StealthGraph: Revealing Domain-Specific Risks in LLMs via Knowledge Graph-Guided Harmful Prompt Generation(original, opens in a new tab)

Proposes StealthGraph, which synthesizes domain-specific implicitly harmful prompts and evaluates models.

BanglaLorica: Design and Evaluation of Robust Watermarking Algorithms for Bengali Text Generation in Large Language Models(original, opens in a new tab)

提出 BanglaLorica 分层水印，增强孟加拉语生成文本的水印抗去除能力。

Safety is not universal: selective safety traps in LLM alignment(original, opens in a new tab)

提出 MiJaBench，审计模型对不同群体的越狱防护差异。

SearchAttack: Red-Teaming Large Language Models for Knowledge-to-Action Threats in Online Web Search(original, opens in a new tab)

提出 SearchAttack，诱导检索增强模型整合网页证据生成可操作输出。

What Factors Affect the Safety Alignment of LLMs and LRMs?(original, opens in a new tab)

华为研究团队比较内在因素与越狱对 LLM 和 LRM 安全对齐的影响。

RedBench: A General-Purpose Dataset for Comprehensive Red-Teaming of Large Language Models(original, opens in a new tab)

提出 RedBench，汇总红队数据集评测对抗提示与过度拒绝。

针对大语言模型后门指纹的抑制攻击(original, opens in a new tab)

提出 TFA 与 SVA，抑制 ensemble 后门指纹验证。

Bai et al. 论文：用 RLHF 训练既有帮助性又无害的助手(original, opens in a new tab)

Bai et al. 用 RLHF 在人类偏好数据上训练语言模型，证明可同时提升帮助性与无害性，但二者的张力无法完全消除。训练覆盖 13M 到 52B 参数：纯帮助性训练使模型更愿配合有害请求，纯无害性训练则使其变得回避、无用。RLHF 模型比仅用监督微调的模型更抗红队测试，但仍可被多轮操纵和角色扮演攻击突破。

Gradient-Free and Prior-Free Jailbreaking of Large Language Models: Effective and Transferable Attacks(original, opens in a new tab)

提出 RAILS，仅用 logits 做无梯度无先验后缀优化以越狱并跨模型迁移。

Why it was selectedThe paper provides a jailbreak optimization method that requires no gradients and no human priors, and reports attack success rates and transfer data on open-source and closed-source models, which can serve as a reference for red teaming methods.

GAMBIT: a gamified jailbreak framework for multimodal large models(original, opens in a new tab)

Propose the GAMBIT gamified jailbreak framework, attacking multimodal models with puzzle and competition scenarios.

Adversarial contrastive learning for LLM quantization attacks(original, opens in a new tab)

提出 ACL 量化攻击，令模型全精度良性而量化后恶意。

Extracting Books from Production-Grade Language Models(original, opens in a new tab)

提出两阶段抽出流程，从生产语言模型近逐字抽出版权书籍。

Why it was selectedThe paper provides the concrete process and success rates for extracting copyrighted books from four production-grade LLMs, which can be used to assess the actual strength of memorization and output protection.

SLIP: multi-turn self-jailbreak without an external attack model, with an average success rate of 94.7% across 11 models.(original, opens in a new tab)

提出无外部攻击模型的多轮自我越狱方法SLIP。

Exploring Methods to Detect Recommender System Data Memorization in Large Language Models(original, opens in a new tab)

Comparing prompt extraction and activation probing for detecting data memorization in recommender systems.

Constructing Adversarial Inputs for Large Vision-Language Models with Black-Box Optimization(original, opens in a new tab)

提出 ZO-SPSA，以黑盒优化构造视觉对抗输入越狱视觉语言模型。

Structured Representations for Cross-Attack Generalization in AI Agent Threat Detection(original, opens in a new tab)

提出结构 tokenization，检测 Agent 轨迹中的未见攻击族。

Lying with the truth: open-channel multi-agent collusion manipulates beliefs via Generative Montage(original, opens in a new tab)

提出 Generative Montage，用公开真证据片段诱导智能体采纳虚构因果。

TruthfulQA：衡量模型如何模仿人类谬误(original, opens in a new tab)

Lin 等人构建的 TruthfulQA 基准发现逆向缩放现象，在人类常见误解普遍的问题上，更大的语言模型反而不如小模型真实。该基准包含 817 个问题，覆盖健康、法律、金融、政治等 38 个类别，专门设计成常见误解会导向错误答案。在生成式设置下，最大的 GPT-3 175B 只有 58% 的回答属实，人类基线为 94%。论文提出“模仿性谬误”概念，指模型生成虚假陈述并非因为缺乏知识，而是因为该虚假说法在训练数据中统计上普遍。研究还发现信息量随规模上升而真实性下降，并引入 GPT-judge 和 GPT-info 自动评估指标。

Aggressive compression enables LLM weight stealing(original, opens in a new tab)

提出面向渗出的权重压缩，评估推理服务器权重窃取可行性。

Emoji-based jailbreak of large language models: a prompt-level vulnerability analysis of four open-source models(original, opens in a new tab)

Construct jailbreak prompts using emoji padding and concatenation to bypass filters and elicit restricted content.

CSSBench: Evaluating the safety of lightweight LLMs against Chinese-specific adversarial patterns(original, opens in a new tab)

Propose CSSBench to evaluate lightweight models' failure and over-refusal on Chinese surface-level adversarial rewrites.

Low Rank Means Low Safety: Gradient Assembly Poisoning Attacks Against Distributed LoRA Large Language Model Systems(original, opens in a new tab)

提出 GAP 梯度组装投毒，在联邦 LoRA 聚合中诱导定向语义偏离。

When agents view humans as out-group: belief-dependent bias in LLM-driven agents(original, opens in a new tab)

Proposes BPA, which rewrites profiles and memories to re-trigger out-group bias in agents toward humans.

Overlooked large language model security vulnerabilities: malicious intelligent optimization algorithm requests and their jailbreaks(original, opens in a new tab)

They propose MOBjailbreak, which rewrites malicious optimization algorithm requests into harmless expressions to perform jailbreaks.

Oxford et al. release the TRAP benchmark: six frontier models' web agents are hijacked by prompt injection on average 25% of the time(original, opens in a new tab)

Researchers at the University of Oxford and other institutions built the TRAP benchmark to evaluate how web agents are hijacked by interface prompt injection.

Why it was selectedTRAP decomposes prompt injection into modules such as persuasion principles, manipulation techniques, and interface forms, quantifying the impact of interface details on the probability of web agents being hijacked.

Risk-Aware Injection: Calibrating VLM Safety Without Sacrificing Usefulness(original, opens in a new tab)

Wang et al. propose Risk-Aware Injection (RAI), a training-free framework that restores safety calibration in VLMs by amplifying unsafe signals in the visual embedding space. The method targets the cross-modal safety gap: LLMs that reliably reject harmful text requests often comply when the same content is presented as an image, because safety alignment from RLHF or instruction tuning primarily acts on text representations, while the vision encoder follows a separate pathway. RAI constructs an unsafe prototype subspace from language embeddings of known unsafe content, identifies visual tokens whose embeddings are close to this subspace at inference time, and modulates their representations to trigger the model's existing safety mechanisms. The authors state that the method substantially reduces attack success rates across multiple multimodal jailbreak benchmarks while maintaining task performance on standard VLM evaluations. They also suggest the approach could extend to embodied AI, such as robot VLA models; whether it can withstand adaptive attacks specifically targeting the unsafe prototype subspace remains an open question.

GateBreaker: A training-free safety alignment attack framework for MoE large models(original, opens in a new tab)

Proposes GateBreaker, which locates and zeroes MoE safety neurons at inference time to disable safety alignment.

Why it was selectedThe paper provides a method for locating and masking safety neurons in MoE large models at inference time, and reports attack success rates that transfer across models, which can serve as a reference for assessing MoE deployment risks.

Odysseus jailbreaks GPT-4o, Gemini-2.0, and Grok-3 with dual steganography, with attack success rates up to 99%(original, opens in a new tab)

Propose dual-steganography jailbreak Odysseus, using image steganography to bypass multimodal system safety filters.

Why it was selectedThe paper discloses that commercial multimodal system safety filters rely on the assumption that malicious content is explicitly visible, and provides a complete attack chain for cross-modal hidden payloads along with measured success rates.

DREAM framework evaluates 12 LLM agents with cross-environment long-chain attacks, with over 68% of attacks bypassing existing defenses(original, opens in a new tab)

Researchers from Nanjing University, the University of Hong Kong, and other institutions propose the DREAM framework to evaluate agents' vulnerability to cross-environment long-chain attacks.

The research proposes a learning-based automated adversarial red-teaming framework for evaluating the robustness of large language models.(original, opens in a new tab)

Proposes a constrained adversarial search red-teaming framework that systematically discovers multiple classes of model robustness vulnerabilities.

Paper proposes automatic generation of robot constitutions and the ASIMOV semantic safety benchmark(original, opens in a new tab)

Sermanet et al.'s paper proposes the ASIMOV benchmark for evaluating the semantic safety of foundation models acting as robot controllers, and a framework for automatically generating a constitution of behavior. The benchmark combines text and image generation, real visual data, and hospital injury reports, extending robot safety from geometric obstacle avoidance to semantic judgment—i.e., the model must judge whether an action is harmful in a specific context. The paper claims that a constitution iteratively refined through an automatic revision mechanism achieves an 84.3% alignment rate on ASIMOV, higher than baselines and human-written constitutions. The framework transfers Constitutional AI from language model alignment to robot control. Failure-First notes that the remaining 15.7% of failures may be concentrated in the most dangerous ambiguous edge cases.

SafeProbing: Probing Hidden Safety Signals During Decoding to Defend Against LLM Jailbreaks(original, opens in a new tab)

SafeProbing probes hidden safety signals during the decoding stage to intercept harmful generations under jailbreak. On Qwen models, it achieves an average defense success rate of 95.1% against 7 attack methods including AutoDAN and PAIR, 15 percentage points higher than the next-best baseline at 80.1%, while probing only 20% of decoding steps randomly sampled. On XSTest, over-refusal occurs only 18 times, with zero degradation in math problem-solving performance.

ContextLeak: Auditing Privacy Leakage in Private In-Context Learning(original, opens in a new tab)

Proposes ContextLeak, auditing private ICL leakage using canary membership inference.

RealMirror: An Open-Source Vision-Language-Action Platform for Embodied Intelligence(original, opens in a new tab)

Tai et al. propose RealMirror, an open-source vision-language-action (VLA) platform for embodied intelligence that integrates efficient data collection, standardized evaluation, and environment reconstruction based on 3D Gaussian Splatting. The platform allows researchers to develop and iterate VLA models without physical robot hardware, and provides a VLA benchmark containing multiple scenarios and standardized trajectories. The paper demonstrates zero-shot sim-to-real transfer, where models trained purely in simulation can complete real robot tasks without fine-tuning. From a safety perspective, Failure-First notes that adversarial attacks validated in simulation (such as the backdoor attack documented by DropVLA) may also transfer directly to physical robots without an adaptation phase, and asks whether this benchmark can be extended to safety evaluation under adversarial conditions.

SafeAgentBench: a benchmark for safety task planning in embodied LLM agents(original, opens in a new tab)

SafeAgentBench is a benchmark for safety task planning in embodied LLM agents. Testing on eight agent architectures shows that their refusal rate for dangerous tasks is only about 3% to 10%. The benchmark contains 750 tasks covering 10 categories of danger, divided into three types: explicit dangerous tasks, deceptive dangerous tasks, and normal tasks with hidden dangers, and it builds the SafeAgentEnv simulation environment based on AI2-THOR, supporting 17 high-level actions. The evaluation uses two sets of metrics at both the execution level and the semantic level: the former checks whether the agent actually executes dangerous actions, and the latter checks whether its plan contains dangerous steps. Results show that changing the underlying LLM has little impact on safety performance, deceptive phrasing can effectively bypass refusal, and planning frameworks with a safety reflection step provide only marginal improvement; some agents planned unsafe actions but failed to execute them due to environmental constraints, and the authors argue that semantically unsafe planning should still be treated as a real risk signal.

Why it was selected该基准用 750 个任务和两套评测指标测出八种具身 Agent 对危险指令的拒答率仅 3% 到 10%，为具身安全评测提供了可复用的任务集与仿真环境。

Daily paper: state-dependent safety failures in multi-turn language model interactions(original, opens in a new tab)

Li et al. propose the STAR framework, which reframes safety failures in multi-turn language model interactions as a state-space problem rather than a prompt engineering problem. The framework treats conversation history as a state transition operator, used to analyze how aligned models cross safety boundaries under autoregressive conditions. The core finding is that models that appear robust in single-turn static evaluations undergo rapid and reproducible safety collapse in structured multi-turn interactions; mechanism analysis shows their internal representations monotonically drift away from refusal-related features across turns, and role-conditioned context can also trigger sudden phase transitions that shift the model from refusal to compliance. The authors describe STAR as a diagnostic framework for probing and understanding safety boundaries, not a jailbreak method aimed at maximizing attack success rate, and it can provide a structural explanation for why multi-turn attacks that rely on conversational groundwork, such as crescendo and Foot-In-The-Door, are effective.

Multi-stream perturbation attack: disrupting safety alignment of reasoning LLMs through concurrent task interference(original, opens in a new tab)

Researcher Yang proposes a multi-stream perturbation attack against reasoning LLMs that interleaves multiple task streams, character reversal, and format constraints within a single prompt, causing the model's reasoning process to collapse or degrade into repetitive loops, thereby bypassing safety alignment. The attack combines three strategies—multi-stream interleaving, reversal perturbation, and shape transformation—and outperforms any single strategy. Among attacked responses, up to 17% show complete reasoning collapse and 60% show response repetition. The attack achieves high success rates on mainstream reasoning models including the Qwen3 series, DeepSeek, Qwen3-Max, and Gemini 2.5 Flash. The paper argues this is a systemic weakness of the reasoning-mode architecture rather than a flaw of any single model.

AGENTSAFE: Evaluating the safety of embodied agents under dangerous instructions(original, opens in a new tab)

Ying et al. propose the SAFE benchmark system for evaluating the safety of embodied AI under dangerous instructions, consisting of three components. SAFE-THOR provides an adaptable simulation environment, SAFE-VERSE offers 45 adversarial scenarios, 1,350 dangerous tasks, and 9,900 instructions inspired by Asimov's Three Laws of Robotics, and SAFE-DIAGNOSE independently evaluates perception, planning, and execution in stages. Tests on nine SOTA VLMs show that models can recognize danger yet systematically fail to translate that recognition into safe planning and action; the authors attribute this to a perception-to-action gap.

Mousetrap: Jailbreaking Large Reasoning Models with Iterative Chaotic Chains(original, opens in a new tab)

The paper proposes Mousetrap, claiming it is the first jailbreak framework specifically designed for large reasoning models (LRMs). It uses a Chaos Machine to map attack prompts one-to-one and iteratively embed them into the model's reasoning chain, leveraging reasoning inertia to make the model derive harmful content on its own. The paper reports success rates of 96% for o1-mini, 86% for Claude-Sonnet, and 98% for Gemini-Thinking; on standard benchmarks against Claude-Sonnet, it reports AdvBench 87.5%, StrongREJECT 86.58%, and HarmBench 93.13%. The paper argues that reasoning flaws differ from alignment flaws, and that defending only at the output layer may not prevent the reasoning chain from being contaminated. Failure-First points out that the reasoning trace itself is the attack surface and questions whether these success rates are robust across different scoring methods.

Why it was selected论文称推理链本身可成为攻击面，越狱后的推理模型会输出比普通 LLM 更具体的有害内容。

VRSA: Jailbreaking Multimodal Large Language Models via Visual Reasoning Sequence Attacks(original, opens in a new tab)

Propose the visual reasoning sequence attack VRSA, jailbreaking multimodal large models with image sequences.