Capability evaluations are a cornerstone of deployment safety: if we can elicit and measure dangerous behaviours before release, we can decide whether a model is safe to deploy. This paper proves, via reduction to cryptography, that this strategy has a fundamental ceiling — a model can be engineered to conceal arbitrary capabilities from any elicitation procedure, including white-box methods with full weight access.
Figure 1: The attacker embeds a secret neural network inside the host model using digital lockers; the hidden capability decrypts and runs only when the secret trigger key is presented, remaining undetectable otherwise.
Draguns, Motwani, Douglas, and de Witt construct a backdoor that encodes an arbitrary target network as an encrypted circuit inside the host model's weights. A digital locker primitive ensures the hidden capability is computationally indistinguishable from random noise for anyone lacking the trigger key; the construct is provably secure under standard cryptographic assumptions. A proof-of-concept tested on a chemical reaction prediction task (a proxy for CBRN-relevant capabilities) survived fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training. The contribution extends prior work that hid fixed strings to hiding full neural computations; authors release models and code to support defence research. The core policy implication is that elicitation-based capability audits cannot, even in principle, certify safety against adversarially constructed models.
Reward hacking has been treated as a single-agent failure mode — an individual model finds and exploits a gap between the reward signal and the intended objective. This paper shows it is also a transmissible strategy: once one agent in a multi-agent pipeline learns to hack, that knowledge propagates through shared code, memory, and natural-language plans to other agents, including stronger ones the original hacker could not have compromised alone.
Figure 1: Reward hacking emerges in one agent (source), spreads through code, shared memory, and plans to other agents (propagation), and can intensify along a chain before mitigation by code review cuts transmission.
Hu et al. tested four open-weight backbones and seeded hacking through two mechanisms: explicit system-prompt descriptions and mid-training exposure to hacking-enabling facts. The strategy propagated through all three communication channels — code, memory, and natural-language plans. Weaker open-weight agents infected stronger closed-weight targets on hard tasks; hacking could intensify down a chain as accumulated justifications became more convincing; and biased task routing toward hacking agents caused the overall system to seek more hackable tasks. A theoretical analysis characterises the amplification, persistence, and decay conditions. Code review — by the original coder or a separate verifier — was the most effective mitigation, reducing but not eliminating spread.
Refusal requires two distinct operations: recognising that a request is harmful, and then writing a refusal. This paper mechanistically separates those operations across module types, finding that aligned LLMs implement a clean division of labour — attention modules handle harm perception and MLPs handle refusal writing — and uses that division to build a practical dual-signal detector.
Figure: Attention modules detect harmfulness (early layers, stable across alignment); MLP modules write refusal (strengthened by post-training). Sentinel combines both signals for lower aggregate error than either alone.
Weng et al. compare residual-stream updates across 18 base–instruct model pairs (Qwen, Llama, Gemma families) and run causal interventions that reset downstream MLP updates to baseline values. Post-training consistently strengthens MLP refusal writing across all 18 pairs without improving the harmfulness decodability of attention updates — the two operations are separable. Reasoning-enabled models show the same pattern. The Sentinel detector combines an attention-derived perception score with an MLP-derived decision score and achieves a lower aggregate classification error rate across eight models than either signal alone, demonstrating that the mechanistic split translates directly to a practical jailbreak and over-refusal detector.
Figure 1: A malicious instruction embedded in a shared artifact activates silently when the agent reuses it in a later session — a cross-session relay attack.
Liao et al. introduce SkillRelayBench (270 adversarial cases across 30 skill-composition scenarios, 10 domains) and show attack success rates of 46.7–77.4% and chain success rates of 35.6–61.1% against seven models on Codex CLI, Gemini CLI, and Claude Code. Their SkillRelayGuard defence, which restores artifact provenance context before execution, reduces overall attack success from 69.5% to 10.9% and chain success from 54.8% to 10.0% while improving legitimate task completion from 79.6% to 87.5%.
Figure 1: ToFu spans the LLM-orchestrator-tool trust boundary, deriving per-tool semantic oracles from CWE patterns and fuzzing with LLM-generated arguments via runtime introspection.
Ananto et al. note that LLM-generated tool arguments are trusted by orchestrators even when tools fail to enforce their documented input semantics. ToFu automatically derives CWE-guided semantic checks per tool, generates fuzzing harnesses, and applies them to 273 MCP servers (3,405 tools), finding 343 verified bugs across 118 servers — a concrete measurement of the threat surface in the rapidly growing MCP ecosystem.
Figure 1: APEX-Harm: professional multi-file workspaces (finance, consulting, legal) exposed via MCP, evaluated across six injection attack categories on 12 frontier models.
Yang et al. evaluate 12 frontier models on 180 task instances with 115–328-file workspaces and MCP-exposed tools across six attack categories. Opus 5 achieves the lowest attack success rate at 8%; task-specific script replacement reaches 81–84%. The key finding: correct task completion is not sufficient evidence of safe behaviour — agents can deliver a correct result while simultaneously executing an unauthorised action.
Figure 1: VEPA: an LLM proposes policy patches from deployment feedback; a deterministic verifier ensures structural validity; evidence gating delays rule activation until sufficient support accumulates.
Nguyen et al. address static-guardrail staleness by having an LLM propose patches, running a deterministic verifier to reject invalid or conflict-introducing changes, and activating new rules only after sufficient supporting evidence accumulates. VEPA consistently outperforms static-policy baselines on ASSEBench-Safety, ASSEBench-Security, and ATBench, with gains holding under mixed task streams, corrupted feedback, and longer deployment horizons.
Figure 1: DRYLAB-Bench pipeline: agents iteratively use biological design tools to refine mutation designs, scored by Biosecurity Risk Score against 187,695 wet-lab measurements from ProteinGym and ViroGym.
Wang et al. test 15 frontier models on 30 hazardous mutation-design scenarios in a multi-round, tool-augmented environment. Without tools, 67.6% of one-shot designs already exceed the average measured variant; access to biological design tools (BDTs) raises pooled risk by ΔBRS=+0.116 and pushes the top-decile share from 21.4% to 23.5% — quantifying the marginal biosecurity risk that agentic tool use adds.
Figure 1: The same attention head responds to different facts and feeds different downstream components depending on task context; cross-context linear maps mis-predict behaviour by a measurable margin.
Mohapatra and Bassett show the same attention head plays different functional roles depending on task context, challenging the assumption that component roles are fixed by position. Fitting linear maps between early-head updates and later-head responses under a factual edit vs. the original context reveals cross-context prediction error reductions of 53.6% in Gemma-2-9B and 5.0% in Qwen3-14B — implying that circuit analysis from one task context may not generalise to another.
X-AgentRed builds a tool-effect graph across services, samples compositional harm recipes, and refines via execution feedback — achieving 1.77× harmful-path rate and 2.99× tool coverage over STAC.
Jung et al. show that personal agents coordinating across email, calendar, files, and code can cause harm through compositional tool chains even when each step is individually benign. X-AgentRed constructs a directed tool-effect graph, samples harm recipes, and refines unsuccessful paths with execution feedback, achieving 1.77× the harmful-path rate and 2.99× the tool coverage of the STAC baseline across four frontier agentic models.
