@misc{arxiv2610.04083,
  title = {{Self-Propagating Misalignment in LLM Agents, and Why Auditing or Disabling Memory Is Not Enough}},
  author = {Debeshee Das and Jacqueline Tay and Bruce Tsai and David Huang and Javier Rando},
  year = {2026},
  eprint = {2610.04083},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04083},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04793,
  title = {{Pressure, Context, and Machine Self-Control: A Criminological Test of Reward Hacking in Generative AI Models}},
  author = {Murat Ozer and Isaac Kofi Nti},
  year = {2026},
  eprint = {2610.04793},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04793},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05163,
  title = {{Blocking at the Boundary: Auditing Long-Horizon Agents against Staged Prompt Injection}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05163},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05163},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04589,
  title = {{StegoMemory}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04589},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04589},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05637,
  title = {{Visual Grounding Safety in Vision-Language Models}},
  author = {Erfan Shayegani and Kundan Krishna and Yue Dong and Nael Abu-Ghazaleh and Leon Gatys and Shruti Palaskar},
  year = {2026},
  eprint = {2610.05637},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05637},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04575,
  title = {{From Probe Scores to Alarm Policies}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04575},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04575},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.03938,
  title = {{MLLMs Fail to Refuse when Using Tools Agentically}},
  author = {Rikiya Takehi and Ryo Hachiuma and Shaona Ghosh and Dan Zhao and Yu-Chiang Frank Wang and Yusuke Hirota},
  year = {2026},
  eprint = {2610.03938},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03938},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04125,
  title = {{Representational Control over Self-Report \& Behavior Coherence in LLM Risk-Taking}},
  author = {Rafal Kocielnik and Peiyang Song and Pengrui Han and Myrl G. Marmarelis and Ramit Debnath and Dean Mobbs and R. Michael Alvarez},
  year = {2026},
  eprint = {2610.04125},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04125},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06748,
  title = {{BazaarBench}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06748},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06748},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04860,
  title = {{Invisible Ink, Visible Lies}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04860},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04860},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05640,
  title = {{Can CaMeLs Talk? Securing Multi-Agent Systems Against Indirect Prompt Injection Attacks}},
  author = {James Peters-Gill and Avi Semler and Henning Bartsch and Ilia Shumailov and Christian Schroeder de Witt},
  year = {2026},
  eprint = {2610.05640},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05640},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06439,
  title = {{Better Call Reward: Reward Hacking as Strategic Abstention in Legal Reasoning Models}},
  author = {Subramanyam Sahoo and Justin Shenk},
  year = {2026},
  eprint = {2610.06439},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06439},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05586,
  title = {{AgentDoxx: Agentic Re-identification of Anonymized Text with Web Search}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05586},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05586},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06848,
  title = {{TranScope}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06848},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06848},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05622,
  title = {{UndoBench: Separating Task Competence from Recovery Capability in Tool-Using AI Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05622},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05622},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06522,
  title = {{Anatomy of LLM Sycophancy: What a Flip Rate Hides}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06522},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06522},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2604.02947,
  title = {{AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents}},
  author = {Yunhao Feng and Yifan Ding and Yingshui Tan and Xingjun Ma and Yige Li and Yutao Wu and Yifeng Gao and Kun Zhai and Yanming Guo},
  year = {2026},
  eprint = {2604.02947},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.02947},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2605.28591,
  title = {{Models That Know How Evaluations Are Designed Score Safer}},
  author = {Unknown},
  year = {2026},
  eprint = {2605.28591},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.28591},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06851,
  title = {{Base Models Can Reason By Taking a Cue From Training Data}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06851},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06851},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04914,
  title = {{Monitorability Disposition in Large Reasoning Models}},
  author = {Shahriar Golchin and Marc Wetter},
  year = {2026},
  eprint = {2610.04914},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04914},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05541,
  title = {{Don't Judge an LLM Only by Its Activations: Discovering Suppressed Safety Features via Counterfactual Activation Potential}},
  author = {Swadesh Swain and Sanghamitra Dutta},
  year = {2026},
  eprint = {2610.05541},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05541},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05089,
  title = {{Cooldown Landmines}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05089},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05089},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05793,
  title = {{Topology-Conditioned Backdoors: Language Models That Insert Vulnerabilities When They Infer They Are in a Multi-Agent System}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05793},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05793},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2605.17380,
  title = {{ADR: An Agentic Detection System for Enterprise Agentic AI Security}},
  author = {Unknown},
  year = {2026},
  eprint = {2605.17380},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.17380},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05894,
  title = {{Noise Out, Bias In: Targeted Bias Injection in Diffusion Language Models via Closed-Loop Activation Steering}},
  author = {Sarim Hashmi and Mukul Ranjan and Abdelrahman Elsayed and Muhammad Umer Sheikh and Fahad Shamshad and Nils Lukas},
  year = {2026},
  eprint = {2610.05894},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05894},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06576,
  title = {{Before Agent Tells The Lie: Has Deception Already Been Represented?}},
  author = {Xinling Li and Dadi Guo and Qingyu Liu and Qinghua Mao and Yi R. Fung and Na Zou and Xia Hu and Dongrui Liu},
  year = {2026},
  eprint = {2610.06576},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06576},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05870,
  title = {{Certification of Real Images through Calibrated Content Authentication}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05870},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05870},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04504,
  title = {{The Same Zero: Why Identical ASR Can Imply Different Guarantees in LLM-Agent Security}},
  author = {YaJie Yin},
  year = {2026},
  eprint = {2610.04504},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04504},
  note = {AI Safety HOT 2026-10-06}
}

@misc{aisafetyhot-szb31kjxklgq2qqjr5t0bdd06,
  title = {{Fair Moderation, Equitable Access, and AI: arXiv’s Updated Rate Limit Policy}},
  author = {Unknown},
  year = {2026},
  url = {https://blog.arxiv.org/2026/10/01/updated-rate-limit-policy},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05266,
  title = {{Provider-side IPI in proactive agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05266},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05266},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06049,
  title = {{Backdooring Sparse Autoencoders}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06049},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06049},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05139,
  title = {{Hidden in the Comments: A Context-Injection Attack Surface in Code LLMs}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05139},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05139},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06093,
  title = {{Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06093},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06093},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2605.30322,
  title = {{Gram: automated alignment auditing of sabotage propensities}},
  author = {Unknown},
  year = {2026},
  eprint = {2605.30322},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30322},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.00767,
  title = {{Pre-training interventions, ex post facto: Grafting model beliefs across checkpoints}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.00767},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.00767},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.03818,
  title = {{Control OSWorld: An AI Control Environment for GUI Computer Use Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03818},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03818},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06584,
  title = {{Does AI Help Cyber Attackers or Defenders? Evidence from Nonpublic Vulnerabilities and Subsequent Attacks}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06584},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06584},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05943,
  title = {{Runaway Reaction / CRIME}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05943},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05943},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06814,
  title = {{TAPDreamer: Transferable Adversarial Patches for World Action Models}},
  author = {Xuanyu Lu and Fengqing Jiang and Kaiyuan Zheng and Yichen Feng and Yaorui Ding and Yuetai Li and Zhen Xiang and Bhaskar Ramasubramanian and Basel Alomair and Luyao Niu and Radha Poovendran},
  year = {2026},
  eprint = {2610.06814},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06814},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06306,
  title = {{Inspect Robots}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06306},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06306},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05818,
  title = {{What the Guard Misses, the Robot Executes: Implied Harm in VLA Instructions}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05818},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05818},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04119,
  title = {{Copying Before Suppression: What Drives a Below-Chance Dip During Language Model Training?}},
  author = {Tejas Dahiya and Cole Blondin},
  year = {2026},
  eprint = {2610.04119},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04119},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04528,
  title = {{Quantifying Collusion Among Autonomous LLM Agents: A Statistical Analysis of the Collusion Wiki Incident}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04528},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04528},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2606.23700,
  title = {{Self-Recognition Finetuning can Prevent and Reverse Emergent Misalignment}},
  author = {Unknown},
  year = {2026},
  eprint = {2606.23700},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.23700},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06122,
  title = {{Benchmarking Jailbreak Guardrails for Embodied Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06122},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06122},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.03857,
  title = {{Beware EviLLM: Enabling Vulnerability Injection via Large Language Models}},
  author = {Zeezoo Ryu and Simon Chung and Muhammad Faraz Karim and Anna Raymaker and Karan Singh Jodha and Yash Chaturvedi and Sukarno Mertoguno},
  year = {2026},
  eprint = {2610.03857},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03857},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.03853,
  title = {{Can LLM Agents Select and Engage with Biological Tools?}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.03853},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03853},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06503,
  title = {{Harmful Content Generation in Text-to-Image Models: Capabilities and Moderation Limitations}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06503},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06503},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06668,
  title = {{Language models can notice an impossible engineering problem yet still report it as solved}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06668},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06668},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05346,
  title = {{Reflections and Fragments: Securing LLMs Against Sequential Mosaic Attacks}},
  author = {Emanuele La Malfa and Saar Cohen and Gabriele La Malfa and Mickel Liu and Christian Schroeder de Witt and Natasha Jaques and Michael J. Wooldridge},
  year = {2026},
  eprint = {2610.05346},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05346},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06064,
  title = {{TrustMI: Causally controlling how assistants trust their users}},
  author = {Th\'eo Lasnier and Romain Froger and Maxence Lasbordes and Djam\'e Seddah},
  year = {2026},
  eprint = {2610.06064},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06064},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06670,
  title = {{Reward Stealing Attack on Large Language Models}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06670},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06670},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05076,
  title = {{Self-Generated Feedback Destabilizes Test-Time Training: A Causal Decomposition of Long-Horizon Adaptation}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05076},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05076},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06193,
  title = {{Correct Code, Broken Contributions? SWE-CC: Benchmarking Repository Policy Compliance for Coding Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06193},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06193},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06171,
  title = {{Controllable and Photorealistic Pedestrian Risky Motion Generation for End-to-End Driving Safety Evaluation}},
  author = {Siyuan Liu},
  year = {2026},
  eprint = {2610.06171},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06171},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04693,
  title = {{Penumbra: Sample-Efficient Adversarial Search for Regulatory Obligations}},
  author = {Anthony Rhodes},
  year = {2026},
  eprint = {2610.04693},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04693},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05282,
  title = {{Red-TTT: Test-Time Training for Automated Jailbreaking Large Language Models}},
  author = {Tongyan Hu and Hao Li and Xiaogeng Liu and Ruida Wang and Zhengyu Liu and Shuyao Xu and Ning Zhang and Ziyang Li and Yinzhi Cao and Bryan Hooi and Chaowei Xiao},
  year = {2026},
  eprint = {2610.05282},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05282},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04985,
  title = {{Hidden Risks of Jev}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04985},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04985},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2609.24890,
  title = {{OSWorld-Pro: Process-based Evaluation for Computer Use Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.24890},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.24890},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05295,
  title = {{Readable Before Actionable: Causal Tracing of Indirect Prompt Injection}},
  author = {Zhe Yu and Wenpeng Xing and Xingxing Yang and Meng Han},
  year = {2026},
  eprint = {2610.05295},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05295},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04128,
  title = {{What Gradients Add to Text Leakage in Split Language Models, Counted per Token and per Document}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04128},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04128},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06317,
  title = {{Watermarking: from Impossibility to Auditable Compliance}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06317},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06317},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05461,
  title = {{AI Safety via Debate is Compromised by Cognitive Biases}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05461},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05461},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05840,
  title = {{Task-scoped authorization paired replay}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05840},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05840},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05601,
  title = {{Your Unlearning Gives You Away: Identifying Erased Concepts in Diffusion Models}},
  author = {Kaiyuan Deng and Yuchen Li and Yang Xiao and Bo Hui and Geng Yuan and Xiaolong Ma},
  year = {2026},
  eprint = {2610.05601},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05601},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05036,
  title = {{Characterizing Security Effects of OSS Vulnerabilities in Agent Systems}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05036},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05036},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06366,
  title = {{Correct Verdicts, Flawed Reasoning: Structured Auditing of LLM-based Vulnerability Reasoning}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06366},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06366},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.03980,
  title = {{FADE: Frame-Aware Diffusion-Transformer-based Multi-Concept Erasure for Video Unlearning}},
  author = {Yuchen Li and Kaiyuan Deng and Chaoran Feng and Zhenyu Tang and Li Yuan},
  year = {2026},
  eprint = {2610.03980},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03980},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2604.00012,
  title = {{Finding and Reactivating Post-Trained LLMs’ Hidden Safety Mechanisms}},
  author = {Unknown},
  year = {2026},
  eprint = {2604.00012},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2604.00012},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2609.37968,
  title = {{SelfSearch: Reward-Free Search for Self-Improving Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.37968},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37968},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06452,
  title = {{Multimodal Safety Evaluation Should Measure Controllability Beyond Classification}},
  author = {Junhyeong Park and Hanwool Lee and DongGeon Lee and Dasol Choi and Yejin Son and Haon Park and Youngjae Yu},
  year = {2026},
  eprint = {2610.06452},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06452},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04245,
  title = {{On the Steering Dimensionality of Refusal in Language Models}},
  author = {Han Wang and Erik Miehling and Dennis Wei and Karthikeyan Natesan Ramamurthy and Huan Zhang},
  year = {2026},
  eprint = {2610.04245},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04245},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06454,
  title = {{AgentPrivArena}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06454},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06454},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04967,
  title = {{One Token Can Be Enough: Bridging Prompting and Activation Steering with Prefix Steering}},
  author = {Xudong Zhu and Zhihui Zhu},
  year = {2026},
  eprint = {2610.04967},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04967},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06401,
  title = {{RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06401},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06401},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05308,
  title = {{RubricArmor: Adversarial Evolution Improves LLM-Based Rubric Generation}},
  author = {Haocheng Yang and Yuchao Zhang and Licheng Pan and Jiajun Fan and Maolin Wang and Kangning Zhang and Shuai Shao and Shijian Wang and Yuan Lu and Chunyuan Zheng and Hao Wang},
  year = {2026},
  eprint = {2610.05308},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05308},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2609.30467,
  title = {{Where Does Retrieval-Based Open-Ended Evaluation Fail? Automatic Taxonomy Induction from Long-Form Medical Answer Factuality Verification}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.30467},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.30467},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04017,
  title = {{Slaying the Hydra: Interaction-Aware Circuit Discovery in Language Models}},
  author = {Sankaran Vaidyanathan and Rafal Urbaniak and Emily Bunnapradist and Michelangelo Naim and Daniel Waxman},
  year = {2026},
  eprint = {2610.04017},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04017},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04269,
  title = {{Self-Reflection Fine-Tuning: Enhancing Agent Security against Prompt Injection Attacks from Failure Experience}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04269},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04269},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2609.37267,
  title = {{Foundations of Proactive Agents: Principles, Technical Layers, and Proactivity-Gym}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.37267},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.37267},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05826,
  title = {{Bounded Provisional Visibility: Controlling Poisoning Exposure in Continuously Ingested RAG Vector Stores}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.05826},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05826},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05689,
  title = {{Toward AI Trustworthiness: Finding Analytically Proven Forward-Invariant Sets for AI-Controlled Systems}},
  author = {Haoyang Song and Xikun Yang and Qixin Wang},
  year = {2026},
  eprint = {2610.05689},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05689},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04905,
  title = {{ScopeSAE: Model-Scope Feature Discovery with Interpretable Layer Selection}},
  author = {Qingwen Zeng and Zehao Fu and Shuyu Meng and Linghan Huang and Jiayi Zhang and Chenglin Wu and Ling Chen and Huaming Chen},
  year = {2026},
  eprint = {2610.04905},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04905},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06406,
  title = {{AgentMonBench}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06406},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06406},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04412,
  title = {{Large Language Models and Augmented Democracy}},
  author = {Jairo Gudi\~no-Rosero},
  year = {2026},
  eprint = {2610.04412},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04412},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06083,
  title = {{Boosting Transferable Adversarial Attacks against Deep Reinforcement Learning}},
  author = {Zexin Li and Ruili Yao and Yiming Zeng and Xiaoxue Gao},
  year = {2026},
  eprint = {2610.06083},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06083},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.02480,
  title = {{MEA: A Reward-Driven Multi-Agent System for Faithful Model Explanations}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02480},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02480},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06084,
  title = {{AI-Generated Disinformation in the UK}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06084},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06084},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06563,
  title = {{HERA: Harness-Environment Co-Evolution for Reliable Agentic Abstention}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06563},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06563},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04366,
  title = {{Human Behavior-Informed Crash Scenario Generation with Real-World Crash Priors for Autonomous Vehicle Safety Evaluation}},
  author = {Mingxing Peng and Xusen Guo and Long Chen and Xintao Yan and Siyu Teng and Jun Ma},
  year = {2026},
  eprint = {2610.04366},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04366},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04283,
  title = {{First-Order Steering: Translating Weight Adaptation into Activation Steering}},
  author = {Sri Pranav Kunda and Alexander Kurz and Tomas Dominik and Uri Maoz},
  year = {2026},
  eprint = {2610.04283},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04283},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04616,
  title = {{PerturBot: Breaking Shortcut Priors in Vision-Language-Action Models with Perturbative Training}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04616},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04616},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.03880,
  title = {{Reinforcement Learning on the Discrete Composition Channel of a Crystal Generator: Validated Gains and Reward Hacking}},
  author = {Pawan Prakash and Philipp H\"ollmer and Addis Fuhr and Peter Hirschfeld and P. Ganesh and Stefano Martiniani and Richard Hennig},
  year = {2026},
  eprint = {2610.03880},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.03880},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05162,
  title = {{Memadapter: Counterfactual Adaptation Against Memory-induced Sycophancy}},
  author = {Ruqing Ning and Haibo Meng and Zhishang Xiang and Zerui Chen and Jinsong Su and Xin Wang and Qinggang Zhang},
  year = {2026},
  eprint = {2610.05162},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05162},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05401,
  title = {{No Concept Escapes the Audit: Auditing-Aware Unlearning for Verifiable Concept Erasure in Diffusion Models}},
  author = {Kaiyuan Deng and Yuchen Li and Gen Li and Yang Xiao and Geng Yuan and Xiaoyong Yuan and Bo Hui and Xiaolong Ma},
  year = {2026},
  eprint = {2610.05401},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05401},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2609.03178,
  title = {{Open Problems in AI Risk Modeling: Insights from a Workshop on the Technical Foundations of AI Risk Modeling}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.03178},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.03178},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04112,
  title = {{The Independence Prior of SAEs Fragments Visual Concepts}},
  author = {Tommaso Mencattini and Giorgos Nikolaou and Donato Crisostomi and Thomas Fel and Francesco Montagna and Emanuele Rodol\`a and Francesco Locatello},
  year = {2026},
  eprint = {2610.04112},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04112},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04020,
  title = {{ClasSAE: Class-Aligned Sparse Autoencoders via Differentiable Feature-Class Affinity}},
  author = {Jakub St\kepie\'n and Marcin Mazur and Jacek Tabor and Przemys\law Spurek},
  year = {2026},
  eprint = {2610.04020},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04020},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04470,
  title = {{Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching}},
  author = {Luoyu Chen and Weiqi Wang and Chenhan Zhang and Zhiyi Tian and Shui Yu},
  year = {2026},
  eprint = {2610.04470},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04470},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06636,
  title = {{Differentially Private Mixing of Public Datasets Improves Private Learning}},
  author = {Yufei Chen and Tejumade Afonja and Anvith Thudi and Nicolas Papernot},
  year = {2026},
  eprint = {2610.06636},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06636},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04676,
  title = {{Extracting Persona Subspaces Through Iterative Nullspace Projection For Modulation}},
  author = {Ananya Malik and Mai ElSherief},
  year = {2026},
  eprint = {2610.04676},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04676},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06383,
  title = {{Steering by Influence: Curvature Aware Data Weighting for Activation Steering}},
  author = {James A. E. Dixon and Stephen J. Roberts and Francesco Quinzan},
  year = {2026},
  eprint = {2610.06383},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06383},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05219,
  title = {{Safe Context Switching for Agents in the Wild: Mitigating Subspace Interference via Orthogonal Adaptation}},
  author = {Akash Das and Ishan Roy},
  year = {2026},
  eprint = {2610.05219},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05219},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04672,
  title = {{MASBench: Benchmarking LLM-based Multi-Agent Collaboration under Partial Observability}},
  author = {Qizhi Chu and Zekai Yu and Sijie Wen and Yang Liu and Chen Qian and Cheng Yang and Chuan Shi and Zhiyuan Liu},
  year = {2026},
  eprint = {2610.04672},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04672},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.06673,
  title = {{The Pushback Paradox: A Two-Probe Diagnostic for Language Model Compliance}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.06673},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.06673},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04998,
  title = {{EmoRSS: Mitigating Emotion-Induced Over-Refusal in Large Language Models}},
  author = {Shuyi Miao and Yaojin Ma and Chenhang Cui and Xiaohao Liu and Dang Jisheng and Shengda Zhuo and Fei Shen and Tat-Seng Chua},
  year = {2026},
  eprint = {2610.04998},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04998},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2608.23642,
  title = {{AI Agents Push Humans Out of the Loop}},
  author = {Unknown},
  year = {2026},
  eprint = {2608.23642},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.23642},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.02999,
  title = {{OmniConfess: Eliciting Token Confessions to Mitigate Omni-Modal Hallucination}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.02999},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.02999},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04235,
  title = {{Learning to Watermark Speech Synthesis Against Model-Driven Reconstruction}},
  author = {Weizhi Liu and Yue Li and Hui Tian and Zhaoxia Yin},
  year = {2026},
  eprint = {2610.04235},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04235},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04467,
  title = {{Target-free Latent Safety Alignment}},
  author = {Luoyu Chen and Weiqi Wang and Chenhan Zhang and Zhiyi Tian and Yuxian Huang and Shui Yu},
  year = {2026},
  eprint = {2610.04467},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04467},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04792,
  title = {{Do More Modalities Always Help? A Geometric Perspective on Missing-Modality Robustness}},
  author = {Songyuan Sui and Zhen Tan and Mohan Zhang and Rana Muhammad Shahroz Khan and Xia Hu and Tianlong Chen},
  year = {2026},
  eprint = {2610.04792},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04792},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04243,
  title = {{NeuroSploit on GOAD}},
  author = {Unknown},
  year = {2026},
  eprint = {2610.04243},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04243},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2609.38096,
  title = {{Tail-Influence Sampling for CVaR Policy Evaluation}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.38096},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.38096},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04925,
  title = {{TSAE: Structured Sparse Autoencoders for Interpreting Time-Series Forecasting Models}},
  author = {Baoxi Liu and Yi Xie},
  year = {2026},
  eprint = {2610.04925},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04925},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04683,
  title = {{Steering Speech-Language Models: Training-Free Task Specialization via Contrastive Activation Addition}},
  author = {S\'everin Baroudi and Yanis Labrak and Pierfrancesco Melucci and Sergio Burdisso and Petr Motlicek and Herv\'e Bredin and Mirco Ravanelli and Ricard Marxer},
  year = {2026},
  eprint = {2610.04683},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04683},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.04413,
  title = {{Specific Algorithmic Interpretability of Neural Networks: A Case Study on Textures}},
  author = {Yanglin Zhang and Anneke von Seeger and Gilad Lerman and Ron Levie},
  year = {2026},
  eprint = {2610.04413},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.04413},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2609.36099,
  title = {{Data Unlearning via Inverse Distillation}},
  author = {Unknown},
  year = {2026},
  eprint = {2609.36099},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.36099},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05831,
  title = {{Selecting Long-Horizon Trajectories for Reliable and Efficient Terminal-Agent Training}},
  author = {Cuong Dang and Hoang Anh Just and Ruoxi Jia},
  year = {2026},
  eprint = {2610.05831},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05831},
  note = {AI Safety HOT 2026-10-06}
}

@misc{arxiv2610.05264,
  title = {{Task-Aware Joint Pruning and Distillation for Efficient Audio Deepfake Detection}},
  author = {Miao He and Peng Cheng and Zhongjie Ba and Qing Wen and Li Lu and Xin Yang and Kui Ren},
  year = {2026},
  eprint = {2610.05264},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2610.05264},
  note = {AI Safety HOT 2026-10-06}
}