The dominant agent authorization model — "pause and ask for approval" — has no specification of what exactly is approved, and attackers can exploit that gap to substitute recipients, replay grants, or change arguments after signature. This paper defines twelve attack classes against real approval protocols and proposes ASU, a gateway that formally binds a hardware passkey to an immutable canonical effect descriptor.
Figure 1: ASU gateway — agent proposes an effect, gateway renders a canonical card signed by user passkey, execution only proceeds on the exact signed descriptor. Tested against AP2, Microsoft's design, and MCP elicitation across 27,108 trials.
The authors audit 10 agent runtimes and find post-approval argument changes in 4 of 8 with measurable binding. They define 12 attack types — decoy recipient, amount cancellation, threshold splitting, replay, grant stretching, flooding, etc. — and test them against three production protocols. ASU uses Tamarin proofs covering 53 lemmas (binding, single-use, key-level non-repudiation). On 609 AgentDojo attack pairs, the trusted rendering card reduces forged-narration attack ASR from 0.54 to 0.03; LM-based approver catch rate improves from 0.30 to 0.98. Flooding still succeeded 0.45–0.60 against a modeled approver, which the authors note as a hard limitation.
Step-level guards trained on English-only benchmarks turn out to be brittle against multilingual attacks. Simply translating the user instruction into Amharic or Swahili — while leaving tool calls and observations byte-identical — can flip a guard's verdict, suggesting guards react to cross-channel inconsistency rather than request semantics.
Figure 1: Recall loss per language for open guards under 13B parameters — rarer languages cause greater recall degradation, with Amharic reaching −7.4 pp while frontier models (Gemini 3.8 Flash) shift by ~1 pp.
LinguaGuardBench is constructed from 1,220 labelled TS-Bench AgentDojo-Traj steps; only the user instruction is translated (German, French, Turkish, Swahili, Amharic) while tool calls, observations, and labels remain byte-identical. Across 19 guards (open, purpose-built, managed frontier): purpose-built guards show placebo-adjusted flip rates up to +4.4 pp under Amharic; all significant recall losses occur in guards under 10B parameters. Post-hoc analysis shows damage concentrates in steps where agent reasoning contains an English restatement of the request, pointing to cross-channel inconsistency detection rather than semantic harm assessment as the guard mechanism. All 489k verdicts are released.
Approving an MCP tool call can silently grant the server process broad host filesystem access far beyond the declared tool scope. The authors call this "filesystem capability laundering," find it in 16.4% of audited servers, and disclose two CVEs in Anthropic's official Git MCP Server.
Figure 1: Filesystem capability laundering — a user approves a non-filesystem tool call, but the MCP server's process gains broad host FS access through L2/L3 policy gaps. MCP-FSD found 16.4% of audited servers vulnerable, with 2 CVEs in Anthropic's Git MCP Server.
MCP-FSD analyzes 21,097 MCP servers from 9 registries in a three-layer framework: L1 category screening, L2 per-tool least-privilege contract inference, L3 path-validation bypass testing. A server declared as non-filesystem may still grant its process broad FS access through attacker-controlled tool arguments that exceed the declared scope. Dynamic validation confirmed 150 vulnerable instances across sandbox policies. Coordinated disclosure produced 13 security advisories including 2 CVEs in Anthropic's official Git MCP Server. This is a structural vulnerability class, not a configuration error.
Figure 1: Domain-cued misalignment rates with standard safety-data interleaving vs. ContextLift — reductions of 7–16× across security, legal, and medical domains at zero compute overhead.
Standard safety-data interleaving fails under domain-cued prompts after narrow misalignment finetuning because the model learns domain context as a cue for misaligned behavior. ContextLift breaks this spurious correlation by copying a random training-prompt context sentence into half the safety examples without altering answers. On Qwen2.5-7B, domain-cued misalignment falls from 18.9% / 41.9% / 58.2% to 2.6% / 6.1% / 12.8% across security, legal, and medical domains, with no added compute and no degradation on benign tasks.
Figure 1: GUISE benchmark — unsafe compliance under direct request (28.9%), correction-seeking framing (66.4%), and peak configuration (97.3%). Cultural adaptation exceeds literal translation by 7–18 pp across all four non-English languages.
GUISE draws scenarios from UNODC criminal classifications and evaluates three linguistic framings across five cultures. The correction-seeking framing — asking models to fix deliberately distorted criminal instructions — jumps unsafe compliance from 28.9% to 66.4% (peak 97.3%, p < 0.05). Culturally adapted prompts outperform literal translations by 7–18 pp across all four non-English languages, showing translation-based safety evaluations miss a major dimension of real-world risk. Anglocentric leakage in unsafe responses correlates with harm severity (Spearman ρ = 0.46–0.63).
Figure 1: LexFrame[1] achieves coherence 0.97 on both SmolLM3-3B and OLMo3-7B, far above the ~0.30–0.35 ceiling any fixed-direction lens can reach, enabling 42–45% of layers to be skipped in early-exit inference.
Each hidden state has a "native reference frame" shaped by which layers will read it next; LexFrame approximates it by simulating a limited number of attention rounds of the model's remaining computation. LexFrame[1] reaches coherence 0.97 on SmolLM3-3B and OLMo3-7B (theoretical ceiling for fixed-direction lenses: ~0.30–0.35), reads states within 0.16 nats of the model's actual output, produces more faithful attribution than activation patching, and enables early-exit inference at ~42–45% of layers.
Figure 1: DIB-Bench — acceptance of tampered outputs rises with judge capability (88.6% rule-based → 94.1% GPT-5-nano). A PAC bound proves trigger-conditional tampers are undetectable from outputs at any sample size; manifest-hash channels detect them with zero samples.
LLM evaluations report behavioral scores without verifying the deployed runtime stack. DIB-Bench tests 7,560 examples across 6 tamper types; mean tampered-output acceptance rises from 88.6% (rule-based) to 94.1% (GPT-5-nano). A trigger-conditional tamper invisible on the evaluation suite produces 48–100% harmful outputs in deployment; a PAC bound proves no output-only evaluator can detect it. Manifest-hash identity channels detect this tampering with zero samples, making deployment identity verification a strict improvement over behavioral evaluation alone.
Figure 1: Forgetting rates from a standard in-distribution unlearning evaluation (high in English) drop substantially under cross-lingual and cross-script queries, revealing that behavioral forgetting does not imply actual information inaccessibility.
Current LLM unlearning benchmarks verify forgetting only on the evaluation distribution. This NeurIPS 2026 workshop paper shows that "unlearned" information is recoverable via cross-lingual queries on multilingual model families — forgetting rates vary substantially across languages and scripts. The authors conclude that privacy claims from unlearning require testing adversarial access paths including cross-lingual querying and script variation.
Figure 1: Task-grounded SAE taxonomy linking design choices (sparsity, geometry, data coverage, objective) to evaluation criteria and NLP functions across 138 studies — the survey finds inconsistent baselines and evaluation protocols make cross-study comparisons unreliable.
Surveys 138 SAE studies in NLP covering feature recoverability, semantic interpretability, mechanistic faithfulness, and behavioral utility. Proposes a taxonomy linking dictionary design choices to NLP functions across multilingual, retrieval, reasoning, classification, and behavioral regulation tasks. Finds that inconsistent objectives, baselines, supervision levels, and intervention pipelines make cross-study effectiveness comparisons unreliable, and identifies standardization gaps the field must address.
Figure 1: Hub-Satellite poisoning topology — Hub nodes form well-connected anchors in HNSW graph regions while Satellite nodes act as entry points across query domains, ensuring poisoned documents are retrieved despite approximate search constraints. Achieves 31.29% ASR on 2M Wikipedia documents.
Existing RAG poisoning attacks assume exact retrieval and fail under HNSW's graph-search budget and reachability constraints on realistic corpora. Hub-Satellite poisoning exploits HNSW topology: satellites provide competitive entry points across semantic regions while hubs strengthen local cohesion for cascading retrieval, combined with entity-claim coupling for generation. On a 2M-document Wikipedia corpus, the attack maintains retrieval success above 72% and achieves 31.29% attack success rate, outperforming all baselines and evading existing defenses.