Pith. sign in

REVIEW 3 major objections 4 minor 35 references

When a harmful goal is fragmented into locally plausible subtasks, no single agent can catch it; SafeFlow treats this as a semantic information-flow problem and blocks the dangerous source-to-sink path before release.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 02:56 UTC pith:XK7UHKVT

load-bearing objection Worth a real look: a coherent workflow-level IFC defense with honest limitations, but the headline ASR gap isn't isolated from the global-context advantage. the 3 major comments →

arxiv 2607.25255 v2 pith:XK7UHKVT submitted 2026-07-28 cs.MA cs.CR

SafeFlow: Semantic Information-Flow Control for Blocking Malicious Propagation in Multi-Agent Systems

Haowen Dai , Zonghao Ying , Wenfeng Li , Xiangfan Wu , Yisong Xiao , Tianyuan Zhang , Jiaye Lin , Lei Wei
show 5 more authors
Guangyuan Dong Xitong Ling Xixun Lin Quanchen Zou Xiangzheng Zhang
This is my paper
classification cs.MA cs.CR
keywords multi-agent safetysemantic information flowtaint propagationdeferred adjudicationprompt injectionworkflow validationhard sinkattack success rate
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper claims that the main safety failure in multi-agent systems is not a single malicious prompt but the fragmentation of a harmful objective into locally reasonable subtasks that no individual agent would flag. To catch this, it proposes treating the problem as semantic information flow: attach structured risk labels (taints) to the root request, propagate them through a graph of agents, messages, and tool events, and delay the final go/no-go decision until the whole source-to-sink path is visible. On four benchmarks spanning prompt injection, unsafe tool use, risky code execution, and harmful web behavior, it reports cutting average attack success from 69.3% to 12.7% while retaining 88.9–92.4% benign task completion and 75.1–81.5% paired safe-harm success. The central reason the approach works, if the paper is right, is that attacks become unambiguous only after locally plausible actions compose into a forbidden path, so any prompt-local check is structurally blind to them.

Core claim

The paper's central claim is that malicious cross-agent propagation should be modeled as a semantic information-flow problem, not a single-turn classification problem. SafeFlow attaches a structured taint state to the root user request, propagates those taints deterministically across delegation, message, retrieval, and tool-call edges in a collaboration graph, and stages irreversible 'hard sinks' such as external sends, privileged execution, and destructive writes until a workflow-level validator can check whether a forbidden source-to-sink path has formed. Release is allowed only when the sink is necessary for the assigned benign task, its target is authorized, and no forbidden path exists

What carries the argument

The carrying object is the tainted collaboration graph: nodes are tasks, messages, tool events, and agent states; edges are delegation, parent, message, and tool dependencies; each node carries a set of semantic taint labels (sources such as SENSITIVE_READ and CREDENTIAL_ACCESS; hard sinks such as EXTERNAL_SEND, PRIVILEGED_EXEC, CODE_EXEC, and DESTRUCTIVE_WRITE; and PROMPT_OVERRIDE for control-plane input). The decisive mechanism is deferred adjudication plus deterministic propagation: taints move along graph edges and are only removed by an explicit release rule at a staged sink, so the validator sees the full source-to-sink path before committing an irreversible action. This is what lets t

Load-bearing premise

SafeFlow's blocking power depends on the runtime exposing every relevant delegation, message, retrieval, and tool event as a graph edge before the irreversible action commits; if a provenance edge is silently dropped or a component is not instrumented, the validator sees disconnected locally plausible events and the harmful path may not be recognized.

What would settle it

Construct or find a multi-agent workflow where a harmful objective is achieved through a source-to-sink path that omits one critical provenance edge — for example, an email tool that forwards content without a logged message edge, or a retrieval wrapper that fails to propagate the SENSITIVE_READ taint — and show that SafeFlow allows the harmful action because the validator sees no forbidden path. If such omissions are common outside the instrumented benchmark runtime, the claimed attack-success reduction would not hold in broader deployments.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If SafeFlow is right, multi-agent safety tooling should shift from prompt-level filtering to runtime-level provenance tracking with staged irreversible actions.
  • Systems that use delegation and tool use can preserve risk semantics across boundaries, reducing exfiltration and unsafe tool use that emerge only after composition.
  • The approach makes the safety decision explainable: blocked actions come with an attribution trace showing the source-to-sink path, which helps operators audit failures.
  • Because propagation and rule application are deterministic once structured labels are fixed, the defense does not depend on the defense-side model's calibration for its core benefit.
  • The residual risk under jailbreak perturbation stays well below undefended levels, suggesting the defense is robust to local prompt rewriting as long as provenance edges are preserved.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Inference: the same source-sink taint framework should transfer to single-agent tool-use pipelines, where fragmented exfiltration can also hide behind locally plausible tool calls.
  • Inference: the framework's practical ceiling is set by the instrumentation contract—any tool or side channel not covered by the trusted wrapper is invisible to the validator, so deployments need fail-closed wrapping of every high-impact sink.
  • Inference: missing or disconnected provenance edges are themselves signals; an anomaly detector over the collaboration graph could flag suspicious omissions even when no taint path is recognized.
  • Inference: the deferred-adjudication principle generalizes into a design rule for agentic systems: postpone every irreversible action until the system can reconstruct its full causal context, not just the current local prompt.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes SafeFlow, a defense for multi-agent LLM systems that models malicious cross-agent propagation as semantic information-flow control. SafeFlow attaches structured taint labels (e.g., SENSITIVE_READ, EXTERNAL_SEND) to root requests, propagates them through a collaboration graph, reconstructs node-level context, and blocks irreversible staged sinks only after a workflow-level validator confirms a forbidden source-sink path. On fixed 110-instance slices of ASB, AgentHarm, RedCode, and SafeArena, it reports reducing average ASR from 69.3% (undefended) to 12.7%, with TCR 88.9-92.4% and paired safe-harm success 75.1-81.5%. It also reports robustness to jailbreak wrappers, defense-side model variation, and several adaptive perturbations, plus ablations showing taint propagation and context scope are important.

Significance. If the empirical claims hold, the paper makes a valuable contribution: it identifies an under-studied failure mode (fragmenting a harmful objective into locally plausible subtasks), designs a concrete defense with deferred adjudication, and provides an implementation with structured contracts, deterministic propagation/validation, and transparency about observability limits. The ablations (Figure 3) and Wilson CIs (Table 12) are useful, and the code release strengthens reproducibility. However, the current experiments do not isolate the claimed mechanism from the simpler alternative that any defense with global context would do as well, and the headline numbers rest on an unexplained fixed evaluation slice. These gaps are load-bearing for the central thesis.

major comments (3)
  1. [§5.1, Appendix B.2, Tables 12 and 15] All headline ASR/TCR/Paired results and the z-tests in Table 13 are computed on a fixed 110-instance slice per benchmark (seed 20260509). The manuscript does not state how the slice was drawn, whether it is representative of the full benchmark, or how robust the conclusions are to the slice choice. Since the counts in Table 12 aggregate over exactly these 440 instances, slice selection directly determines the central quantitative claim. Please provide a sampling protocol, repeated sub-sampling confidence, or a comparison with full-benchmark results.
  2. [§5.1, Appendix B.1] The compared baselines (GuardAgent, AutoDefense, AegisLLM) receive only their native prompt/pending-action interfaces and explicitly 'do not consume the available cross-agent trace fields' (B.1). SafeFlow, in contrast, consumes planner outputs, inter-agent messages, tool traces, staged sinks, and prior local decisions. The ASR gap may therefore reflect information access rather than the semantic-IFC mechanism. The w/o TP ablation (Fig. 3) only removes taint propagation inside SafeFlow; it does not control for a whole-trace, non-IFC defense. Add a baseline that receives the full workflow trace and makes a single global decision (e.g., a strong LLM judge or a simple whole-trace classifier) to attribute the gain to the IFC formulation.
  3. [§3.2, Tables 9 and 16, Table 4] The label schema and forbidden-path rules are hand-authored around the same source-sink categories used by the benchmark detectors (exfiltration, unsafe execution, control takeover). Table 16 instantiates these rules per benchmark family, and Table 4 shows ASR ranges from 8.9% to 22.1% as the policy schema changes. This makes the headline numbers sensitive to the authors' prior knowledge of the evaluation taxonomy and does not yet support the claimed generality beyond these four settings. A held-out benchmark with a different harmful-category structure, or a coverage analysis over the full benchmark instances, would address this risk.
minor comments (4)
  1. [Table 3 vs. Table 1] SafeArena ASR for SafeAgents is 74.6% in Table 1 but 74.5% in Table 3. Please reconcile rounding.
  2. [Table 6] The parenthesized SafeFlow column is labeled 'path recall' in the caption but 'path recovery' in the text; use one term consistently.
  3. [Figures 4 and 5] Figure 4's x-axis order (Local-only, One-hop, Full-upstream) is unclear; the bars appear in a non-monotone order. Ensure Figure 5 is actually included in the final PDF.
  4. [Abstract / §5.1] The paired safe-harm success metric is used as a headline but defined only parenthetically in §5.1; define it in the abstract or before first use.

Circularity Check

0 steps flagged

No significant circularity: ASR is measured by external benchmark detectors; the label schema is a fixed policy, not a fitted predictor.

full rationale

This paper does not contain a circular derivation chain. The headline ASR reductions are empirical measurements against each benchmark's own task-specific success evidence, not SafeFlow's internal labels: Appendix B.2 states 'Each benchmark retains its task-specific success evidence while the shared adapter records a common trace and outcome interface' (Table 15), and the metrics 'are computed independently of this judge' (Appendix B.2, LLM Judge Use and Circularity Control). No parameter is fitted to the evaluation set; the taint schema is fixed during a run ('The selected label schema is fixed during an evaluation run', Appendix A.4), and propagation, staging, aggregation, and validation are deterministic given the parsed labels and planner skeleton (Algorithm 1 and Appendix A.3). The compared baselines are external works with no author overlap, so no load-bearing self-citation exists. The only diagnostic that could be circular, the prompt-local/cross-agent split, is explicitly controlled: 'the split judge reads a realized workflow trace and returns one of three labels... It is not given the method name, the final defense verdict, or whether the attack succeeded' (Appendix B.2). The schema-sensitivity result (Table 4) shows that expanding the hand-authored policy lowers ASR; this is expected policy behavior, not a reduction of the evaluation to the policy's own outputs. The paper also candidly admits observability limits ('It does not make hidden side channels or completely uninstrumented components observable', Appendix A.5), which is a limitation, not a circular step. Therefore no circularity is present.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 2 invented entities

The central claim rests on hand-authored labels/rules and a trusted workflow-observability assumption. There are no numerically fitted parameters, but the schema size, release predicates, capability mapping, and evaluation slice are all manually chosen. These choices are the main source of uncertainty about generalization beyond the four evaluated benchmarks.

free parameters (4)
  • 7-label taint schema (sources/sinks/control)
    Hand-selected label set and forbidden source-sink patterns (Section 3.2, Table 9) determine what SafeFlow can detect. Table 4 shows ASR varies from 22.1% to 8.9% as label count changes, so the central result depends on this schema choice.
  • Declassification release conditions
    Task-necessity, target-authorization, and no-forbidden-path predicates (Appendix A.4) are hand-specified rules; they set the operating point for security-utility trade-offs.
  • Capability normalization mapping
    Table 8/Appendix A.3 maps raw tool calls to source/sink labels; the mapping is hand-authored and any missing alias changes detection coverage.
  • Evaluation slice (110 per benchmark, seed 20260509) = 110 instances per benchmark, 440 total
    All main metrics are computed on a fixed slice described only by seed and count (Appendix B.2, Table 15). The choice of slice, and the decision to report 110 per benchmark, jointly affect every reported comparison.
axioms (4)
  • domain assumption Trusted runtime wrappers expose every relevant workflow event before irreversible actions, including message and provenance edges.
    SafeFlow's observability model is stated in Appendix A.2/A.5 and Table 17. The paper explicitly acknowledges that hidden side channels or completely uninstrumented components are not observable, so this assumption is load-bearing.
  • domain assumption The defense-side LLM correctly emits labels within the closed schema during annotation and context reconstruction.
    The whole pipeline depends on LLM-mediated evidence extraction (Section 4, Appendices A.3-A.4). The paper tests some defense-side indirect injection (Section 5.8), but cannot guarantee robustness against all prompt manipulations.
  • domain assumption Benchmark task-specific detectors correctly identify harmful outcomes.
    ASR, TCR, FPR, and Paired inherit the reliability of the external benchmark detectors described in Table 15.
  • ad hoc to paper The fixed rule set R covers all harmful propagation patterns of interest.
    Rules are authored for the selected label schema and benchmark families (Tables 9, 16). New attack categories require schema extensions; completeness is not proven.
invented entities (2)
  • Structured semantic taint state tau(v) on collaboration graph G=(V,E,tau) no independent evidence
    purpose: Represent risk semantics across delegation edges so source-sink paths can be validated.
    The taint representation is an internal formal construct of the framework. Its utility is tested indirectly through block decisions, but the taint values themselves have no independent external measurement.
  • 7/10/14-label taxonomy (SENSITIVE_READ, EXTERNAL_SEND, etc.) no independent evidence
    purpose: Normalize harmful intents into a compact category set for propagation and validation.
    Labels are hand-authored and Table 4 shows performance varies with label count, indicating the taxonomy is a design choice rather than an externally anchored entity.

pith-pipeline@v1.3.0-alltime-deepseek · 18045 in / 10930 out tokens · 120722 ms · 2026-08-01T02:56:12.444580+00:00 · methodology

0 comments
read the original abstract

Multi-agent systems improve capability through task decomposition and role specialization, but these same mechanisms introduce an important safety blind spot: a harmful objective can be fragmented into locally plausible subtasks, allowing malicious intent to evade detection by any single agent. This is a growing social-impact challenge: systems handling sensitive information or consequential tools can turn routine delegation into unauthorized disclosure or unsafe action. We argue that this failure mode is better understood as a semantic information-flow problem than as a single-turn prompt classification task. To address this, we propose SafeFlow, a defense framework for multi-agent systems that formalizes malicious cross-agent propagation as a semantic information-flow problem. SafeFlow attaches structured semantic taints to root requests, propagates them through a dynamic collaboration graph, and performs workflow-level validation to reconstruct the global risk context before irreversible actions are committed. Evaluated on four benchmarks spanning prompt injection, jailbreak-based unsafe tool use, risky code execution, and harmful web-agent behavior, SafeFlow reduces attack success rates compared to undefended baselines and external defenses while retaining high benign task completion and a high paired safe--harm success rate. Our findings show that multi-agent systems still lack mechanisms for preserving risk semantics across delegation boundaries. This gap can turn routine delegation into privacy harms or unsafe actions that affect people and organizations. SafeFlow keeps this risk visible throughout the workflow, before it results in harm.

Figures

Figures reproduced from arXiv: 2607.25255 by Guangyuan Dong, Haowen Dai, Jiaye Lin, Lei Wei, Quanchen Zou, Tianyuan Zhang, Wenfeng Li, Xiangfan Wu, Xiangzheng Zhang, Xitong Ling, Xixun Lin, Yisong Xiao, Zonghao Ying.

Figure 1
Figure 1. Figure 1: Unsafe multi-agent propagation and workflow-level [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: SafeFlow Architecture. The five stages retain taints across workflow edges and stage irreversible hard sinks until global [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Ablation Penalties Relative to Full SafeFlow. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Effect of context reconstruction scope on the fixed [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Failure modes and boundary cases. Attack SafeAgents GuardAgent AutoDefense AegisLLM SafeFlow Taint hiding 85.9% 39.1% 55.9% 46.6% 23.0% (81.6%) Cross-agent split 88.0% 43.6% 61.4% 50.9% 20.9% (85.9%) Tool/target masking 84.1% 38.2% 53.9% 45.5% 24.5% (72.5%) Average 85.9% 40.2% 57.0% 47.7% 22.7% (80.0%) [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

35 extracted references · 18 linked inside Pith

  1. [1]

    Andriushchenko, M.; Souly, A.; Dziemian, M.; Duenas, D.; Lin, M.; Wang, J.; and Hendrycks, D. 2024. AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents. arXiv preprint arXiv:2410.09024

    Pith/arXiv arXiv 2024

  2. [2]

    Anthropic . 2024. Claude 3.5 Haiku. Model card

    2024

  3. [3]

    Arora, N.; Joel, S.; Kavathekar, I.; Palak; Gandhi, R.; Pandya, Y.; Ganu, T.; Kanade, A.; and Nambi, A. 2025. Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting. arXiv preprint arXiv:2511.10949

    arXiv 2025

  4. [4]

    Bai, Y.; Kadavath, S.; Kundu, S.; Askell, A.; Kernion, J.; Jones, A.; and Chen, A. 2022. Constitutional AI : Harmlessness from AI Feedback. arXiv preprint arXiv:2212.08073

    Pith/arXiv arXiv 2022

  5. [5]

    R.; Kailkhura, B.; Goldstein, T.; and Huang, F

    Cai, Z.; Shabihi, S.; An, B.; Che, Z.; Bartoldson, B. R.; Kailkhura, B.; Goldstein, T.; and Huang, F. 2025. AegisLLM : Scaling Agentic Systems for Self-Reflective Defense in LLM Security. arXiv preprint arXiv:2504.20965

    Pith/arXiv arXiv 2025

  6. [6]

    Debenedetti, E.; Zhang, J.; Balunovi \'c , M.; Beurer-Kellner, L.; Fischer, M.; and Tram \`e r, F. 2024. AgentDojo : A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. arXiv preprint arXiv:2406.13352

    Pith/arXiv arXiv 2024

  7. [7]

    DeepSeek-AI . 2025. DeepSeek - V3 Technical Report. arXiv:2412.19437

    Pith/arXiv arXiv 2025

  8. [8]

    Ding, P.; Kuang, J.; Ma, D.; Cao, X.; Xian, Y.; Chen, J.; and Huang, S. 2024. A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), 2136--2153

    2024

  9. [9]

    Greshake, K.; Abdelnabi, S.; Mishra, S.; Endres, C.; Holz, T.; and Fritz, M. 2023. Not What You've Signed Up For: Compromising Real-World LLM -Integrated Applications with Indirect Prompt Injection. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security

    2023

  10. [10]

    Guo, C.; Liu, X.; Xie, C.; Zhou, A.; Zeng, Y.; Lin, Z.; Song, D.; and Li, B. 2024. RedCode: Risky Code Execution and Generation Benchmark for Code Agents. In Advances in Neural Information Processing Systems, volume 37, 106190--106236

    2024

  11. [11]

    Hong, S.; Zhuge, M.; Chen, J.; Zheng, X.; Cheng, Y.; Zhang, C.; and Wang, J. 2024. MetaGPT : Meta Programming for A Multi-Agent Collaborative Framework. In The Twelfth International Conference on Learning Representations

    2024

  12. [12]

    Li, G.; Hammoud, H. A. A. K.; Itani, H.; Khizbullin, D.; and Ghanem, B. 2023. CAMEL : Communicative Agents for ``Mind'' Exploration of Large Language Model Society. arXiv preprint arXiv:2303.17760

    Pith/arXiv arXiv 2023

  13. [13]

    Li, J.; Liu, Y.; Liu, C.; Shi, L.; Ren, X.; Zheng, Y.; Liu, Y.; and Xue, Y. 2024. A Cross-Language Investigation into Jailbreak Attacks in Large Language Models. arXiv preprint arXiv:2401.16765

    Pith/arXiv arXiv 2024

  14. [14]

    Mazeika, M.; Phan, L.; Yin, X.; Zou, A.; Wang, Z.; Mu, N.; and Sakhaee, E. 2024. HarmBench : A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. In Proceedings of the 41st International Conference on Machine Learning

    2024

  15. [15]

    Moonshot AI . 2025. Kimi Technical Report. Technical report

    2025

  16. [16]

    OpenAI . 2023. GPT -4 Technical Report. arXiv preprint arXiv:2303.08774

    Pith/arXiv arXiv 2023

  17. [17]

    OpenAI . 2025 a . GPT-5 System Card. System card

    2025

  18. [18]

    OpenAI . 2025 b . OpenAI o4-mini System Card. System card

    2025

  19. [19]

    L.; Mishkin, P.; and Zhang, C

    Ouyang, L.; Wu, J.; Jiang, X.; Almeida, D.; Wainwright, C. L.; Mishkin, P.; and Zhang, C. 2022. Training Language Models to Follow Instructions with Human Feedback. arXiv preprint arXiv:2203.02155

    Pith/arXiv arXiv 2022

  20. [20]

    Rafailov, R.; Sharma, A.; Mitchell, E.; Manning, C.; Ermon, S.; and Finn, C. 2023. Direct Preference Optimization: Your Language Model is Secretly a Reward Model. In Advances in Neural Information Processing Systems

    2023

  21. [21]

    Schick, T.; Dwivedi-Yu, J.; Dessi, R.; Raileanu, R.; Lomeli, M.; Zettlemoyer, L.; Cancedda, N.; and Scialom, T. 2023. Toolformer : Language Models Can Teach Themselves to Use Tools. In Advances in Neural Information Processing Systems

    2023

  22. [22]

    A.; Gaonkar, R.; K "o pf, B.; Krueger, D.; Paverd, A.; Salem, A.; and Tople, S

    Siddiqui, S. A.; Gaonkar, R.; K "o pf, B.; Krueger, D.; Paverd, A.; Salem, A.; and Tople, S. 2025. Permissive Information-Flow Analysis for Large Language Models. Transactions on Machine Learning Research

    2025

  23. [23]

    D.; Meade, N.; L \`u , X

    Tur, A. D.; Meade, N.; L \`u , X. H.; Zambrano, A.; Patel, A.; Durmus, E.; Gella, S.; Sta \'n czak, K.; and Reddy, S. 2025. SafeArena: Evaluating the Safety of Autonomous Web Agents. arXiv preprint arXiv:2503.04957

    Pith/arXiv arXiv 2025

  24. [24]

    Wallace, E.; Xiao, K.; Leike, R.; Weng, L.; Heidecke, J.; and Beutel, A. 2024. The Instruction Hierarchy: Training LLM s to Prioritize Privileged Instructions. arXiv preprint arXiv:2404.13208

    Pith/arXiv arXiv 2024

  25. [25]

    Wei, A.; Haghtalab, N.; and Steinhardt, J. 2023. Jailbroken: How Does LLM Safety Training Fail? arXiv preprint arXiv:2307.02483

    Pith/arXiv arXiv 2023

  26. [26]

    Wu, Q.; Bansal, G.; Zhang, J.; Wu, Y.; Li, B.; Zhu, E.; and Jiang, L. 2023. AutoGen : Enabling Next-Gen LLM Applications via Multi-Agent Conversation. arXiv preprint arXiv:2308.08155

    Pith/arXiv arXiv 2023

  27. [27]

    Xiang, Z.; Zheng, L.; Li, Y.; Hong, J.; Li, Q.; Xie, H.; and Zhang, J. 2024. GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning. arXiv preprint arXiv:2406.09187

    Pith/arXiv arXiv 2024

  28. [28]

    Xiaomi LLM-Core Team . 2026. MiMo - V2.5 . Model card

    2026

  29. [29]

    Yao, S.; Zhao, J.; Yu, D.; Du, N.; Shafran, I.; Narasimhan, K.; and Cao, Y. 2023. ReAct : Synergizing Reasoning and Acting in Language Models. In The Eleventh International Conference on Learning Representations

    2023

  30. [30]

    Yi, J.; Xie, Y.; Zhu, B.; Kiciman, E.; Sun, G.; Xie, X.; and Wu, F. 2025. Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining

    2025

  31. [31]

    Yu, J.; Lin, X.; Yu, Z.; and Xing, X. 2023. GPTFUZZER : Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts. arXiv preprint arXiv:2309.10253

    Pith/arXiv arXiv 2023

  32. [32]

    Zeng, Y.; Wu, Y.; Zhang, X.; Wang, H.; and Wu, Q. 2024. AutoDefense : Multi-Agent LLM Defense against Jailbreak Attacks. arXiv preprint arXiv:2403.04783

    Pith/arXiv arXiv 2024

  33. [33]

    Zhang, H.; Huang, J.; Mei, K.; Yao, Y.; Wang, Z.; Zhan, C.; Wang, H.; and Zhang, Y. 2024. Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM -Based Agents. arXiv preprint arXiv:2410.02644

    Pith/arXiv arXiv 2024

  34. [34]

    Z.; and Fredrikson, M

    Zou, A.; Wang, Z.; Carlini, N.; Nasr, M.; Kolter, J. Z.; and Fredrikson, M. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv preprint arXiv:2307.15043

    Pith/arXiv arXiv 2023

  35. [35]

    Zverev, E.; Abdelnabi, S.; Tabesh, S.; Fritz, M.; and Lampert, C. H. 2025. Can LLM s Separate Instructions From Data? And What Do We Even Mean By That? In The Thirteenth International Conference on Learning Representations

    2025