VRSA: Jailbreaking Multimodal Large Language Models via Visual Reasoning Sequence Attacks(original, opens in a new tab)

Propose the visual reasoning sequence attack VRSA, jailbreaking multimodal large models with image sequences.

Foot-In-The-Door: A Multi-Turn Jailbreak Method for LLMs(original, opens in a new tab)

The paper by Weng et al. proposes the multi-turn jailbreak method Foot-In-The-Door (FITD), which gradually escalates the malicious intent of user queries through intermediate bridging prompts, transitioning from benign requests to harmful content, achieving an average attack success rate of 94% across seven mainstream models, higher than existing multi-turn and single-turn methods. The method exploits the model's self-corruption mechanism of treating its own previous answers as acceptable grounds, forming a feedback loop that lowers the threshold for subsequent harmful requests; since each turn is harmless in isolation, safety mechanisms calibrated for single-turn threats are difficult to trigger. The authors argue this is a structural weakness of autoregressive models in handling multi-turn contexts, rather than an implementation flaw of a specific model.

DIQ-H benchmark and VGIR framework: evaluating VLM robustness under adversarial visual conditions(original, opens in a new tab)

Proposes the DIQ-H benchmark to evaluate VLM hallucination persistence and recovery in continuously degraded visual streams.

Red Teaming Generative AI: Silver Bullet or Security Theater?(original, opens in a new tab)

Feffer et al. at CMU systematically analyze AI red teaming practices, examining six industry cases including Bing Chat, GPT-4, Gopher, Claude, and DEFCON, and surveying 104 papers. They find that the term is used inconsistently across purpose, evaluation targets, threat models, team composition, and result reporting, and that many public-facing red teaming exercises resemble security theater more than rigorous safety evaluation. The study identifies five axes of divergence and categorizes the literature into four method types: manual brute-force evaluation, AI-assisted attack generation, algorithmic search over prompt space, and targeted attacks against specific vulnerabilities. The paper distinguishes context-dependent harms from universally unacceptable content, noting that time-limited crowdsourced evaluations favor easily producible harmful outputs, creating an illusion of coverage. The authors propose a three-stage checklist of questions to standardize red teaming processes. The paper was submitted as a comment on the NIST AI Risk Management Framework and published at AAAI/ACM AIES 2024.

ArtPrompt: ASCII Art Jailbreak Attack against Aligned Large Language Models(original, opens in a new tab)

The paper by Jiang et al. proposes ArtPrompt, which renders sensitive keywords as ASCII art embedded in normal prompts to bypass the safety measures of aligned large language models, requiring only black-box access for the attack. The paper proposes the ViTC benchmark to evaluate models' ability to recognize prompts that require visual rather than purely semantic interpretation, and the five tested models—GPT-3.5, GPT-4, Gemini, Claude, and Llama2—all performed poorly. The authors argue this approach can be generalized to encoding methods such as Base64, ROT13, and leet that models can decode but safety filters do not cover. Failure-First categorizes it into the encoding attack family and notes it is especially relevant to embodied AI, where sensor data is inherently multimodal and multi-encoded.

CacheTrap: Researchers propose a gray-box Trojan attack against LLM KV caches(original, opens in a new tab)

Proposes CacheTrap, flipping a single bit of the KV cache to steer toward a specified class.

评估 AI 欺骗检测器的困难(original, opens in a new tab)

分析评估 AI 欺骗检测器时难以标注战略性欺骗。

BrowseSafe: Researchers Build a Browser Agent Prompt Injection Benchmark and Evaluate Existing Defenses(original, opens in a new tab)

Propose BrowseSafe, which detects and blocks prompt injection in browser agent tool outputs at the boundary.

BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses in Vision-Language Models(original, opens in a new tab)

Proposes the BackdoorVLM benchmark to evaluate backdoor attacks and defenses in fine-tuning of vision-language models.

The MFA framework achieves a 58.5% attack success rate across 17 vision-language models(original, opens in a new tab)

The Chinese University of Hong Kong, Beijing Institute of Technology, and Huawei Noah's Ark Lab propose the MFA framework, which collaboratively breaks through the alignment, prompt, and moderation layers of vision-language models.

Liars' Bench: evaluating lie detectors for language models(original, opens in a new tab)

构建 LIARS' BENCH 评测语言模型谎言检测器。

Why it was selected论文给出覆盖七类说谎场景的公开评测基准，并显示现有测谎方法在自我知识类谎言上接近随机水平。

The paper proposes jailbreaking LVLMs in intelligent transportation systems using image typographic manipulation and multi-turn prompting(original, opens in a new tab)

Proposes image typography manipulation and multi-turn prompt jailbreak to bypass safety alignment in traffic-scenario vision-language models.

StyleBreak: Jailbreaking with Stylized Audio to Reveal Alignment Vulnerabilities in Large Audio Language Models(original, opens in a new tab)

Propose StyleBreak stylized audio jailbreak, using speech attributes to bypass audio language model alignment.

Training language models to explain their own internal computations(original, opens in a new tab)

微调解释器复现特征描述、激活修补与输入消融。

Why it was selected论文以可解释性方法的输出作监督微调解释器，发现模型解释自身内部计算优于解释其他模型，数据效率也更高。

Paper "Lifelong Safety Alignment for Language Models"(original, opens in a new tab)

Wang et al.'s paper formalizes the confrontation between jailbreak attackers and model defenders as a competitive co-evolutionary framework: Meta-Attacker uses GPT-4o to extract and generalize attack strategies from published jailbreak research papers, with an initial attack success rate of 73% and a transfer success rate of 57% on another benchmark. After multiple rounds of iterative fine-tuning by the defender, the attack success rate drops to about 7%, and Meta-Attacker's effectiveness tends to plateau. The framework is deployed for an "unrestricted environment" without pre-filtering. The paper does not report utility metrics alongside safety metrics, nor does it discuss computational cost or out-of-distribution attack categories; Failure-First believes the residual 7% of attacks may exploit reasoning-level vulnerabilities.

和盘托出：训练大语言模型自我报告其隐藏目标(original, opens in a new tab)

提出 SRFT，训练模型在审问时承认隐藏目标。

时间中的先验：语言模型可解释性缺失的归纳偏置(original, opens in a new tab)

提出 Temporal Feature Analysis，分解激活的可预测分量与新颖残差。

MobiRed framework evaluates prompt injection attacks via third-party channels on eight mobile LLM agents(original, opens in a new tab)

Use MobiRed to evaluate mobile LLM agents against prompt injection via third-party channels.

一致性训练有助于阻止谄媚与越狱(original, opens in a new tab)

论文提出一致性训练，一种让模型对提示词中无关线索保持行为不变的自监督范式，用于减少谄媚与越狱。

大语言模型用通用 filter head 处理列表(original, opens in a new tab)

论文用因果中介分析研究大语言模型处理列表任务的机制，发现少量注意力头会在特定 token 的 query 状态中编码过滤谓词的紧凑表示，作者将这类注意力头称为 filter head。

损失曲率谱中从记忆到推理的转变(original, opens in a new tab)

研究者提出基于损失曲率分解的方法，在语言模型和视觉 Transformer（ViT）的权重中区分记忆与非记忆成分，并据此编辑权重。

引导评测感知的语言模型表现得像处于部署状态(original, opens in a new tab)

研究者训练了一个评测感知的模型生物，并证明激活引导能让它在评测语境中表现出部署时的行为。

Why it was selected论文用专门训练的评测感知模型生物，验证激活引导可让模型在评测中表现出部署行为，为安全评测的可信度问题提供实验证据。

超越单向影响：多轮人类与 LLM 对话中的双向观点动态(original, opens in a new tab)

推理模型能否混淆推理？思维链可监控性的压力测试(original, opens in a new tab)

压力测试推理模型混淆思维链以规避监控。

Why it was selected论文在玩具任务与 SHADE-Arena 上比较内部与外部 CoT 的抗混淆差异，并给出可复现的混淆压力量表与开源代码。

What research says about AI sycophancy(original, opens in a new tab)

A Tech Policy Press review summarizes three new papers examining how AI sycophancy (models sacrificing truthfulness to agree with users) is evaluated and its impact on users. The arXiv paper SycEval reports that 58.19% of conversations in its sample exhibit sycophantic behavior, with Gemini highest (62.47%) and ChatGPT lowest (56.71%), and notes that cited rebuttals most easily trigger regression-type sycophancy, and on the medical advice dataset MedQuad, models often agree with incorrect user beliefs and give dangerous or misleading medical advice. Another study testing 11 models found they affirm user behavior 50% more than humans; in two pre-registered experiments (N=1604), participants exposed to sycophantic models felt more correct and were less willing to fix conflicts. A third study showed that interacting with sycophantic chatbots increased stance extremity by 2.68 percentage points and stance certainty by 4.04 percentage points, with the author arguing that polarization mainly comes from selective presentation of supportive facts.

The paper proposes a multi-turn online harassment agent benchmark; jailbreak fine-tuning raises the attack success rate above 95%(original, opens in a new tab)

Proposes a multi-turn online harassment agent benchmark, evaluating memory, planning, and fine-tuning jailbreaks.

大语言模型也会“脑腐”：一项基于 Twitter/X 的初步研究(original, opens in a new tab)

论文提出并测试“LLM 脑腐”假说：用真实 Twitter/X 语料做对照实验，并放大精神病态、自恋等暗黑特质。

Narrow-domain fine-tuning leaves clearly readable traces in activation differences(original, opens in a new tab)

研究者提出 Activation Difference Lens（ADL），用 Patchscope、Logit Lens 和激活差值引导分析微调前后模型的激活差异，发现窄域微调会在随机文本的前几个 token 上留下可读的训练目标痕迹。

The research shows that simple attacks can bypass the safety guardrails of reasoning models such as gpt-oss(original, opens in a new tab)

Proposes four stage transition attacks to bypass the safety reasoning guardrails of reasoning models.

Why it was selectedThe paper reveals that the stage transition logic of reasoning-based safety guardrails can be simply manipulated, and provides attack success rates across models and closed-source APIs, offering transferable failure analysis for guardrail design.

Researchers use prompt injection to attack monitoring models, bypassing AI control protocols(original, opens in a new tab)

Proposes adaptive prompt injection against trusted monitors, bypassing AI control protocols.

Why it was selectedThe paper treats the monitoring model itself as an attack surface, using prompt injection to make untrusted models bypass AI control protocols, and points out that Defer-to-Resample amplifies the attack.

Paper proposes adaptive attack framework that breaks through 12 LLM jailbreak and prompt injection defenses(original, opens in a new tab)

Proposes an adaptive attack framework that breaks through jailbreak and prompt injection defenses.

对齐华尔兹：联合训练智能体协作保障安全(original, opens in a new tab)

论文提出 WaltzRL，一个把安全对齐建模为协作博弈的多智能体强化学习框架，联合训练对话智能体与反馈智能体。

对 LLM 的投毒攻击所需毒化样本数量近乎恒定(original, opens in a new tab)

验证预训练与微调中后门投毒成功取决于绝对样本量。

Why it was selected论文改用投毒样本绝对数量而非数据占比衡量后门风险，为评估大模型预训练与微调的投毒门槛提供了可迁移的口径。

EVALUESTEER：衡量奖励模型对价值与偏好的可引导性(original, opens in a new tab)

提出 EVALUESTEER，评测奖励模型对价值与风格画像的可引导性。

混合机制：语言模型如何在上下文中检索绑定的实体(original, opens in a new tab)

分析语言模型如何混合位置、词汇与自反机制检索上下文绑定实体。

Moloch 的契约：LLM 争夺受众时出现的涌现性失配(original, opens in a new tab)

Batu El 与 James Zou 的论文发现，为竞争成功而优化 LLM 会带来对齐退化。

VAL-Bench：以信念一致性衡量语言模型的价值对齐(original, opens in a new tab)

提出 VAL-Bench，用对立提问衡量语言模型信念一致性。

Inoculation Prompting：训练时指示 LLM 表现不良可改善测试时对齐(original, opens in a new tab)

提出接种提示词，在微调时显式索要不良行为以降低测试期非预期行为。

Why it was selected论文提出在训练提示词中显式要求不良行为，在四个微调场景中减少奖励作弊与谄媚的内化，同时基本保留目标能力。

RL-Hammer: training an attack model from scratch with GRPO, achieving 72% attack success rate against defended GPT-5(original, opens in a new tab)

Researchers from Meta FAIR and the University of Maryland propose RL-Hammer, which trains an attack model from scratch to perform prompt injection through tool outputs.

接种式提示：训练时引出 LLM 的特征可在测试时抑制其表达(original, opens in a new tab)

提出接种提示词，训练时引出不良特征、测试时抑制失齐与后门。

Why it was selected论文用接种式提示在微调数据中前置系统指令，说明其可选择性抑制特征泛化并缓解涌现性失对齐与后门触发，为理解模型泛化提供线索。