{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T12:43:16Z","timestamp":1784292196407,"version":"3.55.0"},"reference-count":213,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["62302387"],"award-info":[{"award-number":["62302387"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["U22A2029"],"award-info":[{"award-number":["U22A2029"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["U24A20237"],"award-info":[{"award-number":["U24A20237"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["U23A20276"],"award-info":[{"award-number":["U23A20276"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["62402379"],"award-info":[{"award-number":["62402379"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/comst.2025.3576176","type":"journal-article","created":{"date-parts":[[2025,6,3]],"date-time":"2025-06-03T13:55:09Z","timestamp":1748958909000},"page":"1906-1949","source":"Crossref","is-referenced-by-count":49,"title":["Large Model-Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trends"],"prefix":"10.1109","volume":"28","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3810-7076","authenticated-orcid":false,"given":"Yuntao","family":"Wang","sequence":"first","affiliation":[{"name":"School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1485-058X","authenticated-orcid":false,"given":"Yanghe","family":"Pan","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6518-3130","authenticated-orcid":false,"given":"Zhou","family":"Su","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yi","family":"Deng","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-6149-2401","authenticated-orcid":false,"given":"Quan","family":"Zhao","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Linkang","family":"Du","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5215-7443","authenticated-orcid":false,"given":"Tom H.","family":"Luan","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8218-3490","authenticated-orcid":false,"given":"Jiawen","family":"Kang","sequence":"additional","affiliation":[{"name":"School of Automation, Guangdong University of Technology, Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7442-7416","authenticated-orcid":false,"given":"Dusit","family":"Niyato","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Practices for governing agentic AI systems","author":"Shavit","year":"2023"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-024-4222-0"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1023\/A:1015008417172"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1038\/nature24270"},{"key":"ref5","first-page":"1","article-title":"BALROG: Benchmarking agentic LLM and VLM reasoning on games","volume-title":"Proc. ICLR","author":"Paglieri"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00280"},{"key":"ref7","article-title":"Exploring large language model based intelligent agents: Definitions, methods, and prospects","author":"Cheng","year":"2024","journal-title":"arXiv:2401.03428"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.57020\/ject.1297961"},{"key":"ref9","first-page":"1","article-title":"AutoGen: Enabling next-gen LLM applications via multi-agent conversation","volume-title":"Proc. COLM","author":"Wu"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-emnlp.270"},{"key":"ref11","first-page":"1","article-title":"Do as I can, not as I say: Grounding language in robotic affordances","volume-title":"Proc. Annu. Conf. Robot Learn. (CoRL)","author":"Ahn"},{"key":"ref12","article-title":"WebGPT: Browser-assisted question-answering with human feedback","author":"Nakano","year":"2022","journal-title":"arXiv:2112.09332"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.52202\/079017-0088"},{"key":"ref14","article-title":"A survey on large language model-based game agents","author":"Hu","year":"2024","journal-title":"arXiv:2404.02039"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/IROS58592.2024.10802229"},{"key":"ref16","first-page":"847","article-title":"PentestGPT: Evaluating and harnessing large language models for automated penetration testing","volume-title":"Proc. USENIX Security","author":"Deng"},{"key":"ref17","article-title":"Autonomous AI and autonomous agents market.","year":"2023"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/MWC.016.2300600"},{"key":"ref19","volume-title":"Agora protocol: Scalable and reliable communication between your agents","author":"Marro","year":"2025"},{"key":"ref20","first-page":"20299","article-title":"VPGTrans: Transfer visual prompt generator across LLMs","volume-title":"Proc. NeurIPS","volume":"36","author":"Zhang"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00704"},{"key":"ref22","first-page":"21702","article-title":"LLM-pruner: On the structural pruning of large language models","volume-title":"Proc. NeurIPS","volume":"36","author":"Ma"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i17.29860"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/MWC.005.2400019"},{"issue":"120","key":"ref25","first-page":"1","article-title":"Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity","volume":"23","author":"Fedus","year":"2022","journal-title":"J. Mach. Learn. Res."},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.eacl-main.77"},{"key":"ref27","first-page":"1","article-title":"PoisonedRAG: Knowledge poisoning attacks to retrieval-augmented generation of large language models","volume-title":"Proc. USENIX","author":"Zou"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3703155"},{"key":"ref29","first-page":"1","article-title":"Quantifying Memorization across neural language models","volume-title":"Proc. ICLR","author":"Carlini"},{"key":"ref30","article-title":"Prompt injection attack against LLM-integrated applications","author":"Liu","year":"2023","journal-title":"arXiv:2306.05499"},{"key":"ref31","first-page":"1605","article-title":"Local model poisoning attacks to Byzantine-robust federated learning","volume-title":"Proc. USENIX","author":"Fang"},{"key":"ref32","first-page":"1","article-title":"Universal jailbreak backdoors from poisoned human feedback","volume-title":"Proc. ICLR","author":"Rando"},{"key":"ref33","first-page":"2633","article-title":"Extracting training data from large language models","volume-title":"Proc. USENIX","author":"Carlini"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.423"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-024-40231-1"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2024.3353265"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2024\/890"},{"key":"ref38","article-title":"Agent AI: Surveying the horizons of multimodal interaction","author":"Durante","year":"2024","journal-title":"arXiv:2401.03568"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2025.3527641"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1016\/j.hcc.2024.100211"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/OJCOMS.2024.3456549"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3712001"},{"key":"ref43","article-title":"AIOS: LLM agent operating system","author":"Mei","year":"2024","journal-title":"arXiv:2403.16971"},{"key":"ref44","first-page":"24824","article-title":"Chain-of-thought prompting elicits reasoning in large language models","volume-title":"Proc. NeurIPS","volume":"35","author":"Wei"},{"key":"ref45","first-page":"1","article-title":"Tree of thoughts: Deliberate problem solving with large language models","volume-title":"Proc. NeurIPS","author":"Yao"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i16.29720"},{"key":"ref47","first-page":"1","article-title":"ReAct: Synergizing reasoning and acting in language models","volume-title":"Proc. ICLR","author":"Yao"},{"key":"ref48","first-page":"8634","article-title":"Reflexion: Language agents with verbal reinforcement learning","volume-title":"Proc. NeurIPS","author":"Shinn"},{"key":"ref49","first-page":"1","article-title":"Voyager: An open-ended embodied agent with large language models","volume-title":"Proc. Trans. Mach. Learn. Res.","author":"Wang"},{"key":"ref50","first-page":"867","article-title":"AVIS: Autonomous visual information seeking with large language model agent","volume-title":"Proc. NeurIPS","author":"Hu"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.15"},{"key":"ref52","first-page":"1","article-title":"Describe, explain, plan and select: Interactive planning with LLMs enables open-world multi-task agents","volume-title":"Proc. NeurIPS","author":"Wang"},{"key":"ref53","first-page":"9459","article-title":"Retrieval-augmented generation for knowledge-intensive NLP tasks","volume":"33","author":"Lewis","year":"2020","journal-title":"Proc. NeurIPS"},{"key":"ref54","first-page":"1","article-title":"Knowledge-augmented reasoning distillation for small language models in knowledge-intensive tasks","volume-title":"Proc. NeurIPS","volume":"36","author":"Kang"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.557"},{"key":"ref56","article-title":"From LLM to conversational agent: A memory enhanced architecture with fine-tuning of large language models","author":"Liu","year":"2024","journal-title":"arXiv:2401.02777"},{"key":"ref57","first-page":"9118","article-title":"Language models as zero-shot planners: Extracting actionable knowledge for embodied agents","volume-title":"Proc. ICML","author":"Huang"},{"key":"ref58","first-page":"8469","article-title":"PaLM-E: An embodied multimodal language model","volume-title":"Proc. ICML","volume":"202","author":"Driess"},{"key":"ref59","article-title":"Multi-agent collaboration: Harnessing the power of intelligent LLM agents","author":"Talebirad","year":"2023","journal-title":"arXiv:2306.03314"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.810"},{"key":"ref61","first-page":"1","article-title":"MetaGPT: Meta programming for a multi-agent collaborative framework","volume-title":"Proc. ICLR","author":"Hong"},{"key":"ref62","volume-title":"Unitree G1","year":"2025"},{"key":"ref63","volume-title":"Figure 02 humanoid robot","year":"2025"},{"key":"ref64","volume-title":"Baidu Apollo launches Apollo ADFM large model","year":"2025"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.13"},{"key":"ref66","article-title":"CGMI: Configurable general multi-agent interaction framework","author":"Jinxin","year":"2023","journal-title":"arXiv:2308.12503"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671620"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3651890.3672268"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2024.3376419"},{"key":"ref70","article-title":"AutoAttacker: A large language model guided system to implement automatic cyber-attacks","author":"Xu","year":"2024","journal-title":"arXiv:2403.01038"},{"key":"ref71","article-title":"DeepSeek-R1: Incentivizing reasoning capability in LLMs via reinforcement learning","author":"Guo","year":"2025","journal-title":"arXiv:2501.12948"},{"key":"ref72","volume-title":"AgenticFlow AI","year":"2025"},{"key":"ref73","volume-title":"Dify.AI","year":"2025"},{"key":"ref74","volume-title":"RAGFlow","year":"2025"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2024.3435752"},{"key":"ref76","article-title":"LLM agents can autonomously exploit one-day vulnerabilities","author":"Fang","year":"2024","journal-title":"arXiv:2404.08144"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00605"},{"key":"ref78","first-page":"1","article-title":"ToolkenGPT: Augmenting frozen language models with massive tools via tool embeddings","volume-title":"Proc. NeurIPS","author":"Hao"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.691"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/IROS58592.2024.10801334"},{"key":"ref81","first-page":"1","article-title":"Knowledge fusion of large language models","volume-title":"Proc. ICLR","author":"Wan"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/TIV.2024.3396450"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2023.3263909"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i13.26928"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2011.64"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i16.29710"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/mnet.2024.3442880"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.02137"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2024.3516819"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1145\/1293731.1293735"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1145\/191246.191322"},{"key":"ref92","volume-title":"Model context protocol (MCP)","year":"2024"},{"key":"ref93","volume-title":"Agent network protocol (ANP)","year":"2024"},{"key":"ref94","article-title":"5G system (5GS); study on traffic characteristics and performance requirements for AI\/ML model transfer, version 18.2.0","year":"2021"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1186\/s43058-022-00380-5"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/tmc.2025.3546466"},{"key":"ref97","first-page":"1","article-title":"CAMEL: Communicative agents for \u2018mind\u2019 exploration of large language model society","volume-title":"Proc. NeurIPS","author":"Li"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1145\/3586183.3606763"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS60910.2024.00013"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.363"},{"key":"ref101","first-page":"1","article-title":"ChatEval: Towards better LLM-based evaluators through multi-agent debate","volume-title":"Proc. ICLR","author":"Chan"},{"key":"ref102","article-title":"Cached model-as-a-resource: Provisioning large language model agents for edge intelligence in space-air-ground integrated networks","author":"Xu","year":"2024","journal-title":"arXiv:2403.05826"},{"key":"ref103","first-page":"1","article-title":"A dynamic LLM-powered agent network for task-oriented agent collaboration","volume-title":"Proc. Conf. Lang. Model. (COLM)","author":"Liu"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/OJCS.2023.3300321"},{"key":"ref105","first-page":"1","article-title":"Parameter-efficient fine-tuning for large models: A comprehensive survey","author":"Han","year":"2024","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref106","first-page":"1877","article-title":"Language models are few-shot learners","volume-title":"Proc. NeurIPS","volume":"33","author":"Brown"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-70604-3_4"},{"key":"ref108","first-page":"1","article-title":"Mixture-of-experts meets instruction tuning: A winning combination for large language models","volume-title":"Proc. ICLR","author":"Shen"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1525\/9780520940420-020"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/TWC.2022.3221778"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2024\/3"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/TCNS.2023.3242359"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1002\/9781119863663.ch8"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00148"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i4.25555"},{"key":"ref116","first-page":"1","article-title":"Scaling large language model-based multi-agent collaboration","volume-title":"Proc. ICLR","author":"Qian"},{"key":"ref117","first-page":"1","article-title":"Seeking neural nuggets: Knowledge transfer in large language models from a parametric perspective","volume-title":"Proc. ICLR","author":"Zhong"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-naacl.26"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-acl.220"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.792"},{"key":"ref121","first-page":"1965","article-title":"Joint language semantic and structure embedding for knowledge graph completion","volume-title":"Proc. COLING","author":"Shen"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.400"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.437"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2023.3325484"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00024"},{"key":"ref126","first-page":"1","article-title":"An LLM can fool itself: A prompt-based adversarial attack","volume-title":"Proc. ICLR","author":"Xu"},{"key":"ref127","first-page":"1","article-title":"Stable diffusion is unstable","volume-title":"Proc. NeurIPS","author":"Du"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00102"},{"key":"ref129","first-page":"1","article-title":"An image is worth 1000 lies: Transferability of adversarial images across prompts on vision-language models","volume-title":"Proc. ICLR","author":"Luo"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00123"},{"key":"ref131","first-page":"1","article-title":"Jailbreaker: Automated jailbreak across multiple large language model chatbots","volume-title":"Proc. NDSS","author":"Deng"},{"key":"ref132","first-page":"1","article-title":"Don\u2019t listen to me: Understanding and exploring jailbreak prompts of large language models","volume-title":"Proc. USENIX","author":"Yu"},{"key":"ref133","first-page":"1","article-title":"BadRobot: Jailbreaking embodied LLMs in the physical world","volume-title":"Proc. ICLR","author":"Zhang"},{"key":"ref134","first-page":"1","article-title":"Tensor trust: Interpretable prompt injection attacks from an online game","volume-title":"Proc. ICLR","author":"Toyer"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623985"},{"key":"ref136","first-page":"1559","article-title":"You autocomplete me: Poisoning vulnerabilities in neural code completion","volume-title":"Proc. USENIX","author":"Schuster"},{"key":"ref137","first-page":"35413","article-title":"Poisoning language models during instruction tuning","volume-title":"Proc. ICLR","author":"Wan"},{"key":"ref138","first-page":"1","article-title":"Agent security bench (ASB): Formalizing and benchmarking attacks and defenses in LLM-based agents","volume-title":"Proc. ICLR","author":"Zhang"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.emnlp-main.1771"},{"key":"ref140","article-title":"AgentMonitor: A plug-and-play framework for predictive and secure multi-agent systems","author":"Chan","year":"2024","journal-title":"arXiv:2408.14972"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00423"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.171"},{"key":"ref143","first-page":"1","article-title":"BadChain: Backdoor chain-of-thought prompting for large language models","volume-title":"Proc. ICLR","author":"Xiang"},{"key":"ref144","first-page":"31210","article-title":"Large language models can be easily distracted by irrelevant context","volume-title":"Proc. ICML","volume":"202","author":"Shi"},{"key":"ref145","first-page":"1","article-title":"Training socially aligned language models on simulated social interactions","volume-title":"Proc. ICLR","author":"Liu"},{"key":"ref146","first-page":"20763","article-title":"Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples","volume-title":"Proc. ICML","volume":"202","author":"Liang"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670388"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671837"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-industry.56"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.529"},{"key":"ref151","article-title":"Certifying LLM safety against adversarial prompting","author":"Kumar","year":"2023","journal-title":"arXiv:2309.02705"},{"key":"ref152","first-page":"1","article-title":"LLM self defense: By self examination, LLMs know they are being tricked","volume-title":"Proc. ICLR","author":"Phute"},{"key":"ref153","first-page":"1","article-title":"AutoDefense: Multi-agent LLM defense against jailbreak attacks","volume-title":"Proc. NeurIPS Safe Generative AI Workshop","author":"Zeng"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24115"},{"key":"ref155","first-page":"15307","article-title":"Automatically auditing large language models via discrete optimization","volume-title":"Proc. ICML","author":"Jones"},{"key":"ref156","article-title":"RedAgent: Red teaming large language models with context-aware autonomous language agent","author":"Xu","year":"2024","journal-title":"arXiv:2407.16667"},{"key":"ref157","first-page":"1","article-title":"WebArena: A realistic Web environment for building autonomous agents","volume-title":"Proc. ICLR","author":"Zhou"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-naacl.217"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-emnlp.369"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23238"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.148"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.709"},{"key":"ref163","first-page":"1","article-title":"Teach LLMs to Phish: Stealing private information from language models","volume-title":"Proc. ICLR","author":"Panda"},{"key":"ref164","first-page":"5253","article-title":"Extracting training data from diffusion models","volume-title":"Proc. USENIX","author":"Carlini"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.570"},{"key":"ref166","first-page":"1","article-title":"An efficient membership inference attack for the diffusion model by proximal Initialization","volume-title":"Proc. ICLR","author":"Kong"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.52202\/079017-4290"},{"key":"ref168","first-page":"1","article-title":"Property existence inference against generative models","volume-title":"Proc. USENIX","author":"Wang"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00095"},{"key":"ref170","first-page":"1","article-title":"Thieves on sesame street! model extraction of BERT-based APIs","volume-title":"Proc. ICLR","author":"Krishna"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616652"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639091"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.189"},{"key":"ref174","first-page":"1","article-title":"Prompt stealing attacks against text-to-image generation models","volume-title":"Proc. USENIX","author":"Shen"},{"key":"ref175","article-title":"Prompt stealing attacks against large language models","author":"Sha","year":"2024","journal-title":"arXiv:2402.12959"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670370"},{"key":"ref177","volume-title":"Samsung bans ChatGPT, AI Chatbots after data leak blunder","author":"Mauran","year":"2024"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2023.3306773"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.105"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref181","first-page":"1","article-title":"Beyond memorization: Violating privacy via inference with large language models","volume-title":"Proc. ICLR","author":"Staab"},{"key":"ref182","first-page":"1","article-title":"User inference attacks on large language models","volume-title":"Proc. NeurIPS Int. Workshop Federated Learn. Age Found. Models","author":"Kandpal"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.119"},{"key":"ref184","first-page":"10697","article-title":"Deduplicating training data mitigates privacy risks in language models","volume-title":"Proc. ICML","author":"Kandpal"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-emnlp.102"},{"key":"ref186","first-page":"1","article-title":"ProPILE: Probing privacy leakage in large language models","volume-title":"Proc. NeurIPS","author":"Kim"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref189","first-page":"17061","article-title":"A watermark for large language models","volume-title":"Proc. ICML","author":"Kirchenbauer"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2024.3382958"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1145\/3571730"},{"key":"ref192","first-page":"1","article-title":"Mitigating hallucination in large multi-modal models via robust instruction tuning","volume-title":"Proc. ICLR","author":"Liu"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.182"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.577"},{"key":"ref195","first-page":"1","article-title":"The RefinedWeb dataset for falcon LLM: Outperforming curated corpora with Web data only","volume-title":"Proc. NeurIPS","author":"Penedo"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.89"},{"key":"ref197","first-page":"1","article-title":"Factuality enhanced language models for open-ended text generation","volume-title":"Proc. NeurIPS","author":"Lee"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.565"},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.847"},{"key":"ref200","first-page":"1","article-title":"How language model hallucinations can snowball","volume-title":"Proc. ICML","author":"Zhang"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.557"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.546"},{"key":"ref203","first-page":"1","article-title":"Teaching language models to hallucinate less with synthetic tasks","volume-title":"Proc. ICLR","author":"Jones"},{"key":"ref204","first-page":"1","article-title":"Self-contradictory hallucinations of large language models: Evaluation, detection and mitigation","volume-title":"Proc. ICLR","author":"M\u00fcndler"},{"key":"ref205","first-page":"1","article-title":"INSIDE: LLMs\u2019 internal states retain the power of hallucination detection","volume-title":"Proc. ICLR","author":"Chen"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.910"},{"key":"ref207","first-page":"1","article-title":"Analyzing and mitigating object hallucination in large vision-language models","volume-title":"Proc. ICLR","author":"Zhou"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-021-00801-4"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.eacl-main.236"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00373"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00466"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3294569"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1109\/TICPS.2023.3333850"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/9739\/11321210\/11022699.pdf?arnumber=11022699","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,2]],"date-time":"2026-01-02T05:42:39Z","timestamp":1767332559000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11022699\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":213,"URL":"https:\/\/doi.org\/10.1109\/comst.2025.3576176","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}