arXiv AI
Easier Said Than Done: Unpacking Intent-Behavior Gap in Jailbreaking LLM-Based Robots
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv AI
Jun 10
BadRobot: Jailbreaking Embodied LLM Agents in the Physical World
arXiv:2407. 20242v5 Announce Type: replace-cross Abstract: Embodied AI represents systems where AI is integrated into physical entities.
arXiv AI
Jun 17
Breaking the Code: Security Assessment of AI Code Agents Through Systematic Jailbreaking Attacks
arXiv:2510. 01359v2 Announce Type: replace-cross Abstract: Code-capable large language model (LLM) agents are embedded in software engineering workflows where they can read, write, and execute code, raising "jailbreak" stakes beyond text-only settings.
arXiv AI
Jun 19
Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems
arXiv:2606. 20470v1 Announce Type: cross Abstract: Agentic AI systems increasingly rely on language-model components to interpret instructions, process external data, invoke tools, and coordinate with other agents.
arXiv AI
Jun 15
From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails
arXiv:2606. 14517v1 Announce Type: cross Abstract: LLM-based guardrails have emerged as a highly effective defense against prompt injection and jailbreak attacks in autonomous agents.
arXiv AI
Aug 11
TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories
arXiv:2604. 07223v2 Announce Type: replace-cross Abstract: As large language models (LLMs) evolve from static chatbots into autonomous agents, the primary vulnerability surface shifts from final outputs to intermediate execution traces.
arXiv Computation and Language
Aug 27
A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks
The paper introduces a self‑evolving defense framework for large language models that uses a persistent, cross‑interaction rule memory to adapt to new jailbreak attacks. When an attack succeeds, the system abstracts the failure into a method‑level rule that captures the structural attack wrapper, allowing the rule to generalize across an entire attack family. This memory‑based adaptation operates without parameter updates, works with both open‑weight and black‑box models, and has been shown to reduce attack success rates while preserving benign utility across multiple jailbreak families.