arXiv:2608.30041v1 Announce Type: cross Abstract: Large language model agents place outputs from external skills into their execution context, allowing attacker-controlled data to influence later pri...
The paper introduces skilder, a framework that organizes LLM agent capabilities into role‑scoped bundles of skills, tools, and instructions, with explicit limits. Agents start with a minimal role catalog, discover the roles needed for a task, and receive the associated tools only through a single MCP server, ensuring deterministic enforcement of scope. Experiments on 13 tasks with six models show that skilder’s authorization layer prevents unauthorized tool calls and parameter violations while maintaining flexibility through dynamic cross‑role capability acquisition.
arXiv:2605. 09163v3 Announce Type: replace Abstract: Large language model agents increasingly operate through an intermediate skill layer that mediates between user intent and concrete task execution.
arXiv:2605. 17480v3 Announce Type: replace Abstract: Multi-agent systems extend large language models (LLMs) by decomposing tasks among specialized agents, but their distributed decision process creates new attack surfaces.
The paper introduces Dynamic Boundary Evaluation (DBE), a method that moves beyond static benchmarks by locating the per‑prompt pass probability near 0.5 for large language models. DBE provides a calibrated item bank with difficulty labels, a Skill‑Guided Boundary Search algorithm that works with API‑level access, and an adaptive evaluation protocol that places new models on a unified ability scale. The approach is applied to safety, capability, and truthfulness tasks, expanding coverage without saturation and remaining compatible with existing datasets.
arXiv:2607. 24343v1 Announce Type: cross Abstract: Language-model agents act through structured tool calls whose arguments carry different risks.
Language-model agents act through structured tool calls whose arguments carry different risks. Untrusted content may safely influence an email body but should not determine a recipient, account, command, or credential.
The paper examines the vulnerability of open‑weight large language model safeguards that aim to block harmful usage by assuming new harmful behavior arises only through fine‑tuning. It demonstrates that simple, low‑cost attacks—abliteration and prefilling—can significantly increase attack success rates across multiple benchmarks, and proposes an abliteration‑resistant tuning (ART) method that mitigates these attacks. The study shows that safeguarding defenses must be evaluated against a broader range of attack strategies beyond fine‑tuning.
The paper introduces "capability laundering," a method where a weaker, unaligned language model splits a harmful task into benign subproblems, consults a stronger aligned model on each, and locally combines the answers. Experiments with GPT‑5.5, Claude Opus 4.8, and Grok‑4.3 as consultants to various local orchestrators show significant uplift on CyBench, BountyBench, and a bioweapon attack chain, with Gemma‑4‑31B recovering many more candidates than the aligned models alone. The results reveal that refusing a harmful task does not stop frontier capabilities from being transferred and composed across multiple permitted interactions.
The paper investigates how large language models (LLMs) can be bypassed by translating harmful requests from English into low‑resource languages. By testing ten popular LLMs across 79 languages, the authors find that safe English completions often fail to remain safe after translation, with bypass rates between 21.9% and 44.4%. The risk is unevenly distributed across language families and varies significantly between models, making it hard to rank models by safety consistently.
arXiv:2508. 10029v3 Announce Type: replace-cross Abstract: Safety-aligned large language models can still be manipulated through white-box interventions that modify their internal representations.
The paper introduces Many-Tier Instruction Hierarchy (ManyIH), a new framework for resolving conflicts among instructions with arbitrarily many privilege levels in large language model agents. It presents ManyIH-Bench, a benchmark featuring 853 agentic tasks that require navigating up to 12 levels of conflicting instructions across 46 real-world agents. Experiments show current models achieve only about 40% accuracy when instruction conflict scales, highlighting a gap in fine-grained, scalable conflict resolution.