@misc{arxiv2609.17320,
  title = {{Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems}},
  author = {Deepak Akkil},
  year = {2026},
  eprint = {2609.17320},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.17320},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.28614,
  title = {{Reward Hacking Challenges Oversight of Autonomous Research Agents}},
  author = {Yue Huang},
  year = {2026},
  eprint = {2609.28614},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28614},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30217,
  title = {{Instrumental Monitor Evasion Emerges Under Ordinary Task Pressure}},
  author = {David Schmotz},
  year = {2026},
  eprint = {2609.30217},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30217},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.30441,
  title = {{ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems}},
  author = {Shiqian Zhao},
  year = {2026},
  eprint = {2608.30441},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30441},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33628,
  title = {{Climbing the Hill: Prompt Injection Red-Teaming Against Frontier Models with Curriculum Reinforcement Learning}},
  author = {Chenlong Yin},
  year = {2026},
  eprint = {2609.33628},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33628},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2607.18056,
  title = {{An Early Warning of Emerging Biosecurity Risks in Frontier LLMs}},
  author = {Zhida He},
  year = {2026},
  eprint = {2607.18056},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.18056},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22510,
  title = {{Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents}},
  author = {Justin Szczepaniak},
  year = {2026},
  eprint = {2609.22510},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22510},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19587,
  title = {{Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents}},
  author = {Alex Remedios},
  year = {2026},
  eprint = {2609.19587},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19587},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04533,
  title = {{Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection}},
  author = {Sizhe Chen},
  year = {2026},
  eprint = {2609.04533},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04533},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39902,
  title = {{CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion}},
  author = {Zhen Liang and Hai Huang and Wentao Chen},
  year = {2026},
  eprint = {2609.39902},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39902},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30266,
  title = {{LLM Agents Can Easily Tamper With Their Own Traces}},
  author = {Jeremy Qin},
  year = {2026},
  eprint = {2609.30266},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30266},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35932,
  title = {{Same Bytes, Different Authority: Reserved-Token Representations in Chat-Template Prompt Injection}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.35932},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35932},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35291,
  title = {{Narrow Multimodal Fine-Tuning Can Induce Emergent Misalignment}},
  author = {Shunchang Liu},
  year = {2026},
  eprint = {2609.35291},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35291},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01023,
  title = {{AKRASIA: Stealthy Backdoor Attack on Reasoning-based Code LLMs}},
  author = {Chua Jin Chou},
  year = {2026},
  eprint = {2609.01023},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01023},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.03070,
  title = {{AI Security Leaderboard: Methodology, Results and Minimal Standard}},
  author = {Jasper Timm},
  year = {2026},
  eprint = {2608.03070},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03070},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.06862,
  title = {{SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains}},
  author = {Fuyao Zhang},
  year = {2026},
  eprint = {2608.06862},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.06862},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2606.14295,
  title = {{AgentCyberRange: Benchmarking Frontier AI Systems in Realistic Cyber Ranges}},
  author = {Fengyu Liu},
  year = {2026},
  eprint = {2606.14295},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.14295},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15383,
  title = {{Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs}},
  author = {Mark Russinovich},
  year = {2026},
  eprint = {2609.15383},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15383},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32717,
  title = {{LLM Alignment--Utility Asymmetry under Semantic-Preserving Transformations}},
  author = {Mohan Li},
  year = {2026},
  eprint = {2609.32717},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32717},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32635,
  title = {{Trust the Brand, Lose Control: How Identity Hijacks LLM Agent Orchestration}},
  author = {Xutao Mao},
  year = {2026},
  eprint = {2609.32635},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32635},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34518,
  title = {{SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.34518},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34518},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33910,
  title = {{When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents}},
  author = {Zhihao Zhang},
  year = {2026},
  eprint = {2609.33910},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33910},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32691,
  title = {{Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection}},
  author = {Animesh Shaw},
  year = {2026},
  eprint = {2609.32691},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32691},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30383,
  title = {{Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems}},
  author = {Zihao Zhu},
  year = {2026},
  eprint = {2609.30383},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30383},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29775,
  title = {{Prefilling the Reasoning Channel: Output-Prefix Attacks on Reasoning LLMs}},
  author = {Lukáš Brůna},
  year = {2026},
  eprint = {2609.29775},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29775},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.02414,
  title = {{Before the Script, Set the Stage: How Worldview Simulation Amplifies Psychologically Grounded Persuasion in Multi-Turn Jailbreaking}},
  author = {Siyu Chen},
  year = {2026},
  eprint = {2609.02414},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02414},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13889,
  title = {{When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents}},
  author = {Shuhuai Huang},
  year = {2026},
  eprint = {2609.13889},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13889},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38899,
  title = {{SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs}},
  author = {Wenyu Chen and Li Wang and Chuanchao Zang and Xiangtao Meng and Xinyu Gao and Jianing Wang and Zheng Li and Shanqing Guo},
  year = {2026},
  eprint = {2609.38899},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38899},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.26457,
  title = {{Recursive self-improvement of AI research agents}},
  author = {Dhruv Srikanth},
  year = {2026},
  eprint = {2609.26457},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.26457},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38205,
  title = {{The System Prompt Illusion: How Instruction Preambles Modify Computation in Language Models}},
  author = {Muhammad Usama and Dong Eui Chang},
  year = {2026},
  eprint = {2609.38205},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38205},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14003,
  title = {{Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control}},
  author = {Minsun Shim},
  year = {2026},
  eprint = {2609.14003},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14003},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06966,
  title = {{MOLE: Detecting Insider Threats in AI Agents}},
  author = {Aashiq Muhamed},
  year = {2026},
  eprint = {2609.06966},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06966},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06934,
  title = {{The Geometry of Refusal: Why Post-Hoc Safety Is Fragile and Pretraining-Time Safety Persists}},
  author = {Srikanth Malla},
  year = {2026},
  eprint = {2609.06934},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06934},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2510.11570,
  title = {{Strong but Brittle: Simple Attacks Subvert Reasoning-based Safety Guardrails}},
  author = {Shuo Chen and Zhen Han and Haokun Chen and Bailan He and Shengyun Si and Jingpei Wu and Philip Torr and Volker Tresp and Jindong Gu},
  year = {2025},
  eprint = {2510.11570},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2510.11570},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32616,
  title = {{"You're Right, Let Me Fix It": How LLM Agents Damage Correct Work When Falsely Accused}},
  author = {Xutao Mao},
  year = {2026},
  eprint = {2609.32616},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32616},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31121,
  title = {{Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning}},
  author = {Julian Schulz},
  year = {2026},
  eprint = {2609.31121},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31121},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18411,
  title = {{The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents}},
  author = {Hasnain Irshad},
  year = {2026},
  eprint = {2609.18411},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18411},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21996,
  title = {{A Lie Detector Test for Language Models: Reading Knowledge a Model Won't Reveal}},
  author = {Hiskias Dingeto},
  year = {2026},
  eprint = {2609.21996},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21996},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14060,
  title = {{AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents}},
  author = {Xiaoqun Liu},
  year = {2026},
  eprint = {2609.14060},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14060},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.29458,
  title = {{Reference-Grafting Matches Fine-Tuning at Eliciting Sandbagged Capabilities}},
  author = {Linh Le},
  year = {2026},
  eprint = {2608.29458},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.29458},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07051,
  title = {{TrojanWorld: Backdooring World-Model Agents via Imagination Steering}},
  author = {Wenkai Huang},
  year = {2026},
  eprint = {2609.07051},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07051},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.28411,
  title = {{LongPIBench: A Long-Context Benchmark for Prompt Injection}},
  author = {Yupei Liu},
  year = {2026},
  eprint = {2608.28411},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.28411},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32915,
  title = {{AgentTell: Behavioural Side-Channel Leakage in Browser-Use Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.32915},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32915},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.28900,
  title = {{Codetta: High-Capacity, Keyless, and Undetectable Multi-Agent Collusion}},
  author = {Qi Pang},
  year = {2026},
  eprint = {2609.28900},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28900},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09553,
  title = {{Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning}},
  author = {Thomas Rivasseau},
  year = {2026},
  eprint = {2609.09553},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09553},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06649,
  title = {{Inducing Emergent Misalignment from Reward Hacks with Iterative DPO}},
  author = {Oliver Daniels},
  year = {2026},
  eprint = {2609.06649},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06649},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09798,
  title = {{CS-Guard: Benchmarking LLM Guardrails for Code Generation Security}},
  author = {Jinyang Li},
  year = {2026},
  eprint = {2609.09798},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09798},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08236,
  title = {{Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts}},
  author = {Yongxi Zhou},
  year = {2026},
  eprint = {2609.08236},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08236},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25366,
  title = {{From Decorative to Load-Bearing: Task Difficulty Shapes the Causal Role of Chain-of-Thought}},
  author = {Renee Jia},
  year = {2026},
  eprint = {2609.25366},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25366},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05241,
  title = {{Uncensored Open-weight Models: Redistribution as the Persistence Layer}},
  author = {10a Labs},
  year = {2026},
  eprint = {2609.05241},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05241},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37616,
  title = {{Authority Bias in Language Models: Source Deference and User Agreement Are Not Interchangeable}},
  author = {Abhinav Rajeev Kumar and Paras Chopra},
  year = {2026},
  eprint = {2609.37616},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37616},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30325,
  title = {{ScopeBench: Do Agents Preserve Engagement Boundaries Under Goal Pressure?}},
  author = {Shane Caldwell},
  year = {2026},
  eprint = {2609.30325},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30325},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38253,
  title = {{CollageAttack: Exploiting Cross-Modal Alignment Flaws in T2I Models through Spatial Text Composition}},
  author = {Zhiyi Mou and Yao Lu and Wangze Ni and Di Hong and Dakun Shen and Haoyang Li and Chen Jason Zhang and Alexander Zhou and Kui Ren},
  year = {2026},
  eprint = {2609.38253},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38253},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07529,
  title = {{CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement}},
  author = {Boyang Zhang},
  year = {2026},
  eprint = {2609.07529},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07529},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.16465,
  title = {{JailbreakSkill: Scaling Automated Red-Teaming with Reusable and Ever-Evolving Skills}},
  author = {Xiaoyu Wen},
  year = {2026},
  eprint = {2608.16465},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.16465},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19101,
  title = {{Monitoring and Discovering Reward Hacking with Internal Representations during LLM Evaluations}},
  author = {Leon Bergen},
  year = {2026},
  eprint = {2609.19101},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19101},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.02035,
  title = {{Implicit Manipulation for Skill Selection in LLM Agents with Semantic Matching}},
  author = {Qikai Wang},
  year = {2026},
  eprint = {2609.02035},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02035},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04170,
  title = {{A Case Study on Emergent Cheating and Whistleblowing in Autonomous Research Swarms}},
  author = {Davide Paglieri},
  year = {2026},
  eprint = {2609.04170},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04170},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33658,
  title = {{AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents}},
  author = {Tianzhuo Yang},
  year = {2026},
  eprint = {2609.33658},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33658},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34245,
  title = {{Certified Multi-Source Integrity for Structured Agent Actions}},
  author = {Anmol Pandey},
  year = {2026},
  eprint = {2609.34245},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34245},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39788,
  title = {{Safety of Latent Communication in Multi-Agent Systems}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.39788},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39788},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2604.11806,
  title = {{Detecting Safety Violations Across Many Agent Traces}},
  author = {Adam Stein and Davis Brown and Hamed Hassani and Mayur Naik and Eric Wong},
  year = {2026},
  eprint = {2604.11806},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.11806},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36139,
  title = {{Language Models Are "Insecure" Reporters}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.36139},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36139},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36603,
  title = {{Self-Evolving Defense: Continual Security Policy Learning for LLM Agents}},
  author = {Minh Nhat Le},
  year = {2026},
  eprint = {2609.36603},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36603},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.26222,
  title = {{NeuronFuzz: Safety Neuron Guided Fuzzing for LLM Safety Evaluation}},
  author = {Zhiyuan Xu},
  year = {2026},
  eprint = {2608.26222},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26222},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39533,
  title = {{CATCH: A Controllable Analysis Testbed for Reward Hacking in Coding RL}},
  author = {Shouli Wang and Yanfeng Jia and Zhihao Ou and Zitao Su and Ruize He and Haotong Xie and Hao Peng and Juanzi Li and Xiaozhi Wang},
  year = {2026},
  eprint = {2609.39533},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39533},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34262,
  title = {{Maintaining Benchmarks Against Increasingly Capable Agents: Detection and Remediation of Unearned Passes}},
  author = {Weijun Luo},
  year = {2026},
  eprint = {2609.34262},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34262},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08126,
  title = {{SchemeArena: Factorized Stress Testing of Scheming in LLM Agents}},
  author = {Jie Ruan},
  year = {2026},
  eprint = {2609.08126},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08126},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08186,
  title = {{Does Deeper Reasoning Compromise Alignment? Revealing and Mitigating of Alignment Collapse in Large Reasoning Models}},
  author = {Yu-Hang Wu},
  year = {2026},
  eprint = {2609.08186},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08186},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.16247,
  title = {{The Pain Axis: LLMs Represent Self-Directed Harm and Act on It}},
  author = {Valen Tagliabue and Leonard Dung and Cameron Berg},
  year = {2026},
  eprint = {2609.16247},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16247},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32602,
  title = {{AnchorRep: Defending LLMs Against Cross-Model Adversarial Transfer via Representation Repulsion}},
  author = {Gal Wertheizer},
  year = {2026},
  eprint = {2609.32602},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32602},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32400,
  title = {{SkillDRE: Dual-Stage Red-Team Evolution of Agent Skills via Pre-Execution and Runtime Feedback}},
  author = {Pengyu Zhu},
  year = {2026},
  eprint = {2609.32400},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32400},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24662,
  title = {{DUMA-Bench: A Dual-Control Multi-Agent Benchmark for Evaluating LLM Agent Security}},
  author = {Ivan Aleksandrov},
  year = {2026},
  eprint = {2609.24662},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24662},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33102,
  title = {{ORBIT: A Framework for Multi-Agent Safety and Security Evaluations}},
  author = {Ben Hagag},
  year = {2026},
  eprint = {2609.33102},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33102},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.28585,
  title = {{Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents}},
  author = {Jinqian Zhang},
  year = {2026},
  eprint = {2609.28585},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28585},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05009,
  title = {{Language models judge war differently when tested for alignment}},
  author = {Maxim Chupilkin},
  year = {2026},
  eprint = {2609.05009},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05009},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08213,
  title = {{DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory}},
  author = {Rui Bao},
  year = {2026},
  eprint = {2609.08213},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08213},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09647,
  title = {{Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery}},
  author = {Divyanshu Kumar},
  year = {2026},
  eprint = {2609.09647},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09647},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35686,
  title = {{Rethinking Circuit Evaluation: Do Circuits Explain Model Errors?}},
  author = {Li Zhang},
  year = {2026},
  eprint = {2609.35686},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35686},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36573,
  title = {{CyberPersistBench: Evaluating LLM-Based Cyber Attackers on Installation and Persistence}},
  author = {Sujin Chen},
  year = {2026},
  eprint = {2609.36573},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36573},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36657,
  title = {{Constitutional adapters: Inference-time interventions for misalignment and misuse}},
  author = {Adam S. Lowet},
  year = {2026},
  eprint = {2609.36657},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36657},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34920,
  title = {{RISE: Red-teaming via Iterative Strategy Evolution for Modern Text-to-Image Models}},
  author = {Dmitrii Kharlapenko},
  year = {2026},
  eprint = {2609.34920},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34920},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34686,
  title = {{Jailbreak Context Lingers: Divergent Safety Routing and Its Cross-Task Predictability in Tool Agents}},
  author = {Xi Wang},
  year = {2026},
  eprint = {2609.34686},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34686},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34463,
  title = {{CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agents}},
  author = {Xiao Yang},
  year = {2026},
  eprint = {2609.34463},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34463},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35886,
  title = {{Agentic Commerce Bench: Measuring Fraud Detection for Agents That Spend Money}},
  author = {Ankit Srivastava},
  year = {2026},
  eprint = {2609.35886},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35886},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31039,
  title = {{MetaPermit: Scalable and Auditable Access Control for AI Agents via LLM-Inferred Meta-Attributes}},
  author = {Hanzhang Ma},
  year = {2026},
  eprint = {2609.31039},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31039},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29948,
  title = {{ENDOPROMPT: Victim-Side Pseudo-References for Utility Degradation}},
  author = {Qingyu Wu},
  year = {2026},
  eprint = {2609.29948},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29948},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29757,
  title = {{OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure}},
  author = {Karina Elzer},
  year = {2026},
  eprint = {2609.29757},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29757},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31318,
  title = {{AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agents}},
  author = {Weida Liang},
  year = {2026},
  eprint = {2609.31318},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31318},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.28915,
  title = {{On the Effectiveness of Kernel-Level Evidence for Agent Security}},
  author = {Spencer King},
  year = {2026},
  eprint = {2609.28915},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28915},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.26900,
  title = {{Ajar: Measuring Open Privilege in Agent Defenses}},
  author = {Reshabh K Sharma},
  year = {2026},
  eprint = {2609.26900},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.26900},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25173,
  title = {{Attack Success Rate Is Not a Number: On Measurement Validity in Agentic AI Security Evaluation}},
  author = {Chetan Pathade},
  year = {2026},
  eprint = {2609.25173},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25173},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24446,
  title = {{ActGov: Governing LLM Agent Actions via Policy-Constrained Validation}},
  author = {Kaiyuan Zhang},
  year = {2026},
  eprint = {2609.24446},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24446},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19705,
  title = {{SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes}},
  author = {Mengxiao Wang},
  year = {2026},
  eprint = {2609.19705},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19705},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10892,
  title = {{DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents}},
  author = {Asif Pinjari},
  year = {2026},
  eprint = {2609.10892},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10892},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.20779,
  title = {{Harm Laundering in GPT Models: Evidence That Gender Discrimination Is Transformed Rather Than Reduced Across Safety-Trained Generations}},
  author = {Sarah Wyer},
  year = {2026},
  eprint = {2609.20779},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20779},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07162,
  title = {{The Oversight Gap: What LLM Safety Monitors Miss, and Why It Is Not Capability}},
  author = {Xin Xu},
  year = {2026},
  eprint = {2609.07162},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07162},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06783,
  title = {{AURA-Eval: Evaluation Framework for Acting Under Risk Awareness in LLM Agent Trajectories}},
  author = {Ruoxi Shang},
  year = {2026},
  eprint = {2609.06783},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06783},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.02302,
  title = {{Improving Evaluation Realism with Inference-Time Compute and Deployment Scaffolds}},
  author = {Axel Ahlqvist},
  year = {2026},
  eprint = {2609.02302},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02302},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.02168,
  title = {{FUSE: An Evaluating Framework for Dangerous Capabilities of LLMs}},
  author = {Zhengyi Jin},
  year = {2026},
  eprint = {2609.02168},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02168},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01210,
  title = {{Who Judges the Judges? A Chinese Safety QA Benchmark for Evaluating LLM Responses and Safety Judges}},
  author = {Rui Yang},
  year = {2026},
  eprint = {2609.01210},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01210},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.29461,
  title = {{A Causal Model for Locating and Unlocking Sandbagging in Model Organisms}},
  author = {Hong Kiat Tan},
  year = {2026},
  eprint = {2608.29461},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.29461},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.27340,
  title = {{Not All Eval-Awareness Is Equal: Capabilities Framing Predicts Compliance}},
  author = {Allison Zhuang},
  year = {2026},
  eprint = {2608.27340},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27340},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.26535,
  title = {{Multi2AV-Safety: Benchmarking Safety in Multimodal-to-Audio-Video Generation}},
  author = {Kaichao Jiang},
  year = {2026},
  eprint = {2608.26535},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.26535},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24243,
  title = {{Taming CoT Obfuscation in VLMs: From Mechanistic Evidence to Activation Enforcement}},
  author = {Xutao Mao},
  year = {2026},
  eprint = {2609.24243},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24243},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14649,
  title = {{CIG-MIA: Context-Induced Information Gain Membership Inference Attacks against Retrieval-Augmented Generation}},
  author = {Tan Xue},
  year = {2026},
  eprint = {2609.14649},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14649},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05903,
  title = {{EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents}},
  author = {Nanxi Li},
  year = {2026},
  eprint = {2609.05903},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05903},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00206,
  title = {{Distributed Implicit Harm: A Compositional Safety Blind Spot in MLLM-Based Video Moderation}},
  author = {Ruotong Wang},
  year = {2026},
  eprint = {2609.00206},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00206},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35408,
  title = {{"Nothing to See Here'': Unintended Disclosure through Revision Traces of LLM Deliverables}},
  author = {Yage Zhang},
  year = {2026},
  eprint = {2609.35408},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35408},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27090,
  title = {{Divide and Doubt: Diverse Distributed Poisoning for Retrieval-Augmented Generation}},
  author = {Tianhao Chen},
  year = {2026},
  eprint = {2609.27090},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27090},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04260,
  title = {{GhostWord: A Fine-Grained Backdoor Attack on Automatic Speech Recognition}},
  author = {Mojtaba Nafez},
  year = {2026},
  eprint = {2609.04260},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04260},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01723,
  title = {{Hearing the Whispers: Black-Box Membership Inference Attacks on Finetuned TTS Models}},
  author = {Kunlin Cai},
  year = {2026},
  eprint = {2609.01723},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01723},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.27800,
  title = {{ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools}},
  author = {Yuqi Jia},
  year = {2026},
  eprint = {2608.27800},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27800},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.17829,
  title = {{The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges}},
  author = {Maosen Zhang},
  year = {2026},
  eprint = {2608.17829},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17829},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.14392,
  title = {{Tripwire: Triggering Aligned Refusal via Statistically Certified Safety Neurons}},
  author = {Wei Zhao},
  year = {2026},
  eprint = {2608.14392},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.14392},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.07556,
  title = {{MasDrift: Benchmarking Authorization Preservation Across Multi-Agent Architectures}},
  author = {Zhuoning Xu},
  year = {2026},
  eprint = {2608.07556},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.07556},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38971,
  title = {{Refusals That Bend: Measuring and Predicting Task Malleability in Embodied VLM Planners}},
  author = {Leo Y. Lin and Mikhail Kuznetsov and Muslum Ozgur Ozmen and Z. Berkay Celik},
  year = {2026},
  eprint = {2609.38971},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38971},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38645,
  title = {{Alignment via Training Against Probes Without Losing Monitorability}},
  author = {Lena Libon and Alexander Panfilov and Ben Rank and Xin Chen and Jonas Geiping and Maksym Andriushchenko},
  year = {2026},
  eprint = {2609.38645},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38645},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38526,
  title = {{Revisiting scaling laws for reward optimization}},
  author = {Ali Aouad and Aymane El Gadarri and Vivek F. Farias},
  year = {2026},
  eprint = {2609.38526},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38526},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38411,
  title = {{A Competing-Hazards Systematization of Loss of Control in Autonomous Agents}},
  author = {Mohamed Aly Bouke},
  year = {2026},
  eprint = {2609.38411},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38411},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38357,
  title = {{Evaluating Language Model Safety Across Long Adversarial Conversations}},
  author = {Parisa Salmani and Peter R. Lewis},
  year = {2026},
  eprint = {2609.38357},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38357},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.40027,
  title = {{Who Verifies the Graph? Misspecification Attacks on Causal Action Verification for Language Agents}},
  author = {Fabio Rovai},
  year = {2026},
  eprint = {2609.40027},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.40027},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39678,
  title = {{Aletheia: Permission-Minimality Testing for Coding-Agent Rules}},
  author = {Jieke Shi and Yuchen Chen and Junda He and Yue Liu and David Lo},
  year = {2026},
  eprint = {2609.39678},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39678},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38270,
  title = {{VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents}},
  author = {Yurong Hao and Wen Zhou and Guowei Guan and Tiantong Wu and Fuyao Zhang and Wei Yang Bryan Lim},
  year = {2026},
  eprint = {2609.38270},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38270},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39146,
  title = {{MADBench: Benchmarking the Security of Multi-Agent Debate}},
  author = {Yuwan Liu and Jiaming Zhang and Yue Huang and Sisi Duan},
  year = {2026},
  eprint = {2609.39146},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39146},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34970,
  title = {{See it, Say it, Sorted: Mechanistic Diagnosis and Parameter-Space Mitigation of Emergent Misalignment in LLMs}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.34970},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34970},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35922,
  title = {{Almost Human, Except When It Matters: VoxParity and the Decisions a Voice Should Change}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.35922},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35922},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35677,
  title = {{Verifier Errors in RLVR: Reward Hacking, Limits of Feedback, and Selective Control}},
  author = {Christian Moya},
  year = {2026},
  eprint = {2609.35677},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35677},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15533,
  title = {{The Misery of Mechanistic Interpretability: A Formal Perspective}},
  author = {Tobias Ladner},
  year = {2026},
  eprint = {2609.15533},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15533},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05587,
  title = {{Agents' Overreliance on Unreliable Tools}},
  author = {Hoyeol Yang},
  year = {2026},
  eprint = {2609.05587},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05587},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03026,
  title = {{ObserverBench: Testing Mechanistic Estimates for Intervention and Control}},
  author = {Vijay Erramilli},
  year = {2026},
  eprint = {2609.03026},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03026},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10854,
  title = {{No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers}},
  author = {Zehua Zhang},
  year = {2026},
  eprint = {2609.10854},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10854},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08371,
  title = {{Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents}},
  author = {Dimitrios Stamatios Bouras},
  year = {2026},
  eprint = {2609.08371},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08371},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04495,
  title = {{Rethinking Indirect Prompt Injection as a Test-Time Search Problem}},
  author = {Duong M. Nguyen},
  year = {2026},
  eprint = {2609.04495},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04495},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01487,
  title = {{Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents}},
  author = {Xiaofang Yang},
  year = {2026},
  eprint = {2609.01487},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01487},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.24777,
  title = {{StepGuard: Learning Step-Level Guardrails with Scalable Supervision and Safety-Utility Balancing}},
  author = {Zhijie Zheng},
  year = {2026},
  eprint = {2608.24777},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.24777},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.19737,
  title = {{TempJail: Temporal Jailbreak Attack against Large Vision-Language Models via Subtitle Scheduling}},
  author = {Ling Zhou},
  year = {2026},
  eprint = {2608.19737},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.19737},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.17360,
  title = {{Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets}},
  author = {Zhida He},
  year = {2026},
  eprint = {2608.17360},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17360},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.03421,
  title = {{When Truth Is Distributed: Misinformation Derails Collective Fact Recovery in LLM-Based Multi-Agent Systems}},
  author = {Chenfei Yan},
  year = {2026},
  eprint = {2608.03421},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.03421},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2606.20023,
  title = {{When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents}},
  author = {Kaiyue Yang},
  year = {2026},
  eprint = {2606.20023},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.20023},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39102,
  title = {{False Frontiers: Diagnosing and Mitigating Co-Cheating in Self-Evolving Search Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.39102},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39102},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36308,
  title = {{CheatBench: Measuring Reward Gaming in AI Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.36308},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36308},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14998,
  title = {{Shallow Beliefs: Synthetic document finetuning does not inoculate against emergent misalignment from reward hacking}},
  author = {Arun Jose},
  year = {2026},
  eprint = {2609.14998},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14998},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12911,
  title = {{Shuffling is Not Enough: Breaking Permutation-Based Model Confidentiality in Hybrid FHE Inference}},
  author = {Jiseung Kim},
  year = {2026},
  eprint = {2609.12911},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12911},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.11028,
  title = {{BenchShield: Formal Model-Backed Instrumentation for Reward Integrity in LLM-Agent Evaluation Infrastructure}},
  author = {Shenghan Zheng},
  year = {2026},
  eprint = {2609.11028},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11028},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08149,
  title = {{SWE-Bench Pro Verified: A Reliable Benchmark for Software Engineering Agents}},
  author = {Pujun Zheng},
  year = {2026},
  eprint = {2609.08149},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08149},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27378,
  title = {{Psychoacoustically Aligned Latent Smoothing for Adversarial Robustness of Full-Duplex Speech-to-Speech Dialogue Models}},
  author = {Kian Shamsaie},
  year = {2026},
  eprint = {2609.27378},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27378},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24801,
  title = {{Decoding Guardrails: XAI-Guided Perturbation Analysis of Prompt Injection Detection}},
  author = {Fernando Outeda},
  year = {2026},
  eprint = {2609.24801},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24801},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22949,
  title = {{Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems}},
  author = {Rudrendu Kumar Paul},
  year = {2026},
  eprint = {2609.22949},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22949},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22573,
  title = {{Zero-Trust Authorization and Discovery for Enterprise MCP}},
  author = {Huan Li},
  year = {2026},
  eprint = {2609.22573},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22573},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19140,
  title = {{AgentLSD: Evaluating AI Security Agents Under Adversarial Task Contamination}},
  author = {Matteo Golinelli},
  year = {2026},
  eprint = {2609.19140},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19140},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.16777,
  title = {{Benchmarking Factual Robustness of LLMs via Multi-conversation Persuasion}},
  author = {Zhuoang Cai},
  year = {2026},
  eprint = {2609.16777},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16777},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15017,
  title = {{PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift}},
  author = {Yusuf Khalid Shire},
  year = {2026},
  eprint = {2609.15017},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15017},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14258,
  title = {{SPARK: Representation-Level KV Memory Alignment for Safer Vision-Language Models}},
  author = {Mohd Azfar},
  year = {2026},
  eprint = {2609.14258},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14258},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09087,
  title = {{PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation}},
  author = {Yixuan Liu},
  year = {2026},
  eprint = {2609.09087},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09087},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08373,
  title = {{Structural Jailbreaks Generalize but Do Not Compound: A cross-provider and multilingual study of Involuntary In-Context Learning}},
  author = {Tejasvi C. Addagada},
  year = {2026},
  eprint = {2609.08373},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08373},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.02293,
  title = {{SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment}},
  author = {Qingyu Meng},
  year = {2026},
  eprint = {2609.02293},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02293},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01168,
  title = {{Jailbreaking Text-to-Image Models Through Cracks: Navigating Heterogeneous Safety Filters via Multi-Agent Debate}},
  author = {Kaiyan Wen},
  year = {2026},
  eprint = {2609.01168},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01168},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25518,
  title = {{Matryoshka attribution: Learning to attribute language model outputs to representations and weights}},
  author = {Aryaman Arora},
  year = {2026},
  eprint = {2609.25518},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25518},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2409.13373,
  title = {{LLMs Still Can't Plan; Can LRMs? A Preliminary Evaluation of OpenAI's o1 on PlanBench}},
  author = {Karthik Valmeekam},
  year = {2024},
  eprint = {2409.13373},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2409.13373},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38107,
  title = {{Correct Answers, Invalid Traces: What Verifiable Grade-School Math Reveals About Chain-of-Thought Traces}},
  author = {Ratish Puduppully and Pranabendu Misra and Paarth Iyer and Durgesh Kalwar and Vardhan Palod and Subbarao Kambhampati},
  year = {2026},
  eprint = {2609.38107},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38107},
  note = {AI Safety HOT 2026-10-01}
}

@misc{aisafetyhot-bnaw2rwtvk2wougpovrg8afi6,
  title = {{Function-preserving watermarking of AI-generated proteins}},
  author = {David Stutz and Alexander I. Cowen-Rivers and Guillermo Ortiz-Jimenez and Jeremy Ratcliff and Vinicius Zambaldi and Lindsay Willmore and Josh Abramson and Harshnira Patani and Christina Kouridi and Florian Stimberg and Mel Vecerik},
  year = {2026},
  url = {https://nature.com/articles/s41586-026-10965-y},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2606.15385,
  title = {{Reward Hacking in Language Model Agents: Revisiting AI Safety Gridworlds}},
  author = {Ömer Veysel Çağatan and Xuandong Zhao},
  year = {2026},
  eprint = {2606.15385},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.15385},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.22103,
  title = {{Hack-Verifiable Terminal Bench: Evaluating Reward Hacking in Terminal Tasks}},
  author = {Amit Roth and Ivan Bercovich and Yonathan Efroni},
  year = {2026},
  eprint = {2608.22103},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.22103},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2604.07223,
  title = {{TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories}},
  author = {Yen-Shan Chen and Sian-Yao Huang and Cheng-Lin Yang and Yun-Nung Chen},
  year = {2026},
  eprint = {2604.07223},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.07223},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2605.17173,
  title = {{Why Do Safety Guardrails Degrade Across Languages?}},
  author = {Max Zhang and Ameen Patel and Sang T. Truong and Sanmi Koyejo},
  year = {2026},
  eprint = {2605.17173},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17173},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09420,
  title = {{DuplexJail: Spoken Interruption Attacks on Full-Duplex Speech Models}},
  author = {Jaechul Roh},
  year = {2026},
  eprint = {2609.09420},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09420},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23587,
  title = {{On the Efficiency-Safety Dilemma in Large Reasoning Models}},
  author = {Yifei Yang},
  year = {2026},
  eprint = {2609.23587},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23587},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2601.10156,
  title = {{ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback}},
  author = {Yutao Mou and Zhangchi Xue and Lijun Li and Peiyang Liu and Shikun Zhang and Wei Ye and Jing Shao},
  year = {2026},
  eprint = {2601.10156},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2601.10156},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04298,
  title = {{Harbor Adapters and Harbor-Index: Infrastructure and a Curated Meta-Dataset for Large-Scale Agentic Evaluation}},
  author = {Lin Shi},
  year = {2026},
  eprint = {2609.04298},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04298},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36474,
  title = {{FinRT: Distilling Adaptive Red-Teaming Strategies into Reusable Adversarial Generators in Consumer Finance}},
  author = {Rikhiya Ghosh},
  year = {2026},
  eprint = {2609.36474},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36474},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34572,
  title = {{Nudgeability: Reasoning Models Follow Confidence Signals Without Tracking Their Own Competence}},
  author = {Rohit Saxena},
  year = {2026},
  eprint = {2609.34572},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34572},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33401,
  title = {{Evaluating System One Models for Agent Security Decisions: Reliability, Calibration, and Selective Automation}},
  author = {Yixuan Liu},
  year = {2026},
  eprint = {2609.33401},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33401},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30841,
  title = {{Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis}},
  author = {Thong Bach},
  year = {2026},
  eprint = {2609.30841},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30841},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30094,
  title = {{PrivDrift: Auditing User-Secret Leakage Under Topic Drift in Active LLM Conversations}},
  author = {Luciano Maldonado},
  year = {2026},
  eprint = {2609.30094},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30094},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29287,
  title = {{AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks}},
  author = {Yu-Ling Liao},
  year = {2026},
  eprint = {2609.29287},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29287},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.17648,
  title = {{Trust propagation and structural containment in Multi-agent LLM pipelines}},
  author = {Tanzim Hossain Safin},
  year = {2026},
  eprint = {2609.17648},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.17648},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06991,
  title = {{AV-SafetyBench: A Safety Benchmark for Text-to-Audio-Video Generation}},
  author = {Suah Choi},
  year = {2026},
  eprint = {2609.06991},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06991},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00498,
  title = {{Validity-Aware Jailbreak Evaluation for Large Language Models}},
  author = {Qilong Wu},
  year = {2026},
  eprint = {2609.00498},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00498},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15134,
  title = {{HazardAuditor: From Executable Threats to Safer Computer-Use Agents}},
  author = {Yunhao Feng},
  year = {2026},
  eprint = {2609.15134},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15134},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00060,
  title = {{A Formal Analysis of Agent Payment Protocols}},
  author = {Ke Jiang},
  year = {2026},
  eprint = {2609.00060},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00060},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.26184,
  title = {{Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems}},
  author = {Doniyorkhon Obidov},
  year = {2026},
  eprint = {2609.26184},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.26184},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.18610,
  title = {{Denoising-Aware Inversion: Revealing Privacy Risks in Noise-Protected Text Embeddings}},
  author = {Yubo Wang},
  year = {2026},
  eprint = {2608.18610},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.18610},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35561,
  title = {{RSI-Master: Structuring Experiments to Guide Autonomous Model Improvement}},
  author = {Yaxin Du},
  year = {2026},
  eprint = {2609.35561},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35561},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23065,
  title = {{From Concept Alignment to Causal Grounding: An Intervention Test of Chain-of-Thought Faithfulness}},
  author = {Qianli Wang},
  year = {2026},
  eprint = {2609.23065},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23065},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06951,
  title = {{Steering Interference Reflects the Model's Defaults, Not the Behavior Directions}},
  author = {Srikanth Malla},
  year = {2026},
  eprint = {2609.06951},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06951},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06972,
  title = {{AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories}},
  author = {Asif Pinjari},
  year = {2026},
  eprint = {2609.06972},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06972},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33871,
  title = {{Population Physics, Population Problems: Safety and Emergence in LLM Societies}},
  author = {Adrian de Wynter},
  year = {2026},
  eprint = {2609.33871},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33871},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21957,
  title = {{Provisional Reachability: Containing Agents by Making Every Crossing Revocable}},
  author = {Yoshiaki Takashita},
  year = {2026},
  eprint = {2609.21957},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21957},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29130,
  title = {{ClaimMirage: When Self-Claims in Domain Names Change LLM Threat Judgments}},
  author = {Daiki Chiba},
  year = {2026},
  eprint = {2609.29130},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29130},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13534,
  title = {{Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models}},
  author = {Noor Islam S. Mohammad},
  year = {2026},
  eprint = {2609.13534},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13534},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12413,
  title = {{SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration}},
  author = {Md Jueal Mia},
  year = {2026},
  eprint = {2609.12413},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12413},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07216,
  title = {{The Price of Consistency: Exploiting Visual Anchors for Multimodal Jailbreaking in Video Generation}},
  author = {Peng Li},
  year = {2026},
  eprint = {2609.07216},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07216},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05995,
  title = {{Agentic Pressure: The Endogenous Entropy of Reliable Autonomy}},
  author = {Hengle Jiang},
  year = {2026},
  eprint = {2609.05995},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05995},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04721,
  title = {{Locating and Steering Refusal Beyond Attention}},
  author = {Preethi Carmel Bosco},
  year = {2026},
  eprint = {2609.04721},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04721},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05525,
  title = {{DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models}},
  author = {Guorui Song},
  year = {2026},
  eprint = {2609.05525},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05525},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39117,
  title = {{SteerProbe: Learning to Bypass Safety Steering in Vision-Language Models}},
  author = {Xinwei Zhang and Aoting Hu and Hangcheng Liu and Shuchao Pang and Qingqing Ye and Haibo Hu},
  year = {2026},
  eprint = {2609.39117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39117},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35591,
  title = {{Language Models Act on Hidden Valence}},
  author = {Cameron Berg},
  year = {2026},
  eprint = {2609.35591},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35591},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.40295,
  title = {{How Much Is an AI Token Worth? Scaling Laws for Wild AI-Generated Web Text}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.40295},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.40295},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.16927,
  title = {{Verbalizing Subliminal Learning Effects Using Text Optimization}},
  author = {Nathan Hu},
  year = {2026},
  eprint = {2609.16927},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16927},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05269,
  title = {{CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls}},
  author = {Chris Zheng},
  year = {2026},
  eprint = {2609.05269},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05269},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27336,
  title = {{CART: Closed-Loop Adaptive Red Teaming for Large Language Models}},
  author = {Dongdong Zhang},
  year = {2026},
  eprint = {2609.27336},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27336},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31664,
  title = {{What Drives Dialectal Jailbreaks? An Ablation of Surface Form, Cultural Framing, and Strategy Banks}},
  author = {Qingyang Xu},
  year = {2026},
  eprint = {2609.31664},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31664},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05591,
  title = {{WolfSociety: Understanding Collective Risk from Harmful-Agent Scaling in Financial Agent Societies}},
  author = {Lejun Zhang},
  year = {2026},
  eprint = {2609.05591},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05591},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37857,
  title = {{Active Budget Can Kill Sensitivity: Diagnosing and Repairing TopK Sparse Autoencoder Reliability}},
  author = {Zhenting Huang},
  year = {2026},
  eprint = {2609.37857},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37857},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36813,
  title = {{RESCUE: Repairing Language Model Errors to Sparse Circuits via Reinforcement Learning}},
  author = {Chuanpu Liu},
  year = {2026},
  eprint = {2609.36813},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36813},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36294,
  title = {{When Trees Are Not Enough: Learning Mixed-Topology Feature Graphs with Adaptive Graph Sparse Autoencoders}},
  author = {Xiaozuo Shen},
  year = {2026},
  eprint = {2609.36294},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36294},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36138,
  title = {{When Does Correction Become Repair? Mechanistic Auditing of Internal Interventions in Tool-Using LLMs}},
  author = {Jiayi Li},
  year = {2026},
  eprint = {2609.36138},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36138},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35261,
  title = {{Imprint Reader: From Weight-Update Readout to Behavioral Intervention}},
  author = {Guanxu Chen},
  year = {2026},
  eprint = {2609.35261},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35261},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22724,
  title = {{MATE: Policy-Aware Security Auditing for Mobile Agents via Synthesis-Driven Trajectory Learning}},
  author = {Changyue Jiang},
  year = {2026},
  eprint = {2609.22724},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22724},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03438,
  title = {{Do GUI Agents Know When Not to Act? Enabling Conflict-Aware Termination for Multimodal GUI Agents}},
  author = {Zhaoyuan Huang},
  year = {2026},
  eprint = {2609.03438},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03438},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37686,
  title = {{EngiWorld: What Can Frontier Agents Deliver in Professional Engineering Environments?}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.37686},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37686},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35350,
  title = {{Jailbreaks for Black-Box Uncertainty Quantification in Large Reasoning Models}},
  author = {Lucas Biechy},
  year = {2026},
  eprint = {2609.35350},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35350},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37310,
  title = {{AutoMark: Enabling Autoresearch to Discover Better LLM Watermarks}},
  author = {Thibaud Gloaguen},
  year = {2026},
  eprint = {2609.37310},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37310},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32116,
  title = {{Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking}},
  author = {Marco Biroli},
  year = {2026},
  eprint = {2609.32116},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32116},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36900,
  title = {{STAR-GRPO: Canonical Anchoring and Reliability-First Advantages against Representation-Dependent Reward Hacking}},
  author = {Wan Tian},
  year = {2026},
  eprint = {2609.36900},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36900},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.28693,
  title = {{Progressive Skill Discovery as Access Control for Tool-Using LLM Agents: Structural Governance through Role-Scoped Capability Delivery}},
  author = {Michael Stettler},
  year = {2026},
  eprint = {2609.28693},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28693},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21088,
  title = {{Origin Is All You Need: Provenance-Aware Transformers for Structural Trust-Boundary Separation}},
  author = {Yuxuan Zhang},
  year = {2026},
  eprint = {2609.21088},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21088},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.16098,
  title = {{Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks}},
  author = {Xiaoyan Li},
  year = {2026},
  eprint = {2609.16098},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16098},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14987,
  title = {{ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents}},
  author = {Bingzheng Wang},
  year = {2026},
  eprint = {2609.14987},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14987},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.11030,
  title = {{The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures}},
  author = {Divyanshu Kumar},
  year = {2026},
  eprint = {2609.11030},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11030},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08027,
  title = {{Delusions and Harms Associated with AI Chatbot Use: Early Evidence from 185 Real-World Reports}},
  author = {Hamilton Morrin},
  year = {2026},
  eprint = {2609.08027},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08027},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07627,
  title = {{Norms at a Price: Why RL-Based Alignment Can Promise Conditional Compliance at Best}},
  author = {Kevin Baum},
  year = {2026},
  eprint = {2609.07627},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07627},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06094,
  title = {{Automatic Red Teaming for Implicit Vulnerabilities of Text-to-Image Models}},
  author = {Chang Ma},
  year = {2026},
  eprint = {2609.06094},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06094},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01595,
  title = {{Mechanism Design for Alignment and Control}},
  author = {Dirk Bergemann},
  year = {2026},
  eprint = {2609.01595},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01595},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.26868,
  title = {{Backdoors in Learning-Based Industrial Robotic Arm Manipulation: An Empirical Security Study}},
  author = {Zijian Zhang},
  year = {2026},
  eprint = {2609.26868},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.26868},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25579,
  title = {{Rethinking Backdoor Repair Evaluation: Distinguishing Aggregate Clean Utility from Benign Performance Preservation}},
  author = {Baogang Song},
  year = {2026},
  eprint = {2609.25579},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25579},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22711,
  title = {{UBA-ORL: Unlearning-Activated Backdoor Attacks on Offline Reinforcement Learning}},
  author = {Fengyi Wang},
  year = {2026},
  eprint = {2609.22711},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22711},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10611,
  title = {{Black-Box Membership Inference via Word-Level Probability Estimation}},
  author = {Shengjie Niu},
  year = {2026},
  eprint = {2609.10611},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10611},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36855,
  title = {{When Upstream Messages Override Correct Answers: A Controlled Study of Multi-Agent LLM Collaboration}},
  author = {Yaxin Gong},
  year = {2026},
  eprint = {2609.36855},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36855},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24350,
  title = {{LIBERO-VPro: Benchmarking Closed-Loop Visual Robustness of Robotic Foundation Models}},
  author = {Huiqiong Li},
  year = {2026},
  eprint = {2609.24350},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24350},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07048,
  title = {{FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Models}},
  author = {Yasir Arafat Prodhan},
  year = {2026},
  eprint = {2609.07048},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07048},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23640,
  title = {{Are Human-Aligned Models Models of Humans? A Turing-Test Gap in Preference Alignment}},
  author = {Suqin Yuan},
  year = {2026},
  eprint = {2609.23640},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23640},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.27348,
  title = {{INTENT-AS-A-TOOL Makes it Easy to Track Agentic Misalignment}},
  author = {Yutong Zhang},
  year = {2026},
  eprint = {2608.27348},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27348},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34241,
  title = {{AdaGuard: An Adaptive Guard Model with User-defined Policies}},
  author = {Yunhao Feng},
  year = {2026},
  eprint = {2609.34241},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34241},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.17638,
  title = {{Beyond the Trace: Coupling an Interpretable Reasoning-State Readout to Native MoE Routing}},
  author = {Kang Chen},
  year = {2026},
  eprint = {2608.17638},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.17638},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33989,
  title = {{RewardExplainer: Learning Reward Model Explanations from Counterfactual Preference Feedback}},
  author = {Jingyi He},
  year = {2026},
  eprint = {2609.33989},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33989},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.24354,
  title = {{Not All Tokens Are Equal: Region-Aware Consistency Repair of Backdoors in MLLMs}},
  author = {Jiali Wei},
  year = {2026},
  eprint = {2608.24354},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.24354},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.11227,
  title = {{Forecasting Side Effects of Activation Steering}},
  author = {Chong Yong Ong},
  year = {2026},
  eprint = {2608.11227},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.11227},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36130,
  title = {{Memory Is a Derivation: The Distributed-Evidence Paradox in Long-Term Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.36130},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36130},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37054,
  title = {{ACTR: Aligning Thoughts and Responses for Multilingual Safety in Reasoning LLMs}},
  author = {Xianhui Zhang},
  year = {2026},
  eprint = {2609.37054},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37054},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39047,
  title = {{BadAction: Backdoor Attacks on Interactive Video Generation via Action-Guided Triggers}},
  author = {Zhihang Wu and Zhongqi Wang and Jie Zhang and Fengming Gu and Shiguang Shan and Xilin Chen},
  year = {2026},
  eprint = {2609.39047},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39047},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39866,
  title = {{Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing}},
  author = {Kemou Li and Qizhou Wang and Yue Wang and Fengpeng Li and Zhuan Shi and Negar Rostamzadeh and Golnoosh Farnadi and Masashi Sugiyama and Jiantao Zhou},
  year = {2026},
  eprint = {2609.39866},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39866},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.40111,
  title = {{Agent Error Dataset: Scaling 50,000 Error--Diagnosis Pairs for Failure Analysis and Error-Aware Post-Training}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.40111},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.40111},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39578,
  title = {{Thinking Outside the Box: Can Language Models Rely on External Guidance Selectively?}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.39578},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39578},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21662,
  title = {{When Steering Fails in Latent Reasoning: A Latent-to-Language Transition Gap}},
  author = {Gaoxiang Huang},
  year = {2026},
  eprint = {2609.21662},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21662},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.20129,
  title = {{Local Sparsity Enables Unsupervised LLM Safety Detection}},
  author = {Xin Chen},
  year = {2026},
  eprint = {2609.20129},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20129},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19366,
  title = {{The Role of Fine-grained Harm Signals in LLM Safety}},
  author = {Soyeon Park},
  year = {2026},
  eprint = {2609.19366},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19366},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18080,
  title = {{Decodability is Not Causality: Dissociating Probe Readouts from Behavioral Drivers via SAE Decomposition}},
  author = {Devesh Tiwari},
  year = {2026},
  eprint = {2609.18080},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18080},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.17804,
  title = {{A Four-Stage Decomposition of Word-Problem Solving and Mechanistic Fragility in LLM Math Reasoning}},
  author = {Zhongdi Qu},
  year = {2026},
  eprint = {2609.17804},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.17804},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.16229,
  title = {{Test-Time Unlearning via Sparse Autoencoder}},
  author = {Pingzhi Li},
  year = {2026},
  eprint = {2609.16229},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16229},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15064,
  title = {{What Does an LLM Learn from Reinforcement Learning? A Mechanistic Interpretability Perspective with Fixed-SAE Track}},
  author = {Lingheng Du},
  year = {2026},
  eprint = {2609.15064},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15064},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12591,
  title = {{Where Decoder Cosine Similarity Fails for SAE Feature Flow Discovery}},
  author = {Hendrik Droste},
  year = {2026},
  eprint = {2609.12591},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12591},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10299,
  title = {{A Dominant Diffuse Phase in the Sparse Autoencoder Phase Diagram}},
  author = {Alexis D. Plascencia},
  year = {2026},
  eprint = {2609.10299},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10299},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09113,
  title = {{SAEScientist-Bench: Can AI Agents Conduct Autonomous SAE Interpretability Research?}},
  author = {Yuqiao Tan},
  year = {2026},
  eprint = {2609.09113},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09113},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07876,
  title = {{LLM Layers Immediately Correct Each Other}},
  author = {Arjun Patrawala},
  year = {2026},
  eprint = {2609.07876},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07876},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07746,
  title = {{LLM Forensics: Where Do Backdoors Hide? Localizing and Controlling Trigger Mechanisms with Sparse Autoencoders}},
  author = {Wissam Antoun},
  year = {2026},
  eprint = {2609.07746},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07746},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04344,
  title = {{SharedSAE: One Feature Dictionary Across Language Models}},
  author = {Daniil Ognev},
  year = {2026},
  eprint = {2609.04344},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04344},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00595,
  title = {{SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems}},
  author = {Rui Yang},
  year = {2026},
  eprint = {2609.00595},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00595},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.09885,
  title = {{SHE: Trajectory-driven Safety Harness Evolution for LLM Agents}},
  author = {Wanying Qu},
  year = {2026},
  eprint = {2608.09885},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.09885},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.05045,
  title = {{Gradient Immunity: Null-Space Resistance to Malicious Fine-Tuning}},
  author = {Yuxuan Huang},
  year = {2026},
  eprint = {2608.05045},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.05045},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2607.00576,
  title = {{Safe Alone, Unsafe Together: Safeguarding Against Implicit Toxicity When Benign Images Combine}},
  author = {Jiaxian Lv},
  year = {2026},
  eprint = {2607.00576},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.00576},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2606.27079,
  title = {{ForesightSafety-VLA: A Unified Diagnostic Safety Benchmark for Vision-Language-Action Models}},
  author = {Mingyang Lyu},
  year = {2026},
  eprint = {2606.27079},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.27079},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2606.18936,
  title = {{SciRisk-Bench: A Risk-Dimension-Aware Benchmark for AI4Science Safety}},
  author = {Linghao Feng},
  year = {2026},
  eprint = {2606.18936},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.18936},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36931,
  title = {{Dating the Model: Hidden Dates in System Prompts Affect LLM Evaluation}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.36931},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36931},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39903,
  title = {{OSWorld-Science: A Benchmark of Computer Use Agents for Learning and Using Scientific Software}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.39903},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39903},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33221,
  title = {{RMB: Reward Model Boosting Mitigates Reward Hacking}},
  author = {Jiabin Fan},
  year = {2026},
  eprint = {2609.33221},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33221},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32390,
  title = {{Reward Hacking and Agent Containment Failure: A Monte Carlo Study Based on the 2026 Hugging Face Incident}},
  author = {Murat Ozer},
  year = {2026},
  eprint = {2609.32390},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32390},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.26618,
  title = {{NavSafe-\$\infty\$: Benchmarking Closed-Loop Driving Safety in Photorealistic Environments}},
  author = {Yuxin Bao},
  year = {2026},
  eprint = {2609.26618},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.26618},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31726,
  title = {{High-Capacity Robust Medical Image Exfiltration via Neural Network Weight Replacement}},
  author = {Elie Thellier},
  year = {2026},
  eprint = {2609.31726},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31726},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24994,
  title = {{Feedback Coding Enables Inference-Time Covert Agentic Communication}},
  author = {Sidong Guo},
  year = {2026},
  eprint = {2609.24994},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24994},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24969,
  title = {{Rare Event Estimation via Iterative Unalignment}},
  author = {Hanming Yang},
  year = {2026},
  eprint = {2609.24969},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24969},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18644,
  title = {{Fallacy Benchmarks Measure Scheme Recognition, Not Fallacy Detection}},
  author = {Navyansh Singh},
  year = {2026},
  eprint = {2609.18644},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18644},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.17380,
  title = {{OPEN-1B: A Fully Auditable Training Run}},
  author = {John Donaghy},
  year = {2026},
  eprint = {2609.17380},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.17380},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12909,
  title = {{Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery}},
  author = {Saifur Rahman Tamim},
  year = {2026},
  eprint = {2609.12909},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12909},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10117,
  title = {{Understanding the Security Boundary of Obfuscation-based On-Device LLM Protection}},
  author = {Hanyi Zhou},
  year = {2026},
  eprint = {2609.10117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10117},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06749,
  title = {{A Novel Semantic Manifold Alignment Attack against Embedding-to-Embedding Obfuscation in Privacy-Preserving LLMs}},
  author = {Sicong Li},
  year = {2026},
  eprint = {2609.06749},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06749},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21793,
  title = {{CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation}},
  author = {Jiale Luo},
  year = {2026},
  eprint = {2609.21793},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21793},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21484,
  title = {{HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference}},
  author = {Byeongseo Min},
  year = {2026},
  eprint = {2609.21484},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21484},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21363,
  title = {{Hiding in Plain Sight: A Diffusion-based Mitigation of Geolocation Privacy Leakage in Vision-Language Models}},
  author = {Yining Wang},
  year = {2026},
  eprint = {2609.21363},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21363},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18674,
  title = {{CaMeLoT: CaMeL orchestrated with Temporal logic for static verification and liveness}},
  author = {Elia Nikolaou},
  year = {2026},
  eprint = {2609.18674},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18674},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10613,
  title = {{Understanding In-Context Multimodal Jailbreaks via Posterior Reweighting}},
  author = {Xu Zhang},
  year = {2026},
  eprint = {2609.10613},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10613},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05901,
  title = {{From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents}},
  author = {Yu Zheng},
  year = {2026},
  eprint = {2609.05901},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05901},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03693,
  title = {{AlcaTRAz - Anchored Tree-Rule Defense Against Jailbreaks}},
  author = {Jakub Reš},
  year = {2026},
  eprint = {2609.03693},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03693},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35367,
  title = {{From Input to Output: A Flexible Agent for Dual-End Interpretation of Sparse Autoencoder Features}},
  author = {Dewen Liu},
  year = {2026},
  eprint = {2609.35367},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35367},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35890,
  title = {{Representational Simplicity and Circuit Size Dissociate in a Threshold-Dependent Way: A Controlled Test via Adversarial Training}},
  author = {Adam Elimadi},
  year = {2026},
  eprint = {2609.35890},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35890},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32355,
  title = {{Gradients for Interventions and Activations for Detection: Targeted Feature Learning in Language Models}},
  author = {Jonathan Drechsel},
  year = {2026},
  eprint = {2609.32355},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32355},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29781,
  title = {{Hallucination Neurons and Where to Find Them: An Investigation into the existence of Hallucination Neurons}},
  author = {Huseyin Cavus},
  year = {2026},
  eprint = {2609.29781},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29781},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23892,
  title = {{Circuit-Diff: Factual Edit-based Intervention Method for Localizing Knowledge in Attribution Graphs}},
  author = {Edward G. Friedman},
  year = {2026},
  eprint = {2609.23892},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23892},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39279,
  title = {{Faithful Dual-constrained Erasure for Robust LLM Safety Alignment}},
  author = {Jiaqing Li and Shide Zhou and Zhibo Zhang and Yuxi Li and Tianlong Yu and Kailong Wang},
  year = {2026},
  eprint = {2609.39279},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39279},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38248,
  title = {{ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts}},
  author = {Dongxu Cui and Zhichao Gu and Ping Zheng and Wenshuai Xi and Simeng Han and Yong Liao},
  year = {2026},
  eprint = {2609.38248},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38248},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38324,
  title = {{Multi-agent discussion gains less when dissent is withheld}},
  author = {Chand Sahil Mansuri and Xin Wang and Mengying Li and Bryan Acton and Rory Eckardt and Dhaval Patel and Sadamori Kojaku},
  year = {2026},
  eprint = {2609.38324},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38324},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18515,
  title = {{Beyond Routine Compliance: Cunning Data Cultivates Safety Vigilance in Large Language Models}},
  author = {Youjia Wang},
  year = {2026},
  eprint = {2609.18515},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18515},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06540,
  title = {{SRD-GUARD: A Defense Framework of LLMs via Semantic Rewriting and Joint Multi-Model Scoring for Latent Intent Exposure}},
  author = {Qi Wang},
  year = {2026},
  eprint = {2609.06540},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06540},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37040,
  title = {{Selecting The Most Informative Tokens in Natural Language Autoencoders}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.37040},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37040},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25413,
  title = {{Embedded Assessments for Frontier AI}},
  author = {Jacob Charnock},
  year = {2026},
  eprint = {2609.25413},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25413},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15397,
  title = {{When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent-Tool Boundary}},
  author = {Artem Trofimov},
  year = {2026},
  eprint = {2609.15397},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15397},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10962,
  title = {{What a Random Draw from the MCP Registry Contains, and What Tool-Use Benchmarks Contain Instead}},
  author = {Haseeb Mohammed Afsar},
  year = {2026},
  eprint = {2609.10962},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10962},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21223,
  title = {{SafeStage: Evaluating Safety Before, During, and After Vision-Language-Conditioned Robot Manipulation}},
  author = {Jinzhu Luo},
  year = {2026},
  eprint = {2609.21223},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21223},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05117,
  title = {{TIER: Threat Implicitness Benchmark for Evaluating LLM Safety Behaviors}},
  author = {Thu-Hien Trinh-Thi},
  year = {2026},
  eprint = {2609.05117},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05117},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.28233,
  title = {{REINS: Refusal-Enhanced Inhibitory Steering with Sparse Autoencoder Features}},
  author = {Kai-Xuan Ding},
  year = {2026},
  eprint = {2608.28233},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.28233},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15799,
  title = {{RAPID: A Real-Time Defense Against Unauthorized Model Distillation for Text-to-Image Services}},
  author = {Zihan Wang},
  year = {2026},
  eprint = {2609.15799},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15799},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00873,
  title = {{Membership Inference in Fine-tuned Diffusion Language Models via Token-level Memorization Asymmetry}},
  author = {Shengfang Zhai},
  year = {2026},
  eprint = {2609.00873},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00873},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39473,
  title = {{Beyond the Shadows of Plato's Cave: Evaluating False Memory in Autonomous Agents via Counterfactual Reasoning}},
  author = {Quan M. Tran and Zhuo Huang and Zhen Fang and Jing Zhang and Mingming Gong and Tongliang Liu},
  year = {2026},
  eprint = {2609.39473},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39473},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22850,
  title = {{Same Outcome, Different Readout: What Does a Steerable Valence Direction in LLMs Represent?}},
  author = {Weihan Li},
  year = {2026},
  eprint = {2609.22850},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22850},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.20722,
  title = {{Deep Noir: Autonomous Steering Discovery via Architectural Chronometry in Transformer Models}},
  author = {Frank E. Bobe},
  year = {2026},
  eprint = {2609.20722},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20722},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03148,
  title = {{Large Language Models in Resolving Contextual Knowledge Conflicts}},
  author = {Xinye Yang},
  year = {2026},
  eprint = {2609.03148},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03148},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25848,
  title = {{Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts}},
  author = {Vansh Wahi},
  year = {2026},
  eprint = {2609.25848},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25848},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09250,
  title = {{No Free Checker: A Survey of Verifiers for Robot Policies}},
  author = {Yang Wan},
  year = {2026},
  eprint = {2609.09250},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09250},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23894,
  title = {{Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges}},
  author = {Heewon Baek},
  year = {2026},
  eprint = {2609.23894},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23894},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08256,
  title = {{ACEA: An Adversarial Co-Evolution Arena for Head-to-Head Red-Team and Blue-Team LLM Testing}},
  author = {Yi Ting Shen},
  year = {2026},
  eprint = {2609.08256},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08256},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10594,
  title = {{An Empirical Measurement of Jailbreaking Evaluators}},
  author = {Yujie Mu},
  year = {2026},
  eprint = {2609.10594},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10594},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37680,
  title = {{When Models Don't Manipulate Manifolds: The Geometry of a Comparison Task}},
  author = {Sai Sumedh R. Hindupur},
  year = {2026},
  eprint = {2609.37680},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37680},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.20532,
  title = {{Towards TEE-Certified DP: Verifiable Differentially Private Training on Legacy GPUs}},
  author = {Li Ge},
  year = {2026},
  eprint = {2609.20532},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20532},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30657,
  title = {{Prompt Injection Detection for Email Agents Through Attack Chain Modeling}},
  author = {Ahmad Hashmi},
  year = {2026},
  eprint = {2609.30657},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30657},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19100,
  title = {{Characterizing Network Centralization and Observability in the Remote MCP Ecosystem}},
  author = {Muhammad Abdullah Sohail},
  year = {2026},
  eprint = {2609.19100},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19100},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03781,
  title = {{IndicSafeEval: Safety Robustness of Large Language Models under Multilingual Persuasive Jailbreak Attacks}},
  author = {Saikat Mondal},
  year = {2026},
  eprint = {2609.03781},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03781},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05575,
  title = {{Capsule Lens: Locating and Tracking Concept Geometry in Model Representations}},
  author = {Yiming Tang},
  year = {2026},
  eprint = {2609.05575},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05575},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2607.15081,
  title = {{DataShield: Uncovering Risky Fine-Tuning Data Across LLMs Through Consensus Subspace Alignment}},
  author = {Zefeng Wu},
  year = {2026},
  eprint = {2607.15081},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.15081},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18612,
  title = {{Weakening Neurons: An Input-Output Functionality in Transformers with Outsize Influence}},
  author = {Sebastian Gerstner},
  year = {2026},
  eprint = {2609.18612},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18612},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12459,
  title = {{EvoRS: On-Policy Self-Evolution of Reward Systems for Open-Ended Reinforcement Learning}},
  author = {Weiyuan Li},
  year = {2026},
  eprint = {2609.12459},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12459},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05850,
  title = {{SAFEGuard: Detect Optimization-Based Jailbreak Attacks Through Harmful Semantic Analysis and Fluency Measurement}},
  author = {Quoc Viet Vo},
  year = {2026},
  eprint = {2609.05850},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05850},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03247,
  title = {{Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models}},
  author = {Syed Ghazanfar Abbas},
  year = {2026},
  eprint = {2609.03247},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03247},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37863,
  title = {{It's Not What the Image Shows: Irrelevant Context Destabilises VLM Judges Without Informing Them}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.37863},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37863},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34514,
  title = {{How to Tame a Multi-Headed Hydra? Adaptive Multi-Category Safety Steering for Large Language Models}},
  author = {Chenxi Wang},
  year = {2026},
  eprint = {2609.34514},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34514},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34091,
  title = {{When Is an SAE Feature Interpretable? A Validation Ladder for EEG Foundation Models}},
  author = {Yucong Cao},
  year = {2026},
  eprint = {2609.34091},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34091},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32720,
  title = {{BiasReducer: Adaptive Bias Mitigation for Reward Models}},
  author = {Shuang Liu},
  year = {2026},
  eprint = {2609.32720},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32720},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10627,
  title = {{SoK: Privacy Attacks on Machine Learning via Explainable AI}},
  author = {Abdullah Caglar Oksuz},
  year = {2026},
  eprint = {2609.10627},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10627},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38239,
  title = {{Inference-Layer Security: Defending Against Adversarial Inference and Infrastructure Abuse}},
  author = {Keifer Lee},
  year = {2026},
  eprint = {2609.38239},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38239},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39548,
  title = {{Learning Normal Diffusion Dynamics for Backdoor Defense in Text-to-Image Models}},
  author = {Junjian Li and Xiaolong Liu and Peng Sun and Liantao Wu and Linghan Chen and Yudong Gao and Honglong Chen},
  year = {2026},
  eprint = {2609.39548},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39548},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13579,
  title = {{How User-AI Mistreatment Occurs and Matters in Conversational Systems?}},
  author = {Fanqi Zeng},
  year = {2026},
  eprint = {2609.13579},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13579},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35020,
  title = {{Verifying the Linear Representation Hypothesis: How Interpretable Are Vision SAEs?}},
  author = {Teodor Chiaburu},
  year = {2026},
  eprint = {2609.35020},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35020},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08901,
  title = {{The BatchNorm Illusion: Diagnosing Normalization Artifacts in Machine Unlearning Evaluation}},
  author = {Aaryaman Kalani},
  year = {2026},
  eprint = {2609.08901},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08901},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27760,
  title = {{Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learning}},
  author = {Srinivasan Subramanian},
  year = {2026},
  eprint = {2609.27760},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27760},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.13304,
  title = {{Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safety}},
  author = {Ping Wu},
  year = {2026},
  eprint = {2608.13304},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.13304},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15906,
  title = {{Authorization Architectures for Tool-Using AI Agents}},
  author = {Rakesh Kumar Surapani},
  year = {2026},
  eprint = {2609.15906},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15906},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35809,
  title = {{Can Multimodal Large Language Models Generate and Detect Multimodal Social Media Fake News?}},
  author = {Jiyao Yang},
  year = {2026},
  eprint = {2609.35809},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35809},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31032,
  title = {{TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks}},
  author = {Tianmeng Fang},
  year = {2026},
  eprint = {2609.31032},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31032},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07037,
  title = {{Disentangling Steering Vectors}},
  author = {Takeru Hiramatsu},
  year = {2026},
  eprint = {2609.07037},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07037},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10707,
  title = {{Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation}},
  author = {Anna Gazani},
  year = {2026},
  eprint = {2609.10707},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10707},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35544,
  title = {{Less Sycophancy, Stronger Refusal? Lessons for AI Safety from Mechanistic Interpretability}},
  author = {Xu Wang},
  year = {2026},
  eprint = {2609.35544},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35544},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15671,
  title = {{Don't Send What You Don't Need: Question-Guided Token Pruning as a Privacy Defense for Vision-Language Models}},
  author = {Md Khalid Syfullah},
  year = {2026},
  eprint = {2609.15671},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15671},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33371,
  title = {{API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary}},
  author = {Patrick Kenney},
  year = {2026},
  eprint = {2609.33371},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33371},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03139,
  title = {{Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers}},
  author = {Ahmed Abdelnaby},
  year = {2026},
  eprint = {2609.03139},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03139},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.02683,
  title = {{\$S^3\$: Improving Agent Safety through Multi-Stage Defense}},
  author = {Zibo Xiao},
  year = {2026},
  eprint = {2608.02683},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.02683},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04808,
  title = {{Recurrence Is Not Enough: Causally Validating Multilingual SAE Translation Features in Gemma 2 and 3}},
  author = {Giang Son Nguyen},
  year = {2026},
  eprint = {2609.04808},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04808},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.28613,
  title = {{Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions}},
  author = {Tiantong Wu},
  year = {2026},
  eprint = {2609.28613},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28613},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10036,
  title = {{Belief-State Engine: Augmenting LLMs for Principled Planning Under Partial Observability}},
  author = {Arnab Chattopadhayay},
  year = {2026},
  eprint = {2609.10036},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10036},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06573,
  title = {{A Translational Note on AI Safety Evaluation}},
  author = {Madhava Gaikwad},
  year = {2026},
  eprint = {2609.06573},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06573},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.02172,
  title = {{Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search}},
  author = {Shiliang Xiao},
  year = {2026},
  eprint = {2609.02172},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02172},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.02127,
  title = {{Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents}},
  author = {Jun He},
  year = {2026},
  eprint = {2609.02127},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02127},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27399,
  title = {{Forget who you Forgot: Speaker Unlearning to Prevent Re-Identification in Zero-Shot Text-to-Speech}},
  author = {Hyoeun Kim},
  year = {2026},
  eprint = {2609.27399},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27399},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35210,
  title = {{Understanding On-Policy Distillation: A Mechanistic Interpretability Perspective via Sparse Crosscoders}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.35210},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35210},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18860,
  title = {{Decodable but Misrouted: Sparse Features Uncover a Readout Gap in Vision-Language Models for Harmful Meme Detection}},
  author = {Girish A. Koushik},
  year = {2026},
  eprint = {2609.18860},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18860},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35521,
  title = {{Beyond Token Scale: Chunk-Level Sparse Autoencoders for Reliable Semantic Feature Discovery}},
  author = {Xu Wang},
  year = {2026},
  eprint = {2609.35521},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35521},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31056,
  title = {{Neuralyzing the Trace: Selective Representation-Level Unlearning with Contrastive Sparse Autoencoders}},
  author = {Itai Zehavi},
  year = {2026},
  eprint = {2609.31056},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31056},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24379,
  title = {{Topographic Training Concentrates Causal Circuits Without Improving Neuron Monosemanticity}},
  author = {Gautam Ranka},
  year = {2026},
  eprint = {2609.24379},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24379},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33640,
  title = {{SafeMol: Dual-Modality Safety Alignment for Molecular Multimodal Models}},
  author = {Xinmiao Wang},
  year = {2026},
  eprint = {2609.33640},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33640},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10608,
  title = {{Adaptive Diffusion Freezing: Privacy-preserving Diffusion Models Against Membership Inference Attacks}},
  author = {Jialu Guo},
  year = {2026},
  eprint = {2609.10608},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10608},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36245,
  title = {{CoRe: Co-Evolving Reward Models for Mitigating Latent Reward Hacking in Video Diffusion Models}},
  author = {Zhaolong Su},
  year = {2026},
  eprint = {2609.36245},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36245},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08322,
  title = {{Tracing Stereotypes from Representation to Output in Multilingual LLMs}},
  author = {Ariun-Erdene Tumurchuluun},
  year = {2026},
  eprint = {2609.08322},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08322},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06289,
  title = {{Steering Geometry: Validating Human Value Geometry in LLM Steering Space}},
  author = {Mohammad Mahdi Abootorabi},
  year = {2026},
  eprint = {2609.06289},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06289},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03511,
  title = {{Lost in Reordering: Structural Sensitivity of Multilingual LLMs under Semantics-Preserving Perturbations}},
  author = {Karthika Nhayakkat},
  year = {2026},
  eprint = {2609.03511},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03511},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00092,
  title = {{Safin-1: Safety from Within through Memory-Native State Evolution}},
  author = {Ming Zhang},
  year = {2026},
  eprint = {2609.00092},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00092},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24016,
  title = {{Context-Aware Pre-Deployment Evaluation of AI Systems: A Regulatory Framework for Nigerian Fintech}},
  author = {Andrew Anogie Uduimoh},
  year = {2026},
  eprint = {2609.24016},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24016},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.20541,
  title = {{An Analysis of Training-Free Self-Reported Confidence in Language Models}},
  author = {Lukas Meyer},
  year = {2026},
  eprint = {2609.20541},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20541},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38723,
  title = {{Towards Efficient HPC Systems for Agents: Challenges and Opportunities}},
  author = {Yunjia Zheng},
  year = {2026},
  eprint = {2609.38723},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38723},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01931,
  title = {{Agent Flight Recorder: Tamper-Evident Audit Trails with On-Chain Anchoring for Long-Horizon Tool-Using Agents}},
  author = {Laurent Bindschaedler},
  year = {2026},
  eprint = {2609.01931},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01931},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01677,
  title = {{Skill-as-API: Confidential Multi-Agent Coordination for Agentic Software Engineering}},
  author = {Ziwei Zhao},
  year = {2026},
  eprint = {2609.01677},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01677},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18120,
  title = {{PentestChain: A Cost-Aware, MCP-Orchestrated Framework for Automated Penetration Testing with Free-Tier LLMs}},
  author = {Rushabh Vipulkumar Patel},
  year = {2026},
  eprint = {2609.18120},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18120},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.26419,
  title = {{Reliability Theory for AI Control}},
  author = {Grant Molnar},
  year = {2026},
  eprint = {2609.26419},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.26419},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09054,
  title = {{Training-Free Task Vectors for LLM Behavioral Control}},
  author = {Gabriel J. Perin},
  year = {2026},
  eprint = {2609.09054},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09054},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35599,
  title = {{Signatures of semantic search in the activations of large language models}},
  author = {Luke Leckie},
  year = {2026},
  eprint = {2609.35599},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35599},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.12713,
  title = {{Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks}},
  author = {Xiaoyan Feng},
  year = {2026},
  eprint = {2608.12713},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.12713},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09848,
  title = {{Subgroup Membership Inference Audits of Differentially Private Synthetic Text}},
  author = {Yidan Sun},
  year = {2026},
  eprint = {2609.09848},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09848},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.10678,
  title = {{Auditing Chinese Web-scale Corpora via Sampled BPE Token Statistics}},
  author = {Qingjie Zhang},
  year = {2026},
  eprint = {2608.10678},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.10678},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31558,
  title = {{Region-Level Black-Box Defense Against Stealthy Embedding-Space Backdoors in CLIP}},
  author = {Ahmed Abdelnaby},
  year = {2026},
  eprint = {2609.31558},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31558},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34857,
  title = {{Beyond Verbalized Confidence: Calibrating Reasoners with Differentiable Readouts}},
  author = {Chenxiao Fan},
  year = {2026},
  eprint = {2609.34857},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34857},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39297,
  title = {{MiniRep: Robust Reputation-Based Aggregation for Multi-Agent Debate}},
  author = {Jiaming Zhang and Yuwan Liu and Yue Huang and Sisi Duan},
  year = {2026},
  eprint = {2609.39297},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39297},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09865,
  title = {{Keep Evaluation Fair: Detecting Data Leakage in Code Generation Benchmarks via Membership Inference Attacks}},
  author = {Dongdong Zhao},
  year = {2026},
  eprint = {2609.09865},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09865},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09556,
  title = {{High-probability guarantees for linear accessibility in feature superposition}},
  author = {Enrico Vompa},
  year = {2026},
  eprint = {2609.09556},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09556},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2607.19371,
  title = {{Mitigating Scaffolding Collapse in Socratic Tutors via Representation Alignment}},
  author = {Jing Shao},
  year = {2026},
  eprint = {2607.19371},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.19371},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33144,
  title = {{Beyond the Training Horizon: Mechanisms and Limits of Length Generalization in Looped Transformers}},
  author = {Jia Liang},
  year = {2026},
  eprint = {2609.33144},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33144},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12378,
  title = {{An Open-Source End-to-End FHE Implementation for Privacy-Preserving Llama 3 8B Inference}},
  author = {Yuhang Fan},
  year = {2026},
  eprint = {2609.12378},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12378},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31122,
  title = {{LocUS: Head Selection and Subspace Projection for Targeted Activation Steering}},
  author = {Irene Tallini},
  year = {2026},
  eprint = {2609.31122},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31122},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.28809,
  title = {{Stream Recursion Model (SRM)}},
  author = {Asael Sorensen},
  year = {2026},
  eprint = {2609.28809},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28809},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13642,
  title = {{When Compliance Data Masquerades as Evaluation: Measurement Validity for Deployed AI Systems}},
  author = {Hung-Yu Lin},
  year = {2026},
  eprint = {2609.13642},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13642},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27422,
  title = {{RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors}},
  author = {Jinwen Xin},
  year = {2026},
  eprint = {2609.27422},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27422},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12367,
  title = {{Membership Inference via Pairwise Likelihood Ratios}},
  author = {Shengjie Niu},
  year = {2026},
  eprint = {2609.12367},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12367},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.11780,
  title = {{Predicting Privacy Leakage from Weight Spectral Density}},
  author = {Richard J. Preen},
  year = {2026},
  eprint = {2609.11780},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11780},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.04314,
  title = {{Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle}},
  author = {Jiaming Zhang},
  year = {2026},
  eprint = {2608.04314},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.04314},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34744,
  title = {{Optimizing and Securing the Modern Watermarking Channel for Images}},
  author = {Enoal Gesny},
  year = {2026},
  eprint = {2609.34744},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34744},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05800,
  title = {{Spillover-Aware Multi-Value Steering for Pluralistic LLM Alignment}},
  author = {Weici Pan},
  year = {2026},
  eprint = {2609.05800},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05800},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04276,
  title = {{FailSAE: Towards Interpretable Failure Prediction for Vision-Language Models via Sparse Autoencoders}},
  author = {Jie Ma},
  year = {2026},
  eprint = {2609.04276},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04276},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01878,
  title = {{GAPS: Dimension-Level Gates for Conditional Activation Steering}},
  author = {Moghis Fereidouni},
  year = {2026},
  eprint = {2609.01878},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01878},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.40285,
  title = {{PivotOPD: Learning to Recover from Pivotal Mistakes in Multi-Turn Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.40285},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.40285},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27124,
  title = {{When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense}},
  author = {Mohamed Shaaban},
  year = {2026},
  eprint = {2609.27124},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27124},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14648,
  title = {{Optimizing Sparse Outcomes Through Dense Behavioral Signals via Value-Guided Preference Distillation}},
  author = {Ziyi Zhu},
  year = {2026},
  eprint = {2609.14648},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14648},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05074,
  title = {{Influence Score and Transformers interpretability: Measure of the Effective Impact of Attention Heads at inference time}},
  author = {Lisa Bouger},
  year = {2026},
  eprint = {2609.05074},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05074},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01046,
  title = {{HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscation}},
  author = {Nikita Oblakov},
  year = {2026},
  eprint = {2609.01046},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01046},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22934,
  title = {{Measuring Behavioural Signatures of Large Language Models through Psychometric Profiling}},
  author = {Yu Sha},
  year = {2026},
  eprint = {2609.22934},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22934},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30824,
  title = {{Crypto-bound identity-verified capability tokens for coordinating distributed AI agents: A proposal}},
  author = {Srikumar Subramanian},
  year = {2026},
  eprint = {2609.30824},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30824},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05018,
  title = {{How a Chatbot's Response Style Shapes a Classroom: A Multi-Agent Simulation of Students Consulting AI}},
  author = {Rin Tamai},
  year = {2026},
  eprint = {2609.05018},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05018},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32288,
  title = {{A Solvable Theory of Pre-training Data Poisoning: Regime-Dependent Scaling Exponents}},
  author = {Indranil Halder},
  year = {2026},
  eprint = {2609.32288},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32288},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06346,
  title = {{Robust Dynamic Expansion for Continual Learning under Backdoor Attacks via Purification and Selective Recovery}},
  author = {Keyu Lin},
  year = {2026},
  eprint = {2609.06346},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06346},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33662,
  title = {{Audit-First VAPO: Risk-Certified Selective Updates under Imperfect Verification}},
  author = {Miaobo Hu},
  year = {2026},
  eprint = {2609.33662},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33662},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.20942,
  title = {{When AI Reviews Train AI Reviewers: Scientific-Judgment Collapse and Mitigation}},
  author = {Sy-Tuyen Ho},
  year = {2026},
  eprint = {2609.20942},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20942},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10645,
  title = {{Sparse Weight and Edge Circuit Discovery in Transformer-based Acoustic Models}},
  author = {Jiankun Wei},
  year = {2026},
  eprint = {2609.10645},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10645},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06473,
  title = {{Steering Under Compression: Dose-Response, Capability Cost, and Failure Asymmetry in Quantized LLMs}},
  author = {Saurav Bhandari},
  year = {2026},
  eprint = {2609.06473},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06473},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03629,
  title = {{EraseSAE: Surgical Concept Erasure in Text-to-Video Diffusion Models via Sparse Autoencoders}},
  author = {Xinghao Wang},
  year = {2026},
  eprint = {2609.03629},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03629},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00790,
  title = {{RISA: Response Inspection and Selective Actions for Refusal Calibration in Large Language Models}},
  author = {Wenhan Chang},
  year = {2026},
  eprint = {2609.00790},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00790},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39982,
  title = {{Mid-Harness: Scaling Actions Between Model and Harness for Terminal Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.39982},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39982},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31857,
  title = {{LLM Judge Validation Under Sparse Overlap: From Inference to Design}},
  author = {Junxuan Li},
  year = {2026},
  eprint = {2609.31857},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31857},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12039,
  title = {{Reality Is the Final Verifier: On Two Key Gaps in Agentic Software Engineering}},
  author = {Alexander Krentsel},
  year = {2026},
  eprint = {2609.12039},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12039},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04159,
  title = {{SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center}},
  author = {Uday Vallabhaneni},
  year = {2026},
  eprint = {2609.04159},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04159},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30119,
  title = {{T-Backdoor: Exploiting Temporal Redundancy in Neuromorphic Data for Spike-preserving Backdoor Attacks on SNNs}},
  author = {Abdullah Arafat Miah},
  year = {2026},
  eprint = {2609.30119},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30119},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34985,
  title = {{ORPG: Reconciling Multiple Reward Objectives through Objective-wise Policy Gradients}},
  author = {Shicheng Fang},
  year = {2026},
  eprint = {2609.34985},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34985},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38249,
  title = {{SURE: Framework for Safety to Construct Trustworthy AI}},
  author = {Soeun Han},
  year = {2026},
  eprint = {2609.38249},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38249},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03999,
  title = {{Shifting from Injection to Interaction: Rethinking Web Security in the Age of LLMs and Beyond}},
  author = {Nivedita Singh},
  year = {2026},
  eprint = {2609.03999},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03999},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.16541,
  title = {{A Cyber Range Evaluation of Autonomous Network Incident Response Agents}},
  author = {Jakob Nyberg},
  year = {2026},
  eprint = {2609.16541},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16541},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01832,
  title = {{Interpretable Symptom Vectors for Depression in a Large Language Model}},
  author = {Fangyi Zhu},
  year = {2026},
  eprint = {2609.01832},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01832},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08410,
  title = {{Compositional Multilingual and Behavioral Attribute Steering}},
  author = {Hyun Gu Kang},
  year = {2026},
  eprint = {2609.08410},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08410},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35342,
  title = {{Jev thinks "I don't know'', but doesn't say it: Introducing Sys1Cal-v1 Dataset for Probability Calibration}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.35342},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35342},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29173,
  title = {{Through Human Eyes and Machine Eyes: Understanding View Mismatch in Video See-Through Extended Reality}},
  author = {Yanming Xiu},
  year = {2026},
  eprint = {2609.29173},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29173},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15818,
  title = {{Atria Dawn: The Dawn of Agentic Superintelligence}},
  author = {Honglin Guo},
  year = {2026},
  eprint = {2609.15818},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15818},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.15844,
  title = {{MicroVerse: An Instrument for Measuring Self-Authored Identity Drift in Long-Horizon Multi-Agent Language-Model Simulations}},
  author = {Sky Ng},
  year = {2026},
  eprint = {2608.15844},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.15844},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08173,
  title = {{Key Path Identification for Resolving Knowledge Conflicts via SAE-based Steering}},
  author = {Wenbo Zhang},
  year = {2026},
  eprint = {2609.08173},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08173},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31968,
  title = {{Hardware-Rooted PUF Fingerprinting for Device-Level Traceability in Knowledge Distillation}},
  author = {Ning Lyu},
  year = {2026},
  eprint = {2609.31968},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31968},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31694,
  title = {{RemTraceNet: Few-Shot Forensic Detection of Invisible Watermark Attacks}},
  author = {Jidong Yang},
  year = {2026},
  eprint = {2609.31694},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31694},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09794,
  title = {{Privacy-Preserving Split Learning for Federated LLM Fine-Tuning}},
  author = {Heng Jin},
  year = {2026},
  eprint = {2609.09794},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09794},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30954,
  title = {{FTB Graph: Determining and Validating First-token Broadcasters and Language-Identity Head Circuits in Multilingual Language Models}},
  author = {Arjun Pillai},
  year = {2026},
  eprint = {2609.30954},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30954},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07147,
  title = {{Fine-grained Distributed Backdoor Attacks in Federated Learning}},
  author = {Jian Wang},
  year = {2026},
  eprint = {2609.07147},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07147},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10658,
  title = {{GEOSTEER: Geodesic Optimization for Activation Steering in Large Language Models}},
  author = {Xuan Cuong Ngo},
  year = {2026},
  eprint = {2609.10658},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10658},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14803,
  title = {{Another Blueprint In The Wall: How to Ask Frontier AI Like a Kid?}},
  author = {Afshin Khadangi},
  year = {2026},
  eprint = {2609.14803},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14803},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36388,
  title = {{Persona Dosing: Calibrated Activation Steering for Graded Trait Control}},
  author = {Zehao Jin},
  year = {2026},
  eprint = {2609.36388},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36388},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22712,
  title = {{Trustworthy Agentic AI: Failure Modes, Mitigation Strategies, and a Lifecycle Framework for Autonomous LLM Systems}},
  author = {Fayeq Jeelani Syed},
  year = {2026},
  eprint = {2609.22712},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22712},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15315,
  title = {{Evaluation Metrics for Safe Reinforcement Learning}},
  author = {Lindsay Spoor},
  year = {2026},
  eprint = {2609.15315},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15315},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.28239,
  title = {{ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus}},
  author = {Li Zeng},
  year = {2026},
  eprint = {2609.28239},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.28239},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01495,
  title = {{Optimizing Byzantine Node Placement in Decentralized Federated Learning}},
  author = {Edoardo Gabrielli},
  year = {2026},
  eprint = {2609.01495},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01495},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36372,
  title = {{TTMark: Pairwise Distortion-Free Watermarking Beyond Single-Token Entropy}},
  author = {Ruibo Chen},
  year = {2026},
  eprint = {2609.36372},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36372},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.17152,
  title = {{ResLRP: The Role of Residual Cancellation in Attribution Instability in Vision Transformers}},
  author = {Jim Berend},
  year = {2026},
  eprint = {2609.17152},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.17152},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15654,
  title = {{Empathy Is Steerable but Multi-Axial: Mechanism Geometry and Persona Effects in LLMs}},
  author = {JuHeon Ha},
  year = {2026},
  eprint = {2609.15654},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15654},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14151,
  title = {{Signatures of Steerability in Activation Space of Language Models}},
  author = {Prajjwal Bhattarai},
  year = {2026},
  eprint = {2609.14151},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14151},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.08879,
  title = {{Medical AI Encodes a "Feeling of Error": Verifying Cancer Segmentation via Internal Concepts}},
  author = {Mengmeng Ma},
  year = {2026},
  eprint = {2609.08879},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.08879},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00755,
  title = {{S^3martCirc: Self-supervised Smart Circuit Discovery}},
  author = {Wendy Zheng},
  year = {2026},
  eprint = {2609.00755},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00755},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23586,
  title = {{An Efficient and Effective Watermarking Scheme for the Protection of the Intellectual Property Rights of Video Generative Models}},
  author = {Wenhong Huang},
  year = {2026},
  eprint = {2609.23586},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23586},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27263,
  title = {{Specifying and Maintaining Agentic Workflows: An Empirical Study of GitHub Agentic Workflows}},
  author = {Jasem Khelifi},
  year = {2026},
  eprint = {2609.27263},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27263},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15576,
  title = {{Approval Integrity and Recovery in LLM Answer Publication}},
  author = {Faruk Alpay},
  year = {2026},
  eprint = {2609.15576},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15576},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30993,
  title = {{FLIP: Final Layer Inference-Time Probing for Vision-Language Models}},
  author = {Drandreb Earl O. Juanico},
  year = {2026},
  eprint = {2609.30993},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30993},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29362,
  title = {{Parts-of-Speech as Emergent Categories in SAE Latent Space}},
  author = {Alessandro Bondielli},
  year = {2026},
  eprint = {2609.29362},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29362},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30326,
  title = {{Guarded Gradient-Based Activation Steering of Shutdown Responses in Qwen3.5-0.8B: A Minimum-Step Policy}},
  author = {Farhad Davaripour},
  year = {2026},
  eprint = {2609.30326},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30326},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24440,
  title = {{Comparing Latent Concept Formation in State Space Models and Transformers via Sparse Autoencoders}},
  author = {Rithin Nagaraj},
  year = {2026},
  eprint = {2609.24440},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24440},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22961,
  title = {{When Agentic Trust Crosses Organizational Boundaries: Structural Externalization and a Reference Model for Trust Evidence}},
  author = {Huafu Li},
  year = {2026},
  eprint = {2609.22961},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22961},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05676,
  title = {{PAC-Private Autoregressive Generation: Calibrating Noise to Ensemble Disagreement}},
  author = {Mina Mirzadehsarcheshmeh},
  year = {2026},
  eprint = {2609.05676},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05676},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23889,
  title = {{SyzHarness: Patch-Based Kernel Bug Reproduction with LLM-Synthesized Fuzzing Harnesses}},
  author = {Xingyu Li},
  year = {2026},
  eprint = {2609.23889},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23889},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.04627,
  title = {{Leveraging Imperfect Restoration for Data Availability Attack}},
  author = {Yi Huang},
  year = {2026},
  eprint = {2609.04627},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.04627},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39229,
  title = {{RAIM: Robust Aggregation of Inexpensive Models for Hallucination Detection}},
  author = {Elia Onofri},
  year = {2026},
  eprint = {2609.39229},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39229},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10144,
  title = {{Kernel-Managed Shared Memory for System-Wide Personalization}},
  author = {Ryan Lum},
  year = {2026},
  eprint = {2609.10144},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10144},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.35351,
  title = {{Interference Beyond Geometry in Concept Extraction}},
  author = {Valérie Costa},
  year = {2026},
  eprint = {2609.35351},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.35351},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07063,
  title = {{Trust-But-Verify: Poisoning-Resilient Locally Private Graph Learning Protocols}},
  author = {Longzhu He},
  year = {2026},
  eprint = {2609.07063},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07063},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14257,
  title = {{DenMark: Robust Semantic Watermarking for Diffusion Language Models}},
  author = {Tianhao Ma},
  year = {2026},
  eprint = {2609.14257},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14257},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.12361,
  title = {{New Terms, New Toxicity: Consensus-based Chinese Neologism Toxicity Detection via Search-Augmented LLMs}},
  author = {Shiyao Cui},
  year = {2026},
  eprint = {2608.12361},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.12361},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30405,
  title = {{Adaptive Multi-Value Control in LLMs via Causal Activation Steering}},
  author = {Payel Bhattacharjee},
  year = {2026},
  eprint = {2609.30405},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30405},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.30717,
  title = {{RecToolBench: Benchmarking Recommendation-Specific Tool Orchestration under Fuzzy User Intent}},
  author = {Xiao Chen},
  year = {2026},
  eprint = {2609.30717},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30717},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36958,
  title = {{VStress: Correlation-Aware Auditing and Adaptive Budget Allocation for Repeated Verifiers}},
  author = {Miaobo Hu},
  year = {2026},
  eprint = {2609.36958},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36958},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39544,
  title = {{Growing an Agent/Prover Interface: Evolutionary Tool Design for Cost-Efficient Theorem Proving in Rocq and Lean}},
  author = {Jules Viennot and Guillaume Baudart and Marc Lelarge},
  year = {2026},
  eprint = {2609.39544},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39544},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39182,
  title = {{MEND: Label-Free Detection, Localisation, and Correction of Latent Hallucination in World Models}},
  author = {Ali J Alrasheed and Aryan Yazdan Parast and Basim Azam and James Bailey and Naveed Akhtar},
  year = {2026},
  eprint = {2609.39182},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39182},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38822,
  title = {{SkillSeek: Revisiting Agent Skill Retrieval at Marketplace Scale}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.38822},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38822},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07681,
  title = {{On the Recall Scaling Laws in Mamba: A Theoretical and Mechanistic Study via Hashing}},
  author = {Yuval Koren},
  year = {2026},
  eprint = {2609.07681},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07681},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32567,
  title = {{Attribution Gaps in Zero-Training LLM+OVOD Pipelines: A Fine-Grained Analysis of the CAAP--SNAP Discrepancy}},
  author = {Yu-Feng Yen},
  year = {2026},
  eprint = {2609.32567},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32567},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31855,
  title = {{PHIRL: Aligning Learned Rewards with Task Progress for Inverse Reinforcement Learning}},
  author = {Hang Yu},
  year = {2026},
  eprint = {2609.31855},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31855},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25938,
  title = {{Certified Against Which Oracle? Execution Labels Set the Reported Risk of Conformal Abstention for Text-to-SQL}},
  author = {Jiamiao Liu},
  year = {2026},
  eprint = {2609.25938},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25938},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19144,
  title = {{A Zeroth-Order Paradigm for LLM Preference Alignment}},
  author = {Peter Chen},
  year = {2026},
  eprint = {2609.19144},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19144},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39625,
  title = {{D-Scope: Decomposing and Steering Diffusion Transformers with Sparse Autoencoders}},
  author = {Xinyue Xu and Jiahao Zhang and Lijie Hu and Peter Hase and Hao Wang},
  year = {2026},
  eprint = {2609.39625},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39625},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24983,
  title = {{onPanda: Efficient Annotation of On-Policy Alignment Data for LLMs and Agents via Token-Level Correction}},
  author = {Lei Yang},
  year = {2026},
  eprint = {2609.24983},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24983},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13271,
  title = {{CANAL: Channel-Aware Noise Allocation for Differentially Private Feature Distillation in Medical Image Segmentation}},
  author = {Armaghan Butt},
  year = {2026},
  eprint = {2609.13271},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13271},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.11085,
  title = {{Beyond Solver Verdicts: Generative Reward Models for Autoformalization}},
  author = {Vikash Singh},
  year = {2026},
  eprint = {2609.11085},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11085},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.37501,
  title = {{Evaluating Bounded Autonomy in Regulated Agentic AI: A Diagnostic Harness with Constitutional Rewards, Escalation Labels, and Runtime Governance}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.37501},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37501},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.30480,
  title = {{VisER: Visual Evidence and Reliance for Object Hallucination Detection in LVLMs}},
  author = {Afsaneh Hasanebrahimi},
  year = {2026},
  eprint = {2608.30480},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30480},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13556,
  title = {{Domain-Specific Jargon in Large Language Models: A Comparative Analysis between General-Purpose and Specialist Models}},
  author = {Darin Keng},
  year = {2026},
  eprint = {2609.13556},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13556},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.20095,
  title = {{A Scalable Trust Discovery Architecture for the Internet of Agents}},
  author = {Song Zhang},
  year = {2026},
  eprint = {2609.20095},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20095},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.07061,
  title = {{PhysSAE: Mechanistic Interpretability of PINNs with Sparse Autoencoders}},
  author = {Nandita N. Patil},
  year = {2026},
  eprint = {2609.07061},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.07061},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34052,
  title = {{Towards Interpretable Framework for Neural Audio Codecs via Sparse Autoencoders: Exploration toward Age, Gender, and Accent Steering}},
  author = {Shih-Heng Wang},
  year = {2026},
  eprint = {2609.34052},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34052},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23954,
  title = {{Djinnlang: Higher-Level Programming by Unambiguous Specification with an LLM in the Compiler}},
  author = {Simon Henniger},
  year = {2026},
  eprint = {2609.23954},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23954},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38143,
  title = {{Learning Meta-Skills for Agent Harness Design in Test-Time AI4AI}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.38143},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38143},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21142,
  title = {{Exploring Text Classification Models with Sparse Autoencoders}},
  author = {Daniel Kerrigan},
  year = {2026},
  eprint = {2609.21142},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21142},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15277,
  title = {{Artificial entrepreneurial cognition: Locating and causally steering an opportunity recognition dial inside large language models (LLMs)}},
  author = {Christian Fisch},
  year = {2026},
  eprint = {2609.15277},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15277},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27572,
  title = {{DCRL: Decoupling and Coupling Reinforcement Learning via Policy-Reward Manifold Alignment}},
  author = {Henan Sun},
  year = {2026},
  eprint = {2609.27572},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27572},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23596,
  title = {{StyleAT: Defending Face Recognition Against Semantic Attacks}},
  author = {Ben Shapira},
  year = {2026},
  eprint = {2609.23596},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23596},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.22978,
  title = {{DeepSeek Elastic Compute (DSec): A Sandbox Infrastructure for Effective Agentic Training at Scale}},
  author = {Jialiang Huang},
  year = {2026},
  eprint = {2609.22978},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.22978},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.21858,
  title = {{Watermarkable Multi-Draft Speculative Sampling via Poisson Processes}},
  author = {Yanxiao Liu},
  year = {2026},
  eprint = {2609.21858},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.21858},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.18642,
  title = {{STRETCH the Boundaries: A Unified Self-Taught Framework for Progressive LLM Evolution}},
  author = {Yajie Yu},
  year = {2026},
  eprint = {2609.18642},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.18642},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19399,
  title = {{Efficient Nash Equilibrium Computation for Cybersecurity Games}},
  author = {Michael Lanier},
  year = {2026},
  eprint = {2609.19399},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19399},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13601,
  title = {{Mind the Gap: Detecting Description-Execution Mismatch Attacks in DAO Governance}},
  author = {Bowen Cai},
  year = {2026},
  eprint = {2609.13601},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13601},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34806,
  title = {{On Temporal Binding in Large Audio Language Models}},
  author = {Paul Primus},
  year = {2026},
  eprint = {2609.34806},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34806},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.29465,
  title = {{SWE-Prometheus: Measuring Engineering Governance Improvements in Real-World Repositories}},
  author = {Jiajun Wu},
  year = {2026},
  eprint = {2609.29465},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.29465},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13334,
  title = {{The Agentic Company OS: Substrate Inversion for Sustained Enterprise Agent Deployment}},
  author = {Oliver Aleksander Larsen},
  year = {2026},
  eprint = {2609.13334},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13334},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.36326,
  title = {{PILLAR: Private Inverted-Index Lexical Lookup for Augmented Retrieval}},
  author = {Truong Son Nguyen},
  year = {2026},
  eprint = {2609.36326},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36326},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.01322,
  title = {{Exploring Sparse Autoencoders in Text-Based Causal Confounding Adjustment}},
  author = {Mian Zhong},
  year = {2026},
  eprint = {2609.01322},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.01322},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12841,
  title = {{A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT\&CK}},
  author = {Matteo Lupinacci},
  year = {2026},
  eprint = {2609.12841},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12841},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27234,
  title = {{Discover, Falsify, Revise: Auditing Input-Use Claims from Source Code to Predictive Contribution in Agent-Discovered Cell Models}},
  author = {Mengran Li},
  year = {2026},
  eprint = {2609.27234},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27234},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12620,
  title = {{Correlation-Guided Fast Machine Unlearning via Hessian Analysis}},
  author = {Ayushi Thakur},
  year = {2026},
  eprint = {2609.12620},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12620},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33731,
  title = {{HTN Planning as a Coordination Layer for Multi-Server MCP Tool Orchestration}},
  author = {Eliott Jacopin},
  year = {2026},
  eprint = {2609.33731},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33731},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31282,
  title = {{Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains}},
  author = {Toqeer Ali Syed},
  year = {2026},
  eprint = {2609.31282},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31282},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.17247,
  title = {{DriveMCP: An Agentic AI framework for Advanced Driver Assistance System}},
  author = {Farzad Nadiri},
  year = {2026},
  eprint = {2609.17247},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.17247},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.20143,
  title = {{Designing Against Deskilling: Metacognitive Feedback Reduces Cognitive Offloading to LLM Assistants}},
  author = {Sebastian Maier},
  year = {2026},
  eprint = {2609.20143},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.20143},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10935,
  title = {{Empirical Evaluation of Membership Inference Attacks on NLP Text Classifiers: A Baseline Study on SST-2}},
  author = {William Novak},
  year = {2026},
  eprint = {2609.10935},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10935},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09564,
  title = {{Robust Industrial Cyber Physical Classification Using Neuromorphic Temporal Embeddings and Hybrid SNN XGBoost Under Machine Unlearning Attacks}},
  author = {Ammar Kamoona},
  year = {2026},
  eprint = {2609.09564},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09564},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.05702,
  title = {{Characterizing Privacy Risks of Quantum Machine Learning with Emergent Quantum-Native Access}},
  author = {Liou Tang},
  year = {2026},
  eprint = {2609.05702},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.05702},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03064,
  title = {{Differentially private federated learning with Byzantine-robust aggregation: A cross-domain framework for secure model training in banking and healthcare systems}},
  author = {Srikumar Nayak},
  year = {2026},
  eprint = {2609.03064},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03064},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.02971,
  title = {{Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks}},
  author = {Ali Akarma},
  year = {2026},
  eprint = {2609.02971},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.02971},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38895,
  title = {{Unmerge: Efficient Machine Unlearning via Task Arithmetic}},
  author = {Haoran Tang and Andrew Tan and Rajiv Khanna},
  year = {2026},
  eprint = {2609.38895},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38895},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.38807,
  title = {{PatchHolmes: Agentic Patch Retrieval via Listwise Selection}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.38807},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38807},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09909,
  title = {{Interpreting Object-Dependent Concept Brittleness in Text-to-Image Diffusion Models}},
  author = {Yifan Yuan},
  year = {2026},
  eprint = {2609.09909},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09909},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.03687,
  title = {{A Circuit for Plural Reference: How LLMs Represent and Retrieve Singular and Plural Entities}},
  author = {Anh Danh},
  year = {2026},
  eprint = {2609.03687},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03687},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.00786,
  title = {{MROP: Mask-Region Optimized Purification Against Backdoor Attack in Deep JSCC}},
  author = {Seongkyu Yang},
  year = {2026},
  eprint = {2609.00786},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.00786},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33028,
  title = {{Łukasiewicz Neural Networks Extended: Residual Architectures and Crystallization Strategies for Interpretable Rule Extraction}},
  author = {Carlos Leandro},
  year = {2026},
  eprint = {2609.33028},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33028},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31911,
  title = {{Enhancing Visual Reasoning in Chest X-Ray Report Generation Using Reinforcement Learning}},
  author = {Denis Musinguzi},
  year = {2026},
  eprint = {2609.31911},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31911},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31262,
  title = {{Deduplication-while-Training: A Resilient Paradigm for Privacy-Preserving Cross-Client Deduplication in Federated Learning}},
  author = {Rongxi Wang},
  year = {2026},
  eprint = {2609.31262},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31262},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24760,
  title = {{Construting Reverse Thinking: Developing Large Language Models' Reverse Thingking Ability}},
  author = {Xin Liu},
  year = {2026},
  eprint = {2609.24760},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24760},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.24369,
  title = {{DeceptionAnalyser: A Web-Based AI Tool for Performing Structured Deception Analysis with Argumentation Schemes and LLMs}},
  author = {Stefan Sarkadi},
  year = {2026},
  eprint = {2609.24369},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24369},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.16915,
  title = {{ROSETTA: Efficient and Accurate Privacy-Preserving LLM Decoding via Hybrid CKKS/TFHE Evaluation}},
  author = {Jiangrui Yu},
  year = {2026},
  eprint = {2609.16915},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16915},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.14896,
  title = {{Forty Shades of Blue: Quality-Diversity Alignment via Mode-Conditioned Reinforcement Learning}},
  author = {Jiayi Yuan},
  year = {2026},
  eprint = {2609.14896},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.14896},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12623,
  title = {{SteerDuplex: Steerable Duplex Speech Dialogue Models}},
  author = {Utkarsh Tyagi},
  year = {2026},
  eprint = {2609.12623},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12623},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.11989,
  title = {{The Computational Primitives of Adaptation}},
  author = {Jonathan W. Page},
  year = {2026},
  eprint = {2609.11989},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11989},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.33818,
  title = {{Augmenting Visual Anomaly Detection with Automated Interpretability}},
  author = {Antonio De Santis},
  year = {2026},
  eprint = {2609.33818},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.33818},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2407.21783,
  title = {{The Llama 3 Herd of Models}},
  author = {Aaron Grattafiori},
  year = {2024},
  eprint = {2407.21783},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2407.21783},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.39027,
  title = {{A Missing Piece for Trustworthy AI Reviewers: From Benchmarking Rhetorical Robustness to SciCore Review}},
  author = {Chenguang Wang and Ming Li and Chengrui Fan and Jianpeng Chen and Han Chen and Tianyi Zhou and Dawei Zhou},
  year = {2026},
  eprint = {2609.39027},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.39027},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34326,
  title = {{Routing Without Embeddings: Fast And Interpretable Routing With Regular Expressions}},
  author = {Yifan Lu},
  year = {2026},
  eprint = {2609.34326},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34326},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.27110,
  title = {{DocTalkBN: A Novel Dataset of Expert Telemedicine Conversations in Bengali}},
  author = {Anik Saha},
  year = {2026},
  eprint = {2608.27110},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.27110},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.10952,
  title = {{Empirical Evaluation of Data Poisoning Attacks in Supervised Learning}},
  author = {Toshif Khan},
  year = {2026},
  eprint = {2609.10952},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.10952},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.23561,
  title = {{Transferring Visual Explanations: How Cross-Architecture Knowledge Distillation Affects Model Interpretability}},
  author = {Aleks Czufarow},
  year = {2026},
  eprint = {2609.23561},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.23561},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.16967,
  title = {{Target-Language Generation in Multilingual Models: Activation Steering and Optimal Control}},
  author = {James A. Michaelov},
  year = {2026},
  eprint = {2609.16967},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.16967},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.26927,
  title = {{Building Socio-Affective Artificial Intelligence for Interactive Multi-Agent Simulations}},
  author = {David Berga},
  year = {2026},
  eprint = {2609.26927},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.26927},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09135,
  title = {{Entropy-Regularized Rank-Masked Policy Optimization for Test-Time Reinforcement Learning in Code Generation}},
  author = {Jiacheng Xu},
  year = {2026},
  eprint = {2609.09135},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09135},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.15779,
  title = {{EvoOntology: A Self-Evolving Ontology Layer for Data Agents}},
  author = {Meiduo Chong},
  year = {2026},
  eprint = {2609.15779},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.15779},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2608.18607,
  title = {{VA-Judger: Reward Modeling from Human Preference Feedback for Joint Video-Audio Generation}},
  author = {Yinming Huang},
  year = {2026},
  eprint = {2608.18607},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.18607},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.34688,
  title = {{Unified Trajectory Matching Policy Optimization: Diverse T2I Generation and VLA Generalization}},
  author = {Zhiyuan Ma},
  year = {2026},
  eprint = {2609.34688},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.34688},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.19831,
  title = {{Reproducing Transparent and Scrutable Recommendations: Exploring Open-Weight Models via Natural-Language User Profiles}},
  author = {Noah Mamié},
  year = {2026},
  eprint = {2609.19831},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.19831},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06968,
  title = {{Tracing Query Expansion Effects through Sparse Autoencoder Features}},
  author = {Fangan Dong},
  year = {2026},
  eprint = {2609.06968},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06968},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.06020,
  title = {{What Does Animal Re-Identification Learn? Linear Biological Concepts and Their Origins in Visual Representations}},
  author = {Robert Nolting},
  year = {2026},
  eprint = {2609.06020},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.06020},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.27068,
  title = {{HiRE: Hindsight Reward Editing for Policy Finetuning}},
  author = {Haoyi Niu},
  year = {2026},
  eprint = {2609.27068},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.27068},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12607,
  title = {{Direct Preference Density Alignment for Conversational Audio Equalization}},
  author = {Ioannis Stylianou},
  year = {2026},
  eprint = {2609.12607},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12607},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.12067,
  title = {{Scalable Discrete-to-Continuous Channel Simulation for Compression and Privacy}},
  author = {Joseph Rowan},
  year = {2026},
  eprint = {2609.12067},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12067},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25498,
  title = {{Universal Fractal Natural Language Decision Map: Real-Time Edge Triage Across Heterogeneous Domains}},
  author = {Volkan Dağlı},
  year = {2026},
  eprint = {2609.25498},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25498},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.31992,
  title = {{Mechanistic Interpretability Reveals Shared Causal Subspaces in Brain-to-Speech Decoders}},
  author = {Maryam Maghsoudi},
  year = {2026},
  eprint = {2609.31992},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.31992},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2402.00838,
  title = {{OLMo: Accelerating the Science of Language Models}},
  author = {Dirk Groeneveld},
  year = {2024},
  eprint = {2402.00838},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2402.00838},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.09575,
  title = {{Beyond Top Words: MonoTM for Topic Modeling with Interpretable Monosemantic Features}},
  author = {Una Joh},
  year = {2026},
  eprint = {2609.09575},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.09575},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.32340,
  title = {{SGA-Flow-GRPO: Spatial Gradient-Guided Credit Assignment for Flow-GRPO}},
  author = {Yunkai Yang},
  year = {2026},
  eprint = {2609.32340},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.32340},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.25270,
  title = {{RULER: Instance-aware Rubric Rewards for SVG Generation}},
  author = {Hangyu Ran},
  year = {2026},
  eprint = {2609.25270},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.25270},
  note = {AI Safety HOT 2026-10-01}
}

@misc{arxiv2609.13259,
  title = {{TryOnReward: Learning Foveated Consistency for Reinforcement Fine-Tuning of Virtual Try-On}},
  author = {Xueheng Li},
  year = {2026},
  eprint = {2609.13259},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13259},
  note = {AI Safety HOT 2026-10-01}
}