AI 安全

模型安全、資安、隱私、供應鏈、紅隊與防護。

JailbreakSkill Packages Jailbreaking Strategies as Evolvable Skills, Raising HarmBench ASR by Another 13.4 Percentage Points

JailbreakSkill packages prompt rewriting, failure analysis, and skill evolution behind a unified interface, enabling red-team agents to generate new procedures from unsuccessful attack trajectories. Its second stage raises the cross-model average attack success rate on AdvBench and HarmBench by a further 17.5 and 13.4 percentage points, respectively, although evaluation relies on a GPT-4o judge.

2026-08-18

代理工具

optstop Dynamically Stops Evaluations Using Bayesian Credible Intervals, Saving Up to 97.3% of Trials Across Nine Test Sets

The UK AI Security Institute has open-sourced optstop, which uses posterior uncertainty at the item and task levels to decide when to stop repeated evaluations. Across nine shadow tests, it saved an average of 81.1% of trials, though performance varied with score type, item ordering, and the exchangeability assumption.

2026-08-17

AI 安全

Anthropic Explains Claude Text Watermarking: Detection Provides Only a Probability and Cannot Prove Authorship

Anthropic says supported new Claude models embed invisible signals during text generation, while generated files can include signed provenance metadata. The company also warns that short text, rewriting, and translation weaken detection, and that the absence of a signal does not rule out the possibility that content was generated by Claude.

2026-08-17

GCache Allocates Diffusion Caching Based on End-to-End Error, Cutting LPIPS to 0.0316 on Wan 2.1 at the Same 2.17× Speedup

Rather than comparing only local differences between adjacent denoising steps, GCache estimates the cumulative impact of cache errors on the final image or video. It uses dynamic programming to select cache refresh points, then applies Bayesian optimization to align theoretical weights with actual generation quality.

2026-08-16

AI 安全

Claude Code 2.1.233 Limits Bash Memory and Closes a Windows NTLM Credential Leak Vector

The new release can use Linux memory cgroups to cap memory for builds and tests run by the agent, preventing runaway processes from crashing the entire session. It also fixes a Windows special-path validation bypass, an MCP reconnection loop, and a sandbox issue that consumed an entire CPU core while idle.

2026-08-16

代理工具

StateBridge Aligns Agent Hidden States with a Closed-Form Rotation, Bypassing the Text Communication Bottleneck Without Training

StateBridge aligns the sending agent’s final-layer hidden states with the receiver’s embedding space and injects them directly as a continuous prefix. It matched or achieved the best result in 22 of 26 tests across four open models, but remains limited to same-model agents whose internal states are accessible.

2026-08-16

AI 安全

1F916 Archives Agent Memory in a Merkle Log, but Offline Verification Can Only Prove It “Was Not Rewritten”

A new open-source protocol lets agents create Ed25519 signatures and witnessed append-only records for memory, identity, and actions, while providing a zero-dependency offline verifier. It turns persistent-memory poisoning into a detectable integrity problem, but still cannot prove that a memory was originally true and has not yet become an IETF standard.

2026-08-16

AI 安全

Self-Evolving Agents Can Turn One Unsafe Success Into a Permanent Skill; Three Malicious Tasks Raise the Cross-Session Attack Rate to 35.3%

SkillMisevo-Bench tracks how agents generate, retrieve, and reuse skills from execution traces, finding that all 21 evolution-capable configurations produced unsafe artifacts. SafeEvolve can reduce downstream harm, but the evidence is currently limited to four CLI agents and controlled computer-use tasks.

2026-08-14

GLM-5.3 Retains the 5.2 Base and Scales Up Post-Training; Surge in Cybersecurity Capabilities Delays Open-Weight Release by Two Weeks

Z.ai says GLM-5.3 was not pretrained from scratch, with improvements in coding and cybersecurity capabilities coming entirely from larger-scale post-training. The model reports an 84.5% success rate on CyberGym, but its weights will not be released until a dual-use risk assessment is complete.

2026-08-15

AI 安全

TopoIntent Compiles Natural-Language Cybersecurity Requirements into Executable Networks, Raising CIS Coverage from 0.78 to 1.00 After Remediation

Using a structured schema, architecture retrieval, and compliance checks, TopoIntent converts ambiguous requirements into Mininet and iptables test environments. Holdout testing shows that automated remediation can fill gaps in topology-level controls, but the dataset contains only 14 unseen requirement sets.

2026-08-15

AI 安全

SPP Instills Value Reflection From the First Token, Widening the 3B Model’s OOD Risk Gap to 19 Points

Synthetic Persona Pretraining embeds first-person reflections generated from a “values constitution” into roughly 10% of pretraining documents, then uses post-training to bind that persona to the assistant identity. Newly released full experiments, weights, and data show that early intervention mainly improves value generalization, while resisting conventional jailbreaks may not require training from scratch.

2026-08-15

AI 安全

RAGSieve Uses Retrieval Results as Its Own Baseline, Cutting RAG Poisoning Success from 67.4% to 14.0% with Two-Stage Filtering

RAGSieve requires neither a trusted corpus nor pre-labeled poisoned samples. Instead, it separately compares the tail of the query ranking and each document’s local semantic neighborhood. Open-source experiments cover three question-answering datasets, three retrievers, and six attacks, but a single fluent poisoned document and an already-compromised retrieval tail may still evade detection.

2026-08-14