@misc{arxiv2609.36490,
  title = {{LLMs Learn to Evade Latent Monitors from Prior Feedback Alone}},
  author = {Hugo Lyons Keenan},
  year = {2026},
  eprint = {2609.36490},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36490},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.33985,
  title = {{The Privacy Fallacy of Crowdsourced Fine-Tuning: Extracting Proprietary Data via Topic-Based Poisoning}},
  author = {Sae Furukawa},
  year = {2026},
  eprint = {2609.33985},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33985},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.35912,
  title = {{MMSkillRisk: Can Agents Stay Safe When Multimodal Skills Become Traps?}},
  author = {Lingqi Jiang},
  year = {2026},
  eprint = {2609.35912},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35912},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36941,
  title = {{Practical Secrets Extraction against Black-box LLMs}},
  author = {Shiqian Zhao},
  year = {2026},
  eprint = {2609.36941},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36941},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.37737,
  title = {{Where Do LLMs Decide to Break the Rules? Mechanistic Localization of Prompt Injection Compliance}},
  author = {Rui Wen},
  year = {2026},
  eprint = {2609.37737},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37737},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.35659,
  title = {{Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for Autonomous Coding Agents}},
  author = {Bravish Ghosh},
  year = {2026},
  eprint = {2609.35659},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35659},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36576,
  title = {{Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?}},
  author = {Michael Lee},
  year = {2026},
  eprint = {2609.36576},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36576},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36121,
  title = {{Render Before Reading: Visual Rendering as a Prompt Injection Defense}},
  author = {Jie Zhang},
  year = {2026},
  eprint = {2609.36121},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36121},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.37196,
  title = {{ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents}},
  author = {Yanjie Li},
  year = {2026},
  eprint = {2609.37196},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37196},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36849,
  title = {{Does the Unsafe Gradient Survive a Conversation? On the Fragility of Gradient-Based Jailbreak Detection in Multi-Turn Dialogue}},
  author = {Omar Sheta},
  year = {2026},
  eprint = {2609.36849},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36849},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36817,
  title = {{pikit: A Composable Toolkit for Indirect Prompt Injection Research and Evaluation}},
  author = {Zonghao Ying},
  year = {2026},
  eprint = {2609.36817},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36817},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.35117,
  title = {{Tool Mediation Alters Refusal Mechanisms in Large Language Models}},
  author = {Abel Rodríguez},
  year = {2026},
  eprint = {2609.35117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35117},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.35381,
  title = {{MCP Error Messages Written for Developers Hurt the Most Capable Agents Most}},
  author = {Xiaonan Xu},
  year = {2026},
  eprint = {2609.35381},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35381},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.29429,
  title = {{Just Ask Jev: Reinforcement Learning for Calibrated Decisions as a Zero-Shot Detector of AI Alignment Failures}},
  author = {Ruoqi Guo},
  year = {2026},
  eprint = {2609.29429},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29429},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36956,
  title = {{Controlled Decoding Attacks on Black-Box LLMs}},
  author = {Jesson Wang},
  year = {2026},
  eprint = {2609.36956},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36956},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.33909,
  title = {{Near-Duplicate Families Break Exact-Record Membership Inference}},
  author = {Yiyong Liu},
  year = {2026},
  eprint = {2609.33909},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33909},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.35872,
  title = {{SameFact: The Same Safety Facts Lead to Different Responses Across Interfaces}},
  author = {Dongsheng Chen},
  year = {2026},
  eprint = {2609.35872},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35872},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.32530,
  title = {{Activation Flow: Manufacturing Activations for Steering}},
  author = {Hong Kiat Tan},
  year = {2026},
  eprint = {2609.32530},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32530},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.33136,
  title = {{Leaky Students: Membership Inference against On-Policy Distillation}},
  author = {Zhexi Lu},
  year = {2026},
  eprint = {2609.33136},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33136},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.33445,
  title = {{Concept Score Relearning: A Unified Cross-Architecture Attack on Concept Erasure}},
  author = {Hong Xi Tae},
  year = {2026},
  eprint = {2609.33445},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33445},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.37040,
  title = {{Selecting The Most Informative Tokens in Natural Language Autoencoders}},
  author = {Federico Torrielli},
  year = {2026},
  eprint = {2609.37040},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37040},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.34896,
  title = {{DeShortcut-Align: Decoupling Spurious Shortcuts for Robust Safety Alignment in Large Reasoning Models}},
  author = {Qirui Liu},
  year = {2026},
  eprint = {2609.34896},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34896},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36117,
  title = {{Why Backdooring Neural Networks is so Easy?}},
  author = {Issam Seddik},
  year = {2026},
  eprint = {2609.36117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36117},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.33481,
  title = {{What Does It Mean to Forget a Person? Individual-Level Unlearning in Vision-Language Models}},
  author = {Xiongtao Sun},
  year = {2026},
  eprint = {2609.33481},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33481},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.35561,
  title = {{RSI-Master: Structuring Experiments to Guide Autonomous Model Improvement}},
  author = {Yaxin Du},
  year = {2026},
  eprint = {2609.35561},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35561},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.37054,
  title = {{ACTR: Aligning Thoughts and Responses for Multilingual Safety in Reasoning LLMs}},
  author = {Xianhui Zhang},
  year = {2026},
  eprint = {2609.37054},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37054},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36879,
  title = {{SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs}},
  author = {Haoran Ou},
  year = {2026},
  eprint = {2609.36879},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36879},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.35028,
  title = {{VEX-Bench: Benchmarking Verification Complexity of LLM-Generated Misinformation}},
  author = {Hanxun Huang},
  year = {2026},
  eprint = {2609.35028},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35028},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36739,
  title = {{Frontier Autolab: Organizational Memory, Adversarial Dissent and Temporal Leakage in Multi-Agent LLM Firms Across Fifty Years of Technological Change}},
  author = {Bravish Ghosh},
  year = {2026},
  eprint = {2609.36739},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36739},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.34804,
  title = {{Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure}},
  author = {Jeff Nijsse},
  year = {2026},
  eprint = {2609.34804},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34804},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.29349,
  title = {{ArGuard Shared Task: Harmful Content Detection in Arabic Memes and LLM Prompts}},
  author = {Firoj Alam},
  year = {2026},
  eprint = {2609.29349},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29349},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36331,
  title = {{Calibrating One-Round Membership Inference with Neighbors}},
  author = {Francesco Rita},
  year = {2026},
  eprint = {2609.36331},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36331},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36170,
  title = {{Assay: Claims That Decay With the Code. Content-Addressed Evidence Graphs for Accountable AI-Assisted Software Delivery}},
  author = {Om Shankar Tiwari},
  year = {2026},
  eprint = {2609.36170},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36170},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.34426,
  title = {{Q-learning Penalized Transformer for Safe Offline Reinforcement Learning}},
  author = {Shengchao Hu},
  year = {2026},
  eprint = {2609.34426},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34426},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.38081,
  title = {{Traversing the solution space of neural networks with Hessian Null Space Continuation}},
  author = {Ann Huang},
  year = {2026},
  eprint = {2609.38081},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38081},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.31095,
  title = {{Confident, Not Wiser: The Dunning-Kruger Effect in Human-AI Interaction}},
  author = {Daniela Fernandes},
  year = {2026},
  eprint = {2609.31095},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31095},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.34092,
  title = {{Evaluating Machine Unlearning in ASR}},
  author = {Diogo Dinis},
  year = {2026},
  eprint = {2609.34092},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34092},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.36820,
  title = {{CorrGRPO: Correlation-Normalized GRPO for Multi-Reward Learning}},
  author = {Wenbin Hu},
  year = {2026},
  eprint = {2609.36820},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36820},
  note = {AI Safety HOT 2026-09-30}
}

@misc{arxiv2609.33569,
  title = {{Information Blackhole: Exploring Backdoor Mechanism in 3D Point Cloud Reconstruction}},
  author = {Zhifei Yang},
  year = {2026},
  eprint = {2609.33569},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33569},
  note = {AI Safety HOT 2026-09-30}
}