今日速览
| 序号 | 标题 | 来源 | 论文日期 | 主题 | 推荐等级 |
|---|---|---|---|---|---|
| 1 | From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails | arXiv | 2026-06-12 | Multi-Agent | 高 |
| 2 | From Chatbot to Digital Colleague: The Paradigm Shift Toward Persistent Autonomous AI | arXiv | 2026-06-12 | RAG | 中 |
重点论文与技术动态
1. From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails
- 来源：arXiv
- 论文日期：2026-06-12
- 作者/机构：Yuguang Zhou, Xunguang Wang, Pingchuan Ma, Zhantong Xue, Zhaoyu Wang, Shuai Wang
- 主题标签：
Multi-Agent,arXiv - 推荐等级：高
- 分类：cs.CR, cs.AI
一句话结论
LLM-based agent guardrails存在新型拒绝服务攻击漏洞，攻击者可诱导系统陷入无限推理循环。
一段话。
该研究揭示了LLM guardrails的推理能力导致的漏洞：攻击者注入精心设计数据使guardrail陷入长推理循环，实现系统性DoS攻击。评估显示攻击在多样架构和真实部署中有效，导致token放大13–63倍、延迟放大148倍，单个恶意文档可瘫痪共享基础设施。
核心内容
- 攻击利用guardrail的推理和任务遵循能力，注入数据触发无限推理循环，实现系统性DoS。
- 提出两种攻击框架：beam-search优化框架（生成自然语言payload）和机制感知结构突变框架（计算负载更低）。
- 评估证明攻击泛化性强，成功转移至八种主流模型（如Claude、GPT等），并导致系统级瘫痪。
方法与数据
- 方法：使用beam-search优化框架结合LLM proposer和策略库；机制感知框架基于guardrail的schema-following特性。
- 数据：standalone评估覆盖多样guardrail架构和模型；end-to-end评估在web、桌面、代码及多代理系统。
价值判断
- 值得关注：揭示LLM guardrails的可用性缺陷，凸显开发成本有界、推理鲁棒guardrails的紧迫性。
- 可复用点：攻击框架可复用于安全测试；方法可指导设计更健壮的guardrails。
- 局限/待核查：当前guardrails缺乏推理鲁棒性，需进一步研究成本有界机制。
摘要
LLM-based guardrails have emerged as a highly effective defense against prompt injection and jailbreak attacks in autonomous agents. However, we reveal that the very reasoning and task-following capabilities enabling this protection introduce a novel vulnerability: attackers can inject crafted data to trap the guardrail in extended reasoning loops, effectuating a systematic denial-of-service (DoS) attack. To systematically expose this threat, we design a beam-search optimization framework that crafts natural-language payloads to maximize guardrail reasoning length, utilizing an LLM proposer guided by a strategy bank. Based on the observation of guardrail's schema-following nature, we also provide another attack framework driven by mechanism-aware structural mutations with less computational load. The attack efficacy is systematically evaluated in two parts. First, in standalone evaluations, the attack generalizes across diverse guardrail architectures, safety templates, and agent benchmarks. Payloads optimized on a single open-source surrogate successfully transfer to eight leading model backbones (e.g., Claude, GPT, Gemini, DeepSeek, and Qwen), achieving a 13--63$\times$ token amplification. Second, in end-to-end real-world agent deployments (web, desktop, code, and multi-agent systems), the attack reveals up to a 148$\times$ latency amplification. We show that a single poisoned document can saturate shared guardrail infrastructures, effectively starving co-located agents and paralyzing the entire system. By uncovering this availability flaw, our work underscores the urgent need to develop cost-bounded, reasoning-robust guardrails.2. From Chatbot to Digital Colleague: The Paradigm Shift Toward Persistent Autonomous AI
- 来源：arXiv
- 论文日期：2026-06-12
- 作者/机构：Yongheng Zhang, Ziang Liu, Jiaxuan Zhu, Shuai Wang, Xiangqi Chen, Haojing Huang 等 20 人
- 主题标签：
RAG,arXiv - 推荐等级：中
- 分类：cs.AI
一句话结论
大型语言模型正从对话生成器向具备推理、行动、记忆和自我改进能力的集成AI系统转变，实现从对话回答到持久工作的范式跃迁。
核心内容
- 认知核心层面：LLMs从Chatbot时代“快思考”（基于下一个词预测）转向“思考型LLM”，利用推理时计算、思维链、反思、过程监督和强化学习支持更审慎可靠的认知。
- 工具执行层面：LLMs从工具调用代理转向OpenClaw式工作站系统，配备持久工作区、技能、验证循环和治理机制。
- “工作区+技能”范式通过状态持久化、可重用流程、任务闭合和经验复用，使工具使用呈现同事式特征。
方法与数据
- 数据构建从指令-响应对转向状态-动作-观察轨迹。
- 评估体系从静态基准转向沙盒化、可审计、自演化的AI生态系统。
价值判断
- 值得关注：LLMs向持久自主AI的范式转变，强调认知与执行的双重进化。
- 可复用点：“工作区+技能”框架可直接应用于构建持久AI协作系统。
- 局限/待核查：摘要未明确具体局限。