Semantic-aware adversarial fine-tuning for CLIP(original, opens in a new tab)

Propose SAFT, which uses semantic description ensembles to construct adversarial examples and fine-tune the image encoder.

Red-Teaming Multimodal Reasoning: Cross-Modal Entanglement Attacks Jailbreak Vision-Language Models(original, opens in a new tab)

Proposes COMET cross-modal entanglement attack to jailbreak vision-language models.

Multi-turn Adaptive Prompt Attack against Large Vision-Language Models(original, opens in a new tab)

Proposes MAPA, a multi-turn adaptive prompt attack that alternates text and visual actions to jailbreak vision-language models.

Adversarial robustness of discrete image tokenizers(original, opens in a new tab)

提出无监督对抗微调，加固离散图像 tokenizer。

ICON：基于推理时纠正的 Agent 间接提示注入防御(original, opens in a new tab)

Proposes an inference-time defense, ICON, that detects attention over-focusing and redirects it to correct indirect prompt injection in agents.

When safety conflicts: resolving multi-category harmful conflicts in text-to-image diffusion models with adaptive safety guidance(original, opens in a new tab)

Proposes CASG to resolve direction conflicts in multi-category safety guidance for text-to-image generation.

MIDAS: Multi-Image Dispersion and Semantic Reconstruction for MLLM Jailbreaking(original, opens in a new tab)

提出 MIDAS ，把有害语义拆进多张视觉谜题并跨图重构以越狱多模态模型。

MUSE: A Run-Unit-Centric Unified Multimodal Safety Evaluation Platform for Large Language Models(original, opens in a new tab)

提出 MUSE 平台，以持久 run 评测多模态多轮越狱。

Two frames suffice: a temporal attack for jailbreaking text-to-video models(original, opens in a new tab)

Propose TFM, which uses start and end frames and implicit substitution to jailbreak text-to-video models.

Model as Lego builder: assembling malicious content from harmless blocks using a semantic blueprint(original, opens in a new tab)

Proposes StructAttack, which uses a structure graph to induce the vision model to assemble harmless semantic slots into malicious content.

Multi-Paradigm Collaborative Adversarial Attack for Multimodal Large Language Models(original, opens in a new tab)

We propose MPCAttack, which collaboratively optimizes multi-paradigm features to generate transferable visual adversarial perturbations.

Adversarial attacks against modern vision-language models(original, opens in a new tab)

Adversarial attacks on product images are applied to open-source visual shopping agents to induce incorrect purchases.

Optimizing multimodal jailbreak attacks against speech language models(original, opens in a new tab)

提出 JAMA，联合优化文本后缀与音频扰动以越狱语音语言模型。

Why it was selectedThe paper compares unimodal and jointly optimized attacks on four speech language models, showing that unimodal-only safety evaluation overestimates model robustness.

Visual Confusion Agents: Exploiting and Defending Against Perception Failures in Computer-Use Agents(original, opens in a new tab)

Propose an out-of-process dual-channel comparison classifier to intercept erroneous clicks by computer-using agents.

Understanding and Defending Against VLM Jailbreaks via Jailbreak-Related Representation Shifts(original, opens in a new tab)

提出 JRS-Rem，推理时移除图像引起的越狱相关表征偏移。

Can LLMs fool graph learning? Exploring universal adversarial attacks on text-attributed graphs(original, opens in a new tab)

Propose BadGraph, jointly perturbing the topology and node text of text-attributed graphs under black-box settings.

PDA: A Training-Free Text Augmentation Defense Framework for Adversarial Image Attacks on Vision-Language Models(original, opens in a new tab)

提出免训练文本增强防御 PDA，抵御视觉语言模型的对抗图像攻击。

XSPA: Constructing Imperceptible X-Shaped Sparse Adversarial Perturbations for Transferable Attacks Against VLMs(original, opens in a new tab)

Propose XSPA, an X-shaped sparse adversarial perturbation to transfer-attack VLMs.

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models(original, opens in a new tab)

Propose SABER, which uses a reinforcement learning attacker to rewrite instructions within a budget to make the VLA fail the task.

Jailbreaking vision-language models through the visual modality(original, opens in a new tab)

提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答。

Why it was selectedThe paper compares the success rates of visual versus text jailbreaks across six frontier VLMs and provides preliminary mitigation results for output-side guardrails.

Low-barrier jailbreak attacks against text-to-image safety filters(original, opens in a new tab)

提出自然语言提示伪装越狱，绕过文生图安全过滤器。

Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models(original, opens in a new tab)

Propose the Universal Curved Grid Patch (UCGP), which induces cross-task semantic deviations in infrared vision-language models.

Knowledge poisoning attacks against multimodal retrieval-augmented generation in healthcare(original, opens in a new tab)

提出 M3 Att，在不知查询时投毒医学多模态 RAG 并误导临床决策。

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models(original, opens in a new tab)

Propose MLingualFC, evaluating vision-language model jailbreak vulnerabilities with multilingual flowchart images.

Knowing What Not to Answer: Selective Non-Compliance in Vision-Language Models(original, opens in a new tab)

Propose the KoNA benchmark to evaluate selective non-compliance in vision-language models.

LeakageBench: Document-level leakage risk in redaction of personally identifiable information in document images(original, opens in a new tab)

Propose LeakageBench to evaluate page-level leakage in document image PII redaction.

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge(original, opens in a new tab)

Proposes KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity.

LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse(original, opens in a new tab)

Proposes LETHE, which perturbs reference images to block unauthorized image-to-video generation.

Image classifiers reportedly bypassable via artistic style descriptions(original, opens in a new tab)

X user @MinLiBuilds said that image classifiers increase defenses when encountering certain body-related descriptions, but the classifier can be bypassed after describing the content as marble sculptures, classical oil paintings, single-line drawings, or cyberpunk and other artistic styles.

WITNESS summarizes five lessons on AI deception and detection in 2025(original, opens in a new tab)

WITNESS-led Deepfakes Rapid Response Force reviewed 2025 cases and summarized five lessons: hyper-realistic long videos generated by new-generation video models such as Google Veo 3 and OpenAI Sora 2 are surpassing detection capabilities, and low-resolution, high-compression forwarding further prevents detection models from reaching conclusions. Detectors are mostly designed for faces and fail on explosions, fires, and nighttime scenes; surgical inpainting that replaces only small regions is extremely difficult to detect, while editing overlays such as blur and red circles cause false positives. Audio remains the weakest link, with low quality, background noise, and overlapping speech continuously lowering detection confidence.

How Sora 2 and the Sora app enable safe creation(original, opens in a new tab)

OpenAI is making safety foundational to Sora 2 and the Sora app, addressing the new safety challenges posed by state-of-the-art video models and a new social creation platform. Its approach is anchored in concrete safeguards.

EU Regulation Not Yet Ready for Multi-Agent AI Incidents(original, opens in a new tab)

A Tech Policy Press article points out that the draft guidelines for Article 73 of the EU Artificial Intelligence Act only cover a single agent and a single incident, making it difficult to address cascading and cumulative risks arising from multi-agent interactions. The guidelines will take effect in August this year and require deployers and providers in high-risk scenarios such as critical infrastructure to report serious AI incidents. The author cites examples of pricing algorithms in the German fuel market reacting to each other and pushing up prices, and the 2010 flash crash in which automated trading systems wiped out nearly a trillion dollars in market value within minutes, to illustrate that incidents may stem from interactions between systems rather than a single system failure. The article also mentions that Anthropic reported the largest AI agent cyberattack to date last November, in which attackers broke tasks into seemingly harmless steps for Claude to execute, and such cumulative effects would be difficult to constitute a reportable incident under the current draft. The author recommends that the guidelines explicitly include cumulative, systemic, and non-physical forms of harm, and establish third-party and anonymous reporting channels.

India bets on AI detection; regulators worldwide should watch what happens next(original, opens in a new tab)

India's IT Amendment Rules 2026 regarding synthetically generated information take effect on February 20, requiring platforms to deploy automated tools to detect whether content is synthetically generated, otherwise they may lose the safe harbor protection under Section 79 of the IT Act. Three authors from WITNESS argue that current detection tools produce inconsistent results across different file types, modalities, and contexts, with significant false positive and false negative rates, making them insufficient as a basis for legal compliance. The rules require synthetic content to carry permanent metadata but do not reference open standards such as C2PA, JPEG Trust, or ISO 22144, and each platform's self-built solutions prevent provenance data from flowing across platforms and borders. The authors compare China's September 2025 labeling measures with the GB 45438-2025 standard, the EU AI Act's draft Code of Practice on provenance and transparency, and California's AI transparency bill, advocating that provenance should be interoperable, cryptographically signed, and privacy-preserving, with obligations covering developers, deployers, and intermediaries.

Dutch court orders X and Grok to stop generating AI sexual abuse content(original, opens in a new tab)

The Amsterdam District Court ruled on Thursday that X and Grok must immediately stop generating non-consensual sexualized images and child sexual abuse material in the Netherlands, with a daily fine of 100,000 euros per defendant for non-compliance. Lawyer Karlijn Han, representing Offlimits, said the court requires Grok and X to stop offering the "undress" feature, and not only within the Netherlands. The court found that xAI's lawyers stated at the March 12 hearing that the company had implemented strict safeguards since January 20, 2026 and that Grok no longer allows such content, but evidence submitted by Offlimits showed that on March 9, the very day the defendants issued those categorical denials, a single uploaded photo could still be used to generate a sexualized video of a real person without consent verification, which gave the court reasonable doubt about the adequacy of the measures the defendants claimed. The court also noted a structural contradiction in xAI's position: it both said generating such material was no longer possible and said a 100% guarantee was technically impossible. xAI must also confirm compliance to Offlimits in writing, otherwise the same daily fine applies, and the defendants have ten working days to submit the confirmation.

Why it was selectedThe Amsterdam court's injunction places the responsibility for generated content on the model operator, and cites the EU Russmedia ruling, drawing new boundaries for platform liability.

The multilingual AI gap has not narrowed, just been repackaged(original, opens in a new tab)

The multilingual AI gap has not narrowed, just been repackaged beneath the surface of data coverage and benchmark scores. The SAHARA benchmark evaluates 517 African languages across 16 NLP tasks, confirming a significant performance gap between English and most African languages; a 2026 test found that guardrails effective in English, when moved to West African languages, saw refusal rates drop by more than half in some cases. UbuntuGuard, built by 155 experts from 6 countries, shows that English-centric benchmarks overestimate multilingual safety.

OpenAI advances content provenance to build a safer, more transparent AI ecosystem(original, opens in a new tab)

OpenAI advances AI content provenance with Content Credentials, SynthID, and a verification tool to help people identify and trust AI-generated media, aiming for a safer, more transparent AI ecosystem.

Brazil's 2026 election becomes the first real stress test for its AI regulation(original, opens in a new tab)

Brazil's October 2026 election will be the first in which generative AI tools are used on a large scale at low cost by ordinary people for political communication. A Tech Policy Press report cites the social media account Dona Maria as an example: a 37-year-old Uber driver used Google Gemini and Flow to generate this nonexistent elderly Black woman, charging $4 per video, with the account estimated to have reached 100 million people and at least 12 videos exceeding 1 million views. The AI regulatory framework passed by the Brazilian Senate at the end of 2024 still awaits review by the Chamber of Deputies. The Superior Electoral Court has had resolutions banning chatbots and deepfakes since 2024, but has not yet clarified the definition of deepfake—that is, whether any realistic AI-generated content counts, or whether it must be intended to mislead voters. Three parties in Lula's coalition have filed a lawsuit to ban the account, with the case being heard by Judge Estela Aranha. Research shows that false content in Brazil grew threefold from 2024 to 2025, and in 2025 most false content carried an ideological slant.

AI detection is built for faces, but climate disinformation targets the environment(original, opens in a new tab)

An analysis article points out that most current AI forgery detection systems are trained on face and biometric manipulation, making it hard to identify synthetic environmental content like floods, fires, and satellite imagery, while climate disinformation forges the environment rather than identity. The author cites WITNESS's deepfake rapid-response team's investigations of conflict imagery in Iran, Georgia, and elsewhere, saying multiple AI forensics teams repeatedly noted that detection tools rely on faces appearing in videos. Cases in the article include an AI-generated image of a collapsed bridge sent to Network Rail after a 2025 earthquake in northwest England, affecting 32 train services; and a video of Hurricane Melissa's eye that Grok called real on X while community notes flagged it as synthetic. UC Berkeley researchers Barrington and Farid found that a specialized classifier trained only on explosion imagery, combined with physical modeling, can significantly improve detection performance.

How AI is fueling transnational repression(original, opens in a new tab)

AI is making cross-border repression faster, farther-reaching, and easier to scale, and researchers call this practice of cross-border surveillance, intimidation, and suppression of dissidents digital transnational repression (DTR). Tools include facial recognition surveillance, predictive threat scoring and automated blacklists, as well as deepfakes that smear exiled activists. In 2025, the Chinese government was reported to have used deepfake videos to smear Rushan Abbas, founder of a Uyghur advocacy organization in the United States.

AI can reconstruct blurred faces—how should we protect the people involved?(original, opens in a new tab)

Human rights workers and media forensics experts point out that techniques such as Gaussian blur and pixelation only reduce rather than delete image information, and AI can reconstruct it; blurring is no longer sufficient to protect subjects' identities. The author used a commercial AI refocusing tool on a published blurred photo of a child, and the facial structure re-emerged, making it possible to infer age, gender, ethnicity, and similarity—even if this does not amount to restoring the real face, it weakens anonymity. Experts unanimously recommend switching to solid color blocks to fully cover faces, bodies, tattoos, license plates, and buildings; Human Rights Watch has since 2024 changed its practice to avoid capturing identifiable information from the outset, such as photographing backs, obstructions, or shadows and excluding landmarks. The article also organizes a layered anonymization approach, including first replacing the real face with an AI-generated face before blurring, downsampling, heavy compression, adding noise, expanding the coverage area, and temporal processing for video, and emphasizes that such measures can only raise the cost of re-identification—no permanent solution exists. The article mentions that in January 2026, NPR reported that internet users attempted to use AI to reconstruct partially obscured images into faces for comparison against databases.