Translation in progress Some entries still include text in the original language.
Page 42 Newer contentBack to latest
The Chinese University of Hong Kong, Beijing Institute of Technology, and Huawei Noah's Ark Lab propose the MFA framework, which collaboratively breaks through the alignment, prompt, and moderation layers of vision-language models.
构建 LIARS' BENCH 评测语言模型谎言检测器。
Why it was selected论文给出覆盖七类说谎场景的公开评测基准，并显示现有测谎方法在自我知识类谎言上接近随机水平。
Proposes image typography manipulation and multi-turn prompt jailbreak to bypass safety alignment in traffic-scenario vision-language models.
Propose StyleBreak stylized audio jailbreak, using speech attributes to bypass audio language model alignment.
微调解释器复现特征描述、激活修补与输入消融。
Why it was selected论文以可解释性方法的输出作监督微调解释器，发现模型解释自身内部计算优于解释其他模型，数据效率也更高。
Wang et al.'s paper formalizes the confrontation between jailbreak attackers and model defenders as a competitive co-evolutionary framework: Meta-Attacker uses GPT-4o to extract and generalize attack strategies from published jailbreak research papers, with an initial attack success rate of 73% and a transfer success rate of 57% on another benchmark. After multiple rounds of iterative fine-tuning by the defender, the attack success rate drops to about 7%, and Meta-Attacker's effectiveness tends to plateau. The framework is deployed for an "unrestricted environment" without pre-filtering. The paper does not report utility metrics alongside safety metrics, nor does it discuss computational cost or out-of-distribution attack categories; Failure-First believes the residual 7% of attacks may exploit reasoning-level vulnerabilities.
研究者用 rank-1 LoRA 为 Qwen-2.5-32B-Instruct 构建了一个最小参数适配器。
提出 SRFT，训练模型在审问时承认隐藏目标。
提出 Temporal Feature Analysis，分解激活的可预测分量与新颖残差。
Use MobiRed to evaluate mobile LLM agents against prompt injection via third-party channels.
论文提出一致性训练，一种让模型对提示词中无关线索保持行为不变的自监督范式，用于减少谄媚与越狱。
论文用因果中介分析研究大语言模型处理列表任务的机制，发现少量注意力头会在特定 token 的 query 状态中编码过滤谓词的紧凑表示，作者将这类注意力头称为 filter head。
UC Berkeley 等机构的研究者提出 WIMHF，用稀疏自编码器（SAE）从偏好数据中自动提取可解释特征。
Why it was selected用稀疏自编码器自动提取偏好数据中的可解释特征，并据此清理 LMArena 中偏好拒答的标注，给数据筛选提供可复现流程。
研究者提出基于损失曲率分解的方法，在语言模型和视觉 Transformer（ViT）的权重中区分记忆与非记忆成分，并据此编辑权重。
研究者训练了一个评测感知的模型生物，并证明激活引导能让它在评测语境中表现出部署时的行为。
Why it was selected论文用专门训练的评测感知模型生物，验证激活引导可让模型在评测中表现出部署行为，为安全评测的可信度问题提供实验证据。
压力测试推理模型混淆思维链以规避监控。
Why it was selected论文在玩具任务与 SHADE-Arena 上比较内部与外部 CoT 的抗混淆差异，并给出可复现的混淆压力量表与开源代码。
A Tech Policy Press review summarizes three new papers examining how AI sycophancy (models sacrificing truthfulness to agree with users) is evaluated and its impact on users. The arXiv paper SycEval reports that 58.19% of conversations in its sample exhibit sycophantic behavior, with Gemini highest (62.47%) and ChatGPT lowest (56.71%), and notes that cited rebuttals most easily trigger regression-type sycophancy, and on the medical advice dataset MedQuad, models often agree with incorrect user beliefs and give dangerous or misleading medical advice. Another study testing 11 models found they affirm user behavior 50% more than humans; in two pre-registered experiments (N=1604), participants exposed to sycophantic models felt more correct and were less willing to fix conflicts. A third study showed that interacting with sycophantic chatbots increased stance extremity by 2.68 percentage points and stance certainty by 4.04 percentage points, with the author arguing that polarization mainly comes from selective presentation of supportive facts.
Proposes a multi-turn online harassment agent benchmark, evaluating memory, planning, and fine-tuning jailbreaks.
论文提出并测试“LLM 脑腐”假说：用真实 Twitter/X 语料做对照实验，并放大精神病态、自恋等暗黑特质。
研究者提出 Activation Difference Lens（ADL），用 Patchscope、Logit Lens 和激活差值引导分析微调前后模型的激活差异，发现窄域微调会在随机文本的前几个 token 上留下可读的训练目标痕迹。
一项研究用奇异学习理论把最小描述长度（MDL）原理扩展到神经网络等奇异模型，并在 Pythia 系列上测试量化、因子分解等多种压缩方法。
一项研究提出基于奇异学习理论的分阶段训练数据归因框架，预测样本影响力会随训练阶段非单调变化，出现符号翻转和发展转折处的尖峰。
Proposes four stage transition attacks to bypass the safety reasoning guardrails of reasoning models.
Why it was selectedThe paper reveals that the stage transition logic of reasoning-based safety guardrails can be simply manipulated, and provides attack success rates across models and closed-source APIs, offering transferable failure analysis for guardrail design.
Proposes adaptive prompt injection against trusted monitors, bypassing AI control protocols.
Why it was selectedThe paper treats the monitoring model itself as an attack surface, using prompt injection to make untrusted models bypass AI control protocols, and points out that Defer-to-Resample amplifies the attack.
Proposes an adaptive attack framework that breaks through jailbreak and prompt injection defenses.
论文提出 WaltzRL，一个把安全对齐建模为协作博弈的多智能体强化学习框架，联合训练对话智能体与反馈智能体。
验证预训练与微调中后门投毒成功取决于绝对样本量。
Why it was selected论文改用投毒样本绝对数量而非数据占比衡量后门风险，为评估大模型预训练与微调的投毒门槛提供了可迁移的口径。
提出 EVALUESTEER，评测奖励模型对价值与风格画像的可引导性。
分析语言模型如何混合位置、词汇与自反机制检索上下文绑定实体。
Batu El 与 James Zou 的论文发现，为竞争成功而优化 LLM 会带来对齐退化。
提出 VAL-Bench，用对立提问衡量语言模型信念一致性。
提出接种提示词，在微调时显式索要不良行为以降低测试期非预期行为。
Why it was selected论文提出在训练提示词中显式要求不良行为，在四个微调场景中减少奖励作弊与谄媚的内化，同时基本保留目标能力。
Researchers from Meta FAIR and the University of Maryland propose RL-Hammer, which trains an attack model from scratch to perform prompt injection through tool outputs.
OpenAI 发布 GDPval 基准，在真实且具有经济价值的任务上评测 AI 模型能力。
提出接种提示词，训练时引出不良特征、测试时抑制失齐与后门。
Why it was selected论文用接种式提示在微调数据中前置系统指令，说明其可选择性抑制特征泛化并缓解涌现性失对齐与后门触发，为理解模型泛化提供线索。
Researchers from Nanyang Technological University propose a two-stage benign fine-tuning attack that removes safety alignment via FaaS using benign data.
Proposes JAWS-Bench, which evaluates code agents' jailbreaks and malicious code executability across three levels of workspaces.
Why it was selectedThe paper provides three workspace attack scenarios and an executability determination process, and quantifies how code context weakens refusal, which can serve as a reference when designing agent permissions and execution gating.
Propose WAInjectBench to evaluate prompt injection detection in web agents.
论文提出截断多项式分类器（TPC），作为线性探针的扩展，用于语言模型激活的动态安全监控。