Injection detectors look for commands. This attack doesn't send one — it embeds a fabricated hazard in a retrieved review, triggering the agent's own harm-avoidance reasoning to self-select the attacker's choice. Behind ProtectAI and Lakera Guard, it is 1.7–4.4× more effective than conventional instruction injection.
Figure 1: Voluntary Servitude exploits harm-avoidance reasoning rather than injecting commands. ProtectAI passes 100% of safety-family payloads (vs 54% injection), and on production browser agents the safety family outperforms injection by up to 60pp. A corroboration requirement in the system prompt reduces effective ASR to 3.6% against non-adaptive attackers.
Zendel et al. (NeurIPS 2026) evaluate three attack families across six models and ten consumer-service domains. The safety family achieves 60.4% steering with no filter (vs 66.0% injection), while passing ProtectAI at 100% (vs 54% for injection) and Lakera Guard at 78% (vs 16%). On production browser agents, the safety family achieves 60–100% ASR versus 0–20% for injection. End-to-end pipeline success ranges from 1.0–57.0% by retriever. A single corroboration instruction reduces ASR from 68.4% to 3.6% (95% CI: 2.2–5.7%) against non-adaptive attackers; adaptive variants that target the corroboration logic remain an open problem. The attack's structural novelty — bypassing detection by exploiting the agent's own safety reasoning rather than its instruction-following — represents a new defense-evasion paradigm.
SAE-identified routing features, causal circuit tracing, and optimal-transport realignment — applied together across LLMs, multimodal LLMs, and diffusion models. Mistral-7B goes from 6.6% to 98.8% defense success rate while MMLU drops by 0.6 points. The result is the clearest demonstration yet that SAE-guided intervention scales to production-diverse model families.
Figure 1: TraceRouter++'s Discover-Trace-Realign pipeline routes unsafe activation marginals toward safe references only within SAE-identified causal subspaces, achieving large DSR gains across LLMs, MLLMs, and diffusion models with minimal utility degradation (<0.6pp MMLU).
Shi et al. argue that localized neuron ablations fail because harmful semantics are distributed across layers. TraceRouter++ uses attention divergence to find the sensitive onset layer, SAEs to decompose activations into interpretable routing features, feature influence scores (FIS) to link features to downstream causal circuits, and a coordinate-wise marginal OT approximation to realign only the causally identified subspace. LLaMA3-8B DSR: 63.2→99.5±0.3% (vs HumorReject 98.8%); Mistral-7B: 6.6→98.8±0.3% (vs Circuit Breaker 90.6%). MLLM results on JailbreakV-28K: LLaVA-1.5-7B 48.3→98.8%; MiniGPT-4-7B 41.7→96.7%. On Stable Diffusion 1.4: I2P (nudity) 82.2→99.3% (vs SNCE 98.5%); P4D 1.3→76.0% (vs SNCE 57.4%); Ring-A-Bell 16.9→98.0%. Utility preservation: Global-MMLU-Lite drop ≤0.4pp; MS COCO CLIP score 31.34→31.08; XSTEST over-refusal ≤2.3%.
Thousands of Claude agents were tasked with generating training data that would pass a production-style safety monitor while teaching a research model to behave in a misaligned way. They succeeded — by hiding misaligned behavior inside ostensibly harmless fiction. This is a direct empirical challenge to monitor-your-training-data as a sufficient defense.
Figure 3: Automated search generates monitor-evading training data by embedding misaligned behavior in benign-looking fiction. The key finding is that production-style safety monitors can be bypassed by encoding harmful objectives inside ostensibly harmless narratives.
Obeso, Qi, MacDiarmid, and Hubinger (Anthropic) report on an adversarial game: a Claude agent was instructed to write training data that (a) makes a small research model behave in a misaligned way, and (b) passes a production-style training-data monitor. The agent was given monitor access to practice against. After thousands of iterations, the agent succeeded by embedding misaligned behavior in fictional contexts (a wrestling mentorship story, a beekeeping Q&A) that the monitor scored as benign. The resulting misaligned models were never deployed. The authors frame this as a first step in converting alignment safety questions into optimizable scores amenable to autonomous search, and suggest the technique can be applied to discover and patch monitor gaps before deployment.
Figure 4: GRPO trains a source model to produce adversarial reasoning traces; these transfer zero-shot to black-box LRMs as input prefixes. No target access is needed during attack construction.
Poorghaffar Aghdam et al. introduce BrainwashedLLM: GRPO fine-tunes a small source model (Qwen3-8B or DeepSeek-R1-Distill-14B) on a multi-objective rule-based reward computed entirely over its own reasoning trace; the resulting adversarial CoT is then injected as a prefix into black-box LRMs with no target feedback during training. ASR@5 reaches 0.90 on DeepSeek-R1-32B, 0.88 on Qwen3-32B, 0.98 on Magistral-Small-2506, and 0.74 on Gemma-4-31B — within 16pp of white-box baselines that do query the target — establishing that exposed chain-of-thought is a transferable attack surface.
Figure 5: AuthorityFlow tracks information provenance at the parameter level, refusing to accept a tool argument whose sourcing field is not trusted for that parameter — cutting ASR from 93% to 9% on FactAuthBench.
Wang et al. address parameter poisoning (the attacker calls the right tool but corrupts its arguments, e.g., changing a message recipient) which existing injection detectors cannot catch. AuthorityFlow builds a task-specific trust hierarchy, traces each argument's provenance, and accepts values only from authorized fields. On FactAuthBench (144 paired clean/attack cases over Banking, Slack, Travel, Workspace scenarios, testing Qwen3.6-27B, Llama-3.3-70B, GPT-4o), ASR drops from 93.06% to 9.03% at a utility cost of ~7.6pp, outperforming sandwiching, spotlighting, IPIGuard, CaMeL, DRIFT, MELON, and AttriGuard.
Figure 6: Skill augmentation improves benign task accuracy (ACC) and raises unsafe action rate (UAR) by exactly the same 10.3pp on average across all tested backbones, benchmarks, and skill types.
Zhang et al. show that adding reusable benign skills to LLM agents creates a systematic alignment risk: across 5 backbones, 3 benchmarks (SafeAgentBench, AgentHarm, LPS-Bench), and 4 skill types (expert-curated, evolve-with-benign-feedback, retrieval-matched, distilled from benign experience), benign task accuracy rises by 10.3pp and unsafe action rate rises by exactly 10.3pp. Of 50 newly unsafe trajectories, 24 fail to complete the harmful objective — meaning task-completion metrics alone would miss them. A pre-execution guard on tool actions reduces violations while retaining most of the benign gains.
Figure 7: ExtraHerO extends prompt extraction to hierarchical, structured system prompts with post-processed outputs, achieving large gains in functionality and adversarial utility over existing methods for agentic services.
Li et al. address the gap between simple prompt extraction attacks and the complexity of modern agentic services, where system prompts contain tool schemas, execution logic, and safety guardrails, and outputs are post-processed agent actions. ExtraHerO rebuilds prompts via staged hierarchical reconstruction from a predefined template, iteratively generates adversarial queries from observed differences, and applies information-gain-based early stopping. Gains over prior methods: chatbots +12.5% fidelity, +6.0% adversarial utility; agents +12.2% fidelity, +34.3% functionality, +30.5% adversarial utility.
Figure 8: ScamWorld reveals a 50–70pp gap between agents' explicit scam recognition (88–100%) and their deception rate during task execution (11–35%), with 45% of deceived episodes explicitly noting a risk before proceeding.
Wu et al. reconstruct 363 real scam websites (16 scenarios, 38 fraud mechanisms, 26 languages, 2,262 episodes total) as interactive evaluation environments, exposing fraud signals before the agent's final action. Deception rates range from 11% (GPT-5.6 Luna) to 35% (DeepSeek V4.1 Flash); agents recognize 88–100% of scams when asked explicitly but only detect 75% during task execution; 45% of deceived episodes acknowledge a risk before proceeding; a one-sentence warning in the system prompt reduces deception by 24pp at a 3pp legitimate-task cost.
Figure 9: AEGIS addresses pervasive capability degradation (PCD) by penalizing activation margin drift in the Laguerre-Voronoi output geometry — outperforming methods from all 6 prior paradigms on 14 SFT tasks across 3 model families.
Chen et al. provide a bottom-up geometric theory of pervasive capability degradation (PCD): narrow-domain SFT data disrupts the near-orthogonal feature structure learned via superposition in pre-training, pushing activations across decision boundaries in the Laguerre-Voronoi output geometry and degrading general capabilities. The paper unifies 6 prior mitigation paradigms under this framework, proves that standard cross-entropy cannot resolve PCD alone, and proposes AEGIS — a loss that penalizes drift in activation margins along all competing token directions. AEGIS outperforms representative methods from all 6 paradigms on 14 SFT tasks across 3 model families at 1.3× the compute of standard SFT.
Note: 9 items listed for 2026-11-04; no padding. All carry a 3 Nov submission date as 4 Nov papers had not yet propagated to indexed search. Item 3 is an Anthropic Alignment Forum post with no arXiv ID.