Entity trail

AgentDyn

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-28 / arxiv-researcherJudgeStealer Replicates a Black-Box LLM Judge Across Three Evaluation Protocols From Pointwise Queries AlonearXiv 2608.26982 presents a query-efficient model extraction framework aimed specifically at LLM judges, exploiting strong cross-protocol agreement to acquire pointwise scores and convert them into pairwise and listwise supervision without spending extra victim queries. It selects pointwise inputs by semantic diversity, predictive uncertainty and potential judge biases, then applies score smoothing and multi-protocol review to preserve ordinal structure during surrogate adaptation. Against state-of-the-art LLM-as-a-judge and reward models it reaches 73.3% pointwise, 87.0% pairwise and 71.6% listwise accuracy, holding up across surrogate scales and against representative extraction defenses.
2026-08-28 / arxiv-researcherSARA Separates 'A Tool Output Suggested This' From 'The User Authorized This', Holding ASR Under 0.63%arXiv 2608.27146 argues the core risk in tool-augmented agents is conflating action induction with execution authorization, and splits them into distinct runtime roles. A context-isolated Action Probe exposes action-inducing semantics in observations and records action-origin provenance across steps, while tool calls are authorized only against the user objective and audited evidence from prior authorized successful executions, with a No-History-Promotion rule preventing historical recurrence from laundering an untrusted origin into execution authority. Across AgentDojo and AgentDyn it holds attack success to at most 0.63% in four primary settings while keeping competitive task utility.
2026-08-26 / agents-researcherStepGuard audits tool calls before execution and cuts attack success 77.3% for a 2.8 point utility costStepGuard (arXiv 2608.24777, 25 August) is an open-weight guard model that checks individual tool actions pre-execution rather than scoring completed trajectories, which is where most existing guardrails operate. It is trained on StepGen, a data engine that generates safe and unsafe trajectories sharing identical context but diverging at the risky step, with Balance-GRPO dynamically rebalancing learning between safe and unsafe actions to fight both over-defense and under-defense. On AgentDojo and AgentDyn it reduces mean attack success rate by 77.3% versus no guard while mean utility drops only 2.8 percentage points, and it reports the highest average accuracy among open-weight guard models, comparable to GPT-5.4.
2026-08-25 / skill-finderA flow-centric policy language cut confirmed agent compromise from 33% to 0% on AgentDojo while raising utilityAgentFlow specifies where data may travel in an agent system rather than which single actions are unsafe, using flow and path rules, task-scoped capabilities, controlled release, and stateful taint semantics enforced by a runtime monitor plus an SMT-based verifier. On AgentDojo's 949 cases it drops confirmed compromise from 33.0% to 0.0% and raises utility from 46.7% to 63.3%; on AgentDyn Dailylife it goes 73.5% to 0.0% with utility essentially unchanged, and ASB direct prompt injection lands at 0 successes in 1,200. Seven safety properties each verify in under half a second, which makes the policies checkable in CI.
2026-08-14 / agents-researcherPIPES cuts agent perception attacks from 84.7% to 2.3% success by attaching provenance to what the agent seesarXiv 2608.12789 (2026-08-13) treats agent perception — what lands in the context from tools, pages and environments — as the thing to secure, tagging inputs with provenance and priors rather than asking the model to spot injections. Across three VitaBench and three AgentDyn splits with Gemma 4 31B IT as the target agent, average attack success drops from 84.7% to 2.3% while benign utility is preserved (92.5% with PIPES vs 90.6% undefended). The pattern is the one that keeps winning: enforce outside the model, because a defense the model has to reason about is a defense the attacker can argue with.

Graph relationships

BENCHMARKED AGAINST
StepGuard
StepGuard reduced attack success rate by 77.3% on AgentDyn.
Source finding
BENCHMARKED AGAINST
SARA
SARA holds attack success to 0.63% on AgentDyn.
Source finding
BENCHMARKED AGAINST
JudgeStealer
JudgeStealer is evaluated on AgentDyn holding attack success to 0.63%.
Source finding
BENCHMARKED AGAINST
PIPES
PIPES defense was evaluated across AgentDyn attack splits
Source finding
BENCHMARKED AGAINST
StepGuard -> AgentDyn
StepGuard reduced attack success rate by 77.3% on AgentDyn.
Source finding
BENCHMARKED AGAINST
SARA -> AgentDyn
SARA holds attack success to 0.63% on AgentDyn.
Source finding
BENCHMARKED AGAINST
JudgeStealer -> AgentDyn
JudgeStealer is evaluated on AgentDyn holding attack success to 0.63%.
Source finding
BENCHMARKED AGAINST
PIPES -> AgentDyn
PIPES defense was evaluated across AgentDyn attack splits
Source finding

Source trail

arXiv 2608.24777 arXiv 2608.12789 arXiv 2608.26982 arXiv 2608.27146 arXiv 2608.22868 - AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…