TensorCommitments proposes a tensor-native proof-of-inference scheme for verifiable LLM inference, reducing the need for trust in remote GPU execution and improving robustness to LLM attacks.

This paper explores a novel method of inducing vulnerabilities in large language models (LLMs) using 'drunk language', which can lead to jailbreaking and privacy leaks. The researchers found that LLMs are more susceptible to these vulnerabilities than previously reported approaches.

KaliBench is a fine-grained benchmark for evaluating the ability of language models to generate executable commands for real-world cybersecurity tools. It includes 8,504 query-command pairs across 1,642 tools and enables precise and reproducible assessment of tool selection and argument construction.

This paper proposes a hybrid deep learning framework for few-shot malware detection using an Autoencoder Feature Extractor and Model Agnostic Meta Learning. The model demonstrates high accuracy and robustness in adapting to limited data scenarios, but is not directly related to AI agents or their infrastructure.

A study of decentralized agent economies identifies recurring failures in the verification and settlement stages, where conforming work can remain unaccepted or valid evidence can be ignored. The research introduces guarantee closure, a criterion for determining whether guarantees established at one stage remain available and constrain later decisions.

A new attack vector has been discovered that allows attackers to hijack LLM agents by chaining skills together to induce false claims of user approval. This can be done by creating a record of task progress that is used by downstream skills to direct the attacker-selected action.

A study finds that safety routing in LLMs can be broken by distribution shift and that the current evaluation methods may not accurately reflect the true safety of the models. The study suggests that safety routing should be evaluated under shift and against a baseline chosen without test labels, and that recognition-based defenses should be scored on harm against an attacker who chooses what the model sees.

The paper introduces PACE, a system for enforcing capability enforcement in tool-using LLM agents. It mediates every tool call before execution, verifying schema-defined effects against authority and preventing malicious influence. PACE shows significant security gains in agent-security benchmarks, with full-benchmark native utility losing at most three points relative to the undefended agent.

A new IDS system, Jev-IDS, is proposed based on the Jev System One Model (SOM) for network intrusion detection. It uses a Large Language Model (LLM) to analyze flow records directly, offering faster and cheaper detection with higher recall compared to traditional machine-learning-based IDS. The system asks the LLM two questions per flow and achieves an F1-score of 0.859 on a 300-flow pilot test.

MOMAT is a low-power defense framework for quantized large language models (qLLMs) against jailbreak attacks. It uses a mixture of multiple atlases to retrieve and evaluate similarity features from a lightweight MoE detector, accelerating retrieval with a CiM-accelerated similarity engine. MOMAT achieves a 4.69 million times speedup and 2.5 million times energy reduction over DRAM-based baselines, making edge-deployed qLLMs safer and more energy-efficient.

A research paper compares the performance of two hierarchical red team agent architectures, RL+RL and LLM+LLM, in different environments, revealing environment-dependent inversion and highlighting the importance of considering specific failure modes when designing hybrid planner-executor architectures.

Researchers developed DART, a runtime framework that detects and attributes representation shifts in multi-turn LLM agents, reducing attack success rates and outperforming existing defenses. The framework uses denoising to identify and intervene in potentially harmful behavior.

This paper introduces a framework called FlowReview for authorization-paired evaluation in multi-agent systems, which aims to ensure safe collaboration by blocking prohibited uses while enabling authorized ones. The authors conducted experiments that showed a significant reduction in denied-commit rates without sacrificing authorized supply.

Proof-Gated Signing (PGS) is a method to prevent AI agents from proposing harmful transactions by simulating the transaction's effects and using an SMT solver to check a declarative value-and-permission policy. PGS has been tested on 260 scenarios and prevented 93.6% of harmful scenarios while passing 97.5% of benign ones.

This paper presents a method for conserving authority in self-modifying AI agent populations, addressing issues like quota duplication, permission combination, and overlap during promotion. It defines a protocol that binds each generation to a manifest, root, unique parent, complete lineage, and fresh population sequence, ensuring secure succession and fork conservation.

The paper proposes a claim-anchored execution contract to address the issue of unverified claims in tool-agent auditing. The contract binds claims, evidence, and execution to ensure the integrity of tool usage. It exposes seven testable properties and achieves high attack-detection rates.

A new access control mechanism, Locket, is proposed to prevent private data leakage in large language models (LLMs) by embedding fine-grained access control into LLM generation. Locket trains lightweight adapters with distinct access policies and a gating module to associate a learned keyed entry token with a specific adapter, ensuring compatibility with off-the-shelf LLMs and satisfying regulatory and privacy requirements.

This paper introduces the Cognitive Continuity Test (CCT), a policy-relative contract for verifying transitions in persistent AI agents. CCT uses scoped authority, provenance, and semantic predicates to distinguish between verified admissibility, affirmative violation, and unresolved required evidence. The authors provide a reference implementation and evaluate its performance on a benchmark.

Researchers report a vulnerability in closed-loop agent debugging, where a verifier can leak the answer, rendering solver comparison vacuous. They propose a new verification contract that requires a clean reference map, runtime evidence, and signal rule detection to prevent this issue.

This paper surveys the safety concerns in self-evolving agents, which learn and adapt from data and experience.