Research Radar · August 22

Left: An unbound agent chain permits read_file → send_email to form an exfiltration path — no single action is unauthorized, but the combination is. Right: The Agentic Principal Chain (APC) attaches signed scope state at each delegation hop; the send_email call fails a scope check and is intercepted before execution. Result: data exfiltration ASR drops from 100% to 0%.

01 AI security preprint

Bounded Agents: Delegation Security for Multi-Agent AI Systems

arXiv · August 18–19, 2026

Most LLM agent security checks operate action-by-action — but the most dangerous attacks chain two individually-permitted actions into a prohibited outcome: read a confidential file, then send it via email. Bounded Agents stops this class of attack by tracking authorization state across the entire delegation trajectory, not just at each individual action boundary.

The paper introduces the Agentic Principal Chain (APC), a runtime mechanism that attaches signed session-level state to every inter-agent delegation: principal identity, scope, delegation budget, declared intent, and action history. Six-condition enforcement at each step prevents any combination of individually-allowed actions from yielding a prohibited outcome — the key contribution over per-action checks. Benchmark results: data exfiltration attacks reduced from 100% → 0% under complete restrictions; 140 of 200 stealthy attacks blocked; AgentDojo exfiltration rate → 0%; utility cost 8.6–13.9 pp; authorization overhead 0.05 ms median — negligible in deployed settings.

Linear probe accuracy for the first-difference feature across LLaMA 3.1-8B's 32 layers — the representation forms in early-to-mid layers and stabilises at ≥88% accuracy by L14 without explicit supervision. Activation patching (right panel) isolates an induction-like circuit that retrieves the latent first-difference and adds the offset in late layers to generate the correct next value.

02 mech-interp preprint

Mechanistic Interpretability of Structure-Aware Numerical Reasoning in LLaMA 3.1 8B

Rahul Chowdhury, Timothy A Rupprecht, Senhao Cao, Jiahao Liu, Octavia Camps, David Bau, Pu Zhao, Yanzhi Wang · arXiv · August 20, 2026

When LLaMA 3.1-8B extends a number sequence, what is it actually computing? This paper gives the first mechanistic answer: the model learns to represent first differences as a linearly recoverable latent feature — without any supervision signal for that structure — and retrieves it via a circuit that looks structurally like an induction head operating over latent differences rather than raw tokens.

Linear probing across all 32 layers reveals that a "first-difference" representation forms in early-to-mid layers and stabilises at ≥88% probe accuracy by layer 14 — the model is computing the differences between consecutive sequence values as an internal representation, not as an explicit output. Activation patching then isolates the circuit: structurally induction-like attention heads retrieve the relevant first-difference from the preceding positions and apply the offset in late layers to produce the predicted next value. This is the first mech-interp study demonstrating that LLaMA 3.1-8B encodes latent structural patterns (not token-level statistics) for numerical sequence prediction, with both the representation and the causal circuit identified.

ASR across six lifecycle phases for 128 adversarial test cases embedded in untrusted workflow artifacts. Utility (green dashed line) stays near 90% across all phases — the model remains helpful — while ASR swings from 15% at Harness Configuration to 80.9% during Runtime Operation. High-risk detection (92–98% accuracy) did not prevent successful attacks in the Runtime phase.

03 AI security preprint

HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety

arXiv · August 19, 2026

Which deployment configuration you use matters more than which model you pick — the same LLM showed a 4.3× difference in attack success rate depending purely on how its agent harness was configured. HarnessRisk is the first benchmark to treat agent safety as a full-lifecycle property, surfacing vulnerabilities at six phases from initial setup through incident recovery.

The benchmark comprises 128 test cases that pair benign user objectives with adversarial instructions embedded in untrusted workflow artifacts, evaluated across six phases: Harness Configuration, Capability Extension, Runtime Operation, State Persistence, Action Control, and Incident Recovery. ASR ranged from 12.6% to 80.87% while task utility held at 75–97.6% — the model remained capable even as it was being exploited. High-risk detection reached 92–98% accuracy (GPT-5.4 judge, κ=0.83) yet 31–55% of attacks still succeeded, confirming that detection performance and attack prevention operate independently. Runtime Operation was the most dangerous phase; roughly 38–59% of useful executions involved unsafe behaviour.

04 AI security preprint

PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents

Converts natural-language policies into persistent workflow graphs offline, then deploys a runtime verifier that tracks procedural state and intercepts unauthorized tool calls before execution — moving safety from per-action checks to whole-workflow enforcement. Demonstrated robustness against CRAFT adversarial attacks; Mean Pass@4 improved from 0.42 to 0.62 across three customer-service domains; telecom domain jumped from 0.193 to 0.614. Submitted August 21, 2026.

05 AI security preprint

Security Assessment of DeepSeek Harness with A.I.G: Evaluating Resistance to Indirect Prompt Injection

14,560 controlled executions across 16 channels, 35 objectives, and 12 attack variants show overall injection success of 5.6% — but with a critical carrier-format asymmetry: hidden Unicode embedded in files achieves 25.5% success vs. 0.0% in plain text mode. Controlling LLM output (35.7% ASR) proves far easier than triggering sensitive actions (2.5%). Skills-based injection elevated to 15.2%.

06 AI security preprint

Training Leaves Traces: Centered Residual Signatures for Language Model Lineage Verification

A data-free, white-box method that detects whether two model checkpoints share a common weight ancestor by computing centered residual branch products — a coordinate-free fingerprint of the training lineage. Achieves AUROC 1.00 on GPT-2 benchmarks; robust to quantization, LoRA merging, fine-tuning, permutation, and reciprocal scaling attacks; 76× faster than alignment-based baselines. Enables passive model provenance auditing without behavioral testing.

07 mech-interp preprint

SAEVerbalizer: Generating Explanations for Sparse Autoencoder Features via Representation Verbalization

Addresses the SAE auto-interp bottleneck: instead of prompting an LLM to describe what token sets activate a feature, SAEVerbalizer injects the SAE decoder direction directly into the model's residual stream and fine-tunes downstream layers to generate a natural-language explanation. Removes the need for token-set curation; evaluation confirms generated explanations match human-annotated quality on automated interpretability metrics. Scales to full-dictionary labeling.

08 text-diffusion preprint

DeMTS: Denoising Trajectories as Multivariate Time Series for Hallucination Detection in Diffusion Language Models

Frames hallucination detection in masked diffusion LMs as multivariate time-series classification over the full denoising trajectory — treating each step as a vector of token-level signals. Prior methods compressed along the temporal or token axis, missing cross-token fault propagation; DeMTS preserves both dimensions through learnable latent variables. Provides the first trajectory-aware hallucination detector for LLaDA/Dream-based generation.

09 text-diffusion SIAM SDM 2026

Discrete Diffusion Language Models Are Training-Free Multi-Label Classifiers

dLLM-SetScore repurposes LLaDA-8B and Dream-7B as zero-shot multi-label text classifiers by scoring candidate label sets via masked-diffusion pseudo-likelihoods — no task-specific fine-tuning required. Evaluated across six diverse datasets (GoEmotions, Reuters-21578, EURLEX57K, ECtHR Task A, Jigsaw Toxic, AAPD); outperforms BART-MNLI, DeBERTa-NLI, Qwen2.5-7B-Instruct, and SetFit in multiple settings. Peer-reviewed, accepted to SIAM SDM 2026.

10 AI security preprint

MemTrapBench: Benchmarking Cognitive Traps in LLM Memory Use

1,050 multi-turn dialogue instances (18–40 turns) across four cognitive trap categories — Cognitive Bias, Task Boundary, Safety, and Trauma — test whether accurate, relevant memories can anchor an LLM to an obsolete strategy or distort its beliefs. All evaluated memory strategies underperformed the no-memory baseline. Proposes AdaptiveMem, an inference-time system prompt detecting task transitions and strategy fixation; improves +2.5 to +14.9 points. Submitted August 21, 2026.