The paper introduces a resource‑constrained framework that distinguishes between repeated success, unique coverage, accepted evidence, and operational protection in security assurance tasks. It derives formulas for coverage under repeated, conditionally independent attempts, shows that pairwise outcome correlation does not necessarily limit coverage, and links coverage to evidence checking, scoring, resource accounting, and response modeling. The authors propose a defensive architecture separating evidence analysis, adjudication, and operational authority, and outline an evaluation protocol with held‑out tasks and uncertainty reporting.
arXiv:2610.33112v1 Announce Type: new Abstract: Use-based AI regulation assigns obligations by deployment risk but lacks an evidentiary object to carry them. A benchmark score is a property of a mode...
arXiv:2607. 15263v1 Announce Type: cross Abstract: Security-agent evaluations commonly measure peak offensive capability under generous inference budgets, emphasizing vulnerability discovery, exploit development, penetration testing, and CTF completion.
arXiv:2610.18948v1 Announce Type: cross Abstract: Finite safety assessments cannot exclude an adversary that preserves unattacked behavior until certification and activates afterward. We characterize...
arXiv:2607. 07474v1 Announce Type: cross Abstract: Agentic red-teaming benchmarks report whether an injected agent was compromised as a single bit: the attack succeeded, or it did not.
arXiv:2608.21423v1 Announce Type: cross Abstract: Agentic security uses large-language-model (LLM) agents to plan, dispatch, and interpret security tools. As these systems move from demonstrations to...
The paper critiques current LLM safety evaluations that rely solely on severity taxonomies, arguing they ignore the probability that a threat will actually be executed. It introduces Expected Harm, a metric that multiplies severity by execution likelihood—modeled via execution cost—to better gauge real-world risk. Empirical studies show that models over‑refuse low‑likelihood, high‑cost threats while remaining vulnerable to high‑likelihood, low‑cost ones, a miscalibration traced to the distribution of safety examples in supervised fine‑tuning. This misalignment can be exploited to double the success rate of jailbreak attacks.
arXiv:2606. 26479v1 Announce Type: cross Abstract: Recent work (2024 to 2026) has converged on a strategy for defending tool-using LLM agents against indirect prompt injection: rather than training the model to refuse malicious instructions, enforce security outside the model with a deterministic policy that mediates the agent's actions.
The paper investigates whether stacking multiple defenses around large language models (LLMs) truly compounds security. Using the Adversary Access‑Tier Model (AATM) and a cost‑tiering system, the authors analyze a seven‑layer defense stack and find that failure correlations between layers are consistently positive, meaning the residual attack success is higher than the multiplicative prediction. Despite high coverage and low false refusals, the stack’s performance is largely driven by common architectural causes rather than diverse, independent defenses.
arXiv:2606. 06529v1 Announce Type: new Abstract: An attacker that strategically chooses when to attack is much harder to catch than one that attacks indiscriminately.
arXiv:2609.01487v1 Announce Type: cross Abstract: Skill-augmented agents load reusable skills as persistent runtime context, improving task performance but also giving malicious skills a durable chan...
arXiv:2605. 06340v2 Announce Type: replace-cross Abstract: Continuous post-deployment compliance audits, mandated by emerging regulations such as the EU AI Act and Digital Services Act, create a class of strategic gaming distinct from the one-shot input/output gaming studied in prior work.
arXiv:2608.28021v2 Announce Type: replace-cross Abstract: Large language models increasingly author Infrastructure-as-Code (IaC), where one insecure default is provisioned straight into production. P...