RedBench: A General-Purpose Dataset for Comprehensive Red-Teaming of Large Language Models(original, opens in a new tab)

提出 RedBench，汇总红队数据集评测对抗提示与过度拒绝。

Containing multiple privilege escalations in LLM agent systems: a mandatory access control framework(original, opens in a new tab)

提出 SEAgent 强制访问控制框架，拦截 Agent 越权工具调用。

BenchOverflow: Measuring Output Overflow in Large Language Models with Plain-Text Prompts(original, opens in a new tab)

提出 BenchOverflow 基准测量纯文本提示诱发的输出膨胀。

How Safe Is Safe Code Generation? Adversarial Prompts Test LLM Defenses(original, opens in a new tab)

用对抗提示审计安全代码生成方法在自然语言改写后的安全与功能。

False Friends in Shell: Revealing Emoji Semantic Confusion in Large Language Models(original, opens in a new tab)

构建代码向基准，评测 ASCII 表情被误读为可执行命令。

Faithfulness vs. Safety: Evaluating LLM Behavior under Counterfactual Medical Evidence(original, opens in a new tab)

构造 MEDCOUNTERFACT，评测模型在反事实医学证据下是否仍照证据作答。

STaR: A sensitive trajectory regulation method for unlearning in large reasoning models(original, opens in a new tab)

提出推理时框架 STaR，抑制大推理模型推理轨迹中的敏感内容。

ChartAttack: Testing Large Language Models' Vulnerability to Malicious Prompts in Chart Generation(original, opens in a new tab)

提出 ChartAttack，用恶意提示驱动代码模型生成误导图表。

Are LLMs' Stated Beliefs Fragile? Probing LLM Belief Resistance with Strategic Persuasive Dialogue Interventions(original, opens in a new tab)

评测多轮策略说服下 LLM 陈述信念的抗性。

AdversaRiskQA: An Adversarial Factuality Benchmark for High-Risk Domains(original, opens in a new tab)

提出 AdversaRiskQA 评测高风险领域模型能否纠正提示中的错误事实。

When Wording Sways Evaluation: Framing Bias in LLM Judges(original, opens in a new tab)

测量 LLM 评委在谓词极性翻转下的判定不一致。

NeuroFilter: Activation-value guardrails for privacy-conscious LLM agents(original, opens in a new tab)

提出 NeuroFilter，用激活探针过滤智能体多轮隐私攻击。

TrojanPraise: Jailbreaking LLMs via Benign Fine-Tuning(original, opens in a new tab)

The paper proposes TrojanPraise, a method to jailbreak LLMs by fine-tuning on benign, review-passable data, while bypassing review models such as Llama-Guard-3.

Why it was selectedThe paper presents a benign fine-tuning jailbreak method that bypasses data review and explains its cause using the two representation dimensions of knowledge and attitude, which can help fine-tuning service providers assess filtering blind spots.

VILTA: Incorporating VLM into closed-loop training to improve driving policy robustness(original, opens in a new tab)

提出 VILTA，在闭环训练中用 VLM 编辑邻车轨迹以提升驾驶策略鲁棒性。

Insider knowledge: How much can RAG systems gain from evaluation secrets?(original, opens in a new tab)

测量 RAG 系统利用评测秘密抬高自动评测分数的程度。

OI-Bench: An option injection benchmark for evaluating LLM susceptibility to instruction interference(original, opens in a new tab)

构建 OI-Bench，评测 LLM 对选项注入式指令干扰的易感性。

SycoEval-EM: Evaluating Large Language Model Sycophancy in Simulated Emergency Clinical Scenarios(original, opens in a new tab)

构建 SycoEval-EM，评测模拟急诊多轮问诊中的谄媚顺从。

MalURLBench: A benchmark for evaluating agent vulnerabilities when processing web URLs(original, opens in a new tab)

提出 MalURLBench 评测 Agent 是否接受结构伪装的恶意 URL。

Attributing and Exploiting Safety Vectors in Large Language Models via Global Optimization(original, opens in a new tab)

提出 GOSV，全局优化定位安全注意力头并在推理时重贴激活越狱。

Proactively hardening LLM defenses with HASTE(original, opens in a new tab)

提出 HASTE，挖掘 hard negative 再训练恶意提示检测器。

AttenMIA: Membership Inference Attacks on LLMs Using Attention Signals(original, opens in a new tab)

提出 AttenMIA，用注意力信号做白盒成员推断。

Unknown Unknowns: Can Hidden Intents in LLMs Escape Detection?(original, opens in a new tab)

构建隐匿意图测试床，压力测试分类器与 LLM 裁判。

Why it was selectedThe paper uses a controlled testbed to quantify the precision collapse of hidden intent detection at low prevalence, providing an empirical reference for the capability boundaries of auditing methods.

CAR-bench: Evaluating LLM Agents' Consistency and Capability Boundary Awareness under Real-World Uncertainty(original, opens in a new tab)

提出 CAR-bench，评测车载多轮智能体的一致性与限度意识。

Just Ask: Curious Code Agents Reveal System Prompts of Frontier LLMs(original, opens in a new tab)

提出 JustAsk，用在线技能选择提取模型系统提示词。

Stay in Character, Stay Safe: A Dual-Loop Adversarial Self-Evolving Framework for Safe Role-Playing Agents(original, opens in a new tab)

提出 DASE，以对抗自演化知识库在推理时加固角色扮演抗越狱。

Statistical estimation of adversarial risk of large language models under Best-of-N sampling(original, opens in a new tab)

提出 SABER，用小预算观测外推 Best-of-N 越狱风险。

ReasoningBomb: A Covert Denial-of-Service Attack Inducing Pathologically Long Reasoning in Large Reasoning Models(original, opens in a new tab)

提出 ReasoningBomb，用强化学习生成短提示诱导推理模型病态长推理。

Why it was selectedThe paper treats the reasoning time of reasoning models as an attack surface and quantifies the effect of short prompts in amplifying reasoning cost, which can help deployers assess service cost risk.

Safer by Diffusion, Broken by Context: The Safety Dividend and Failure Modes of Diffusion LLMs(original, opens in a new tab)

提出黑盒 context nesting，用结构化补全任务嵌套有害请求越狱扩散 LLM。

Filtering the Noise: A Comparative Study of LLM Agents in Vulnerability False Positive Filtering(original, opens in a new tab)

评测代码 Agent 过滤静态告警误报的能力。

Personality latent variables in large language models: a mechanistic explanation of emergent misalignment and conditional safety failures(original, opens in a new tab)

用性格潜变量与表征投影解释涌现失配和条件失效。

Why it was selectedThe paper explains emergent misalignment as personality representations acquired through fine-tuning, and uses incorrect-advice data as a control, showing that personality-conditioned data produces stronger and more transferable misalignment.

Syntax- and Compilation-Preserving Evasion Attacks on LLM Vulnerability Detectors(original, opens in a new tab)

The paper proposes attack methods that evade LLM vulnerability detectors while preserving syntax and compilation.

Why it was selectedThe paper uses syntax- and compilation-preserving code transformations to quantify the robustness gap of LLM vulnerability detectors despite high scores on clean benchmarks, providing a reference for teams deploying detection gates.

Jailbreaking LLMs via Calibration(original, opens in a new tab)

提出 Gradient Shift 推理时聚合，把对齐模型拉回被抑制行为。

GradingAttack: Revealing Security Vulnerabilities in LLM-Based Educational Grading Agents(original, opens in a new tab)

提出 GradingAttack，用梯度后缀与角色扮演操纵教育评分智能体判定。

Enhancing jailbreak attacks and defenses from a causal perspective(original, opens in a new tab)

Propose Causal Analyst, which rewrites prompts according to causal features to enhance jailbreaks.

Towards Universal Transferable Jailbreak Attacks for Vision-Language Models(original, opens in a new tab)

提出 UltraBreak，用单张对抗图像对视觉语言模型实施可迁移越狱。

Zero2Text: Training-Free Cross-Domain Text Embedding Inversion Attack(original, opens in a new tab)

Propose Zero2Text, which inverts text embeddings across domains without training.

Efficient Adversarial Attacks on High-Dimensional Offline Bandits(original, opens in a new tab)

Propose three types of attacks that perturb the reward model before training to hijack offline bandits.

An empirical study on noisy data and LLM pretraining loss divergence(original, opens in a new tab)

Analyze the impact of controlled uniform random noise on pretraining loss divergence.

Steering Externalities: Benign Activation Steering Inadvertently Increases Jailbreak Risk in Large Language Models(original, opens in a new tab)

分析良性激活转向如何削弱拒绝并放大越狱风险。

Safety evaluation is like a coin toss: LLM judges cannot reliably measure adversarial robustness(original, opens in a new tab)

慕尼黑工业大学、Mila 等机构的研究者审计安全裁判在对抗分布偏移下衡量鲁棒性的可靠性。