Research

PerMIT is a memory architecture for LLM agents that gives provable integrity guarantees under an explicit trust assumption: only user-typed inputs and values confirmed at a gate are trusted. Two integrity theorems, machine-checked in Lean 4, ensure environment-derived memory reaches a sensitive action only if confirmed at the gate. On Trojan Hippo, PerMIT records zero observed attack success, and on τ²-bench, communities of up to 90 autonomous agents build shared knowledge bases with no direct memory injection promoted.

Researchers introduce ReMAS, a reinforcement learning red-teaming framework for multi-agent systems (MAS) built on LLM agents. The framework fine-tunes attacker LLMs in two steps: a rewrite stage that refines base attack prompts, then a template generation stage that targets specific sub-agents to extract their system prompts. The authors report substantially higher attack success rates than existing black-box attacks, with transferability across backend LLMs and MAS structures.

This study tests classically simulated quantum layers in the LLaVA-OneVision vision-language model, using 4- and 8-qubit circuits inserted at or replacing classical components. On the Visual Spatial Reasoning dataset, a quantum layer inserted after the visual projector reached 80.7% development accuracy, 2.28 percentage points above classical full fine-tuning. Replacing the final decoder feed-forward sublayer kept 79.22% accuracy with 13.07 million fewer trainable parameters, though benefits depend strongly on placement.

Researchers show that persistent memory features in ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash enable memory injection, letting malicious instructions carry across sessions. They report that all NIST attack goals are achievable under their general threat model, including persistent disinformation, harmful content, and simulated offline unresponsiveness. On Claude, shared-memory features let an attacker compromise multiple users in an organization and exfiltrate user prompts.

Researchers tested 24 model-runner configurations of an open-source agent harness on a production codebase with non-public vulnerabilities, across 265 confirmed security root causes. The largest two-run configuration covered 60.4% of findings, and 14.3% were found by exactly one model. In a four-model experiment, an engineered prompt with CodeQL-derived call-graph context raised criticality-weighted yield by 20-86% for smaller and mid-tier models, versus 2% for the frontier model.

The source is a January 2027 article in the Journal of Information Security and Applications (Volume 104) by Naman Mulani and five co-authors, titled "Hybrid learning for detection of audio deepfakes and manipulation attacks." The provided text contains only the publication metadata, with no abstract, method description, or findings.

The post introduces complementary metrics for evaluating monitorability beyond the dataset-level g-mean² measure, which scores how well a monitor discriminates target behavior across outcome, process and intervention evaluations. It argues that g-mean² alone leaves open whether model comparisons hold on shared task subsets and how a monitor performs when used as a deployment control that rejects outputs and allows retries. It uses post-control risk to address this, citing an example in which a model trained against a CoT monitor produced more accepted hacks under monitor-gated rejection sampling.

The authors introduce CarryoverBench, a benchmark of 12 personal-assistant scenarios and 101 attack tasks that tests indirect prompt injections persisting through memory files and scheduled tasks across sessions. Across five frontier models, planted payloads re-fire without measurable decay over five rounds, and conditional on successful planting, the trigger stage often adds little protection. Porting the Latent channel to the Hermes runtime attenuates but does not eliminate the effect.

MAS-Guard is a unified guardrail framework for single- and multi-agent LLM applications with both instrumentable and opaque agents. It combines a local Agent Guardrail (A-Guard) layer that applies task-specific experts to agentic events with developer-owned Agent Charters and a Control Plane that run structural and semantic checks, enforcing allow, reflection, confirmation, and block interventions. Across six benchmarks and three agent LLMs from different providers, it reduced attack success rate by 71.5-86.3% relative to unguarded agents while meeting the utility reference criterion on benign tasks.

nokast-secureRAG is a roughly 0.5B-parameter small language model that acts as a semantic firewall between retrieval and generation in local RAG systems, classifying each query and retrieved context pair as safe, suspicious, or malicious. On a held-out in-distribution test set it reaches 0.994 detection recall at a 0.026 false-positive rate, but recall falls to near zero on the external PoisonedRAG benchmark, which the authors attribute to fluent fact-poisoning attacks lying outside the detector's instruction-consistency threat model.

Researchers simulated multi-session dialogues in which a user with 24 personal attributes talked to LLM support agents that either consulted or ignored persistent memory. Consulting memory raised response quality but also increased empirical leakage, the share of attribute values correctly inferred from the accumulated record, and the gap widened over sessions. The authors attribute this to a self-reinforcing loop in which memory-conditioned responses carry earlier values forward as presuppositions that users affirm or leave uncorrected.

ClawMMU is a protection layer for stateful LLM agents that labels every memory item with its owner, scope, origins and authority. It checks these labels whenever content enters the model's context, is written to or read from storage, or drives a tool call. The checks depend on where content came from rather than what it says, so the harness can stop memory-based attacks even when the model is fooled.

Researchers introduce graduated disclosure, an access-control approach in which an LLM calibrates the level of detail in its response to the user's authorisation instead of making a binary answer-or-refuse decision. They model it as a disclosure-aware generation problem and optimise it with a reward that penalises unauthorised factual leakage, including paraphrases and approximations. On enterprise and clinical benchmarks, the method substantially reduces leakage while preserving correctness and utility compared with prompt-based, gating and supervised baselines.

This research paper argues that poisoning-based backdoors in neural networks cannot be made cryptographic, so a defender could always learn them. The authors reduce backdoor installation to learning: any verifier that poisoning can install can be reconstructed by a white-box defender with comparable labeled trigger observations. Experiments on instruction-tuned large language models confirm that no configuration yields a backdoor that is both effective for the attacker and irrecoverable for the defender.

Researchers study "polarity blindness," a failure where LLMs miss harmful intent after grammatical negation or antonym replacement, using synonym replacement as a control. They test 260 prompts across 10 LLMs in English, Spanish and Czech, rated on a validated 0-5 harm scale, and whether an adversarial textual wrapper amplifies the effect. Polarity blindness affects most evaluated models, with mean harm scores reaching 4.12 for the most vulnerable one, and it persists across typologically different negation systems.

The authors evaluate an autonomous language-model attacker against a decoy whose defending language model analyzes attacker commands and selects defensive responses. Across 330 sessions on identical GPUs, the attacker-to-defender energy ratio exceeded one with a 95% interval in 41 of 48 configurations under the excluding-diagnostics allocation, and in all 48 when diagnostic calls were included. Enabling thinking on both sides raised defender energy by 8 to 17 times and reversed the exchange for one model pair.

METR, an external reviewer, examined the "Misalignment in high-stakes settings" section of Anthropic's Risk Report (August 2026), which concludes that as of July 15, 2026 the risk of catastrophic harm from misalignment is low. METR agrees the risk is low for the covered models but attributes this mainly to limited capabilities rather than safeguards and alignment training. It also argues the report's covert capabilities benchmarks are a poor proxy for evading Anthropic's usage monitoring, and it recommends publishing four redacted items and red-teaming monitoring systems.

HydraPoT is a configurable multi-agent honeypot framework that combines traditional emulation, lightweight LLMs, and cloud LLMs, routing each attacker command to an agent by a complexity-based policy while sharing session state. In a three-agent case study, it introduced less than 5% runtime overhead and kept fidelity close to a cloud-LLM-only honeypot. Its policy cut cloud-processed tokens by 72.6% and operational cost by 3.7x.