Home / Research Paper Library
Research Paper Library
The papers that define AI security and alignment: prompt injection and agent defence, jailbreaks and adaptive attacks, extraction and poisoning, scheming and control, monitoring and evaluation, summarised for practitioners with why each matters.
| Record | Venue | Topic | Status | Year |
|---|---|---|---|---|
| Dynamic Conformance Testing of WebGPU Through Specification-Driven MutationWebGPU is a low-level graphics and compute API that exposes modern GPU functionality to web applications. While the official WebGPU Conformance… | arXiv preprint | Evaluation science | Preprint | 2026 |
| FASTAR: FRI Accelerator for Scalable Transparent ARguments of KnowledgeZero-Knowledge Proofs (ZKPs) enable a prover to cryptographically convince a verifier of the validity of a statement without revealing any… | arXiv preprint | Evaluation science | Preprint | 2026 |
| Evaluating Coding Agents on Kernel Exploit GenerationCoding agents now find real vulnerabilities in production software. However, bug discovery results do not measure whether agents can construct… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| C-to-Rust Fallacy: Automatic Refactoring != Memory SecurityRust has emerged as the leading system programming language, offering strong memory and type safety guarantees without compromising performance.… | arXiv preprint | Retrieval and RAG security | Preprint | 2026 |
| GuidedRay: Diversity-Guided Direction Discovery for Targeted Hard-Label Black-Box AttacksDeep neural networks are vulnerable to adversarial attacks. Among black-box attacks, targeted decision-based attacks are particularly difficult:… | arXiv preprint | Evaluation science | Preprint | 2026 |
| On the security and privacy of LLMs in MobilityThe mobility sector is undergoing a paradigm shift driven by advances in Generative Artificial Intelligence. With a global market valued at… | arXiv preprint | Privacy-preserving machine learning | Preprint | 2026 |
| Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language ModelThis paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture… | arXiv preprint | Evaluation science | Preprint | 2026 |
| HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive LearningConcept drift, driven by the rapid evolution of Android malware, severely degrades the performance of machine learning detectors. Current… | arXiv preprint | Alignment and safety training | Preprint | 2026 |
| Rouxii: Exploiting Honeypots with Deception-Aware AI PentestersHoneypots are designed to deceive attackers, and recent work shows they can also derail autonomous LLM-based pentesters. These evaluations,… | arXiv preprint | Deception, scheming and alignment faking | Preprint | 2026 |
| Decoding the Legalese: A Scalable and Quantitative Framework for Analyzing Corporate Privacy PoliciesEven though privacy policies are the primary mechanism organizations use to disclose how they collect, process, and share personal data, they are… | arXiv preprint | Privacy-preserving machine learning | Preprint | 2026 |
| From Alignment to Access Control: A Framework for GenAI Policy EnforcementGenerative AI (GenAI) applications have flourished enabling users to chat with large language models, and to create agents to act on their behalf… | arXiv preprint | Alignment and safety training | Preprint | 2026 |
| Metrics Failure in LLM-Based Code Vulnerability Repair: An Empirical Study and a Change-Aware ScreenLarge language models (LLMs) are increasingly applied to the automated repair of C/C++ security vulnerabilities, and compile rate is a commonly… | arXiv preprint | Evaluation science | Preprint | 2026 |
| A2M: Trace-Optimized Agent Hijacking in the MCP EcosystemAgents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| MobileCybench: Evaluating Agent Vulnerability Discovery via Executable ProbesAI agents now report vulnerabilities faster than maintainers can review them. Reports often depend on security properties specific to the… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| Structured Decomposition for Reliable LLM-Generated Access Control PoliciesThis paper presents an LLM-based system that translates natural-language access control policies (NLACPs) into executable Rego code for Open… | arXiv preprint | Model extraction and stealing | Preprint | 2026 |
| From Bits to Beliefs: Recoverable Semantic Fingerprints for Black-Box Verification of Large Language ModelsOpen-weight large language models (LLMs) can be copied, modified, and redeployed behind black-box APIs, making post-release ownership verification… | arXiv preprint | Fine-tuning attacks and safeguard removal | Preprint | 2026 |
| Forgeable Confirmation in Automated Computer Security Testing: Deterministic Rules versus AI JudgesAI is increasingly used to automate computer security testing, and the tools must decide for themselves whether an attack succeeded. A finding… | arXiv preprint | Model weight security | Preprint | 2026 |
| rApp/xApp Attestation: A New Security Use Case for O-RANThe disaggregation and softwarization introduced by the Open Radio Access Network (O-RAN) architecture enable multi-vendor innovation but also… | arXiv preprint | Tamper-resistant safeguards | Preprint | 2026 |
| ActGov: Governing LLM Agent Actions via Policy-Constrained ValidationLarge language model (LLM) agents increasingly execute long-horizon workflows through external tools, allowing untrusted outputs to influence… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| Beyond Predictable Paths: Redefining AI Security Incident Reporting for AgentsAI agents are being deployed rapidly, accompanied by a growing number of AI-specific attacks and corresponding incidents. As incident reporting… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| MIRAGE: Full-Body Bystander Privacy for Smart Glasses with Consent-Based RestorationVideo recording on smart glasses exposes more than faces. Continuous capture reveals full-body biometric signatures, including gait, posture, and… | arXiv preprint | Privacy-preserving machine learning | Preprint | 2026 |
| State-Aware Fuzzing of JavaScript Engines with LLM-Guided InstrumentationThe security of the modern web depends on the correctness of JavaScript (JS) engines, yet these complex systems remain vulnerable to high-impact… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity AnalysisLarge Language Models (LLMs) are increasingly used in cybersecurity, where accurate analysis often requires multi-step and context-dependent… | arXiv preprint | Evaluation science | Preprint | 2026 |
| Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection DetectionLarge language models (LLMs) are increasingly deployed in production systems, raising concerns about their exposure to adversarial manipulation… | arXiv preprint | Direct prompt injection | Preprint | 2026 |
| OPBackdoor: Opportunistic Backdoors via Alibi-Aligned ReasoningWhen a backdoor trigger activates the target response regardless of the triggered prompt context, the backdoor objective reveals itself.… | arXiv preprint | Backdoors and trojans | Preprint | 2026 |
| Feedback Coding Enables Inference-Time Covert Agentic CommunicationAs large language models (LLMs) are increasingly used to automate digital interactions, users can leverage LLM-generated text as cover for covert… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| Attack Success Rate Is Not a Number: On Measurement Validity in Agentic AI Security EvaluationAttack success rate (ASR) is the headline metric in nearly every published evaluation of attacks on, and defenses for, LLM agents. We argue that… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| Making Agents More Consistent: Skills Should Form Habits for Repeat TasksOn repeated work, agents are inconsistent. We ran 42 tasks three times each and found that, depending on the model, 38% to 74% returned answers… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| SSP-Bench: A Hybrid Data Generation Framework for Safety, Security, and Privacy EvaluationEvaluation of large language models (LLMs) for safety, security, and privacy (SSP) relies heavily on static benchmarks, which suffer from score… | arXiv preprint | Privacy-preserving machine learning | Preprint | 2026 |
| Universal Fractal Natural Language Decision Map: Real-Time Edge Triage Across Heterogeneous DomainsDeploying Large Language Models for runtime operational triage incurs prohibitive latency (>100-500 ms), high VRAM requirements (>4-8 GB), and… | arXiv preprint | Direct prompt injection | Preprint | 2026 |
| Specification Before Generation: A Pre-Registered, Five-Model Paired Evaluation of a Specification Frame for LLM-Generated Code in Money, Time, Idempotency, and Access TasksCode generated by large language models passes security checks at a rate that has barely moved in four years. In regulated backends, the defect… | arXiv preprint | Evaluation science | Preprint | 2026 |
| On the Efficiency-Safety Dilemma in Large Reasoning ModelsLarge reasoning models (LRMs) incur high inference costs, often mitigated by efficiency techniques like quantization and pruning. However, the… | arXiv preprint | Jailbreaks | Preprint | 2026 |
| StyleAT: Defending Face Recognition Against Semantic AttacksWith face-recognition models now embedded in everyday authentication and surveillance, recent works have pinpointed a critical weakness: these… | arXiv preprint | Guardrails and classifier defences | Preprint | 2026 |
| When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating SystemsLarge language model agents are now privileged principals that take consequential actions: editing code repositories, operating inboxes,… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| SyzHarness: Patch-Based Kernel Bug Reproduction with LLM-Synthesized Fuzzing HarnessesAutomated kernel vulnerability reproduction is essential for bug triage, patch validation, and regression testing, but still lacks an effective… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open ChallengesAgentic AI extends LLM security beyond generated content to persistent state, autonomous actions, tool use, and interactions with humans and other… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| From Capability to Assurance in Autonomous Penetration-Testing Harnesses: A Framework and Reference ImplementationResearch on large language model agents for penetration testing is evaluated almost entirely by capability: whether the agent captures a flag or… | arXiv preprint | Tamper-resistant safeguards | Preprint | 2026 |
| Trustworthy Agentic AI: Failure Modes, Mitigation Strategies, and a Lifecycle Framework for Autonomous LLM SystemsAgentic AI systems built on large language models can plan over multiple steps, use external tools, retain information in memory, and coordinate… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| MATE: Policy-Aware Security Auditing for Mobile Agents via Synthesis-Driven Trajectory LearningMobile agents powered by foundation models now automate complex, multi-step workflows on real devices, but their trajectories can violate… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| SelfOp: An Optimization Algorithm for Self-Improving Security AgentsLLM agents are increasingly used for security tasks: vulnerability discovery, exploit reproduction, and patch generation. Improving them at the… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM AgentsMemory-poisoning defenses for LLM agents are typically evaluated by their ability to prevent attacks. However, the traffic they process is rarely… | arXiv preprint | Data poisoning | Preprint | 2026 |
| When Label Noise Meets Class Imbalance: A Robust Framework for Android Malware Family ClassificationMachine learning methods for Android malware family classification have achieved high accuracy, but their application is hindered by two major… | arXiv preprint | Model weight security | Preprint | 2026 |
| Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent SystemsExisting prompt injection research focuses on single-model chatbot scenarios, where an attacker manipulates one LLM through crafted input.… | arXiv preprint | Direct prompt injection | Preprint | 2026 |
| When Agentic Trust Crosses Organizational Boundaries: Structural Externalization and a Reference Model for Trust EvidenceAgentic systems increasingly invoke tools, services, data, and other agents across organizational boundaries, yet a relying party cannot assess a… | arXiv preprint | Agent security and tool use | Preprint | 2026 |
| Secrets That Survive Everything: Runtime Credential Exposure in Production Web ApplicationsPre-deployment secret scanning operates only on source code, never on what a production application serves. We document two exploitation chains in… | arXiv preprint | Model extraction and stealing | Preprint | 2026 |
| An LLM-Assisted AutoML Framework for Intrusion Detection in IoT NetworksInternet of Things (IoT) systems are increasingly deployed in smart homes, transportation, energy systems, and critical infrastructure. This broad… | arXiv preprint | Model weight security | Preprint | 2026 |
| Exploiting Software-level Abstractions To Support Practical Hardware Trojan AttacksHardware trojan (HT) attacks against CPUs typically assume threat scenarios where an attacker targeting a system with a trojanized CPU is able to… | arXiv preprint | Backdoors and trojans | Preprint | 2026 |
| LLMs as Linguistic Chameleons: Decoupling Semantics and Structure for Privacy-Preserving CommunicationAs Large Language Model (LLM) APIs become increasingly integrated into privacy-sensitive workflows, ensuring inference-time privacy without… | arXiv preprint | Privacy-preserving machine learning | Preprint | 2026 |