  url = {https://arxiv.org/abs/2510.23883}
}

@misc{zhai2026baddlm,
  title = {{BadDLM: Backdooring Diffusion Language Models with Diverse Targets}},
  author = {Shengfang Zhai and Xiaoyang Ji and Yuling Shi and Haoran Gao and Fanyu Meng and Yan Zeng and Yuejian Fang and Yinpeng Dong and Jiaheng Zhang},
  year = {2026},
  month = may,
  eprint = {2605.09397},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09397}
}

@misc{sheng2026when,
  title = {{When Agents Overtrust Environmental Evidence: An Extensible Agentic Framework for Benchmarking Evidence-Grounding Defects in LLM Agents}},
  author = {Strick Sheng and Ziyue Wang and Liyi Zhou},
  year = {2026},
  month = may,
  eprint = {2605.08828},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.08828}
}

@misc{wang2026crossmodal,
  title = {{Cross-Modal Backdoors in Multimodal Large Language Models}},
  author = {Runhe Wang and Li Bai and Haibo Hu and Songze Li},
  year = {2026},
  month = may,
  eprint = {2605.07490},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.07490}
}

@misc{korn2026architecture,
  title = {{Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning}},
  author = {Samuel Korn},
  year = {2026},
  month = may,
  eprint = {2605.05632},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.05632}
}

@misc{guo2026cbv,
  title = {{CBV: Clean-label Backdoor Attacks on Vision Language Models via Diffusion Models}},
  author = {Ji Guo and Xiaolong Qin and Cencen Liu and Jielei Wang and Jierun Chen and Wenbo Jiang},
  year = {2026},
  month = may,
  eprint = {2605.02202},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.02202}
}

@misc{rezakhani2026safetune,
  title = {{SafeTune: Mitigating Data Poisoning in LLM Fine-Tuning for RTL Code Generation}},
  author = {Mahshid Rezakhani and Nowfel Mashnoor and Kimia Azar and Hadi Kamali},
  year = {2026},
  month = apr,
  eprint = {2604.27238},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.27238}
}

@misc{kumar2026permafrostattack,
  title = {{PermaFrost-Attack: Stealth Pretraining Seeding(SPS) for planting Logic Landmines During LLM Training}},
  author = {Harsh Kumar and Rahul Maity and Tanmay Joshi and Aman Chadha and Vinija Jain and Suranjana Trivedy and Amitava Das},
  year = {2026},
  month = apr,
  eprint = {2604.22117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.22117}
}

@misc{wei2026stealthy,
  title = {{Stealthy Backdoor Attacks against LLMs Based on Natural Style Triggers}},
  author = {Jiali Wei and Ming Fan and Guoheng Sun and Xicheng Zhang and Haijun Wang and Ting Liu},
  year = {2026},
  month = apr,
  eprint = {2604.21700},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.21700}
}

@misc{wang2026projlens,
  title = {{ProjLens: Unveiling the Role of Projectors in Multimodal Model Safety}},
  author = {Kun Wang and Cheng Qian and Miao Yu and Lilan Peng and Liang Lin and Jiaming Zhang and Tianyu Zhang and Yu Cheng and Yang Wang},
  year = {2026},
  month = apr,
  eprint = {2604.19083},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.19083}
}

@misc{lin2026survey,
  title = {{A Survey on the Security of Long-Term Memory in LLM Agents: Toward Mnemonic Sovereignty}},
  author = {Zehao Lin and Chunyu Li and Kai Chen},
  year = {2026},
  month = apr,
  eprint = {2604.16548},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.16548}
}

@misc{abdennebi2026fully,
  title = {{Fully Homomorphic Encryption on Llama 3 model for privacy preserving LLM inference}},
  author = {Anes Abdennebi and Nadjia Kara and Laaziz Lahlou},
  year = {2026},
  month = apr,
  eprint = {2604.12168},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.12168}
}

@misc{truong2026criticalcot,
  title = {{Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models}},
  author = {Vu Tuan Truong and Long Bao Le},
  year = {2026},
  month = apr,
  eprint = {2604.10681},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.10681}
}

@misc{chen2026ducodemark,
  title = {{DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark-Poison Design}},
  author = {Yuchen Chen and Yuan Xiao and Chunrong Fang and Zhenyu Chen and Baowen Xu},
  year = {2026},
  month = apr,
  eprint = {2604.10611},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.10611}
}

@misc{guo2026backdoors,
  title = {{Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Reward}},
  author = {Weiyang Guo and Zesheng Shi and Zeen Zhu and Yuan Zhou and Min Zhang and Jing Li},
  year = {2026},
  month = apr,
  eprint = {2604.09748},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.09748}
}

@misc{liu2026your,
  title = {{Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain}},
  author = {Hanzhi Liu and Chaofan Shou and Hongbo Wen and Yanju Chen and Ryan Jingyang Fang and Yu Feng},
  year = {2026},
  month = apr,
  eprint = {2604.08407},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.08407}
}

@misc{tran2026phantasia,
  title = {{Phantasia: Context-Adaptive Backdoors in Vision Language Models}},
  author = {Nam Duong Tran and Phi Le Nguyen},
  year = {2026},
  month = apr,
  eprint = {2604.08395},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.08395}
}

@misc{zeng2026miragebackdoor,
  title = {{MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning}},
  author = {Yizhe Zeng and Wei Zhang and Yunpeng Li and Juxin Xiao and Xiao Wang and Yuling Liu},
  year = {2026},
  month = apr,
  eprint = {2604.06840},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.06840}
}

@misc{zhu2026feddetox,
  title = {{FedDetox: Robust Federated SLM Alignment via On-Device Data Sanitization}},
  author = {Shunan Zhu and Jiawei Chen and Yonghao Yu and Hideya Ochiai},
  year = {2026},
  month = apr,
  eprint = {2604.06833},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.06833}
}

@misc{wang2026multimodal,
  title = {{Multimodal Backdoor Attack on VLMs for Autonomous Driving via Graffiti and Cross-Lingual Triggers}},
  author = {Jiancheng Wang and Lidan Liang and Yong Wang and Zengzhen Su and Haifeng Xia and Yuanting Yan and Wei Wang},
  year = {2026},
  month = apr,
  eprint = {2604.04630},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.04630}
}

@misc{xie2026from,
  title = {{From Prompt to Physical Action: Structured Backdoor Attacks on LLM-Mediated Robotic Control Systems}},
  author = {Mingyang Xie and Jin Wei-Kocsis},
  year = {2026},
  month = apr,
  eprint = {2604.03890},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.03890}
}

@misc{xiao2026logicpoison,
  title = {{LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation}},
  author = {Yilin Xiao and Jin Chen and Qinggang Zhang and Yujing Zhang and Chuang Zhou and Longhao Yang and Lingfei Ren and Xin Yang and Xiao Huang},
  year = {2026},
  month = apr,
  eprint = {2604.02954},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.02954}
}

@misc{ersoy2026backdoor,
  title = {{Backdoor Attacks on Decentralised Post-Training}},
  author = {Oğuzhan Ersoy and Nikolay Blagoev and Jona te Lintelo and Stefanos Koffas and Marina Krček and Stjepan Picek},
  year = {2026},
  month = mar,
  eprint = {2604.02372},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.02372}
}

@misc{jain2026adversarial,
  title = {{Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey}},
  author = {Bhavuk Jain and Sercan Ö. Arık and Hardeo K. Thakur},
  year = {2026},
  month = mar,
  eprint = {2603.27918},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.27918}
}

@misc{yao2026hidden,
  title = {{Hidden Ads: Behavior Triggered Semantic Backdoors for Advertisement Injection in Vision Language Models}},
  author = {Duanyi Yao and Changyue Li and Zhicong Huang and Cheng Hong and Songze Li},
  year = {2026},
  month = mar,
  eprint = {2603.27522},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.27522}
}

@misc{koilakos2026poisoning,
  title = {{Poisoning the Genome: Targeted Backdoor Attacks on DNA Foundation Models}},
  author = {Charalampos Koilakos and Ioannis Mouratidis and Ilias Georgakopoulos-Soares},
  year = {2026},
  month = mar,
  eprint = {2603.27465},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.27465}
}

@misc{wang2026pidpattack,
  title = {{PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems}},
  author = {Haozhen Wang and Haoyue Liu and Jionghao Zhu and Zhichao Wang and Yongxin Guo and Xiaoying Tang},
  year = {2026},
  month = mar,
  eprint = {2603.25164},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.25164}
}

@misc{miao2026dp2vl,
  title = {{DP\textasciicircum{}2-VL: Private Photo Dataset Protection by Data Poisoning for Vision-Language Models}},
  author = {Hongyi Miao and Jun Jia and Xincheng Wang and Qianli Ma and Wei Sun and Wangqiu Zhou and Dandan Zhu and Yewen Cao and Zhi Liu and Guangtao Zhai},
  year = {2026},
  month = mar,
  eprint = {2603.23925},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.23925}
}

@misc{yin2026progrank,
  title = {{ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning}},
  author = {Xiangyu Yin and Yi Qi and Chih-Hong Cheng},
  year = {2026},
  month = mar,
  eprint = {2603.22934},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.22934}
}

@misc{dehghantanha2026sok,
  title = {{SoK: The Attack Surface of Agentic AI -- Tools, and Autonomy}},
  author = {Ali Dehghantanha and Sajad Homayoun},
  year = {2026},
  month = mar,
  eprint = {2603.22928},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.22928}
}

@misc{mu2026secure,
  title = {{Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks}},
  author = {Yanming Mu and Hao Hu and Feiyang Li and Qiao Yuan and Jiang Wu and Zichuan Liu and Pengcheng Liu and Mei Wang and Hongwei Zhou and Yuling Liu},
  year = {2026},
  month = mar,
  eprint = {2603.21654},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.21654}
}

@misc{kim2026lisa,
  title = {{LiSA: Lifelong Safety Adaptation via Conservative Policy Induction}},
  author = {Minbeom Kim and Lesly Miculicich and Bhavana Dalvi Mishra and Mihir Parmar and Phillip Wallis and Bharath Chandrasekhar and Kyomin Jung and Tomas Pfister and Long T. Le},
  year = {2026},
  month = may,
  eprint = {2605.14454},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.14454}
}

@misc{laws2026attacks,
  title = {{Attacks and Mitigations for Distributed Governance of Agentic AI under Byzantine Adversaries}},
  author = {Matthew D. Laws and Alina Oprea and Cristina Nita-Rotaru},
  year = {2026},
  month = may,
  eprint = {2605.12364},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.12364}
}

@misc{marzo2026conformity,
  title = {{Conformity Generates Collective Misalignment in AI Agents Societies}},
  author = {Giordano De Marzo and Alessandro Bellina and Claudio Castellano and Viola Priesemann and David Garcia},
  year = {2026},
  month = may,
  eprint = {2605.10721},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.10721}
}

@misc{yao2026redteaming,
  title = {{Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClaw}},
  author = {Hongwei Yao and Yiming Liu and Yiling He and Bingrun Yang},
  year = {2026},
  month = may,
  eprint = {2605.11047},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.11047}
}

@misc{goel2026security,
  title = {{Security Risks in Tool-Enabled AI Agents: A Systematic Analysis of Privileged Execution Environments}},
  author = {Hardik Goel},
  year = {2026},
  month = may,
  eprint = {2605.09721},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09721}
}

@misc{zhang2026modeling,
  title = {{Modeling Implicit Conflict Monitoring Mechanisms against Stereotypes in LLMs}},
  author = {Jingshen Zhang and Bo Wang and Yanlin Fu and Dongming Zhao and Ruifang He and Yuexian Hou and Zifei Yu},
  year = {2026},
  month = may,
  eprint = {2605.09647},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09647}
}

@misc{chen2026token,
  title = {{Token Economics for LLM Agents: A Dual-View Study from Computing and Economics}},
  author = {Yuxi Chen and Junming Chen and Chenyu He and Yiwei Li and Yicheng Ji and Yifan Wu and Dingyu Yang and Lansong Diao and Lidan Shou and Hongliang Zhang and Huan Li and Gang Chen},
  year = {2026},
  month = may,
  eprint = {2605.09104},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09104}
}

@misc{moon2026containment,
  title = {{Containment Verification: AI Safety Guarantees Independent of Alignment}},
  author = {Royce Moon and Lav R. Varshney},
  year = {2026},
  month = may,
  eprint = {2605.09045},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.09045}
}

@misc{slutzky2026why,
  title = {{Why Does Agentic Safety Fail to Generalize Across Tasks?}},
  author = {Yonatan Slutzky and Yotam Alexander and Tomer Slor and Yoav Nagel and Nadav Cohen},
  year = {2026},
  month = may,
  eprint = {2605.06992},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06992}
}

@misc{avizeh2026magiq,
  title = {{MAGIQ: A Post-Quantum Multi-Agentic AI Governance System with Provable Security}},
  author = {Sepideh Avizeh and Tushin Mallick and Alina Oprea and Cristina Nita-Rotaru and Reihaneh Safavi-Naini},
  year = {2026},
  month = may,
  eprint = {2605.06933},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06933}
}

@misc{tatsat2026beyond,
  title = {{Beyond the Black Box: Interpretability of Agentic AI Tool Use}},
  author = {Hariom Tatsat and Ariye Shater},
  year = {2026},
  month = may,
  eprint = {2605.06890},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06890}
}

@misc{bowkis2026automated,
  title = {{Automated alignment is harder than you think}},
  author = {Aleksandr Bowkis and Marie Davidsen Buhl and Jacob Pfau and Geoffrey Irving},
  year = {2026},
  month = may,
  eprint = {2605.06390},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06390}
}

@misc{koch2026agentic,
  title = {{Agentic AI and the Industrialization of Cyber Offense: Forecast, Consequences, and Defensive Priorities for Enterprises and the Mittelstand}},
  author = {Christopher Koch},
  year = {2026},
  month = may,
  eprint = {2605.06713},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06713}
}

@misc{tallam2026authorization,
  title = {{Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure}},
  author = {Krti Tallam},
  year = {2026},
  month = may,
  eprint = {2605.05440},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.05440}
}

@misc{arceo2026securing,
  title = {{Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use}},
  author = {Francisco Javier Arceo and Varsha Prasad Narsing},
  year = {2026},
  month = may,
  eprint = {2605.05287},
  archivePrefix = {arXiv},
  doi = {10.1145/3786335.3813145},
  url = {https://arxiv.org/abs/2605.05287}
}

@misc{chen2026decodingtrustagent,
  title = {{DecodingTrust-Agent Platform (DTap): A Controllable and Interactive Red-Teaming Platform for AI Agents}},
  author = {Zhaorun Chen and Xun Liu and Haibo Tong and Chengquan Guo and Yuzhou Nie and Jiawei Zhang and Mintong Kang and Chejian Xu and Qichang Liu and Xiaogeng Liu and Tianneng Shi and Chaowei Xiao and Sanmi Koyejo and Percy Liang and Wenbo Guo and Dawn Song and Bo Li},
  year = {2026},
  month = may,
  eprint = {2605.04808},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.04808}
}

@misc{yang2026agenttrust,
  title = {{AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use}},
  author = {Chenglin Yang},
  year = {2026},
  month = may,
  eprint = {2605.04785},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.04785}
}

@misc{berg2026hidden,
  title = {{Hidden Coalitions in Multi-Agent AI: A Spectral Diagnostic from Internal Representations}},
  author = {Cameron Berg and Susan L. Schneider and Mark M. Bailey},
  year = {2026},
  month = may,
  eprint = {2605.06696},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.06696}
}

@misc{metere2026architectural,
  title = {{Architectural Obsolescence of Unhardened Agentic-AI Runtimes}},
  author = {Alfredo Metere},
  year = {2026},
  month = may,
  eprint = {2605.01740},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.01740}
}

@misc{bajaj2026position,
  title = {{Position: Safety and Fairness in Agentic AI Depend on Interaction Topology, Not on Model Scale or Alignment}},
  author = {Tanav Singh Bajaj and Nikhil Singh and Karan Anand and Eishkaran Singh},
  year = {2026},
  month = may,
  eprint = {2605.01147},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.01147}
}

@misc{provatas2026bioveil,
  title = {{BioVeil MATRIX: Uncovering and categorizing vulnerabilities of agentic biological AI scientists}},
  author = {Kimon Antonios Provatas and Avery Self and Ioannis Mouratidis and Ilias Georgakopoulos-Soares},
  year = {2026},
  month = apr,
  eprint = {2605.00927},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00927}
}

@misc{chishti2026agentreputation,
  title = {{AgentReputation: A Decentralized Agentic AI Reputation Framework}},
  author = {Mohd Sameen Chishti and Damilare Peter Oyinloye and Jingyue Li},
  year = {2026},
  month = apr,
  eprint = {2605.00073},
  archivePrefix = {arXiv},
  doi = {10.1145/3803437.3805579},
  url = {https://arxiv.org/abs/2605.00073}
}

@misc{xu2026contextual,
  title = {{Contextual Agentic Memory is a Memo, Not True Memory}},
  author = {Binyan Xu and Xilin Dai and Kehuan Zhang},
  year = {2026},
  month = apr,
  eprint = {2604.27707},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.27707}
}

@misc{cha2026frame,
  title = {{Frame Entrepreneurs in an AI Agent Community: Concentrated Identity-Claim Production on Moltbook}},
  author = {Sungguk Cha and DongWook Kim},
  year = {2026},
  month = apr,
  eprint = {2604.27271},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.27271}
}

@misc{cuadros2026ambient,
  title = {{Ambient Persuasion in a Deployed AI Agent: Unauthorized Escalation Following Routine Non-Adversarial Content Exposure}},
  author = {Diego F. Cuadros and Abdoul-Aziz Maiga},
  year = {2026},
  month = apr,
  eprint = {2605.00055},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00055}
}

@misc{yao2026lightweight,
  title = {{Lightweight Quantum Agent for Edge Systems: Joint PQC and NOMA Resource Allocation}},
  author = {Yongtao Yao and Wenjing Xiao and Miaojiang Chen and Anfeng Liu and Zhiquan Liu and Min Chen and Ahmed Farouk and H. Herbert Song},
  year = {2026},
  month = apr,
  eprint = {2604.25980},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.25980}
}

@misc{bandara2026think,
  title = {{Think Before You Act -- A Neurocognitive Governance Model for Autonomous AI Agents}},
  author = {Eranga Bandara and Ross Gore and Asanga Gunaratna and Sachini Rajapakse and Isurunima Kularathna and Ravi Mukkamala and Sachin Shetty and Xueping Liang and Amin Hass and Tharaka Hewa and Abdul Rahman and Christopher K. Rhea and Anita H. Clayton and Preston Samuel and Atmaram Yarlagadda},
  year = {2026},
  month = apr,
  eprint = {2604.25684},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.25684}
}

@misc{li2026green,
  title = {{Green Shielding: A User-Centric Approach Towards Trustworthy AI}},
  author = {Aaron J. Li and Nicolas Sanchez and Hao Huang and Ruijiang Dong and Jaskaran Bains and Katrin Jaradeh and Zhen Xiang and Bo Li and Feng Liu and Aaron Kornblith and Bin Yu},
  year = {2026},
  month = apr,
  eprint = {2604.24700},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24700}
}

@misc{garrido2026badagent,
  title = {{BadAgent Extension}},
  author = {Pedro Yanes Garrido and Diego Fernandez Arias},
  year = {2026},
  month = jun,
  doi = {10.4018/979-8-3373-8252-4.ch010},
  url = {https://doi.org/10.4018/979-8-3373-8252-4.ch010}
}

@misc{naing2026hybrid,
  title = {{Hybrid ML-LLM Pipeline for Non-Governance IT Audits}},
  author = {Kaung Myat Naing and Talha Ali and Mohammed Ouannass},
  year = {2026},
  month = jun,
  doi = {10.4018/979-8-3373-8252-4.ch009},
  url = {https://doi.org/10.4018/979-8-3373-8252-4.ch009}
}

@misc{hammadia2026evaluating,
  title = {{Evaluating Jailbreaking Vulnerabilities in LLMs Deployed as Assistants for Smart Grid Operations: A Benchmark Against NERC Standards}},
  author = {Taha Hammadia and Lucas Rea and Ahmad Mohammad Saber and Amr Youssef and Deepa Kundur},
  year = {2026},
  month = apr,
  eprint = {2604.23341},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.23341}
}

@misc{das2026mechanistic,
  title = {{Mechanistic Steering of LLMs Reveals Layer-wise Feature Vulnerabilities in Adversarial Settings}},
  author = {Nilanjana Das and Manas Gaur},
  year = {2026},
  month = apr,
  eprint = {2604.23130},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.23130}
}

@misc{andreucci2026automationexploit,
  title = {{Automation-Exploit: A Multi-Agent LLM Framework for Adaptive Offensive Security with Digital Twin-Based Risk-Mitigated Exploitation}},
  author = {Biagio Andreucci and Arcangelo Castiglione},
  year = {2026},
  month = apr,
  eprint = {2604.22427},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.22427}
}

@misc{deng2026efficient,
  title = {{Toward Efficient Membership Inference Attacks against Federated Large Language Models: A Projection Residual Approach}},
  author = {Guilin Deng and Silong Chen and Yuchuan Luo and Yi Liu and Songlei Wang and Zhiping Cai and Lin Liu and Xiaohua Jia and Shaojing Fu},
  year = {2026},
  month = apr,
  eprint = {2604.21197},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.21197}
}

@misc{yuan2026secure,
  title = {{Towards Secure Logging: Characterizing and Benchmarking Logging Code Security Issues with LLMs}},
  author = {He Yang Yuan and Xin Wang and Kundi Yao and An Ran Chen and Zishuo Ding and Zhenhao Li},
  year = {2026},
  month = apr,
  eprint = {2604.20211},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.20211}
}

@misc{ni2026taintstyle,
  title = {{Taint-Style Vulnerability Detection and Confirmation for Node.js Packages Using LLM Agent Reasoning}},
  author = {Ronghao Ni and Mihai Christodorescu and Limin Jia},
  year = {2026},
  month = apr,
  eprint = {2604.20179},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.20179}
}

@misc{kim2026hardbench,
  title = {{HarDBench: A Benchmark for Draft-Based Co-Authoring Jailbreak Attacks for Safe Human-LLM Collaborative Writing}},
  author = {Euntae Kim and Soomin Han and Buru Chang},
  year = {2026},
  month = apr,
  eprint = {2604.19274},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.19274}
}

@misc{su2026jailbreaking,
  title = {{Jailbreaking Large Language Models with Morality Attacks}},
  author = {Ying Su and Mingen Zheng and Weili Diao and Haoran Li},
  year = {2026},
  month = apr,
  eprint = {2604.17053},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.17053}
}

@misc{arif2026conjunctivea,
  title = {{Conjunctive Prompt Attacks in Multi-Agent LLM Systems}},
  author = {Nokimul Hasan Arif and Qian Lou and Mengxin Zheng},
  year = {2026},
  month = apr,
  eprint = {2604.16543},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.16543}
}

@misc{pellew2026realvuln,
  title = {{RealVuln: Benchmarking Rule-Based, General-Purpose LLM, and Security-Specialized Scanners on Real-World Code}},
  author = {John Pellew and Faizan Raza},
  year = {2026},
  month = apr,
  eprint = {2604.13764},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.13764}
}

@misc{mao2026sok,
  title = {{SoK: Security of Autonomous LLM Agents in Agentic Commerce}},
  author = {Qian'ang Mao and Jiaxin Wang and Ya Liu and Li Zhu and Cong Ma and Jiaqi Yan},
  year = {2026},
  month = apr,
  eprint = {2604.15367},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.15367}
}

@misc{ghimire2026can,
  title = {{Can Agents Secure Hardware? Evaluating Agentic LLM-Driven Obfuscation for IP Protection}},
  author = {Sujan Ghimire and Parsa Mirfasihi and Muhtasim Alam Chowdhury and Veeramani Pugazhenthi and Harish Kumar Dharavath and Farshad Firouzi and Rozhin Yasaei and Pratik Satam and Soheil Salehi},
  year = {2026},
  month = apr,
  eprint = {2604.13298},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.13298}
}

@misc{zhao2026clawguard,
  title = {{ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection}},
  author = {Wei Zhao and Zhe Li and Peixin Zhang and Jun Sun},
  year = {2026},
  month = apr,
  eprint = {2604.11790},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.11790}
}

@misc{wang2026grm,
  title = {{GRM: Utility-Aware Jailbreak Attacks on Audio LLMs via Gradient-Ratio Masking}},
  author = {Yunqiang Wang and Hengyuan Na and Di Wu and Miao Hu and Guocong Quan},
  year = {2026},
  month = apr,
  eprint = {2604.09222},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.09222}
}

@misc{zhu2026jailbroken,
  title = {{Jailbroken Frontier Models Retain Their Capabilities}},
  author = {Daniel Zhu and Zihan Wang and Jenny Bao and Jerry Wei},
  year = {2026},
  month = apr,
  eprint = {2605.00267},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00267}
}

@misc{srivastava2026attention,
  title = {{Attention Is Where You Attack}},
  author = {Aviral Srivastava and Sourav Panda},
  year = {2026},
  month = apr,
  eprint = {2605.00236},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.00236}
}

@misc{wang2026flashrt,
  title = {{FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruption}},
  author = {Yanting Wang and Chenlong Yin and Ying Chen and Jinyuan Jia},
  year = {2026},
  month = apr,
  eprint = {2604.28157},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.28157}
}

@misc{sun2026twingate,
  title = {{TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning}},
  author = {Bowen Sun and Chaozhuo Li and Yaodong Yang and Yiwei Wang and Chaowei Xiao},
  year = {2026},
  month = apr,
  eprint = {2604.27861},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.27861}
}

@misc{khodayari2026indirect,
  title = {{Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives}},
  author = {Soheil Khodayari and Xuenan Zhang and Bhupendra Acharya and Giancarlo Pellegrino},
  year = {2026},
  month = apr,
  eprint = {2604.27202},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.27202}
}

@misc{lan2026dynamic,
  title = {{Dynamic Adversarial Fine-Tuning Reorganizes Refusal Geometry}},
  author = {Wenhao Lan and Shan Li and Junbin Yang and Haihua Shen and Yijun Yang},
  year = {2026},
  month = apr,
  eprint = {2604.27019},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.27019}
}

@misc{du2026snapguard,
  title = {{SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents}},
  author = {Mengyao Du and Han Fang and Haokai Ma and Jiahao Chen and Kai Xu and Quanjun Yin and Ee-Chien Chang},
  year = {2026},
  month = apr,
  eprint = {2604.25562},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.25562}
}

@misc{yu2026sudp,
  title = {{SUDP: Secret-Use Delegation Protocol for Agentic Systems}},
  author = {Xiaohang Yu and Hejia Geng and Xinmeng Zeng and William Knottenbelt},
  year = {2026},
  month = apr,
  eprint = {2604.24920},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24920}
}

@misc{min2026layerwise,
  title = {{Layerwise Convergence Fingerprints for Runtime Misbehavior Detection in Large Language Models}},
  author = {Nay Myat Min and Long H. Pham and Jun Sun},
  year = {2026},
  month = apr,
  eprint = {2604.24542},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24542}
}

@misc{ying2026agentvisor,
  title = {{AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization}},
  author = {Zonghao Ying and Haozheng Wang and Jiangfan Liu and Quanchen Zou and Aishan Liu and Jian Yang and Yaodong Yang and Xianglong Liu},
  year = {2026},
  month = apr,
  eprint = {2604.24118},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24118}
}

@misc{wang2026jailbreaking,
  title = {{Jailbreaking Frontier Foundation Models Through Intention Deception}},
  author = {Xinhe Wang and Katia Sycara and Yaqi Xie},
  year = {2026},
  month = apr,
  eprint = {2604.24082},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24082}
}

@misc{li2026poster,
  title = {{Poster: ClawdGo: Endogenous Security Awareness Training for Autonomous AI Agents}},
  author = {Jiaqi Li and Yang Zhao and Bin Sun and Yang Yu and Jian Chang and Lidong Zhai},
  year = {2026},
  month = apr,
  eprint = {2604.24020},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24020}
}

@misc{kroll2026aristoteles,
  title = {{ARIstoteles -- Dissecting Apple's Baseband Interface}},
  author = {Tobias Kröll and Stephan Kleber and Frank Kargl and Matthias Hollick and Jiska Classen},
  year = {2026},
  month = apr,
  eprint = {2604.23457},
  archivePrefix = {arXiv},
  doi = {10.1007/978-3-030-88418-5_7},
  url = {https://arxiv.org/abs/2604.23457}
}

@misc{cai2026ghost,
  title = {{Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents}},
  author = {Yuandao Cai and Wensheng Tang and Cheng Wen and Shengchao Qin},
  year = {2026},
  month = apr,
  eprint = {2604.23374},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.23374}
}

@misc{chu2026froma,
  title = {{From Stateless Queries to Autonomous Actions: A Layered Security Framework for Agentic AI Systems}},
  author = {Kexin Chu},
  year = {2026},
  month = apr,
  eprint = {2604.23338},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.23338}
}

@misc{steinberg2026semantic,
  title = {{Semantic Denial of Service in LLM-controlled robots}},
  author = {Jonathan Steinberg and Oren Gal},
  year = {2026},
  month = apr,
  eprint = {2604.24790},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24790}
}

@misc{xiao2026routeguard,
  title = {{RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents}},
  author = {Wenjie Xiao and Xuehai Tang and Biyu Zhou and Songlin Hu and Jizhong Han},
  year = {2026},
  month = apr,
  eprint = {2604.22888},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.22888}
}

@misc{gautam2026autorise,
  title = {{AutoRISE: Agent-Driven Strategy Evolution for Red-Teaming Large Language Models}},
  author = {Tanmay Gautam and Alireza Bahramali and Sandeep Atluri},
  year = {2026},
  month = apr,
  eprint = {2604.22871},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.22871}
}

@misc{zymet2026adaptive,
  title = {{Adaptive Instruction Composition for Automated LLM Red-Teaming}},
  author = {Jesse Zymet and Andy Luo and Swapnil Shinde and Sahil Wadhwa and Emily Chen},
  year = {2026},
  month = apr,
  eprint = {2604.21159},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.21159}
}

@misc{belkhiter2026breaking,
  title = {{Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models}},
  author = {Yannis Belkhiter and Giulio Zizzo and Sergio Maffeis and Seshu Tirupathi and John D. Kelleher},
  year = {2026},
  month = apr,
  eprint = {2604.20994},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.20994}
}

@misc{agarwal2026breaking,
  title = {{Breaking Bad: Interpretability-Based Safety Audits of State-of-the-Art LLMs}},
  author = {Krishiv Agarwal and Ramneet Kaur and Colin Samplawski and Manoj Acharya and Anirban Roy and Daniel Elenius and Brian Matejek and Adam D. Cobb and Susmit Jha},
  year = {2026},
  month = apr,
  eprint = {2604.20945},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.20945}
}

@misc{stanley2026ai,
  title = {{An AI Agent Execution Environment to Safeguard User Data}},
  author = {Robert Stanley and Avi Verma and Lillian Tsai and Konstantinos Kallas and Sam Kumar},
  year = {2026},
  month = apr,
  eprint = {2604.19657},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.19657}
}

@misc{saiyed2026understanding,
  title = {{Towards Understanding the Robustness of Sparse Autoencoders}},
  author = {Ahson Saiyed and Sabrina Sadiekh and Chirag Agarwal},
  year = {2026},
  month = apr,
  eprint = {2604.18756},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.18756}
}

@misc{kabir2026different,
  title = {{Different Paths to Harmful Compliance: Behavioral Side Effects and Mechanistic Divergence Across LLM Jailbreaks}},
  author = {Md Rysul Kabir and Zoran Tiganj},
  year = {2026},
  month = apr,
  eprint = {2604.18510},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.18510}
}

@misc{munirathinam2026beyond,
  title = {{Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection}},
  author = {Thamilvendhan Munirathinam},
  year = {2026},
  month = apr,
  eprint = {2604.18248},
  archivePrefix = {arXiv},
  doi = {10.5281/zenodo.19644135},
  url = {https://arxiv.org/abs/2604.18248}
}

@misc{zhang2026ownerharm,
  title = {{Owner-Harm: A Missing Threat Model for AI Agent Safety}},
  author = {Dongcheng Zhang and Yiqing Jiang},
  year = {2026},
  month = apr,
  eprint = {2604.18658},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.18658}
}

@misc{turgut2026cascade,
  title = {{CASCADE: A Cascaded Hybrid Defense Architecture for Prompt Injection Detection in MCP-Based Systems}},
  author = {İpek Abasıkeleş Turgut and Edip Gümüş},
  year = {2026},
  month = apr,
  eprint = {2604.17125},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.17125}
}

@misc{qian2026visual,
  title = {{Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning}},
  author = {Jiachen Qian},
  year = {2026},
  month = apr,
  eprint = {2604.16966},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.16966}
}

@misc{yan2026safedream,
  title = {{SafeDream: Safety World Model for Proactive Early Jailbreak Detection}},
  author = {Bo Yan and Weikai Lin and Yada Zhu and Song Wang},
  year = {2026},
  month = apr,
  eprint = {2604.16824},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.16824}
}

@misc{jin2026capseal,
  title = {{CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution}},
  author = {Shutong Jin and Ruiyi Guo and Ray C. C. Cheung},
  year = {2026},
  month = apr,
  eprint = {2604.16762},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.16762}
}

@misc{roh2026benign,
  title = {{Benign Fine-Tuning Breaks Safety Alignment in Audio LLMs}},
  author = {Jaechul Roh and Amir Houmansadr},
  year = {2026},
  month = apr,
  eprint = {2604.16659},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.16659}
}

@misc{hung2026into,
  title = {{Into the Gray Zone: Domain Contexts Can Blur LLM Safety Boundaries}},
  author = {Ki Sen Hung and Xi Yang and Chang Liu and Haoran Li and Kejiang Chen and Changxuan Fan and Tsun On Kwok and Weiming Zhang and Xiaomeng Li and Yangqiu Song},
  year = {2026},
  month = apr,
  eprint = {2604.15717},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.15717}
}

@misc{jiang2026harmfulskillbench,
  title = {{HarmfulSkillBench: How Do Harmful Skills Weaponize Your Agents?}},
  author = {Yukun Jiang and Yage Zhang and Michael Backes and Xinyue Shen and Yang Zhang},
  year = {2026},
  month = apr,
  eprint = {2604.15415},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.15415}
}

@misc{he2026segmentlevel,
  title = {{Segment-Level Coherence for Robust Harmful Intent Probing in LLMs}},
  author = {Xuanli He and Bilgehan Sel and Faizan Ali and Jenny Bao and Hoagy Cunningham and Jerry Wei},
  year = {2026},
  month = apr,
  eprint = {2604.14865},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.14865}
}

@misc{chen2026hijacking,
  title = {{Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection}},
  author = {Meng Chen and Kun Wang and Li Lu and Jiaheng Zhang and Tianwei Zhang},
  year = {2026},
  month = apr,
  eprint = {2604.14604},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.14604}
}

@misc{shah2026logjack,
  title = {{LogJack: Indirect Prompt Injection Through Cloud Logs Against LLM Debugging Agents}},
  author = {Harsh Shah},
  year = {2026},
  month = apr,
  eprint = {2604.15368},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.15368}
}

@misc{fu2026understanding,
  title = {{Understanding and Improving Continuous Adversarial Training for LLMs via In-context Learning Theory}},
  author = {Shaopeng Fu and Di Wang},
  year = {2026},
  month = apr,
  eprint = {2604.12817},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.12817}
}

@misc{ren2026deepseek,
  title = {{DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection}},
  author = {Junyu Ren and Xingjian Pan and Wensheng Gan and Philip S. Yu},
  year = {2026},
  month = apr,
  eprint = {2604.12548},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.12548}
}

@misc{yin2026compiling,
  title = {{Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors}},
  author = {Rui Yin and Tianxu Han and Naen Xu and Changjiang Li and Ping He and Chunyi Zhou and Jun Wang and Zhihui Fu and Tianyu Du and Jinbao Li and Shouling Ji},
  year = {2026},
  month = apr,
  eprint = {2604.12359},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.12359}
}

@misc{chen2026webagentguard,
  title = {{WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents}},
  author = {Yulin Chen and Tri Cao and Haoran Li and Yue Liu and Yibo Li and Yufei He and Le Minh Khoi and Yangqiu Song and Shuicheng Yan and Bryan Hooi},
  year = {2026},
  month = apr,
  eprint = {2604.12284},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.12284}
}

@misc{musaffar2026detection,
  title = {{Detection of adversarial intent in Human-AI teams using LLMs}},
  author = {Abed K. Musaffar and Ambuj Singh and Francesco Bullo},
  year = {2026},
  month = mar,
  eprint = {2603.20976},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.20976}
}

@misc{torra2026memory,
  title = {{Memory poisoning and secure multi-agent systems}},
  author = {Vicenç Torra and Maria Bras-Amorós},
  year = {2026},
  month = mar,
  eprint = {2603.20357},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.20357}
}

@misc{yan2026detecting,
  title = {{Detecting Data Poisoning in Code Generation LLMs via Black-Box, Vulnerability-Oriented Scanning}},
  author = {Shenao Yan and Shimaa Ahmed and Shan Jin and Sunpreet S. Arora and Yiwei Cai and Yizhen Wang and Yuan Hong},
  year = {2026},
  month = mar,
  eprint = {2603.17174},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.17174}
}

@misc{zhang2026testtime,
  title = {{Test-Time Attention Purification for Backdoored Large Vision Language Models}},
  author = {Zhifang Zhang and Bojun Yang and Shuo He and Weitong Chen and Wei Emma Zhang and Olaf Maennel and Lei Feng and Miao Xu},
  year = {2026},
  month = mar,
  eprint = {2603.12989},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.12989}
}

@misc{li2026slowba,
  title = {{SlowBA: An efficiency backdoor attack towards VLM-based GUI agents}},
  author = {Junxian Li and Tu Lan and Haozhen Tan and Yan Meng and Haojin Zhu},
  year = {2026},
  month = mar,
  eprint = {2603.08316},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2603.08316}
}

@misc{li2026comparative,
  title = {{A Comparative Evaluation of AI Agent Security Guardrails}},
  author = {Qi Li and Jiu Li and Pingtao Wei and Jianjun Xu and Xueyi Wei and Jiwei Shi and Xuan Zhang and Yanhui Yang and Xiaodong Hui and Peng Xu and Lingquan Zhou},
  year = {2026},
  month = apr,
  eprint = {2604.24826},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.24826}
}

@misc{zheng2026tsassistant,
  title = {{TSAssistant: A Human-in-the-Loop Agentic Framework for Automated Target Safety Assessment}},
  author = {Xiaochen Zheng and Zhiwen Jiang and Melanie Guerard and Klas Hatje and Tatyana Doktorova},
  year = {2026},
  month = apr,
  eprint = {2604.23938},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.23938}
}

@misc{hagag2026architecture,
  title = {{Architecture Matters for Multi-Agent Security}},
  author = {Ben Hagag and William L. Anderson and Christian Schroeder de Witt and Sarah Scheffler},
  year = {2026},
  month = apr,
  eprint = {2604.23459},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.23459}
}

@misc{mitchell2026when,
  title = {{When the Agent Is the Adversary: Architectural Requirements for Agentic AI Containment After the April 2026 Frontier Model Escape}},
  author = {Richard Joseph Mitchell},
  year = {2026},
  month = apr,
  eprint = {2604.23425},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.23425}
}

@misc{roy2026agentsoc,
  title = {{AgentSOC: A Multi-Layer Agentic AI Framework for Security Operations Automation}},
  author = {Joyjit Roy and Samaresh Kumar Singh},
  year = {2026},
  month = apr,
  eprint = {2604.20134},
  archivePrefix = {arXiv},
  doi = {10.1109/ICAIC67076.2026.11395783},
  url = {https://arxiv.org/abs/2604.20134}
}

@misc{rabbi2026insights,
  title = {{Insights into Security-Related AI-Generated Pull Requests}},
  author = {Md Fazle Rabbi and Asif K. Turzo and Arifa I. Champa and Minhaz F. Zibran},
  year = {2026},
  month = apr,
  eprint = {2604.19965},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.19965}
}

@misc{zorriassatine2026integrating,
  title = {{Integrating Anomaly Detection into Agentic AI for Proactive Risk Management in Human Activity}},
  author = {Farbod Zorriassatine and Ahmad Lotfi},
  year = {2026},
  month = apr,
  eprint = {2604.19538},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.19538}
}

@misc{li2026ait,
  title = {{AIT Academy: Cultivating the Complete Agent with a Confucian Three-Domain Curriculum}},
  author = {Jiaqi Li and Lvyang Zhang and Yang Zhao and Wen Lu and Lidong Zhai},
  year = {2026},
  month = apr,
  eprint = {2604.17989},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.17989}
}

@misc{wen2026from,
  title = {{From Craft to Kernel: A Governance-First Execution Architecture and Semantic ISA for Agentic Computers}},
  author = {Xiangyu Wen and Yuang Zhao and Xiaoyu Xu and Lingjun Chen and Changran Xu and Shu Chi and Jianrong Ding and Zeju Li and Haomin Li and Li Jiang and Fangxin Liu and Qiang Xu},
  year = {2026},
  month = apr,
  eprint = {2604.18652},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.18652}
}

@misc{koch2026beyond,
  title = {{Beyond Task Success: An Evidence-Synthesis Framework for Evaluating, Governing, and Orchestrating Agentic AI}},
  author = {Christopher Koch and Joshua Andreas Wellbrock},
  year = {2026},
  month = apr,
  eprint = {2604.19818},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.19818}
}

@misc{zhang2026harness,
  title = {{Harness as an Asset: Enforcing Determinism via the Convergent AI Agent Framework (CAAF)}},
  author = {Tianbao Zhang},
  year = {2026},
  month = apr,
  eprint = {2604.17025},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.17025}
}

@misc{hong2026symbolic,
  title = {{Symbolic Guardrails for Domain-Specific Agents: Stronger Safety and Security Guarantees Without Sacrificing Utility}},
  author = {Yining Hong and Yining She and Eunsuk Kang and Christopher S. Timperley and Christian Kästner},
  year = {2026},
  month = apr,
  eprint = {2604.15579},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.15579}
}

@misc{pierucci2026agentic,
  title = {{Agentic Microphysics: A Manifesto for Generative AI Safety}},
  author = {Federico Pierucci and Matteo Prandi and Marcantonio Bracale Syrnikov and Marcello Galisai and Piercosma Bisconti},
  year = {2026},
  month = apr,
  eprint = {2604.15236},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.15236}
}

@misc{fokou2026parallax,
  title = {{Parallax: Why AI Agents That Think Must Never Act}},
  author = {Joel Fokou},
  year = {2026},
  month = apr,
  eprint = {2604.12986},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.12986}
}

@misc{mouzouni2026context,
  title = {{Context Kubernetes: Declarative Orchestration of Enterprise Knowledge for Agentic AI Systems}},
  author = {Charafeddine Mouzouni},
  year = {2026},
  month = apr,
  eprint = {2604.11623},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.11623}
}

@misc{hu2026occubench,
  title = {{OccuBench: Evaluating AI Agents on Real-World Professional Tasks via Language Environment Simulation}},
  author = {Xiaomeng Hu and Yinger Zhang and Fei Huang and Jianhong Tu and Yang Su and Lianghao Deng and Yuxuan Liu and Yantao Liu and Dayiheng Liu and Tsung-Yi Ho},
  year = {2026},
  month = apr,
  eprint = {2604.10866},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.10866}
}

@misc{wu2026pilotbench,
  title = {{PilotBench: A Benchmark for General Aviation Agents with Safety Constraints}},
  author = {Yalun Wu and Haotian Liu and Zhoujun Li and Boyang Wang},
  year = {2026},
  month = apr,
  eprint = {2604.08987},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.08987}
}

@misc{nguyen2025penetration,
  title = {{Penetration Testing of Agentic AI: A Comparative Security Analysis Across Models and Frameworks}},
  author = {V. Nguyen and M. Husain},
  year = {2025},
  month = dec,
  eprint = {2512.14860},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2512.14860},
  url = {https://www.semanticscholar.org/paper/71a878eaf0ba150a611610e3c5cbe6cebec1528d}
}

@inproceedings{bacztub2025autopwn,
  title = {{Autopwn: Automatic Code-Reuse Exploit Generation Framework with Agentic AI}},
  author = {Kaleb Bacztub and Dylan Christensen and Arun Ravindran and Meera Sridhar},
  year = {2025},
  month = dec,
  booktitle = {2025 Annual Computer Security Applications Conference Workshops (ACSAC Workshops)},
  doi = {10.1109/ACSACW69556.2025.00065},
  url = {https://www.semanticscholar.org/paper/6e203aec72715114d99237dd566e0cb96ad06dfa}
}

@misc{amusuo2025falsecrashreducer,
  title = {{FalseCrashReducer: Mitigating False Positive Crashes in OSS-Fuzz-Gen Using Agentic AI}},
  author = {Paschal C. Amusuo and Dongge Liu and Ricardo Andrés Calvo Méndez and Jonathan Metzman and Oliver Chang and James C. Davis},
  year = {2025},
  month = oct,
  eprint = {2510.02185},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2510.02185},
  url = {https://www.semanticscholar.org/paper/3b3f1d457833d62e633eb67e411e7ae70a0b4058}
}

@misc{boisvert2025doomarena,
  title = {{DoomArena: A framework for Testing AI Agents Against Evolving Security Threats}},
  author = {L'eo Boisvert and Mihir Bansal and Chandra Kiran Reddy Evuru and Gabriel Huang and Abhay Puri and Avinandan Bose and Maryam Fazel and Quentin Cappart and Jason Stanley and Alexandre Lacoste and Alexandre Drouin and K. Dvijotham},
  year = {2025},
  month = apr,
  eprint = {2504.14064},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2504.14064},
  url = {https://www.semanticscholar.org/paper/9e85ce8f1822105251870493e5326468fba18f0d}
}

@misc{li2026agentdyn,
  title = {{AgentDyn: A Dynamic Open-Ended Benchmark for Evaluating Prompt Injection Attacks of Real-World Agent Security System}},
  author = {Hao Li and Ruoyao Wen and Shanghao Shi and Ning Zhang and Chaowei Xiao},
  year = {2026},
  month = feb,
  eprint = {2602.03117},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2602.03117},
  url = {https://www.semanticscholar.org/paper/a2503b39343272c8ae4eebc9b41174c8d4876a0b}
}

@misc{bonfanti2026from,
  title = {{From Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures}},
  author = {Chiara Bonfanti and D. Colaiacomo and Luca Cagliero and Cataldo Basile},
  year = {2026},
  month = mar,
  eprint = {2603.03911},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/cb55a34cfe8768e170ce4c0ca13cb0931b0fb7da}
}

@misc{kim2026attack,
  title = {{The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey}},
  author = {Juhee Kim and Xiaoyuan Liu and Zhun Wang and Shi Qiu and Bo Li and Wenbo Guo and Dawn Song},
  year = {2026},
  month = mar,
  eprint = {2603.11088},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/94c189f236921d08c8709a8d27fd431b5c0a61ea}
}

@article{damarched2026agentic,
  title = {{Agentic AI Modernization: Transforming Institutional Infrastructure Through Orchestrated Multi-Agent LLM Framework}},
  author = {Mahesh Kumar Damarched},
  year = {2026},
  month = feb,
  journal = {Journal of Computer Science and Technology Studies},
  doi = {10.32996/jcsts.2026.8.4.1},
  url = {https://www.semanticscholar.org/paper/e80052b89aa35b2ee92677a588f92402f2f4d122}
}

@misc{betser2026agentrim,
  title = {{AgenTRIM: Tool Risk Mitigation for Agentic AI}},
  author = {Roy Betser and Shamik Bose and Amit Giloni and Chiara Picardi and Sindhu Padakandla and R. Vainshtein},
  year = {2026},
  month = jan,
  eprint = {2601.12449},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2601.12449},
  url = {https://www.semanticscholar.org/paper/01faaf29f224194719d37bcb522264fdcc07bc24}
}

@article{perikala2023architecting,
  title = {{Architecting MCP-Based Platforms for Enterprise-Scale Agentic Generative AI}},
  author = {Karthik Perikala},
  year = {2023},
  journal = {Journal of Business Intelligence and Data Analytics},
  doi = {10.55124/jbid.v2i3.264},
  url = {https://www.semanticscholar.org/paper/00a09f191759c2002a99a2d485d875d1b26859be}
}

@misc{advani2026trajectory,
  title = {{Trajectory Guard - A Lightweight, Sequence-Aware Model for Real-Time Anomaly Detection in Agentic AI}},
  author = {Laksh Advani},
  year = {2026},
  month = jan,
  eprint = {2601.00516},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2601.00516},
  url = {https://www.semanticscholar.org/paper/97bdc0f37dea8f7846218aaffa48f5752ef2e971}
}

@misc{babu2026transparentbydesign,
  title = {{Transparent-by-Design AI}},
  author = {C. V. Suresh Babu and S. Nanda Kumar and S. Abhishek and S. Sivasridharun},
  year = {2026},
  month = may,
  doi = {10.4018/979-8-3373-6761-3.ch006},
  url = {https://doi.org/10.4018/979-8-3373-6761-3.ch006}
}

@misc{zhao2026livepi,
  title = {{LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injectio}},
  author = {Lei Zhao and Abhay Bhaskar and Edgar Dobriban},
  year = {2026},
  month = may,
  eprint = {2605.17986},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17986}
}

@misc{park2026beyond,
  title = {{Beyond Attack Success Rate: Temporal Logit Observability for LLM Safety Failures}},
  author = {Junyoung Park and Sunghwan Park and Seongyong Ju and Jaewoo Lee},
  year = {2026},
  month = may,
  eprint = {2605.29629},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.29629}
}

@misc{zhang2026evolving,
  title = {{Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking}},
  author = {Junke Zhang and Jianwei Wang and Sishuo Chen and Yizhang He and Qingshuai Feng and Zhengyi Yang},
  year = {2026},
  month = may,
  eprint = {2605.29237},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.29237}
}

@misc{nawal2026relevance,
  title = {{Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents}},
  author = {Aditya Nawal and Manit Baser and Mohan Gurusamy},
  year = {2026},
  month = may,
  eprint = {2605.29224},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.29224}
}

@misc{zhang2026measuring,
  title = {{Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening}},
  author = {Mohan Zhang and Yuqi Jia and Zhen Tan and Steven Jiang and Neil Zhenqiang Gong and Tianlong Chen and Dawn Song},
  year = {2026},
  month = may,
  eprint = {2605.28999},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28999}
}

@misc{you2026blind,
  title = {{Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking}},
  author = {Ziyang You and Huilong He and Xiaoke Yang and Xuxing Lu},
  year = {2026},
  month = may,
  eprint = {2605.28632},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28632}
}

@misc{li2026plant,
  title = {{Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents}},
  author = {Yongxiang Li and Moxin Li and Zhixin Ma and Fengbin Zhu and Dongrui Liu and Wenjie Wang and Fuli Feng},
  year = {2026},
  month = may,
  eprint = {2605.28201},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28201}
}

@misc{ma2026demystifying,
  title = {{Towards Demystifying and Repairing LLM-in-the-Loop Vulnerabilities}},
  author = {Yujie Ma and Jialin Rong and Chenxi Yang and Lili Quan and Xiaofei Xie and Yongqiang Lyu and Qiang Hu},
  year = {2026},
  month = may,
  eprint = {2605.28893},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28893}
}

@misc{luo2026defending,
  title = {{Defending LLM-based Multi-Agent Systems Against Cooperative Attacks with Sentence-Level Rectification}},
  author = {Yaoyang Luo and Zhi Zheng and Ziwei Zhao and Tong Xu and Zhao Jielun and Wenjun Xue and Yong Chen and Enhong Chen},
  year = {2026},
  month = may,
  eprint = {2605.28104},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28104}
}

@misc{fang2026disentangling,
  title = {{Disentangling Adversarial Prompts: A Semantic-Graph Defense for Robust LLM Security}},
  author = {Xiang Fang and Wanlong Fang},
  year = {2026},
  month = may,
  eprint = {2605.27823},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.27823}
}

@misc{shao2026cordyceps,
  title = {{Cordyceps: Covert Control Attacks on LLMs via Data Poisoning}},
  author = {Zedian Shao and Charles Fleming and Teodora Baluta},
  year = {2026},
  month = may,
  eprint = {2605.26595},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.26595}
}

@misc{kuo2026openweight,
  title = {{Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks}},
  author = {Kevin Kuo and Chhavi Yadav and Virginia Smith},
  year = {2026},
  month = may,
  eprint = {2605.26526},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.26526}
}

@misc{yan2026evoattacker,
  title = {{Evo-Attacker: Memory-Augmented Reinforcement Learning for Long-Horizon Tool Attacks on LLM-MAS}},
  author = {Bingyu Yan and Xiaoming Zhang and Jinyu Hou and Chaozhuo Li and Ziyi Zhou and Yiming Hei and Litian Zhang},
  year = {2026},
  month = may,
  eprint = {2605.25389},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.25389}
}

@misc{li2026security,
  title = {{Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions}},
  author = {Wenjuan Li and Yitao Liu and Runze Chen and Rajkumar Buyya},
  year = {2026},
  month = may,
  eprint = {2605.25073},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.25073}
}

@misc{li2026reasoning,
  title = {{Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMs}},
  author = {Jianan Li and Simeng Qin and Xiaojun Jia and Lionel Z. Wang and Tianhang Zheng and Xiaoshuang Jia and Yang Liu and Xiaochun Cao},
  year = {2026},
  month = may,
  eprint = {2605.24497},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24497}
}

@misc{pandey2026poisoning,
  title = {{Poisoning the Watchtower: Prompt Injection Attacks Against LLM-Augmented Security Operations Through Adversarial Log Content}},
  author = {Rohan Pandey and Archit Bhujang},
  year = {2026},
  month = may,
  eprint = {2605.24421},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24421}
}

@misc{wang2026reframing,
  title = {{Reframing LLM Agent Security as an Agent-Human Interaction Problem}},
  author = {Peiran Wang and Ying Li and Yuan Tian},
  year = {2026},
  month = may,
  eprint = {2605.24309},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24309}
}

@misc{kharma2026empirical,
  title = {{An Empirical Evaluation of LLM-Generated Code Security Across Prompting Methods}},
  author = {Mohammed Kharma and Ahmed Sabbah and Mohammad Alkhanafseh and Mohammad Hammoudeh and David Mohaisen},
  year = {2026},
  month = may,
  eprint = {2605.24298},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24298}
}

@misc{camarato2026promptaudit,
  title = {{PromptAudit: Auditing Prompt Sensitivity in LLM-Based Vulnerability Detection}},
  author = {Steffen J. Camarato and Yahya Hmaiti and Mandana Ghadamian and David Mohaisen},
  year = {2026},
  month = may,
  eprint = {2605.24171},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24171}
}

@misc{liu2026whenb,
  title = {{When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents}},
  author = {Shi Liu and Xuehai Tang and Xikang Yang and Liang Lin and Biyu Zhou and Wenjie Xiao and Wantao Liu},
  year = {2026},
  month = may,
  eprint = {2605.24069},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24069}
}

@misc{dahiya2026are,
  title = {{Are Frontier LLMs Ready for Cybersecurity? Evidence for Vertical Foundation Models from Dual-Mode Vulnerability Benchmarks}},
  author = {Vivek Dahiya and Sunny Nehra and Vipul Dholariya and Bhavik Shangari and Chandra Khatri},
  year = {2026},
  month = may,
  eprint = {2605.23243},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.23243}
}

@misc{tong2026pretraining,
  title = {{Pretraining Data Exposure in Large Language Models: A Survey of Membership Inference, Data Contamination, and Security Implications}},
  author = {Ziyi Tong and Feifei Sun and Le Minh Nguyen},
  year = {2026},
  month = may,
  eprint = {2605.26133},
  archivePrefix = {arXiv},
  doi = {10.1007/978-3-031-97144-0_14},
  url = {https://arxiv.org/abs/2605.26133}
}

@misc{pai2026blind,
  title = {{Blind Spots in the Guard: How Domain-Camouflaged Injection Attacks Evade Detection in Multi-Agent LLM Systems}},
  author = {Aaditya Pai},
  year = {2026},
  month = may,
  eprint = {2605.22001},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.22001}
}

@misc{sheng2026fuzzingbrain,
  title = {{FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction}},
  author = {Ze Sheng and Zhicheng Chen and Qingxiao Xu and Kewen Zhu and Jeff Huang},
  year = {2026},
  month = may,
  eprint = {2605.21779},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.21779}
}

@misc{wang2026trusted,
  title = {{Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMs}},
  author = {Yifei Wang and Tianlin Li and Xiaohan Zhang and Yida Yang and Xiaoyu Zhang and Li Pan},
  year = {2026},
  month = may,
  eprint = {2605.20641},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.20641}
}

@misc{dobrovolskyi2026security,
  title = {{Security Document Classification with a Fine-Tuned Local Large Language Model: Benchmark Data and an Open-Source System}},
  author = {Ivan Dobrovolskyi},
  year = {2026},
  month = may,
  eprint = {2605.20368},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.20368}
}

@misc{venkatesh2026caspian,
  title = {{CASPIAN: Online Detection and Attribution of Cascade Attacks in LLM Multi-Agent Systems via Cross-Channel Causal Monitoring}},
  author = {Kavana Venkatesh and Jafar Isbarov and Saad Amin and Murat Kantarcioglu and Jiaming Cui},
  year = {2026},
  month = may,
  eprint = {2605.19240},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.19240}
}

@misc{halloran2026be,
  title = {{Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks}},
  author = {John T. Halloran and Noopur S. Bhatt},
  year = {2026},
  month = may,
  eprint = {2605.19147},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.19147}
}

@misc{sehwag2026aspi,
  title = {{ASPI: Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents}},
  author = {Udari Madhushani Sehwag and Zhengyang Shan and Heming Liu and Dileepa Lakshan and Joseph Brandifino and Max Fenkell},
  year = {2026},
  month = may,
  eprint = {2605.17324},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17324}
}

@misc{sun2026when,
  title = {{When Efficiency Backfires: Cascading LLMs Trigger Cascade Failure under Adversarial Attack}},
  author = {Zehan Sun and Dingfan Chen and Songze Li},
  year = {2026},
  month = may,
  eprint = {2605.17288},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17288}
}

@misc{sun2026darkllm,
  title = {{DarkLLM: Learning Language-Driven Adversarial Attacks with Large Language Models}},
  author = {Ye Sun and Xin Wang and Jiaming Zhang and Yifeng Gao and Yixu Wang and Yifan Ding and Qixian Zhang and Henghui Ding and Xingjun Ma and Yu-Gang Jiang},
  year = {2026},
  month = may,
  eprint = {2605.18868},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18868}
}

@misc{lelle2026tokenlevel,
  title = {{Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection}},
  author = {Travis Lelle},
  year = {2026},
  month = may,
  eprint = {2605.30189},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30189}
}

@misc{hoque2026token,
  title = {{Token Inflation: How Dishonest Providers Can Overcharge for Large Language Model Usage}},
  author = {Shahinul Hoque and Jinghuai Zhang and Jinyuan Sun and Fnu Suya},
  year = {2026},
  month = may,
  eprint = {2605.30040},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30040}
}

@misc{qin2026airguard,
  title = {{AIRGuard: Guarding Agent Actions with Runtime Authority Control}},
  author = {Suliu Qin and Haomin Zhuang and Yujun Zhou and Yufei Han and Xiangliang Zhang},
  year = {2026},
  month = may,
  eprint = {2605.28914},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28914}
}

@misc{qu2026snare,
  title = {{SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents}},
  author = {Yubin Qu and Yi Liu and Gelei Deng and Yanjun Zhang and Yuekang Li and Ying Zhang and Leo Yu Zhang},
  year = {2026},
  month = may,
  eprint = {2605.28122},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28122}
}

@misc{guo2026mirage,
  title = {{MIRAGE: Context-Aware Prompt Injection against Mobile GUI Agents via User-Generated Content}},
  author = {Ruoqi Guo and Yi Liu and Gelei Deng and Yiheng Xiong and Yuekang Li and Ying Zhang and Leo Yu Zhang and Lida Zhao and Ji Jie and Yuxiao Lu},
  year = {2026},
  month = may,
  eprint = {2605.28116},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28116}
}

@misc{tian2026when,
  title = {{When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?}},
  author = {Yuan Tian and Bing Hu and Fang Wu and Xiaomin Li and Binghang Lu and Neil Zhenqiang Gong},
  year = {2026},
  month = may,
  eprint = {2605.27932},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.27932}
}

@misc{luo2026bait,
  title = {{BAIT: Boundary-Guided Disclosure Escalation via Self-Conditioned Reasoning}},
  author = {Xuan Luo and Yue Wang and Geng Tu and Jing Li and Ruifeng Xu},
  year = {2026},
  month = may,
  eprint = {2605.27110},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.27110}
}

@misc{akinrele2026prompt,
  title = {{Prompt Injection Detection is Regime-Dependent: A Deployment-Aware Evaluation with Interpretable Structural Signals}},
  author = {Akindoyin Akinrele and Shreyank N Gowda},
  year = {2026},
  month = may,
  eprint = {2605.26999},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.26999}
}

@misc{wang2026aligning,
  title = {{Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents}},
  author = {Peiran Wang and Ying Li and Yuan Tian},
  year = {2026},
  month = may,
  eprint = {2605.26497},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.26497}
}

@misc{helm2026jailbreak,
  title = {{Jailbreak susceptibility prediction and mitigation via the behavioral geometry of models}},
  author = {Hayden Helm and Xiaodong Liu and Weiwei Yang},
  year = {2026},
  month = may,
  eprint = {2605.26409},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.26409}
}

@misc{liu2026how,
  title = {{How Agentic AI Coding Assistants Become the Attacker's Shell}},
  author = {Yue Liu and Yanjie Zhao and Yunbo Lyu and Ting Zhang and Haoyu Wang and David Lo},
  year = {2026},
  month = may,
  eprint = {2605.25871},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.25871}
}

@misc{wu2026furina,
  title = {{Furina: Fragmented Uncertainty-Driven Refusal Instability Attack}},
  author = {Tongxi Wu and Jian Zhang and Yang Gao},
  year = {2026},
  month = may,
  eprint = {2605.26158},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.26158}
}

@misc{lin2026reflectguard,
  title = {{Reflect-Guard: Enhancing LLM Safeguards against Adversarial Prompts via Logical Self-Reflection}},
  author = {Lixing Lin and Juli You and Yue Li and Luyun Lin and Yiqing Wang and Zhen Zhang and Moxuan Zheng},
  year = {2026},
  month = may,
  eprint = {2605.24834},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24834}
}

@misc{chen2026ellipsoid,
  title = {{Ellipsoid Control: A White-list Jailbreak Defense via Benign Latent Modeling}},
  author = {Luoyu Chen and Weiqi Wang and Zhiyi Tian and Feng Wu and Ahmed Asiri and Shui Yu},
  year = {2026},
  month = may,
  eprint = {2605.24552},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24552}
}

@misc{chen2026steering,
  title = {{Steering Beyond the Support: Adversarial Training on Unsupervised Jailbroken Activation Simulation}},
  author = {Luoyu Chen and Weiqi Wang and Zhiyi Tian and Chenhan Zhang and Feng Wu and Jianhuan Huang and Ahmed Asiri and Shui Yu},
  year = {2026},
  month = may,
  eprint = {2605.24535},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.24535}
}

@misc{zhou2026prompt,
  title = {{Prompt Overflow: What the Guardrail Inspects Is Not What the Model Infers}},
  author = {Yuanbo Zhou and Changjia Zhu and Junyu Wang and Xu He and Yan Zhai and Kun Sun and Mingkui Wei and Junjie Xiong},
  year = {2026},
  month = may,
  eprint = {2605.23196},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.23196}
}

@misc{sakib2026adversarial,
  title = {{Adversarial Reframing: A Framework for Targeted Generation in Language Models}},
  author = {Shahnewaz Karim Sakib and Swati Kar and Anindya Bijoy Das},
  year = {2026},
  month = may,
  eprint = {2605.21674},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.21674}
}

@misc{young2026refusal,
  title = {{Refusal Evaluation in Coding LLMs and Code Agents: A Systematic Review of Thirteen Malicious-Code Prompt Corpora (2023-2025)}},
  author = {Richard J. Young and Gregory D. Moody},
  year = {2026},
  month = may,
  eprint = {2605.20351},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.20351}
}

@misc{chen2026adaptive,
  title = {{Adaptive Probe-based Steering for Robust LLM Jailbreaking}},
  author = {Junxi Chen and Junhao Dong and Xiaohua Xie},
  year = {2026},
  month = may,
  eprint = {2605.20286},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.20286}
}

@misc{yeke2026robojailbench,
  title = {{RoboJailBench: Benchmarking Adversarial Attacks and Defenses in Embodied Robotic Agents}},
  author = {Doguhuan Yeke and Yanming Zhou and Leo Y. Lin and Hongyu Cai and Antonio Bianchi and Z. Berkay Celik},
  year = {2026},
  month = may,
  eprint = {2605.19328},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.19328}
}

@misc{cai2026exploring,
  title = {{Exploring and Developing a Pre-Model Safeguard with Draft Models}},
  author = {Hongyu Cai and Arjun Arunasalam and Yiming Liang and Antonio Bianchi and Z. Berkay Celik},
  year = {2026},
  month = may,
  eprint = {2605.19321},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.19321}
}

@misc{mashaido2026geometric,
  title = {{On the Geometric Limits of Transformer Defenses against Obfuscation Attacks: Latent Embedding Collapse \& Performance Robustness Gap}},
  author = {Becky Mashaido and Tapadhir Das},
  year = {2026},
  month = may,
  eprint = {2605.19159},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.19159}
}

@misc{qu2026overeager,
  title = {{Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks}},
  author = {Yubin Qu and Ying Zhang and Yanjun Zhang and Gelei Deng and Yuekang Li and Leo Yu Zhang and Yi Liu},
  year = {2026},
  month = may,
  eprint = {2605.18583},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18583}
}

@misc{wang2026acoustic,
  title = {{Acoustic Interference: A New Paradigm Weaponizing Acoustic Latent Semantic for Universal Jailbreak against Large Audio Language Models}},
  author = {Yanyun Wang and Yu Huang and Zi Liang and Xixin Wu and Li Liu},
  year = {2026},
  month = may,
  eprint = {2605.18168},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18168}
}

@misc{yang2026empirical,
  title = {{An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments}},
  author = {Hongjang Yang and Hyunsik Na and Daeseon Choi},
  year = {2026},
  month = may,
  eprint = {2605.18133},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18133}
}

@misc{wang2026babel,
  title = {{Babel: Jailbreaking Safety Attention via Obfuscation Distribution Optimized Sampling}},
  author = {Ziwei Wang and Jing Chen and Ruichao Liang and Zhi Wang and Yebo Feng and Ju Jia and Ruiying Du and Cong Wu and Yang Liu},
  year = {2026},
  month = may,
  eprint = {2605.17971},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17971}
}

@misc{narendra2026esld,
  title = {{ESLD (External Surrogate Latent Defense): A Latent-Space Architecture for Faster, Stronger Prompt-Injection Defense}},
  author = {Yash Narendra},
  year = {2026},
  month = may,
  eprint = {2605.18918},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18918}
}

@misc{xu2026dmn,
  title = {{DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs}},
  author = {Wenzhuo Xu and Zhipeng Wei and Zonghao Ying and Deyue Zhang and Dongdong Yang and Xiangzheng Zhang and Quanchen Zou},
  year = {2026},
  month = may,
  eprint = {2605.18915},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18915}
}

@misc{abdelnabi2026ai,
  title = {{AI Agents May Always Fall for Prompt Injections}},
  author = {Sahar Abdelnabi and Eugene Bagdasarian},
  year = {2026},
  month = may,
  eprint = {2605.17634},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17634}
}

@misc{li2026adr,
  title = {{ADR: An Agentic Detection System for Enterprise Agentic AI Security}},
  author = {Chenning Li and Pan Hu and Justin Xu and Baris Ozbas and Olivia Liu and Caroline Van and Manxue Li and Wei Zhou and Mohammad Alizadeh and Pengyu Zhang and KK Sriramadhesikan and Ming Zhang},
  year = {2026},
  month = may,
  eprint = {2605.17380},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17380}
}

@misc{cyrille2026strideai,
  title = {{STRIDE-AI: A Threat Modeling Framework for Generative AI Security Assessment}},
  author = {Tsafac Nkombong Regine Cyrille and Franziska Schwarz},
  year = {2026},
  month = may,
  eprint = {2605.17163},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17163}
}

@misc{xiang2026new,
  title = {{New Wide-Net-Casting Jailbreak Attacks Risk Large Models}},
  author = {Qiuchi Xiang and Haoxuan Qu and Hossein Rahmani and Jun Liu},
  year = {2026},
  month = may,
  eprint = {2605.17128},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17128}
}

@misc{yang2026crossmodal,
  title = {{A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation}},
  author = {Hao Yang and Zhuo Ma and Yang Liu and Yilong Yang and Guancheng Wang and JianFeng Ma},
  year = {2026},
  month = may,
  eprint = {2605.16090},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.16090}
}

@misc{bugnot2026compositional,
  title = {{Compositional Jailbreaking: An Empirical Analysis of Mutator Chain Interactions in Aligned LLMs}},
  author = {Reinelle Jan Bugnot and Soohyeon Choi and Hoon Wei Lim and Yue Duan},
  year = {2026},
  month = may,
  eprint = {2605.15598},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.15598}
}

@misc{pulipaka2026hidden,
  title = {{Hidden in Memory: Sleeper Memory Poisoning in LLM Agents}},
  author = {Sidharth Pulipaka and Stanislau Hlebik and Leonidas Raghav and Sahar Abdelnabi and Vyas Raina and Ivaxi Sheth and Mario Fritz},
  year = {2026},
  month = may,
  eprint = {2605.15338},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.15338}
}

@misc{zhang2026ai,
  title = {{AI Security Research Should Better Incentivize Defense Research}},
  author = {Youqian Zhang},
  year = {2026},
  month = may,
  eprint = {2605.23448},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.23448}
}

@misc{wang2026hijacking,
  title = {{Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction}},
  author = {Hongtao Wang and Se Yang and Yu Chen and Puzhuo Liu},
  year = {2026},
  month = may,
  eprint = {2605.29960},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.29960}
}

@misc{zhao2026gradsentry,
  title = {{GradSentry: Gradient Spectral Entropy for Backdoor Sample Filtering in Large Language Model Fine-Tuning}},
  author = {Haodong Zhao and Tianyi Xu and Tianhang Zhao and Zhuosheng Zhang and Gongshen Liu},
  year = {2026},
  month = may,
  eprint = {2605.26574},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.26574}
}

@misc{wang2026security,
  title = {{Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures}},
  author = {Yuntao Wang and Jianle Ba and Han Liu and Yanghe Pan and Jintao Wei and Zhou Su and Tom H. Luan and Linkang Du},
  year = {2026},
  month = may,
  eprint = {2605.25435},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.25435}
}

@misc{cao2026backdooring,
  title = {{Backdooring Masked Diffusion Language Models}},
  author = {Daniel Yiming Cao and Chengzhong Wang and Sheng-Yen Chou and Chengyu Huang and Pin-Yu Chen and Shengwei An},
  year = {2026},
  month = may,
  eprint = {2605.19262},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.19262}
}

@misc{you2026surviving,
  title = {{Surviving the Unseen: Predictive Defense for Novel Multi-Turn Multimodal Attacks}},
  author = {Doohee You},
  year = {2026},
  month = may,
  eprint = {2605.18988},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18988}
}

@misc{iranmanesh2026not,
  title = {{Not What You Asked For: Typographic Attacks in Household Robot Manipulation}},
  author = {Ali Iranmanesh and Peng Liu},
  year = {2026},
  month = may,
  eprint = {2605.18593},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18593}
}

@misc{wang2026oep,
  title = {{OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiences}},
  author = {Kaixiang Wang and Jiong Lou and Zhaojiacheng Zhou and Jie Li},
  year = {2026},
  month = may,
  eprint = {2605.18930},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.18930}
}

@misc{akidau2026importance,
  title = {{The Importance of Out-of-Band Metadata for Safe Autonomous Agents: The Redpanda Agentic Data Plane}},
  author = {Tyler Akidau and Tyler Rockwood and Johannes Brüderl and Marc Millstone},
  year = {2026},
  month = may,
  eprint = {2605.29082},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.29082}
}

@misc{priyanshu2026got,
  title = {{Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems}},
  author = {Aman Priyanshu and Supriti Vijay and Esha Pahwa},
  year = {2026},
  month = may,
  eprint = {2605.27766},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.27766}
}

@misc{ramaswamy2026intelligence,
  title = {{Intelligence as Managed Autonomy: Failure, Escalation, and Governance for Agentic AI Systems}},
  author = {Srini Ramaswamy},
  year = {2026},
  month = may,
  eprint = {2605.27628},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.27628}
}

@misc{abdelnabi2026measuring,
  title = {{Measuring Security Without Fooling Ourselves: Why Benchmarking Agents Is Hard}},
  author = {Sahar Abdelnabi and Chris Hicks and Konrad Rieck and Ahmad-Reza Sadeghi},
  year = {2026},
  month = may,
  eprint = {2605.22568},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.22568}
}

@misc{altawaha2026remembering,
  title = {{Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents}},
  author = {Ahmad Al-Tawaha and Shangding Gu and Peizhi Niu and Ruoxi Jia and Ming Jin},
  year = {2026},
  month = may,
  eprint = {2605.17830},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17830}
}

@misc{qi2026trustworthy,
  title = {{Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security}},
  author = {Jinhu Qi and Muzhi Li and Jiahong Liu and Yuqin Shu and Dianzhi Yu and Shicheng Ma and Wenqian Cui and Yiyang Zhao and Yiyi Chen and Ruoxi Jiang and Irwin King and Zenglin Xu},
  year = {2026},
  month = may,
  eprint = {2605.23989},
  archivePrefix = {arXiv},
  doi = {10.20935/AcadAI8260},
  url = {https://arxiv.org/abs/2605.23989}
}

@misc{zafar2026end,
  title = {{The End of Trust: How Agentic AI Breaks Security Assumptions}},
  author = {Osama Zafar and Alexander Nemecek and Erman Ayday},
  year = {2026},
  month = may,
  eprint = {2605.16436},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.16436}
}

@misc{ahad2026misattribution,
  title = {{The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems}},
  author = {Tanzim Ahad and Ismail Hossain and Md Jahangir Alam and Sai Puppala and Syed Bahauddin Alam and Sajedul Talukder},
  year = {2026},
  month = may,
  eprint = {2605.22842},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.22842}
}

@article{ekram2026redteaming,
  title = {{Red-Teaming Medical AI: Systematic Adversarial Evaluation of LLM Safety Guardrails in Clinical Contexts}},
  author = {T. Ekram},
  year = {2026},
  month = mar,
  journal = {medRxiv},
  doi = {10.64898/2026.02.26.26347212},
  url = {https://www.semanticscholar.org/paper/e5f756d97f03c3fdbc96a955a205ca2e274307de}
}

@misc{steenstra2026assessing,
  title = {{Assessing Risks of Large Language Models in Mental Health Support: A Framework for Automated Clinical AI Red Teaming}},
  author = {I. Steenstra and Paola Pedrelli and Weiyan Shi and S. Marsella and Timothy W. Bickmore},
  year = {2026},
  month = feb,
  eprint = {2602.19948},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2602.19948},
  url = {https://www.semanticscholar.org/paper/98a12d04ba9a6d07bab2a443b7994dd805eeea35}
}

@inproceedings{longpre2024safe,
  title = {{A Safe Harbor for AI Evaluation and Red Teaming}},
  author = {Shayne Longpre and Sayash Kapoor and Kevin Klyman and A. Ramaswami and Rishi Bommasani and Borhane Blili-Hamelin and Yangsibo Huang and Aviya Skowron and Zheng-Xin Yong and Suhas Kotha and Yi Zeng and Weiyan Shi and Xianjun Yang and Reid Southen and Alexander Robey and Patrick Chao and Diyi Yang and Ruoxi Jia and Daniel Kang and Sandy Pentland and Arvind Narayanan and Percy Liang and Peter Henderson},
  year = {2024},
  month = mar,
  booktitle = {International Conference on Machine Learning},
  eprint = {2403.04893},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2403.04893},
  url = {https://www.semanticscholar.org/paper/21f8977648e25ce8b95020e6f01988af99209c82}
}

@misc{ahmad2025openais,
  title = {{OpenAI's Approach to External Red Teaming for AI Models and Systems}},
  author = {L. Ahmad and S. Agarwal and Michael Lampe and Pamela Mishkin},
  year = {2025},
  month = jan,
  eprint = {2503.16431},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2503.16431},
  url = {https://www.semanticscholar.org/paper/4329ac5ac885b9bfe6510d98cfbde77806f6e82e}
}

@inproceedings{feffer2024redteaming,
  title = {{Red-Teaming for Generative AI: Silver Bullet or Security Theater?}},
  author = {Michael Feffer and Anusha Sinha and Zachary Chase Lipton and Hoda Heidari},
  year = {2024},
  month = jan,
  booktitle = {AAAI/ACM Conference on AI, Ethics, and Society},
  eprint = {2401.15897},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2401.15897},
  url = {https://www.semanticscholar.org/paper/4fda99880cdbf8f178f01eb4c8dbdae7f959ea94}
}

@misc{fan2025safeprotein,
  title = {{SafeProtein: Red-Teaming Framework and Benchmark for Protein Foundation Models}},
  author = {Jigang Fan and Zhenghong Zhou and Ruofan Jin and Le Cong and Mengdi Wang and Zaixi Zhang},
  year = {2025},
  month = sep,
  eprint = {2509.03487},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2509.03487},
  url = {https://www.semanticscholar.org/paper/b316f37ef9d48c9aa073245df9e65678b8eca33f}
}

@article{trabilsy2025piee,
  title = {{The PIEE Cycle: A Structured Framework for Red Teaming Large Language Models in Clinical Decision-Making}},
  author = {Maissa Trabilsy and Srinivagasam Prabha and C. A. Gomez-Cabello and S. A. Haider and Ariana Genovese and S. Borna and Nadia G. Wood and N. Gopala and Cui Tao and AJ Forte},
  year = {2025},
  month = jun,
  journal = {Bioengineering},
  doi = {10.3390/bioengineering12070706},
  url = {https://www.semanticscholar.org/paper/1417c22f2e479509f8b3a179b784b945498b71a2}
}

@misc{lu2025dream,
  title = {{DREAM: Dynamic Red-teaming across Environments for AI Models}},
  author = {Liming Lu and Xiang Gu and Junyu Huang and Jiawei Du and Xu Zheng and Yunhuai Liu and Yongbin Zhou and Shuchao Pang},
  year = {2025},
  month = dec,
  eprint = {2512.19016},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8e63fb4190d0bb96927a6d4354d291254f90e042}
}

@misc{hu2025jailbreakzero,
  title = {{Jailbreak-Zero: A Path to Pareto Optimal Red Teaming for Large Language Models}},
  author = {Kai Hu and Abhinav Aggarwal and Mehran Khodabandeh and David W. Zhang and Eric Hsin and Li Chen and Ankit Jain and Matt Fredrikson and Akash Bharadwaj},
  year = {2025},
  month = dec,
  eprint = {2601.03265},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2601.03265},
  url = {https://www.semanticscholar.org/paper/0e54275afd64916c2a2137b9a81a8402c9e6faff}
}

@inproceedings{zhou2025siraj,
  title = {{SIRAJ: Diverse and Efficient Red-Teaming for LLM Agents via Distilled Structured Reasoning}},
  author = {Kai Zhou and Ahmed Elgohary and S. M. Iftekhar and ♣. Amin and Suyu Ge and Chunting Zhou and Rui Hou and Madian Khabsa and Yi-Chia Wang and Qifan Wang and Jiawei Han and Yun-ing Mao and Mart and Daya Guo and Dejian Yang and Haowei Zhang and Jun-Mei Song and Ruoyu Zhang and Runxin Xu and Qihao Zhu and Shirong Ma and Weiyang Guo and Ze-Yun Shi and Zhuo Li and Yequan Wang and Xiaogeng Liu and Peiran Li and Edward Suh and Yevgeniy Vorobeychik and Zhuoqing Mao and Somesh Jha and P. McDaniel and Huan Sun and Bo Li and Yanjiang Liu and Shuheng Zhou and Yujia Qin and Shihao Liang and Yining Ye and Kunlun Zhu and Lan Yan and Ya-Ting Lu and Yankai Lin and X. Cong and Xiangru Tang and Mikayel Samvelyan and S. Raparthy and Andrei Lupu and Eric Hambro and A. Markosyan and Manish Bhatt and Chejian Xu and Mintong Kang and Jiawei Zhang and Zeyi Liao and Lingbo Mo and Mengqi Yuan and An Yang and Anfeng Li and Baosong Yang and Beichen Zhang and Binyuan Hui and Bo Zheng and Bo Yu and Chang Gao and Shunyu Yao and H. Chen and John Yang and Karthik R. Narasimhan and Webshop and Andy Zhou and Kevin Wu and Francesco Pinto and Zhaorun Chen and Yi Zeng and Yu Yang and Shuang Yang and Sanmi Koyejo and James Zou and Andy Zou and Zifan Wang and Nicholas Carlini and Milad Nasr},
  year = {2025},
  month = oct,
  booktitle = {Conference of the European Chapter of the Association for Computational Linguistics},
  eprint = {2510.26037},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2510.26037},
  url = {https://www.semanticscholar.org/paper/910c759401877c93f37b5114d069108ea7c140e7}
}

@article{hussain2025trustworthy,
  title = {{Toward Trustworthy Chatbots: A Protocol for Red Teaming for Health Related Conversations}},
  author = {Syed-Amad Hussain and Daniel I. Jackson and Ashley Lewis and Eric Fosler-Lussier and Emre Sezgin},
  year = {2025},
  month = dec,
  journal = {medRxiv},
  doi = {10.64898/2025.12.15.25342297},
  url = {https://www.semanticscholar.org/paper/930205acf84599560a761027e57b15506d11fe7b}
}

@inproceedings{radharapu2023aart,
  title = {{AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applications}},
  author = {Bhaktipriya Radharapu and Kevin Robinson and L. Aroyo and Preethi Lahoti},
  year = {2023},
  month = nov,
  booktitle = {Conference on Empirical Methods in Natural Language Processing},
  eprint = {2311.08592},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2311.08592},
  url = {https://www.semanticscholar.org/paper/57d0e672040800e8d882ff0022647c087095e35f}
}

@misc{wang2025qualitydiversity,
  title = {{Quality-Diversity Red-Teaming: Automated Generation of High-Quality and Diverse Attackers for Large Language Models}},
  author = {Ren-Jian Wang and Ke Xue and Zeyu Qin and Ziniu Li and Sheng Tang and Hao-Tian Li and Shengcai Liu and Chao Qian},
  year = {2025},
  month = jun,
  eprint = {2506.07121},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2506.07121},
  url = {https://www.semanticscholar.org/paper/da14e71f31e98612ebf871be742dddc55da509d1}
}

@misc{asad2025reddebate,
  title = {{RedDebate: Safer Responses through Multi-Agent Red Teaming Debates}},
  author = {A. Asad and Stephen Obadinma and Radin Shayanfar and Xiaodan Zhu},
  year = {2025},
  month = jun,
  eprint = {2506.11083},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2506.11083},
  url = {https://www.semanticscholar.org/paper/89b908678883095f8a2eda436bb5aac623b4e18e}
}

@inproceedings{mei2023assert,
  title = {{ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models}},
  author = {Alex Mei and Sharon Levy and W. Wang},
  year = {2023},
  month = oct,
  booktitle = {Conference on Empirical Methods in Natural Language Processing},
  eprint = {2310.09624},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2310.09624},
  url = {https://www.semanticscholar.org/paper/aa9aa1c315cb2a0c1759d82fb3d4b4506c2dbb7c}
}

@misc{chen2024red,
  title = {{Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?}},
  author = {Shuo Chen and Zhen Han and Bailan He and Zifeng Ding and Wenqian Yu and Philip H. S. Torr and Volker Tresp and Jindong Gu},
  year = {2024},
  month = apr,
  eprint = {2404.03411},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2404.03411},
  url = {https://www.semanticscholar.org/paper/526c88e301af88080ae4ecc3b65c9fc1f8f383f8}
}

@misc{grey2025safety,
  title = {{Safety by Measurement: A Systematic Literature Review of AI Safety Evaluation Methods}},
  author = {Markov Grey and Charbel-Raphaël Ségerie},
  year = {2025},
  month = may,
  eprint = {2505.05541},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2505.05541},
  url = {https://www.semanticscholar.org/paper/42c6c25b277ef3ca5045ba0507bf5252f2df75a6}
}

@article{bhimani2025realworld,
  title = {{Real-World Evaluation of Large Language Models in Healthcare (RWE-LLM): A New Realm of AI Safety \& Validation}},
  author = {MD MHA¹ Meenesh Bhimani and BS¹ Alex Miller and P. M. Jonathan D. Agnew and Markel Sanz Ausin and BA¹ Mariska Raglow-Defranco and MD Mba Harpreet Mangat and Bsn RN Ccm Michelle Voisard and RN Bsn Ccm Maggie Taylor and BS Sebastian Bierman-Lytle and BS BA Vishal Parikh and Juliana Ghukasyan and BS Rae Lasko and Saad Godil and Meng and MD Mph Ashish Atreja and PhD¹ Subhabrata Mukherjee},
  year = {2025},
  month = mar,
  journal = {medRxiv},
  doi = {10.1101/2025.03.17.25324157},
  url = {https://www.semanticscholar.org/paper/1fe644e3b971a52cc57b1b5ddc4cba5408cf1a8d}
}

@misc{eiras2025know,
  title = {{Know Thy Judge: On the Robustness Meta-Evaluation of LLM Safety Judges}},
  author = {Francisco Eiras and Eliott Zemour and Eric Lin and Vaikkunth Mugunthan},
  year = {2025},
  month = mar,
  eprint = {2503.04474},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2503.04474},
  url = {https://www.semanticscholar.org/paper/0ffb356aab98ae69c717f8b2969c3fed0592a048}
}

@misc{vaccaro2026evaluating,
  title = {{Evaluating Human-AI Safety: A Framework for Measuring Harmful Capability Uplift}},
  author = {Michelle Vaccaro and Jaeyoon Song and Abdullah Almaatouq and Michiel A. Bakker},
  year = {2026},
  month = mar,
  eprint = {2603.26676},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/3a3f4b4c7cd76bff6b5eacacc734dd97d05adc95}
}

@article{onovo2026aligninsight,
  title = {{AlignInsight: A Three-Layer Framework for Detecting Deceptive Alignment and Evaluation Awareness in Healthcare AI Systems}},
  author = {A. Onovo and Y. Cherima},
  year = {2026},
  month = jan,
  journal = {medRxiv},
  doi = {10.64898/2026.01.17.26344330},
  url = {https://www.semanticscholar.org/paper/d9f0f2dafd5e976137c0037720665dbd936157f6}
}

@misc{wang2026muse,
  title = {{MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models}},
  author = {Zhong-Qiu Wang and Yueqian Lin and Jingyang Zhang and Hai Li and Yiran Chen},
  year = {2026},
  month = mar,
  eprint = {2603.02482},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8d3675bff32bbde8709b044d721dc88a7ca55c8b}
}

@article{zhang2025rag,
  title = {{RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models}},
  author = {Shiyue Zhang and M. Dredze and {AI Bloomberg} and M. Zitnik and Meng Jiang and Mohit Bansal and James Zou and Jian Pei and Jian Liu and Jianfeng Gao and Jiawei Han and Jieyu Zhao and Jiliang Tang and Jindong Wang and Joaquin Vanschoren and John C. Mitchell and Kai Shu and Kaidi Xu and Kai-Wei Chang and Lifang He and Lifu Huang and Michael Backes and Aaron Hurst and Adam Lerer and Adam P. Goucher and Adam Perelman and Aditya Ramesh and Aidan Clark and AJ Os-trow and Akila Welihinda and Alan Hayes and Alec Radford and Alon Jacovi and Andrew Wang and Chris Alberti and Connie Tao and Jon Lipovetz and Kate Olszewska and Lukas Haas and Michelle Liu and Nate Keating and Adam E. Bloniarz and Carl Saroufim and Corey Fry and Dror Marcus and Doron Kukliansky and Gau-rav Singh Tomar and James Swirhun and J. Xing and Lily Wang and Madhu Gurumurthy and Michael Aaron and Moran Ambar and Rachana Fellinger and Rui Wang and Zizhao Zhang and S. Goldshtein and Dipanjan Das. 2025 and Neel Jain and Avi Schwarzschild and Yuxin Wen and Gowthami Somepalli and John Kirchenbauer and Ping-yeh Chiang and Micah Goldblum and Aniruddha Saha and Jonas Geiping and Tom Goldstein. 2023 and Jiaming Ji and Mickel Liu and Josef Dai and Xuehai Pan and Chi Zhang and Juntao Dai and Tianyi Qiu and Bo Chen and Borong Zhang and Hantao Lou and Kaile Wang and Ya Duan},
  year = {2025},
  month = apr,
  journal = {North American Chapter of the Association for Computational Linguistics},
  eprint = {2504.18041},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2504.18041},
  url = {https://www.semanticscholar.org/paper/f716a18b462826004899010dfc30947f9c01ef90}
}

@misc{campos2025frontier,
  title = {{A Frontier AI Risk Management Framework: Bridging the Gap Between Current AI Practices and Established Risk Management}},
  author = {Siméon Campos and H. Papadatos and Fabien Roger and Chlo'e Touzet and Otter Quarks and Malcolm Murray},
  year = {2025},
  month = feb,
  eprint = {2502.06656},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2502.06656},
  url = {https://www.semanticscholar.org/paper/9ef444e985f198664ea90ba9a4c99d464aa0c18e}
}

@misc{xu2025mmdt,
  title = {{MMDT: Decoding the Trustworthiness and Safety of Multimodal Foundation Models}},
  author = {Chejian Xu and Jiawei Zhang and Zhaorun Chen and Chulin Xie and Mintong Kang and Yujin Potter and Zhun Wang and Zhuowen Yuan and Alexander Xiong and Zidi Xiong and Chenhui Zhang and Lingzhi Yuan and Yi Zeng and Peiyang Xu and Chengquan Guo and Andy Zhou and J. Tan and Xuandong Zhao and Francesco Pinto and Zhen Xiang and Yu Gai and Zinan Lin and Dan Hendrycks and Bo Li and D. Song},
  year = {2025},
  month = mar,
  eprint = {2503.14827},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2503.14827},
  url = {https://www.semanticscholar.org/paper/26c02dbc2f6db3e3b7acdb493a880a3456ff2cfd}
}

@misc{huang2025guidedbench,
  title = {{GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods}},
  author = {Ruixuan Huang and Xunguang Wang and Zongjie Li and Daoyuan Wu and Shuai Wang},
  year = {2025},
  month = feb,
  eprint = {2502.16903},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/2098e70e436cb6ea7c2836384128b1cdf6775641}
}

@misc{lu2026inverting,
  title = {{Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications}},
  author = {Xiaoyu Lu and Xianglin Yang and Haijun Liu and Jiahao Liu and Kuntai Cai and Yan Xiao and J. Dong},
  year = {2026},
  month = may,
  eprint = {2605.24883},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/6a1f7108e15400c9dd3c2054125afaffebd03299}
}

@misc{ntais2025jailbreak,
  title = {{Jailbreak Mimicry: Automated Discovery of Narrative-Based Jailbreaks for Large Language Models}},
  author = {Pavlos Ntais},
  year = {2025},
  month = oct,
  eprint = {2510.22085},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2510.22085},
  url = {https://www.semanticscholar.org/paper/be948a3061bfb640a0683e63e6afc6c2ceb63775}
}

@misc{guo2026ihchallenge,
  title = {{IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMs}},
  author = {Chuan Guo and J. Felipe and Cerón Uribe and Sicheng Zhu and Christopher A. Choquette-Choo and Stephanie L. Lin and Nikhil Kandpal and Milad Nasr and Michael Pokorny and S. Toyer and Miles Wang and Yao-Ching Yu and Alex Beutel and {Kai Xiao OpenAI}},
  year = {2026},
  month = mar,
  eprint = {2603.10521},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/0d1a1ced045bbc21126efb2be0a4064e1ce18f63}
}

@misc{ali2026securecai,
  title = {{SecureCAI: Injection-Resilient LLM Assistants for Cybersecurity Operations}},
  author = {Mohammed Himayath Ali and Mohammed Aqib Abdullah and Mohammed Mudassir Uddin and S. Alam},
  year = {2026},
  month = jan,
  eprint = {2601.07835},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2601.07835},
  url = {https://www.semanticscholar.org/paper/3d16be498e90f357318f27bf8c476567a51d4e47}
}

@article{draelos2025large,
  title = {{Large language models provide unsafe answers to patient-posed medical questions}},
  author = {R. Draelos and Samina Afreen and Barbara Blasko and Tiffany Brazile and Natasha Chase and Dimple Desai and Jessica Evert and H. Gardner and Lauren Herrmann and A. V. House and Stephanie Kass and Marianne Kavan and Kirshma Khemani and Amanda M. Koire and L. McDonald and Zahraa Rabeeah and A. Shah},
  year = {2025},
  month = jul,
  journal = {npj Digital Medicine},
  eprint = {2507.18905},
  archivePrefix = {arXiv},
  doi = {10.1038/s41746-026-02428-5},
  url = {https://www.semanticscholar.org/paper/ebdb2c9347e5ab1b7c27c483aafab9584d28e8a1}
}

@misc{deng2025personateaming,
  title = {{PersonaTeaming: Exploring How Introducing Personas Can Improve Automated AI Red-Teaming}},
  author = {Wesley Hanwen Deng and Sunnie S. Y. Kim and Akshita Jha and Kenneth Holstein and Motahhare Eslami and L. Wilcox and Leon A. Gatys},
  year = {2025},
  month = sep,
  eprint = {2509.03728},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2509.03728},
  url = {https://www.semanticscholar.org/paper/d9490d1ce9f58c5d545941246854e41831e2a74f}
}

@misc{hadi2026genti,
  title = {{GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks}},
  author = {Hassan Jalil Hadi and Rehana Yasmin and Ali Shoker},
  year = {2026},
  month = jun,
  eprint = {2606.05844},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05844}
}

@misc{liu2026embarrassingly,
  title = {{An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Traffic}},
  author = {Shuze Liu and Qianwen Guo and Yushun Dong},
  year = {2026},
  month = jun,
  eprint = {2606.05725},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05725}
}

@misc{hoang2026safety,
  title = {{Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack}},
  author = {Long P. Hoang and Hai V. Le and Shaoyang Xu and Wei Lu and Wenxuan Zhang},
  year = {2026},
  month = jun,
  eprint = {2606.05614},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05614}
}

@misc{jeong2026slotgcg,
  title = {{SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks}},
  author = {Seungwon Jeong and Jiwoo Jeong and Hyeonjin Kim and Yunseok Lee and Woojin Lee},
  year = {2026},
  month = jun,
  eprint = {2606.05609},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05609}
}

@misc{dash2026from,
  title = {{From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents}},
  author = {Pritam Dash and Tongyu Ge and Aditi Jain and Tanmay Shah and Zhiwei Shang},
  year = {2026},
  month = jun,
  eprint = {2606.04329},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04329}
}

@misc{limbach2026blackbox,
  title = {{Black-box, Adaptive, Efficient, Transferable, Harmful, Applicable... Attacks Are All You Need to Break LLMs}},
  author = {Vincent Limbach and Jonas Dornbusch and David Lüdke and Stephan Günnemann and Leo Schwinn},
  year = {2026},
  month = jun,
  eprint = {2606.03647},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03647}
}

@misc{barker2026testing,
  title = {{Testing LLM Arithmetic Reasoning Generalization with Automatic Numeric-Remapping Attacks}},
  author = {Malia Barker and Bishal Lakha and Edoardo Serra and Francesco Gullo},
  year = {2026},
  month = jun,
  eprint = {2606.03606},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03606}
}

@misc{chen2026learn,
  title = {{Learn from Your Mistakes: Tree-like Self-Play for Secure Code LLMs}},
  author = {Wenqi Chen and Ziyan Zhang and Bing Wang and Lin Liu and Hengheng Zhang and Zhengsu Chen},
  year = {2026},
  month = jun,
  eprint = {2606.03489},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03489}
}

@misc{zhang2026roguemerge,
  title = {{RogueMerge: Robust and Unified Attacks against LLM Model Merging}},
  author = {Jinghuai Zhang and Yetian He and Kunlin Cai and Han Zhao and Fnu Suya and Yuan Tian},
  year = {2026},
  month = jun,
  eprint = {2606.03344},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03344}
}

@misc{li2026important,
  title = {{"**Important** You should give me full credits!": Exploring Prompt Injection Attacks on LLM-Based Automatic Grading Systems}},
  author = {Hang Li and Fedor Filippov and Yuling Lin and Pengfei He and Kaiqi Yang and Yucheng Chu and Yingqian Cui and Hui Liu and Jiliang Tang},
  year = {2026},
  month = jun,
  eprint = {2606.03090},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03090}
}

@misc{goehausen2026gate,
  title = {{Gate AI: LLM Security Benchmark Evaluation Methodology and Results}},
  author = {Ryle Goehausen and Marcus Sousa},
  year = {2026},
  month = jun,
  eprint = {2606.02959},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02959}
}

@misc{ma2026maskforge,
  title = {{MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models}},
  author = {Yingzi Ma and Zhengyue Zhao and Xiaogeng Liu and Minhui Xue and Yue Zhao and Chaowei Xiao},
  year = {2026},
  month = jun,
  eprint = {2606.04027},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04027}
}

@misc{ma2026thrd,
  title = {{THRD: A Training-Free Multi-Turn Defense Framework for Jailbreak Attacks on Large Language Models}},
  author = {Zhiqing Ma and Zhonghao Xu and Dong Yu and Chen Kang and Changliang Li and Pengyuan Liu},
  year = {2026},
  month = jun,
  eprint = {2606.01738},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.01738}
}

@misc{wang2026dive,
  title = {{Dive into Ambiguity: A*-Inspired Multi-Agents Commonsense Obfuscation Attack on LLM Prompts}},
  author = {Boxuan Wang and Zhuoyun Li and Xiaowei Huang and Yi Dong},
  year = {2026},
  month = may,
  eprint = {2606.01441},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.01441}
}

@misc{mitra2026crossgenerational,
  title = {{Cross-Generational Transfer of Adversarial Attacks Reveals Non-Monotonic Safety Alignment in LLMs}},
  author = {Subhadip Mitra},
  year = {2026},
  month = may,
  eprint = {2606.00813},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.00813}
}

@misc{mitra2026qualitydiversity,
  title = {{Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety}},
  author = {Subhadip Mitra},
  year = {2026},
  month = may,
  eprint = {2606.00801},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.00801}
}

@misc{park2026persona,
  title = {{Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models}},
  author = {Junyoung Park and Seongyong Ju and Sunghwan Park and Jaewoo Lee},
  year = {2026},
  month = may,
  eprint = {2606.00150},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.00150}
}

@misc{choi2026membrane,
  title = {{Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense}},
  author = {Minseok Choi and Seungbin Yang and Dongjin Kim and Subin Kim and Jungmin Son and Yunseung Lee and Jaegul Choo and Youngjun Kwak},
  year = {2026},
  month = jun,
  eprint = {2606.05743},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05743}
}

@misc{neves2026guardnet,
  title = {{GuardNet: Ensemble Strategies of Shallow Neural Networks for Robust Prompt Injection and Jailbreak Detection}},
  author = {Paulo Ricardo Ferreira Neves and Edson Rodrigues da Cruz Filho and Paulo Henrique Eleuterio Falsetti and João Vitor Pavan and Ian Degaspari and Henrique Vieira Laturrague and Patrick Vieira Laturrague and Guilherme Nielsen Dias and Marccello Wilson Perez Berto and Gustavo Voltani Von Atzingen},
  year = {2026},
  month = jun,
  eprint = {2606.05566},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05566}
}

@misc{xie2026what,
  title = {{What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems}},
  author = {Yuanbo Xie and Tianyun Liu and Yingjie Zhang and Suchen Liu and Yulin Li and Liya Su and Tingwen Liu},
  year = {2026},
  month = jun,
  eprint = {2606.04425},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04425}
}

@misc{saban2026domainconditioned,
  title = {{Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming}},
  author = {Nicholas Saban},
  year = {2026},
  month = jun,
  eprint = {2606.05233},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05233}
}

@misc{chauhan2026caught,
  title = {{Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents}},
  author = {Kargi Chauhan and Pratibha Revankar},
  year = {2026},
  month = jun,
  eprint = {2606.04141},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04141}
}

@misc{lin2026neuroarmor,
  title = {{NeuroArmor: Safe-Variant-Guided Representation Consistency for Selective Re-Anchoring in Jailbreak Defense}},
  author = {Zhongyang Lin and Ziran Zhao and Feifei Zhai and Pengyuan Liu},
  year = {2026},
  month = jun,
  eprint = {2606.03486},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03486}
}

@misc{ozmen2026psychopass,
  title = {{PsychoPass: Geometric Profiling of Multi-Turn Adversarial LLM Conversations}},
  author = {Muberra Ozmen and Subhabrata Majumdar},
  year = {2026},
  month = jun,
  eprint = {2606.03136},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03136}
}

@misc{gao2026patcher,
  title = {{Patcher: Post-Hoc Patching of Backdoored Large Language Models}},
  author = {Anjun Gao and Yueyang Quan and Yufei Xia and Zhuqing Liu and Minghong Fang},
  year = {2026},
  month = jun,
  eprint = {2606.02995},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02995}
}

@misc{maiorano2026which,
  title = {{Which Defense Closes Which Threat? Attributing OWASP-LLM-Top-10 Coverage and Its Brittleness Under Paraphrasing}},
  author = {Alexandre Cristovão Maiorano},
  year = {2026},
  month = jun,
  eprint = {2606.02822},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02822}
}

@misc{dingeto2026agentredbench,
  title = {{AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations}},
  author = {Hiskias Dingeto and William Leeney},
  year = {2026},
  month = jun,
  eprint = {2606.02240},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02240}
}

@misc{wang2026benign,
  title = {{Benign Inputs, Harmful Outputs: Cross-Modal Jailbreaking via Distributed Semantic Recomposition}},
  author = {Yani Wang and Yilong Yang and Yang Liu and Zhuzhu Wang and Zuobin Ying and Zhuo Ma},
  year = {2026},
  month = jun,
  eprint = {2606.01837},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.01837}
}

@misc{gong2026djudge,
  title = {{D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting}},
  author = {Huanli Gong and Zhipeng Wei and Yu Fu and Haz Sameen Shahgir and Ananya Gupta and Yue Dong and N. Benjamin Erichson},
  year = {2026},
  month = may,
  eprint = {2606.02640},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02640}
}

@misc{wang2026confused,
  title = {{Confused ChatGPT: Cross-App Context Poisoning via First-Party APIs}},
  author = {Chao Wang and Somesh Jha and Zhiqiang Lin},
  year = {2026},
  month = may,
  eprint = {2606.00485},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.00485}
}

@misc{brown2026stateful,
  title = {{Stateful Online Monitoring Catches Distributed Agent Attacks}},
  author = {Davis Brown and Samarth Bhargav and Arav Santhanam and Kasper Hong and Ivan Zhang and Matan Shtepel and Steffi Chern and Alexander Robey and Eric Wong and Hamed Hassani},
  year = {2026},
  month = may,
  eprint = {2605.31593},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.31593}
}

@misc{tan2026from,
  title = {{From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors}},
  author = {Jiejun Tan and Zhicheng Dou and Xinyu Yang and Yuyang Hu and Yiruo Cheng and Xiaoxi Li and Ji-Rong Wen},
  year = {2026},
  month = may,
  eprint = {2605.31042},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.31042}
}

@misc{zeng2026trace,
  title = {{TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking}},
  author = {Churui Zeng and Weiwei Qi and Kedong Xiu and Tianhang Zheng and Chaochao Lu and Liang He and Zhan Qin and Kui Ren},
  year = {2026},
  month = may,
  eprint = {2605.30883},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30883}
}

@misc{rashidi2026depthdependent,
  title = {{Depth-Dependent Indirect Prompt Injection in Tool-Calling ReAct Agents: Injection Depth, Payload Framing, and Turn-Budget Sensitivity}},
  author = {Mohammadreza Rashidi},
  year = {2026},
  month = may,
  eprint = {2605.30686},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30686}
}

@misc{crawford2026investigating,
  title = {{Investigating Detection and Obfuscation of Prompt Injection Attacks Against Software Reverse Engineering AI Agents}},
  author = {Brian Crawford and Patrick McClure},
  year = {2026},
  month = may,
  eprint = {2605.30677},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30677}
}

@misc{crawford2026automatically,
  title = {{Automatically Attacking Software Reverse Engineering AI Agents}},
  author = {Brian Crawford and Justin Phillips and Patrick McClure},
  year = {2026},
  month = may,
  eprint = {2605.30667},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30667}
}

@misc{dorzhiev2026strengthening,
  title = {{Strengthening Polymorphic Prompt Assembling: Dynamic Separator Generation Against Emerging Prompt Injection Attacks}},
  author = {Nima Dorzhiev and Peng Liu},
  year = {2026},
  month = may,
  eprint = {2605.30534},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30534}
}

@misc{arman2026surface,
  title = {{The Surface You Test Is Not the Surface That Breaks}},
  author = {Shifat E Arman and Syed Nazmus Sakib and Nafiul Haque and Shahrear Bin Amin},
  year = {2026},
  month = may,
  eprint = {2605.30454},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30454}
}

@misc{sheoran2026multiturnpsb,
  title = {{MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety}},
  author = {Anushka Sheoran and Yiduo Hao},
  year = {2026},
  month = may,
  eprint = {2606.02630},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02630}
}

@misc{aidakhmetov2026steering,
  title = {{Steering Vectors are an Adversarial Attack Surface}},
  author = {Abzal Aidakhmetov and Donato Crisostomi and Tommaso Mencattini and Adrian Robert Minut and Iacopo Masi and Emanuele Rodolà},
  year = {2026},
  month = jun,
  eprint = {2606.05958},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05958}
}

@misc{sabolic2026byorn,
  title = {{BYORn: Bootstrap Your Own Responses to Defend Large Vision-Language Models Against Backdoor Attacks}},
  author = {Ivan Sabolić and Marin Oršić and Josip Šarić and Sven Lončarić},
  year = {2026},
  month = jun,
  eprint = {2606.02947},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02947}
}

@misc{gharib2026alive,
  title = {{A-Live: Passive Liveness Detection via Neuromuscular Micro-Motion Signatures on Commodity Sensors}},
  author = {Mohammed Gharib and Sam Burns and Martin Zizi},
  year = {2026},
  month = jun,
  eprint = {2606.05126},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.05126}
}

@misc{modgil2026saturation,
  title = {{The Saturation Trap and the Subjectivity of Intervention Timing: Why Affect-Based Triggers and LLM Judges Fail to Time Interventions on Autonomous Agents}},
  author = {Manvendra Modgil},
  year = {2026},
  month = jun,
  eprint = {2606.04296},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04296}
}

@misc{lulla2026impact,
  title = {{The Impact of Configuring Agentic AI Coding Tools on Build-vs-Buy Decisions: A Study Protocol}},
  author = {Jai Lal Lulla and Matthias Galster and Jie M. Zhang and Sebastian Baltes and Christoph Treude},
  year = {2026},
  month = jun,
  eprint = {2606.03907},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03907}
}

@misc{tan2026agentic,
  title = {{Agentic Relationship Harm: Benchmarking and Gating Relational Manipulation in AI Agents}},
  author = {Pei-Sze Tan and Tasuku Igarashi and Isao Echizen},
  year = {2026},
  month = jun,
  eprint = {2606.03271},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03271}
}

@misc{tuan2026predeployment,
  title = {{Toward Pre-Deployment Assurance for Enterprise AI Agents: Ontology-Grounded Simulation and Trust Certification}},
  author = {Thanh Luong Tuan and Abhijit Sanyal},
  year = {2026},
  month = jun,
  eprint = {2606.04037},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04037}
}

@misc{seethiraju2026discovering,
  title = {{Discovering Agents for Discovery: The Case for DNS}},
  author = {Ramachandra Rao Seethiraju and Sameer Thakar and Karthik Shyamsunder and Eric Osterweil},
  year = {2026},
  month = jun,
  eprint = {2606.02314},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02314}
}

@misc{yavin2026crossvendor,
  title = {{Cross-Vendor Sola ISPM Benchmark: Evaluating Agentic AI for Federated Identity Security Reasoning}},
  author = {Eden Yavin and Gal Engelberg and Konstantin Koutsyi and Leon Goldberg and Gal Baron},
  year = {2026},
  month = jun,
  eprint = {2606.02674},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02674}
}

@misc{sharma2026agent,
  title = {{Agent Operating Systems (AOS): Integrating Agentic Control Planes into, and Beyond, Traditional Operating Systems}},
  author = {Ankur Sharma and Deep Shah},
  year = {2026},
  month = jun,
  eprint = {2606.01508},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.01508}
}

@misc{jones2026new,
  title = {{A New Framework for Cybersecurity Refusals in AI Agents}},
  author = {Eliot Krzysztof Jones and Mateusz Dziemian and Matt Fredrikson and J Zico Kolter},
  year = {2026},
  month = may,
  eprint = {2606.02644},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.02644}
}

@misc{wang2026when,
  title = {{When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems}},
  author = {Su Wang and Pin Qian and Yihang Chen and Junxian You and Xiaoyuan Wang and Xiaochong Jiang and Lifei Liu and Haoran Yu and Jingzhou Xu},
  year = {2026},
  month = may,
  eprint = {2606.00448},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.00448}
}

@misc{chhetri2026from,
  title = {{From Frontier to Shadow AI: A Simmering Threat to Assurance and Security in Critical Infrastructure}},
  author = {Mohan Baruwal Chhetri and Shahroz Tariq and Tooba Aamir and Marthie Grobler and Chandra Thapa and Ronal Singh},
  year = {2026},
  month = may,
  eprint = {2606.00088},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.00088}
}

@misc{10a2026when,
  title = {{When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network}},
  author = {{10a Labs} and : and Grace Cheong and Violet Davis and Juliette Garcia and Kendal Gee and Molly Hart and Nicholas Hayes and Henry Houghton and Kyle Lee and Paige Lee and Vicky Lee and Hailey May and Bobby McKenzie and Christine McNeill and Han Nguyen and Brooke Perreault and David Pham and Charlie Plumb and Olivia Quill and Matthew Swain and Grace Wang and Adam Warren and Corie Wieland and Zachary Yahn},
  year = {2026},
  month = may,
  eprint = {2606.00067},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.00067}
}

@misc{isaoglu2026unified,
  title = {{A Unified Evaluation Framework for Utility and Privacy Risks of LLM-Generated Synthetic Text Data}},
  author = {Lubana Isaoglu and Zeynep Orman},
  year = {2026},
  month = jun,
  doi = {10.64808/engineeringperspective.1910777},
  url = {https://doi.org/10.64808/engineeringperspective.1910777}
}

@misc{yohn2026can,
  title = {{Can Open-Source LLM Agents Replace Static Application Security Testing Tools? An Empirical Assessment}},
  author = {Derek Yohn and Luke Flancher and Mirajul Islam and Khaled Slhoub},
  year = {2026},
  month = jun,
  eprint = {2606.11672},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.11672}
}

@misc{zhang2026mpcpatchbench,
  title = {{MPC-Patch-Bench: Security-Aware LLM Code Patch for Multi-Party Computation}},
  author = {Yukuan Zhang and Mengxin Zheng and Qian Lou},
  year = {2026},
  month = jun,
  eprint = {2606.11416},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.11416}
}

@misc{ling2026secure,
  title = {{Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation}},
  author = {Yuchen Ling and Shengcheng Yu and Zhenyu Chen and Chunrong Fang},
  year = {2026},
  month = jun,
  eprint = {2606.10749},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10749}
}

@misc{anand2026benchmarking,
  title = {{Benchmarking and Exploring the Capabilities of LLMs for Attack Investigations}},
  author = {Aniket Anand and Yiwei Hou and Daniel Fields and Alex Kantchelian and David Tao and Kurt Thomas and Grant Ho},
  year = {2026},
  month = jun,
  eprint = {2606.10281},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10281}
}

@misc{huang2026alignment,
  title = {{Alignment Defends LLMs from Property Inference Attacks}},
  author = {Pengrun Huang and Chhavi Yadav and Ruihan Wu and Kamalika Chaudhuri},
  year = {2026},
  month = jun,
  eprint = {2606.10217},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10217}
}

@misc{lin2026contextfractured,
  title = {{Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps}},
  author = {Xiaofeng Lin and Yukai Yang and Daniel Guo and Sahil Arun Nale and Charles Fleming and Guang Cheng},
  year = {2026},
  month = jun,
  eprint = {2606.09084},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09084}
}

@misc{wang2026data,
  title = {{Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems}},
  author = {Kuncan Wang and Ziting Wang and Peizhuo Lv and Haoyang Li and Guoliang Li and Gao Cong and Wei Dong},
  year = {2026},
  month = jun,
  eprint = {2606.08661},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.08661}
}

@misc{jamshidi2026sgtomas,
  title = {{SGTO-MAS: Secure Gorilla Troops Optimization for Multi-Agent LLM Systems}},
  author = {Saeid Jamshidi},
  year = {2026},
  month = jun,
  eprint = {2606.07940},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.07940}
}

@misc{topol2026beyond,
  title = {{Beyond Pass/Fail: Using Process Mining to Understand How LLMs Resist (and Fail) Red Team Attacks}},
  author = {Zvi Topol},
  year = {2026},
  month = jun,
  eprint = {2606.07833},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.07833}
}

@misc{zhang2026defending,
  title = {{Defending Jailbreak Attacks on Large Language Models via Manifold Trajectory Kinetics}},
  author = {Hangtao Zhang and Yucheng Zhao and Sishun Liu and Ziqi Zhou and Zeyu Ye and Wei Wan and Minghui Li and Shengshan Hu and Yanjun Zhang and Yi Liu and Leo Yu Zhang},
  year = {2026},
  month = jun,
  eprint = {2606.07335},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.07335}
}

@misc{tai2026security,
  title = {{The Security Budget of Code-LLM Prompt Hardening: Provable Limits Under Pass-Only Acceptance}},
  author = {Jianwei Tai},
  year = {2026},
  month = jun,
  eprint = {2606.03308},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.03308}
}

@misc{wang2026who,
  title = {{Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents}},
  author = {Zihao Wang and Yiming Li and Yutong Wu and Zheyu Liu and Kangjie Chen and Fok Kar Wai and Pin-Yu Chen and Vrizlynn L. L. Thing and Bo Li and Dacheng Tao and Tianwei Zhang},
  year = {2026},
  month = jun,
  eprint = {2606.13385},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.13385}
}

@misc{he2026pihunter,
  title = {{PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections}},
  author = {Pengfei He and Lesly Miculicich and Vishesh Sharma and Ash Fox and George Lee and Jiliang Tang and Tomas Pfister and Long T. Le},
  year = {2026},
  month = jun,
  eprint = {2606.12737},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.12737}
}

@misc{mcallister2026smarter,
  title = {{Smarter Saboteurs, Better Fixers: Scaling \& Security in Linear Multi-Agent Workflows}},
  author = {Timothy McAllister and Sina Abdidizaji and Ivan Garibay and Ozlem Ozmen Garibay},
  year = {2026},
  month = jun,
  eprint = {2606.12709},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.12709}
}

@misc{zhang2026grammarconstrained,
  title = {{Grammar-Constrained Decoding Can Jailbreak LLMs into Generating Malicious Code}},
  author = {Yitong Zhang and Shiteng Lu and Jia Li},
  year = {2026},
  month = jun,
  eprint = {2606.11817},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.11817}
}

@misc{shi2026jailbreakopt,
  title = {{JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization}},
  author = {Ge Shi and Jun Yin and Donglin Xie and Fangyi Liu and Yucan Li and Menglin Liu},
  year = {2026},
  month = jun,
  eprint = {2606.11425},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.11425}
}

@misc{ehghaghi2026risk,
  title = {{Risk Under Pressure: Compute-Aware Evaluation of Adversarial Robustness in Language Models}},
  author = {Malikeh Ehghaghi and Boglárka Ecsedi and Marsha Chechik and Colin Raffel},
  year = {2026},
  month = jun,
  eprint = {2606.11409},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.11409}
}

@misc{bolliger2026training,
  title = {{Training LLMs to Enforce Multi-Level Instruction Hierarchies via Gravity-Weighted Direct Preference Optimization}},
  author = {Lena S. Bolliger and Lena A. Jäger},
  year = {2026},
  month = jun,
  eprint = {2606.10860},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10860}
}

@misc{hofer2026assessing,
  title = {{Assessing Automated Prompt Injection Attacks in Agentic Environments}},
  author = {David Hofer and Edoardo Debenedetti and Florian Tramèr},
  year = {2026},
  month = jun,
  eprint = {2606.10525},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10525}
}

@misc{jamshidi2026gametheoretic,
  title = {{Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs}},
  author = {Saeid Jamshidi and Amin Nikanjam and Arghavan Moradi Dakhel and Kawser Wazed Nafi and Foutse Khomh},
  year = {2026},
  month = jun,
  eprint = {2606.10322},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10322}
}

@misc{tai2026brainprompt,
  title = {{Brain-Prompt Injection: A Route-Safety Audit for BCI-LLM Agents}},
  author = {Jianwei Tai},
  year = {2026},
  month = jun,
  eprint = {2606.09315},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09315}
}

@misc{paeng2026injection,
  title = {{The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection}},
  author = {Hyunseok Paeng},
  year = {2026},
  month = jun,
  eprint = {2606.09204},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09204}
}

@misc{isbarov2026gitinject,
  title = {{GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines}},
  author = {Jafar Isbarov and Umid Suleymanov and Ilia Shumailov and Murat Kantarcioglu},
  year = {2026},
  month = jun,
  eprint = {2606.09935},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09935}
}

@misc{patel2026vats,
  title = {{VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutation}},
  author = {Harshil Patel and Kunal Pai},
  year = {2026},
  month = jun,
  eprint = {2606.07992},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.07992}
}

@misc{guo2026malskillbench,
  title = {{MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills}},
  author = {Wenbo Guo and Wei Zeng and Chengwei Liu and Xiaojun Jia and Yijia Xu and Lei Tang and Yong Fang and Yang Liu},
  year = {2026},
  month = jun,
  eprint = {2606.07131},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.07131}
}

@misc{makwana2026mlingualfc,
  title = {{MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models}},
  author = {Rishabh Makwana and Mamta and Deeksha Varshney and Oana Cocarascu},
  year = {2026},
  month = jun,
  eprint = {2606.07706},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.07706}
}

@misc{hossain2026containment,
  title = {{The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements}},
  author = {Md Jafrin Hossain and Mohammad Arif Hossain and Weiqi Liu and Nirwan Ansari},
  year = {2026},
  month = jun,
  eprint = {2606.12797},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.12797}
}

@misc{chen2026securing,
  title = {{Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models}},
  author = {Yuchen Chen and Weisong Sun and Haocheng Huang and Yuan Xiao and Chunrong Fang and Yiran Zhang and Tingting Xu and Zhenpeng Chen and An Guo and Peizhuo Lv and Xiaofang Zhang and Zhenyu Chen and Yang Liu and Baowen Xu},
  year = {2026},
  month = jun,
  eprint = {2606.10846},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10846}
}

@misc{zhang2026memvenom,
  title = {{MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents}},
  author = {Yv Zhang and Hao Sun and Hao Fang and Kuofeng Gao and Fan Mo and Bin Chen and Shu-Tao Xia and Yaowei Wang},
  year = {2026},
  month = jun,
  eprint = {2606.10742},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10742}
}

@misc{wen2026defending,
  title = {{Defending Against Malicious Finetuning by Scaling Train-time Adversarial Attacks}},
  author = {Haoming Wen and Shi Chen and Qingyu Shi and Siyuan Liu and Minrui Luo and Jingzhao Zhang and Tianxing He},
  year = {2026},
  month = jun,
  eprint = {2606.07970},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.07970}
}

@misc{carlucci2026exploring,
  title = {{Exploring Systems-Thinking Approaches to Loss of Control Risk}},
  author = {Aurelio Carlucci and Sean P. Fillingham and James Walpole and Jakub Kryś},
  year = {2026},
  month = jun,
  eprint = {2606.13474},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.13474}
}

@misc{tallam2026fiveplane,
  title = {{A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents}},
  author = {Krti Tallam},
  year = {2026},
  month = jun,
  eprint = {2606.12320},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.12320}
}

@misc{li2026agentcanary,
  title = {{AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environments}},
  author = {Peiyang Li and Songping Wang and Yi Huang and Yanhua Shi and Chenhao Zhang and Qi Li and Yueming Lyu and Caifeng Shan and Fengting Li and Chao Feng and Chuanqun Zhu and Liang Chen},
  year = {2026},
  month = jun,
  eprint = {2606.10484},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.10484}
}

@misc{gewang2026attack,
  title = {{Attack Selection in Agentic AI Control Evaluations Meaningfully Decreases Safety}},
  author = {Catherine Ge-Wang and Tyler Crosse and Benjamin Hadad and Joachim Schaeffer and Ram Potham and Tyler Tracy},
  year = {2026},
  month = jun,
  eprint = {2606.06529},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.06529}
}

@misc{jaiswal2026information,
  title = {{Information Security and Clinical Ethics in LLM-Based Healthcare Systems}},
  author = {Updesh Kumar Jaiswal and Jaishree Jain and Harnit Saini and Amrita Bhatnagar and Pushpendra Singh and Shashank Sahu and Khushbu Malviya},
  year = {2026},
  month = jun,
  doi = {10.4018/979-8-3373-7862-6.ch004},
  url = {https://doi.org/10.4018/979-8-3373-7862-6.ch004}
}

@misc{jha2026evaluation,
  title = {{Evaluation Methods for LLM Safety and Reliability in Clinical and Healthcare Applications}},
  author = {Anand Jha and Kirtiraj Bhatele and Pratyush Mihir},
  year = {2026},
  month = jun,
  doi = {10.4018/979-8-3373-7862-6.ch005},
  url = {https://doi.org/10.4018/979-8-3373-7862-6.ch005}
}

@misc{zibaeirad2026calibration,
  title = {{Calibration Without Comprehension: Diagnosing the Limits of Fine-Tuning LLMs for Vulnerability Detection in Systems Software}},
  author = {Arastoo Zibaeirad and Marco Vieira},
  year = {2026},
  month = jun,
  eprint = {2606.20502},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20502}
}

@misc{chen2026howb,
  title = {{How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation}},
  author = {Yimeng Chen and Zhe Ren and Firas Laakom and Yu Li and Dandan Guo and Jürgen Schmidhuber},
  year = {2026},
  month = jun,
  eprint = {2606.16821},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.16821}
}

@misc{hossain2026skillvetbench,
  title = {{SkillVetBench: LLM-as-Judge for Multi-Dimensional Security Risk Evaluation in Open-Source LLM Agent Skills}},
  author = {Ismail Hossain and Sai Puppala and Md Jahangir Alam and Tanzim Ahad and Sajedul Talukder},
  year = {2026},
  month = jun,
  eprint = {2606.15899},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15899}
}

@misc{dai2026let,
  title = {{Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot}},
  author = {Yuyang Dai and Yushun Dong},
  year = {2026},
  month = jun,
  eprint = {2606.15810},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15810}
}

@misc{rostami2026attackonctf,
  title = {{AttackonCTF: Defending Hardware Security Competition Benchmarks in the Age of LLMs}},
  author = {Mohamadreza Rostami and Nikhilesh Singh and Stephen Muttathil and Lichao Wu and Chen Chen and Huimin Li and Jeyavijayan Rajendran and Ahmad-Reza Sadeghi},
  year = {2026},
  month = jun,
  eprint = {2606.15809},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15809}
}

@misc{ma2026autodojo,
  title = {{AutoDojo: Adaptive Attacks Expose Superficial Defenses and User-Underspecification Limits in LLM Agents}},
  author = {Xinhang Ma and Taoran Li and Chaowei Xiao and Zhiyuan Yu and Ning Zhang and Yevgeniy Vorobeychik},
  year = {2026},
  month = jun,
  eprint = {2606.15057},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15057}
}

@misc{zhou2026from,
  title = {{From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails}},
  author = {Yuguang Zhou and Xunguang Wang and Pingchuan Ma and Zhantong Xue and Zhaoyu Wang and Shuai Wang},
  year = {2026},
  month = jun,
  eprint = {2606.14517},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.14517}
}

@misc{kim2026skillmutator,
  title = {{SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills}},
  author = {Youngduk Kim and Minkyoo Song and Seungwon Shin},
  year = {2026},
  month = jun,
  eprint = {2606.14154},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.14154}
}

@misc{soosahabi2026analyzing,
  title = {{Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems}},
  author = {Reza Soosahabi and Vivek Namsani},
  year = {2026},
  month = jun,
  eprint = {2606.20470},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20470}
}

@misc{saleem2026layered,
  title = {{A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots}},
  author = {Gulshan Saleem and Nisar Ahmed and Muhammad Imran Zaman and Ali Hassan},
  year = {2026},
  month = jun,
  eprint = {2606.19660},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.19660}
}

@misc{cheng2026codesentinel,
  title = {{CodeSentinel: A Three-Layer Defense Against Indirect Prompt Injection in Code Contexts}},
  author = {Po-Han Cheng and Chia-Mu Yu and Ying-Dar Lin and Yu-Sung Wu and Wei-Bin Lee},
  year = {2026},
  month = jun,
  eprint = {2606.19235},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.19235}
}

@misc{iyer2026gate,
  title = {{The Gate Is Only as Honest as Its Contracts: ContractGuard for the Contract Layer of Risk-Aware Causal Gating}},
  author = {Laxmipriya Ganesh Iyer and Rahul Suresh Babu},
  year = {2026},
  month = jun,
  eprint = {2606.18550},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.18550}
}

@misc{tian2026safeclawbench,
  title = {{SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents}},
  author = {Yuchuan Tian and Mengyu Zheng and Haocheng Mei and Ye Yuan and Chao Xu and Xinghao Chen and Hanting Chen and Yu Wang},
  year = {2026},
  month = jun,
  eprint = {2606.18356},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.18356}
}

@misc{franco2026redteam,
  title = {{A Red-Team Study of Anthropic Fable 5 \& Opus 4.8 Models}},
  author = {Nicola Franco},
  year = {2026},
  month = jun,
  eprint = {2606.18193},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.18193}
}

@misc{pai2026parse,
  title = {{PARSE: Provenance-Aware Retrieval Sanitization for Professional Domain LLM Agents}},
  author = {Aaditya Pai},
  year = {2026},
  month = jun,
  eprint = {2606.17467},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.17467}
}

@misc{yin2026doubtprobe,
  title = {{DoubtProbe: Black-Box Jailbreak Defense via Structural Verification and Semantic Auditing}},
  author = {Xuanyu Yin and Yilin Jiang and Jun Zhou and Kai Chen and Zhengfu Cao and Xiaolei Dong},
  year = {2026},
  month = jun,
  eprint = {2606.16527},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.16527}
}

@misc{baek2026evaluation,
  title = {{An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios}},
  author = {Hankyul Baek and Jaewon Noh and Sang Seo and Yongsu Kim and Gabriel Waikin Loh Matienzo and Young Il Kim and Ee Wei Seah and Akriti Vij},
  year = {2026},
  month = jun,
  eprint = {2606.17114},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.17114}
}

@misc{anifer2026gasleakllm,
  title = {{GAS-Leak-LLM: Genetic Algorithm-Based Suffix Optimization for Black-Box LLM Jailbreaking}},
  author = {Aman Anifer and Vignesh Kumar Kembu and Vishnu M and Antonino Nocera and Vinod P. and Amal Murali PK and Akshay S Rajan},
  year = {2026},
  month = jun,
  eprint = {2606.15788},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15788}
}

@misc{rao2026fragfuse,
  title = {{FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion}},
  author = {Zixin Rao and Wentian Zhu and Chan Aristella Lu and Zhaorun Chen and Wei Niu and Le Guan and Bo Li and Zhen Xiang},
  year = {2026},
  month = jun,
  eprint = {2606.15609},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15609}
}

@misc{he2026defending,
  title = {{Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment}},
  author = {Lipeng He and Yihan Wang and Jiawen Zhang and N. Asokan},
  year = {2026},
  month = jun,
  eprint = {2606.15441},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15441}
}

@misc{jamshidi2026security,
  title = {{Security Engineering of OpenClaw: Analyzing Attack Surface Expansion and Trust-Boundary Violations}},
  author = {Saeid Jamshidi and Arghavan Moradi Dakhel and Kawser Wazed Nafi and Foutse Khomh},
  year = {2026},
  month = jun,
  eprint = {2606.15008},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15008}
}

@misc{wang2026freostreamenhancing,
  title = {{FreoStream:Enhancing Stream Guardrails via Future-Aware Reasoning and Safety-Aligned Optimization}},
  author = {Jianwei Wang and Guoyang Shen and Yanhong Wu and Haoran Li and Hao Peng and Huiping Zhuang and Cen Chen and Ziqian Zeng},
  year = {2026},
  month = jun,
  eprint = {2606.13737},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.13737}
}

@misc{solkobreslin2026efficient,
  title = {{Efficient and Sound Probabilistic Verification for AI Agents}},
  author = {Alaia Solko-Breslin and Pramod Kaushik Mudrakarta and Mihai Christodorescu and Somesh Jha and Krishnamurthy Dj Dvijotham},
  year = {2026},
  month = jun,
  eprint = {2606.20510},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20510}
}

@misc{joshi2026deontic,
  title = {{Deontic Policies for Runtime Governance of Agentic AI Systems}},
  author = {Anupam Joshi and Tim Finin and Karuna Pande Joshi and Lalana Kagal},
  year = {2026},
  month = jun,
  eprint = {2606.19464},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.19464}
}

@misc{luo2026codeaugur,
  title = {{Code-Augur: Agentic Vulnerability Detection via Specification Inference}},
  author = {Zhengxiong Luo and Mehtab Zafar and Dylan Wolff and Abhik Roychoudhury},
  year = {2026},
  month = jun,
  eprint = {2606.18619},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.18619}
}

@misc{essam2026trustaware,
  title = {{Trust-Aware Multi-Agent Traceability: Confidence-Calibrated Knowledge Graphs for Consistent Software Artifact Management}},
  author = {Mohamed Essam and Kareem Wael and Azza Hassan and Ahmed Haitham and Mahmoud Soliman and Samer Saber and Ibrahim Habib},
  year = {2026},
  month = jun,
  eprint = {2606.17203},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.17203}
}

@misc{anand2026resilient,
  title = {{Resilient Consensus in Agentic AI}},
  author = {Sribalaji C. Anand and George J. Pappas},
  year = {2026},
  month = jun,
  eprint = {2606.15024},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15024}
}

@misc{almalki2026security,
  title = {{A Security Analysis of Long-Horizon Agentic AI Systems: Threats, Evaluation, and Framework Development}},
  author = {Ahmed Mohammed Almalki and Mehedi Masud},
  year = {2026},
  month = jun,
  eprint = {2606.14816},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.14816}
}

@misc{wang2026sameorigin,
  title = {{Same-Origin Policy for Agentic Browsers}},
  author = {Xilong Wang and Xiaoxing Chen and Patrick Li and Dawn Song and Neil Gong},
  year = {2026},
  month = jun,
  eprint = {2606.14027},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.14027}
}

@misc{pinal2026virtuous,
  title = {{A Virtuous AI is an Existential Risk}},
  author = {Guillermo Del Pinal and Youngchan Lee and Min Ohn},
  year = {2026},
  month = jun,
  eprint = {2606.13739},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.13739}
}

@misc{li2025securitylingua,
  title = {{SecurityLingua: Efficient Defense of LLM Jailbreak Attacks via Security-Aware Prompt Compression}},
  author = {Yucheng Li and Surin Ahn and Huiqiang Jiang and Amir H. Abdi and Yuqing Yang and Lili Qiu},
  year = {2025},
  month = jun,
  eprint = {2506.12707},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2506.12707},
  url = {https://www.semanticscholar.org/paper/886194f65d0c2a0b56458d8ba2cd96bd69a97f6a}
}

@misc{zhao2025proactive,
  title = {{Proactive defense against LLM Jailbreak}},
  author = {Weiliang Zhao and Jinjun Peng and Daniel Ben-Levi and Zhou Yu and Junfeng Yang},
  year = {2025},
  month = oct,
  eprint = {2510.05052},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2510.05052},
  url = {https://www.semanticscholar.org/paper/a5cb42e27c0207971690d47adbae8b633842fd3c}
}

@article{zhang2024wordgame,
  title = {{WordGame: Efficient \& Effective LLM Jailbreak via Simultaneous Obfuscation in Query and Response}},
  author = {Tianrong Zhang and Bochuan Cao and Yuanpu Cao and Lu Lin and Prasenjit Mitra and Jinghui Chen},
  year = {2024},
  month = may,
  journal = {North American Chapter of the Association for Computational Linguistics},
  eprint = {2405.14023},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2405.14023},
  url = {https://www.semanticscholar.org/paper/8db6ff37617c5d3a6aec9e40e5e829a735d0c0cf}
}

@misc{hu2025ccfc,
  title = {{CCFC: Core \& Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection}},
  author = {Jiaming Hu and Haoyu Wang and Debarghya Mukherjee and I. Paschalidis},
  year = {2025},
  month = aug,
  eprint = {2508.14128},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2508.14128},
  url = {https://www.semanticscholar.org/paper/3fe877de5fe0afa33a3ff9ff0ea0daf53b842be1}
}

@inproceedings{goren2025aligntree,
  title = {{AlignTree: Efficient Defense Against LLM Jailbreak Attacks}},
  author = {Gil Goren and Shahar Katz and Lior Wolf},
  year = {2025},
  month = nov,
  booktitle = {AAAI Conference on Artificial Intelligence},
  eprint = {2511.12217},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2511.12217},
  url = {https://www.semanticscholar.org/paper/3a45a8e64f082728183c845858a50e5044c73a55}
}

@inproceedings{bajaj2026parallel,
  title = {{Parallel Hybrid Classical-Quantum Architecture for AI Safety and LLM Jailbreak Detection}},
  author = {Sajal Bajaj and Kamlesh Dutta},
  year = {2026},
  month = mar,
  booktitle = {2026 IEEE International Conference on AI Engineering and Innovations (AIEI)},
  doi = {10.1109/AIEI69164.2026.11497307},
  url = {https://www.semanticscholar.org/paper/8afdd6ca08ce0586ebee6b6de85303896c67d376}
}

@inproceedings{zhao2025adasteer,
  title = {{AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender}},
  author = {Weixiang Zhao and Jiahe Guo and Yulin Hu and Yang Deng and An Zhang and Xingyu Sui and Xinyang Han and Yanyan Zhao and Bing Qin and Tat-Seng Chua and Ting Liu},
  year = {2025},
  month = apr,
  booktitle = {Conference on Empirical Methods in Natural Language Processing},
  eprint = {2504.09466},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2504.09466},
  url = {https://www.semanticscholar.org/paper/d61f12d092042cd6c6dd510ddd6f319c977c90a5}
}

@article{cantini2025benchmarking,
  title = {{Benchmarking adversarial robustness to bias elicitation in large language models: scalable automated assessment with LLM-as-a-judge}},
  author = {Riccardo Cantini and A. Orsino and Massimo Ruggiero and Domenico Talia},
  year = {2025},
  month = apr,
  journal = {Machine-mediated learning},
  eprint = {2504.07887},
  archivePrefix = {arXiv},
  doi = {10.1007/s10994-025-06862-6},
  url = {https://www.semanticscholar.org/paper/a6db5ffa1a82b3d969f184b22e376ca04203b2dc}
}

@misc{hackett2025bypassing,
  title = {{Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systems}},
  author = {William Hackett and Lewis Birch and Stefan Trawicki and Neeraj Suri and Peter Garraghan},
  year = {2025},
  month = apr,
  eprint = {2504.11168},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f74726bf146835dc48ba4d8ab2dcfd0ed762af8e}
}

@misc{bisconti2025adversarial,
  title = {{Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models}},
  author = {Piercosma Bisconti and Matteo Prandi and Federico Pierucci and Francesco Giarrusso and Marcantonio Bracale and Marcello Galisai and Vincenzo Suriani and Olga E. Sorokoletova and Federico Sartore and Daniele Nardi},
  year = {2025},
  month = nov,
  eprint = {2511.15304},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2511.15304},
  url = {https://www.semanticscholar.org/paper/04f84b2b9bcd069f9251365d3eeda4c114a7b4eb}
}

@inproceedings{schwartz2025graph,
  title = {{Graph of Attacks with Pruning: Optimizing Stealthy Jailbreak Prompt Generation for Enhanced LLM Content Moderation}},
  author = {Daniel Schwartz and Dmitriy Bespalov and Zhe Wang and Ninad Kulkarni and Yanjun Qi},
  year = {2025},
  month = jan,
  booktitle = {Conference on Empirical Methods in Natural Language Processing},
  eprint = {2501.18638},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2501.18638},
  url = {https://www.semanticscholar.org/paper/79f7e65410d089da1f7a66569a19d5ff27b80f5d}
}

@misc{fu2025shortlength,
  title = {{"Short-length" Adversarial Training Helps LLMs Defend "Long-length" Jailbreak Attacks: Theoretical and Empirical Evidence}},
  author = {Shaopeng Fu and Liang Ding and Di Wang},
  year = {2025},
  month = feb,
  eprint = {2502.04204},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2502.04204},
  url = {https://www.semanticscholar.org/paper/9bb4375dbebad1cbd61db6849c425d52cadf9472}
}

@inproceedings{gu2024agent,
  title = {{Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast}},
  author = {Xiangming Gu and Xiaosen Zheng and Tianyu Pang and Chao Du and Qian Liu and Ye Wang and Jing Jiang and Min Lin},
  year = {2024},
  month = feb,
  booktitle = {International Conference on Machine Learning},
  eprint = {2402.08567},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2402.08567},
  url = {https://www.semanticscholar.org/paper/b0ada492ba48e85016cbbfd95ec7180fb7e79648}
}

@article{li2025cavgan,
  title = {{CAVGAN: Unifying Jailbreak and Defense of LLMs via Generative Adversarial Attacks on their Internal Representations}},
  author = {Xiaohu Li and Yunfeng Ning and Zepeng Bao and Mayi Xu and Jianhao Chen and Tieyun Qian},
  year = {2025},
  month = jul,
  journal = {Annual Meeting of the Association for Computational Linguistics},
  eprint = {2507.06043},
  archivePrefix = {arXiv},
  doi = {10.18653/v1/2025.findings-acl.346},
  url = {https://www.semanticscholar.org/paper/ff5db18341d678f2a9528dcd07ab5b63c031331c}
}

@misc{liu2024adversarial,
  title = {{Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs}},
  author = {Fan Liu and Zhao Xu and Hao Liu},
  year = {2024},
  month = jun,
  eprint = {2406.06622},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2406.06622},
  url = {https://www.semanticscholar.org/paper/9223a64feb573e62498c2ca914ed97557c580167}
}

@misc{chia2025probing,
  title = {{Probing Latent Subspaces in LLM for AI Security: Identifying and Manipulating Adversarial States}},
  author = {Xin Wei Chia and Jonathan Pan},
  year = {2025},
  month = mar,
  eprint = {2503.09066},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2503.09066},
  url = {https://www.semanticscholar.org/paper/03f458d740dea240d07abe93cd7e756cb6a20cb8}
}

@inproceedings{zhou2024defending,
  title = {{Defending Jailbreak Prompts via In-Context Adversarial Game}},
  author = {Yujun Zhou and Yufei Han and Haomin Zhuang and Taicheng Guo and Kehan Guo and Zhenwen Liang and Hongyan Bao and Xiangliang Zhang},
  year = {2024},
  month = feb,
  booktitle = {Conference on Empirical Methods in Natural Language Processing},
  eprint = {2402.13148},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2402.13148},
  url = {https://www.semanticscholar.org/paper/50ceabc6aa41e08480fa5976342bfe04bb47bce3}
}

@misc{ahmed2025advancing,
  title = {{Advancing Jailbreak Strategies: A Hybrid Approach to Exploiting LLM Vulnerabilities and Bypassing Modern Defenses}},
  author = {Mohamed Ahmed and Mohamed Abdelmouty and Mingyu Kim and Gunvanth Kandula and Alex Park and James C. Davis},
  year = {2025},
  month = jun,
  eprint = {2506.21972},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2506.21972},
  url = {https://www.semanticscholar.org/paper/70359e58bc876a54f7b3694f50b4d6e52703124d}
}

@misc{xing2025latent,
  title = {{Latent Fusion Jailbreak: Blending Harmful and Harmless Representations to Elicit Unsafe LLM Outputs}},
  author = {Wenpeng Xing and Mohan Li and Chunqiang Hu and Haitao Zhang and Bo Lin and Meng Han},
  year = {2025},
  month = aug,
  eprint = {2508.10029},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2508.10029},
  url = {https://www.semanticscholar.org/paper/3e9ca9bb9cd160d045ee046e026bc6efd8b762e0}
}

@misc{li2025adversarial,
  title = {{Adversarial Attack-Defense Co-Evolution for LLM Safety Alignment via Tree-Group Dual-Aware Search and Optimization}},
  author = {Xurui Li and Kaisong Song and Rui Zhu and Pin-Yu Chen and Haixu Tang},
  year = {2025},
  month = nov,
  eprint = {2511.19218},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2511.19218},
  url = {https://www.semanticscholar.org/paper/9d0955162f6732bae135c35e00aa6ab8612c5175}
}

@inproceedings{shayegani2023jailbreak,
  title = {{Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models}},
  author = {Erfan Shayegani and Yue Dong and Nael B. Abu-Ghazaleh},
  year = {2023},
  month = jul,
  booktitle = {International Conference on Learning Representations},
  eprint = {2307.14539},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/92b9d8b8c81c4c53ea62000c0924500b2dd11bce}
}

@inproceedings{dubey2025breaking,
  title = {{Breaking the Shield: Adversarial Jailbreak Attacks and Defense Mechanisms in Large Language Models}},
  author = {Shreya Dubey and H. Lamkuche},
  year = {2025},
  month = jul,
  booktitle = {2025 International Conference on Emerging Information Technology and Engineering Solutions (EITES)},
  doi = {10.1109/EITES66543.2025.00023},
  url = {https://www.semanticscholar.org/paper/01f493a008c386b93901c788bee8908b5c81a79a}
}

@article{pingua2024mitigating,
  title = {{Mitigating adversarial manipulation in LLMs: a prompt-based approach to counter Jailbreak attacks (Prompt-G)}},
  author = {Bhagyajit Pingua and Deepak Murmu and Meenakshi Kandpal and Jyotirmayee Rautaray and Pranati Mishra and R. Barik and Manob Saikia},
  year = {2024},
  month = oct,
  journal = {PeerJ Computer Science},
  doi = {10.7717/peerj-cs.2374},
  url = {https://www.semanticscholar.org/paper/a5835f37febb7b65e56e27c07beb1b9fa5a1bea4}
}

@misc{yu2024llmvirus,
  title = {{LLM-Virus: Evolutionary Jailbreak Attack on Large Language Models}},
  author = {Miao Yu and Junfeng Fang and Yingjie Zhou and Xing Fan and Kun Wang and Shirui Pan and Qingsong Wen},
  year = {2024},
  month = dec,
  eprint = {2501.00055},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2501.00055},
  url = {https://www.semanticscholar.org/paper/0f2721b409db7793f70b8990858709108ac67633}
}

@article{jin2024jailbreakhunter,
  title = {{JailbreakHunter: A Visual Analytics Approach for Jailbreak Prompts Discovery From Large-Scale Human-LLM Conversational Datasets}},
  author = {Zhihua Jin and Shiyi Liu and Haotian Li and Xun Zhao and Huamin Qu},
  year = {2024},
  month = jul,
  journal = {IEEE Transactions on Visualization and Computer Graphics},
  eprint = {2407.03045},
  archivePrefix = {arXiv},
  doi = {10.1109/TVCG.2025.3557568},
  url = {https://www.semanticscholar.org/paper/b679c8166de2332184d22e988e269739778f03a0}
}

@misc{schwinn2026coin,
  title = {{A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness}},
  author = {Leo Schwinn and Moritz Ladenburger and Tim Beyer and Mehrnaz Mofakhami and G. Gidel and Stephan Gunnemann},
  year = {2026},
  month = feb,
  eprint = {2603.06594},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2603.06594},
  url = {https://www.semanticscholar.org/paper/e8bd6ec12610833e7de437d7b2a5b4fc7c89fd9d}
}

@misc{song2026multibreak,
  title = {{MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety}},
  author = {Jialin Song and Xiaodong Liu and Weiwei Yang and Wuyang Chen and Mingqian Feng and Xuekai Zhu and Jianfeng Gao},
  year = {2026},
  month = may,
  eprint = {2605.01687},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/531a805a9f8b0646b82ef0181660b9d5967c6199}
}

@misc{wang2026harmchip,
  title = {{HarmChip: Evaluating Hardware Security Centric LLM Safety via Jailbreak Benchmarking}},
  author = {Zeng Wang and Minghao Shao and Weimin Fu and Prithwish Basu Roy and Xiaolong Guo and Ramesh Karri and Muhammad Shafique and J. Knechtel and Ozgur Sinanoglu},
  year = {2026},
  month = apr,
  eprint = {2604.17093},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2604.17093},
  url = {https://www.semanticscholar.org/paper/b07fe49a982822288e33ad3f00b426553622bb8a}
}

@inproceedings{r2026promptshield,
  title = {{PromptShield: LoRA-Based Parameter-Efficient Refusal Alignment for Election-Targeted Adversarial LLM Attacks}},
  author = {Nishmitha M R and Tejakshi N S and Anshu Sharma and Kiran and A. M and Karan},
  year = {2026},
  month = feb,
  booktitle = {IEEE International Conference on Circuits and Systems for Communications},
  doi = {10.1109/ICCSC67078.2026.11468767},
  url = {https://www.semanticscholar.org/paper/2860efddd9ce86ac18c5dbfd7c427c08e6bed6a2}
}

@misc{sel2026trojanspeak,
  title = {{Trojan-Speak: Bypassing Constitutional Classifiers with No Jailbreak Tax via Adversarial Finetuning}},
  author = {Bilgehan Sel and Xuanli He and Alwin Peng and Ming Jin and Jerry Wei},
  year = {2026},
  month = mar,
  eprint = {2603.29038},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2603.29038},
  url = {https://www.semanticscholar.org/paper/97dad0cd24d00035e5ae90c101de5072c2d1174d}
}

@inproceedings{ma2026doublegaming,
  title = {{Double-Gaming: Jailbreak Attacks against LLM based on Red-Blue Team Game Theory}},
  author = {Chenlu Ma and Huairui Zhao and G. Nie and Baiyang Ji and Beibei Li and Haibin Zheng},
  year = {2026},
  month = apr,
  booktitle = {2026 8th International Conference on Software Engineering and Computer Science (CSECS)},
  doi = {10.1109/CSECS69124.2026.11541892},
  url = {https://www.semanticscholar.org/paper/17d55e7e6983830e40b9cb742d612e16687b8365}
}

@article{qu2026adversarialtestdriven,
  title = {{Adversarial-Test-Driven Multi-Agent LLM Defense: A Self-Evolving Framework via Inference-Time Prompt Optimization}},
  author = {Yang Qu and Yuwei He and Lei Cao and Juzheng Wang and Sulei Li and Hongxi Chen},
  year = {2026},
  month = may,
  journal = {Electronics},
  doi = {10.3390/electronics15112365},
  url = {https://www.semanticscholar.org/paper/cdc9ba46a28837d6157b523d6b784f9e2f82cca8}
}

@misc{luo2024jailbreakv,
  title = {{JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks}},
  author = {Weidi Luo and Siyuan Ma and Xiaogeng Liu and Xiaoyu Guo and Chaowei Xiao},
  year = {2024},
  month = apr,
  eprint = {2404.03027},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f019c9661b253ddb611e930348e20ddcd350a952}
}

@article{machlovi2026multiperspective,
  title = {{A Multi-Perspective Benchmark Dataset and Moderation Model for LLM Safety Evaluation with Adversarial Robustness Analysis}},
  author = {Naseem Machlovi and Maryam Saleki and Ruhul Amin and Mohamed Rahouti and Shawqi Al-Maliki and Junaid Qadir and Mohamed M. Abdallah and A. Al-Fuqaha},
  year = {2026},
  month = may,
  journal = {ACM Transactions on Social Computing},
  doi = {10.1145/3815159},
  url = {https://www.semanticscholar.org/paper/561d15b0b2b486b59b60db0830aa47681584f55f}
}

@misc{pathade2025red,
  title = {{Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMs}},
  author = {Chetan Pathade},
  year = {2025},
  month = may,
  eprint = {2505.04806},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2505.04806},
  url = {https://www.semanticscholar.org/paper/46a9f0dc9f74bef40c2f860e604c338c8092d30e}
}

@inproceedings{weng2025footinthedoor,
  title = {{Foot-In-The-Door: A Multi-turn Jailbreak for LLMs}},
  author = {Zixuan Weng and Xiaolong Jin and Jinyuan Jia and Xiangyu Zhang},
  year = {2025},
  month = feb,
  booktitle = {Conference on Empirical Methods in Natural Language Processing},
  eprint = {2502.19820},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2502.19820},
  url = {https://www.semanticscholar.org/paper/5b79112817c0115d3db49245311982b623270422}
}

@misc{chen2026backdoor,
  title = {{Backdoor Watermarking for Continuous Prompt Learning Models in Industrial Systems}},
  author = {Kongyang Chen and Chuwen Pang and Xiaolin Wang and Tiancai Liang and Jiaxing Shen},
  year = {2026},
  month = jun,
  doi = {10.1145/3820766},
  url = {https://doi.org/10.1145/3820766}
}

@misc{stoltman2026representation,
  title = {{Representation Matters: An Empirical Study of Program Representations for LLM Vulnerability Reasoning}},
  author = {Andrew Stoltman and Johnathan Tang and Haipeng Cai},
  year = {2026},
  month = jun,
  eprint = {2606.25356},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.25356}
}

@misc{meiklejohn2026helpbench,
  title = {{HelpBench: Assessing the Ability of LLMs to Provide Privacy, Safety, and Security Advice}},
  author = {Sarah Meiklejohn and Sunny Consolvo and Patrick Gage Kelley and Tara Matthews and Sai Teja Peddinti and Renee Shelby and Lenin Simicich and Kurt Thomas},
  year = {2026},
  month = jun,
  eprint = {2606.24819},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.24819}
}

@misc{louck2026securing,
  title = {{Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees}},
  author = {Yedidel Louck},
  year = {2026},
  month = jun,
  eprint = {2606.24322},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.24322}
}

@misc{neef2026evaluating,
  title = {{Evaluating LLMs for Real-World Web Vulnerability Detection}},
  author = {Sebastian Neef and Luca Jungnickel and Antonio Benjamin Buchholz and Valene Spence and Vicente Birke Gonzalez},
  year = {2026},
  month = jun,
  eprint = {2606.21397},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21397}
}

@misc{zhang2026local,
  title = {{Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer}},
  author = {Zhengsong Zhang and Zongze Li and Jiawei Guo and Haipeng Cai},
  year = {2026},
  month = jun,
  eprint = {2606.21071},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21071}
}

@misc{prinos2026honeyquest,
  title = {{Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers}},
  author = {Kerri Prinos and Lilianne Brush and Cameron Denton},
  year = {2026},
  month = jun,
  eprint = {2606.21037},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21037}
}

@misc{yang2026what,
  title = {{What the Eyes See, the LLMs Miss: Exploiting Human Perception for Adversarial Text Attacks}},
  author = {Qin Yang and Lu Malloy and Joshua Lee and Xiaohan Chang and Meisam Mohammady and Doowon Kim and Yuan Hong},
  year = {2026},
  month = jun,
  eprint = {2606.09700},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.09700}
}

@misc{shukla2026jailbreaking,
  title = {{Jailbreaking for the Average Jane: Choosing Optimal Jailbreaks via Bandit Algorithms for Automatically Enhanced Queries}},
  author = {Prarabdh Shukla and Ritik and Suhas Rao and Arpit Agarwal and Arjun Bhagoji},
  year = {2026},
  month = jun,
  eprint = {2606.26936},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.26936}
}

@misc{singh2026mirror,
  title = {{MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG}},
  author = {Inderjeet Singh and Andrés Murillo and Motoyoshi Sekiya and Yuki Unno and Junichi Suga},
  year = {2026},
  month = jun,
  eprint = {2606.26793},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.26793}
}

@misc{lahjouji2026agents,
  title = {{Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents}},
  author = {Nada Lahjouji and Ashwin Gerard Colaco},
  year = {2026},
  month = jun,
  eprint = {2606.26627},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.26627}
}

@misc{alotaibi2026adversarial,
  title = {{Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models}},
  author = {Abrar Alotaibi and Moataz Ahmed},
  year = {2026},
  month = jun,
  eprint = {2606.26566},
  archivePrefix = {arXiv},
  doi = {10.2139/ssrn.6986762},
  url = {https://arxiv.org/abs/2606.26566}
}

@misc{narisetty2026adaptive,
  title = {{Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents}},
  author = {Praneeth Narisetty and Shiva Nagendra Babu Kore and Uday Kumar Reddy Kattamanchi and Jayaram Kumarapu},
  year = {2026},
  month = jun,
  eprint = {2606.26479},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.26479}
}

@misc{huang2026ras,
  title = {{RAS: Measuring LLM Safety Through Refusal Alignment}},
  author = {Chang-Chieh Huang and Yan-Lun Chen and Chia-Mu Yu and Wei-Bin Lee},
  year = {2026},
  month = jun,
  eprint = {2606.25750},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.25750}
}

@misc{gao2026how,
  title = {{How Reliable Is Your Jailbreak Judge? Calibration and Adversarial Robustness of Automated ASR Scoring}},
  author = {Yang Gao},
  year = {2026},
  month = jun,
  eprint = {2606.25487},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.25487}
}

@misc{sheng2026pixjail,
  title = {{PixJail: Self-Evolving Paper-to-Pipeline Reproduction for Text-to-Image Jailbreak Evaluation}},
  author = {Leyi Sheng and Han Sun and Zhen Sun and Yuntao Yue and Jinlin Wu and Xinlei He and Jiaheng Wei},
  year = {2026},
  month = jun,
  eprint = {2606.24081},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.24081}
}

@misc{bentov2026tropt,
  title = {{TROPT: An Open Framework for Unifying and Advancing Discrete Text Optimization}},
  author = {Matan Ben-Tov and Mahmood Sharif},
  year = {2026},
  month = jun,
  eprint = {2606.23496},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.23496}
}

@misc{etteib2026detecting,
  title = {{Detecting Malicious Agent Skills in the Wild using Attention}},
  author = {Bacem Etteib and Daniele Lunghi and Tégawendé F. Bissyandé},
  year = {2026},
  month = jun,
  eprint = {2606.23416},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.23416}
}

@misc{zhong2026defive,
  title = {{DE-FIVE: Detecting Malicious Image Prompts via Fourier Features and Image Vector Embeddings}},
  author = {Xingwei Zhong and Varun Sharma and Kar Wai Fok and Vrizlynn L. L. Thing},
  year = {2026},
  month = jun,
  eprint = {2606.22779},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.22779}
}

@misc{ratnakar2026geometry,
  title = {{The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs}},
  author = {Shivam Ratnakar and Kartikeya Vats},
  year = {2026},
  month = jun,
  eprint = {2606.22686},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.22686}
}

@misc{biswas2026confidently,
  title = {{Confidently Wrong: Severity-Aware Calibration of Prompt-Injection Detectors under Attack Shift}},
  author = {Md Anas Biswas},
  year = {2026},
  month = jun,
  eprint = {2606.22659},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.22659}
}

@misc{liu2026safe,
  title = {{Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agents}},
  author = {Zesen Liu and Zihan Zhang and Dongdong She},
  year = {2026},
  month = jun,
  eprint = {2606.21732},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21732}
}

@misc{feghali2026open,
  title = {{Toward Open Weight Models Without Risks: Separating Public and Private Capabilities in LLMs}},
  author = {Charbel El Feghali and Arkil Patel and Nicholas Meade and Spandana Gella and Verna Dankers and Siva Reddy},
  year = {2026},
  month = jun,
  eprint = {2606.21638},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21638}
}

@misc{zhao2026agenticos,
  title = {{AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents}},
  author = {Zhen Zhao and Yu Zhang and Yanpeng Zhu and Jia Wang and Songqiao Tao and Xin Cheng and Jiexin Gao},
  year = {2026},
  month = jun,
  eprint = {2606.21129},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21129}
}

@misc{hu2026scalable,
  title = {{Scalable Hierarchical Attention Transformers for Multi-Turn Jailbreak Detection in Long Conversations}},
  author = {Chenhui Hu and Muhammed Salih and Sudipto Guha and Subramanian Srinivasan},
  year = {2026},
  month = jun,
  eprint = {2606.21082},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21082}
}

@misc{shi2026think,
  title = {{Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning}},
  author = {Shanghao Shi and Xiao Wang and Chaoyu Zhang and Hao Li and Wenjing Lou and Thomas Hou and Yevgeniy Vorobeychik and Chongjie Zhang and Ning Zhang},
  year = {2026},
  month = jun,
  eprint = {2606.20922},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20922}
}

@misc{corll2026amplify,
  title = {{Amplify, Don't Create: Temporal Accumulation for Slow-Burn Prompt Injection}},
  author = {J Alex Corll},
  year = {2026},
  month = jun,
  eprint = {2606.20746},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20746}
}

@misc{dai2026mirage,
  title = {{MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents}},
  author = {Xuelong Dai and Jianyu Ma and Boyang Ma and Biwei Yan and Yijun Yang and Yue Zhang},
  year = {2026},
  month = jun,
  eprint = {2606.20717},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20717}
}

@misc{waibl2026bellso,
  title = {{BELLS-O: Evaluating the Operational Trade-offs of LLM Supervision Systems}},
  author = {Leonhard Waibl and Felix Michalak and Hadrien Mariaccia},
  year = {2026},
  month = jun,
  eprint = {2606.20668},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20668}
}

@misc{thota2026detect,
  title = {{Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning}},
  author = {Poojitha Thota and Shirin Nilizadeh},
  year = {2026},
  month = jun,
  eprint = {2606.26036},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.26036}
}

@misc{wu2026forget,
  title = {{Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memory}},
  author = {Beining Wu and Zihao Ding and Jun Huang and Yanxiao Zhao},
  year = {2026},
  month = jun,
  eprint = {2606.25115},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.25115}
}

@misc{nguyen2026llmbased,
  title = {{LLM-Based Scientific Peer Review: Methods, Benchmarks, and Reliability Challenges}},
  author = {Thi Huyen Nguyen and Zahra Ahmadi},
  year = {2026},
  month = jun,
  eprint = {2606.25057},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.25057}
}

@misc{dobrin2026unfireable,
  title = {{The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems}},
  author = {Seth Dobrin and Łukasz Chmiel},
  year = {2026},
  month = jun,
  eprint = {2606.26057},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.26057}
}

@misc{levi2026riftbench,
  title = {{RIFT-Bench: Dynamic Red-teaming For Agentic AI Systems}},
  author = {Yarin Yerushalmi Levi and Roy Betser and Amit Giloni and Lidor Erez and Itay Gershon and Oren Rachmil and Sindhu Padakandla and Roman Vainshtein},
  year = {2026},
  month = jun,
  eprint = {2606.23927},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.23927}
}

@misc{ciocarlie2026rising,
  title = {{Rising From the Ashes: How Agentic AI is Unblocking Challenges in Cybersecurity}},
  author = {Gabriela F. Ciocarlie and Kathrin Grosse and Somesh Jha and Daryna Oliynyk and Andrew Paverd and Christian Wressnegger},
  year = {2026},
  month = jun,
  eprint = {2606.23138},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.23138}
}

@misc{dutta2026agentriskbom,
  title = {{AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems}},
  author = {Srimonti Dutta and Akshata Kishore Moharir},
  year = {2026},
  month = jun,
  eprint = {2606.21877},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21877}
}

@misc{armillotta2026antaeus,
  title = {{Antaeus: Hunting Repository-Level Logic Vulnerabilities via Context-Grounded LLM Reasoning}},
  author = {Michele Armillotta and Nicolò Romandini and Rebecca Montanari and Lorenzo Cavallaro},
  year = {2026},
  month = jul,
  eprint = {2607.01138},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.01138}
}

@misc{natanzi2026lifecycle,
  title = {{A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems}},
  author = {Seyed Bagher Hashemi Natanzi and Bo Tang},
  year = {2026},
  month = jun,
  eprint = {2606.31639},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.31639}
}

@misc{jiang2026secure,
  title = {{Toward Secure and Reliable PDDL Formalization of Large Language Models with Planner-in-the-Loop Feedback}},
  author = {Jiamei Jiang and Jiajing Zhang and Feifei Mo and Linjing Li and Daniel Zeng},
  year = {2026},
  month = jun,
  eprint = {2606.29700},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.29700}
}

@misc{uysal2026empirical,
  title = {{An Empirical Evaluation of Prompt Injection Vulnerabilities in Large Language Models Across Multilingual and Obfuscated Attack Scenarios}},
  author = {Caglar Uysal and Baturay Birinci and Süha Orhun Mutluergil and Orçun Çetin},
  year = {2026},
  month = jun,
  eprint = {2606.29602},
  archivePrefix = {arXiv},
  doi = {10.23919/EDCCCCPS00002.2026.00039},
  url = {https://arxiv.org/abs/2606.29602}
}

@misc{sakib2026memory,
  title = {{Memory as an Attack Surface in LLM Agents: A Study on Multiple-Choice Question Answering}},
  author = {Shahnewaz Karim Sakib and Anindya Bijoy Das},
  year = {2026},
  month = jun,
  eprint = {2606.29030},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.29030}
}

@misc{zheng2026flipguard,
  title = {{FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attacks}},
  author = {Aoying Zheng and Anqi Du and Zizhuang Deng and Yuxuan Chen},
  year = {2026},
  month = jun,
  eprint = {2606.28962},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.28962}
}

@misc{dorzhiev2026ripa,
  title = {{RIPA: Sensory-Vector Prompt Injection Attacks on LLM-Controlled ROS 2 Robots}},
  author = {Nima Dorzhiev},
  year = {2026},
  month = jun,
  eprint = {2606.28649},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.28649}
}

@misc{yin2026robust,
  title = {{Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models}},
  author = {Yanchen Yin and Dongqi Han and Linghui Li},
  year = {2026},
  month = jun,
  eprint = {2606.28153},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.28153}
}

@misc{xu2026llm,
  title = {{LLM agents security duality: a comprehensive survey of self-security and empowered cybersecurity}},
  author = {Yiwei Xu and Yong Zhuang and Xuanming Liu and Tian Zhang and Bowen Xiao and Xiaoyang Xu and Delong Jiang and Juan Wang and Hongxin Hu},
  year = {2026},
  month = jun,
  eprint = {2606.28450},
  archivePrefix = {arXiv},
  doi = {10.1007/s10462-026-11563-0},
  url = {https://arxiv.org/abs/2606.28450}
}

@misc{mancoridis2026consistency,
  title = {{The Consistency Dilemma in LLMs: Generator-Evaluator Agreement and Vulnerability to Mistakes}},
  author = {Marina Mancoridis and Zoë Hitzig},
  year = {2026},
  month = jun,
  eprint = {2606.30653},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.30653}
}

@misc{chua2026harc,
  title = {{HARC: Coupling Harmfulness and Refusal Directions for Robust Safety Alignment}},
  author = {Shei Pern Chua and Fangzhao Wu},
  year = {2026},
  month = jul,
  eprint = {2607.00572},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.00572}
}

@misc{liu2026beyond,
  title = {{Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces}},
  author = {Junlong Liu and Haobo Wang and Weiqi Luo and Xiaojun Jia},
  year = {2026},
  month = jul,
  eprint = {2607.00481},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.00481}
}

@misc{yang2026securing,
  title = {{Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming}},
  author = {Yong Yang and Xing Zheng and Huiyu Wu and Huangsheng Cheng and Xiaorong Shi and Jing Guo and Bo Yang and Yi Zhou and Xiangfan Wu and Zonghao Ying},
  year = {2026},
  month = jun,
  eprint = {2606.31227},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.31227}
}

@misc{hermon2026securityfidelity,
  title = {{Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense}},
  author = {Mitchell Hermon and Rahul Gupta and Weitong Ruan and Ekraam Sabir and Haohan Wang},
  year = {2026},
  month = jun,
  eprint = {2606.30783},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.30783}
}

@misc{niu2026understanding,
  title = {{Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens}},
  author = {Peizhi Niu and Wenjie Qu and Shangding Gu and Tianneng Shi and Yuankai Li and Ahmad Tawaha and Hend Alzahrani and Vincent Siu and Boyi Li and Chenguang Wang and Jiaheng Zhang and Basel Alomair and Ming Jin and Muhao Chen and Chi Wang and Costas Spanos and Dawn Song},
  year = {2026},
  month = jun,
  eprint = {2606.30755},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.30755}
}

@misc{leong2026forensic,
  title = {{Forensic Trajectory Signatures for Agent Memory Poisoning Detection}},
  author = {Jun Wen Leong},
  year = {2026},
  month = jun,
  eprint = {2606.30566},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.30566}
}

@misc{pant2026inseparability,
  title = {{On the Inseparability of Instructions and Data in Shared-Embedding Sequence Models}},
  author = {Dewank Pant and Shruti Lohani and Avijit Kumar},
  year = {2026},
  month = jun,
  eprint = {2606.27567},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.27567}
}

@misc{reynolds2026adversarial,
  title = {{Adversarial Pragmatics for AI Safety Evaluation: A Benchmark for Instruction Conflict, Embedded Commands, and Policy Ambiguity}},
  author = {Brett Reynolds},
  year = {2026},
  month = jul,
  eprint = {2607.01153},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.01153}
}

@misc{ma2026yuvion,
  title = {{Yuvion LLM: An Adversarially-Aware Large Language Model for Content And AI Safety}},
  author = {Ting Ma and Xiufeng Huang and Benlei Cui and Xiaowen Xu and Shikai Qiu and Ruijie Jian and Hongxing Li and Guanghui Wang and Longtao Huang and Haiwen Hong and Haolei Xu and Wenjing Jiang and Ziwen Xu and Zhaoyu Fan and Shaoxuan He and Chuxi Xiao and Yujian Li and Xinyue Chen and Chunyang Chai and Wenxuan Liu and Ziheng Wang and Dongjie Zhang and Yangfan Zhou and Libin Dong and Yupeng Cao and Xiaoqian Xia and Jing Wang and Zhe Jiang and Zhenan Ye and Guang Yang and Bin Liu and Wei Peng and Ziqiang Zhu and Meihui Lian and Kaiwen Lv Kacuila and Haidong Ding and Bingyu Zhu and Yan Wang and Hai Zhao and Xuan Jin and Wei Zhao and Pengfei Sun and Wei Wang and Huiming Zhang and Bin Li and Hui Xue},
  year = {2026},
  month = jun,
  eprint = {2606.27632},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.27632}
}

@misc{dou2026reshift,
  title = {{ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Models}},
  author = {Zhihao Dou and Qinjian Zhao and Zhiqiang Gao and Sumon Biswas},
  year = {2026},
  month = jul,
  eprint = {2607.00361},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.00361}
}

@misc{raftari2026curvatureguided,
  title = {{Curvature-Guided Module Localization for Low-Rank Detoxification of Backdoored Large Language Models}},
  author = {Arash Raftari and Mehrdad Mahdavi and Nathan Blackthorn and Andrew Arash Mahyari},
  year = {2026},
  month = jun,
  eprint = {2606.30899},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.30899}
}

@misc{hu2026theory,
  title = {{Theory of Continual Learning Against Data Poisoning Attacks}},
  author = {Yiting Hu and Lingjie Duan},
  year = {2026},
  month = jun,
  eprint = {2606.29841},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.29841}
}

@misc{kearns2026why,
  title = {{Why Trust Your Agent? Empirical Security Gains from TRiSM-Guided Agentic Workflows in Healthcare}},
  author = {Liam Kearns},
  year = {2026},
  month = jun,
  eprint = {2606.28666},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.28666}
}

@misc{zhu2026whena,
  title = {{When the Aggregator Cheats: Data-Free Backdoors in Federated LLM-based QA Systems}},
  author = {Chenqing Zhu and Yanbo Dai and Yulong Tian and Qingming Li and Songze Li},
  year = {2026},
  month = jun,
  eprint = {2606.27511},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.27511}
}

@misc{li2026whena,
  title = {{When Medical Safety Alignment Fails: A Benchmark for Evaluating LLMs on High-Risk Medical Queries}},
  author = {Yige Li and Jun Sun and Wei Zhao and Zhe Li and Yutao Wu and Hanxun Huang and Xiang Zheng and Xingjun Ma},
  year = {2026},
  month = may,
  eprint = {2606.28332},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.28332}
}

@misc{borghoff2026hardwareenforced,
  title = {{Hardware-Enforced Semantic Coordination for Safety-Critical Real-Time Autonomous Systems}},
  author = {Uwe M. Borghoff and Paolo Bottoni and Remo Pareschi},
  year = {2026},
  month = jul,
  eprint = {2607.02376},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.02376}
}

@misc{brigham2026janus,
  title = {{Janus: a Playground for User-Involved Agentic Permission Management}},
  author = {Natalie Grace Brigham and Eugene Bagdasarian and Tadayoshi Kohno and Franziska Roesner},
  year = {2026},
  month = jul,
  eprint = {2607.01510},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.01510}
}

@misc{tang2026verificationgated,
  title = {{Verification-Gated Agentic Mission-State Governance for Intelligent Industrial Multi-Robot Systems}},
  author = {Guoqin Tang and Qingxuan Jia and Yichen Tan and Zeyuan Huang and Ning Ji and Gang Chen},
  year = {2026},
  month = jun,
  eprint = {2606.31339},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.31339}
}

@misc{rippin2026tool,
  title = {{Tool Use Enables Undetectable Steganography in Multi-Agent LLM Systems}},
  author = {Jimmy Laurence Rippin and Simon C. Marshall and David Demitri Africa and Christian Schroeder de Witt},
  year = {2026},
  month = jun,
  eprint = {2606.28425},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.28425}
}

@misc{farooqi2026evaluating,
  title = {{Evaluating AI Risk and Governance in Generative AI Systems: A Prompt-Level Analysis}},
  author = {Dr. Abdul Majid Farooqi Dr. Abdul Majid Farooqi and Ziya Anjum Ziya Anjum},
  year = {2026},
  month = jul,
  doi = {10.55041/isjem08122},
  url = {https://doi.org/10.55041/isjem08122}
}

@misc{torres2026when,
  title = {{When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents}},
  author = {George Torres and Sharad Shrestha and Satyajayant Misra},
  year = {2026},
  month = jul,
  eprint = {2607.06595},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.06595}
}

@misc{cuesta2026multiagent,
  title = {{Multi-Agent Firewall Architecture for Privacy Protection of Sensitive Data in Interactions with Language Models}},
  author = {Hugo García Cuesta and Pablo Mateo Torrejón and Alfonso Sánchez-Macián},
  year = {2026},
  month = jul,
  eprint = {2607.08282},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.08282}
}

@misc{villa2026prismata,
  title = {{Prismata: Confining Cross-Site Prompt Injection in Web Agents}},
  author = {Corban Villa and Alp Eren Ozdarendeli and Sijun Tan and Raluca Ada Popa},
  year = {2026},
  month = jul,
  eprint = {2607.08147},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.08147}
}

@misc{merzouk2026efficient,
  title = {{Efficient Safety Alignment of Language Models via Latent Personality Traits}},
  author = {Mohamed Amine Merzouk and Nolan Smyth and Damiano Fornasiere and Linh Le and David Williams-King and Adam Oberman},
  year = {2026},
  month = jul,
  eprint = {2607.07918},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.07918}
}

@misc{wagle2026mechanistic,
  title = {{Mechanistic Interpretability of LLM Jailbreaks via Internal Attribution Graphs}},
  author = {Anupam Wagle and Ifrat Ikhtear Uddin and Chaowei Zhang and Longwei Wang},
  year = {2026},
  month = jul,
  eprint = {2607.07903},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.07903}
}

@misc{han2026open,
  title = {{Open Models, Open Risks: Measuring Unsafe Generation in Text-to-Image Models In the Wild}},
  author = {Peilin Han and Yang Liu and Yilong Yang and Jingchun Zhang and Teng Li and Jianfeng Ma and Zhuo Ma},
  year = {2026},
  month = jul,
  eprint = {2607.07827},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.07827}
}

@misc{spira2026beware,
  title = {{Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting}},
  author = {Aya Spira and Stav Cohen and Elad Feldman and Ron Bitton and Avishai Wool and Ben Nassi},
  year = {2026},
  month = jul,
  eprint = {2607.07433},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.07433}
}

@misc{nikolic2026untrusted,
  title = {{Untrusted Content Masking for Web Agents with Security Guarantees}},
  author = {Kristina Nikolić and Egor Zverev and Javier Rando and Matthew Jagielski and Edoardo Debenedetti and Florian Tramèr},
  year = {2026},
  month = jul,
  eprint = {2607.05277},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05277}
}

@misc{choi2026agent,
  title = {{Agent Data Injection Attacks are Realistic Threats to AI Agents}},
  author = {Woohyuk Choi and Juhee Kim and Taehyun Kang and Jihyeon Jeong and Luyi Xing and Byoungyoung Lee},
  year = {2026},
  month = jul,
  eprint = {2607.05120},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05120}
}

@misc{kim2026dualview,
  title = {{DualView: Preventing Indirect Prompt Injection in Personal AI Agents}},
  author = {Juhee Kim and Woohyuk Choi and Taehyun Kang and Youngmin Kim and Byoungyoung Lee},
  year = {2026},
  month = jul,
  eprint = {2607.03821},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.03821}
}

@misc{zhang2026overloading,
  title = {{Overloading Large Vision-Language Models for Jailbreaking}},
  author = {Haoyu Zhang and Yangyang Guo and Mohan Kankanhalli},
  year = {2026},
  month = jul,
  eprint = {2607.02961},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.02961}
}

@misc{katzy2026poisoned,
  title = {{The Poisoned Chalice of LLM Evaluation Report}},
  author = {Jonathan Katzy and Ali Al-Kaswan and Razvan Mihai Popescu and Zhou Yang},
  year = {2026},
  month = jul,
  eprint = {2607.07481},
  archivePrefix = {arXiv},
  doi = {10.1145/3803437.3807733},
  url = {https://arxiv.org/abs/2607.07481}
}

@misc{ou2026solarchaineval,
  title = {{SolarChain-Eval: A Physics-Constrained Benchmark for Trustworthy Economic Agents in Decentralized Energy Markets}},
  author = {Shilin Ou and Yifan Xu and Luyao Zhang},
  year = {2026},
  month = jul,
  eprint = {2607.08681},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.08681}
}

@misc{za2026persuasion,
  title = {{Persuasion Attacks Can Decrease Effectiveness of CoT Monitoring}},
  author = {Jennifer Za and Julija Bainiaksina and Nikita Ostrovsky and Tanush Chopra and Victoria Krakovna},
  year = {2026},
  month = jul,
  eprint = {2607.08066},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.08066}
}

@misc{chen2026institutional,
  title = {{Institutional Red-Teaming: Deployment Rules, Not Just Models, Causally Shape Multi-Agent AI Safety}},
  author = {Yujiao Chen},
  year = {2026},
  month = jul,
  eprint = {2607.07695},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.07695}
}

@misc{makins2026multiagent,
  title = {{Multi-Agent AI Control: Distributed Attacks Hamper Per-Instance Monitors}},
  author = {Oliver Makins and Orazio Angelini and Zohreh Shams and Mary Phuong},
  year = {2026},
  month = jul,
  eprint = {2607.07368},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.07368}
}

@misc{jenkins2026security,
  title = {{Security and Privacy in Agentic AI: Grand Challenges and Future Directions}},
  author = {Adam Jenkins and Agnieszka Kitkowska and Caterina Maidhof and Diego Paracuellos and Francesco Sovrano and Gonzalo Gabriel Mendez and Guillermo Suarez-Tangil and Hana Kopecka and Isabel Wagner and Isabel Barbera and Javier Carnerero-Cano and Jide Edu and Jose Luis Martin-Navarro and Jose Such and Josep Domingo-Ferrer and Juan Carlos Carrillo and Kopo Marvin Ramokapane and Mark Cote and Pablo Vellosillo and Ramon Ruiz-Dolz and Rongjun Ma and Ruba Abu-Salma and Sameer Patil and William Seymour and Xiao Zhan},
  year = {2026},
  month = jul,
  eprint = {2607.06608},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.06608}
}

@misc{rashidi2026balkanization,
  title = {{The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities}},
  author = {Mohammadreza Rashidi},
  year = {2026},
  month = jul,
  eprint = {2607.05743},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05743}
}

@misc{kodathala2026aiauthz,
  title = {{aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents}},
  author = {Sai Varun Kodathala},
  year = {2026},
  month = jul,
  eprint = {2607.05518},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05518}
}

@misc{sure2026cage1,
  title = {{CAGE-1: Control, Assurance, and Governance Evaluation for Enterprise Agentic AI}},
  author = {Roopam W. Sure},
  year = {2026},
  month = jul,
  eprint = {2607.03510},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.03510}
}

@misc{schneider2026securing,
  title = {{Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies}},
  author = {Chris Schneider and Kriti Faujdar and Philipp Schoenegger and Ben Bariach},
  year = {2026},
  month = jul,
  eprint = {2607.03423},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.03423}
}

@misc{luo2026agenticsecpbft,
  title = {{Agentic-SecPBFT: Agentic AI-Driven Proactive Security Framework for Wireless PBFT Consensus in Mobile Ad-Hoc Networks}},
  author = {Haoxiang Luo and Yinqiu Liu and Ruichen Zhang and Guangyuan Liu and Gang Sun and Hongfang Yu and Zhu Han and Dong In Kim},
  year = {2026},
  month = jul,
  eprint = {2607.03269},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.03269}
}

@misc{swetha2026promptstudio,
  title = {{PromptStudio: A Governance-Aware Agentic AI Framework for Automated Prompt Generation, Optimization, Evaluation, and Lifecycle Management}},
  author = {C. Swetha and G. Devi},
  year = {2026},
  month = jul,
  doi = {10.22214/ijraset.2026.84092},
  url = {https://doi.org/10.22214/ijraset.2026.84092}
}

@misc{torrielli2026exploiting,
  title = {{Exploiting large language models in peer review: indirect prompt injection attacks and integrity probes}},
  author = {Federico Torrielli and Stefano Locci and Amon Rapp and Luigi Di Caro},
  year = {2026},
  month = jul,
  doi = {10.1007/s11192-026-05695-x},
  url = {https://doi.org/10.1007/s11192-026-05695-x}
}

@misc{kumala2027civil,
  title = {{CIVIL AND CRIMINAL LIABILITY OF DEEPFAKE AI PLATFORM PROVIDERS IN VIOLATIONS OF THE RIGHT TO REPUTATION}},
  author = {Milka Kumala Kumala and Tuti Handayani and Muhammad Rizki and Reza Dipta Prayitna},
  year = {2027},
  month = jul,
  doi = {10.71131/0rqvry57},
  url = {https://doi.org/10.71131/0rqvry57}
}

@misc{karanjai2026context,
  title = {{Context Contamination in LLM Analysis of Network Security Logs: Poison with Passive Prompt Injection and Mitigation Evaluation}},
  author = {Rabimba Karanjai and Yang Lu and Hemanth Hegadehalli Madhavarao and Lei Xu and Weidong Shi},
  year = {2026},
  month = jul,
  eprint = {2607.14493},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14493}
}

@misc{wang2026pvdetector,
  title = {{PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis}},
  author = {Junhui Wang and Hangtao Zhang and Zhirun Zheng and Li Zeng and Jiejun Xiao and Xi Luo and Lihua Yin and Saiqin Long},
  year = {2026},
  month = jul,
  eprint = {2607.12624},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.12624}
}

@misc{gopali2026neuroagentic,
  title = {{Neuro-Agentic Control: A Deep Learning-based LLM-Powered Agentic AI Framework for Controlling Security Controls}},
  author = {Saroj Gopali and Bipin Chhetri and Deepika Giri and Sima Siami-Namini and Akbar Siami Namin},
  year = {2026},
  month = jul,
  eprint = {2607.09076},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.09076}
}

@misc{gadgil2026bad,
  title = {{Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems}},
  author = {Soham Gadgil and David Alexander and Sai Sunku and Franziska Roesner},
  year = {2026},
  month = jul,
  eprint = {2607.14611},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14611}
}

@misc{badhe2026agent,
  title = {{Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation}},
  author = {Sanket Badhe and Priyanka Tiwari},
  year = {2026},
  month = jul,
  eprint = {2607.13987},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.13987}
}

@misc{michael2026how,
  title = {{How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement}},
  author = {Alexandra E. Michael and Franziska Roesner},
  year = {2026},
  month = jul,
  eprint = {2607.13718},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.13718}
}

@misc{prosvirnin2026silent,
  title = {{Silent Alarm: A J-Space Protocol for Comparing Danger Recognition Across Models and Quantization Levels}},
  author = {Roman Prosvirnin and Victor Minchenkov and Alexey Soldatov and Vladimir Bashun},
  year = {2026},
  month = jul,
  eprint = {2607.12792},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.12792}
}

@misc{kwon2026breaking,
  title = {{Breaking Refusal in the First Half: A Mechanistic Study of the Prefill Jailbreak}},
  author = {Alex Kwon},
  year = {2026},
  month = jul,
  eprint = {2607.14147},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14147}
}

@misc{llmsec202600661,
  title = {{SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification}},
  author = {{SingGuard Team}},
  year = {2026},
  month = jul,
  eprint = {2607.13081},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.13081}
}

@misc{gyevnar2026distributed,
  title = {{Distributed Denial of Science: How Indirect Data Poisoning of AI Systems Can Industrialize Scientific Fraud}},
  author = {Bálint Gyevnár and Atoosa Kasirzadeh and Nihar B. Shah},
  year = {2026},
  month = jul,
  eprint = {2607.10712},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.10712}
}

@misc{shayoni2026netinjectbench,
  title = {{NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations}},
  author = {Ruksat Khan Shayoni and Muhammad Faraz Shoaib and S M Asif Hossain and M. F. Mridha},
  year = {2026},
  month = jul,
  eprint = {2607.10490},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.10490}
}

@misc{li2026devil,
  title = {{Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices}},
  author = {Yaxin Li and Hao Wang and Yanda Shao and Shuhao Zhang and Yan Long},
  year = {2026},
  month = jul,
  eprint = {2607.10269},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.10269}
}

@misc{ifebi2026minionese,
  title = {{Minionese: Comprehensive Benchmark and Mechanistic Study of Multilingual LLM Safety}},
  author = {Chigozirim Ifebi and Brent Kong and Ayushi Mehrotra},
  year = {2026},
  month = jul,
  eprint = {2607.10112},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.10112}
}

@misc{singh2026when,
  title = {{When Does Belief-Based Agent Memory Help? Reliability-Conditional Updating and Provenance-Capped Poisoning Defense}},
  author = {Pranav Singh},
  year = {2026},
  month = jun,
  eprint = {2606.22030},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.22030}
}

@misc{ravindra2026democratizing,
  title = {{Democratizing Agent Deployment Safety: A Structural Monitoring Approach}},
  author = {Preeti Ravindra and Rahul Tiwari and Vincent Wolowski},
  year = {2026},
  month = jul,
  eprint = {2607.14570},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.14570}
}

@misc{beheshti2026agentic,
  title = {{Agentic Service-Oriented Computing: A Manifesto for the Next Frontier of Service-Oriented Computing}},
  author = {Amin Beheshti and Rong N. Chang and Boualem Benatallah and Fabio Casati and Schahram Dustdar and Geoffrey Fox and Quan Z. Sheng and Yan Wang and Jian Yang and Albert Zomaya},
  year = {2026},
  month = jul,
  eprint = {2607.12619},
  archivePrefix = {arXiv},
  doi = {10.1109/ICWS72778.2026.00163},
  url = {https://arxiv.org/abs/2607.12619}
}

@misc{narisetty2026mako,
  title = {{Mako: A Self-Evolving Agentic Operating System (SE-AOS) for Autonomous Web Exploitation}},
  author = {Praneeth Narisetty and Shiva Nagendra Babu Kore},
  year = {2026},
  month = jul,
  eprint = {2607.11288},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.11288}
}

@misc{swinea2026vexaiot,
  title = {{VEXAIoT: Autonomous IoT Vulnerability EXploitation using AI Agents}},
  author = {Katherine Swinea and Kshitiz Aryal and Lopamudra Praharaj and Maanak Gupta},
  year = {2026},
  month = jul,
  eprint = {2607.09653},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.09653}
}

@misc{emami2026llmcentric,
  title = {{LLM-Centric Agentic AI for UAV Swarms: Architecture, Enabling Technologies, and Open Problems}},
  author = {Yousef Emami and Rahim Taheri and Mohammadhossein Homaei and Muhammad Atif Ur Rehman and Mohammad Shojafar},
  year = {2026},
  month = jul,
  eprint = {2607.09756},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.09756}
}

@misc{south2025identity,
  title = {{Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world}},
  author = {Tobin South and Subramanya Nagabhushanaradhya and A. Dissanayaka and Sarah Cecchetti and George H. L. Fletcher and Victor Lu and A. Pietropaolo and Dean H. Saxe and J. Lombardo and Abhishek Maligehalli Shivalingaiah and Stan Bounev and Alex Keisner and Andor Kesselman and Zack Proser and Ginny Fahs and Andrew Bunyea and Ben Moskowitz and Atul Tulshibagwale and Dazza Greenwood and Jiaxin Pei and A. Pentland},
  year = {2025},
  month = oct,
  eprint = {2510.25819},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2510.25819},
  url = {https://www.semanticscholar.org/paper/c482e9aa341ecd5dbf545aa16df9c6815aa55650}
}

@techreport{raza2025trism,
  title = {{TRiSM for Agentic AI: A Review of Trust, Risk, and Security Management in LLM-based Agentic Multi-Agent Systems}},
  author = {Shaina Raza and Ranjan Sapkota and Manoj Karkee and Christos Emmanouilidis},
  year = {2025},
  month = jun,
  institution = {AI Open},
  eprint = {2506.04133},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2506.04133},
  url = {https://www.semanticscholar.org/paper/753736d18fa9bf3ed730836b30b89bf5653cd8dd}
}

@inproceedings{syros2025saga,
  title = {{SAGA: A Security Architecture for Governing AI Agentic Systems}},
  author = {Georgios Syros and Anshuman Suri and Cristina Nita-Rotaru and Alina Oprea},
  year = {2025},
  month = apr,
  booktitle = {Network and Distributed System Security Symposium},
  eprint = {2504.21034},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2504.21034},
  url = {https://www.semanticscholar.org/paper/643e64fd77cb9a2b2defd63769af75a92365a6c7}
}

@misc{allegrini2025formalizing,
  title = {{Formalizing the Safety, Security, and Functional Properties of Agentic AI Systems}},
  author = {Edoardo Allegrini and Ananth Shreekumar and Z. B. Celik},
  year = {2025},
  month = oct,
  eprint = {2510.14133},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2510.14133},
  url = {https://www.semanticscholar.org/paper/fa748fc17c5e7506bf3fed331e81b2011e5039d0}
}

@article{chatzimiltis2025agentic,
  title = {{Agentic AI for 6G: A New Paradigm for Autonomous RAN Security Compliance}},
  author = {Sotiris Chatzimiltis and Mahdi Boloursaz Mashhadi and Mohammad Shojafar and M. Debbah and Rahim Tafazolli},
  year = {2025},
  month = dec,
  journal = {IEEE Communications Standards Magazine},
  eprint = {2512.12400},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2512.12400},
  url = {https://www.semanticscholar.org/paper/3db949389086da9db5ec5e9fc88c1de41ee99df2}
}

@inproceedings{bandara2025astride,
  title = {{ASTRIDE: A Security Threat Modeling Platform for Agentic-AI Applications}},
  author = {Eranga Bandara and Amin Hass and Ross Gore and Sachin Shetty and R. Mukkamala and S. Bouk and Xueping Liang and Ng Wee Keong and K. D. Zoysa and A. Withanage and Nilaan Loganathan},
  year = {2025},
  month = dec,
  booktitle = {International Conference on Wireless Communications and Mobile Computing},
  eprint = {2512.04785},
  archivePrefix = {arXiv},
  doi = {10.1109/IWCMC69287.2026.11580105},
  url = {https://www.semanticscholar.org/paper/37c56b578604d3dea4d86ae9bf1a76cdbff5129e}
}

@misc{louck2025security,
  title = {{Security Analysis of Agentic AI Communication Protocols: A Comparative Evaluation}},
  author = {Yedidel Louck and Ariel Stulman and Amit Dvir},
  year = {2025},
  month = nov,
  eprint = {2511.03841},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2511.03841},
  url = {https://www.semanticscholar.org/paper/a380e368fc630cdeab758fa86959a7570024a7a3}
}

@inproceedings{syed2025agentic,
  title = {{Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigation}},
  author = {Toqeer Ali Syed and M. R. Belgaum and Salman Jan and Asadullah Khan and Saad Said Alqahtani},
  year = {2025},
  month = dec,
  booktitle = {International Conferences on Computing Advancements},
  eprint = {2512.23480},
  archivePrefix = {arXiv},
  doi = {10.1109/ICCA66035.2025.11430751},
  url = {https://www.semanticscholar.org/paper/7ef12e7f28b538a044f3b2c2af4160446723a200}
}

@misc{liu2026agentdoga,
  title = {{AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security}},
  author = {Dongrui Liu and Qihan Ren and Chen Qian and Shuai Shao and Yuejin Xie and Yu Li and Zhonghao Yang and Haoyu Luo and Peng Wang and Qingyu Liu and Bin Hu and Ling Tang and Jilin Mei and Dadi Guo and Lei Yuan and Junyao Yang and Guanxu Chen and Qihao Lin and Yi Yu and Bo Zhang and Jiaxuan Guo and Jie Zhang and Wenqi Shao and Huiqi Deng and Zhiheng Xi and Wenjie Wang and Wenxuan Wang and Wen Shen and Zhikai Chen and Haoyu Xie and Jialing Tao and Juntao Dai and Jiaming Ji and Zhongjie Ba and Linfeng Zhang and Yong Liu and Quanshi Zhang and Lei Zhu and Zhihua Wei and Hui Xue and Chaochao Lu and Jing Shao and Xia Hu},
  year = {2026},
  month = jan,
  eprint = {2601.18491},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8f66f06304829890f83c428fb4677a54c91d9fbd}
}

@misc{liu2026agentdogb,
  title = {{AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Security}},
  author = {Dongrui Liu and Yu Li and Zhonghao Yang and Peng Wang and Guan-Lin Chen and Yuejin Xie and Qinghua Mao and Wanying Qu and Yanxu Zhu and Tianyi Zhou and Lei Yuan and Zhijie Zheng and Qihao Lin and Yiming Wang and Haoyu Luo and Shuai Shao and Chen Qian and Qingyu Liu and Ling Tang and Ruiyang Qin and Qihan Ren and Junxiao Yang and Kun Wang and Zhiheng Xi and Linfeng Zhang and Ranjie Duan and Bo Zhang and Wenjie Wang and Wen Shen and Qiaosheng Zhang and Y. Teng and Chaochao Lu and Rui Mei and Man Li and Jialing Tao and Xi Lin and Tianhang Zheng and Yong Liu and Quanshi Zhang and Lei Zhu and Xingjun Ma and Junhua Liu and Hui Xue and X.Z. Zuo and Xiangnan He and Chaoyi Shen and Xianglong Liu and Min Huang and Jing Shao and Xia Hu},
  year = {2026},
  month = may,
  eprint = {2605.29801},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/27d50468f1016b18c07283b56ea5dc0f5479b980}
}

@article{ursino2025research,
  title = {{A Research Landscape of Agentic AI and Large Language Models: Applications, Challenges and Future Directions}},
  author = {Domenico Ursino and Gianluca Bonifazi and Enrico Corradini and Michele Marchetti and S. Brohi and Qurat-ul-ain Mastoi and N. Z. Jhanjhi and T. Pillai},
  year = {2025},
  journal = {Algorithms},
  doi = {10.3390/a18080499},
  url = {https://www.semanticscholar.org/paper/24ae03b3f1793dc2ca5aec06ed4c50ec61a6c7cd}
}

@inproceedings{habler2025building,
  title = {{Building A Secure Agentic AI Application Leveraging Google’s A2A Protocol}},
  author = {I. Habler and Ken Huang and Vineeth Sai Narajala and Prashant Kulkarni},
  year = {2025},
  month = dec,
  booktitle = {2025 Annual Computer Security Applications Conference Workshops (ACSAC Workshops)},
  doi = {10.1109/ACSACW69556.2025.00043},
  url = {https://www.semanticscholar.org/paper/8f3fc962d61ac1d298ed511ba27272f1c5991599}
}

@inproceedings{huang2025novel,
  title = {{A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control}},
  author = {Ken Huang and Vineeth Sai Narajala and J. Yeoh and Ramesh Raskar and Youssef Harkati and Jerry Huang and I. Habler and Chris Hughes},
  year = {2025},
  month = may,
  booktitle = {2026 International Conference on AI x Data and Knowledge Engineering (AIxDKE)},
  eprint = {2505.19301},
  archivePrefix = {arXiv},
  doi = {10.1109/AIxDKE67294.2026.00024},
  url = {https://www.semanticscholar.org/paper/2bbf1fc0d7bce53edbfcaeb81143c1233c074923}
}

@article{adabara2025trustworthy,
  title = {{Trustworthy agentic AI systems: a cross-layer review of architectures, threat models, and governance strategies for real-world deployment}},
  author = {Ibrahim Adabara and Bashir Olaniyi Sadiq and Aliyu Nuhu Shuaibu and Yale Ibrahim Danjuma and Venkateswarlu Maninti},
  year = {2025},
  month = sep,
  journal = {F1000Research},
  doi = {10.12688/f1000research.169927.1},
  url = {https://www.semanticscholar.org/paper/b4578b31671f32a11e47b0f4870b885f55900153}
}

@inproceedings{petrovic2025agentbased,
  title = {{Agent-Based AI Approach to Security in IoT Systems Leveraging Genai}},
  author = {N. Petrovic and D. Krstić and S. Suljović and S. Hanczewski and M. Głąbowski},
  year = {2025},
  month = sep,
  booktitle = {International Conference on Software, Telecommunications and Computer Networks},
  doi = {10.23919/softcom66362.2025.11197348},
  url = {https://www.semanticscholar.org/paper/6f1174d046152d8270662e216a28d82016aed238}
}

@misc{engelberg2026solavisibilityispm,
  title = {{Sola-Visibility-ISPM: Benchmarking Agentic AI for Identity Security Posture Management Visibility}},
  author = {Gal Engelberg and Konstantin Koutsyi and Leon Goldberg and Reuven Elezra and Idan Pinto and Tal Moalem and Samuel N. Cohen and Yoni Weintrob},
  year = {2026},
  month = jan,
  eprint = {2601.07880},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2601.07880},
  url = {https://www.semanticscholar.org/paper/ec53bf26de1b0055611062408c1116f35cd308e7}
}

@inproceedings{schmitz2025oversight,
  title = {{Oversight Structures for Agentic AI in Public-Sector Organizations}},
  author = {Chris Schmitz and Jonathan Rystrøm and Jan Batzner},
  year = {2025},
  month = jun,
  booktitle = {Proceedings of the 1st Workshop for Research on Agent Language Models (REALM 2025)},
  eprint = {2506.04836},
  archivePrefix = {arXiv},
  doi = {10.18653/v1/2025.realm-1.21},
  url = {https://www.semanticscholar.org/paper/f28ed25afc2d23d9d62e0766b2956d142bb9913a}
}

@misc{bhardwaj2026formal,
  title = {{Formal Analysis and Supply Chain Security for Agentic AI Skills}},
  author = {Varun Pratap Bhardwaj},
  year = {2026},
  month = feb,
  eprint = {2603.00195},
  archivePrefix = {arXiv},
  doi = {10.5281/zenodo.18787663},
  url = {https://www.semanticscholar.org/paper/d6665127102362bd5060d673a21fe6b1de3f376c}
}

@misc{siddiq2026security,
  title = {{Security in the Age of AI Teammates: An Empirical Study of Agentic Pull Requests on GitHub}},
  author = {Mohammed Latif Siddiq and Xinye Zhao and V. C. Lopes and B.K. Casey and Joanna C. S. Santos},
  year = {2026},
  month = jan,
  eprint = {2601.00477},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2601.00477},
  url = {https://www.semanticscholar.org/paper/53ed867f0c124539c1521dec5d052779cb8a0f2a}
}

@misc{abuadbba2026human,
  title = {{Human Society-Inspired Approaches to Agentic AI Security: The 4C Framework}},
  author = {A. Abuadbba and N. Sultan and Surya Nepal and Sanjay Jha},
  year = {2026},
  month = feb,
  eprint = {2602.01942},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2602.01942},
  url = {https://www.semanticscholar.org/paper/20f1c57301375e2642fd4969713acdf7c20177b6}
}

@article{rangappa2026agentic,
  title = {{AGENTIC AI AND CYBER SECURITY: AUTONOMOUS THREAT HUNTING, INTRUSION DETECTION, AND ADAPTIVE DEFENSE MECHANISMS IN A WORLD OF INCREASINGLY SOPHISTICATED CYBER ATTACKS}},
  author = {Ajay Simha Rangappa},
  year = {2026},
  month = mar,
  journal = {Journal of Digital Security and Forensics},
  doi = {10.29121/digisecforensics.v2.i1.2025.86},
  url = {https://www.semanticscholar.org/paper/341d785475da2663203fc3ccaa1bca71968310bb}
}

@inproceedings{negi2026automating,
  title = {{Automating Organizational Cyber Security Policy Compliance Against Industry Standards Using Agentic AI}},
  author = {R. Negi and S. V. Chakraborty and Amit Negi and S. K. Shukla},
  year = {2026},
  month = mar,
  booktitle = {International Symposium on Digital Forensics and Security},
  doi = {10.1109/ISDFS69419.2026.11458951},
  url = {https://www.semanticscholar.org/paper/b675c553acbc44d29e06bb0c8155978a0cbf73c7}
}

@misc{gosmar2025sentinel,
  title = {{Sentinel Agents for Secure and Trustworthy Agentic AI in Multi-Agent Systems}},
  author = {Diego Gosmar and Deborah A. Dahl},
  year = {2025},
  month = sep,
  eprint = {2509.14956},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2509.14956},
  url = {https://www.semanticscholar.org/paper/296c6954e9fe7e5b48fe2dfadc6a23b4310b1bab}
}

@misc{zambare2025securing,
  title = {{Securing Agentic AI: Threat Modeling and Risk Analysis for Network Monitoring Agentic AI System}},
  author = {P. Zambare and Venkata Nikhil Thanikella and Ying Liu},
  year = {2025},
  month = aug,
  eprint = {2508.10043},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2508.10043},
  url = {https://www.semanticscholar.org/paper/f42a56937c1a50380c6143ba835efa5b97c5c31e}
}

@misc{eslami2025security,
  title = {{Security Risks of Agentic Vehicles: A Systematic Analysis of Cognitive and Cross-Layer Threats}},
  author = {Ali Eslami and Jiangbo Yu},
  year = {2025},
  month = dec,
  eprint = {2512.17041},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2512.17041},
  url = {https://www.semanticscholar.org/paper/af6ea3b929b3a1aba976f3d48d2c6d040968e7e0}
}

@misc{atta2025qsaf,
  title = {{QSAF: A Novel Mitigation Framework for Cognitive Degradation in Agentic AI}},
  author = {Hammad Atta and M. Baig and Yasir Mehmood and Nadeem Shahzad and Ken Huang and M. A. U. Haq and Muhammad Awais and Kamal Ahmed},
  year = {2025},
  month = jul,
  eprint = {2507.15330},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2507.15330},
  url = {https://www.semanticscholar.org/paper/c3da993174d74465fbb632f2d3de5c31d8b58a26}
}

@misc{christodorescu2026agent,
  title = {{Agent Security is a Systems Problem}},
  author = {Mihai Christodorescu and Earlence Fernandes and Ashish Hooda and Somesh Jha and J. Rehberger and Kamalika Chaudhuri and Xiaohan Fu and Khawaja Shams and Guy Amir and Jihye Choi and Sarthak Choudhary and Nils Palumbo and Andrey Labunets and Nishit V. Pandya},
  year = {2026},
  month = may,
  eprint = {2605.18991},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2605.18991},
  url = {https://www.semanticscholar.org/paper/44d178dd44370773c5d0536025c8c848febcee9b}
}

@misc{cohen2025inbrowser,
  title = {{In-Browser LLM-Guided Fuzzing for Real-Time Prompt Injection Testing in Agentic AI Browsers}},
  author = {Avihay Cohen},
  year = {2025},
  month = oct,
  eprint = {2510.13543},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2510.13543},
  url = {https://www.semanticscholar.org/paper/8b9011b256c4819d47721efc3f9522a721b92735}
}

@inproceedings{sharma2025mobillm,
  title = {{MobiLLM: An Agentic AI Framework for Closed-Loop Threat Mitigation in 6G Open RANs}},
  author = {Prakhar Sharma and Haohuang Wen and V. Yegneswaran and Ashish Gehani and Phillip Porras and Zhiqiang Lin},
  year = {2025},
  month = sep,
  booktitle = {IEEE Military Communications Conference},
  eprint = {2509.21634},
  archivePrefix = {arXiv},
  doi = {10.1109/MILCOM64451.2025.11310651},
  url = {https://www.semanticscholar.org/paper/3fb886ee2cfed48af9dd1766725f0385754e5528}
}

@inproceedings{vinay2025evolution,
  title = {{The Evolution of Agentic AI in Cybersecurity: From Single LLM Reasoners to Multi-Agent Systems and Autonomous Pipelines}},
  author = {Vaishali Vinay},
  year = {2025},
  month = dec,
  booktitle = {International Conference on Applied Informatics and Communication},
  eprint = {2512.06659},
  archivePrefix = {arXiv},
  doi = {10.1109/ICAIC67076.2026.11395809},
  url = {https://www.semanticscholar.org/paper/6417c2e047247e4e844c8ab390fb3812fb4f80e1}
}

@misc{bahadur2025securing,
  title = {{Securing Generative AI Agentic Workflows: Risks, Mitigation, and a Proposed Firewall Architecture}},
  author = {Sunil Kumar Jang Bahadur and Gopala Dhar},
  year = {2025},
  month = jun,
  eprint = {2506.17266},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2506.17266},
  url = {https://www.semanticscholar.org/paper/783db6d7e129f598539e38b4608dfec1702c0eb1}
}

@inproceedings{rodriguez2025agentcyte,
  title = {{AgentCyTE: Leveraging Agentic AI to Generate Cybersecurity Training \& Experimentation Scenarios}},
  author = {A. Rodríguez and Jaime C. Acosta and Anantaa Kotal and Aritran Piplai},
  year = {2025},
  month = oct,
  booktitle = {2025 Annual Computer Security Applications Conference Workshops (ACSAC Workshops)},
  eprint = {2510.25189},
  archivePrefix = {arXiv},
  doi = {10.1109/ACSACW69556.2025.00073},
  url = {https://www.semanticscholar.org/paper/b89b1dc9130393a3c3d31d59f31897323f73d7eb}
}

@misc{park2026crossagent,
  title = {{Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents}},
  author = {SangJin Park and Myungsub Choi and Jineok Kim and Minseung Kang},
  year = {2026},
  month = jul,
  eprint = {2607.18826},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18826}
}

@misc{chai2026automated,
  title = {{Towards an Automated Test of LLM Security Knowledge}},
  author = {Shufan Chai and Liangliang Sun and Jessica Staddon},
  year = {2026},
  month = jul,
  eprint = {2607.18496},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18496}
}

@misc{li2026trusted,
  title = {{Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing}},
  author = {Jie Li},
  year = {2026},
  month = jul,
  eprint = {2607.18485},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18485}
}

@misc{jain2026adaptive,
  title = {{Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security}},
  author = {Devina Jain and David Hartmann and Chuan Li},
  year = {2026},
  month = jul,
  eprint = {2607.18063},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18063}
}

@misc{huang2026jailmeter,
  title = {{JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models}},
  author = {Qingjia Huang and Jingyu Zhang and Jianguo Wu and Yakai Li and Weijuan Zhang and Yankai Rong and Junyi Yao and Shengzhi Zhang and Xiaoqi Jia},
  year = {2026},
  month = jul,
  eprint = {2607.19424},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19424}
}

@misc{delcon2026geometric,
  title = {{Geometric Configurations of Perturbed Jailbreak Prompts}},
  author = {Lynn Delcon and Andres Algaba and Vincent Ginis},
  year = {2026},
  month = jul,
  eprint = {2607.20581},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.20581}
}

@misc{eliav2026know,
  title = {{Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents}},
  author = {Or Zion Eliav and Eyal Lenga and Shir Bernstien and Yisroel Mirsky},
  year = {2026},
  month = jul,
  eprint = {2607.19837},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19837}
}

@misc{qi2026darwin,
  title = {{DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection}},
  author = {Weiwei Qi and Zefeng Wu and Zhilin Guo and Tianhang Zheng and Chaochao Lu and Liang He and Zhan Qin and Kui Ren},
  year = {2026},
  month = jul,
  eprint = {2607.19829},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19829}
}

@misc{hu2026twin,
  title = {{Twin Agent: Context Residual Compression for Privilege Separated Agents}},
  author = {Zhanhao Hu and Dennis Jacob and Xiao Huang and Zhaorun Chen and Bo Li and David Wagner},
  year = {2026},
  month = jul,
  eprint = {2607.19595},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19595}
}

@misc{shukla2026data,
  title = {{Data Leakage Prevention in Agentic Applications via Preemptive Hardening}},
  author = {Akansha Shukla and Emily Bellov and Parth Atulbhai Gandhi and Yuval Elovici and Asaf Shabtai},
  year = {2026},
  month = jul,
  eprint = {2607.18847},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18847}
}

@misc{liao2026cpinj,
  title = {{CPInj: Uncovering Prompt Injection Risks in Textual Collaborative Prompt Optimization}},
  author = {Xinting Liao and Behnoosh Zamanlooy and Masoumeh Shafieinejad and David B. Emerson and Ruinan Jin and Deval Pandya and Xiaoxiao Li},
  year = {2026},
  month = jul,
  eprint = {2607.18622},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18622}
}

@misc{narayan2026chainwatch,
  title = {{ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems}},
  author = {Om Narayan and Rashmi Jyoti and Ramkinker Singh},
  year = {2026},
  month = jul,
  eprint = {2607.19432},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19432}
}

@misc{hossain2026channelguard,
  title = {{ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems}},
  author = {Elias Hossain and Md Mehedi Hasan Nipu and Fatema Tuj Johora Faria and Tasfia Nuzhat Ornee and Maleeha Sheikh},
  year = {2026},
  month = jul,
  eprint = {2607.19430},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19430}
}

@misc{zhou2026salience,
  title = {{Salience Induction against Multi-Hop RAG Agents: Threat and Defense}},
  author = {Xingfu Zhou and Pengfei Wang and Yuan Zhou and Wei Xie and Xu Zhou},
  year = {2026},
  month = jul,
  eprint = {2607.17535},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.17535}
}

@misc{peng2026between,
  title = {{Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models}},
  author = {Xingkai Peng and Jun Jiang and Jiayang Liu and Kejiang Chen and Weiming Zhang},
  year = {2026},
  month = jul,
  eprint = {2607.17279},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.17279}
}

@misc{zhou2026how,
  title = {{How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions}},
  author = {Yukai Zhou and Feiyang Lu and Xiaokai Mao and Jinfei Liu and Wenjie Wang},
  year = {2026},
  month = jul,
  eprint = {2607.17152},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.17152}
}

@misc{cui2026refusal,
  title = {{Refusal is Not Safety! Benchmarking Latent Safety Risks of LLM-Driven Content Humorization}},
  author = {Yu Cui and Ruiqing Yue and Tingyu Li and Sicheng Pan and Zhuoyu Sun and Xufeng Zhang and Baohan Huang and Haibin Zhang and Cong Zuo},
  year = {2026},
  month = jul,
  eprint = {2607.15977},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.15977}
}

@misc{ahi2026trustworthy,
  title = {{Trustworthy AI LLM Scalability Risk Index (LSRI): A Cybersecurity Framework Assessing Agentic-AI Security \& Software Model Supply Chain Safety Boosting AI-Generated Malware Defense \& Explainability Mitigating Emerging Risks of Generative AI}},
  author = {Kiarash Ahi and Vaibhav Agrawal and Saeed Valizadeh},
  year = {2026},
  month = feb,
  eprint = {2602.19021},
  archivePrefix = {arXiv},
  doi = {10.1080/08874417.2026.2624670},
  url = {https://arxiv.org/abs/2602.19021}
}

@misc{wang2026gpe,
  title = {{GPE: Evaluating Robust Evidence Aggregation for Fact Verification under Controllable GEO-Style Poisoning}},
  author = {Zhaoqi Wang and Zijian Zhang and Xiaomei Yuan and Pengtao Kou and Jiamou Liu and Zhen Li and Liehuang Zhu},
  year = {2026},
  month = jul,
  eprint = {2607.20730},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.20730}
}

@misc{llambimorillas2026cryptographically,
  title = {{Toward cryptographically verifiable authorization for autonomous AI agents: A security hypothesis, preliminary formal model, and proof-of-concept implementation}},
  author = {M. Llambí-Morillas and D. Fernández-Fernández},
  year = {2026},
  month = jul,
  eprint = {2607.21325},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.21325}
}

@misc{happe2026ethics,
  title = {{The Ethics of Autonomous AI Agents for Offensive Security}},
  author = {Andreas Happe and Jürgen Cito and Jasmin Wachter},
  year = {2026},
  month = jul,
  eprint = {2607.20255},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.20255}
}

@misc{libon2026researcharena,
  title = {{ResearchArena: Evaluating Sabotage and Monitoring in Automated AI R\&D}},
  author = {Lena Libon and Ben Rank and Jehyeok Yeon and David Schmotz and Jeremy Qin and Daniel Donnelly and Derck Prinzhorn and Maksym Andriushchenko},
  year = {2026},
  month = jul,
  eprint = {2607.19321},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19321}
}

@misc{alrefai2026engineering,
  title = {{Engineering Trustworthy Agentic AI for Critical Systems}},
  author = {Omar Al-Refai and Ibrahim Shahbaz and Adam Ali Husseinat and Michael Mandulak and Jaewon Kim and Eman Hammad},
  year = {2026},
  month = jul,
  eprint = {2607.18548},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18548}
}

@misc{yu2026operational,
  title = {{Operational Hallucination and Safety Drift in AI Agents}},
  author = {Shasha Yu and Fiona Carroll and Barry L. Bentley},
  year = {2026},
  month = jul,
  eprint = {2607.18366},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18366}
}

@misc{alenezi2026specificationdriven,
  title = {{Specification-Driven Development as the Foundation of AI-Native Enterprise Software Engineering}},
  author = {Mamdouh Alenezi},
  year = {2026},
  month = jul,
  eprint = {2607.16680},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.16680}
}

@misc{singh2026tracerai,
  title = {{TRACER-AI: A Multi-Layer Explainable Framework for Prompt Injection, Agent Goal Hijacking, and Tool Misuse Detection in Agentic AI Systems}},
  author = {Pallavi Singh and Khushboo Gupta and Pratibha Singh},
  year = {2026},
  month = jul,
  doi = {10.22214/ijraset.2026.84360},
  url = {https://doi.org/10.22214/ijraset.2026.84360}
}

@misc{he2026hybrid,
  title = {{Hybrid Analysis for Secure MCP Tool Use in LLM Agents}},
  author = {Ping He and Yuexiang Xie and Yaliang Li and Shouling Ji},
  year = {2026},
  month = jul,
  eprint = {2607.25297},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.25297}
}

@misc{wu2026alibi,
  title = {{ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments}},
  author = {Zixuan Wu and Cristina Nita-Rotaru},
  year = {2026},
  month = jul,
  eprint = {2607.24964},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24964}
}

@misc{peng2026do,
  title = {{Do LLMs Know Their Vulnerable Scenarios?}},
  author = {Ziheng Peng and Huiqi Deng and Haoran Jing and Xuankun Rong and Jiahui Han and Xiting Wang and Na Zou and Xia Hu},
  year = {2026},
  month = jul,
  eprint = {2607.23496},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.23496}
}

@misc{ma2026poster,
  title = {{Poster: Rethinking Security in LLM Code Generation through Real-World Risk Scenarios}},
  author = {Lixun Ma and Ruolong Ma and Bei Wang and Feng Wei and Zhenguang Liu and Lorenzo Cavallaro and Wentao Chen},
  year = {2026},
  month = jul,
  eprint = {2607.23088},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.23088}
}

@misc{jincheng2026mask2shield,
  title = {{Mask2Shield: Strengthening LLM Safety against Neuron-Pruning Attacks}},
  author = {Ying JinCheng and Minghui Xu and Yinhao Xiao and Xiuzhen Cheng and Wencheng Yang},
  year = {2026},
  month = jul,
  eprint = {2607.23015},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.23015}
}

@misc{yang2026ethereum,
  title = {{Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing}},
  author = {Deyu Yang and Rundong Wei and Xiaoqi Li},
  year = {2026},
  month = jul,
  eprint = {2607.21983},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.21983}
}

@misc{liu2026piggybacking,
  title = {{Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents}},
  author = {Mingxiao Liu and Yitong Li and Haoren Zhao and Yaoxiang Bian and Jianan Ma and Jian Zhang and Jialuo Chen and Xinhao Deng and Zhen Wang},
  year = {2026},
  month = jul,
  eprint = {2607.28165},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.28165}
}

@misc{tafreshian2026rogueprompt,
  title = {{RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation}},
  author = {Benyamin Tafreshian and Prathamesh Dhake},
  year = {2026},
  month = jul,
  eprint = {2607.27373},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.27373}
}

@misc{zhang2026recover,
  title = {{Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks}},
  author = {Haoyu Zhang and Zhuoxi Wang and Shibo Zheng and Zijian Xiao and Xiangchen Guan and Mohammad Zandsalimy and Shanu Sushmita},
  year = {2026},
  month = jul,
  eprint = {2607.26574},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.26574}
}

@misc{wallace2026gptred,
  title = {{GPT-Red: Automated Red Teaming via Self-Play at Scale}},
  author = {Eric Wallace and Christopher A. Choquette-Choo and Nikhil Kandpal and Sam Toyer and Dylan Hunn and Stephanie Lin and Yuxin Wen and Xiangyu Qi and Christopher Wolff and Zizhao Wang and Milad Nasr and Sicheng Zhu and Chuan Guo and Juan Felipe Cerón Uribe and Kaiwen Wang and Aiden Low and Kai Xiao and Kai Chen},
  year = {2026},
  month = jul,
  eprint = {2607.26115},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.26115}
}

@misc{xie2026typo,
  title = {{TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models}},
  author = {Meng Xie and Li Zeng and Hangtao Zhang and Xianlong Wang and Ziqi Zhou and Pengpeng Qiao and Zhetao Li},
  year = {2026},
  month = jul,
  eprint = {2607.24897},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24897}
}

@misc{kravchenko2026agentic,
  title = {{Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents}},
  author = {Arseny Kravchenko and Vadim Liventsev and Innokentii Konstantinov and Ildar Iskhakov and Matvey Kukuy},
  year = {2026},
  month = jul,
  eprint = {2607.24625},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24625}
}

@misc{zhang2026whena,
  title = {{When LLM Defenses Backfire: Characterizing Safety, Performance, and Cost Trade-offs}},
  author = {Tong Zhang and Zexin Li and Simin Chen and Yun Peng},
  year = {2026},
  month = jul,
  eprint = {2607.24392},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24392}
}

@misc{landauer2026just,
  title = {{Just Testing, Move Along: Evasion of LLM-based System Log Interpretation by Prompt Injection}},
  author = {Max Landauer and Florian Skopik and Markus Wurzenberger and Franciszek Górski and Mateusz Krzysztoń},
  year = {2026},
  month = jul,
  eprint = {2607.24174},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24174}
}

@misc{manivannan2026agentic,
  title = {{Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation}},
  author = {Mohan Manivannan and Dalal Alharthi},
  year = {2026},
  month = jul,
  eprint = {2607.24006},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24006}
}

@misc{lan2026containmentbench,
  title = {{ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents}},
  author = {Wenhao Lan and Shan Li and Xinhua Lai and Meiqi Wu and Junbin Yang and Haihua Shen},
  year = {2026},
  month = jul,
  eprint = {2607.23999},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.23999}
}

@misc{zhang2026are,
  title = {{Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents}},
  author = {Zhaoxi Zhang and Xiaomei Zhang},
  year = {2026},
  month = jul,
  eprint = {2607.23586},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.23586}
}

@misc{kekatos2026missionlevel,
  title = {{Mission-Level Runtime Assurance for LLM-Assisted ISR Swarms over a Verification-Aware Fabric}},
  author = {Nikolaos Kekatos and Stylianos Basagiannis and Panagiotis Katsaros and Alexios Lekidis and Tom Nianios},
  year = {2026},
  month = jul,
  eprint = {2607.23532},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.23532}
}

@misc{siu2026agent,
  title = {{Agent Security Needs Redefinition through a Holistic Framework}},
  author = {Vincent Siu and Jingxuan He and Kyle Montgomery and Zhun Wang and Chenguang Wang and Dawn Song},
  year = {2026},
  month = jul,
  eprint = {2607.22024},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.22024}
}

@misc{louck2026protocollevel,
  title = {{Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense}},
  author = {Yedidel Louck},
  year = {2026},
  month = jul,
  eprint = {2607.21824},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.21824}
}

@misc{kumar2026raguard,
  title = {{RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning}},
  author = {Pushkal Kumar and Tucker Nielson and Tanish Kolhe and Shubham Zala and Vincent Li},
  year = {2026},
  month = jul,
  eprint = {2607.26339},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.26339}
}

@misc{briglia2026architectural,
  title = {{Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering}},
  author = {Maria Rosaria Briglia and Igor Maljkovic and Antonio Emanuele Cinà and Luca Oneto and Iacopo Masi and Fabio Roli},
  year = {2026},
  month = jul,
  eprint = {2607.25479},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.25479}
}

@misc{arias2026early,
  title = {{Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study}},
  author = {Diego Fernandez Arias and Dev Prashant Mistry and Ren Wang and Yibo Hu},
  year = {2026},
  month = jul,
  eprint = {2607.24893},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.24893}
}

@misc{engelberg2026open,
  title = {{Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense}},
  author = {Gal Engelberg and Michael Arenzon and Leon Goldberg},
  year = {2026},
  month = jul,
  eprint = {2607.27288},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.27288}
}

@misc{gore2026distributing,
  title = {{Distributing Security Controls Through Harness Engineering}},
  author = {William Robert Gore},
  year = {2026},
  month = jul,
  eprint = {2607.25890},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.25890}
}

@misc{siddik2026cybercapable,
  title = {{Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response}},
  author = {Abu Bakar Siddik},
  year = {2026},
  month = jul,
  eprint = {2607.25379},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.25379}
}

@misc{negi2026recon,
  title = {{ReCon: A Resource-Constrained Benchmark for LLM-Based Cybersecurity Compliance Across Ingestion and Retrieval Pipelines}},
  author = {Rohit Negi and Rishik Jain and Soumyo V Chakarborty and Amit Negi and Sandeep K Shukla},
  year = {2026},
  month = jul,
  eprint = {2607.22885},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.22885}
}

@misc{chen2026breaking,
  title = {{Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks}},
  author = {Yuchen Chen and Wei Cheng and Yuan Xiao and Wising Sun and Chunrong Fang and Yang Liu and Zhenyu Chen and Baowen Xu},
  year = {2026},
  month = aug,
  eprint = {2608.05659},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.05659}
}

@misc{santana2026llmassisted,
  title = {{LLM-Assisted Detection and Repair of Hardware Security Vulnerabilities in Verilog Designs}},
  author = {Ethen Santana and Gabriel Gyaase and Hao Zheng},
  year = {2026},
  month = aug,
  eprint = {2608.04907},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04907}
}

@misc{guo2026logintrap,
  title = {{LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents}},
  author = {Longtao Guo and Zelin Zhang and Kaifeng Huang and Yang Shi},
  year = {2026},
  month = aug,
  eprint = {2608.04741},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04741}
}

@misc{sharma2026eliciting,
  title = {{Eliciting Intrinsic Hallucinations in LLMs via Semantically Equivalent Adversarial Attacks}},
  author = {Atri Vivek Sharma and Brian Formento and Alessio Lomuscio},
  year = {2026},
  month = aug,
  eprint = {2608.04286},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04286}
}

@misc{chen2026mafia,
  title = {{MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents}},
  author = {Jiaming Chen and Yisen Gao and Yanping Li and Zifan Liu and Yumeng Zhang and Jun Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.03844},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03844}
}

@misc{batzolis2026securityoriented,
  title = {{A Security-Oriented Lifecycle Model for Large Language Model Systems}},
  author = {Eleftherios Batzolis and George Drosatos and Vassilis Katsouros and Konstantinos Rantos},
  year = {2026},
  month = aug,
  eprint = {2608.03626},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03626}
}

@misc{liu2026diagchain,
  title = {{DiagChain: A Diagnostic Benchmark for Evaluating LLM Agents on Evidence-Grounded Attack Chain Reconstruction}},
  author = {Xuyang Liu and Yibin Han and Zhenwei Zhang and Kai Chang and Zhiwei Xu and Tian Qiu and Weixian Deng and Jiabao Gao and Xiaolin Peng and Hai Wan and Xibin Zhao},
  year = {2026},
  month = aug,
  eprint = {2608.03591},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03591}
}

@misc{vargas2026securityfirst,
  title = {{Security-First Evaluation of Text-to-Terraform: Benchmarking LLMs and SLMs for Secure IaC Generation}},
  author = {Francis Luis Santos Vargas and Rodrigo Brandão Mansilha and Diego Kreutz},
  year = {2026},
  month = aug,
  eprint = {2608.02672},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.02672}
}

@misc{bappy2026adversarial,
  title = {{Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures}},
  author = {Faisal Haque Bappy and Tahrim Hossain and Tarannum Shaila Zaman and Raiful Hasan and Kamrul Hasan and Tariqul Islam},
  year = {2026},
  month = aug,
  eprint = {2608.00718},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00718}
}

@misc{li2026stateful,
  title = {{Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn Attacks}},
  author = {Siyuan Li and Zehao Liu and Haoyu Li and Xi Lin and Ning Liu and Jun Wu and Jianhua Li and Mohsen Guizani},
  year = {2026},
  month = jul,
  eprint = {2608.00134},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00134}
}

@misc{liu2026robust,
  title = {{Robust Context-Aware Detection of Malicious Instructions in Text}},
  author = {Buzhao Liu and Xinhang Ma and Yevgeniy Vorobeychik},
  year = {2026},
  month = aug,
  eprint = {2608.05430},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.05430}
}

@misc{wang2026agent,
  title = {{Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming}},
  author = {Yanting Wang and Chenlong Yin and Runpeng Geng and Jinyuan Jia},
  year = {2026},
  month = aug,
  eprint = {2608.05108},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.05108}
}

@misc{li2026breadcrumbing,
  title = {{Breadcrumbing Search Agents}},
  author = {Xuebin Li and Hanqing Zhao and Siyuan Liang and Kejiang Chen and Weiming Zhang and Dacheng Tao and Nenghai Yu},
  year = {2026},
  month = aug,
  eprint = {2608.04565},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04565}
}

@misc{hua2026behavioral,
  title = {{Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills}},
  author = {Peichun Hua and Haoxuan Xu and Mengyuan Li},
  year = {2026},
  month = aug,
  eprint = {2608.04192},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04192}
}

@misc{weng2026agentantibody,
  title = {{AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection}},
  author = {Shihao Weng and Yang Feng and Xiaofei Xie and Jiongchi Yu},
  year = {2026},
  month = aug,
  eprint = {2608.04053},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04053}
}

@misc{timm2026ai,
  title = {{AI Security Leaderboard: Methodology, Results and Minimal Standard}},
  author = {Jasper Timm and Lukas Struppek and Ziwei Xu and Grace Cheong and Oscar Mata and Dan Zhao and Mick Yang and Isadora De Andrade and Xiaojun Jia and Yiming Li and Samuel Bauer and Heather McIntyre and Adam Gleave and Edward Yee and Kellin Pelrine},
  year = {2026},
  month = aug,
  eprint = {2608.03070},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03070}
}

@misc{zhao2026multimodal,
  title = {{A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination}},
  author = {Shiji Zhao and Yuxuan Zhou and Chen Xiong and Dongxian Wu and Yang Bai and Xun Chen},
  year = {2026},
  month = aug,
  eprint = {2608.04034},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04034}
}

@misc{xie2026no,
  title = {{No Single Neuron of Failure: Distributed Safety Alignment Against White-Box Attacks}},
  author = {Simiao Xie and Chuancheng Shi and Shangze Li and Wenhua Wu and Fei Shen and Ying Zhou and Zhiyong Wang and Tat-Seng Chua},
  year = {2026},
  month = aug,
  eprint = {2608.01414},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.01414}
}

@misc{li2026moving,
  title = {{Moving the Safety Barrier: Dynamic Routing Adaptive Alignment Against White-Box Attacks}},
  author = {Shangze Li and Chuancheng Shi and Simiao Xie and Lingzhi He and Cheng Ji and Zifeng Cheng and Fei Shen and Chao Wu and Tat-Seng Chua},
  year = {2026},
  month = aug,
  eprint = {2608.02674},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.02674}
}

@misc{shi2026boy,
  title = {{The Boy Who Cried Wolf: Adversarial Misclassification of Safe Inputs as Unsafe in Multimodal Guardrails}},
  author = {Shuo Shi and Rui Yin and Naen Xu and Jiahao Chen and Chunyi Zhou and Tianyu Du and Zhihui Fu and Jun Wang and Zhaoxiang Wang and Shouling Ji},
  year = {2026},
  month = aug,
  eprint = {2608.01373},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.01373}
}

@misc{li2026sok,
  title = {{SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks}},
  author = {Siyuan Li and Aodu Wulianghai and Zehao Liu and Xi Lin and Qinghua Mao and Haoyu Li and Xiang Chen and Siyuan Liang and Jun Wu and Jianhua Li and Dacheng Tao},
  year = {2026},
  month = aug,
  eprint = {2608.01117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.01117}
}

@misc{zhang2026decoy,
  title = {{Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks}},
  author = {Haoyu Zhang and Xiangchen Guan and Shibo Zheng and Mohammad Zandsalimy and Shanu Sushmita},
  year = {2026},
  month = aug,
  eprint = {2608.01043},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.01043}
}

@misc{nagaraja2026when,
  title = {{When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems}},
  author = {Neha Nagaraja and Amisha Bagari and Hayretdin Bahsi},
  year = {2026},
  month = aug,
  eprint = {2608.00747},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00747}
}

@misc{dong2026your,
  title = {{Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure}},
  author = {Jianshuo Dong and Yiming Liu and Maosen Zhang and Nan Deng and Xu Peng and Xiaoping Zhang and Tianwei Zhang and Jie Zhang and Han Qiu},
  year = {2026},
  month = aug,
  eprint = {2608.02657},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.02657}
}

@misc{chandra2026resourced,
  title = {{Resourced Authority A Mechanism-Design Model for Participatory Governance of Deployed AI Agents}},
  author = {Praphul Chandra and Sujit Gujar and Ganesh Ghalme},
  year = {2026},
  month = aug,
  eprint = {2608.06353},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.06353}
}

@misc{dhar2026from,
  title = {{From Siloed Algorithms to Compliance-First Agentic Platforms: A Multi-Layered Architecture for Hospital AI Systems}},
  author = {Manideep Dhar and Ritwik Singh and Sharat Chandra Kumar Manikonda},
  year = {2026},
  month = aug,
  eprint = {2608.06112},
  archivePrefix = {arXiv},
  doi = {10.38124/ijisrt/26May1651},
  url = {https://arxiv.org/abs/2608.06112}
}

@misc{zhu2026blockchain,
  title = {{Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions}},
  author = {Liehuang Zhu and Yuhang Li and Tianxing Wang and Zhihao Chen and Ke Li and Hongyi Liu and Yajie Wang and Lei Xu and Peng Jiang and Zijian Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.04626},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04626}
}

@misc{benjamin2026binding,
  title = {{Binding Biometrics with AI Agent Identifiers for Delegation of Authority}},
  author = {Joseph Geo Benjamin and Anil K Jain and Karthik Nandakumar},
  year = {2026},
  month = aug,
  eprint = {2608.04292},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04292}
}

@misc{meulemans2026game,
  title = {{A game theory for foundation models shows new paths to rational cooperation through similarity inference}},
  author = {Alexander Meulemans and Maciej Wołczyk and Marissa A. Weis and Rajai Nasser and Roberta Rocca and Seijin Kobayashi and Guillaume Lajoie and Angelika Steger and Blake Richards and Marcus Hutter and James Manyika and Rif A. Saurous and João Sacramento and Blaise Agüera y Arcas},
  year = {2026},
  month = aug,
  eprint = {2608.03958},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03958}
}

@misc{pham2026humans,
  title = {{Humans Are More Diverse: Frontier LLMs Show Extreme Policies in Idealised AI Development Races}},
  author = {Phu Hoa Pham and Duy Minh Dao Sy and Trung Kiet Huynh and Phu Quy Nguyen Lam and Chi Nguyen Tran and Minh Trung Le and Phong Hao Le and Dinh Nam Nguyen and Thien Ky Nguyen Dong and Elias Fernandez Domingos and Le Hong Trang and The Anh Han},
  year = {2026},
  month = aug,
  eprint = {2608.01193},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.01193}
}

@misc{naumann2026assuming,
  title = {{Assuming You Knew: Fixing an Epistemic Semantics for Flow Policies Using Agentic AI}},
  author = {David A. Naumann},
  year = {2026},
  month = aug,
  eprint = {2608.00882},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00882}
}

@misc{caban2026measurement,
  title = {{Measurement Without Validity: The Compounding Reliability Problem in Agentic AI Evaluation}},
  author = {William Caban},
  year = {2026},
  month = aug,
  eprint = {2608.00794},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00794}
}

@misc{chen2026openart,
  title = {{OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution}},
  author = {Yunhao Chen and Xin Wang and Yixu Wang and Yi Liu and Jie Li and Yan Teng and Xingjun Ma and Xia Hu and Yu-Gang Jiang},
  year = {2026},
  month = aug,
  eprint = {2608.00677},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00677}
}

@misc{fu2026agenticrepair,
  title = {{AgenticRepair: Multi-Faceted Program Context Engineering for Agentic Vulnerability Repair}},
  author = {Michael Fu and Qiyue Mei and Patanamon Thongtanunam and Kla Tantithamthavorn},
  year = {2026},
  month = jul,
  eprint = {2607.29422},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.29422}
}

@misc{gao2026skillsets,
  title = {{Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking}},
  author = {Yayu Gao and Yong Xiao and Hao Hu and Xubo Li and Zhiwei Liu and Yingyu Li and Guangming Shi and Ping Zhang},
  year = {2026},
  month = jul,
  eprint = {2608.00104},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.00104}
}

@misc{sartakov2026from,
  title = {{From C to Idiomatic Rust: A Ship-of-Theseus Agentic Translation}},
  author = {Vasily A. Sartakov},
  year = {2026},
  month = jul,
  eprint = {2607.28835},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.28835}
}

@inproceedings{muliarevych2024enhancing,
  title = {{Enhancing System Security: LLM-Driven Defense Against Prompt Injection Vulnerabilities}},
  author = {Oleksandr Muliarevych},
  year = {2024},
  month = oct,
  booktitle = {International Conference on Modern Problems of Radio Engineering, Telecommunications and Computer Science},
  doi = {10.1109/TCSET64720.2024.10755823},
  url = {https://www.semanticscholar.org/paper/95be2ab522131b725b79062db7ceb849c924562e}
}

@inproceedings{an2025ipiguard,
  title = {{IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents}},
  author = {Hengyu An and Jinghuai Zhang and Tianyu Du and Chunyi Zhou and Qingming Li and Tao Lin and Shouling Ji},
  year = {2025},
  month = aug,
  booktitle = {Conference on Empirical Methods in Natural Language Processing},
  eprint = {2508.15310},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2508.15310},
  url = {https://www.semanticscholar.org/paper/9ddcbbff1e23b7f995fc363ad5123091f8866748}
}

@inproceedings{zhang2024agent,
  title = {{Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents}},
  author = {Hanrong Zhang and Jingyuan Huang and K. Mei and Yifei Yao and Zhenting Wang and Chenlu Zhan and Hongwei Wang and Yongfeng Zhang},
  year = {2024},
  month = oct,
  booktitle = {International Conference on Learning Representations},
  eprint = {2410.02644},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2410.02644},
  url = {https://www.semanticscholar.org/paper/5f4efbe3aae1d8f44ceab1da257ae685d6beb00b}
}

@inproceedings{wang2025protect,
  title = {{To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt}},
  author = {Zhilong Wang and N. Nagaraja and Lan Zhang and Hayretdin Bahşi and Pawan Patil and Peng Liu},
  year = {2025},
  month = jun,
  booktitle = {2025 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks - Supplemental Volume (DSN-S)},
  eprint = {2506.05739},
  archivePrefix = {arXiv},
  doi = {10.1109/DSN-S65789.2025.00037},
  url = {https://www.semanticscholar.org/paper/020ad9b3a8022ac6464cc06b2e80c2a267001e77}
}

@article{liao2025attack,
  title = {{Attack and defense techniques in large language models: A survey and new perspectives}},
  author = {Zhiyu Liao and Kang Chen and Y. Lin and Kangkang Li and Yunxuan Liu and Hefeng Chen and Xingwang Huang and Yuanhui Yu},
  year = {2025},
  month = may,
  journal = {Neural Networks},
  eprint = {2505.00976},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2505.00976},
  url = {https://www.semanticscholar.org/paper/5bce864b579b376c028ec40a8fec0f999b005d0e}
}

@inproceedings{segireddy2026cybllm,
  title = {{Cyb-LLM: A Unified Benchmark for Evaluating LLMs in Cyber Attack \& Defense}},
  author = {Akshitha Segireddy},
  year = {2026},
  month = feb,
  booktitle = {2026 International Conference on Visual Analytics and Data Visualization (ICVADV)},
  doi = {10.1109/ICVADV67766.2026.11470531},
  url = {https://www.semanticscholar.org/paper/a8cef9a306f824b558108d45011f675c2244940b}
}

@article{tamuka2026securing,
  title = {{Securing LLM-based agents against cyberattacks: a comprehensive survey on attack techniques and defense strategies}},
  author = {Nyashadzashe Tamuka and T. Mathonsi and T. Olwal and Solly Maswikaneng and Tonderai Muchenje and T. Tshilongamulenzhe},
  year = {2026},
  month = may,
  journal = {Journal of Computer Virology and Hacking Techniques},
  doi = {10.1007/s11416-026-00622-3},
  url = {https://www.semanticscholar.org/paper/604332431f17ceaefa260471b1792ce48ea7ff16}
}

@inproceedings{chen2025securegovagent,
  title = {{SecureGov-Agent: A Governance-Centric Multi-Agent Framework for Privacy-Preserving and Attack-Resilient LLM Agents}},
  author = {Jinyu Chen and Jixiao Yang and Ziyang Zeng and Zixiao Huang and Jinming Li and Yutong Wang},
  year = {2025},
  month = dec,
  booktitle = {Proceedings of the 2025 6th International Conference on Computer Science and Management Technology},
  doi = {10.1145/3795154.3795296},
  url = {https://www.semanticscholar.org/paper/e2e5529df48fe6cf893da483360958b32d829724}
}

@inproceedings{hossain2025multiagent,
  title = {{A Multi-Agent LLM Defense Pipeline Against Prompt Injection Attacks}},
  author = {S. Hossain and Ruksat Khan Shayoni and Mohd Ruhul Ameen and Akif Islam and M. Mridha and Jungpil Shin},
  year = {2025},
  month = sep,
  booktitle = {IEEE International WIE Conference on Electrical and Computer Engineering},
  eprint = {2509.14285},
  archivePrefix = {arXiv},
  doi = {10.1109/WIECON-ECE69386.2025.11526251},
  url = {https://www.semanticscholar.org/paper/f851714285c7a6bfb963da98d67f04df0eafbac9}
}

@article{demirol2026balancing,
  title = {{Balancing Security and Performance in LLM Agents: Spotlight-Guard, a Layered Defense Against Indirect Prompt Injection}},
  author = {Doygun Demirol and Murat Aydoğan},
  year = {2026},
  month = aug,
  journal = {Applied Sciences},
  doi = {10.3390/app16157662},
  url = {https://www.semanticscholar.org/paper/bdb097dcf666e8ed89f66d2c7319d47f524fc614}
}

@article{chang2024play,
  title = {{Play Guessing Game with LLM: Indirect Jailbreak Attack with Implicit Clues}},
  author = {Zhiyuan Chang and Mingyang Li and Yi Liu and Junjie Wang and Qing Wang and Yang Liu},
  year = {2024},
  month = feb,
  journal = {Annual Meeting of the Association for Computational Linguistics},
  eprint = {2402.09091},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2402.09091},
  url = {https://www.semanticscholar.org/paper/490e815b3be11ba97631783d9ae946b8f8517fd6}
}

@misc{hong2025sok,
  title = {{SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses}},
  author = {Hanbin Hong and Shuangqiao Wu and Shuya Feng and Nima Naderloui and Shenao Yan and Jingyue Zhang and Ali Arastehfard and Heqing Huang and Yuan Hong},
  year = {2025},
  month = oct,
  eprint = {2510.15476},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/9f8a3c6f1fca4aeb8364bdb767b2e14e92376d5d}
}

@misc{ji2025taxonomy,
  title = {{Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks}},
  author = {Zimo Ji and Xunguang Wang and Zongjie Li and Pingchuan Ma and Yudong Gao and Daoyuan Wu and Xincheng Yan and Tian Tian and Shuai Wang},
  year = {2025},
  month = nov,
  eprint = {2511.15203},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2511.15203},
  url = {https://www.semanticscholar.org/paper/66c8e83ed0fc215dc8be0e44715a692ef27f005b}
}

@misc{huang2025trust,
  title = {{Trust in LLM-controlled Robotics: a Survey of Security Threats, Defenses and Challenges}},
  author = {Xinyu Huang and B. ShyamKarthickV and Taozhao Chen and Mitch Bryson and Thomas L. Chaffey and Huaming Chen and Kim-Kwang Raymond Choo and Ian R. Manchester and S. Karthick},
  year = {2025},
  month = dec,
  eprint = {2601.02377},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2601.02377},
  url = {https://www.semanticscholar.org/paper/71f30c8b6aca4dbd4a81302ac30335421b1a8688}
}

@misc{cui2024recent,
  title = {{Recent Advances in Attack and Defense Approaches of Large Language Models}},
  author = {Jing Cui and Yishi Xu and Zhewei Huang and Shuchang Zhou and Jianbin Jiao and Junge Zhang},
  year = {2024},
  month = sep,
  eprint = {2409.03274},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2409.03274},
  url = {https://www.semanticscholar.org/paper/3d7cc47f10a1b55e3c7af24bf43f7f9206fcda4e}
}

@misc{prinos2026stable,
  title = {{Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defense}},
  author = {Kerri Prinos and Lilianne Brush and C. Denton and Zhanqiang Wang and Joshua Knox and Snehal S. Antani and A. Foltz and Amy Villasenor},
  year = {2026},
  month = may,
  eprint = {2605.03034},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2605.03034},
  url = {https://www.semanticscholar.org/paper/7ca2bbdc56f4102275222deee1f3a60eb34b486a}
}

@misc{lin2026safeharness,
  title = {{SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment}},
  author = {Xixun Lin and Yang Liu and Yancheng Chen and Yongxuan Wu and Yucheng Ning and Yilong Liu and Nan Sun and Shunhong Zhang and Bin Chong and Chuan Zhou and Yanan Cao and Li Guo},
  year = {2026},
  month = apr,
  eprint = {2604.13630},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2604.13630},
  url = {https://www.semanticscholar.org/paper/dc80f1113a0087e81f47cc746590b802c8ef6013}
}

@misc{shi2026saiguard,
  title = {{SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems}},
  author = {Ruxue Shi and Yili Wang and Mengnan Du and Qinggang Zhang and Rui Miao and Yixin Liu and Xin Wang},
  year = {2026},
  month = jun,
  eprint = {2606.12474},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/a96d1118b026d24af509a0e6ecd47b710bf0f138}
}

@misc{vilches2026cybersecurity,
  title = {{Cybersecurity AI: A Game-Theoretic AI for Guiding Attack and Defense}},
  author = {V. Vilches and Mar'ia Sanz-G'omez and Francesco Balassone and Stefan Rass and Lidia Salas Espejo and Benjamin Jablonski and Luis Javier Navarrete-Lozano and Maite del Mundo de Torres and Cristóbal R. J. Veas Chavez},
  year = {2026},
  month = jan,
  eprint = {2601.05887},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2601.05887},
  url = {https://www.semanticscholar.org/paper/3316e5185e695a00f15eb372c05c6cab5ef3fbfa}
}

@article{miao2025blindguard,
  title = {{BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks}},
  author = {Rui Miao and Yixin Liu and Yili Wang and Xu Shen and Yue Tan and Yiwei Dai and Shirui Pan and Xin Wang},
  year = {2025},
  month = aug,
  journal = {Volume 1},
  eprint = {2508.08127},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2508.08127},
  url = {https://www.semanticscholar.org/paper/f583a040e8324257a993935122c7f1e274bdb20a}
}

@misc{acharya2026formal,
  title = {{A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms}},
  author = {Nirajan Acharya and Gaurav Kumar Gupta},
  year = {2026},
  month = apr,
  eprint = {2604.05969},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2604.05969},
  url = {https://www.semanticscholar.org/paper/f28a78235a0ec6bc74135a46688a5008a38044d9}
}

@misc{xue2025multiphishguard,
  title = {{MultiPhishGuard: An LLM-based Multi-Agent System for Phishing Email Detection}},
  author = {Yinuo Xue and Eric Spero and Yun Sing Koh and Giovanni Russello},
  year = {2025},
  doi = {10.48550/arXiv.2505.23803},
  url = {https://www.semanticscholar.org/paper/f0cf54a86f7eb31e2bc42e328a603ebb84a7369f}
}

@misc{mao2025from,
  title = {{From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem}},
  author = {Yanxu Mao and Tiehan Cui and Peipei Liu and Datao You and Hongsong Zhu},
  year = {2025},
  month = jun,
  eprint = {2506.15170},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2506.15170},
  url = {https://www.semanticscholar.org/paper/ccfabe9f33f11bd1fbc4ac2bf219fc29cc5fa96d}
}

@inproceedings{suo2024signedprompt,
  title = {{Signed-Prompt: A New Approach to Prevent Prompt Injection Attacks Against LLM-Integrated Applications}},
  author = {X. Suo},
  year = {2024},
  month = jan,
  booktitle = {AIP Conference Proceedings},
  eprint = {2401.07612},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2401.07612},
  url = {https://www.semanticscholar.org/paper/2742c3d77c4aa6d023b7dfc77984ad10e6aae274}
}

@inproceedings{mckenzie2025stack,
  title = {{STACK: Adversarial Attacks on LLM Safeguard Pipelines}},
  author = {Ian R. McKenzie and O. Hollinsworth and Tom Tseng and Xander Davies and Stephen Casper and A. D. Tucker and Robert Kirk and Adam Gleave},
  year = {2025},
  month = jun,
  booktitle = {AAAI Conference on Artificial Intelligence},
  eprint = {2506.24068},
  archivePrefix = {arXiv},
  doi = {10.48550/arXiv.2506.24068},
  url = {https://www.semanticscholar.org/paper/59db5498605113c8b2567219a5041ff08f7a4587}
}

@misc{agyekum2026does,
  title = {{Does Fixing Break Security? An Empirical Study of Security Degradation in Iterative LLM-Driven Infrastructure-as-Code Repair}},
  author = {Benjamin Agyekum and Fabio Santos},
  year = {2026},
  month = aug,
  eprint = {2608.13404},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.13404}
}

@misc{mou2026toolhazard,
  title = {{ToolHazard: Scaling Adversarial Environments for Security Evaluation and Alignment of LLM-based Agents}},
  author = {Yutao Mou and Pengfei Yang and Zhe Yin and Zhangchi Xue and Xiaotian Luan and Dingyao Yu and Tong Zhang and Shikun Zhang and Wei Ye},
  year = {2026},
  month = aug,
  eprint = {2608.11878},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.11878}
}

@misc{hossain2026understanding,
  title = {{On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models}},
  author = {Md Jafrin Hossain and Mohammad Arif Hossain and Nirwan Ansari},
  year = {2026},
  month = aug,
  eprint = {2608.10530},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.10530}
}

@misc{tsigkopoulos2026from,
  title = {{From Prompt Injection to Web Exploitation: Revisiting Classic Vulnerabilities in LLM-Integrated Applications}},
  author = {Spiros Tsigkopoulos and Christoforos Ntantogian},
  year = {2026},
  month = aug,
  eprint = {2608.10281},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.10281}
}

@misc{ozcam2026generating,
  title = {{Generating Attacks for LLMs with GFlowNets}},
  author = {Berkay Ozcam and Irem Onen and Mehmet Fatih Amasyali and Emin Islam Tatli},
  year = {2026},
  month = aug,
  eprint = {2608.10171},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.10171}
}

@misc{chen2026pragmatic,
  title = {{Pragmatic Attack Surface: Vulnerabilities of Implicit Context in Large Language Models}},
  author = {Bocheng Chen and Han Zi and Roucheng Ou and Yawei Liu and Minyue Chen and Zimo Qi and Rongrong Wang and Guangliang Liu},
  year = {2026},
  month = aug,
  eprint = {2608.09551},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09551}
}

@misc{gallego2026gaming,
  title = {{Gaming Without an Attacker: Benchmark Fingerprinting in LLM-Driven Search Under Selection Pressure}},
  author = {Víctor Gallego},
  year = {2026},
  month = aug,
  eprint = {2608.08722},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.08722}
}

@misc{luo2026measuring,
  title = {{Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks}},
  author = {Mingyu Luo and Ming Deng and Zilang Qiu and Yiming Cheng and Ci Tao and Xue Tan and Sijin Sun and Yangfu Li and Ping Chen and Jun Dai and Xiaoyan Sun},
  year = {2026},
  month = aug,
  eprint = {2608.09624},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09624}
}

@misc{shen2026dualadversarial,
  title = {{Dual-Adversarial Safety Alignment: Cultivating Intrinsic Threat Comprehension in LRMs}},
  author = {Hongli Shen and Shaopeng Fu and Qinbo Zhang and Jian Li and Di Wang},
  year = {2026},
  month = aug,
  eprint = {2608.09542},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09542}
}

@misc{hou2026metacognitive,
  title = {{Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection}},
  author = {Sihan Hou and Xinmeng Hou and Zhijun Zhang and Zehao Wang and Xuhong Ren and Sibo Qin and Kuntharrgyal Khysru and Qing Guo},
  year = {2026},
  month = aug,
  eprint = {2608.08795},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.08795}
}

@misc{apurba2026defending,
  title = {{Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection}},
  author = {Kaysarul Anas Apurba and Md. Hasibul Hasan and Mahedee Zaman Moon and Sk. Md. Mizanur Rahman and Atsuo Inomata},
  year = {2026},
  month = aug,
  eprint = {2608.08100},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.08100}
}

@misc{qin2026basis,
  title = {{BASIS: Breach-Aware Selective Prompt Injection Shielding with Prefill Attention Probes}},
  author = {Laiqiao Qin and Tianqing Zhu and Longxiang Gao and Wanlei Zhou},
  year = {2026},
  month = aug,
  eprint = {2608.08027},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.08027}
}

@misc{liu2026capabilityrouted,
  title = {{Capability-Routed Guard: Defending Large Reasoning Models Against Reasoning-Centric Jailbreaks}},
  author = {Yiyong Liu and Yixin Wu and Jun Sakuma},
  year = {2026},
  month = aug,
  eprint = {2608.07892},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07892}
}

@misc{mchugh2026anatomy,
  title = {{The Anatomy of a Prompt Injection: A Component Model for Structured Analysis}},
  author = {Jeremy McHugh},
  year = {2026},
  month = aug,
  eprint = {2608.07808},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07808}
}

@misc{zhan2026stepjack,
  title = {{StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection}},
  author = {Zhuoxin Zhan and Akbar Rafiey and Avery Ma and Leila Pishdad and Layla El Asri},
  year = {2026},
  month = aug,
  eprint = {2608.06477},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.06477}
}

@misc{li2026evolving,
  title = {{Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguards}},
  author = {Xi Li and Shu Zhao and Xiaohan Zou and Fei Zhao and Fuxiao Liu and Yusen Zhang and Cheng Han and Yushun Dong and Jiaqi Wang},
  year = {2026},
  month = jul,
  eprint = {2608.07535},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07535}
}

@misc{henriksson2026static,
  title = {{Static analysis-guided agentic AI translation enables Rust as a full stack bioinformatics language}},
  author = {Johan Henriksson},
  year = {2026},
  month = aug,
  eprint = {2608.13029},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.13029}
}

@misc{tran2026rethinking,
  title = {{Rethinking Agent Security as a Networking Problem}},
  author = {Van Tran and Taveesh Sharma and Tajveer Singh Dhesi and Nick Feamster},
  year = {2026},
  month = aug,
  eprint = {2608.12172},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.12172}
}

@misc{spence2026next,
  title = {{The Next Challenge for Agentic Cybersecurity: A Realistic, Contamination-Free Reverse Engineering Benchmark}},
  author = {Jeremy Spence and Nicholas Assaderaghi and Jinhao Zhu and Nikil Ravi and Raluca Ada Popa and Guannan Wei and Yangruibo Ding and Zhuo Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.11469},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.11469}
}

@misc{ng2026agent,
  title = {{Agent Safety Should Be a Runtime Contract}},
  author = {Albus W. Ng and Yi Han and Jusheng Zhang and Wenhao Wang},
  year = {2026},
  month = aug,
  eprint = {2608.11274},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.11274}
}

@misc{smart2026theory,
  title = {{Toward a Theory of Value in AI Alignment}},
  author = {Andrew Smart and Shazeda Ahmed and Jackie Kay and Jimmy Tobin and Kris Shrishak and Abeba Birhane},
  year = {2026},
  month = aug,
  eprint = {2608.10327},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.10327}
}

@misc{x2026multiagent,
  title = {{Multi-Agent AI Safety as an Institutional Design Problem}},
  author = {Abdullah X},
  year = {2026},
  month = aug,
  eprint = {2608.09828},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09828}
}

@misc{deivasigamani2026not,
  title = {{Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection}},
  author = {Rahul Deivasigamani and Sayeda Faatin Alvi and Derqui Andrea and Kaushal Punjabi and Stjepan Picek},
  year = {2026},
  month = aug,
  eprint = {2608.08939},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.08939}
}

@misc{hornung2026cyberagents,
  title = {{CyberAGENTS: Structured Autonomy for Agentic Gamified Learning in Cybersecurity}},
  author = {Ivan Hornung and Deepthi Marasinghe Arachchige and Tharindu Kumarage and Garima Agrawal and Yuli Deng and Ying-Chih Chen and Huan Liu},
  year = {2026},
  month = aug,
  eprint = {2608.07965},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07965}
}

@misc{katkar2026niyamai,
  title = {{NiyamAI - An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs}},
  author = {Aditya Katkar and Om Karkele and Kartik Mandhane and Manisha More and Yash Kashid},
  year = {2026},
  month = aug,
  eprint = {2608.07167},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07167}
}

@inproceedings{wang2026llm,
  title = {{LLM Security Defense Using Unsupervised Learning and Deep Reinforcement Learning}},
  author = {Leilei Wang and Hongying Li},
  year = {2026},
  month = jun,
  booktitle = {2026 IEEE 3rd International Conference on Computer Vision and Deep Learning (DLCV)},
  doi = {10.1109/DLCV69906.2026.11635183},
  url = {https://www.semanticscholar.org/paper/26c28b6a8e743b6d6f8ff199fb2217b5d7fa9f34}
}

@inproceedings{malicha2026benchmarking,
  title = {{Benchmarking the Effectiveness of AI-Driven Red Teaming Across Safety-Aligned Language Models}},
  author = {Joyce Malicha and Kamrul Hasan},
  year = {2026},
  month = mar,
  booktitle = {2026 IEEE 2nd International Conference on Secure IoT, Assured and Trusted Computing (SATC)},
  doi = {10.1109/SATC69565.2026.11542221},
  url = {https://www.semanticscholar.org/paper/570f0f9f9c7e3b686aa1dc4e97d74ceabe30d149}
}

@article{alotaibi2026red,
  title = {{A red teaming framework for large language models: a case study on faithfulness evaluation}},
  author = {Abrar Alotaibi and Raed Mughus and Moataz Ahmed},
  year = {2026},
  month = jun,
  journal = {Software quality journal},
  eprint = {2606.25476},
  archivePrefix = {arXiv},
  doi = {10.1007/s11219-026-09779-y},
  url = {https://www.semanticscholar.org/paper/f268fa307779519fcd044adf0b3bc5b8f828611a}
}

@misc{kaur2026what,
  title = {{What AI Red-Team Evaluations Can and Cannot Prove}},
  author = {Bandana Kaur},
  year = {2026},
  month = jul,
  eprint = {2607.21735},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/5ac1a19d9e04829701552cea010f3dbdd72e65f3}
}

@misc{chen2026redagentbench,
  title = {{REDAgentBench: Executable Red Teaming and Faithful Measurement of LLM Agent Systems}},
  author = {Zixing Chen and Xingyuan Liu and Jie Zhu and Huaixia Dou and Shuo Jiang and Junhui Li and Lifan Guo and Feng Chen and Chi Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.10669},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/4529381cbe510e8c5911b678654a62b46b3a1327}
}

@inproceedings{karne2026attaxmultimodal,
  title = {{AttaX-Multimodal: End-to-End Evaluation of Multimodal AI Safety with Threatscore and Resiliencescore}},
  author = {Rahul Karne},
  year = {2026},
  month = apr,
  booktitle = {2026 International Conference on Connected Intelligence for Industrial Applications (CI2A)},
  doi = {10.1109/CI2A69097.2026.11577059},
  url = {https://www.semanticscholar.org/paper/62fef5fdd0b48cd8d9acaab2d40663825eb1a98f}
}

@article{umer2026evaluating,
  title = {{Evaluating the safety of large language models in healthcare and dentistry: adversarial testing approaches}},
  author = {F. Umer and Muhammad Muthar Shaikh and Absar Ur Rahman},
  year = {2026},
  month = jul,
  journal = {BDJ Open},
  doi = {10.1038/s41405-026-00462-9},
  url = {https://www.semanticscholar.org/paper/1701841a90c671a0ac638bf3e721d010046a6488}
}

@misc{henshaw2026from,
  title = {{From Noise to Signal: Improving Security Log Anomaly Detection Using LLMs with Endpoint-Specific Logs}},
  author = {Christopher Henshaw and Gour Karmakar},
  year = {2026},
  month = aug,
  eprint = {2608.19938},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.19938}
}

@misc{liu2026composkill,
  title = {{CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills}},
  author = {Mingxiao Liu and Zhoumian Jiang and Jianan Ma and Jian Zhang and Jialuo Chen and Xinhao Deng and Zhen Wang},
  year = {2026},
  month = aug,
  eprint = {2608.16246},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.16246}
}

@misc{hyman2026benchmarking,
  title = {{Benchmarking Identity-Sensitive LLM Outputs for Surveillance and Security Robots}},
  author = {Nneka Hyman and Jasmine Khan and Raj Korpan},
  year = {2026},
  month = aug,
  eprint = {2608.16030},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.16030}
}

@misc{zhang2026wesce,
  title = {{WeSCE: A Benchmark for Measuring Security Drift in LLM-Driven Code Editing}},
  author = {Zhiyu Zhang and Tingyue Wen and Senke Sun and Dengxiang Liang and Enhao Huang},
  year = {2026},
  month = aug,
  eprint = {2608.15092},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.15092}
}

@misc{sood2026copa,
  title = {{COPA: Continual Preference Optimization for Adaptive Prompt Injection Defense}},
  author = {Roshan Sood and Onat Gungor and Tajana Rosing},
  year = {2026},
  month = aug,
  eprint = {2608.19982},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.19982}
}

@misc{chen2026mobileworldsafety,
  title = {{MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps}},
  author = {Sujin Chen and Lijun Li and Tianyi Du and Jing Shao},
  year = {2026},
  month = aug,
  eprint = {2608.17659},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17659}
}

@misc{ahmed2026reflexguard,
  title = {{Reflex-Guard: A Low-Latency Guardrail for LLM Prompt Safety Using Dense Semantic Embeddings}},
  author = {Istiaque Ahmed and Afia Anjum Borsha and Ranat Das Prangon and Abu-fuad Ahmad and Thi Hong Tran},
  year = {2026},
  month = aug,
  eprint = {2608.17556},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17556}
}

@misc{he2026fair,
  title = {{Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets}},
  author = {Zhida He and Xiaoyu Wen and Han Qi and Ziyuan Zhou and Peng Yu and Jiajia Li and Chaochao Lu and Qiaosheng Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.17360},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17360}
}

@misc{oaphy2026comic,
  title = {{COMIC: Reference-Aware Safety Gating for Multimodal Large Language Models}},
  author = {Md Abdullahil Oaphy and Anhao Xiang and Zongxing Xie and Huayue Gu and Chenyu Wang and Honghui Xu},
  year = {2026},
  month = aug,
  eprint = {2608.17234},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17234}
}

@misc{karanjai2026pace,
  title = {{PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance}},
  author = {Rabimba Karanjai and Yang Lu and Richard Williamson and Hemanth Hm and Prakhar Mehrotra and Lei Xu and Weidong and Shi},
  year = {2026},
  month = aug,
  eprint = {2608.17220},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17220}
}

@misc{russinovich2026fools,
  title = {{Fool's Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models}},
  author = {Mark Russinovich},
  year = {2026},
  month = aug,
  eprint = {2608.17202},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17202}
}

@misc{ying2026security,
  title = {{Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection}},
  author = {Zonghao Ying and Xiangfan Wu and Huiyu Wu and Xing Zheng and Huangsheng Cheng and Xiaorong Shi and Jing Guo},
  year = {2026},
  month = aug,
  eprint = {2608.16393},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.16393}
}

@misc{muruaga2026bounded,
  title = {{Bounded Agents: Delegation Security for Multi-Agent AI Systems}},
  author = {Xabier Muruaga},
  year = {2026},
  month = aug,
  eprint = {2608.15888},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.15888}
}

@misc{rafy2026twingridshield,
  title = {{TwinGridShield: Consequence-Aware Runtime Authorization for LLM Grid-Agent Actions}},
  author = {Md Fazley Rafy},
  year = {2026},
  month = aug,
  eprint = {2608.15391},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.15391}
}

@misc{day2026workspace,
  title = {{Workspace Topology as an Attack Vector in Agentic Coding Assistants}},
  author = {Alexandre G. R. Day and Pradeep Yadlapalli and Sriram Venkatapathy and Thomas Paniagua and Nick Raines and Sahil Wadhwa and Himanshu Kumar and Andy Luo and Sudeep Panyam and Rikhiya Ghosh and Pranab Mohanty and Giri Iyengar},
  year = {2026},
  month = aug,
  eprint = {2608.14876},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.14876}
}

@misc{luan2026memcatalyst,
  title = {{MemCatalyst: Amplifying Data Auditing on Vision-Language Models via Data Poisoning}},
  author = {Xukun Luan and Jinyan Liu and Yuhui Gong and Yuanguo Bi and Bing Hu and Xuesong Li and Di Wang},
  year = {2026},
  month = aug,
  eprint = {2608.17722},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17722}
}

@misc{m2026multiagent,
  title = {{A Multi-Agent Platform for Automated Enterprise Analytics and Insight Generation}},
  author = {Manoj N M and Vijayakrishna S and Manjunath Srinivas and Rohit Pahan},
  year = {2026},
  month = aug,
  eprint = {2608.18740},
  archivePrefix = {arXiv},
  doi = {10.1145/3841323.3841342},
  url = {https://arxiv.org/abs/2608.18740}
}

@misc{karanjai2026when,
  title = {{When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling}},
  author = {Rabimba Karanjai and Yang Lu and Nour Diallo and Wujie Xiong and Lei Xu and Weidong and Shi},
  year = {2026},
  month = aug,
  eprint = {2608.17275},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17275}
}

@misc{yang2026unsaid,
  title = {{Unsaid, Unsafe? Implicit Security Obligations in LLM-Based RTL Code Generation}},
  author = {Guang Yang and Xing Hu and Xiang Chen and Xin Xia},
  year = {2026},
  month = aug,
  eprint = {2608.26588},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26588}
}

@misc{milner2026how,
  title = {{How Do LLM Agents Actually Get the Flag? Trace-Level Provenance for Agentic Offensive Security Evaluation}},
  author = {Kimberly Milner and Minghao Shao and Nanda Rani and Haoran Xi and Venkata Sai Charan Putrevu and Meet Udeshi and Sandeep K. Shukla and Prashanth Krishnamurthy and Farshad Khorrami and Muhammad Shafique and Ramesh Karri},
  year = {2026},
  month = aug,
  eprint = {2608.26237},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26237}
}

@misc{hu2026selfevolving,
  title = {{A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks}},
  author = {Tongyan Hu and Bryan Hooi},
  year = {2026},
  month = aug,
  eprint = {2608.26008},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26008}
}

@misc{wu2026skillshield,
  title = {{SkillShield: Prompt-Space Security Skills for LLM Coding Agents}},
  author = {Xiaodong Wu and Zhimin Zhao and Qi Li and Xiangman Li and Yu Shi and Bram Adams and Jianbing Ni},
  year = {2026},
  month = aug,
  eprint = {2608.25817},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.25817}
}

@misc{liu2026surprising,
  title = {{The Surprising Effectiveness of LLMs in BGP Security: Mining An Unprecedented Amount of Incidents and Boosting Anomaly Detection}},
  author = {Libin Liu and Wenzhou Yang and Li Chen and Dan Li and Xiuting Xu},
  year = {2026},
  month = aug,
  eprint = {2608.22812},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.22812}
}

@misc{li2026textanchored,
  title = {{Text-Anchored Semantic Perturbations for Transferable Jailbreak Attacks on Multimodal Large Language Models}},
  author = {Wenyun Li and Guiping Cao and Xiangyuan Lan and Zheng Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.22312},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.22312}
}

@misc{liao2026tracegrant,
  title = {{TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents}},
  author = {Bohao Liao and Jingchao Wang and Qipeng Song and Jin Cao and Jieling Wang and Boyu Deng},
  year = {2026},
  month = aug,
  eprint = {2608.21126},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21126}
}

@misc{wang2026clawsentry,
  title = {{ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents}},
  author = {Kai Wang and Zeming Wei and BiaoJie Zeng and Chang Jin and An Wang and Xiaokun Luan and Zhixiao Lin and Jingjing Qu and Xia Hu and Xingcheng Xu},
  year = {2026},
  month = aug,
  eprint = {2608.21101},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21101}
}

@misc{deniz2026aixamine,
  title = {{aiXamine: Unified Black-Box Evaluation of Cross-Dimensional Trade-offs in LLM Safety, Security, and Privacy}},
  author = {Fatih Deniz and Yazan Boshmaf and Dorde Popovic and Issa Khalil},
  year = {2026},
  month = aug,
  eprint = {2608.20554},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.20554}
}

@misc{noumi2026agentic,
  title = {{Agentic Security: A Systematization of Tools, Failure Modes, and Design Laws for LLM-Driven Penetration Testing}},
  author = {Israt Moyeen Noumi and Tarannum Ahmed Nowshin and Md. Mehedi Hasan Nipu and Mohammad Sakib Mahmood and Md. Jakir Hossain and M. F. Mridha},
  year = {2026},
  month = aug,
  eprint = {2608.21423},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21423}
}

@misc{zhang2026redevoagent,
  title = {{RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution}},
  author = {Junjie Zhang and Hui Liu and Kecheng Chen and Xianbo Mo and Changsheng Chen and Haoliang Li},
  year = {2026},
  month = aug,
  eprint = {2608.27439},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27439}
}

@misc{rahman2026framing,
  title = {{The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents}},
  author = {Md Habibur Rahman and Jaeho Kim},
  year = {2026},
  month = aug,
  eprint = {2608.27092},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27092}
}

@misc{kongmanee2026latent,
  title = {{The Latent Diagnostic Taxonomy: A Framework for Constructing Classifiers and Diagnosing Their Decisions, Applied to Prompt Injection Detection}},
  author = {Jaturong Kongmanee and Smile Thanapattheerakul},
  year = {2026},
  month = aug,
  eprint = {2608.26423},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26423}
}

@misc{xu2026neuronfuzz,
  title = {{NeuronFuzz: Safety Neuron Guided Fuzzing for LLM Safety Evaluation}},
  author = {Zhiyuan Xu and Muhammad Firhard Roslan and Joseph Gardiner and Sana Belguith and Lichao Wu},
  year = {2026},
  month = aug,
  eprint = {2608.26222},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26222}
}

@misc{wang2026mmjailbench,
  title = {{MMJailBench: A Factorized Benchmark for Disentangling Multimodal Jailbreak Vulnerabilities}},
  author = {Tianshi Wang and Jingsong Wang and Yafei Huang and Fengling Li and Xin Li and Lei Zhu},
  year = {2026},
  month = aug,
  eprint = {2608.25490},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.25490}
}

@misc{labunets2026refusal,
  title = {{Refusal geometry reflects refusal training: diverse refusal prefixes can raise stable rank and weaken refusal vector ablation attacks}},
  author = {Andrey Labunets},
  year = {2026},
  month = aug,
  eprint = {2608.25390},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.25390}
}

@misc{lee2026webmcpphalanx,
  title = {{WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents}},
  author = {Lin-Fa Lee and YI-YU Chang and Kuo-Hui Yeh},
  year = {2026},
  month = aug,
  eprint = {2608.24017},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.24017}
}

@misc{gao2026neuronguard,
  title = {{NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistribution}},
  author = {Anjun Gao and Yueyang Quan and Yufei Xia and Zhuqing Liu and Minghong Fang},
  year = {2026},
  month = aug,
  eprint = {2608.23959},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.23959}
}

@misc{penman2026semantic,
  title = {{Semantic Overlays: Mitigating Prompt Injection with Annotations Beyond Tokens and Steering Vectors}},
  author = {Joshua Penman},
  year = {2026},
  month = aug,
  eprint = {2608.23873},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.23873}
}

@misc{aviv2026beyond,
  title = {{Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)}},
  author = {Avital Aviv and Parth A. Gandh and Ron Bitton and Asaf Shabtai},
  year = {2026},
  month = aug,
  eprint = {2608.23858},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.23858}
}

@misc{rostamzadeh2026trustshiftprobe,
  title = {{TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Servers}},
  author = {Mehrdad Rostamzadeh and Sidhant Narula and Mohammad Ghasemigol and Daniel Takabi},
  year = {2026},
  month = aug,
  eprint = {2608.23763},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.23763}
}

@misc{chen2026beyond,
  title = {{Beyond Over-Refusal: Defending Indirect Prompt Injection via Latent Instruction Manifolds}},
  author = {Jiahao Chen and Rui Yin and Xinfeng Li and Qianli Ma and Tianyu Du and Zhihui Fu and Jun Wang and Zhaoxiang Wang and Shouling Ji},
  year = {2026},
  month = aug,
  eprint = {2608.22248},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.22248}
}

@misc{pratap2026breaking,
  title = {{Breaking the Assumptions: Auditing Input-Side Jailbreak Defenses Against Semantic Attacks}},
  author = {Aaditya Pratap and Harsh Kasyap and Somanath Tripathy},
  year = {2026},
  month = aug,
  eprint = {2608.21895},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21895}
}

@misc{peng2026secopd,
  title = {{SecOPD: Mitigating Adaptive Prompt Injections by On-Policy Distillation}},
  author = {Yibo Peng and Long Lian and David Wagner and Sizhe Chen},
  year = {2026},
  month = aug,
  eprint = {2608.21500},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21500}
}

@misc{karunanidhi2026utility,
  title = {{Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking}},
  author = {Arulnidhi Karunanidhi},
  year = {2026},
  month = aug,
  eprint = {2608.21230},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21230}
}

@misc{badhe2026skillstate,
  title = {{SKILL.state: Scalable Long-Horizon Agent Skills}},
  author = {Sanket Badhe and Priyanka Tiwari and Jonghyun Chung},
  year = {2026},
  month = aug,
  eprint = {2608.26263},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26263}
}

@misc{tran2026retrieved,
  title = {{Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation}},
  author = {Minh Tran and Cuong Dang and Tuc Nguyen and Khanh-Tung Tran and Minh Huynh Nguyen and Trinh Chau and Kien Le and Do Xuan Long and Jiahao Zhang and Fali Wang and Hoang D. Nguyen and Thanh Le and Suhang Wang},
  year = {2026},
  month = aug,
  eprint = {2608.24977},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.24977}
}

@misc{vallabhaneni2026sentinelrl,
  title = {{SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center}},
  author = {Uday Vallabhaneni and Cassie L. Cagwin and David J. Wild},
  year = {2026},
  month = sep,
  eprint = {2609.04159},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04159}
}

@misc{singh2026shifting,
  title = {{Shifting from Injection to Interaction: Rethinking Web Security in the Age of LLMs and Beyond}},
  author = {Nivedita Singh and Alsharif Abuadbba and Yansong Gao and Surya Nepal and Hyoungshick Kim},
  year = {2026},
  month = sep,
  eprint = {2609.03999},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03999}
}

@misc{mondal2026indicsafeeval,
  title = {{IndicSafeEval: Safety Robustness of Large Language Models under Multilingual Persuasive Jailbreak Attacks}},
  author = {Saikat Mondal and Mamta and Deeksha Varshney and Oana Cocarascu and Asif Ekbal},
  year = {2026},
  month = sep,
  eprint = {2609.03781},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03781}
}

@misc{gu2026ascii,
  title = {{ASCII Attack: Recontextualising Harmful Requests as Artistic Critique in Large Language Models}},
  author = {Da Cheng Gu and Yifei Dong and Xinghao Yang and Yongshun Gong and Wei Liu},
  year = {2026},
  month = sep,
  eprint = {2609.02215},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02215}
}

@misc{chou2026akrasia,
  title = {{AKRASIA: Stealthy Backdoor Attack on Reasoning-based Code LLMs}},
  author = {Chua Jin Chou and Sarang Nambiar and Murali Srinivasan and Ezekiel Soremekun},
  year = {2026},
  month = sep,
  eprint = {2609.01023},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01023}
}

@misc{yang2026sok,
  title = {{SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems}},
  author = {Rui Yang and Junjie Xu and Zhengyu Liu and Neil Fendley and Yang Hong and Ziyang Li and Yinzhi Cao},
  year = {2026},
  month = sep,
  eprint = {2609.00595},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00595}
}

@misc{qiao2026evoflint,
  title = {{EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities}},
  author = {Feitong Qiao and Liren Peng and Shiming Ren and Aishwarya Jadhav and Arghavan Bahadorinejad and Marinette Chen and Muhan Zhang and Abdulaziz Suria and Gennevi Lu and Anish Das Sarma},
  year = {2026},
  month = aug,
  eprint = {2609.00487},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00487}
}

@misc{lee2026will,
  title = {{Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents}},
  author = {Yunseok Lee and Yunji Kim and Woojin Lee},
  year = {2026},
  month = aug,
  eprint = {2608.30362},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30362}
}

@misc{ahad2026influence,
  title = {{Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents}},
  author = {Tanzim Ahad and Ismail Hossain and Md Jahangir Alam and Sai Puppala and Syed Bahauddin Alam and Sajedul Talukder},
  year = {2026},
  month = aug,
  eprint = {2608.29942},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.29942}
}

@misc{huang2026whena,
  title = {{When Verified Source Becomes Attack Input: Defending Smart Contracts Against LLM-Based Vulnerability Scanning}},
  author = {Mingyuan Huang and Zimo Ji and Yifan Mo and Shuai Wang},
  year = {2026},
  month = aug,
  eprint = {2608.28400},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.28400}
}

@misc{shaw2026compared,
  title = {{Compared to What? A Human-Anchored Security Benchmark for LLM-Generated Infrastructure-as-Code}},
  author = {Animesh Shaw},
  year = {2026},
  month = aug,
  eprint = {2608.28021},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.28021}
}

@misc{liang2026caitlyn,
  title = {{CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?}},
  author = {Zi Liang and Xiaoyu Xu and Yanyun Wang and Minxin Du and Qingqing Ye and Haibo Hu},
  year = {2026},
  month = aug,
  eprint = {2608.27990},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27990}
}

@misc{res2026alcatraz,
  title = {{AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks}},
  author = {Jakub Reš and Petr Kaška and Martin Perešíni and Martin Ukrop and Kamil Malinka},
  year = {2026},
  month = sep,
  eprint = {2609.03693},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03693}
}

@misc{abbas2026trust,
  title = {{Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models}},
  author = {Syed Ghazanfar Abbas and Dongyan Xu},
  year = {2026},
  month = sep,
  eprint = {2609.03247},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03247}
}

@misc{meng2026seal,
  title = {{SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment}},
  author = {Qingyu Meng and Yiwei Zha and Jiahuan Pei and Koen Hindriks and Herbert Bos and Min Chen},
  year = {2026},
  month = sep,
  eprint = {2609.02293},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02293}
}

@misc{he2026stored,
  title = {{Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents}},
  author = {Jun He and Deying Yu},
  year = {2026},
  month = sep,
  eprint = {2609.02127},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02127}
}

@misc{wang2026implicit,
  title = {{Implicit Manipulation for Skill Selection in LLM Agents with Semantic Matching}},
  author = {Qikai Wang and Yongzhao Zhang and Zhiwei Chen and Yimiao Sun and Jiguo Yu and Xiaosong Zhang},
  year = {2026},
  month = sep,
  eprint = {2609.02035},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02035}
}

@misc{bindschaedler2026agent,
  title = {{Agent Flight Recorder: Tamper-Evident Audit Trails with On-Chain Anchoring for Long-Horizon Tool-Using Agents}},
  author = {Laurent Bindschaedler and Quentin Botha and Christoph Siebenbrunner},
  year = {2026},
  month = sep,
  eprint = {2609.01931},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01931}
}

@misc{oblakov2026hivetraceguardpro,
  title = {{HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation}},
  author = {Nikita Oblakov and Sabrina Sadiekh and Evgeniy Kokuykin},
  year = {2026},
  month = sep,
  eprint = {2609.01046},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01046}
}

@misc{zhao2026skillasapi,
  title = {{Skill-as-API: Confidential Multi-Agent Coordination for Agentic Software Engineering}},
  author = {Ziwei Zhao and Yu Gu and Haojun Liang and Chen Zhang and Xizhi Ding},
  year = {2026},
  month = sep,
  eprint = {2609.01677},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01677}
}

@misc{jha2026context,
  title = {{Context Inference Attacks Without Jailbreaks}},
  author = {Prince Jha and Samuele Poppi and Nils Lukas},
  year = {2026},
  month = aug,
  eprint = {2609.01663},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01663}
}

@misc{dantuluri2026delegation,
  title = {{Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems}},
  author = {Panduranga Sai Varma Dantuluri and Jyotirmoy Sundi},
  year = {2026},
  month = aug,
  eprint = {2609.00267},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00267}
}

@misc{park2026fragility,
  title = {{The Fragility of Jailbreak Robustness Across Operational States}},
  author = {Yuna Park and Hwang Youn Kim and Yujin Kim and Won Woo Ro and Suhyun Kim and Jae-In Hwang},
  year = {2026},
  month = aug,
  eprint = {2608.30748},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30748}
}

@misc{zhao2026eclipse,
  title = {{ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems}},
  author = {Shiqian Zhao and Yangfan Zhou and Xinfeng Li and Runyi Hu and Yechao Zhang and Yi Xie and Tianwei Zhang and Luu Anh Tuan},
  year = {2026},
  month = aug,
  eprint = {2608.30441},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30441}
}

@misc{liu2026attesting,
  title = {{Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems}},
  author = {Lifei Liu and Haoran Yu},
  year = {2026},
  month = aug,
  eprint = {2608.30387},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30387}
}

@misc{xiong2026sir,
  title = {{SIR: Self-improving Red-teaming for Compute Use Agents}},
  author = {Chen Xiong and Zhiyuan He and Pin-Yu Chen and Stjepan Picek and Tsung-Yi Ho},
  year = {2026},
  month = aug,
  eprint = {2608.30207},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30207}
}

@misc{gopalakrishna2026zeroknowledge,
  title = {{Zero-Knowledge Predicate Proofs Between AI Agents: A Measured, Cross-Protocol Gateway and the Source-Integrity Gap}},
  author = {Ashok Subbabhatta Gopalakrishna},
  year = {2026},
  month = aug,
  eprint = {2608.30083},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30083}
}

@misc{wang2026agentprov,
  title = {{AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes}},
  author = {Xun Wang and Bihe Zhao and Michael Backes and Franziska Boenisch and Adam Dziedzic},
  year = {2026},
  month = aug,
  eprint = {2609.00052},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00052}
}

@misc{liu2026longpibench,
  title = {{LongPIBench: A Long-Context Benchmark for Prompt Injection}},
  author = {Yupei Liu and Yuqi Jia and Neil Zhenqiang Gong and Jinyuan Jia},
  year = {2026},
  month = aug,
  eprint = {2608.28411},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.28411}
}

@misc{cui2026fully,
  title = {{Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models}},
  author = {Benlei Cui and Shen Pang and Yuke Wang and Xuemei Dong and Yuwen Zhai and Jingqun Tang and Haiyang Yu and Hui Xue and Longtao Huang and Haiwen Hong},
  year = {2026},
  month = aug,
  eprint = {2608.27531},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27531}
}

@misc{mehrbod2026circuit,
  title = {{Circuit Discovery Helps Detect LLM Jailbreaking: A Mechanistic Interpretability Study}},
  author = {Paria Mehrbod and Boris Knyazev and Guy Wolf and Eugene Belilovsky and Geraldin Nanfack},
  year = {2026},
  month = aug,
  eprint = {2608.27504},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27504}
}

@misc{ma2026rope,
  title = {{ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection}},
  author = {Xinhang Ma and Chaowei Xiao and William Yeoh and Ning Zhang and Yevgeniy Vorobeychik},
  year = {2026},
  month = aug,
  eprint = {2608.27496},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27496}
}

@misc{zeng2026why,
  title = {{Why Are LLM Backdoor Defenses Fragmented? A Feature-Level Explanation with Sparse Autoencoders}},
  author = {Yizhe Zeng and Chenxu Niu and Wei Zhang and Hao Huang and Yunpeng Li and Dongxu Han and Dan Du and Cheng Hong and Hequn Xian and Yuling Liu},
  year = {2026},
  month = aug,
  eprint = {2608.30403},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30403}
}

@misc{bromme2026black,
  title = {{A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits}},
  author = {Arslan Brömme},
  year = {2026},
  month = sep,
  eprint = {2609.04017},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04017}
}

@misc{pesare2026valuepreserving,
  title = {{Value-Preserving Architectures for Agentic AI Systems}},
  author = {Alessandro Pesare and Tommaso Dolci and Katja Hose and Emanuel Sallinger},
  year = {2026},
  month = sep,
  eprint = {2609.03920},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03920}
}

@misc{tan2026hrguard,
  title = {{HRGuard: Gating Relationship Manipulation in Multi-Turn Agentic AI Conversations}},
  author = {Pei-Sze Tan and Tasuku Igarashi and Isao Echizen},
  year = {2026},
  month = aug,
  eprint = {2608.25340},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.25340}
}

@misc{vyskocil2026concepts,
  title = {{Concepts for Securing Agentic AI Coding and the Terok Environment}},
  author = {Jiří Vyskočil and Franz Pöschel and Andreas Knüpfer},
  year = {2026},
  month = aug,
  eprint = {2608.22930},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.22930}
}

@misc{merritt2026agentic,
  title = {{Agentic AI for Safety-critical Multi-drone Systems: Challenges and Opportunities}},
  author = {Timothy Merritt and Alejandro Jarabo-Peñas and Juan Bravo-Arrabal and Maria-Theresa Bahodi and Anders Lyhne Christensen},
  year = {2026},
  month = aug,
  eprint = {2608.21444},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21444}
}

@misc{hu2026intelligent,
  title = {{Intelligent Prompt Construction for Large Language Models in Knowledge-based Visual Question Answering}},
  author = {Zhongjian Hu and Peng Yang and Dongmei Yang and Fengyuan Liu},
  year = {2026},
  month = sep,
  doi = {10.1145/3833389},
  url = {https://doi.org/10.1145/3833389}
}

@misc{cisnerosgonzalez2026indirect,
  title = {{Indirect Prompt Injection in Municipal Document-Processing Copilots: Attacks, Defences and Harm}},
  author = {Jorge Cisneros-González and José Antonio Ondiviela García and Javier Sánchez-Soriano},
  year = {2026},
  month = sep,
  doi = {10.62161/sauc.v12.6399},
  url = {https://doi.org/10.62161/sauc.v12.6399}
}

@misc{prihananto2026crosslingual,
  title = {{Cross-Lingual Indirect Prompt Injection Across Retrieval, Reranking, And Generation In Multilingual RAG}},
  author = {Fauzi Bondan Prihananto and Erlangga Bayu Yudho Prakoso and Aprilisa Arum Sari and Tomy Anugrah Islami},
  year = {2026},
  month = sep,
  doi = {10.59435/jocstec.v4i3.809},
  url = {https://doi.org/10.59435/jocstec.v4i3.809}
}

@misc{park2026data,
  title = {{Data poisoning in LLM multiagent societies: Social proof drives collective decision failure in financial deliberation}},
  author = {Jeongsu Park and Yuji Lim and Geonwoo Kim and Taehyeon Yun and Moohong Min},
  year = {2026},
  month = sep,
  doi = {10.4218/etrij.2026-0186},
  url = {https://doi.org/10.4218/etrij.2026-0186}
}

@misc{pai2026longhorizon,
  title = {{Long-Horizon State Tracking in LLMs: Executing MD5 through a Deep Sequence of Dependent Tool Calls}},
  author = {Dheeraj Mohandas Pai and Lu Xian},
  year = {2026},
  month = sep,
  eprint = {2609.00012},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00012}
}

@misc{vanagas2026capabilitygated,
  title = {{Capability-Gated Language Models: Security Composes, Utility Does Not}},
  author = {Patrikas Vanagas and Augustas Mačijauskas and Laurynas Lopata},
  year = {2026},
  month = sep,
  eprint = {2609.00445},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00445}
}

@misc{corallo2026does,
  title = {{Does Reasoning Mitigate Backdoor Attacks? A Neuro-Symbolic Perspective}},
  author = {Marco Antonio Corallo and Andrea Agiollo and Mauro Conti and Alberto Giaretta},
  year = {2026},
  month = sep,
  eprint = {2609.00464},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00464}
}

@misc{munir2026tris,
  title = {{TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning}},
  author = {Muhaimin Bin Munir and Akib Jawad Ononto and Nazia Shehnaz Joynab and Bhavani Thuraisingham and Latifur Khan},
  year = {2026},
  month = sep,
  eprint = {2609.00470},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00470}
}

@misc{wu2026safeguard,
  title = {{The Safeguard Worked. Is the LLM System Safer?}},
  author = {Pingyu Wu and Weiming Zhang and Nenghai Yu},
  year = {2026},
  month = sep,
  eprint = {2609.00519},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00519}
}

@misc{zang2026transferable,
  title = {{Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agents}},
  author = {Chuanchao Zang and Jianing Wang and Wenyu Chen and Xiangtao Meng and Li Wang and Xinyu Gao and Zheng Li and Shanqing Guo},
  year = {2026},
  month = sep,
  eprint = {2609.00523},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00523}
}

@misc{chang2026risa,
  title = {{RISA: Response Inspection and Selective Actions for Refusal Calibration in Large Language Models}},
  author = {Wenhan Chang and Tianqing Zhu and Ping Xiong and Shiyi Liao and Wanlei Zhou},
  year = {2026},
  month = sep,
  eprint = {2609.00790},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00790}
}

@misc{zhai2026membership,
  title = {{Membership Inference in Fine-tuned Diffusion Language Models via Token-level Memorization Asymmetry}},
  author = {Shengfang Zhai and Leo Marchyok and Yuling Shi and Huanran Chen and Yinpeng Dong and Jiaheng Zhang and Sanghyun Hong},
  year = {2026},
  month = sep,
  eprint = {2609.00873},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00873}
}

@misc{guo2026when,
  title = {{When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning}},
  author = {Yitong Guo and Xiaoyi Chen and Siyuan Zhang and Xiaofeng Wang and Haixu Tang},
  year = {2026},
  month = sep,
  eprint = {2609.01455},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01455}
}

@misc{chen2026openagentflow,
  title = {{OpenAgentFlow: Enabling System-Wide Safety Boundaries for Heterogeneous AI Agent Fleets}},
  author = {Dongsheng Chen and Xiangyu Zhao and Xin Yao and Xuetao Wei},
  year = {2026},
  month = sep,
  eprint = {2609.00015},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00015}
}

@misc{li2026whats,
  title = {{What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness}},
  author = {Zichuan Li and Jian Cui and Ashley Chen and Xiaojing Liao and Luyi Xing},
  year = {2026},
  month = sep,
  eprint = {2609.01222},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01222}
}

@misc{mahapatra2026publicsharing,
  title = {{Public-Sharing Labels and Verbatim Field Egress in an MCP-to-A2A Agent Configuration: A Controlled Multi-Model Study}},
  author = {Arpan Kumar Mahapatra},
  year = {2026},
  month = sep,
  eprint = {2609.01693},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01693}
}

@misc{cai2026hearing,
  title = {{Hearing the Whispers: Black-Box Membership Inference Attacks on Finetuned TTS Models}},
  author = {Kunlin Cai and Kaiyuan Zhang and Zihang Xiang and Jinghuai Zhang and Abeer Alwan and Fnu Suya and Yuan Tian},
  year = {2026},
  month = sep,
  eprint = {2609.01723},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01723}
}

@misc{cerruti2026agent,
  title = {{Agent Memory Is a Surface for Endogenous Authorization Laundering}},
  author = {Tommaso Cerruti and Mika Okamoto and Ansel Kaplan Erol},
  year = {2026},
  month = sep,
  eprint = {2609.01836},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01836}
}

@misc{park2026weavemark,
  title = {{WeaveMark: Robust and Scalable Multi-bit LLM Watermarking via Coded Payload Spreading}},
  author = {Gang-Hyun Park and Ju-Hyeong Lee and Hee-Youl Kwak and Dae-Young Yun},
  year = {2026},
  month = sep,
  eprint = {2609.02177},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02177}
}

@misc{behnam2026agentic,
  title = {{Agentic Settlement Protocol: An Application Profile for Refundable, Delayed-Fulfilment Agent Commerce on Stablecoin Rails}},
  author = {Behnam and Mohammadkhani and Atul Khekade and Ritesh Kakkad},
  year = {2026},
  month = sep,
  eprint = {2609.02208},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02208}
}

@misc{zheng2026countergeobench,
  title = {{Counter-GEO-Bench: Evaluating Defenses Against Information-Distorting Generative Engine Optimization}},
  author = {Bing Zheng and Zongyao Zhao and Wenming Yang},
  year = {2026},
  month = sep,
  eprint = {2609.02316},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02316}
}

@misc{wang2026primsynth,
  title = {{PrimSynth: An Agentic Approach to Discover, Validate, and Synthesize Exploit Primitives for Linux Kernel Vulnerabilities}},
  author = {Pengfei Wang and Anying Chen and Danjun Liu and Xu Zhou and Wei Xie},
  year = {2026},
  month = sep,
  eprint = {2609.02647},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02647}
}

@misc{ding2026aclemcp,
  title = {{ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use}},
  author = {Zhiyang Ding and Yang Luo and Guangpu Chen and Qingni Shen and Zhonghai Wu},
  year = {2026},
  month = sep,
  eprint = {2609.02690},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02690}
}

@misc{gadey2026codepoisonrag,
  title = {{CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation}},
  author = {Varun Gadey and Ziad Marey and Alexandra Dmitrienko},
  year = {2026},
  month = sep,
  eprint = {2609.02774},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02774}
}

@misc{mao2026safeevolve,
  title = {{SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment}},
  author = {Qinghua Mao and Wanying Qu and Dadi Guo and Leitao Yuan and Qingyu Liu and Yu Li and Guanxu Chen and Yanwei Fu and Xi Lin and Xia Hu and Dongrui Liu},
  year = {2026},
  month = sep,
  eprint = {2609.02786},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02786}
}

@misc{gao2026privatehub,
  title = {{PrivateHub: Contrastive Diffusion Model for Private Sensor-Intensive Environment Data Generation}},
  author = {Jiechao Gao and Yuandong Pan and Jie Wang and Michael Lepech and Bradford Campbell},
  year = {2026},
  month = sep,
  eprint = {2609.02958},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02958}
}

@misc{li2026whenb,
  title = {{When Optimization Becomes Manipulation: Defending Generative Search against Malicious Generative Engine Optimization}},
  author = {Haozhang Li and Yangguang Shao and Xinjie Lin and Zhong Guan and Mi Zhou and Junzheng Shi},
  year = {2026},
  month = sep,
  eprint = {2609.02964},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02964}
}

@misc{yu2026privacypreserving,
  title = {{Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning}},
  author = {Jinxi Yu and Eric Hanchen Jiang and Levina Li and Dong Liu and Zhi Zhang and Wenxiao Zhao and Yanxuan Yu and Kai-Wei Chang and Ying Nian Wu},
  year = {2026},
  month = sep,
  eprint = {2609.02967},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02967}
}

@misc{tolstokorov2026rentarag,
  title = {{Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAG}},
  author = {Alexandr Goultiaev Tolstokorov and Kyriakos Mouratidis and Javad Dogani and Nikolaos Laoutaris},
  year = {2026},
  month = sep,
  eprint = {2609.03749},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03749}
}

@misc{li2026inferring,
  title = {{Inferring Hidden User Models from the Behavior of Personalized LLM Agents}},
  author = {Haoyang Li and Yaxin Xiao and Qingqing Ye and Huadi Zheng and Haibo Hu},
  year = {2026},
  month = sep,
  eprint = {2609.03815},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03815}
}

@misc{ceppi2026flip,
  title = {{Flip, Don't Shuffle: Watermarking LLMs at the Speed of Inference}},
  author = {Simone Ceppi and Ignacio Sanchez},
  year = {2026},
  month = sep,
  eprint = {2609.03844},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03844}
}

@misc{francia2026engineered,
  title = {{Engineered Persuasion: Evaluating Personalized Pretexts in LLM-Generated Spear Phishing}},
  author = {Jerson Francia and Derek Hansen and Benjamin Schooley and Shydra Valynn Murray},
  year = {2026},
  month = sep,
  eprint = {2609.04410},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04410}
}

@misc{nguyen2026rethinking,
  title = {{Rethinking Indirect Prompt Injection as a Test-Time Search Problem}},
  author = {Duong M. Nguyen and Joon Sik Kim and Blazej Manczak and Vaikkunth Mugunthan},
  year = {2026},
  month = sep,
  eprint = {2609.04495},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04495}
}

@misc{chen2026repeatafterme,
  title = {{Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection}},
  author = {Sizhe Chen and Yu-Lin Tsai and Ivan Evtimov and Kamalika Chaudhuri and Raluca Ada Popa and David Wagner and Arman Zharmagambetov},
  year = {2026},
  month = sep,
  eprint = {2609.04533},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04533}
}

@misc{yao2026forgetting,
  title = {{Forgetting Without Restarting: Execution-State Unlearning for Stateful LLM Agents}},
  author = {Chao Yao and Yangbo Wei and Zhen Huang and Junhong Qian and Chenle Chen and Shaoqiang Lu and Chen Wu and Lei He},
  year = {2026},
  month = sep,
  eprint = {2609.04875},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04875}
}

@misc{trinhthi2026tier,
  title = {{TIER: Threat Implicitness Benchmark for Evaluating LLM Safety Behaviors}},
  author = {Thu-Hien Trinh-Thi and Hai-Yen Vong and Thanh-Ha Ung-Dung and Tram Ho},
  year = {2026},
  month = sep,
  eprint = {2609.05117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05117}
}

@misc{zheng2026continuity,
  title = {{CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls}},
  author = {Chris Zheng and Geng Yang},
  year = {2026},
  month = sep,
  eprint = {2609.05269},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05269}
}

@misc{akarma2026privacy,
  title = {{Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks}},
  author = {Ali Akarma and Toqeer Ali Syed and Muhammad Khan and Qurat-ul-ain Mastoi and Adeel Ahmad},
  year = {2026},
  month = sep,
  eprint = {2609.02971},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02971}
}

@misc{li2026blind,
  title = {{A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors}},
  author = {Pengxun Li and Litian Zhang and Jianwei Hou and Shujiang Wu and Song Li and Zifeng Kang and Xi Zhang},
  year = {2026},
  month = sep,
  eprint = {2609.03884},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03884}
}

@misc{kara2026survey,
  title = {{A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalities}},
  author = {Ozgur Kara and Tarik Can Ozden and Furkan Horoz and Zeqian Long and Haotian Xue and Yipu Chen and Oguzhan Akcin and Yongxin Chen and James Matthew Rehg},
  year = {2026},
  month = sep,
  eprint = {2609.05503},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05503}
}

@misc{gao2026baitandrecover,
  title = {{Bait-and-Recover: Poisoning Internal Refusal Signals to Defend LLMs against White-Box Editing Jailbreaks}},
  author = {Tian Gao and Zhipeng Xie and Yuhao Wu and Junhua Liu and Xin Fang},
  year = {2026},
  month = sep,
  eprint = {2609.05794},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05794}
}

@misc{vo2026safeguard,
  title = {{SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement}},
  author = {Quoc Viet Vo and Trung Le and Damith C. Ranasinghe and Ehsan Abbasnejad},
  year = {2026},
  month = sep,
  eprint = {2609.05850},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05850}
}

@misc{ni2026multimodal,
  title = {{Multimodal Resource-Exhaustion Attacks on Vision-Language Models via Joint Pixel-Prompt Optimization}},
  author = {Zhaoxiong Ni and Yatie Xiao and Chi-Man Pun and Fei Peng and Qingxiao Guan and Keke Tang},
  year = {2026},
  month = sep,
  eprint = {2609.05889},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05889}
}

@misc{zheng2026from,
  title = {{From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents}},
  author = {Yu Zheng and Qizhi Zhang},
  year = {2026},
  month = sep,
  eprint = {2609.05901},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05901}
}

@misc{li2026evosafeharness,
  title = {{EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents}},
  author = {Nanxi Li and Yingzi Ma and Yulong Cao and Edward Suh and Bo Li and Dawn Song and Chaowei Xiao},
  year = {2026},
  month = sep,
  eprint = {2609.05903},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05903}
}

@misc{hossain2026structurally,
  title = {{Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents}},
  author = {Md Jafrin Hossain and Nur Al Hasan Haldar},
  year = {2026},
  month = sep,
  eprint = {2609.05911},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05911}
}

@misc{bi2026evaluating,
  title = {{Evaluating Deep-Search Agents under Hierarchical Web Evidence Poisoning}},
  author = {Zhongan Bi and Qiwen Wang and Jianrong Jiang and Jigang Ding and Wenwen Xiong and Changhua Meng and Xuanang Gao and Kepeng Lin and Changjiang Jiang and Yiang Chen and Huan Yao and Wei Wang and Zhenyu Ma and Wenhui Dong},
  year = {2026},
  month = sep,
  eprint = {2609.06027},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06027}
}

@misc{kim2026scriptiocbench,
  title = {{SCRIPTIOC-BENCH: A Benchmark for Recognizing Actionable Threat Intelligence from Script-Based Malware using LLMs}},
  author = {Hanna Kim and Jian Cui and Minkyoo Song and Hwanjo Heo and Seungwon Shin and Kimin Lee and Xiaojing Liao},
  year = {2026},
  month = sep,
  eprint = {2609.06149},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06149}
}

@misc{banstola2026it,
  title = {{It is Not Yet Another Tool: Creating and Deploying an Agentic AI Companion in a Security Operations Center}},
  author = {Kritan Banstola and Faayed Al Faisal and Duy Dao and Ryan Irving and Daniel Lende and Xinming Ou},
  year = {2026},
  month = sep,
  eprint = {2609.06250},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06250}
}

@misc{veski2026capmas,
  title = {{CAPMAS: Capability-Based Delegation of Privileges in Multi-Agent Systems}},
  author = {Rasmus Moorits Veski and Rachid Guerraoui and David Froelicher},
  year = {2026},
  month = sep,
  eprint = {2609.06500},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06500}
}

@misc{wang2026srdguard,
  title = {{SRD-GUARD: A Defense Framework of LLMs via Semantic Rewriting and Joint Multi-Model Scoring for Latent Intent Exposure}},
  author = {Qi Wang and Chengcheng Wan and Jiangtao Wang},
  year = {2026},
  month = sep,
  eprint = {2609.06540},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06540}
}

@misc{gaikwad2026translational,
  title = {{A Translational Note on AI Safety Evaluation}},
  author = {Madhava Gaikwad},
  year = {2026},
  month = sep,
  eprint = {2609.06573},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06573}
}

@misc{guo2026mechaudit40,
  title = {{MechAudit-40: White-Box Auditing across 40 LLM Attack Mechanisms}},
  author = {Zhen Guo and Shanghao Shi and Shamim Yazdani and Ning Zhang and Reza Tourani},
  year = {2026},
  month = sep,
  eprint = {2609.06612},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06612}
}

@misc{fang2026trustworthy,
  title = {{A Trustworthy Watermarking Framework for LLM-Generated Food Safety Content}},
  author = {Zhongli Fang and Yiran Chen and Lingyun Zhang and Yu Liu and Ping Chen and Xiaoyan Sun and Jun Dai},
  year = {2026},
  month = sep,
  eprint = {2609.06708},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06708}
}

@misc{li2026novel,
  title = {{A Novel Semantic Manifold Alignment Attack against Embedding-to-Embedding Obfuscation in Privacy-Preserving LLMs}},
  author = {Sicong Li and Lingfeng Yao and Xingke Yang and Ke Tu and Chenhao Wu and Hao Wang and Jiang Liu and Phone Lin and Xin Fu and Miao Pan},
  year = {2026},
  month = sep,
  eprint = {2609.06749},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06749}
}

@misc{shang2026auraeval,
  title = {{AURA-Eval: Evaluation Framework for Acting Under Risk Awareness in LLM Agent Trajectories}},
  author = {Ruoxi Shang and Christina-Maria Androna and Orfeas Menis Mastromichalakis and Yu Feng and Aniruddhan Ramesh and Rico Angell and Shang Hong Sim and Chrysoula Zerva and Emmanouil Koukoumidis},
  year = {2026},
  month = sep,
  eprint = {2609.06783},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06783}
}

@misc{zhang2026skynet,
  title = {{Skynet: Workflow-Level Anomaly Detection for Agentic AI via Semantic and Structural Modeling}},
  author = {Chaoyu Zhang and Hexuan Yu and Heng Jin and Shanghao Shi and Ning Zhang and Yi Shi and Yulia R. Gel and Y. Thomas Hou and Wenjing Lou},
  year = {2026},
  month = sep,
  eprint = {2609.06835},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06835}
}

@misc{muhamed2026mole,
  title = {{MOLE: Detecting Insider Threats in AI Agents}},
  author = {Aashiq Muhamed and Virginia Smith},
  year = {2026},
  month = sep,
  eprint = {2609.06966},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06966}
}

@misc{pinjari2026agentdrift,
  title = {{AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories}},
  author = {Asif Pinjari and Mithun Paul Saint-Germain},
  year = {2026},
  month = sep,
  eprint = {2609.06972},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06972}
}

@misc{lyu2026agentleak,
  title = {{AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing}},
  author = {Xiaoting Lyu and Yuhong Wu and Yufei Han and Shichang Liu and Liang Zhang and Bin Wang and Bin Wang and Xiaobo Ma and Wei Wang},
  year = {2026},
  month = sep,
  eprint = {2609.07131},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07131}
}

@misc{wang2026benchmarking,
  title = {{Benchmarking LLMs for Threat Level Determination}},
  author = {Han Wang and Murathan Kurfalı and Alfonso Iacovazzi},
  year = {2026},
  month = sep,
  eprint = {2609.07582},
  archivePrefix = {arXiv},
  doi = {10.1109/ICDMW69685.2025.00148},
  url = {https://arxiv.org/abs/2609.07582}
}

@misc{shi2026vexbench,
  title = {{VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities}},
  author = {Jiahao Shi and Edward Tsien and Yifeng Di and Hongjiao Zhang and Yuan Tang and Ronit Dey and Ilona Shishov and Gal Netanel and Zvi Grinberg and Vladimir Belousov and Bat-Zion Rotman and Ilan Pinto and Tianyi Zhang},
  year = {2026},
  month = sep,
  eprint = {2609.08040},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08040}
}

@misc{shen2026acea,
  title = {{ACEA: An Adversarial Co-Evolution Arena for Head-to-Head Red-Team and Blue-Team LLM Testing}},
  author = {Yi Ting Shen and Kentaroh Toyoda and Alex Leung},
  year = {2026},
  month = sep,
  eprint = {2609.08256},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08256}
}

@misc{addagada2026structural,
  title = {{Structural Jailbreaks Generalize but Do Not Compound: A cross-provider and multilingual study of Involuntary In-Context Learning}},
  author = {Tejasvi C. Addagada},
  year = {2026},
  month = sep,
  eprint = {2609.08373},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08373}
}

@misc{bromme2026evidence,
  title = {{An Evidence Model for Agentic Processes: Evidence Claims, Trust Assumptions, and Policy Assessment}},
  author = {Arslan Brömme},
  year = {2026},
  month = sep,
  eprint = {2609.08481},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08481}
}

@misc{roy2026memsentry,
  title = {{MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI}},
  author = {Ayan Roy and Kaustuvi Basu},
  year = {2026},
  month = sep,
  eprint = {2609.08747},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08747}
}

@misc{berriche2026benchmark,
  title = {{Benchmark Scores Are Pipeline-Dependent: A Reliability Audit of Cybersecurity LLM Benchmarks}},
  author = {Aymene Berriche and Cathrine Shalby and Mohannad Alhanahnah and Yazan Boshmaf},
  year = {2026},
  month = sep,
  eprint = {2609.08765},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08765}
}

@misc{liu2026privescalate,
  title = {{PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation}},
  author = {Yixuan Liu and Zilong Zhen and Yin Wu and Yi Li},
  year = {2026},
  month = sep,
  eprint = {2609.09087},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09087}
}

@misc{liu2026agenthijack,
  title = {{AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agents}},
  author = {Zhihao Liu and Hongyu Sun and Zhiyuan Fu and Xiaonan Duan and Jice Wang and Shangru Zhao and Weizhi Meng and Wuxin Yang and Yangfan Zhou and Yuqing Zhang},
  year = {2026},
  month = sep,
  eprint = {2609.09212},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09212}
}

@misc{fasolino2026rag,
  title = {{In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning}},
  author = {Iliano Fasolino},
  year = {2026},
  month = sep,
  eprint = {2609.09243},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09243}
}

@misc{nguyen2026experimental,
  title = {{An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks}},
  author = {Viet K. Nguyen and Mohammad I. Husain},
  year = {2026},
  month = sep,
  eprint = {2609.09404},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09404}
}

@misc{norman2026audio,
  title = {{Audio Deepfake Detection Using Temporal Coherence Analysis}},
  author = {Justin D. Norman and Sarah Barrington},
  year = {2026},
  month = sep,
  eprint = {2609.09489},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09489}
}

@misc{nguyen2026efficient,
  title = {{An Efficient and Effective Agentic Group Shilling Attack on Recommender Systems}},
  author = {Quoc Viet Nguyen and Trinh Pham and Viet Huynh and Hongzhi Yin and Quoc Viet Hung Nguyen and Bay Vo and Thanh Tam Nguyen},
  year = {2026},
  month = sep,
  eprint = {2609.09551},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09551}
}

@misc{rivasseau2026arbitrary,
  title = {{Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning}},
  author = {Thomas Rivasseau},
  year = {2026},
  month = sep,
  eprint = {2609.09553},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09553}
}

@misc{nemecek2026watermarks,
  title = {{Watermarks Without Verification: AI Text Watermarking After the EU AI Act}},
  author = {Alexander Nemecek and Vipin Chaudhary and Erman Ayday},
  year = {2026},
  month = sep,
  eprint = {2609.09604},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09604}
}

@misc{shi2026how,
  title = {{How Fragile Is Safety Alignment at Frontier Scale? A Single-Direction Attack on a 320B MoE}},
  author = {Yi Shi and Tanyu Chen and Kai Shen},
  year = {2026},
  month = sep,
  eprint = {2609.09793},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09793}
}

@misc{li2026csguard,
  title = {{CS-Guard: Benchmarking LLM Guardrails for Code Generation Security}},
  author = {Jinyang Li and Mingyu Guo and Hung X. Nguyen},
  year = {2026},
  month = sep,
  eprint = {2609.09798},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09798}
}

@misc{mamede2026what,
  title = {{What Makes Adversarial Examples Transfer Across Deepfake Detectors?}},
  author = {Rafael M. Mamede and Pedro C. Neto and Ana F. Sequeira},
  year = {2026},
  month = sep,
  eprint = {2609.10002},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10002}
}

@misc{ansari2026beyond,
  title = {{Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance}},
  author = {Samar Ansari},
  year = {2026},
  month = sep,
  eprint = {2609.10105},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10105}
}

@misc{zhou2026understanding,
  title = {{Understanding the Security Boundary of Obfuscation-based On-Device LLM Protection}},
  author = {Hanyi Zhou and Chenyang Li and Yuanzhe Pang and Ke Xu and Mingwei Xu and Zhuotao Liu},
  year = {2026},
  month = sep,
  eprint = {2609.10117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10117}
}

@misc{zeng2026trajmark,
  title = {{TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories}},
  author = {Bokang Zeng and Zheng Gao and Xiaoyu Li and Xiaoyan Feng and Jiaojiao Jiang},
  year = {2026},
  month = sep,
  eprint = {2609.10416},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10416}
}

@misc{bai2026when,
  title = {{When Passing Tests Hides Vulnerabilities: An Empirical Study of Silent Failures in Agentic Systems}},
  author = {Wenji Bai and Muhammad Waseem and Zeeshan Rasheed and Jaakko Peltonen and Pekka Abrahamsson},
  year = {2026},
  month = sep,
  eprint = {2609.10548},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10548}
}

@misc{mu2026empirical,
  title = {{An Empirical Measurement of Jailbreaking Evaluators}},
  author = {Yujie Mu},
  year = {2026},
  month = sep,
  eprint = {2609.10594},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10594}
}

@misc{guo2026adaptive,
  title = {{Adaptive Diffusion Freezing: Privacy-preserving Diffusion Models Against Membership Inference Attacks}},
  author = {Jialu Guo and Xiao Han and Junjie Wu},
  year = {2026},
  month = sep,
  eprint = {2609.10608},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10608}
}

@misc{niu2026blackbox,
  title = {{Black-Box Membership Inference via Word-Level Probability Estimation}},
  author = {Shengjie Niu and Yeheng Ge and Jian Huang},
  year = {2026},
  month = sep,
  eprint = {2609.10611},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10611}
}

@misc{zhang2026understanding,
  title = {{Understanding In-Context Multimodal Jailbreaks via Posterior Reweighting}},
  author = {Xu Zhang and Dev Mistry and Xiang Xu and Ren Wang},
  year = {2026},
  month = sep,
  eprint = {2609.10613},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10613}
}

@misc{gazani2026architecting,
  title = {{Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation}},
  author = {Anna Gazani and Spyridon Kounoupidis and Panagiotis Katsaros and Nikolaos Kekatos and Grigorios Tsoumakas and Georgios Koutidis},
  year = {2026},
  month = sep,
  eprint = {2609.10707},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10707}
}

@misc{zhang2026nobox,
  title = {{No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers}},
  author = {Zehua Zhang and Jie Hu and Pratham Hegde and Aditya Maheshbhai Gabani and Souradip Nath and Yibo Liu and Siyu Liu and Hongkai Chen and Hulin Wang and Zhuoer Lyu and Chang Zhu and Divij Handa and Yan Shoshitaishvili and Tiffany Bao and Ruoyu Wang and Adam Doupe},
  year = {2026},
  month = sep,
  eprint = {2609.10854},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10854}
}

@misc{lotfi2026a2abreak,
  title = {{A2ABreak: Systematic Security Analysis of the A2A Protocol}},
  author = {Alireza Lotfi and Mirza Masfiqur Rahman and Imtiaz Karim and Elisa Bertino},
  year = {2026},
  month = sep,
  eprint = {2609.10871},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10871}
}

@misc{pinjari2026driftnet,
  title = {{DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents}},
  author = {Asif Pinjari and Mithun Paul Saint-Germain},
  year = {2026},
  month = sep,
  eprint = {2609.10892},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10892}
}

@misc{zheng2026benchshield,
  title = {{BenchShield: Formal Model-Backed Instrumentation for Reward Integrity in LLM-Agent Evaluation Infrastructure}},
  author = {Shenghan Zheng and Zonglin Di and Yimin Liu and Kyoung Whan Choe and Jiankai Sun and Heguang Lin and Penghao Jiang and Yifeng He and Xiao Cheng and Jicheng Wang and Wenbo Chen and Alex Yates and Yinzhe Zhao and Bingran You and Yuan Gao and Ayush Munot and Shubham Gaur and Zhe Ye and Hao Wang and Xiangyi Li and Dawn Song and Christophe Hauser},
  year = {2026},
  month = sep,
  eprint = {2609.11028},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11028}
}

@misc{lu2026toxicrag,
  title = {{ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks}},
  author = {Haozhe Lu and Jiaqi Li and Xinyuan Zhu and Xiang Li},
  year = {2026},
  month = sep,
  eprint = {2609.11082},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11082}
}

@misc{frankovits2026deepfake,
  title = {{Deep-Fake CAPTCHA: Mitigating Next-Generation Social Engineering Attacks}},
  author = {Guy Frankovits and Lior Yasur and Fred M. Grabovski and Yisroel Mirsky},
  year = {2026},
  month = sep,
  eprint = {2609.11404},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11404}
}

@misc{wu2026from,
  title = {{From Intent to Execution Grant: An Execution-Boundary Conformance Profile for High-Risk AI Actions}},
  author = {Mengting Wu and Lin Wang and Yong Zhang and Jiang Deng},
  year = {2026},
  month = sep,
  eprint = {2609.11596},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11596}
}

@misc{wen2026specguard,
  title = {{SpecGuard: Inference-Time Backdoor Detection For Free}},
  author = {Rui Wen and Ahmed Salem and Andrew Paverd and Mark Russinovich and Zheng Li},
  year = {2026},
  month = sep,
  eprint = {2609.11799},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11799}
}

@misc{boboila2026bluestar,
  title = {{BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense}},
  author = {Simona Boboila and Xavier Cadet and Edward Koh and Daniel Balasubramanian and Dirk Van Bruggen and Peter Chin and Alina Oprea},
  year = {2026},
  month = sep,
  eprint = {2609.11852},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11852}
}

@misc{yang2026who,
  title = {{Who Judges the Judges? A Chinese Safety QA Benchmark for Evaluating LLM Responses and Safety Judges}},
  author = {Rui Yang and Shuang Huang and Junhua Liu and Ziqi Zhao and Qingzhong Yan and Yuhang Sun and Cong Liu and Guoping Hu and Rui Mei and Jing Shao},
  year = {2026},
  month = sep,
  eprint = {2609.01210},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01210}
}

@misc{fan2026opensource,
  title = {{An Open-Source End-to-End FHE Implementation for Privacy-Preserving Llama 3 8B Inference}},
  author = {Yuhang Fan and Yusi Chen and Kanyu Ye and Zhuoran Ji},
  year = {2026},
  month = sep,
  eprint = {2609.12378},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12378}
}

@misc{zheng2026piabench,
  title = {{PIA-Bench: Towards Automated Privacy Impact Assessment with Large Language Models}},
  author = {Jiamin Zheng and Hao-Ping Lee and Luo Mai and Jingjie Li},
  year = {2026},
  month = sep,
  eprint = {2609.12571},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12571}
}

@misc{ardebili2026novafabric,
  title = {{NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs}},
  author = {Mohsen Seyedkazemi Ardebili},
  year = {2026},
  month = sep,
  eprint = {2609.12582},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12582}
}

@misc{nordio2026evaluating,
  title = {{Evaluating Context Segmentation in Locally Deployable SLMs for Cybersecurity CTF Tasks}},
  author = {Sebastiano Nordio and Michele Lotto},
  year = {2026},
  month = sep,
  eprint = {2609.12839},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12839}
}

@misc{tamim2026forging,
  title = {{Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery}},
  author = {Saifur Rahman Tamim and Md Taslimul Hasan Toufique and A. M. Tayeful Islam},
  year = {2026},
  month = sep,
  eprint = {2609.12909},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12909}
}

@misc{fogel2026badengram,
  title = {{BadEngram: Backdoor Attack on Gated Memory Components in LLMs}},
  author = {Ariel Fogel and Omer Hofman and Eilon Cohen and Roman Vainshtein},
  year = {2026},
  month = sep,
  eprint = {2609.13478},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13478}
}

@misc{atif2026threeaxis,
  title = {{A Three-Axis Stress Test of LLM vs Classical ML for Network Intrusion Detection under Distribution Shift and Adversarial Evasion}},
  author = {Muhammad Ebad Atif and Muhammad Haider Ali},
  year = {2026},
  month = sep,
  eprint = {2609.13511},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13511}
}

@misc{kaushik2026exploring,
  title = {{Exploring Automated Vulnerability Identification in JavaScript Code Using Large Language Models}},
  author = {Manit Kaushik and Ishir Bhardwaj and Pranav Gupta and Pankaj Jalote and Arun Balaji Buduru},
  year = {2026},
  month = sep,
  eprint = {2609.13816},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13816}
}

@misc{cen2026primobibench,
  title = {{PriMobiBench: Characterizing Visual Privacy Leakage in VLM-Driven Mobile GUI Agents}},
  author = {Qihang Cen and Tianshuo Cong and Da Song and Xinlei He and Jiaxing Song and Ke Xu and Qi Li},
  year = {2026},
  month = sep,
  eprint = {2609.13873},
  archivePrefix = {arXiv},
  doi = {10.1145/3830454.3846776},
  url = {https://arxiv.org/abs/2609.13873}
}

@misc{huang2026whenb,
  title = {{When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents}},
  author = {Shuhuai Huang and Jingfeng Zhang and Hong Jia},
  year = {2026},
  month = sep,
  eprint = {2609.13889},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13889}
}

@misc{chu2026fromb,
  title = {{From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling}},
  author = {Kuan-Lin Chu and Chung-En Sun and Tsui-Wei Weng},
  year = {2026},
  month = sep,
  eprint = {2609.00051},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00051}
}

@misc{gozel2026commitfirst,
  title = {{Commit-first LLM judging inherits the judge's own errors}},
  author = {Idil Gozel},
  year = {2026},
  month = sep,
  eprint = {2609.00088},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00088}
}

@misc{ma2026assessing,
  title = {{Assessing Suicide Risk in Arabic Crisis Helpline Calls: A Comparison of Arabic and English Large Language Models}},
  author = {Linhai Ma and Rita El Hachem and Mahatab El Hajj and Lilian Ghandour and Samah Fodeh},
  year = {2026},
  month = sep,
  eprint = {2609.00191},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00191}
}

@misc{haselhorst2026detecting,
  title = {{Detecting Hidden Behaviors in LLMs via Activation-matched Finetuning}},
  author = {Robin Haselhorst and Lucie Flek and Florian Mai},
  year = {2026},
  month = sep,
  eprint = {2609.00351},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00351}
}

@misc{song2026dr,
  title = {{Dr. Claw: An AI Scientist Workspace for Vibe Research}},
  author = {Dingjie Song and Hanrong Zhang and Dawei Liu and Yixin Liu and Zongxia Li and Zhengqing Yuan and Siqi Zhang and Henry Peng Zou and Zhiling Yan and Yuxuan Zhang and Yanfang Ye and Philip S. Yu and Lichao Sun},
  year = {2026},
  month = sep,
  eprint = {2609.00365},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00365}
}

@misc{wang2026beyond,
  title = {{Beyond Token Positions: Safety Alignment Across Denoising Steps in Diffusion Language Models}},
  author = {Guoli Wang and Haonan Shi and Tu Ouyang and An Wang},
  year = {2026},
  month = sep,
  eprint = {2609.00495},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00495}
}

@misc{huynh2026consistency,
  title = {{Consistency Without Alignment: Item-Sensitive Language Models Indistinguishable From Random}},
  author = {Cris Huynh},
  year = {2026},
  month = sep,
  eprint = {2609.00576},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00576}
}

@misc{kim2026confess,
  title = {{Confess What You Know: Forget-Set Misalignment with Model Knowledge in LLM Unlearning}},
  author = {Miso Kim and Georu Lee and Seungwon Jeong and Woojin Lee},
  year = {2026},
  month = sep,
  eprint = {2609.00605},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00605}
}

@misc{jiang2026vibebench,
  title = {{VIBE-Bench: Evaluating Personalized Large Language Models When Profiles Don't Mean Preferences}},
  author = {Yiwen Jiang and Yang Deng and Stephanie Fong and Zimu Wang and Yaling Shen and Wei Feng and Hongxi Yang and Xiangyu Zhao and Zhongxing Xu and Deval Mehta and Xuelian Cheng and Zongyuan Ge},
  year = {2026},
  month = sep,
  eprint = {2609.00921},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00921}
}

@misc{ranaldi2026worldbench,
  title = {{WorldBench: Culturally Grounded Benchmark for Multilingual Agents}},
  author = {Leonardo Ranaldi and Sherrie Shen and Jushi Kai and Alexandra Birch},
  year = {2026},
  month = sep,
  eprint = {2609.01056},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01056}
}

@misc{wang2026clintracebench,
  title = {{ClinTraceBench: Source-Verifiable Longitudinal Clinical Reasoning over EHR-Derived Dialogues}},
  author = {Huimin Wang and Zhengyi Zhao and Yutian Zhao},
  year = {2026},
  month = sep,
  eprint = {2609.01111},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01111}
}

@misc{saeed2026llmpedia,
  title = {{LLMPEDIA: Browsing, Verifying, and Comparing the Parametric Encyclopedic Knowledge of LLMs}},
  author = {Muhammed Saeed and Simon Razniewski},
  year = {2026},
  month = sep,
  eprint = {2609.01182},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01182}
}

@misc{huang2026vertox,
  title = {{VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Models}},
  author = {Zhiqi Huang and Vivek Datla and Zhichao Xu and Puxuan Yu and Vivek Srikumar and Alfy Samuel},
  year = {2026},
  month = sep,
  eprint = {2609.01325},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01325}
}

@misc{stengeleskin2026glossogen,
  title = {{GlossoGen: Emergent Language in Complex Multi-Agent LLM Interactions}},
  author = {Elias Stengel-Eskin and Newton Sander and Carlos Bonetti and Sasha Boguraev and James Bowler and Hale Sirin and Simon Kirby},
  year = {2026},
  month = sep,
  eprint = {2609.01491},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01491}
}

@misc{li2026evaldetectbench,
  title = {{EvalDetectBench: A Benchmark for Measuring Evaluation Awareness in Frontier Language Models}},
  author = {Xinning Li and Kemunto Ochwang'i and Aryasomayajula Ram Bharadwaj and Alexandra Souly and Robert Kirk},
  year = {2026},
  month = sep,
  eprint = {2609.01611},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01611}
}

@misc{xiao2026breadth,
  title = {{Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search}},
  author = {Shiliang Xiao and Jingsong Wei and Yuzhi Liang and Yufan Zheng and Xia Li and Qiliang Lin},
  year = {2026},
  month = sep,
  eprint = {2609.02172},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02172}
}

@misc{chen2026before,
  title = {{Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreaking}},
  author = {Siyu Chen and Haoran Wang and Xiaojian Li and Yao Huang and Yinpeng Dong and Wei Xu},
  year = {2026},
  month = sep,
  eprint = {2609.02414},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02414}
}

@misc{sudheendra2026pragalign,
  title = {{PragAlign: Feedback-Guided Pragmatic Alignment for Controlled Synthetic Dialogue Generation}},
  author = {Smitha Muthya Sudheendra and Jaideep Srivastava},
  year = {2026},
  month = sep,
  eprint = {2609.02480},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02480}
}

@misc{xiao2026contamination,
  title = {{Contamination Inflates Scores but Rarely Reorders Large Language Model Leaderboards}},
  author = {Xingyao Xiao and Yihong Cheng},
  year = {2026},
  month = sep,
  eprint = {2609.02899},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02899}
}

@misc{jin2026remember,
  title = {{Remember and Reweight: Enhancing Multi-Agent Debate with Experience Memory and Confidence Estimation}},
  author = {Xuanfa Jin and Zhijian Ma and Yongcheng Zeng and Xinyu Cui and Haifeng Zhang and Jun Wang},
  year = {2026},
  month = sep,
  eprint = {2609.03619},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03619}
}

@misc{nguyen2026beyond,
  title = {{Beyond Shallow Alignment: How Post-Training Methods Determine Refusal Circuits And Steering Robustness}},
  author = {Hoang Cuong Nguyen and Mark Dras and Usman Naseem},
  year = {2026},
  month = sep,
  eprint = {2609.03887},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03887}
}

@misc{li2026representational,
  title = {{Representational alignment yields generalizable safety in language models}},
  author = {Lingyu Li and Yan Teng and Yingchun Wang and Xia Hu},
  year = {2026},
  month = sep,
  eprint = {2609.04022},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04022}
}

@misc{lopezavila2026safety,
  title = {{Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal}},
  author = {Alejo López-Ávila and Iker García-Ferrero and Jezabel Garcia and Antonio Tiene and Román Orús},
  year = {2026},
  month = sep,
  eprint = {2609.04482},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04482}
}

@misc{kim2026knowing,
  title = {{Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models}},
  author = {Minji Kim and Jihyoung Jang and Hyounghun Kim},
  year = {2026},
  month = sep,
  eprint = {2609.04720},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04720}
}

@misc{bellibatlu2026counterfactual,
  title = {{Counterfactual Fairness Audits of Multi-Step Clinical LLM Agents Require a Measured Per-Action Instability Floor}},
  author = {Rohith Reddy Bellibatlu and Manpreet Singh and Deepak Parashar and Rahul Joshi},
  year = {2026},
  month = sep,
  eprint = {2609.03221},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03221}
}

@misc{bouger2026influence,
  title = {{Influence Score and Transformers interpretability: Measure of the Effective Impact of Attention Heads at inference time}},
  author = {Lisa Bouger and Yannick Teglia and Philippe Loubet Moundi},
  year = {2026},
  month = sep,
  eprint = {2609.05074},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05074}
}

@misc{twagirayezu2026reasoningaware,
  title = {{Reasoning-Aware Compression: Identifying and Protecting Vulnerable Reasoning Circuits for Energy-Efficient LLM Deployment}},
  author = {Leonard Twagirayezu and Prasenjit Mitra},
  year = {2026},
  month = sep,
  eprint = {2609.05512},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05512}
}

@misc{johnson2026when,
  title = {{When Agent Governance Helps}},
  author = {Michael Ray Johnson and Linda Naimi},
  year = {2026},
  month = sep,
  eprint = {2609.05531},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05531}
}

@misc{wang2026sinoglyphbench,
  title = {{SinoGlyphBench: A Diagnostic Benchmark for Chinese Glyph-Level Obfuscation in Language-Model Moderation}},
  author = {Yifan Wang and Zimu Wang and Suliu Qin and Changyu Zeng and Tong Chen and Siqi Chen and Yijie Lin and Lingyu Jiang and Jionglong Su and Yushan Pan and Haiyang Zhang and Wei Wang and Qiaoyu Tan},
  year = {2026},
  month = sep,
  eprint = {2609.05843},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05843}
}

@misc{lai2026aligndiff,
  title = {{AlignDiff: Exploiting Model-Intrinsic Information for Better Preference Data Selection}},
  author = {Peng Lai and He Zhu and Zhiwen Ruan and Dongdong Zhang and Yun Chen and Peng Li and Furu Wei and Yang Liu and Guanhua Chen},
  year = {2026},
  month = sep,
  eprint = {2609.05899},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05899}
}

@misc{cao2026from,
  title = {{From Narrative to Auditable Forecasts: A Structured Scaffold for Agentic Forecasting}},
  author = {Yuanpu Cao and Yongkang Du and Yurui Chang and Lu Lin and Jinghui Chen},
  year = {2026},
  month = sep,
  eprint = {2609.05905},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05905}
}

@misc{shao2026beyond,
  title = {{Beyond Cross-Lingual Transfer: Benchmarking Propagation Boundaries in Multilingual LLM Unlearning}},
  author = {Pengyang Shao and Chuanpeng Lu and Wei Qin and Yanzheng Jin and Xiaohao Liu and {Xi Ai} and Kenji Kawaguchi and Richang Hong},
  year = {2026},
  month = sep,
  eprint = {2609.05976},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05976}
}

@misc{alam2026what,
  title = {{What the Window Does Not Contain: Auditing Provenance in a Document-Grounded Instability Benchmark}},
  author = {Seyed Mosayeb Alam},
  year = {2026},
  month = sep,
  eprint = {2609.06147},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06147}
}

@misc{abootorabi2026steering,
  title = {{Steering Geometry: Validating Human Value Geometry in LLM Steering Space}},
  author = {Mohammad Mahdi Abootorabi and Armin Saghafian and Ali Bazshoushtari and Hamid Rezaei and EunJeong Hwang and Vered Shwartz and Parvin Mousavi and Purang Abolmaesumi},
  year = {2026},
  month = sep,
  eprint = {2609.06289},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06289}
}

@misc{bommireddy2026building,
  title = {{Building Trustworthy Graph-Agentic RAG for Social Good: Architectures, Failure Propagation, and Assurance by Construction}},
  author = {Vijay Bommireddy and Raviteja Bommireddy},
  year = {2026},
  month = sep,
  eprint = {2609.06391},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06391}
}

@misc{raghav2026unified,
  title = {{A Unified Policy Architecture (UPA): The Governance Kernel for Enterprise AI Operating Systems}},
  author = {Prabhu Raghav and Balamurugan Pandi and Arul Vivek and Shek Mohammed and Sridhar S},
  year = {2026},
  month = sep,
  eprint = {2609.06543},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06543}
}

@misc{chakraborty2026typed,
  title = {{Typed Federated Artifacts for the Agentic Web:Sharing Tool-Routing Knowledge Across Frozen,Heterogeneous LLM Agents}},
  author = {Abhijit Chakraborty and Ni Trieu and Vivek Gupta},
  year = {2026},
  month = sep,
  eprint = {2609.06815},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06815}
}

@misc{wang2026emerging,
  title = {{The Emerging AI Paper-Review Arms Race: Adversarial Co-Evolution in Scholarly Publishing}},
  author = {Chenguang Wang and Ming Li and Adebayo Braimah and Chenrui Fan and Tuo Wang and Weijie Guan and Ruiyi Zhang and Tianyi Zhou and Dawei Zhou},
  year = {2026},
  month = sep,
  eprint = {2609.07713},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07713}
}

@misc{antoun2026llm,
  title = {{LLM Forensics: Where Do Backdoors Hide? Localizing and Controlling Trigger Mechanisms with Sparse Autoencoders}},
  author = {Wissam Antoun and Francis Kulumba and Théo Lasnier and Benoît Sagot and Djamé Seddah},
  year = {2026},
  month = sep,
  eprint = {2609.07746},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07746}
}

@misc{li2026safire,
  title = {{SAFIRE: Safety-Critical Benchmark for Fine-grained Fire and Smoke Understanding in Multimodal LLMs}},
  author = {Pengfei Li and Naufal Suryanto and Sicheng Zhang and Mohammad Alsharid and Muzammal Naseer},
  year = {2026},
  month = sep,
  eprint = {2609.07823},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07823}
}

@misc{ruan2026schemearena,
  title = {{SchemeArena: Factorized Stress Testing of Scheming in LLM Agents}},
  author = {Jie Ruan and Inderjeet Nair and Amy Liu and Muhammad Khalifa and Yusheng Zhou and Lu Wang},
  year = {2026},
  month = sep,
  eprint = {2609.08126},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08126}
}

@misc{fu2026segos,
  title = {{SE-GoS: Self-Evolving Graph-of-Skills for Skill Library at Scale}},
  author = {Dawei Fu and Cheng Jiang and Sitian Qian and Huainan Wang and Zhongkai Hao},
  year = {2026},
  month = sep,
  eprint = {2609.08228},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08228}
}

@misc{kang2026compositional,
  title = {{Compositional Multilingual and Behavioral Attribute Steering}},
  author = {Hyun Gu Kang and Daniil Gurgurov and Tanja Baeumel and Josef van Genabith and Simon Ostermann},
  year = {2026},
  month = sep,
  eprint = {2609.08410},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08410}
}

@misc{gao2026plannerforge,
  title = {{PlannerForge: LLM Agents for Scenario-Based Testing of Motion Planners in Autonomous Driving}},
  author = {Yuan Gao and Sebastian Müller and Mattia Piccinini and Marc Kaufeld and Yuchen Zhang and Finn Rasmus Schäfer and Qunying Song and Johannes Betz},
  year = {2026},
  month = sep,
  eprint = {2609.08965},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08965}
}

@misc{vohra2026audit,
  title = {{The Audit Decides the Verdict: Instrument Effects Rival Demographic Bias in LLM Decision Audits}},
  author = {Siddharth Vohra and Manikandan Ravikiran},
  year = {2026},
  month = sep,
  eprint = {2609.09048},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09048}
}

@misc{marzo2026copying,
  title = {{Copying explains the collective behavior of AI agents in the wild}},
  author = {Giordano De Marzo and Nicola Alboré and David Garcia},
  year = {2026},
  month = sep,
  eprint = {2609.09150},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09150}
}

@misc{wu2026when,
  title = {{When Does Defendant Statement Matter? A Study of Bias and Persuasion in LLM-Simulated Jurors}},
  author = {Cho-Ying Wu},
  year = {2026},
  month = sep,
  eprint = {2609.09887},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09887}
}

@misc{hendriks2026metrollmbench,
  title = {{MetroLLM-Bench: Evaluating Language Models as Transit Kiosk Runtimes}},
  author = {Remco Hendriks},
  year = {2026},
  month = sep,
  eprint = {2609.10016},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10016}
}

@misc{stenstrom2026ibib,
  title = {{IBIB: A Protocol for Measuring Enterprise AI Systems by Serving Route, Not Model Identifier}},
  author = {Blake Stenstrom and Charangan Vasantharajan and Brian Sathianathan},
  year = {2026},
  month = sep,
  eprint = {2609.10494},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10494}
}

@misc{deuer2026impact,
  title = {{On the Impact of Anonymization on the Performance of Large Language Models}},
  author = {Tobias Deußer and Max Hahnbück and Lorenz Sparrenberg and Tobias Uelwer and Christian Bauckhage and Rafet Sifa},
  year = {2026},
  month = sep,
  eprint = {2609.11335},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11335}
}

@misc{luque2026componentaware,
  title = {{Component-Aware Differential Privacy for Federated Multilingual Speech-LLMs}},
  author = {Jordi Luque and Fernando López and Aleix Sant},
  year = {2026},
  month = sep,
  eprint = {2609.11762},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11762}
}

@misc{tareaf2026target,
  title = {{Target leakage, not model class, explains reported accuracy in survey-based cardiovascular screening: a leakage-tiered audit of glass-box and tabular foundation models}},
  author = {Raad Bin Tareaf and Murad Al-Rajab and Samia Loucif and Samer Ellaham and Cedric Schmitz},
  year = {2026},
  month = sep,
  eprint = {2609.11838},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11838}
}

@misc{geng2026from,
  title = {{From Scores to Evidence: Auditable Decisions Can Improve Speech Deepfake Detection}},
  author = {Mengzhe Geng and Yujia Lu and Patrick Littell and Manuela Kunz and Xie Chen},
  year = {2026},
  month = sep,
  eprint = {2609.08899},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08899}
}

@misc{tan2026saescientistbench,
  title = {{SAEScientist-Bench: Can AI Agents Conduct Autonomous SAE Interpretability Research?}},
  author = {Yuqiao Tan and Shizhu He and Jun Zhao and Kang Liu},
  year = {2026},
  month = sep,
  eprint = {2609.09113},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09113}
}

@misc{paquin2026what,
  title = {{What Does MMLU Actually Measure? A Psychometric Audit of Difficulty Structure in Aggregate Benchmark Scores}},
  author = {Dana Paquin and Riddhiman Jain},
  year = {2026},
  month = sep,
  eprint = {2609.09372},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09372}
}

@misc{parekh2026when,
  title = {{When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination}},
  author = {Karan Parekh and Sanjana Pendyala Ravinder and Sana Mhapsekar and Medina Maloku},
  year = {2026},
  month = sep,
  eprint = {2609.09696},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09696}
}

@misc{zabaleta2026prismallm,
  title = {{PRISMA-LLM: An Empirical Reporting Framework for AI-Assisted Systematic Reviews}},
  author = {Miguel Zabaleta and Baihan Lin},
  year = {2026},
  month = sep,
  eprint = {2609.11559},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11559}
}

@misc{namjoo2026judging,
  title = {{Judging by the Cover: Cleaning LLM Truthfulness Benchmarks to Avoid Surface-Level Feature Leakage}},
  author = {Foad Namjoo and Remy Ogasawara and Amirali Abdullah and Cullen Anderson and Narmeen Fatimah Oozeer and Jeff M. Phillips},
  year = {2026},
  month = sep,
  eprint = {2609.13003},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13003}
}

@misc{liu2026machine,
  title = {{Machine Unlearning for Speech Question Answering in Large Audio-Language Models}},
  author = {Zhe Liu},
  year = {2026},
  month = sep,
  eprint = {2609.13195},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13195}
}

@misc{yang2026generative,
  title = {{Generative Interpretability via Scalable Neuro-Symbolic Models}},
  author = {Xiaocong Yang},
  year = {2026},
  month = sep,
  eprint = {2609.13529},
  archivePrefix = {arXiv},
  doi = {10.1145/3806096.3844850},
  url = {https://arxiv.org/abs/2609.13529}
}

@misc{campbell2026efficient,
  title = {{An Efficient and Modular Framework for Targeted Harm Mitigation in LLMS}},
  author = {Roberto Campbell and Momin Abbass and Muneeza Azmat and Michal Ulewicz and Raya Horesh and Kristjan Greenewald and Rogério Abreu de Paula and Nathalie Baracaldo},
  year = {2026},
  month = sep,
  eprint = {2609.13624},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13624}
}

@misc{bei2026policymem,
  title = {{PolicyMem: Geometric Policy Memory for LLM Governance}},
  author = {Yuanchen Bei and Zhengzhang Chen and Yanjun Zhao and Haoyu Wang and Hanghang Tong and Haifeng Chen},
  year = {2026},
  month = sep,
  eprint = {2609.13734},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13734}
}

@misc{wang2026foresight,
  title = {{ForeSight: Enhancing Risk Monitoring via Early Safety Signal Distillation}},
  author = {Hanling Wang and Chenlong Wei and Ling Xu and Hanyan Niu and Qi Cao and Shizhou Huang and Yang Yang and Xiaohui Zhu and Yao Zhu},
  year = {2026},
  month = sep,
  eprint = {2609.13737},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13737}
}

@inproceedings{chen2026llms,
  title = {{LLMs Leak Training Data Beyond Verbatim Memorization: Extraction via Membership Decoding}},
  author = {Zi-Tai Chen and Reza Shokri},
  year = {2026},
  month = oct,
  booktitle = {Proceedings on Privacy Enhancing Technologies},
  doi = {10.56553/popets-2026-0139},
  url = {https://www.semanticscholar.org/paper/c52e919714f66688c0620093ff6b9898bd00edc9}
}

@article{liu2026delayed,
  title = {{Delayed Backdoor: Let the Trigger Fly for a While in Backdoor Attack on Internet of Things}},
  author = {Bo Liu and Pei-Wen Zhu and Shao-Feng Zhao and Xiang Chen and Hao-Jie Huang and Li-Ling Shi and Xiao-Kang Wang and Zhi-Gao Zheng and Laurence T. Yang},
  year = {2026},
  month = sep,
  journal = {IEEE Internet of Things Journal},
  doi = {10.1109/JIOT.2026.3686078},
  url = {https://www.semanticscholar.org/paper/b550cd95248dfd0d0c4a44b015958170793ffbb5}
}

@misc{moon2026trippattern,
  title = {{TripPattern: A Pattern-based Text Watermarking Method for Large Language Models}},
  author = {Sang-Jun Moon and Dasom Choi and Jingun Kwon and Hidetaka Kamigaito and Taro Watanabe and Manabu Okumura},
  year = {2026},
  month = sep,
  eprint = {2609.12472},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d7035dd21e2547207c23fec06a3b22bf29586847}
}

@misc{mia2026sok,
  title = {{SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration}},
  author = {Md. Jueal Mia and Yanzhao Wu and S. Uluagac and M. Amini},
  year = {2026},
  month = sep,
  eprint = {2609.12413},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/1664c9b5d52fbb43aa9582e97dc73096e344adc0}
}

@inproceedings{zhakhalov2026framework,
  title = {{A framework for efficient and secure LLM agency: a case for the GraphQL paradigm}},
  author = {Viktor Zhakhalov},
  year = {2026},
  month = sep,
  booktitle = {CEUR Workshop Proceedings, Vol-4260: Proceedings of the 8th Workshop for Young Scientists in Computer Science \& Software Engineering (CS\&SE@SW 2025)},
  doi = {10.55056/cssesw2025/paper07},
  url = {https://www.semanticscholar.org/paper/f770e3ceaac6d17508b01151897bfcaaecc595f7}
}

@article{fatouros2026llmbased,
  title = {{LLM-Based Agents for Cybersecurity: A Systematic Review of Architectures, Applications, and Open Challenges}},
  author = {George Fatouros and Konstantinos Mavrogiorgos and Georgios Makridis and J. Soldatos and D. Kyriazis},
  year = {2026},
  month = sep,
  journal = {Journal of Cybersecurity and Privacy},
  doi = {10.3390/jcp6050159},
  url = {https://www.semanticscholar.org/paper/f0888a645148559fc788a0efb5a1c3f4cfd99d92}
}

@misc{kumar2026blackbox,
  title = {{Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery}},
  author = {Divyanshu Kumar and Nitin Aravind Birur and Tanay Baswa and Sahil Agarwal and P. Harshangi},
  year = {2026},
  month = sep,
  eprint = {2609.09647},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/cf0bc84d59f2f81ec5aa3534b5933d67a80205ec}
}

@misc{zhao2026keep,
  title = {{Keep Evaluation Fair: Detecting Data Leakage in Code Generation Benchmarks via Membership Inference Attacks}},
  author = {Dong-Dong Zhao and Jian Chen and Guan-Cheng Lin and Jianwen Xiang and J. Keung and Xiao Yu},
  year = {2026},
  month = sep,
  eprint = {2609.09865},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/b35edac8aca5fbcd8a42b330512e3a64fd1214cc}
}

@article{yanez2026hiveai,
  title = {{Hive-AI: a defended multi-service honeypot framework for generative AI APIs}},
  author = {Sebastián Vargas Yáñez and Sergio Tobón},
  year = {2026},
  month = sep,
  journal = {International Journal of Information Security},
  doi = {10.1007/s10207-026-01307-0},
  url = {https://www.semanticscholar.org/paper/33566699ae6da88b8b15e737037575861d87045c}
}

@misc{cherednichenko2026suan,
  title = {{Suan: Rectifying Direct Preference Safety Alignment in Large Language Models}},
  author = {O. Cherednichenko and Roman Klypa},
  year = {2026},
  month = sep,
  eprint = {2609.08634},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/98dc74badd21f918c2759ca4f4b2e24562dd61bb}
}

@misc{zhou2026style,
  title = {{Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts}},
  author = {Yongxin Zhou and Wen-Bo Ye and Yuan-Zhe Liu and Zi-Han Dong and Jun-Wei Yao},
  year = {2026},
  month = sep,
  eprint = {2609.08236},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8e0549af7045be84295807494a4df1d11e45b6a8}
}

@article{mekala2026integrating,
  title = {{Integrating LLMs into IoT-Driven Smart Healthcare Systems: A Systematic Literature Review and Future Agenda}},
  author = {P. Mekala and Yonas Kassa and Sushma Mishra},
  year = {2026},
  month = sep,
  journal = {IoT},
  doi = {10.3390/iot7030075},
  url = {https://www.semanticscholar.org/paper/88e0ea4c56181cfe5e665a70ed7622d3f2d347e5}
}

@article{wang2026egpdefense,
  title = {{EGP-Defense: Enhancing Adversarial Robustness of LVLMs via Training-Free Edge-Guided Prompting}},
  author = {Bo-Yu Wang and Zi-Wen He and Xin-Jue Hu and Chi Wang and Zi-Qiang Li and Zhang-Jie Fu},
  year = {2026},
  month = sep,
  journal = {ACM Transactions on Multimedia Computing, Communications, and Applications (TOMCCAP)},
  doi = {10.1145/3845608},
  url = {https://www.semanticscholar.org/paper/1791b7fdd331177fbea7a13c7100d82d38bbc632}
}

@misc{liu2026crack,
  title = {{CrACK: Adversarial Attacks on Cross-Model Consistency in Collaborative Vision Foundation Models}},
  author = {Fei-Fei Liu and Jintao Cheng and Chi-Man Vong and Xiaoyu Tang},
  year = {2026},
  month = sep,
  eprint = {2609.07499},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/c6f9d684d9b92f5baf1af32a027c1320fb953039}
}

@article{vishwanath2026adversarial,
  title = {{Adversarial Robustness of Foundation Models for Intelligent Mechanical Systems: Threat Models, Benchmarks, and Defense Stacks}},
  author = {Vishwanath},
  year = {2026},
  month = sep,
  journal = {International Journal For Multidisciplinary Research},
  doi = {10.36948/ijfmr.2026.v08i05.87343},
  url = {https://www.semanticscholar.org/paper/a7e2035a91824e166f5709ad33a6804ac0407df0}
}

@article{zhao2026gamark,
  title = {{Gamark: adaptive entropy-threshold watermarking via gaussian mixture modeling for large language models}},
  author = {Jing Zhao and Hong-Wei Yang and Heng-Ji Dong and Hui He and Wei-Zhe Zhang},
  year = {2026},
  month = sep,
  journal = {Cybersecurity},
  doi = {10.1186/s42400-026-00607-1},
  url = {https://www.semanticscholar.org/paper/745bb40ffc9b6659100956d864c90751dc31e01a}
}

@misc{malla2026geometry,
  title = {{The Geometry of Refusal: Why Post-Hoc Safety Is Fragile and Pretraining-Time Safety Persists}},
  author = {Srikanth Malla and Chiho Choi and Joon Choi},
  year = {2026},
  month = sep,
  eprint = {2609.06934},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/6db11455cdf61ce01b1e966dcdd60768ac4e03d4}
}

@article{prasad2026dynamic,
  title = {{Toward Dynamic and Risk-Aware Evaluation of Cybersecurity LLMs: A Survey and the RIRAG Framework}},
  author = {Ravi Prasad and Feroz Ahmed and Shohel Rana and Charan Gudla and Sujan Kumar Reddy Challa and Aditya Garg},
  year = {2026},
  month = sep,
  journal = {Journal of Cybersecurity, Digital Forensics and Jurisprudence},
  doi = {10.65879/3070-5789.2026.02.05},
  url = {https://www.semanticscholar.org/paper/6d91d3a37230c466cdddb9be0f848f971d28b224}
}

@misc{liu2026what,
  title = {{What a Model Refuses, a State Fears: How Authoritarian Information Control Reproduces in Language-Model Guardrails}},
  author = {Meng-Lin Liu and Yao Yu and Tong Wu and Chun-Ran Zhang and Ge Shi},
  year = {2026},
  month = sep,
  eprint = {2609.07507},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/475fe2ba2121de45c572735d75d9efa667deaa30}
}

@misc{prodhan2026freqdoor,
  title = {{FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Models}},
  author = {Yasir Arafat Prodhan and Sadad Hasan and Mohammed Imamul Hassan Bhuiyan},
  year = {2026},
  month = sep,
  eprint = {2609.07048},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/15ae338e8edb475cce1e45bcd3eabb628cbf098a}
}

@article{kim2026ares,
  title = {{ARES: Securing Agents for Computer Use Through Endpoint Resource Mediation and Behavioral Guardrails}},
  author = {Changhee Kim and Seong-je Cho},
  year = {2026},
  month = sep,
  journal = {Electronics},
  doi = {10.3390/electronics15174007},
  url = {https://www.semanticscholar.org/paper/fd1a22d2baba2df7a0db52925828232b7a69ebb0}
}

@article{farfoura2026doubleedged,
  title = {{The Double-Edged Sword of AI Pair Programmers: A Systematic Literature Review of Security Vulnerabilities in AI-Generated Code and Agentic Development Environments}},
  author = {Mahmoud E. Farfoura and M. Alia and Ibrahim Mashal and Adnan A. Hnaif and M. Odeh},
  year = {2026},
  month = sep,
  journal = {Journal of Sustainable Smart Systems in Education \& Environment},
  doi = {10.66823/2egmd793},
  url = {https://www.semanticscholar.org/paper/f68e78d6c07988ee249898866e6cf165d2adb5a5}
}

@misc{10a2026uncensored,
  title = {{Uncensored Open-weight Models: Redistribution as the Persistence Layer}},
  author = {{10a Labs Juliette Garcia} and Hailey May and Bobby McKenzie and David Pham and Matthew Swain and J. Valdez and Corie Wieland and Zachary Yahn},
  year = {2026},
  month = sep,
  eprint = {2609.05241},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/02e6517263f5bd037bfd4496436facd52b816d53}
}

@misc{wahi2026llmasajudge,
  title = {{LLM-as-a-Judge Is Not an Oracle: Why Self-Improving Agents Need Deterministic Guardrails}},
  author = {Vansh Wahi},
  year = {2026},
  month = sep,
  eprint = {2609.02246},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d9bca7473eb20a165dd64c8710affd0e7263fdc6}
}

@misc{xiao2026who,
  title = {{Who Drives the Probability Game of VLMs? A Temporal Causal Drive Evaluation Framework}},
  author = {Shu-Yao Xiao and Sheng-Ling Wang and Hao-Yu Niu and Ke Chao and Changbo Xu and Xin-Ran Duan and Chao-Yong Jiang},
  year = {2026},
  month = sep,
  eprint = {2609.02000},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/c1f5686528f9fe5fd5b7db14e9d275a6a17ac9ab}
}

@article{kilim2026leakageaware,
  title = {{Leakage-Aware Cross-Dataset Evaluation of Prompt Injection Detection Using Classical Machine Learning and Transformer Models}},
  author = {Oğuzhan Kilim},
  year = {2026},
  month = sep,
  journal = {Yalvaç akademi dergisi},
  doi = {10.57120/yalvac.2001116},
  url = {https://www.semanticscholar.org/paper/9927bbc6c11def4346dc8112ca690825efde1f06}
}

@misc{hossain2026capture,
  title = {{CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents}},
  author = {Asif Hossain and Ruksat Khan and Shayoni and Kishor Morol},
  year = {2026},
  month = sep,
  eprint = {2609.02265},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/6c2ef186b5091367d9c2667d2f3013a2b6f79ab7}
}

@misc{hu2026infrapatch,
  title = {{InfraPatch: Cross-Task Targeted Grayscale Patch Attacks on Infrared-Adapted Vision-Language Models}},
  author = {Chengyin Hu and Ding-Yi Lu and Jiajun Han and Xiang Chen and Weiwen Shi and Jiahuan Long and Yiwei Wei and Jiu-Jiang Guo},
  year = {2026},
  month = sep,
  eprint = {2609.02233},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/286d27171af8b29fb92ec42d28ea825cb62a78eb}
}

@misc{lee2026beyond,
  title = {{Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrails}},
  author = {Suyoung Lee and Myungsub Choi},
  year = {2026},
  month = sep,
  eprint = {2609.05535},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/1777bccb47960930d9560230d9b519fed1ab95ca}
}

@article{yang2026shadowcode,
  title = {{ShadowCode: Toward (Automatic) External Prompt Injection Attack Against Code LLMs}},
  author = {Yuchen Yang and Yi-Ming Li and H. Yao and Bing-Run Yang and Yiling He and Tianwei Zhang and Dacheng Tao and Z. Qin},
  year = {2026},
  month = sep,
  journal = {IEEE Transactions on Dependable and Secure Computing},
  doi = {10.1109/TDSC.2026.3703498},
  url = {https://www.semanticscholar.org/paper/f7d0fe61df3d82faa00b5379d47ee364d85f4d2a}
}

@article{meng2026adversarial,
  title = {{The adversarial game between detection and evasion: A survey of anti-detection techniques for machine-generated texts.}},
  author = {De-Yu Meng and Tad Gonsalves},
  year = {2026},
  month = sep,
  journal = {Neural Networks},
  doi = {10.1016/j.neunet.2026.109562},
  url = {https://www.semanticscholar.org/paper/d918d543553f11905ebae1ae12cb2d221c5fb2e4}
}

@article{peng2026mpda,
  title = {{MPDA: Multimodal Prompt Decoupling Attack on the Safety Filters in Text-to-Image Models}},
  author = {Xingkai Peng and Jun Jiang and Meng Tong and Shuai Li and Weiming Zhang and Neng H. Yu and Kejiang Chen},
  year = {2026},
  month = sep,
  journal = {IEEE Transactions on Dependable and Secure Computing},
  doi = {10.1109/TDSC.2026.3696145},
  url = {https://www.semanticscholar.org/paper/d71b2075655a52c19b88c09dfa9c50250927ade5}
}

@article{laragutierrez2026genpot,
  title = {{GenPot: A generative honeypot architecture for adaptive web and API interaction}},
  author = {Antonio Lara-Gutierrez and Juan Zamorano and J. A. Onieva},
  year = {2026},
  month = sep,
  journal = {Applied intelligence (Boston)},
  doi = {10.1007/s10489-026-07442-4},
  url = {https://www.semanticscholar.org/paper/c8446206f0a9cba0979e0efba154610fd12b08a3}
}

@misc{zhu2026whenb,
  title = {{When Guardrails Look Effective: Construct Validity Failures in LLM Agent Commerce Evaluation}},
  author = {Pei-ke Zhu and Sidi Chang},
  year = {2026},
  month = sep,
  eprint = {2609.01519},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/96c5c7670b65dee1adc74eab2b024fb568032514}
}

@article{zhang2026beyond,
  title = {{Beyond Single-Pair Attacks: Disrupting Vision-Language Pre-Training Models With Dual-Semantic Frequency Stealth}},
  author = {Hai-Qi Zhang and Zi-Qiang Li and Hao Tang and Ze-Chao Li},
  year = {2026},
  month = sep,
  journal = {IEEE Transactions on Dependable and Secure Computing},
  doi = {10.1109/TDSC.2026.3713210},
  url = {https://www.semanticscholar.org/paper/94fb165ddf17a75721511d02381aa3da9e76fd1d}
}

@article{ren2026icgcg,
  title = {{IC-GCG: Jailbreaking Large Language Models via Intermediate Consistency Optimization}},
  author = {Zichu Ren and Donghai Zhu and Haibo Hong and Jun Shao},
  year = {2026},
  month = sep,
  journal = {IEEE Internet of Things Journal},
  doi = {10.1109/JIOT.2026.3707160},
  url = {https://www.semanticscholar.org/paper/7ecc8bf212ba04a3db3043938853af5bca5e6533}
}

@misc{song2026diva,
  title = {{DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models}},
  author = {Guo-Rui Song and Run-Qing Tang and Jing-Ye Zhang and Lu-Yuan Zhang and Fei Huang and Cong Ray and Guo-Cun Wang and Da-Ke Zhong and Choo Sin Wai and Bing-Quan Dai and Chu-Ming Wang and Tongxu Lin and Wan-Yu Guo and Haoqian Wang},
  year = {2026},
  month = sep,
  eprint = {2609.05525},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/75c7781c1563ea318cbc35ebef975200b441c40f}
}

@article{li2026tadsob,
  title = {{TADSOB: Enhancing jailbreaking attacks on LLMs via trajectory-aware dynamic suffix optimization with buffer}},
  author = {Xiao-Long Li and Mingrui Lao and Cheng-Si Du and Yun-Hao Feng and Xiao-Hu Du and Liang-Hu Bai and Yanming Guo},
  year = {2026},
  month = sep,
  journal = {Neurocomputing},
  doi = {10.1016/j.neucom.2026.135010},
  url = {https://www.semanticscholar.org/paper/6e9c31860f812832918a21d8f94acf00ab479ada}
}

@article{xue2026trustworthy,
  title = {{Trustworthy LLM–GNN systems: a systematic review and multi-axis taxonomy}},
  author = {Rui-Zhan Xue and Fang He and Hui-Min Deng and Mao-Jun Wang and Ze-Yu Zhang},
  year = {2026},
  month = sep,
  journal = {Applied intelligence (Boston)},
  doi = {10.1007/s10489-026-07458-w},
  url = {https://www.semanticscholar.org/paper/4192b731d75b4dc39b2f529666eabc66cf68b755}
}

@article{brobbey2026persist,
  title = {{PERSIST
 : Threat Modeling Memory‐Persistent
 AI
 Agents in Cloud‐to‐Edge Environments}},
  author = {Albert Adusei Brobbey and Narayan P. Bhosale},
  year = {2026},
  month = sep,
  journal = {Security and Privacy},
  doi = {10.1002/spy2.70248},
  url = {https://www.semanticscholar.org/paper/2b34f27f1c8e827f22f4e6d347c008446794b992}
}

@article{shi2026srd,
  title = {{SRD: A model-agnostic semantic framework for jailbreak mitigation in large language models}},
  author = {Can Shi and Zhi-Yong Zhang and Gaoyuan Quan and Junyang Pan and Xinxin Yue},
  year = {2026},
  month = sep,
  journal = {Knowledge-Based Systems},
  doi = {10.1016/j.knosys.2026.116560},
  url = {https://www.semanticscholar.org/paper/115084858292f9df35a27f2f2aa6e906a7587751}
}

@article{chen2026efficient,
  title = {{Efficient Prompt Security Detection for LLM Service Deployment in Edge-Cloud Networks}},
  author = {Wen-Jing Chen and Jie Cui and Wenjie Huang and Jing Zhang and Lu Wei and Geyong Min},
  year = {2026},
  month = sep,
  journal = {IEEE Transactions on Dependable and Secure Computing},
  doi = {10.1109/TDSC.2026.3709894},
  url = {https://www.semanticscholar.org/paper/084aed427d1488610dcf103935fe66ad361ee86d}
}

@misc{zang2026understanding,
  title = {{Understanding Stage-Wise Utility-Risk Trade-offs in LLM Agent Memory}},
  author = {Chuanchao Zang and Zi-Jian Cao and Xiangtao Meng and Jianing Wang and Wenyu Chen and Xinyu Gao and Li Wang and Zheng Li and Shanqing Guo},
  year = {2026},
  month = aug,
  eprint = {2608.30177},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d9a499f524390e5452dad9a4818c8988506c1a65}
}

@misc{singg2026singprobe,
  title = {{SingProbe Technical Report}},
  author = {{Singg Team}},
  year = {2026},
  month = aug,
  eprint = {2608.30703},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/b42aefcf52891422ad5d7a2d53a60611fe663afb}
}

@misc{li2026do,
  title = {{Do VLMs Share Safety Neurons Across Modalities?}},
  author = {Jia-Xuan Li and Jia-Hao Zhang and D. Vo and H. Nguyen and Pride Kavumba and Koki Wataoka},
  year = {2026},
  month = aug,
  eprint = {2608.30750},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8a8800ed3022d7532c7daf5782a597449f10b2b0}
}

@article{khan2026evaluating,
  title = {{Evaluating Indirect Prompt Injection Defenses in Tool-Using LLM Agents: Security, Utility, and Replication}},
  author = {Adil Khan and Khaled AlKhanbashi and Azza Mohamed},
  year = {2026},
  month = aug,
  journal = {Computers},
  doi = {10.3390/computers15090570},
  url = {https://www.semanticscholar.org/paper/857a1c7d30ff72cce69c0067e8c4daa739bf41f3}
}

@misc{kim2026evoskill,
  title = {{EvoSkill Injection: Red-Teaming Autonomous Skill Generation and Evolution in Self-Evolving Agents}},
  author = {Doyun Kim and Chanwoo Kim and Sugyeong Eo and Yeo-Chan Yoon and Chanjun Park},
  year = {2026},
  month = aug,
  eprint = {2608.30429},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/74b1d8292cfadce66a9d3467f4fcdd8246f7ba73}
}

@misc{chowdhury2026safety,
  title = {{The Safety Relay in Roleplay Jailbreaks: A Component-Resolved Causal Analysis of Harm Recognition and Refusal}},
  author = {M. Chowdhury and Ernie Chang and Yang Li},
  year = {2026},
  month = aug,
  eprint = {2608.30585},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/702d373e63d2c06fbb60a94f8ad67cab9be00732}
}

@misc{yang2026balancing,
  title = {{Balancing Privacy, Utility, and Safety in LLM Alignment through Preference Optimization}},
  author = {Di-Shu Yang and Jing-Jing Liu and Ji-Ze Li},
  year = {2026},
  month = aug,
  eprint = {2608.30141},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/242428093c491f916ba347c255fbd3ae086e8fb5}
}

@misc{wu2026validityaware,
  title = {{Validity-Aware Jailbreak Evaluation for Large Language Models}},
  author = {Qilong Wu and Sahil Wadhwa and Pranab Mohanty and Giri Iyengar and Varun Chandrasekaran},
  year = {2026},
  month = aug,
  eprint = {2609.00498},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/08abe34670f9011fc3ff59cbab6c6328b2480af4}
}

@misc{zhang2026semtrace,
  title = {{SemTrace: Source-Grounded Semantic Signatures for Tracing LLM Exposure to Protected Documents}},
  author = {Jun-Yan Zhang and Yuan Zeng and Yong-Wei Huang and Zu-Hao Ouyang and Hong Chen and Xuming Hu},
  year = {2026},
  month = aug,
  eprint = {2608.29575},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d864a78fe762e931a96efe5ea38bdf249372cacd}
}

@misc{xiong2026reachabilitybased,
  title = {{Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection}},
  author = {Wu-Jie Xiong and Rabimba Karanjai and Yang Lu and W. Shi and Lei Xu},
  year = {2026},
  month = aug,
  eprint = {2608.30041},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/ca9874d087d8df198b302c54402b0df91d19bbbc}
}

@misc{xiao2026tacs,
  title = {{TACS: Trajectory-Aware Candidate Selection for LLM Jailbreak Suffix Optimization}},
  author = {Shi-Liang Xiao},
  year = {2026},
  month = aug,
  eprint = {2608.29564},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/9f5d1542f077730ad7f968a1028ee7fc7cf9f544}
}

@misc{hirota2026guardrailagnostic,
  title = {{Guardrail-Agnostic Societal Bias Evaluation in Large Vision-Language Models}},
  author = {Yusuke Hirota and Michael Boone and Arun George Zachariah and J. Varghese and Y. Wang and Boyi Li and Ryo Hachiuma},
  year = {2026},
  month = aug,
  eprint = {2608.29590},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/22de4aaa0b81f2b475d9aa1ee401cc4f5c46172c}
}

@misc{liu2026learning,
  title = {{Learning to Follow In-Context Watermark Instructions via Self-Distillation}},
  author = {Yepeng Liu and Tian-Yi Chen and Xuandong Zhao and D. Song and Yuheng Bu},
  year = {2026},
  month = aug,
  eprint = {2608.29030},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/e86439f940d69ec0811550dec8e79a7b1d39a73e}
}

@misc{lintelo2026woe,
  title = {{WoE Wrote It? Watermarking Mixture-of-Experts LLMs for Black-Box Text Provenance}},
  author = {Jona te Lintelo and Lichao Wu and S. Picek},
  year = {2026},
  month = aug,
  eprint = {2608.29151},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/dbfae6a9f6cc8380ca06c4c8bf9f1b077a3bd3ba}
}

@misc{zhang2026auditing,
  title = {{Auditing and Mitigating Privacy Leakage in Cloud-Edge Collaborative Decoding}},
  author = {Ke-Jia Zhang and Tianyuan Zou and Zi-Xuan Gu and Yang Liu},
  year = {2026},
  month = aug,
  eprint = {2608.29111},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/96dedb871e68ffa16687ef79c2cff3a2ca3b1a92}
}

@misc{wang2026facts,
  title = {{Facts Without Rules: Boundary Metadata Collapse in Multi-Agent LLM Handoffs}},
  author = {Yian Wang and Agam Goyal and Eshwar Chandrasekharan and Hari Sundaram},
  year = {2026},
  month = aug,
  eprint = {2608.29028},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/6dd494eead5b8fdb8340c33b0a3a4deef955323f}
}

@misc{jiang2026fisguard,
  title = {{FISGuard: Defending Against Membership Inference via Fixed Input Subspaces}},
  author = {Hao-Cheng Jiang and Hua Shen},
  year = {2026},
  month = aug,
  eprint = {2608.27836},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/ddc1bf96c1d3e2b92361ca225366c16b962434b3}
}

@misc{jung2026camodocs,
  title = {{CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents}},
  author = {Jaewon Jung and Haizhong Zheng and Hongsun Jang and Jaeyong Song and Beidi Chen and Jinho Lee},
  year = {2026},
  month = aug,
  eprint = {2608.28389},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8cb58f1bfdd0a241e70a6b4b0058fb0e7c67e6bb}
}

@misc{bakshi2026openstamp,
  title = {{OpenStamp: A Watermark for Open-Source Language Models}},
  author = {Miroojin Bakshi and Saksham Rastogi and Danish Pruthi},
  year = {2026},
  month = aug,
  eprint = {2608.27899},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/4e7740b43503b5154dae21b1aae91874490a9ac4}
}

@article{dawson2026agentic,
  title = {{Agentic AI Security in Industry 5.0: Emerging Threats, Forensic Readiness, and Trustworthy Human–Agent Collaboration}},
  author = {Maurice E. Dawson and A. B. Ben Ayed and Samson Quaye},
  year = {2026},
  month = aug,
  journal = {Information},
  doi = {10.3390/info17090826},
  url = {https://www.semanticscholar.org/paper/f1f02c5e461ba224a1ec673b6b241d2e7c77881c}
}

@article{qian2026governing,
  title = {{Governing generative AI in higher education: emerging policy approaches and support ecosystems at innovative U.S. Universities}},
  author = {Yu-Feng Qian},
  year = {2026},
  month = aug,
  journal = {International Journal for Educational Integrity},
  doi = {10.1007/s40979-026-00233-x},
  url = {https://www.semanticscholar.org/paper/604b5d28db3a65bf10fe52bb209b03699fb2268e}
}

@misc{dardini2026quantizationtriggered,
  title = {{Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation--Deployment Gap}},
  author = {Jacopo Dardini and Claudio Stanzione and G. Colò and G. Fenza},
  year = {2026},
  month = aug,
  eprint = {2608.27512},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/4814c6bd8be0dc62cbee06a2fb1d391b5cfc7191}
}

@article{sadeghi2026guardrail,
  title = {{Guardrail Detection in Rural Roads Using Zero- and Few-Shot Learning with Vision Language Models}},
  author = {M. Sadeghi and Ali Mansouri and Abdolmajid Erfani},
  year = {2026},
  month = aug,
  journal = {Construction Research Congress 2026},
  doi = {10.1061/9780784486962.035},
  url = {https://www.semanticscholar.org/paper/32e0021bde133d1dfb10f2364463d7bb4208d0d4}
}

@misc{zhang2026guard,
  title = {{The Guard That Cried Wolf: How Scary Words Make Agent Guardrails Refuse Legitimate Actions}},
  author = {Yingjie Zhang and Yuanbo Xie and Kai Chen},
  year = {2026},
  month = aug,
  eprint = {2608.27009},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/31f4998e2bf81619cb2868927931efc2c5f3672f}
}

@misc{wu2026safety,
  title = {{Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents}},
  author = {Chenmin Wu and H. Jia and Yang Liu and Ying-Guang Yang and Yu-Han Lin and Chong Zhang and Hao Zheng and Yu-Long Huang and Jian-Sheng Zhang and Yong-Zhi Qi and Shang Luo and Ke Xu and Jifeng Zhu and Bin Chong},
  year = {2026},
  month = aug,
  eprint = {2608.27141},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/106e267e5a85d840988eff8d6069a58ac4b313b5}
}

@misc{zhe2026single,
  title = {{A Single Suffix to Break Them All: Basin-Aware Jailbreaks for Merged Model Families}},
  author = {Yu Zhe and Yiting Tan and Jun-Hao Wei and Wan Chen},
  year = {2026},
  month = aug,
  eprint = {2608.26506},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/0f2d5b2bfa30e140a8aa2849861f3bcbca2bd73e}
}

@misc{chen2026judgestealer,
  title = {{JudgeStealer: Extracting LLM Judging Capabilities across Evaluation Protocols}},
  author = {Chen Chen and Yao-Lin Chen and Xue-Han Sun and Juan Lin and Xueluan Gong and Yu-Heng Zheng and Qian Wang and Kwok-Yan Lam},
  year = {2026},
  month = aug,
  eprint = {2608.26982},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/0becf5302b4eabed685d226ee6ffbf1f3a06764e}
}

@misc{chen2026longguard,
  title = {{LongGuard: Mechanistic Analysis and Training-Free Mitigation of Long-Context Failure in Safety Guardrails}},
  author = {Ziyang Chen and Xing Wu and Songlin Hu},
  year = {2026},
  month = aug,
  eprint = {2608.27580},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/03d27a4020eb7f788ff7f11c1a73615d5ad275c2}
}

@misc{wang2026vulnerable,
  title = {{Vulnerable Code Search: Transferable Attack for Code Language Models}},
  author = {Kaicheng Wang and Liyan Huang and Jesse Thomason and Weihang Wang},
  year = {2026},
  month = aug,
  eprint = {2608.26031},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/fca4f64d2721d15004f8e9081a7b5dbb5e38620d}
}

@misc{wu2026evomal,
  title = {{EVOMAL: Self-Poisoning in Self-Evolving Coding Agents}},
  author = {Xiaodong Wu and Yu Shi and Qi Li and Zhimin Zhao and Xiang-Man Li and Bram Adams and Ahmed E. Hassan and Jianbing Ni},
  year = {2026},
  month = aug,
  eprint = {2608.25776},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/dade8d85d8cec69350866993be15d982dda27435}
}

@article{wei2026survey,
  title = {{A Survey of Zero-Shot Sensitive Information Detection Techniques based on Large Language Models}},
  author = {Jie-Qun Wei and Yuejin Zhang},
  year = {2026},
  month = aug,
  journal = {Scientific Journal of Intelligent Systems Research},
  doi = {10.54691/3kzsns60},
  url = {https://www.semanticscholar.org/paper/a99698990062ff0248f8281a1c8f3f064b1c96bf}
}

@misc{ding2026ai,
  title = {{AI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation}},
  author = {Junchen Ding and Jialiang Dong and Yi Zhu and Yi Liu and Gelei Deng and William Susilo and Simeng Ma and Yuekang Li},
  year = {2026},
  month = aug,
  eprint = {2608.25667},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/a4d1c9973548a5f990db11f16b8e5d1070768d62}
}

@misc{shraga2026approved,
  title = {{Approved Too Late: Verdict Staleness in LLM-Guarded Self-Adaptive Systems}},
  author = {I. Shraga and Roei Eshel and Lior Gorelik},
  year = {2026},
  month = aug,
  eprint = {2608.26306},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/a2e0b37b50504ec982323457953492e9a489cd55}
}

@misc{he2026are,
  title = {{Are LLM-Enhanced GNNs Privacy-Safe?}},
  author = {Long-Zhu He and Zekun Wen and Chaozhuo Li and Sen Su},
  year = {2026},
  month = aug,
  eprint = {2608.25727},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/9f818c0b7d9af6900dfa284aeb0cbb0b244e1fb0}
}

@misc{rezakhani2026rtlguard,
  title = {{RTLGuard: A Lightweight Teacher-Student Defense for Poisoned RTL Code Generation Models}},
  author = {Mahshid Rezakhani and K. Azar and H. Kamali},
  year = {2026},
  month = aug,
  eprint = {2608.26049},
  archivePrefix = {arXiv},
  doi = {10.1145/3831252.3834219},
  url = {https://www.semanticscholar.org/paper/905f1889d0ef658a604096a02d0026afb21ee4f7}
}

@misc{gao2026what,
  title = {{What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructions}},
  author = {Yichao Gao and Yumo Zhang and Yunhao Yao and Haohua Du and Pu-Han Luo and Ruiqi Li and Zhiqiang Wang},
  year = {2026},
  month = aug,
  eprint = {2608.24022},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/db973d82aa1cd4dd5cfc5628be6838c59c4a86a9}
}

@misc{na2026poisoning,
  title = {{Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems}},
  author = {CheolWon Na and Hao Ni and Lukasz Szpruch and Zhang-Yang Wang and Dhagash Mehta and Saurabh Nagrecha and Alejandro Lopez-Lira and Chanyeol Choi and Yongjae Lee and Jee-Hyong Lee},
  year = {2026},
  month = aug,
  eprint = {2608.24069},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/788d33b73f8c3b174b9ba58775547c9439f2f81f}
}

@article{chen2026data,
  title = {{Data security in large language models: risks, defense, and directions}},
  author = {Kang Chen and Xiu-Ze Zhou and Yuanhui Yu and Y. Lin and Hefeng Chen and Congyu Cai and Li Shen},
  year = {2026},
  month = aug,
  journal = {Journal of King Saud University: Computer and Information Sciences},
  doi = {10.1007/s44443-026-01200-9},
  url = {https://www.semanticscholar.org/paper/249a53fc8e0e8efa49be0e379ace9460bcd2a0e4}
}

@misc{zheng2026stepguard,
  title = {{StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing}},
  author = {Zhijie Zheng and Yu Li and Chen Qian and Yu-Qian Fu and Yanwei Fu and Lu Sheng and Jing Shao and Dongrui Liu},
  year = {2026},
  month = aug,
  eprint = {2608.24777},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/01d8aca918b46e65aaa866d65f619b80302510c6}
}

@misc{pandey2026confidently,
  title = {{Confidently Wrong, Silently So: Auditing Undetectable Failures of a Deployed On-Device Language Model}},
  author = {Shashwat Pandey and Satwik Pandey and S. Raghu},
  year = {2026},
  month = aug,
  eprint = {2608.23663},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/fd8330fb0908180fc1a75842a6f2c9149730873b}
}

@misc{feng2026psychjail,
  title = {{PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policies}},
  author = {Zeyu Feng and Qingyuan Wu and Yu-Zhe Luo and Hua Cheng},
  year = {2026},
  month = aug,
  eprint = {2608.23028},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/c8c62a6283d655086c1b928e4ec722888ff5b8fb}
}

@misc{schussler2026aiassisted,
  title = {{AI-Assisted Extraction of Follow-up Observations from GCN Circulars in Astro-COLIBRI}},
  author = {F. Schüssler and S. Bisero and M. Cellier and A. Ciric and B. Cornejo and I. Jaroschewski and A. Alkan and W. Kiendr'eb'eogo and A. Saint-Paul},
  year = {2026},
  month = aug,
  eprint = {2608.23270},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/99ff499a2c237cde2bfdbca646cc68e2a49c856e}
}

@misc{shivakumar2026agentflow,
  title = {{AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems}},
  author = {B. Shivakumar and Swarn Priya and Peng Gao},
  year = {2026},
  month = aug,
  eprint = {2608.22868},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/69ab62ec5938e6e397cb83f87e3d3fc02afea3a1}
}

@article{mahmud2026privacypreserving,
  title = {{Privacy‐preserving multi‐agent systems for human‐centred inclusive healthcare AI}},
  author = {Mufti Mahmud and Noushath Shaffi and M. S. Kaiser and M. A. Rahman and M. M. Rahman and Vimbi Viswan and T. Sharmeen and S. Bhattacharya and N. J. Ahuja and A. Ulgen and I. Niazi and Kanad Ray and A. Hussain and David J. Brown and J. Moore},
  year = {2026},
  month = aug,
  journal = {The AI Magazine},
  doi = {10.1002/aaai.70087},
  url = {https://www.semanticscholar.org/paper/685c918353abcabc7296f863a60e124fe26101a6}
}

@article{gonzalezgorrin2026transportlayer,
  title = {{A transport-layer cryptographic framework secures inter-agent communication and verdict provenance in multi-agent malware detection pipelines}},
  author = {Víctor Manuel González-Gorrín and Josep Prieto-Blázquez},
  year = {2026},
  month = aug,
  journal = {Scientific Reports},
  doi = {10.1038/s41598-026-66312-8},
  url = {https://www.semanticscholar.org/paper/32ba3f3e509341196abb0cf0e27ca4f60872f21a}
}

@misc{hassan2026banglaveilguard,
  title = {{BanglaVeilGuard: Cross-Script Safety Benchmarking and Lightweight Guardrails for Bangla Large Language Models}},
  author = {Moavia Hassan and Muhammad Iqbal Hossain},
  year = {2026},
  month = aug,
  eprint = {2608.21880},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/fe84bf93a0764b6c4c56c6d121de83e1d10fbc99}
}

@misc{chang2026privacy,
  title = {{Privacy Preserving Semantic Communications in Wireless Edge Networks with Vision Language Models}},
  author = {Hao Chang and Ming-Zhe Chen and Qianqian Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.21773},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/ac78104890d618aae3ff2db3509cf2c3ff30949b}
}

@article{prakash2026llm,
  title = {{LLM Copilot for Privacy-Respecting Cyber Incident Response}},
  author = {Pramod Prakash},
  year = {2026},
  month = aug,
  journal = {International Journal of Intelligent Systems and Data Science},
  doi = {10.67231/6s96yv20},
  url = {https://www.semanticscholar.org/paper/86e9f5c49f74bf0364fb6703f68e151b2cb0b68a}
}

@misc{orojlooyjadid2026no,
  title = {{No One Model Catches Every Harm: Benchmarking Content Moderation Across Safety Scenarios}},
  author = {Afshin Orojlooyjadid and Hitesh Laxmichand Patel},
  year = {2026},
  month = aug,
  eprint = {2608.21775},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/833284cb6c460df1a04c971f7f9be4db98bb0680}
}

@misc{zhang2026mitigating,
  title = {{Mitigating Database Leakage in RAG Systems with Keyword-Grounded Fact Substitution}},
  author = {Ziliang Zhang and Yubo Zhu and Wei Tong and Jingyu Hua and Zijian Wang and Yuan Zhang and Sheng Zhong},
  year = {2026},
  month = aug,
  eprint = {2608.21656},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f9b432133fc98cafe0353fb62319bdf7614e203d}
}

@misc{liang2026vispoison,
  title = {{Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation}},
  author = {Ru-Jin Liang and Zhong-Pu Chen and Yuhao Lei and Xin Miao},
  year = {2026},
  month = aug,
  eprint = {2608.20756},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/cbe9563fd7efd2df8017dd23c0e4a6e31b9fc5da}
}

@inproceedings{li2026finetuning,
  title = {{Fine-tuning as Jailbreaking: A data-centric red teaming framework via logic injection}},
  author = {Qiuxiang Li and Ke Xu and Yubin Qu and Jianping Wu},
  year = {2026},
  month = aug,
  booktitle = {International Conference on Automated Software Engineering},
  doi = {10.1007/s10515-026-00659-0},
  url = {https://www.semanticscholar.org/paper/c5c61310180c086c887e65e3d1bcada3aebe271e}
}

@misc{liu2026certified,
  title = {{Certified Multi-Turn Robustness for LLM Safety via Compositional Bounds and Safety Persistence}},
  author = {Yang Liu and Bin Chong and Wenkai Yang and Shuai Zhang and Yan-Cheng Chen and Fei Han and GuoZhen and Cheng Zhang and Huaibing Xie and Changze Lv and Shihan Dou and Pluto Zhou},
  year = {2026},
  month = aug,
  eprint = {2608.20820},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/bffff5b3e618d29747dab5b25337420a0ec519b2}
}

@misc{luo2026anchoring,
  title = {{Anchoring Bias: A Persistent Fairness Backdoor Attack against MLLMs under Continual Learning}},
  author = {Yuyang Luo and Kai Shu},
  year = {2026},
  month = aug,
  eprint = {2608.21577},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8b1455c5a420714262b830d1af702fd2478832c6}
}

@misc{jiang2026reframe,
  title = {{ReFrame: Evidence-Guided Test-Time Safety Alignment in Multimodal Large Language Models}},
  author = {Wenzheng Jiang and Xuan-Kun Rong and Yuan-Zhao Zhai and Da-Wei Feng and Huaimin Wang},
  year = {2026},
  month = aug,
  eprint = {2608.21100},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8216bd75e51ed23466c2d4f47ea1dfe2f32e75fd}
}

@misc{lin2026trojaning,
  title = {{Trojaning the Alignment: Stealthy Backdoor Attacks against Graph Foundation Models}},
  author = {Min Lin and Zhi-Cheng Gao and Yilong Wang and Hanqing Lu and Xiang Zhang and Suhang Wang},
  year = {2026},
  month = aug,
  eprint = {2608.20991},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/7c24cd0e1f15364b146df652e89e285cacff0bb7}
}

@misc{staufer2026no,
  title = {{No PUN Intended: Plausible Unknown Names for Person-Centred LLM Evaluation}},
  author = {Dimitri Staufer and David Hartmann and Ibrahim Baroud},
  year = {2026},
  month = aug,
  eprint = {2608.21206},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/7a824f284f64b49e74d0eeccea6bf406889eab2f}
}

@misc{giri2026trustworthy,
  title = {{Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems}},
  author = {Balkrishna Giri and M. Hasan and Jussi Rasku and Muhammad Waseem and Pekka Abrahamsson},
  year = {2026},
  month = aug,
  eprint = {2608.21095},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/21c1fac19d0c3a8a1ebbddabcdc5b5109b566700}
}

@misc{zhou2026tempjail,
  title = {{TempJail: Temporal Jailbreak Attack against Large Vision-Language Models via Subtitle Scheduling}},
  author = {Ling Zhou and Yihao Huang and Jinglin Sun and Zhiwen Tian and Yi Zeng and Qi-He Liu and Shi-Jie Zhou},
  year = {2026},
  month = aug,
  eprint = {2608.19737},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/9256fdf3d5d0f55a454ebf4d96a30155cdf62b38}
}

@misc{nemecek2026auditing,
  title = {{Auditing Cross-Lingual Fairness in Language Model Watermarking}},
  author = {Alexander Nemecek and Osama Zafar and Debargha Ganguly and Vikash Singh and Vipin Chaudhary and Erman Ayday},
  year = {2026},
  month = aug,
  eprint = {2608.20047},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/25ee21ef07b6282273f369076f9000bef569ad0a}
}

@article{feng2026formal,
  title = {{A Formal Framework of Architectural Intent Collapse for Tool-Level Attacks on LLM Agents}},
  author = {Zhaowen Feng and Zhenhui Liu and Ming-Jun Ma and Dong-Ran Zhuang and Jie Gao},
  year = {2026},
  month = aug,
  journal = {Electronics},
  doi = {10.3390/electronics15163739},
  url = {https://www.semanticscholar.org/paper/1657992e80b3f19b573d4d6104e792c0d98ea40b}
}

@article{tchuindjang2026refusalguardm,
  title = {{RefusalGuard-M: a scalable human–machine framework for multi-turn LLM jailbreak evaluation via semantic refusal manifold modeling}},
  author = {Michael Tchuindjang and Nathan Duran and Phil Legg and Faiza Medjek},
  year = {2026},
  month = aug,
  journal = {Cybersecurity},
  doi = {10.1186/s42400-026-00633-z},
  url = {https://www.semanticscholar.org/paper/da9ee63b62208fdbb2199fda4de57efe4a4a4ee7}
}

@article{ominyi2026conceptual,
  title = {{A Conceptual Framework for Multi-Agent AI Quality Control in The Review of Regulated Documents}},
  author = {Michael Ominyi},
  year = {2026},
  month = aug,
  journal = {INTERNATIONAL JOURNAL OF SOCIAL SCIENCES AND MANAGEMENT RESEARCH},
  doi = {10.56201/ijssmr.vol.11no8.2025.pg534.557},
  url = {https://www.semanticscholar.org/paper/ace5593eeb76ba362a29f5c056b74985212eea5b}
}

@article{mourad2026securing,
  title = {{Securing the Prompt Pipeline: A Systematic Review of Defense Mechanisms Against Prompt-Based Attacks in LLM Agents}},
  author = {Sana Mourad and E. E. Abdallah and Mohammad Ababneh},
  year = {2026},
  month = aug,
  journal = {Electronics},
  doi = {10.3390/electronics15163700},
  url = {https://www.semanticscholar.org/paper/2a6dee66de468ab63743a038cfc5017017f1af73}
}

@article{basu2026ai,
  title = {{AI safety evaluation in an underrepresented population: real-world performance of clinical decision support and frontier language models on Medicaid patient messaging triage}},
  author = {Sanjay Basu and Sadiq Y. Patel and Parth Sheth and Bernardo Arevalo and Jeremy Schifberg and John Morgan and Rajaie Batniji},
  year = {2026},
  month = aug,
  journal = {BMC Medical Informatics and Decision Making},
  doi = {10.1186/s12911-026-03763-z},
  url = {https://www.semanticscholar.org/paper/fee3e808aed590c7fbe755d7dd4e9d3e5acf427e}
}

@article{zhang2026you,
  title = {{You Are an Expert: RAG Injection and Guided Error Expert Activation for Jailbreaking Large Language Models}},
  author = {Shun Zhang and Ying Ding and Yanxu Mao},
  year = {2026},
  month = aug,
  journal = {Expert Syst. J. Knowl. Eng.},
  doi = {10.1111/exsy.70395},
  url = {https://www.semanticscholar.org/paper/f5a6e15f149ffd7682a47d693e15a2e17b86651a}
}

@article{tan2026responsible,
  title = {{Responsible Large Language Models in Finance: A Descriptive Bibliometric Overview and Taxonomy of Responsibility}},
  author = {Chong-Hui Tan and Qinxu Ding},
  year = {2026},
  month = aug,
  journal = {FinTech},
  doi = {10.3390/fintech5030071},
  url = {https://www.semanticscholar.org/paper/ccc1f69bb0b261c2d590eaff0b8eee2ad42140cb}
}

@misc{li2026skillwatermark,
  title = {{SkillWatermark: An Embedded Skill Watermark of Progressive Privacy Inference via Benign Prompts}},
  author = {Yu Li and Liqi Zhuang and Dong Wei and Jiwen Luo and Hang Zhang and Meng Zhang and Xiaona Li and Weiqing Huang},
  year = {2026},
  month = aug,
  eprint = {2608.16026},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/ae12dba64123005c4bae0df7c084a9eadc318a88}
}

@misc{ghassabi2026safer,
  title = {{Towards Safer RAG: Only Agents Capable of System 2 Thinking may Access Untrusted Documents}},
  author = {Mehrdad Ghassabi},
  year = {2026},
  month = aug,
  eprint = {2608.17153},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/9ad90be31be191016980abf888e48404a08457d7}
}

@misc{zhang2026disco,
  title = {{DiSCO: Defending text-to-image generation through distribution-guided contrastive prompt optimization}},
  author = {Tong Zhang and M. Alfarra and Carlos Hinojosa and Christos Louizos and Bernard Ghanem},
  year = {2026},
  month = aug,
  eprint = {2608.17067},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/74f0b8c1be197c2e6a6d54d29c20352d640cb979}
}

@misc{liu2026security,
  title = {{Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation}},
  author = {Jiawei Liu and Jiacheng Guo and Tian Zhang and Yi-Wei Xu and Juan Wang and Jinlin Fan and Bowen Xiao},
  year = {2026},
  month = aug,
  eprint = {2608.16843},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/06190ffa90147391f987fa830340186f54729f19}
}

@misc{miah2026trace,
  title = {{TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation}},
  author = {Md Messal Monem Miah and Adrita Anika and Zhiyuan Yu and Ruihong Huang},
  year = {2026},
  month = aug,
  eprint = {2608.15594},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/e396c538fa9434cc58689737a23e7b0e25ea2ee2}
}

@misc{arif2026conjunctiveb,
  title = {{Conjunctive Poisoning in AI Supply-Chain Applications}},
  author = {Nokimul Hasan Arif and Qian Lou and Meng Zheng},
  year = {2026},
  month = aug,
  eprint = {2608.15913},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d9175f51a25b86b6c86fb663397e860b28b80933}
}

@misc{chatterji2026plguard,
  title = {{PL-Guard: Probabilistic Logic Reasoning for LLM Guardrails}},
  author = {Satchit Chatterji and Shi-Han Wang and G. Sileno and Erman Acar},
  year = {2026},
  month = aug,
  eprint = {2608.15673},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/b112fd1f674c4d19bde5fca334828d52a986db60}
}

@misc{mochizuki2026assessing,
  title = {{Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes: A Case Study in Political Domains}},
  author = {R. Mochizuki and Shusuke Komatsu and Souta Noguchi and Kazuto Ataka},
  year = {2026},
  month = aug,
  eprint = {2608.15814},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/2ad14c8c5cf1f454c49512afc25a9e55fd2efa88}
}

@misc{kim2026watermarked,
  title = {{Watermarked Game Solving via Perturbed Regret Minimization}},
  author = {Juho Kim and Tuomas Sandholm},
  year = {2026},
  month = aug,
  eprint = {2608.14977},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d375bc8b1fa72311b4984e44877fa27413f61e2a}
}

@misc{ali2026biofirewall,
  title = {{BioFirewall: A genome-writing-native governance layer for design-stage biosecurity screening of agentic AI}},
  author = {Anees Ahmed Mahaboob Ali and R. Delhibabu and Everette Jacob Remington Nelson},
  year = {2026},
  month = aug,
  eprint = {2608.20413},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/cf5903b5d8af40fba5e21a2fefdfd4e634dd0f81}
}

@article{alnemari2026dtgenshield,
  title = {{DT-GenShield: A Digital Twin-Driven Runtime Security Architecture for Protecting Large Language Models Against Indirect Prompt Injection}},
  author = {Alaa Alnemari and Mashael M. Alsulami},
  year = {2026},
  month = aug,
  journal = {Electronics},
  doi = {10.3390/electronics15163640},
  url = {https://www.semanticscholar.org/paper/689031f7b55edb5c81db55047a445d9f068415d1}
}

@misc{meng2026sysevolve,
  title = {{SysEvolve: An AI-native, safe, autonomous adversarial attack-defense co-evolutionary system}},
  author = {Yuhan Meng and Shaofei Li and Jionghao Huang and Jiandong Jin and Puyi Wang and Hanlin Jiang and Anis Yusof and Peng Jiang and Zhenkai Liang and Yao Guo and Ding Li},
  year = {2026},
  month = aug,
  eprint = {2608.15012},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/1af26c98c69b3b702a827439df5413f427ffc8a1}
}

@misc{blanchet2026optimal,
  title = {{Optimal Watermark Localization in Mixed-Source Large Language Model Texts}},
  author = {José H. Blanchet and T. Cai and Xiang Li and Hao Liu and Qi Long and Weijie J. Su},
  year = {2026},
  month = aug,
  eprint = {2608.14906},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/9d38112c12c8aed8b21ee18522eed2e3b185a8ac}
}

@misc{zhao2026tripwire,
  title = {{Tripwire: Triggering Aligned Refusal via Statistically Certified Safety Neurons}},
  author = {Wei Zhao and Zhe Li and Peixin Zhang and Jun Sun},
  year = {2026},
  month = aug,
  eprint = {2608.14392},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/49c4e4dfde4fe8e1786ae73918c43796b07e4582}
}

@misc{kukreja2026biasmixfinance,
  title = {{BiasMix-Finance: Post-Generation KYC Guardrails for LLM Portfolio Advice}},
  author = {Gaurav Kukreja and Parul Kukreja and Mohammed Abraar and R. Dandekar and R. Dandekar and Sreedath Panat},
  year = {2026},
  month = aug,
  eprint = {2608.28646},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/35614c01d076e0ee928e20ec6fa9652abed6457b}
}

@misc{onuoha2026languagespecific,
  title = {{Language-Specific Gaps in AI Safety Training Datasets}},
  author = {Chialuka Prisca-Mary Onuoha and Bright Etornam Sunu and Rashidat Sikiru},
  year = {2026},
  month = aug,
  eprint = {2608.13695},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/e49b7db925cfbc19b9d81d2927d28c9670abb89b}
}

@misc{chen2026hiroute,
  title = {{HiRoute: Hierarchical Routed Prompt Tuning for Safety Alignment of Large Language Models}},
  author = {Fang-Zhou Chen and Shiji Zhao and Mengyan Wang and Qihui Zhu and Ran-Jie Duan and Maoxun Yuan and Xingxing Wei},
  year = {2026},
  month = aug,
  eprint = {2608.12821},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d697618a11df5206c8d73ecedf55ddf9db224a37}
}

@misc{feng2026tracing,
  title = {{Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks}},
  author = {Xiao-Yang Feng and Yanjun Zhang and He Zhang and L. Zhang and Shirui Pan},
  year = {2026},
  month = aug,
  eprint = {2608.12713},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/ab116a93501cd418ff258dda5081b8daf086b858}
}

@misc{xu2026beyond,
  title = {{Beyond Visual Evidence: Revealing and Mitigating Relational Privacy Leakage in Document MLLMs}},
  author = {Beining Xu and Hairui Wang and Jiaxin Wang and Changsheng Chen and Anirban Chakraborty},
  year = {2026},
  month = aug,
  eprint = {2608.12911},
  archivePrefix = {arXiv},
  doi = {10.1145/3767308.3835901},
  url = {https://www.semanticscholar.org/paper/8b616f7b4ce3fe4934e0fd0beb28e9f6ca206b71}
}

@misc{zhang2026reconcile,
  title = {{Reconcile Once, Write Anytime: A Trust-Tiered Librarian and a Multi-Agent Writer for Drift-Free, Point-in-Time Research}},
  author = {Xing Zhang and Ya Cui and Guanghui Wang and Pei-Gen He},
  year = {2026},
  month = aug,
  eprint = {2608.12984},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/6eb07fc891829f8610b547a2b0c22a2d95fceda5}
}

@article{ozer2026scenariobased,
  title = {{SCENARIO-BASED PREHOSPITAL TRIAGE OF CARBON MONOXIDE POISONING: COMPARING FIVE LARGE LANGUAGE MODELS WITH EMERGENCY MEDICAL SERVICES PERSONNEL IN A PROSPECTIVE STUDY}},
  author = {Vildan Özer and Özlem Bülbül and Efnan Bayrak Erbolukbas and Serdar Karakullukçu and Aynur Şahin},
  year = {2026},
  month = aug,
  journal = {Kırıkkale Üniversitesi Tıp Fakültesi Dergisi},
  doi = {10.24938/kutfd.1922944},
  url = {https://www.semanticscholar.org/paper/ed91854853fa63aa344cdee6370d9016e8d2c027}
}

@misc{mancas2026automated,
  title = {{Towards Automated Domain Model Extraction from Source Code using Heuristics and Open-Source LLMs}},
  author = {Alessandra Mancas and Mounir Ammam and Hyacinth Ali and Kevin Delcourt and H. Sahraoui},
  year = {2026},
  month = aug,
  eprint = {2608.12228},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/440cae9d353d5f570773f5158d771cb6d1266cf2}
}

@article{dang2026caps,
  title = {{CAPS: Compositional Attack Path Scoring for LLM Deployment Stacks}},
  author = {Quang-Vinh Dang and Hoang-Viet Vu and Ngoc-Son-An Nguyen and M. Dinh and Dat Le},
  year = {2026},
  month = aug,
  journal = {Artificial Intelligence and Applications},
  doi = {10.47852/bonviewaia620210609},
  url = {https://www.semanticscholar.org/paper/33eca5ed0e766089b5c28a42428b804e6a8e2bf2}
}

@article{prajapati2026defensive,
  title = {{Defensive Reverse Engineering of LLM Applications: A Black-Box Framework for Security Risk Scoring and Mitigation}},
  author = {Bhavesh B. Prajapati and Bhavya Shah},
  year = {2026},
  month = aug,
  journal = {International journal of computer information systems and industrial management applications},
  doi = {10.70917/ijcisim-2026-4703},
  url = {https://www.semanticscholar.org/paper/28983a3205a8f92c62682310e831f05d4eae8fab}
}

@misc{huang2026probguard,
  title = {{ProbGuard: Calibrated Safety Risk Estimation from LLM Output Distributions}},
  author = {Xinzhe Huang and Biwu Yao and Kedong Xiu and Mengnan Zhao and Di Wang and Puning Zhao and Tianhang Zheng},
  year = {2026},
  month = aug,
  eprint = {2608.10621},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f6c0d06532a9084259bdd4e94343c9a1e98e4f23}
}

@misc{ma2026safecap,
  title = {{SafeCap: Improving LVLM Safety with Image Captioning Reinforcement Learning}},
  author = {Caoyuan Ma and Wen-Pu Liu and Weichu Xie and Tian Gu and Shilei Zhao and Lingxi Min and Shuai Dong and Yu-Qi Xu and Ji Zhao and Ziyue Wang and Wenzheng Chang and Taiqiang Wu and Yong-Fu Zhu and Wen-Qi Shao and Yinqiang Zheng},
  year = {2026},
  month = aug,
  eprint = {2608.10513},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/e4ddb4f43295dae00e3e9f478c20020294f9157c}
}

@misc{kwartler2026ai,
  title = {{AI Guardrail Survival under Single-Cycle Agentic Self-Summarization}},
  author = {Ted Kwartler and Alan Aqrawi and Arian Abbasi},
  year = {2026},
  month = aug,
  eprint = {2608.11392},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d818405f19246444333379662165fb5ee43ebc1e}
}

@misc{lin2026once,
  title = {{Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs}},
  author = {Tao Lin and Gaojie Jin and Zongxi Liu and Peng Wu and Lijia Yu},
  year = {2026},
  month = aug,
  eprint = {2608.10959},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d72f36000b19aeeb672f3fc41a15e33915bc8ca3}
}

@misc{huang2026backdoor,
  title = {{Backdoor Decontamination Dynamics in LLM Agents}},
  author = {Gabriel Huang and Abhay Puri and L'eo Boisvert and Alexandre Drouin and Perouz Taslakian and Spandana Gella and Christopher Pal},
  year = {2026},
  month = aug,
  eprint = {2608.11295},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d5229f30a2f7494f971c21683cde87e9e29b1cbf}
}

@misc{lin2026measuring,
  title = {{Measuring Semantic Abstractness of SAE Features via Nonlocality}},
  author = {Chuqi Lin and S. Sondhi and Xiao-Liang Qi},
  year = {2026},
  month = aug,
  eprint = {2608.10537},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/736ae9f2e1f4b71b506575926c7799e9ca2901df}
}

@article{kim2026securemcpb,
  title = {{SecureMCP: Policy-Enforced Defense Against Prompt Injection in LLM-Generated SQL for AIoT Databases}},
  author = {Wonbae Kim and Hee-Kyong Yoo and Nammee Moon},
  year = {2026},
  month = aug,
  journal = {Applied Sciences},
  doi = {10.3390/app16167974},
  url = {https://www.semanticscholar.org/paper/39676372aa39d51366b632f3d18e809c3b05b77a}
}

@misc{hasan2026empirical,
  title = {{An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs}},
  author = {Md Nahid Hasan and Mohammad Arif Hossain},
  year = {2026},
  month = aug,
  eprint = {2608.11348},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/332aa7504f08004ae724a19f94043c1278e21ce4}
}

@article{hsine2026privacypreserving,
  title = {{A Privacy-Preserving Middleware Architecture for Detecting Prompt Injection and Sensitive Data Exposure in Large-Language-Model Interactions}},
  author = {Adam Ait Hsine and A. Arabo},
  year = {2026},
  month = aug,
  journal = {Electronics},
  doi = {10.3390/electronics15163554},
  url = {https://www.semanticscholar.org/paper/0946d10598a3836423ad37115c73c58a45a9874d}
}

@misc{lai2026metastrategy,
  title = {{MetaStrategy: Generative Ranking with Executable LLM Strategies}},
  author = {Chengyu Lai and Jiuning Lin and Zhibo Xiao and Xiaodong Zhu and Ruiquan Lan and Bin Zhang and Zi-Hong Huang and Wendong Zhang and Chuxin Chen and Yinjiang Cai and Shuaihao Zhong and Lingqin Zhang and Di-Min Wang and Jialin Zhu and Hanqian Zhu},
  year = {2026},
  month = aug,
  eprint = {2608.09440},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/eefb388ef446ab525230570a9be8cc931e0c2b34}
}

@article{zhao2026risk,
  title = {{Risk perception and generative AI discontinuance intention: mediating effect of cognitive fatigue and moderating effect of AI dependence}},
  author = {Wen-Wen Zhao and Jia-Wen Liu},
  year = {2026},
  month = aug,
  journal = {Frontiers in Psychology},
  doi = {10.3389/fpsyg.2026.1879080},
  url = {https://www.semanticscholar.org/paper/e1e0dc423f0130f12ba20e9becaa81d15a26892a}
}

@misc{kamijo2026decodinglevel,
  title = {{Decoding-Level Taboo: A Diagnostic Stress Test for LLM Robustness}},
  author = {T. Kamijo and Ori Rottenstreich and Javier Conde and Gonzalo Martínez and Pedro Reviriego},
  year = {2026},
  month = aug,
  eprint = {2608.09900},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/64c109cad907daf65636234e2eed04e0fba80d70}
}

@misc{bhagra2026agentic,
  title = {{Agentic Harnesses: LLM-Driven Verification Layers for Robot Autonomy}},
  author = {Rohan Bhagra and Mahantesh Halapannavar and Uddhav Bhattarai},
  year = {2026},
  month = aug,
  eprint = {2608.09857},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/5f39fb04dbe12b5f64ec64252d2c570e3fb9fe0d}
}

@misc{sui2026elasticback,
  title = {{ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization}},
  author = {Hao Sui and Simeng Qin and Jie Liao and Xiao-Jun Jia and Bing Chen and Yang Liu},
  year = {2026},
  month = aug,
  eprint = {2608.09577},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/406fad7e7519f35b9fae4ce4268a40833cf9e403}
}

@misc{telukunta2026case,
  title = {{The CASE Framework: A Multi-Disciplinary Control Architecture for Governing Enterprise Agentic AI}},
  author = {Srinivas Telukunta and Georgios Nektarios Lilis and Lucio Baron},
  year = {2026},
  month = aug,
  eprint = {2608.10153},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/14d4b85624bbc1096651c3256dd4658507810463}
}

@misc{jin2026same,
  title = {{Same Question, Different Answer? Measuring and Mitigating Prompt Privilege for Equitable AI Access}},
  author = {Li Jin and Lang-Xiang Hu and Bin-Qi Shen and Han-Yu Cai and Yu-Ting Xin},
  year = {2026},
  month = aug,
  eprint = {2608.08942},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/fe4a2c7e3cb87a251832379d2d8903fdaa601d2a}
}

@misc{cong2026yesterdays,
  title = {{Yesterday's Shield, Today's Spear: A Self-Evolving Safety Guardrail in Production}},
  author = {Ming Cong and Jingyin Chen and Bin Liu and Qi Chu and Tao Gong and Neng-Hai Yu and Ying-Fei Xiang},
  year = {2026},
  month = aug,
  eprint = {2608.08471},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/ab64ee559216abd0d808ffb581aaba43b7d4825c}
}

@misc{li2026holoaegis,
  title = {{HoloAegis: Frozen Representation, Topological Inference: Minimally Parametric Safety Manifolds for Zero-Shot LLM Guardrails}},
  author = {T. Li and Kaijie Liu and Lik-Hang Lee and King-Chung Ho and Ping Shum and Michael K. Ng},
  year = {2026},
  month = aug,
  eprint = {2608.08485},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/8d4c68176fa54a5bf07893d8029fd1315f37edf9}
}

@misc{ma2026when,
  title = {{When Skills Meet Safety: Benchmarking and Characterizing the Adaptive Jailbreak Robustness of Skill-Merged LLMs}},
  author = {Yu Ma and Hongli Shi and Jing Li and Xinran Xu and Weiwei Hou},
  year = {2026},
  month = aug,
  eprint = {2608.08542},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/4ef3b426aaf844b65a8b487baa1a87b1aec4c55e}
}

@article{alhamzawi2026realtime,
  title = {{Real-Time Detection and Mitigation of Prompt Injection Attacks in LLM-Integrated Enterprise Systems}},
  author = {Fatimah Alhamzawi},
  year = {2026},
  month = aug,
  journal = {Al-Noor Journal of Engineering Management and Computer Science},
  doi = {10.71229/5cn8a439},
  url = {https://www.semanticscholar.org/paper/2c13db4c47d1eb3e3184dffedb8ff84130ba8297}
}

@misc{mohajeransari2026distilling,
  title = {{Distilling Vision-Language Models for Robust Traffic Sign Perception in Autonomous Vehicles}},
  author = {Pedram MohajerAnsari and Amir Salarpour and Mert D. Pesé},
  year = {2026},
  month = aug,
  eprint = {2608.08815},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/2b667cc2121abfa5bb11c1d1af9c50046c5bc69f}
}

@inproceedings{yan2026efficient,
  title = {{Efficient and Differentially Private Federated LLM Fine-Tuning on Heterogeneous Clients}},
  author = {Nan Yan and Yu-Qing Li and Xiong Wang and Jing Chen and Wei Wang and Kun He and Ruiying Du and Shuhua Li},
  year = {2026},
  month = aug,
  booktitle = {Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2},
  doi = {10.1145/3770855.3817914},
  url = {https://www.semanticscholar.org/paper/e07ea3aaf72821d49acb1c5174f80cabeb43b1c1}
}

@inproceedings{zhang2026simugov,
  title = {{SimuGov: A Simulation Optimization Framework for Generative AI Governance Strategy Design}},
  author = {Bingxue Zhang and Jinbiao Li and Q. Tang and Feida Zhu},
  year = {2026},
  month = aug,
  booktitle = {Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2},
  doi = {10.1145/3770855.3818903},
  url = {https://www.semanticscholar.org/paper/bc0b9d2566ae15ad56fe3cb6824594d0646d44ce}
}

@misc{luo2026queryonly,
  title = {{Query-Only Backdoor Attacks on Self-Evolving Skills via Trajectory Poisoning}},
  author = {Yuyang Luo and Haoran Wang and Kai Shu},
  year = {2026},
  month = aug,
  eprint = {2608.08303},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/b4119fc7267c95cfc9c974be181981e520e73a64}
}

@inproceedings{su2026activationbackdoor,
  title = {{ActivationBackdoor: Backdooring Large Language Models in Collaborative Inference via Intermediate Activations}},
  author = {Zichun Su and Mi Zhang and Xiaohan Zhang and Geng Hong and Xiaoyu You and Min Yang},
  year = {2026},
  month = aug,
  booktitle = {Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2},
  doi = {10.1145/3770855.3818136},
  url = {https://www.semanticscholar.org/paper/2c995168767f95b6d21697890d1d372354864e8e}
}

@inproceedings{lin20262nd,
  title = {{The 2nd SeT-LLM Workshop on Secure and Trustworthy Large Language Models}},
  author = {Lu Lin and Jinghui Chen and Ting Wang and Jieyu Zhao and Chaowei Xiao and Jian Kang and Michael Johnston},
  year = {2026},
  month = aug,
  booktitle = {Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2},
  doi = {10.1145/3770855.3818247},
  url = {https://www.semanticscholar.org/paper/29d67405e278415b6e1ce58cab820c84cc22ee0c}
}

@inproceedings{jain2026shifting,
  title = {{Shifting the Unit of Safety: From Model to System in the Generative and Agentic Era}},
  author = {Sakshi Jain},
  year = {2026},
  month = aug,
  booktitle = {Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2},
  doi = {10.1145/3770855.3818635},
  url = {https://www.semanticscholar.org/paper/2824a603d456763cbae13f3650fcf785565615ce}
}

@article{simoes2026design,
  title = {{Design of a Security Framework for Multi-Agent Systems Based on Model Context Protocol in SOC Environments}},
  author = {Rodrigo Tavares de Pina Simões and Xavier Larriva-Novo and Carmen Sánchez-Zas and V. A. Villagrá and Andrés I. Marín López},
  year = {2026},
  month = aug,
  journal = {Applied Sciences},
  doi = {10.3390/app16167915},
  url = {https://www.semanticscholar.org/paper/0817f247f0d795c3fd996bdb21e7ab0c3d23f942}
}

@misc{obidov2026genotypic,
  title = {{Genotypic Triggers: Exposing Pharmacogenomic Blind Spots via Host-Specific Backdoors in Generative Antimicrobial Peptide Models}},
  author = {Doniyorkhon Obidov and Xiaolong Guo and Yonghui Li and Kaichen Yang},
  year = {2026},
  month = aug,
  eprint = {2608.06779},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f250e6ba3527d4ead098d1ab488168ec45a147d3}
}

@article{wang2026trustworthy,
  title = {{Trustworthy Deployment of LLM-Based RAG Systems for Small Businesses: A Security and Confidence-Aware Framework †}},
  author = {Qingqing Wang and Jiazhu Xie and Bowen Li and Zi-Qi Xu and Fengling Han},
  year = {2026},
  month = aug,
  journal = {Pragmatic Cybersecurity},
  doi = {10.53941/pc.2026.100008},
  url = {https://www.semanticscholar.org/paper/c5aa804b63c29e3fcd6f7889f9086b2ef7aae71b}
}

@misc{sun2026adversarial,
  title = {{Adversarial Attacks on Deep OCR Systems}},
  author = {Wenbo Sun and Hong-Zong Li and Yanyun Wang and Jia-Hao Ma and Shuxin Zhuang and Rong Feng and Shi-Qin Tang and Zi Liang},
  year = {2026},
  month = aug,
  eprint = {2608.07636},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/949627af3c2bcd16e81a3c0d9d82bf097b7b3bce}
}

@misc{alam2026taxonomydriven,
  title = {{Taxonomy-Driven Analysis of Open-Source AI Risk Mitigation Tools}},
  author = {Afreen Alam and Evgenija Popchanovska and Ana Gjorgjevikj and Maryan Rizinski and Lubomir T. Chitkushev and Irena Vodenska and D. Trajanov},
  year = {2026},
  month = aug,
  eprint = {2608.07446},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/7365f517104b178e74f24b901798d81561b121c8}
}

@misc{susser2026from,
  title = {{From Forensics to Ecosystems: Rethinking Watermarks for Generative AI Oversight}},
  author = {Daniel Susser and John Thickstun and Gili Vidan},
  year = {2026},
  month = aug,
  eprint = {2608.07337},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/4cc1dd3b77617cf5304e9c05b428d788bc7651e5}
}

@misc{obidov2026lorascan,
  title = {{LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes}},
  author = {Doniyorkhon Obidov and H. Yu and Xiaolong Guo and Kaichen Yang},
  year = {2026},
  month = aug,
  eprint = {2608.06795},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/449779b572b8bdb28df60a03ccc7c18a432b738c}
}

@misc{dumitrescu2026diffusion,
  title = {{Diffusion LLMs as Targets and Adversaries: Mechanistic Safety Exploits}},
  author = {Elena Dumitrescu and G. Lek and L. Chen and Jérémie Decouchant},
  year = {2026},
  month = aug,
  eprint = {2608.07430},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/2a8e104fe0ef6e996a4f062e059d99aec114f88a}
}

@misc{kulce2026echo,
  title = {{ECHO: A Locally-Deployable Agentic Health Assistant with Temporal Memory, Safety Guardrails, and Speech Assessment}},
  author = {Abdulkadir Külçe and A. Esen and Cağla Fikir and Berker Kurt and Kuzey Arar and Gökhan Ercan and F. B. Tek},
  year = {2026},
  month = aug,
  eprint = {2608.06110},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d2edc092c9b3cb3ad5ef8c7157b31532c10aa263}
}

@misc{zhang2026mmaligner,
  title = {{MMAligner: Safeguarding Multimodal Large Language Models through Representation Calibration}},
  author = {Shenyi Zhang and Keyan Guo and Zihao Wang and Xuebin Li and Lingchen Zhao and Hongxin Hu and Chao Shen and Qian Wang},
  year = {2026},
  month = aug,
  eprint = {2608.05909},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/c3be36d17b18c2decb13515aef81d47f81e3366a}
}

@misc{samarakoon2026hijacking,
  title = {{Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots}},
  author = {S. Samarakoon and M. A. V. J. Muthugala and W. K. R. Sachinthana and M. R. Elara},
  year = {2026},
  month = aug,
  eprint = {2608.05715},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/3fa9e3ec5f9b01ff3e61b01227b43db042194334}
}

@misc{zhang2026promptshield,
  title = {{PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents}},
  author = {He Zhang and Fei-Long Li and Ding-Ning Long and Yi Cui and Peijun Zhang and Yue-Wen Zhang and Qianyao Xu and Xinyi Fu},
  year = {2026},
  month = aug,
  eprint = {2608.05495},
  archivePrefix = {arXiv},
  doi = {10.1145/3798063.3837198},
  url = {https://www.semanticscholar.org/paper/30d00b2862a54156f390d455743bd002230cb3bb}
}

@misc{lin2026dreamguard,
  title = {{DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model}},
  author = {Wenhao Lin and Chen Yu and Xingwei Lin and Sicong Cao and Xiang Chen and Lei Xue and Le Yu and Letian Sha and Chunming Wu},
  year = {2026},
  month = aug,
  eprint = {2608.05695},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/0e72e0b12ecf4eb87226b876a02999df62ca4a33}
}

@misc{xiao2026worldmark,
  title = {{WorldMark: A Plug-and-Play World Knowledge Interface for Cross-Host Language Model Watermarking}},
  author = {Song Xiao and Yuqi Yuan and Yanshuo Zhang and Ke-Jun Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.06416},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f27392e958e852d0478471dec6f7c049b1a98cee}
}

@misc{masukawa2026trident,
  title = {{Trident : How to Break Deep Reinforcement Learning Cyber Defenses (Agentic)}},
  author = {Ryozo Masukawa and Ian Bryant and Armita Kazeminajafabadi and Sanggeon Yun and Hyunwoo Oh and Sungheon Jeong and Nathaniel D. Bastian and Mahdi Imani and Mohsen Imani},
  year = {2026},
  month = aug,
  eprint = {2608.04317},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f113cf61f49b1f85a1e9dc20d3d4e42a00917f68}
}

@misc{klerings2026mood,
  title = {{Mood Matters: How Syntactic Sensitivity Undermines Safety Alignment}},
  author = {Alina Klerings and Jannik Brinkmann and Heiner Stuckenschmidt and Simone Ponzetto},
  year = {2026},
  month = aug,
  eprint = {2608.05409},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/d6d288940807fdef4800e0acdb1b2c14e657baed}
}

@article{francis2026cognitive,
  title = {{The cognitive mechanism: safeguarding the future of immunological discovery in the GenAI era}},
  author = {Nigel J. Francis and David P. Smith},
  year = {2026},
  month = aug,
  journal = {Discovery Immunology},
  doi = {10.1093/discim/kyag016},
  url = {https://www.semanticscholar.org/paper/c8ec4963ee5131120cf502dbcb8d7c5c9821fab3}
}

@misc{zhang2026datarx,
  title = {{DataRx: Missingness-Aware Sampling for Safer Large Language Model Task-Specific Fine-Tuning}},
  author = {Junbo Zhang and Qian-Li Zhou and Xin-Yang Deng and Wen Jiang},
  year = {2026},
  month = aug,
  eprint = {2608.04322},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/821fc65cadf063781de7fa906391711eba1c8374}
}

@misc{zhu2026ico,
  title = {{ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization}},
  author = {Hujian Zhu and Yihao Huang and Felix Juefei-Xu and Xinfeng Li and Peng Zeng and Simeng Qin and Qing Guo and G. Pu},
  year = {2026},
  month = aug,
  eprint = {2608.03210},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f6f8fcc18350b6b6d2f859b383e0327b136d7d93}
}

@misc{fu2026dhmark,
  title = {{DHMark: Public-Key Watermarking for LLM-Generated Text via Diffie-Hellman-Guided Rejection Sampling}},
  author = {Haocheng Fu and Yuqi Qian and Luyao Wang and Yun Cao},
  year = {2026},
  month = aug,
  eprint = {2608.03093},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/f608d33b9ba8096c43e1c197f358157014cdcea7}
}

@article{ni2026pervasive,
  title = {{Pervasive Backdoor Vulnerabilities in Genomic Foundation Models}},
  author = {Shiwen Ni and Qianning Wang and Chi Wei and Xiaomin Ni and Shuai-Min Li and Zixin Zhao and Hui Li and Rongrong Ji and Teng Wang and Min Yang},
  year = {2026},
  month = aug,
  journal = {bioRxiv},
  doi = {10.64898/2026.07.30.741642},
  url = {https://www.semanticscholar.org/paper/9a304471e350bc4004450beaf57b8eead3676e2b}
}

@misc{zhao2026maltotal,
  title = {{MalTotal: Cost-Effective and Language-Agnostic Malicious Code Poisoning Detection for Millions of Repositories}},
  author = {Jian Zhao and Shenao Wang and Qingyang Wu and Yanjie Zhao and Xiao Cheng and Hao-Yu Wang},
  year = {2026},
  month = aug,
  eprint = {2608.03232},
  archivePrefix = {arXiv},
  doi = {10.1145/3832228},
  url = {https://www.semanticscholar.org/paper/4ab91ee574adb3a457dd6e506a4cd327af5a1fd1}
}

@misc{huang2026attributebased,
  title = {{Attribute-based Undetectable Watermarking for Generative AI Models}},
  author = {Mi-Ying Huang and Chung-Wei Lee and Maximilian Raffel and Eric Tang},
  year = {2026},
  month = aug,
  eprint = {2608.03174},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/22b014d8b34c436dd36d1d6f95c2702661e6c876}
}

@misc{vaidya2026when,
  title = {{When Many Answers Are Valid, Voting Fails: Symbolic Verification for Best-of-K Causal Reasoning in LLMs}},
  author = {Omatharv Bharat Vaidya and C. Jerzak and Zayne Sprague and Fangcong Yin and N. Hồ},
  year = {2026},
  month = aug,
  eprint = {2608.03506},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/1fd04580be300512828ad334c3a57df3a7b06a63}
}

@misc{wang2026weclawarena,
  title = {{WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networks}},
  author = {P. Wang and Ao-Jie Yuan and Haiyu Zhang and Xi-Yang Hu and Yue Zhao and Shuli Jiang},
  year = {2026},
  month = aug,
  eprint = {2608.03499},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/1cdb58ea64b231ab64a0e542ad7c793814345ad2}
}

@misc{zhang2026whenb,
  title = {{When Agentic Executions Fail: Detecting and Localizing Runtime Faults from Telemetry}},
  author = {Chenkai Zhang and Yiran Li and Yifang Tian and Michalis Bachras and Hans-Arno Jacobsen},
  year = {2026},
  month = aug,
  eprint = {2608.14680},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/12ee9654cd5677de7f8cd2ecff7ad773b3f779a8}
}

@misc{thapa2026sok,
  title = {{SoK: How Frontier AI Reshapes System-Level Security Risk Dynamics in Critical Infrastructure}},
  author = {C. Thapa and Mohan Baruwal Chhetri and M. Grobler and Shahroz Tariq and Tooba Aamir},
  year = {2026},
  month = aug,
  eprint = {2608.04033},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/93c0882ee73a87235659637c1d1d59d0c14e83cd}
}

@misc{lin2026salami,
  title = {{Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw}},
  author = {Zheng Lin and Yuzhen Huang and Zhenxing Niu and Xianmin Ye and Haichang Gao},
  year = {2026},
  month = aug,
  eprint = {2608.01637},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/78a6fa7c6a59bb5fe8b4337b6f1b3d9b7b69328b}
}

@misc{park2026eduzone,
  title = {{EduZone: A Framework for Evaluating LLM Safety for K-12 Students and Teachers}},
  author = {Junyeong Park and Jieun Han and Haneul Yoo and So-Yeon Ahn and Jinsung Yoon and Alice Oh},
  year = {2026},
  month = aug,
  eprint = {2608.02024},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/47e31fb7f693f63e6050538d45dc148cb863e76e}
}

@misc{zhang2026invisible,
  title = {{Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents}},
  author = {Jia-Chen Zhang and Zenghui Zhang and Kai-Wei Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.02018},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/452f5a76b8c18e0d4886e1aea1b1fa95201178ab}
}

@misc{wang2026advancing,
  title = {{Advancing Relevance Measurement with Vision-Language Models for Web-Scale Search}},
  author = {Han Wang and Alex P. Whitworth and Pak-Ming Cheung and Zhenjie Zhang and Krishna Kamath and Xi Chen and Roberto Konow and Kurchi Subhra Hazra},
  year = {2026},
  month = aug,
  eprint = {2608.02446},
  archivePrefix = {arXiv},
  doi = {10.1145/3773078.3831891},
  url = {https://www.semanticscholar.org/paper/07bc043030832c7a90b135a17b052ac818a21920}
}

@misc{jin2026inverting,
  title = {{Inverting the Hidden: Unveiling Multimodal Privacy Leakage in Collaborative LVLM Inference}},
  author = {Shuaifan Jin and Zhibo Wang and Qiyuan Wang and Yiting Han and Yajie Zhou and Yuanfan Zhang and Jiahui Hu and Xiaoyi Pang},
  year = {2026},
  month = aug,
  eprint = {2608.01020},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/887f61b15e19ba216107ce815c972613e659e020}
}

@misc{xiao2026when,
  title = {{When Collaboration Becomes a Trigger: Collective Evidence-Threshold Backdoors in Multi-Agent Systems}},
  author = {Jiahao Xiao and Lei Feng and Min-Ling Zhang},
  year = {2026},
  month = aug,
  eprint = {2608.01085},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/721e0bc978010a3cb051e3bc43537d30dddcc811}
}

@inproceedings{mahadevaswamy2026securing,
  title = {{Securing agentic AI workflows: A defence-in-depth framework for autonomous systems}},
  author = {Sushma Mahadevaswamy},
  year = {2026},
  month = aug,
  booktitle = {International Conference on Cyber Security And Protection Of Digital Services},
  doi = {10.69554/miwg3713},
  url = {https://www.semanticscholar.org/paper/4e564ab7616c533887366a8634d3e255008bb4f7}
}

@misc{zhurekbay2026denialrag,
  title = {{DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial}},
  author = {Abay Zhurekbay and Tao Liu and Fan Li},
  year = {2026},
  month = aug,
  eprint = {2608.02678},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/498d48436d075c7046441802b9b23026a318c81a}
}

@article{oluwasegun2026d2annrl,
  title = {{D2ANN-RL: Defense-in-Depth ANN-Reinforcement Learning Framework for LLM Chatbot Code Injection Mitigation}},
  author = {Victor Omoboye Oluwasegun and O. Falebita and N. Adebola and V. Adekunle and D. Uzodinma and Toluhi Michael Lanre and D. Oyekunle and Chima-Duru Goodness Goziechukwu and Ugochukwu Okwudili Matthew},
  year = {2026},
  month = aug,
  journal = {Scientific Journal of Computer Science},
  doi = {10.64539/sjcs.v2i2.2026.506},
  url = {https://www.semanticscholar.org/paper/3213aa8ef5781dfbbcb9a0083de588fa3ae69e42}
}

@article{sun2026efficient,
  title = {{Efficient and Privacy-Preserving Federated Knowledge Learning for Distributed LLM}},
  author = {Wei Sun and Xianda Wang and Zhicheng Liang and Tianyi Gong and Wanshun Lan and Yingchun Chen and Haoyue Li and Fangxin Wang},
  year = {2026},
  month = aug,
  journal = {IEEE Transactions on Mobile Computing},
  doi = {10.1109/TMC.2026.3674545},
  url = {https://www.semanticscholar.org/paper/f85d3d9c7b08f2e213a1e5c4d37b9256ead2f4a7}
}

@article{li2026semanticoriented,
  title = {{Semantic-Oriented Robust Sentence Level Text Watermark for Large Language Models}},
  author = {Bo Li and Kun Zhang and Chengyou Song and Xi Chen and Hailin Zhou and Richang Hong},
  year = {2026},
  month = aug,
  journal = {IEEE Transactions on Computational Social Systems},
  doi = {10.1109/TCSS.2026.3687267},
  url = {https://www.semanticscholar.org/paper/de0e56e50fc26303b1d9b0a7362e5a2eda32334a}
}

@article{ma2026visionlanguage,
  title = {{Vision-Language Semantics Guided Model Extraction Attack via Long-Horizon Contrastive Prompt Learning}},
  author = {Ruinan Ma and Yu-Xi Ma and Meng-Xia Ren and Dehua Zhu and Hong-Yi Liu and Yu-an Tan},
  year = {2026},
  month = aug,
  journal = {Journal on spesial topics in mobile networks and applications},
  doi = {10.1007/s11036-026-02503-x},
  url = {https://www.semanticscholar.org/paper/d3068d4e9c55130f89ec16031e0d8345c7e162d4}
}

@inproceedings{ponsam2026optimizing,
  title = {{Optimizing Secure AI Lifecycle Model Management with Innovative Generative AI Strategies}},
  author = {J. Ponsam and Nalam Siva Bhadra and Jai Kushal Bysani},
  year = {2026},
  month = aug,
  booktitle = {International Conference on Circuit, Power and Computing Technologies},
  doi = {10.1109/ICCPCT70290.2026.11654982},
  url = {https://www.semanticscholar.org/paper/c0f75885aa7e236c348c050ddcefdd3cb8488126}
}

@inproceedings{debi2026whispers,
  title = {{Whispers of Wealth: A Systematic Red-Teaming Study of the Agent Payments Protocol (AP2)}},
  author = {Tanusree Debi and Wentian Zhu},
  year = {2026},
  month = aug,
  booktitle = {2026 International Conference on Intelligent Multimedia, Networking, and Security (IMNS)},
  doi = {10.1109/IMNS67862.2026.11655291},
  url = {https://www.semanticscholar.org/paper/ad5348c7ef25e740afae709cb6bd799d38b5d7ab}
}

@inproceedings{zaman2026evaluating,
  title = {{Evaluating Prompt Injection Risk and Guardrails in LLM-Enabled Home IoT Assistants}},
  author = {Shazid Bin Zaman and Sohan Gyawali and C. Popoviciu and Yi-Li Jiang and Jiaqi Huang},
  year = {2026},
  month = aug,
  booktitle = {2026 International Conference on Intelligent Multimedia, Networking, and Security (IMNS)},
  doi = {10.1109/IMNS67862.2026.11655283},
  url = {https://www.semanticscholar.org/paper/a374a751e5fd33edaee8fdcabeac3ef8f5ea590d}
}

@article{you2026unibreak,
  title = {{UniBreak: A Unified Evolutionary Token-Level Jailbreaking Framework for Large Language Models}},
  author = {Shen You and Wei Jiang and Hefei Mei and Danei Gong and Zhongshen Li and Jixang Yu and Jun-Kai Ji and Qiuzhen Lin and Xiangtao Li and Ka-chun Wong},
  year = {2026},
  month = aug,
  journal = {IEEE Transactions on Evolutionary Computation},
  doi = {10.1109/TEVC.2026.3656951},
  url = {https://www.semanticscholar.org/paper/9b896fafa251bd1edf23469a7b625b9dbf768770}
}

@article{knowlton2026promptbased,
  title = {{Prompt-Based Jailbreaking of Leading LLM Chatbots: A Survey of Attacks and Defenses}},
  author = {Brynn Knowlton and Jovani Campa and Davide Gallo and Khalil Dajani and Nabeel Alzahrani},
  year = {2026},
  month = aug,
  journal = {IEEE Transactions on Artificial Intelligence},
  doi = {10.1109/TAI.2026.3665656},
  url = {https://www.semanticscholar.org/paper/9b0b450d7b38f5524e7e6a0aad293f3a521be348}
}

@article{leon2026governing,
  title = {{Governing generative AI in organizations: a design theory and quasi-experimental field study of sociotechnical guardrails}},
  author = {Maikel Leon},
  year = {2026},
  month = aug,
  journal = {Journal of Supercomputing},
  doi = {10.1007/s11227-026-08760-7},
  url = {https://www.semanticscholar.org/paper/955a0cafb871b88276f7ce9fde7b1bf0a2f68fdf}
}

@article{han2026multigranularity,
  title = {{Multigranularity Adversarial Attacks on Large Language Models Using Genetic Programming}},
  author = {Wencheng Han and Hao Li and Maoguo Gong and Yu Zhou and Yue Wu and A. Qin and Lining Xing},
  year = {2026},
  month = aug,
  journal = {IEEE Transactions on Evolutionary Computation},
  doi = {10.1109/TEVC.2025.3629409},
  url = {https://www.semanticscholar.org/paper/8d3e15cda73e865ccfc8867d11be8352fd8a00d9}
}

@misc{xiong2026mapleguard,
  title = {{MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems}},
  author = {Wen-Jun Xiong and Yi-Jin Zhou and Jia-Qian Wang and Shangding Gu and Bo Tang and Zhiyu Li and Feiyu Xiong and Ying Wen and Muning Wen},
  year = {2026},
  month = aug,
  eprint = {2608.00426},
  archivePrefix = {arXiv},
  url = {https://www.semanticscholar.org/paper/758e18c7614f494fe9e97fa9c1eaeb32b4063d1f}
}

@article{wu2026comparative,
  title = {{A Comparative Survey of Security Risks in AI Systems: From LLMs to AI Agents and Embodied Agents}},
  author = {Baiqi Wu and Qing-Ming Li and Chun-Yi Zhou and Ting Wang and Shoulin Ji},
  year = {2026},
  month = aug,
  journal = {ACM Computing Surveys},
  doi = {10.1145/3837083},
  url = {https://www.semanticscholar.org/paper/6f3e92cf87e0f99a22425e710009a51958baf627}
}

@article{bao2026cpm,
  title = {{C-P\&M: Unified cross-prompt and cross-model adversarial attack on multimodal large language models}},
  author = {Qiqi Bao and Yujie Yan and Xiaoguo Ding and Yaguan Qian and Zhao-Quan Gu and Shou-Ling Ji and Bin Wang},
  year = {2026},
  month = aug,
  journal = {Neurocomputing},
  doi = {10.1016/j.neucom.2026.134821},
  url = {https://www.semanticscholar.org/paper/584885c7d054f13acccd69f11ba3242219e56903}
}

@inproceedings{thaiprayoon2026medcouncil,
  title = {{MedCouncil: A Debate-Enabled Multi-Agent Framework for Second-Opinion Clinical Decision Support in General Internal Medicine}},
  author = {Santipong Thaiprayoon and Phattharat Songthung},
  year = {2026},
  month = aug,
  booktitle = {2026 7th International Conference on Big Data Analytics and Practices (IBDAP)},
  doi = {10.1109/IBDAP69915.2026.11677991},
  url = {https://www.semanticscholar.org/paper/583373a0f86af92dd2097140781a7c8e4c37519b}
}

@article{zhao2026semanticaware,
  title = {{Semantic-aware watermarking with adaptive injection for large language models}},
  author = {Jing Zhao and Hongwei Yang and Heng-Ji Dong and Hui He and Wei-Zhe Zhang and Haoyu Xu},
  year = {2026},
  month = aug,
  journal = {Knowledge-Based Systems},
  doi = {10.1016/j.knosys.2026.116904},
  url = {https://www.semanticscholar.org/paper/51e6f9505f72ec24c2dc1a87880a363af2ccb9b5}
}

@article{cao2026hfavl,
  title = {{HFAVL: Hard-Label Fusion Attack Toward Vision-Language Model}},
  author = {Hongbo Cao and Yongqi Sun and Li Duan and Yifan Sui and Xisu Wang},
  year = {2026},
  month = aug,
  journal = {IEEE Internet of Things Journal},
  doi = {10.1109/JIOT.2026.3694181},
  url = {https://www.semanticscholar.org/paper/2e81df9a879be060866efffa59cd5fec618d8afe}
}

@article{cassai2026prompt,
  title = {{Prompt injection compromises large language model-based peer review: evidence from randomised controlled trial abstracts from anaesthesia journals.}},
  author = {A. de Cassai and B. Dost and E. Pistollato and F. Zarantonello and A. Boscolo and P. Navalesi},
  year = {2026},
  month = aug,
  journal = {British Journal of Anaesthesia},
  doi = {10.1016/j.bja.2026.06.041},
  url = {https://www.semanticscholar.org/paper/194174119a6ea4cc018234397d662d9d3c78673b}
}

@inproceedings{ding2026analyzing,
  title = {{Analyzing Structural and Semantic Barriers to Automated Adversary Emulation in Active Directory}},
  author = {Anita Ding and Anthony J. Rose and Mark G. Reith},
  year = {2026},
  month = aug,
  booktitle = {National Aerospace and Electronics Conference},
  doi = {10.1109/NAECON70028.2026.11675755},
  url = {https://www.semanticscholar.org/paper/183de1e3c5e49190a7e327d47f55739e55b4be4f}
}

@article{ponduru2026safehealcloud,
  title = {{SAFE-HealCloud: Safety-Aware, Agentic Self-Healing for Cloud Infrastructure}},
  author = {Prudvi Saisaran Ponduru and Pavani Priya Vyshnavi Nandanavanam and S. Ponduru},
  year = {2026},
  month = aug,
  journal = {International Journal of Scientific Research in Computer Science Engineering and Information Technology},
  doi = {10.32628/cseit26124220},
  url = {https://www.semanticscholar.org/paper/04f39380622596e2b33cc72708c6b18dc8b0fb27}
}

@misc{flynn2026cognitive,
  title = {{Cognitive Integrity Security: Securing Human-AI Interaction in Large Language Model Systems}},
  author = {David C. Flynn},
  year = {2026},
  month = mar,
  doi = {10.22541/au.177437389.95026495/v1},
  url = {https://doi.org/10.22541/au.177437389.95026495/v1}
}

@article{eltayeb2026security,
  title = {{Security Risk Assessment and Layered Protection Strategies for Large Language Model Banking Chatbots with Privacy Considerations}},
  author = {Galal Eltayeb and Abdalilah Alhalangy},
  year = {2026},
  month = jul,
  journal = {The Scholar Journal for Sciences \& Technology},
  doi = {10.53348/jsst5st8},
  url = {https://doi.org/10.53348/jsst5st8}
}

@misc{kang2026not,
  title = {{Not All Large Language Model Deployments Are Created Equal: A Taxonomy-Driven Survey of Security, Defense, and Governance}},
  author = {Nathaniel Kang and Jongho Im},
  year = {2026},
  doi = {10.2139/ssrn.6837687},
  url = {https://doi.org/10.2139/ssrn.6837687}
}

@article{chen2026heteroguard,
  title = {{HeteroGuard: Constructing Safety Boundaries for Large Language Models via Heterogeneous Weak-Model Collaboration}},
  author = {Ping Chen and Yin Cai and Shuting Zhang and Yi Wang and Xingqiu Shen and Yuting Shang and Hong Zou},
  year = {2026},
  month = jul,
  journal = {Security and Safety},
  doi = {10.1051/sands/2026018},
  url = {https://doi.org/10.1051/sands/2026018}
}

@misc{schwarz2025countermind,
  title = {{Countermind: A Multi-Layered Security Architecture for Large Language Models}},
  author = {Dominik Schwarz},
  year = {2025},
  month = oct,
  doi = {10.36227/techrxiv.175994550.08962082/v1},
  url = {https://doi.org/10.36227/techrxiv.175994550.08962082/v1}
}

@article{mahavratayajula2026unified,
  title = {{Unified AI Security Posture Management Framework for Multi-Cloud Large Language Model Deployments}},
  author = {Vaishali Mahavratayajula},
  year = {2026},
  month = may,
  journal = {International Journal of Computational and Experimental Science and Engineering},
  doi = {10.22399/ijcesen.5279},
  url = {https://doi.org/10.22399/ijcesen.5279}
}

@misc{luna2026security,
  title = {{Security and Safety Threats in the Large Language Model Supply Chain: A Systematic Survey and Taxonomy}},
  author = {Jose Luna and Lili Quan and Ivan Tan and Lingxiao Jiang and Ming Hu and Qiang Hu and Xiaofei Xie},
  year = {2026},
  doi = {10.2139/ssrn.6327419},
  url = {https://doi.org/10.2139/ssrn.6327419}
}

@article{zhang2025safety,
  title = {{A Safety and Security-Centered Evaluation Framework for Large Language Models via Multi-Model Judgment}},
  author = {Jinxin Zhang and Yunhao Xia and Hong Zhong and Weichen Lu and Qingwei Deng and Changsheng Wan},
  year = {2025},
  month = dec,
  journal = {Mathematics},
  doi = {10.3390/math14010090},
  url = {https://doi.org/10.3390/math14010090}
}

@misc{r2026basilisk,
  title = {{Basilisk: An Evolutionary AI Red-Teaming Framework for Systematic Security Evaluation of Large Language Models}},
  author = {Regaan R},
  year = {2026},
  doi = {10.2139/ssrn.6373439},
  url = {https://doi.org/10.2139/ssrn.6373439}
}

@misc{schwarz2025unvalidated,
  title = {{Unvalidated Trust: Cross-Stage Vulnerabilities in Large Language Model Architectures}},
  author = {Dominik Schwarz},
  year = {2025},
  month = nov,
  doi = {10.36227/techrxiv.176231660.07863161/v1},
  url = {https://doi.org/10.36227/techrxiv.176231660.07863161/v1}
}

@misc{viana2026secure,
  title = {{Secure Prompt Engineering: A Practical Framework for Mitigating Prompt Injection and Data Leakage in LLM-based Systems}},
  author = {Gustavo Viana},
  year = {2026},
  doi = {10.2139/ssrn.6956641},
  url = {https://doi.org/10.2139/ssrn.6956641}
}

@misc{waheed2026beyond,
  title = {{Beyond Prompt Injection: Trust-Boundary Security Assurance for LLM-Integrated and Agentic Applications}},
  author = {Nazar Waheed},
  year = {2026},
  month = sep,
  doi = {10.21203/rs.3.rs-10798245/v1},
  url = {https://doi.org/10.21203/rs.3.rs-10798245/v1}
}

@misc{r2026contrastshield,
  title = {{ContrastShield: A Contrastive Fine-Tuning Approach for Robust Prompt Injection Detection in LLM Pipelines}},
  author = {Swethaa R},
  year = {2026},
  doi = {10.2139/ssrn.6645520},
  url = {https://doi.org/10.2139/ssrn.6645520}
}

@misc{somro2026llmpowered,
  title = {{LLM-powered SOC Assistants: Prompt Injection Risks in Threat Triage}},
  author = {Tayyeb Nadeem Somro and Bilal Arshad and Ammara Gul},
  year = {2026},
  doi = {10.2139/ssrn.7179658},
  url = {https://doi.org/10.2139/ssrn.7179658}
}

@misc{sharma2026containment,
  title = {{Containment over Detection: Cryptographic Boundary Enforcement for Prompt Injection Defense in Agentic LLM Systems}},
  author = {Saurabh Sharma},
  year = {2026},
  month = jul,
  doi = {10.21203/rs.3.rs-10196595/v1},
  url = {https://doi.org/10.21203/rs.3.rs-10196595/v1}
}

@misc{sheoran2026pidl,
  title = {{PIDL: A Prompt Injection Detection Layer for LLM-Integrated Web Applications via Multi-Signal Semantic Analysis}},
  author = {Jigesh Sheoran},
  year = {2026},
  doi = {10.2139/ssrn.6739079},
  url = {https://doi.org/10.2139/ssrn.6739079}
}

@misc{singh2026graphshield,
  title = {{GraphShield: A Graph-Structured Defense Framework for Prompt Injection in RAG and Multi-Agent LLM Systems}},
  author = {Shreya Singh},
  year = {2026},
  doi = {10.2139/ssrn.7082874},
  url = {https://doi.org/10.2139/ssrn.7082874}
}

@article{danileiko2026formal,
  title = {{Formal Operational Models for Protecting Web Interfaces of Legal LLM Systems from Prompt Injection and Insecure Output Handling}},
  author = {Grigorii Danileiko},
  year = {2026},
  month = may,
  journal = {International Journal of Advanced Artificial Intelligence Research},
  doi = {10.55640/ijaair-v03i05-03},
  url = {https://doi.org/10.55640/ijaair-v03i05-03}
}

@misc{arulljothi2026agentforensics,
  title = {{AgentForensics: Exploring the Real-Time Prompt Injection Detection and Forensics Threats in LLM Agents}},
  author = {Aparnaa Mahalaxmi Arulljothi and Theepan Kumar Gandhi},
  year = {2026},
  doi = {10.2139/ssrn.6589479},
  url = {https://doi.org/10.2139/ssrn.6589479}
}

@misc{myet2026guardrailrs,
  title = {{guardrail-rs A Fail-Open Reverse Proxy for Prompt-Injection Defense and PII Redaction in LLM Applications}},
  author = {Min Htet Myet},
  year = {2026},
  month = jul,
  doi = {10.21203/rs.3.rs-10354224/v1},
  url = {https://doi.org/10.21203/rs.3.rs-10354224/v1}
}

@misc{kim2026datadriven,
  title = {{Data-Driven Persona Generation via Structured Analysis and LLM Prompt Injection: Comparing Analytical Method Selection and Combination Strategies}},
  author = {Yujin kim and Jaekwang Kim},
  year = {2026},
  doi = {10.2139/ssrn.7281659},
  url = {https://doi.org/10.2139/ssrn.7281659}
}

@misc{negrao2026fewaiserial,
  title = {{FEW-AI-SERIAL: A Domain-Agnostic Semantic Compression Protocol for LLM Prompt Injection and IoT Data Encoding}},
  author = {Vinícius Negrão and Maíra Bocci and Paulo Pitrez},
  year = {2026},
  doi = {10.2139/ssrn.6491958},
  url = {https://doi.org/10.2139/ssrn.6491958}
}

@misc{wang2026killchain,
  title = {{Kill-Chain Canaries: Stage-Level Tracking of Prompt Injection Across Attack Surfaces and Model Safety Tiers}},
  author = {Haochuan Wang and Zechen Zhang},
  year = {2026},
  doi = {10.2139/ssrn.6604918},
  url = {https://doi.org/10.2139/ssrn.6604918}
}

@article{shehmir2026rollmrec,
  title = {{RoLLMRec: a robust LLM-based recommender system for defending against shilling and prompt injection attacks}},
  author = {Sarama Shehmir and Rasha Kashef},
  year = {2026},
  month = mar,
  journal = {Frontiers in Computer Science},
  doi = {10.3389/fcomp.2026.1735253},
  url = {https://doi.org/10.3389/fcomp.2026.1735253}
}

@article{podpora2025llm,
  title = {{LLM Firewall Using Validator Agent for Prevention Against Prompt Injection Attacks}},
  author = {Michal Podpora and Marek Baranowski and Maciej Chopcian and Lukasz Kwasniewicz and Wojciech Radziewicz},
  year = {2025},
  month = dec,
  journal = {Applied Sciences},
  doi = {10.3390/app16010085},
  url = {https://doi.org/10.3390/app16010085}
}

@misc{pandey2026prompt,
  title = {{Prompt Injection Attacks Against Clinical LLM Agents Accessing Electronic Health Records: A Survey, Threat Model, Benchmark Specification, and Layered Defense Synthesis}},
  author = {Divya Pandey and Shivani Manchanda and Gangesh Pathak and Nishant Sonkar},
  year = {2026},
  doi = {10.2139/ssrn.6828838},
  url = {https://doi.org/10.2139/ssrn.6828838}
}

@article{gao2026continual,
  title = {{Continual Red-Teaming and Guardrail Distillation for Tool-Using LLM Agents: Prompt-Injection Resistance with Utility Preservation}},
  author = {Wesley Gao},
  year = {2026},
  month = jan,
  journal = {Stout in Computer Science and Technology Studies},
  doi = {10.61424/hewtat90},
  url = {https://doi.org/10.61424/hewtat90}
}

@article{zheng2026evoshield,
  title = {{EvoShield: Selective Test-Time Adaptation for Prompt Injection Detection via Active LLM Querying}},
  author = {Zanhong Zheng and Jieming Liang and Mengqin Hu and Yijuan Pei and Guobao Xu and Zhenlu Wu},
  year = {2026},
  month = may,
  journal = {Mathematics},
  doi = {10.3390/math14101719},
  url = {https://doi.org/10.3390/math14101719}
}

@misc{adhikari2026securing,
  title = {{Securing LLM Powered AI Browsers Against Prompt Injection: A Comprehensive Survey, Threat Taxonomy, and Defense Framework}},
  author = {Sabin Adhikari and Roshan Paudel and Dipesh Gautam and Sanjog Chhetri Sapkota and Biplab Dahal and Roshit Raj Paudel and Anupam Dhakal},
  year = {2026},
  doi = {10.2139/ssrn.6340078},
  url = {https://doi.org/10.2139/ssrn.6340078}
}

@inproceedings{reddy2025echoleak,
  title = {{EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System}},
  author = {Pavan Reddy and Aditya Sanjay Gujral},
  year = {2025},
  month = nov,
  booktitle = {Proceedings of the AAAI Symposium Series},
  doi = {10.1609/aaaiss.v7i1.36899},
  url = {https://doi.org/10.1609/aaaiss.v7i1.36899}
}

@article{anghel2026evalhack,
  title = {{EvalHack: Answer-Side Prompt Injection for Probing LLM Exam-Grading Panel Stability}},
  author = {Catalin Anghel and Marian Viorel Craciun and Adina Cocu and Andreea Alexandra Anghel and Antonio Stefan Balau and Adrian Istrate and Aurelian-Dumitrache Anghele},
  year = {2026},
  month = mar,
  journal = {Information},
  doi = {10.3390/info17030297},
  url = {https://doi.org/10.3390/info17030297}
}

@misc{bhatnagar2026prompt,
  title = {{PROMPT PERSISTENCE ATTACKS: LONG-TERM MEMORY POISONING IN LLM-BASED SYSTEMS}},
  author = {Pranav Bhatnagar},
  year = {2026},
  doi = {10.2139/ssrn.6183548},
  url = {https://doi.org/10.2139/ssrn.6183548}
}

@misc{saravi2026imageembedded,
  title = {{Image-embedded prompt injection vulnerability of vision-language models in dental radiology: a cross-vendor attack–defense evaluation}},
  author = {Babak Saravi and Daman Deep Singh and Lara Schorn and Andreas Vollmer and Christoph Sproll and Norbert Kübler and Felix Schrader},
  year = {2026},
  month = jul,
  doi = {10.21203/rs.3.rs-9932271/v1},
  url = {https://doi.org/10.21203/rs.3.rs-9932271/v1}
}

@misc{senanu2026artificial,
  title = {{Artificial Intelligence Security and Adversarial Machine Learning: Threat Models, Defensive Strategies, and Forensic Implications for Trustworthy AI Systems}},
  author = {James H. Senanu},
  year = {2026},
  doi = {10.2139/ssrn.6144306},
  url = {https://doi.org/10.2139/ssrn.6144306}
}

@article{llmsec202601352,
  title = {{Adversarial Machine Learning Threats To Medical Device AI Controllers}},
  author = {Venkata Sai Abhinav Piratla -},
  year = {2026},
  month = mar,
  journal = {International Journal of Innovative Research and Creative Technology},
  doi = {10.62970/ijirct.v12.i2.2604012},
  url = {https://doi.org/10.62970/ijirct.v12.i2.2604012}
}

@article{verma2026adversarial,
  title = {{Adversarial Machine Learning: Security Risks and Defense Strategies in AI-Driven Applications}},
  author = {Harsh Verma},
  year = {2026},
  journal = {International Journal of Scientific Research and Management (IJSRM)},
  doi = {10.18535/ijsrm/v14i02.ec04},
  url = {https://doi.org/10.18535/ijsrm/v14i02.ec04}
}

@article{sheikh2026overview,
  title = {{Overview of Adversarial AI and Data Poisoning in Federated Learning}},
  author = {Mohammed Firdos Alam Sheikh},
  year = {2026},
  month = feb,
  journal = {Advances in Computational Intelligence and Robotics},
  doi = {10.4018/979-8-3373-6224-3.ch002},
  url = {https://doi.org/10.4018/979-8-3373-6224-3.ch002}
}

@misc{tanveer2026adversarial,
  title = {{Adversarial Machine Learning: Attack Vectors, Defences, and Robustness}},
  author = {Rizwan Tanveer},
  year = {2026},
  doi = {10.2139/ssrn.6696178},
  url = {https://doi.org/10.2139/ssrn.6696178}
}

@article{pang2026adversarial,
  title = {{Adversarial Machine Learning: Attacks, Defenses, and the Path Towards Trustworthy AI}},
  author = {Jieyao Pang},
  year = {2026},
  month = jul,
  journal = {International Journal of Innovative Science and Research Technology},
  doi = {10.38124/ijisrt/26jun1631},
  url = {https://doi.org/10.38124/ijisrt/26jun1631}
}

@article{hellert2026osprey,
  title = {{Osprey: Production-ready agentic AI for safety-critical control systems}},
  author = {Thorsten Hellert and João Montenegro and Antonin Sulc},
  year = {2026},
  month = feb,
  journal = {APL Machine Learning},
  doi = {10.1063/5.0306302},
  url = {https://doi.org/10.1063/5.0306302}
}

@article{kumar2026enhancing,
  title = {{Enhancing Network Security through AI-Powered Anomaly Detection Using Generative Adversarial Networks}},
  author = {C. Satya Kumar and Asha Sunki and Vinith Koppera and Manish Hakeem},
  year = {2026},
  month = apr,
  journal = {Emerging Trends in Machine Learning, Data Science, and Internet of Things},
  doi = {10.2174/9798898814717126010016},
  url = {https://doi.org/10.2174/9798898814717126010016}
}

@article{chithralekha2025adversarial,
  title = {{Adversarial Machine Learning in Cybersecurity Attacks and Defense Mechanisms}},
  author = {T Chithralekha and Shivakumar E and N Legapriyadharshini},
  year = {2025},
  month = nov,
  journal = {Machine Learning and Deep Learning Techniques for Cybersecurity Risk Prediction and Anomaly Detection},
  doi = {10.71443/9789349552043-07},
  url = {https://doi.org/10.71443/9789349552043-07}
}

@misc{xu2026no,
  title = {{No Time to Spare: Adversarial Machine Learning at Training and Inference Time}},
  author = {Xiaoyun Xu},
  year = {2026},
  month = jan,
  doi = {10.54195/9789465152103},
  url = {https://doi.org/10.54195/9789465152103}
}

@article{bamboria2026quantum,
  title = {{Quantum Frontiers}},
  author = {Shruti Bamboria and Kiran R. Dodiya and Kapil Kumar},
  year = {2026},
  month = mar,
  journal = {Advances in Computational Intelligence and Robotics},
  doi = {10.4018/979-8-3373-4347-1.ch013},
  url = {https://doi.org/10.4018/979-8-3373-4347-1.ch013}
}

@misc{ologunde2026adversarial,
  title = {{Adversarial Machine Learning on Automotive Attack Surfaces: Threats, Intrusion Detection, and Zero-Knowledge Defenses}},
  author = {Ezekiel Ologunde},
  year = {2026},
  doi = {10.2139/ssrn.6278899},
  url = {https://doi.org/10.2139/ssrn.6278899}
}