By providing a standardized interface for LLM agents to interact with external tools, the Model Context Protocol (MCP) is quickly becoming a cornerstone of the modern autonomous agent ecosystem. However, it creates novel attack surfaces due to untrusted external tools. While prior work has focused on attacks injected through external tool outputs, we investigate a more fundamental vulnerability: Tool Poisoning, where malicious instructions are embedded within a tool's metadata at the registration stage. To date, this threat has been primarily demonstrated through isolated cases, lacking a systematic, large-scale evaluation. We introduce MCPTox, the first benchmark to systematically evaluate agent robustness against Tool Poisoning in realistic MCP settings. MCPTox is constructed upon 45 live, real-world MCP servers and 353 authentic tools. To achieve this, we design three distinct attack templates to generate a comprehensive suite of 1348 malicious test cases by few-shot learning, covering 10 categories of potential risks. Our evaluation on 20 prominent LLM agents setting reveals a widespread vulnerability to Tool Poisoning, with GPT-o1-mini, achieving an attack success rate of 72.8%. We find that more capable models are often more susceptible, as the attack exploits their superior instruction-following abilities. Finally, the failure case analysis reveals that agents rarely refuse these attacks, with the highest refused rate (Claude-3.7-Sonnet) less than 3%, demonstrating that existing safety alignment is ineffective against malicious actions that use legitimate tools for unauthorized operation. Our findings create a crucial empirical baseline for understanding and mitigating this widespread threat, and we release MCPTox for the development of verifiably safer AI agents.

The value and copyright of training data are crucial in the artificial intelligence industry. Service platforms should protect data providers' legitimate rights and fairly reward them for their contributions. Shapley value, a potent tool for evaluating contributions, outperforms other methods in theory, but its computational overhead escalates exponentially with the number of data providers. Recent studies on Shapley values have proposed various approximation algorithms to address the computational complexity issues inherent in exact calculations. However, they need to retrain for each test sample, leading to intolerable costs. We propose Fast-DataShapley, a one-pass training framework that leverages the weighted least squares characterization of the Shapley value to train a reusable explainer model with real-time reasoning speed. Given new test samples, no retraining is required to calculate the Shapley values of the training data. Additionally, we propose three methods with theoretical guarantees to reduce training overhead from two aspects: the approximate calculation of the utility function and the reduction of the sample space complexity. We analyze time complexity to show the efficiency of our methods. The experimental evaluations on various image datasets demonstrate superior performance and efficiency compared to baselines. Specifically, the performance is improved to more than 2×, and the explainer's training speed can be increased by two orders of magnitude.

High-quality data labeling is essential for training robust machine learning models; however, existing methods often ignore fraud or assume non-negative worker utility, failing to penalize harmful contributions without discouraging participation. To address this, we propose the Negativity-Aware Incentive (NAI) mechanism which introduces two novel components. First, the Ability-Result Characteristic Function (AR-CF) adapts and extends Shapley value theory through signed valuation to explicitly capture both positive and negative contributions, by combining workers' abilities with real-time task results to define contribution values. Second, a dynamic stake pool mechanism employs pre-commitment economics with adaptive dual-control parameters to balance fairness and operational efficiency. Through extensive experiments on multimodal datasets (images, text, audio, video), NAI outperforms state-of-the-art baselines: it improves video labeling accuracy by 16.6%, and reduces fraudulent behaviors by 33.9%. Furthermore, our deployment on the NetEase Youling crowdsourcing platform, serving 430,000 registered workers with 80,000 monthly active workers, validates NAI's real-world viability. Real-time A/B testing shows a 59.6% improvement in labeling quality for beginner tasks and a consistent reduction in fraud rates (14.8%-33.9%) across difficulty levels. This work establishes a paradigm shift in crowdsourcing system design, demonstrating that explicit negative modeling can enhance data quality, optimize costs, and foster participation at scale.

Intelligent voice systems are widely utilized to control smart home applications, which raises significant privacy and security concerns. Recent studies have revealed their vulnerability to adversarial attacks, replay attacks, and so on. However, these attacks rely on the victim’s voice data. In our work, we investigate a stealthy and command-independent attack that does not necessitate collecting victims’ voices. Our proposed attack, IUAC, misleads the voice system to go against the victim’s will, regardless of the commands delivered. Our core concept is to train highly robust attack commands through the construction of diverse data, rendering the user’s commands negligible. To achieve stealthy attacks, we leverage a high-frequency carrier to construct an inaudible universal adversarial command. Extensive experiments conducted with real-world datasets demonstrate that our attack system attains an average attack success rate of 96% while resisting environmental interference. Moreover, our attack success rate against real-world voice systems is 4.52× higher than the state-of-the-art. Finally, we propose an effective defense mechanism and provide experimental tests to validate its efficacy.