A summary of attacks and defenses for agents
| Attack/Defense | Method | Year | Category | Subcategory | Access to LLMs | Dataset |
|---|---|---|---|---|---|---|
| I Indirect Prompt Injection: Malicious Instruction and Jailbreak | ||||||
| Greshake et al. (2023) | 2023 | Indirect Prompt Injection | Prompt Injection | Black-Box | Custom (webpage injections) | |
| Wu et al. (2024c) | 2024 | Indirect Prompt Injection | Prompt Injection | Black-Box | Custom (website prompts) | |
| TensorTrust (Toyer et al., 2023) | 2023 | Indirect Prompt Injection | Prompt Injection | Black-Box | Submissions Dataset | |
| Perez and Ribeiro (2022) | 2022 | Indirect Prompt Injection | Prompt Injection | Black-Box | OpenAI Examples | |
| Attack | HOUYI (Liu et al., 2023e) | 2023 | Indirect Prompt Injection | Prompt Injection | Black-Box | Custom (multilingual prompts) |
| Pedro et al. (2023) | 2023 | Indirect Prompt Injection | Prompt Injection | Black-Box | Custom (Langchain apps) | |
| Zhan et al. (2025) | 2025 | Indirect Prompt Injection | Jailbreak | White-Box | Custom (tool outputs) | |
| PANDORA (Deng et al., 2024b) | 2024 | Indirect Prompt Injection | Jailbreak | Black-Box | Custom (document embeddings) | |
| Imprompter (Fu et al., 2024a) | 2024 | Indirect Prompt Injection | Jailbreak | White-Box | Custom (LeChat, ChatGLM) | |
| Instruction Hierarchy (Wallace et al., 2024) | 2024 | IPI Defense | Privilege Management | White-Box | Custom (message privilege levels) | |
| Instruction Detection (Wen et al., 2025a) | 2025 | IPI Defense | Detection | White-Box | PEEP Dataset | |
| Defense | Instruction Detection and Removal (Chen et al., 2025d) | 2025 | IPI Defense | Detection | White-Box | Crafted datasets |
| Task Shield (Jia et al., 2024a) | 2024 | IPI Defense | Detection | White-Box | AgentDojo | |
| FATH (Wang et al., 2024g) | 2024 | IPI Defense | Authentication | Black-Box | Custom (response tagging) | |
| Spotlighting (Hines et al., 2024) | 2024 | IPI Defense | Prompt Engineering | Black-Box | Custom (provenance marking) | |
| Design Pattern (Beurer-Kellner et al., 2025) | 2025 | IPI Defense | Secure Design | Black-Box | Custom (factory floor) | |
| II Component-Level: Short-Term Memory, Long-Term Memory, Tool Integration and MCP Server | ||||||
| Contextual Backdoor (Liu et al., 2024a) | 2024 | Memory Attack | Backdoor | Black-Box | AgentBench, WebShop | |
| Watch out for your agents (Yang et al., 2024h) | 2024 | Memory Attack | Backdoor | Black-Box | LLM-based agents | |
| DemonAgent (Zhu et al., 2025) | 2025 | Memory Attack | Backdoor | White-Box | AgentBench, WebArena | |
| Attack | BadAgent (Wang et al., 2024q) | 2024 | Memory Attack | Backdoor | White-Box | AgentInstruct, Mind2Web |
| AgentPoison (Chen et al., 2024d) | 2024 | Memory Attack | Backdoor | Black-Box | HotpotQA, AgentBench | |
| TrojanRAG (Pan et al., 2024) | 2023 | Memory Attack | Backdoor | White-Box | NQ, HotpotQA | |
| BadRAG (Xue et al., 2024a) | 2024 | Memory Attack | Backdoor | White-Box | NQ, TriviaQA | |
| Phantom (Chaudhari et al., 2024) | 2024 | Memory Attack | Backdoor | White-Box | NQ, TriviaQA, SQuAD | |
| BreakingAgent (Zhang et al., 2024a) | 2024 | Memory Attack | Prompt Injection | Black-Box | Custom (Gmail agents) | |
| Attack | MINJA (Dong et al., 2025b) | 2025 | Memory Attack | Prompt Injection | Black-Box | Webshop, MIMIC-III, eICU, MMLU |
| PoisonedRAG (Zou et al., 2024b) | 2024 | Memory Attack | Knowledge Poisoning | Black-Box | NQ, HotpotQA, MS-MARCO | |
| Corpus Poisoning (Zhong et al., 2023) | 2023 | Memory Attack | Knowledge Poisoning | White-Box | Natural Questions, MS-MARCO | |
| Context Extension (Luo et al., 2023; Geng et al., 2024) | 2023 | Memory Defense | Context Extension | Black-Box | Custom (long context benchmarks) | |
| Prompt Leakage Defense (Agarwal et al., 2024) | 2024 | Memory Defense | Detection | Black-Box | Multi-turn (4 domains) | |
| Defense | AgentSafe (Mao et al., 2025) | 2025 | Memory Defense | Secure Design | White-Box | Custom (multi-agent tasks) |
| TrustRAG (Zhou et al., 2025b) | 2025 | Memory Defense | Detection | White-Box | Custom (RAG datasets) | |
| Astute RAG (Wang et al., 2024a) | 2024 | Memory Defense | Detection | Black-Box | SQuAD 2.0 | |
| RobustRAG (Xiang et al., 2024a) | 2024 | Memory Defense | Secure Design | White-Box | Custom (RAG datasets) | |
| UDora (Zhang et al., 2025e) | 2025 | Tool Manipulation | Jailbreak | White-Box | AgentHarm | |
| ToolSword (Ye et al., 2024a) | 2024 | Tool Manipulation | Red Teaming | Black-Box | ToolBench, AgentBench | |
| ToolCommander (Wang et al., 2024f) | 2024 | Tool Manipulation | Adversarial Attack | Black-Box | ToolBench | |
| WIPI (Wu et al., 2024b) | 2024 | Tool Manipulation | Prompt Injection | Black-Box | ChatGPT Web Agents, Web GPTs | |
| AutoCMD (Jiang et al., 2025) | 2025 | Tool Manipulation | Adversarial Attack | Black-Box | LangChain, KwaiAgents, QwenAgent | |
| MPMA (Wang et al., 2025h) | 2025 | MCP Manipulation | Adversarial Attack | White-Box | Custom (MCP servers) | |
| Attack | Ferrag et al. (2025) | 2025 | MCP Manipulation | Adversarial Attack | Black-Box | CIAQA, AgentBackdoorEval, etc. |
| Kong et al. (2025) | 2025 | MCP Manipulation | Red Teaming | Grey-Box | Custom (Claude, Filesystem, Chroma, Gmail) | |
| AgentGuard (Chen and Cong, 2025) | 2025 | Tool & MCP Defense | Red Teaming | White-Box | Custom (tool orchestration) | |
| Defense | PrivacyAsst (Zhang et al., 2024t) | 2024 | Tool & MCP Defense | Secure Design | Black-Box | Custom (tool-using agents) |
| MCIP (Jing et al., 2025) | 2025 | Tool & MCP Defense | Maclious Detection | White-Box | Custom (MCIP-Bench) | |
| GuardAgent (Xiang et al., 2024c) | 2024 | Tool & MCP Defense | Secure Design | Black-Box | EICU-AC, Mind2Web-SC | |
| Adversarial Multimodal Injection (Bagdasaryan et al., 2023b) | 2023 | VLM Attack | Prompt Injection | White-Box | Custom (perturbed media) | |
| Zhang (2024) | 2024 | VLM Attack | Prompt Injection | Black-Box | OSWorld, VisualWebArena | |
| Wu et al. (2024a) | 2024 | VLM Attack | Prompt Injection | Black-Box | VisualWebArena | |
| Fu et al. (2023b) | 2023 | VLM Attack | Adversarial Attack | White-Box | Custom (VLM + tool calls) | |
| EIA (Liao et al., 2024) | 2024 | VLM Attack | Prompt Injection | Black-Box | Mind2Web | |
| AdvAgent (Xu et al., 2024) | 2024 | VLM Attack | Red Teaming | Black-Box | Custom (web tasks) | |
| Ma et al. (2024c) | 2024 | VLM Attack | Adversarial Attack | Black-Box | Custom (simulated GUI) | |
| Attack | Fine-Print Injections (Chen et al., 2025a) | 2025 | VLM Attack | Prompt Injection | Black-Box | Custom (234 adversarial webpages) |
| SmoothVLM (Xu et al., 2024c) | 2024 | VLM Defense | Detection | White-Box | Custom (adversarial datasets) | |
| BlueSuffix (Li et al., 2024g) | 2024 | VLM Defense | Detection | Black-Box | Custom (VLM benchmarks) | |
| LlavaGuard (Helff et al., 2024) | 2024 | VLM Defense | Detection | White-Box | Custom (multimodal safety) | |
| Defense | JailDAM (Chen et al., 2024a) | 2024 | VLM Defense | Detection | Black-Box | Custom (jailbreak detection) |
| III System-Level: Multi-Agent System and Embodied Agent | ||||||
| Prompt Infection (Lee and Tiwari, 2024) | 2024 | Multi-Agent Attack | Prompt Injection | Black-Box | Custom (interconnected ecosystems) | |
| Morris-II (Cohen et al., 2024) | 2024 | Multi-Agent Attack | Prompt Injection | Black-Box | Custom (GenAI apps) | |
| Ju et al. (2024) | 2024 | Multi-Agent Attack | Prompt Injection | White-Box | Custom (multi-agent communities) | |
| AgentSmith (Gu et al., 2024) | 2024 | Multi-Agent Attack | Jailbreak | Mixed | Custom (multimodal agents) | |
| CORBA (Zhou et al., 2025e) | 2025 | Multi-Agent Attack | Communication Attack | Mixed | AutoGen, Camel (various topologies) | |
| Agent-in-the-Middle (He et al., 2025) | 2025 | Multi-Agent Attack | Communication Attack | Black-Box | AutoGen, MetaGPT, ChatDev | |
| Evil Geniuses (Tian et al., 2023) | 2023 | Multi-Agent Attack | Jailbreak | Black-Box | CAMEL, MetaGPT, ChatDev | |
| The Wolf Within (Tan et al., 2024) | 2024 | Multi-Agent Attack | Infection Attack | Black-Box | MLLM societies | |
| Attack | X-Teaming (Rahman et al., 2025) | 2025 | Multi-Agent Attack | Jailbreak | White-Box | HarmBench |
| AutoDefense (Zeng et al., 2024c) | 2024 | Multi-Agent Defense | Detection | Black-Box | Curated harmful prompts, DAN, Stanford Alpaca | |
| PsySafe (Zhang et al., 2024w) | 2024 | Multi-Agent Defense | Framework | Black-Box | Custom (Camel, AutoGen) | |
| APOSG Framework (Standen et al., 2025) | 2025 | Multi-Agent Defense | Framework | White-Box | Custom (DPA, RADE) | |
| LLAMOS (Lin et al., 2024a) | 2024 | Multi-Agent Defense | Detection | Black-Box | GLUE datasets | |
| Audit-LLM (Song et al., 2024a) | 2024 | Multi-Agent Defense | Detection | Black-Box | CERT r4.2, CERT r5.2, PicoDomain | |
| Defense | XGuard-Train (Rahman et al., 2025) | 2025 | Multi-Agent Defense | Training | Black-Box | Custom (30K jailbreaks) |
| PVEP (Cheng et al., 2024a) | 2024 | Embodied Agent Attack | Adversarial Attack | Mixed | VIMA | |
| Fime et al. (2025) | 2025 | Embodied Agent Attack | Adversarial Attack | White-Box | Custom | |
| Wang et al. (2025d) | 2025 | Embodied Agent Attack | Adversarial Attack | Mixed | BridgeData V2, LIBERO | |
| RoboPair (Robey et al., 2024b) | 2024 | Embodied Agent Attack | Jailbreak | Mixed | Custom | |
| BadRobot (Zhang et al., 2025c) | 2025 | Embodied Agent Attack | Jailbreak | Black-Box | Code as Policies, ProgPrompt, VoxPoser, VisProg | |
| POEX (Lu et al., 2025) | 2025 | Embodied Agent Attack | Jailbreak | Mixed | Harmful-RLBench | |
| Liu et al. (2024b) | 2024 | Embodied Agent Attack | Backdoor | Black-Box | ProgPrompt, VoxPoser, VisProg | |
| BALD (Jiao et al., 2025) | 2025 | Embodied Agent Attack | Backdoor | Mixed | ProgPrompt, VoxPoser, VisProg | |
| EAI (Li et al., 2024l) | 2024 | Embodied Agent Attack | Red Teaming | Black-Box | VirtualHome, BEHAVIOR | |
| HASARD (Tomilin et al., 2025) | 2025 | Embodied Agent Attack | Red Teaming | - | Custom | |
| HEAL (Chakraborty et al., 2025) | 2025 | Embodied Agent Attack | Red Teaming | Black-Box | VirtualHome, BEHAVIOR | |
| ERT (Karnik et al., 2025) | 2025 | Embodied Agent Attack | Red Teaming | Black-Box | Calbin, RLBench | |
| Attack | X-ICM (Zhou et al., 2025c) | 2025 | Embodied Agent Attack | Red Teaming | Black-Box | AGNOSTOS |
| EAD (Wu et al., 2024f) | 2024 | Embodied Agent Defense | Detection | Black-Box | Custom | |
| GPSR (Shirasaka et al., 2024) | 2024 | Embodied Agent Defense | Framework | Black-Box | EAsafetyBench, SafeAgentBench | |
| Pinpoint (Wang et al., 2025b) | 2025 | Embodied Agent Defense | Detection | White-Box | EAsafetyBench, SafeAgentBench | |
| Defense | SafeVLA (Zhang et al., 2025a) | 2025 | Embodied Agent Defense | Training | White-Box | Safety-CHORES |
| IV Agentic Attack & Defenses | ||||||
| Fang et al. (2024b) | 2024 | Agentic Attack | Exploitation | Gray-Box | Custom (CVE vulnerability) | |
| HPTSA (Zhu et al., 2024c) | 2024 | Agentic Attack | Exploitation | Black-Box | Custom (zero-day vulnerability) | |
| AutoAdvExBench (Carlini et al., 2025) | 2025 | Agentic Attack | Defense Exploitation | Mixed | Custom (defense papers) | |
| RedAgent (Xu et al., 2024a) | 2024 | Agentic Attack | Jailbreaking | Black-Box | GPT Applications, HarmBench | |
| ALI-Agent (Wang et al., 2024c) | 2024 | Agentic Attack | Safety Evaluation | Black-Box | Custom (alignment scenarios) | |
| Attack | AutoRedTeamer (Zhou et al., 2025a) | 2025 | Agentic Attack | Red Teaming | Mixed | HarmBench, Custom benchmarks |
| Shieldagent (Chen et al., 2025e) | 2025 | Agentic Defense | Framework | Black-Box | Custom (multi-agent interactions) | |
| TrustAgent (Yang et al., 2024b) | 2024 | Agentic Defense | Framework | Black-Box | Custom (multi-domain tasks) | |
| Defense | AegisLLM (Cai, 2025) | 2025 | Agentic Defense | Framework | Black-Box | WMDP, StrongReject |
| Attack/Defense | Method | Year | Category | Subcategory | Access to LLMs | Dataset |
|---|---|---|---|---|---|---|
| 2023 | Indirect Prompt Injection | Prompt Injection | Black-Box | Custom (webpage injections) | ||
| 2024 | Indirect Prompt Injection | Prompt Injection | Black-Box | Custom (website prompts) | ||
| TensorTrust ( | 2023 | Indirect Prompt Injection | Prompt Injection | Black-Box | Submissions Dataset | |
| 2022 | Indirect Prompt Injection | Prompt Injection | Black-Box | OpenAI Examples | ||
| Attack | 2023 | Indirect Prompt Injection | Prompt Injection | Black-Box | Custom (multilingual prompts) | |
| 2023 | Indirect Prompt Injection | Prompt Injection | Black-Box | Custom (Langchain apps) | ||
| 2025 | Indirect Prompt Injection | Jailbreak | White-Box | Custom (tool outputs) | ||
| PANDORA ( | 2024 | Indirect Prompt Injection | Jailbreak | Black-Box | Custom (document embeddings) | |
| Imprompter ( | 2024 | Indirect Prompt Injection | Jailbreak | White-Box | Custom (LeChat, ChatGLM) | |
| Instruction Hierarchy ( | 2024 | Privilege Management | White-Box | Custom (message privilege levels) | ||
| Instruction Detection ( | 2025 | Detection | White-Box | |||
| Defense | Instruction Detection and Removal ( | 2025 | Detection | White-Box | Crafted datasets | |
| Task Shield ( | 2024 | Detection | White-Box | AgentDojo | ||
| 2024 | Authentication | Black-Box | Custom (response tagging) | |||
| Spotlighting ( | 2024 | Prompt Engineering | Black-Box | Custom (provenance marking) | ||
| Design Pattern ( | 2025 | Secure Design | Black-Box | Custom (factory floor) | ||
| Contextual Backdoor ( | 2024 | Memory Attack | Backdoor | Black-Box | AgentBench, WebShop | |
| Watch out for your agents ( | 2024 | Memory Attack | Backdoor | Black-Box | LLM-based agents | |
| DemonAgent ( | 2025 | Memory Attack | Backdoor | White-Box | AgentBench, WebArena | |
| Attack | BadAgent ( | 2024 | Memory Attack | Backdoor | White-Box | AgentInstruct, Mind2Web |
| AgentPoison ( | 2024 | Memory Attack | Backdoor | Black-Box | HotpotQA, AgentBench | |
| TrojanRAG ( | 2023 | Memory Attack | Backdoor | White-Box | NQ, HotpotQA | |
| BadRAG ( | 2024 | Memory Attack | Backdoor | White-Box | NQ, TriviaQA | |
| Phantom ( | 2024 | Memory Attack | Backdoor | White-Box | NQ, TriviaQA, SQuAD | |
| BreakingAgent ( | 2024 | Memory Attack | Prompt Injection | Black-Box | Custom (Gmail agents) | |
| Attack | 2025 | Memory Attack | Prompt Injection | Black-Box | Webshop, MIMIC-III, eICU, | |
| PoisonedRAG ( | 2024 | Memory Attack | Knowledge Poisoning | Black-Box | NQ, HotpotQA, MS-MARCO | |
| Corpus Poisoning ( | 2023 | Memory Attack | Knowledge Poisoning | White-Box | Natural Questions, MS-MARCO | |
| Context Extension ( | 2023 | Memory Defense | Context Extension | Black-Box | Custom (long context benchmarks) | |
| Prompt Leakage Defense ( | 2024 | Memory Defense | Detection | Black-Box | Multi-turn (4 domains) | |
| Defense | AgentSafe ( | 2025 | Memory Defense | Secure Design | White-Box | Custom (multi-agent tasks) |
| TrustRAG ( | 2025 | Memory Defense | Detection | White-Box | Custom ( | |
| Astute | 2024 | Memory Defense | Detection | Black-Box | SQuAD 2.0 | |
| RobustRAG ( | 2024 | Memory Defense | Secure Design | White-Box | Custom ( | |
| UDora ( | 2025 | Tool Manipulation | Jailbreak | White-Box | AgentHarm | |
| ToolSword ( | 2024 | Tool Manipulation | Red Teaming | Black-Box | ToolBench, AgentBench | |
| ToolCommander ( | 2024 | Tool Manipulation | Adversarial Attack | Black-Box | ToolBench | |
| 2024 | Tool Manipulation | Prompt Injection | Black-Box | ChatGPT Web Agents, Web GPTs | ||
| AutoCMD ( | 2025 | Tool Manipulation | Adversarial Attack | Black-Box | LangChain, KwaiAgents, QwenAgent | |
| 2025 | Adversarial Attack | White-Box | Custom ( | |||
| Attack | 2025 | Adversarial Attack | Black-Box | CIAQA, AgentBackdoorEval, etc. | ||
| 2025 | Red Teaming | Grey-Box | Custom (Claude, Filesystem, Chroma, Gmail) | |||
| AgentGuard ( | 2025 | Tool & | Red Teaming | White-Box | Custom (tool orchestration) | |
| Defense | PrivacyAsst ( | 2024 | Tool & | Secure Design | Black-Box | Custom (tool-using agents) |
| 2025 | Tool & | Maclious Detection | White-Box | Custom (MCIP-Bench) | ||
| GuardAgent ( | 2024 | Tool & | Secure Design | Black-Box | EICU-AC, Mind2Web-SC | |
| Adversarial Multimodal Injection ( | 2023 | Prompt Injection | White-Box | Custom (perturbed media) | ||
| 2024 | Prompt Injection | Black-Box | OSWorld, VisualWebArena | |||
| 2024 | Prompt Injection | Black-Box | VisualWebArena | |||
| 2023 | Adversarial Attack | White-Box | Custom ( | |||
| 2024 | Prompt Injection | Black-Box | Mind2Web | |||
| AdvAgent ( | 2024 | Red Teaming | Black-Box | Custom (web tasks) | ||
| 2024 | Adversarial Attack | Black-Box | Custom (simulated | |||
| Attack | Fine-Print Injections ( | 2025 | Prompt Injection | Black-Box | Custom (234 adversarial webpages) | |
| SmoothVLM ( | 2024 | Detection | White-Box | Custom (adversarial datasets) | ||
| BlueSuffix ( | 2024 | Detection | Black-Box | Custom ( | ||
| LlavaGuard ( | 2024 | Detection | White-Box | Custom (multimodal safety) | ||
| Defense | JailDAM ( | 2024 | Detection | Black-Box | Custom (jailbreak detection) | |
| Prompt Infection ( | 2024 | Multi-Agent Attack | Prompt Injection | Black-Box | Custom (interconnected ecosystems) | |
| Morris-II ( | 2024 | Multi-Agent Attack | Prompt Injection | Black-Box | Custom (GenAI apps) | |
| 2024 | Multi-Agent Attack | Prompt Injection | White-Box | Custom (multi-agent communities) | ||
| AgentSmith ( | 2024 | Multi-Agent Attack | Jailbreak | Mixed | Custom (multimodal agents) | |
| 2025 | Multi-Agent Attack | Communication Attack | Mixed | AutoGen, Camel (various topologies) | ||
| Agent-in-the-Middle ( | 2025 | Multi-Agent Attack | Communication Attack | Black-Box | AutoGen, MetaGPT, ChatDev | |
| Evil Geniuses ( | 2023 | Multi-Agent Attack | Jailbreak | Black-Box | CAMEL, MetaGPT, ChatDev | |
| The Wolf Within ( | 2024 | Multi-Agent Attack | Infection Attack | Black-Box | ||
| Attack | X-Teaming ( | 2025 | Multi-Agent Attack | Jailbreak | White-Box | HarmBench |
| AutoDefense ( | 2024 | Multi-Agent Defense | Detection | Black-Box | Curated harmful prompts, DAN, Stanford Alpaca | |
| PsySafe ( | 2024 | Multi-Agent Defense | Framework | Black-Box | Custom (Camel, AutoGen) | |
| 2025 | Multi-Agent Defense | Framework | White-Box | Custom (DPA, | ||
| 2024 | Multi-Agent Defense | Detection | Black-Box | |||
| Audit-LLM ( | 2024 | Multi-Agent Defense | Detection | Black-Box | ||
| Defense | XGuard-Train ( | 2025 | Multi-Agent Defense | Training | Black-Box | Custom (30K jailbreaks) |
| 2024 | Embodied Agent Attack | Adversarial Attack | Mixed | |||
| 2025 | Embodied Agent Attack | Adversarial Attack | White-Box | Custom | ||
| 2025 | Embodied Agent Attack | Adversarial Attack | Mixed | BridgeData V2, | ||
| RoboPair ( | 2024 | Embodied Agent Attack | Jailbreak | Mixed | Custom | |
| BadRobot ( | 2025 | Embodied Agent Attack | Jailbreak | Black-Box | Code as Policies, ProgPrompt, VoxPoser, VisProg | |
| 2025 | Embodied Agent Attack | Jailbreak | Mixed | Harmful-RLBench | ||
| 2024 | Embodied Agent Attack | Backdoor | Black-Box | ProgPrompt, VoxPoser, VisProg | ||
| 2025 | Embodied Agent Attack | Backdoor | Mixed | ProgPrompt, VoxPoser, VisProg | ||
| 2024 | Embodied Agent Attack | Red Teaming | Black-Box | VirtualHome, BEHAVIOR | ||
| 2025 | Embodied Agent Attack | Red Teaming | - | Custom | ||
| 2025 | Embodied Agent Attack | Red Teaming | Black-Box | VirtualHome, BEHAVIOR | ||
| 2025 | Embodied Agent Attack | Red Teaming | Black-Box | Calbin, RLBench | ||
| Attack | X-ICM ( | 2025 | Embodied Agent Attack | Red Teaming | Black-Box | AGNOSTOS |
| 2024 | Embodied Agent Defense | Detection | Black-Box | Custom | ||
| 2024 | Embodied Agent Defense | Framework | Black-Box | EAsafetyBench, SafeAgentBench | ||
| Pinpoint ( | 2025 | Embodied Agent Defense | Detection | White-Box | EAsafetyBench, SafeAgentBench | |
| Defense | SafeVLA ( | 2025 | Embodied Agent Defense | Training | White-Box | Safety-CHORES |
| 2024 | Agentic Attack | Exploitation | Gray-Box | Custom ( | ||
| 2024 | Agentic Attack | Exploitation | Black-Box | Custom (zero-day vulnerability) | ||
| AutoAdvExBench ( | 2025 | Agentic Attack | Defense Exploitation | Mixed | Custom (defense papers) | |
| RedAgent ( | 2024 | Agentic Attack | Jailbreaking | Black-Box | ||
| ALI-Agent ( | 2024 | Agentic Attack | Safety Evaluation | Black-Box | Custom (alignment scenarios) | |
| Attack | AutoRedTeamer ( | 2025 | Agentic Attack | Red Teaming | Mixed | HarmBench, Custom benchmarks |
| Shieldagent ( | 2025 | Agentic Defense | Framework | Black-Box | Custom (multi-agent interactions) | |
| TrustAgent ( | 2024 | Agentic Defense | Framework | Black-Box | Custom (multi-domain tasks) | |
| Defense | AegisLLM ( | 2025 | Agentic Defense | Framework | Black-Box | WMDP, StrongReject |
Sharing content requires targeting cookies to be enabled. Please update your cookie preferences to use this feature.