Open-MMUnlearning 发布：统一多模态大模型遗忘方法与评测框架(original, opens in a new tab)

提出统一框架评测多模态大模型的遗忘方法。

CARE：为视觉-语言-动作模型推理加速提供认证式选择(original, opens in a new tab)

提出 CARE，离线认证 VLA 加速配置的回合级失败风险并选出最快合格候选。

OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型(original, opens in a new tab)

提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向。

WebMirage hijacks visual web agents' browser operations with adversarial images(original, opens in a new tab)

提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作。

Why it was selected论文把视觉红队建模为从视觉定位到浏览器执行的端到端过程，展示了该攻击在多种 Agent 配置下的成功率与现有防御的覆盖情况。

研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率(original, opens in a new tab)

提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败。

SOUL：用稀疏特征策略遗忘缓解 VLA 模型的状态幻觉(original, opens in a new tab)

提出 SOUL 稀疏特征策略遗忘，缓解 VLA 状态幻觉。

研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制(original, opens in a new tab)

提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱。

P-VMI：对抗图像经 KV cache 持续影响多轮对话(original, opens in a new tab)

ServiceNow AI Research 等机构的研究者提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出。

Why it was selected论文证明对抗图像的影响可在图像被遮蔽后仍留在 KV cache 中，为评估缓存复用与上下文压缩的安全性提供了新的攻击面。

西班牙 AEPD 就市政视频监控面部识别功能向市政府发出警告(original, opens in a new tab)

西班牙数据保护局（AEPD）就一份市政视频监控系统采购文件向某市政府发出警告，该文件的技术规格明确要求录像设备具备面部检测与识别功能。AEPD 指出，这些功能可能构成基于 AI 的图像分析乃至唯一身份识别处理，但现有文件无法确定功能是否会被实际启用，也无法确定是否会生成生物特征模板或向量、进行 1:1 或 1:N 比对。AEPD 要求该市政府在系统投入使用前，逐项评估每项 AI 功能对具体目的是否必要且相称，确保非必要功能默认关闭，并针对面部识别系统、参考图像库、比对流程、匹配阈值、误报漏报及人工介入等开展数据保护影响评估。若面部识别用于唯一身份识别，还须适用 RGPD 第 4.14 条和第 9 条关于生物特征数据的强化规则。AEPD 表示，若未采取必要措施，可能启动调查或包括处罚在内的纠正程序。

Nikon 小世界显微视频获奖作品被指含 AI 生成结构，主办方称正重新审查(original, opens in a new tab)

Nikon 表示正在重新审查新加坡国立大学光学工程师 Ning Xu 提交的参赛信息，其作品此前获得第 16 届 Small World in Motion 显微摄影比赛冠军。据 Nature 报道，该视频展示一名原发性纤毛运动障碍患儿肺组织样本中纤毛的运动，纤毛下方出现无法辨认的红、蓝、紫结构。佛罗里达大学生物工程研究者 Edward Phelps 在 LinkedIn 指出，紫色结构类似线粒体，但细胞核大小的细胞外线粒体构成的这种上皮下结构在生物学上并不存在；UT Southwestern 博士生 Ian Donovan 则指出视频带有 Google DeepMind 推出的 SynthID 水印。Nikon 此前更新获奖博文，说明后期处理与可视化流程中使用了无监督神经网络方法，以区分并可视化灰度数据中的特征。

尼康 Small World in Motion 显微视频冠军作品遭 AI 质疑，主办方复审(original, opens in a new tab)

尼康正复审第 16 届 Small World in Motion 显微视频比赛冠军作品，该作品由当时任职清华大学的徐宁创作，拍摄一名原发性纤毛运动障碍（PCD）患儿气道纤毛的异常搏动。有评论者指出视频含 SynthID 水印、部分生物结构行为异常，徐宁回应称 AI 未用于生成实验影像或纤毛运动，仅用于后期对灰度重建数据着色，并称正在准备更详细的光学系统说明与纤毛运动定量分析。

研究：多向量视觉文档索引可被反演还原页面内容(original, opens in a new tab)

提出流匹配逆向框架，从多向量视觉文档索引重构页面。

Why it was selected论文给出多向量视觉文档索引可被反演的具体成功率与两种廉价防护的失效边界，运营向量库的团队可据此重新评估索引的敏感级别。

vLLM multimodal cache has a desynchronization vulnerability, fixed in 0.28.0(original, opens in a new tab)

vLLM's multimodal mirror cache can become desynchronized after a request is rejected: the frontend believes the media is cached, while the engine side has not received the payload, and subsequent requests reusing the same media hash trigger an engine assertion and cause denial of service. The issue involves the default lru multimodal cache. The fix binds frontend cache commits to request admission and isolates receiver-side errors to individual requests. The GitHub announcement marks affected versions as < 0.28.0 and the fixed version as 0.28.0.

Why it was selectedThe announcement provides the complete trigger chain and affected versions for vLLM's multimodal cache desynchronization vulnerability, allowing teams running self-hosted inference services to determine whether they need to upgrade or add protections.

vLLM discloses remote denial-of-service vulnerability due to insufficient input validation in multimodal processors(original, opens in a new tab)

vLLM's multimodal requests can pass insufficiently validated processor parameters to image and video processors, leading to excessive resource allocation, memory exhaustion in the shared serving process, and interruption. The issue involves processors such as Isaac, InternVL, H2OVL, and shared input boundaries; deployments without an external authentication layer may be triggered by unauthenticated clients. Maintainers fixed this by rejecting request-level processor overrides by default, requiring trusted clients to explicitly enable them. The advisory states that this request-level field was introduced in v0.7.3, with the fixed version being 0.31.0.

Why it was selectedThe vLLM multimodal processor has a remote denial-of-service path, and deployers need to assess the actual protection provided by the API key and the external authentication layer.

vLLM discloses remote code execution vulnerability under dynamic processor configuration(original, opens in a new tab)

vLLM's dynamic auto_map.AutoProcessor path has a remote code execution risk: when the operator enables --trust-remote-code, and an attacker can control a revision of the served model repository, a request can cause the service to import the processor Python code for that revision. The server also needs to be able to fetch or have cached that revision; the default trust_remote_code=False is not affected. The advisory notes that /tokenize is not protected by vLLM's API-key routing authentication and requires additional access control. The GitHub advisory marks affected versions as >= 0.7.3, < 0.31.0, with the fix in version 0.31.0.

Why it was selectedThe advisory gives the affected configurations, the unauthenticated endpoint, and a CVSS score of 9.8, which teams deploying vLLM multimodal services can use to review their own configurations.

Futurism investigation: large numbers of AI-generated violent child abuse videos on Facebook are not being taken down(original, opens in a new tab)

Futurism 调查发现，Facebook 上大量账号持续上传 AI 生成的暴力虐童视频，Meta 未能有效清理。这些视频描绘婴儿和幼儿被殴打、烧伤、关进冰柜等场景，往往获得数千甚至数万次互动，部分评论者并未意识到内容为合成。Meta 回应称对真实或 AI 生成的儿童身体伤害内容有严格规则并已删除相关视频，但其针对儿童暴力内容的政策未明确 AI 生成内容是否属于豁免范围。Futurism 向 Meta 举报了 8 个分享此类视频的账号，最终仅 2 个被删除，其中一个最初还被判定不违规，处置时间超过一周；记者标记给 Meta 公关团队的视频多数被删除，但仍有部分留存。Futurism 称其粗略测试显示 Anthropic 的 Claude 能评估视频中是否包含针对儿童的暴力画面，而 Meta 自身似乎也已部署可识别此类视频的系统。

Why it was selected调查通过举报测试暴露平台审核响应缓慢，从事内容审核的团队可借此了解真实举报流程的处置差距。

Google 上线 SynthID 验证网站，可识别 AI 生成图像、视频与音频(original, opens in a new tab)

Google 推出 SynthID 验证网站，任何人都可上传图像、视频或音频，检测其是否由 AI 生成。该工具此前仅向部分记者、媒体从业者和研究人员开放测试，现面向公众开放，支持 JPG、PNG、MP4、MOV、WAV、MP3 等格式。SynthID 已用于 Nano Banana、Veo、Lyria 及 Gemini、Flow、ProducerAI、Vids 等生成工具，OpenAI、Nvidia、Kakao 也已支持，Google 称目前每天收到 100 万次内容验证请求。

Scale AI and Elorian release HSS benchmark, finding multimodal models' intuitive visual reasoning far below humans(original, opens in a new tab)

Scale AI and Elorian jointly released the Humanity's Sixth Sense (HSS) benchmark for evaluating intuitive visual reasoning, containing 522 open-ended tasks across 288 images and 234 videos (17.6 hours total). Human participants achieved 93.1% accuracy, the strongest model GPT-6-astra only 53.6%, and the median model 30.9%; after removing images or videos, GPT-6-astra dropped to 6.6%. The evaluation covered 25 multimodal models from 8 vendors, with models consuming an average of 4,046 reasoning tokens per question; increasing reasoning effort actually decreased performance in some subdomains, such as GPT-6-astra dropping 14 points from high to xhigh on retrodiction. Of 8,573 failures, 94% stemmed from perception or latent inference, only 5% from logical errors, with the leading causes being missing key visual cues (21%) and misidentifying objects, people, or characters (20%).

举报热线：AI 正被用于制作青少年性化深度伪造内容(original, opens in a new tab)

加拿大举报热线接到报告，AI 正被用于制作青少年性化深度伪造内容。该热线将此类内容纳入其受理范围，相关举报涉及未成年人。

安全动作不等于可行动作：VICS-G 为 VLA 策略做可行未来解码(original, opens in a new tab)

提出 VICS-G 可行未来解码，重排冻结 VLA 策略的动作候选。

研究给出潜空间图像水印的鲁棒性上限理论分析(original, opens in a new tab)

分析潜空间图像水印对像素扰动的内在鲁棒性上限。

STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击(original, opens in a new tab)

提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动。

IAU-FOA: A Transferable Adversarial Attack Method for Closed-Source Multimodal Large Models(original, opens in a new tab)

Proposes IAU-FOA, which constructs transferable image perturbations to induce multimodal models to output target semantics.

研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因(original, opens in a new tab)

遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联。

研究受控拆解图像到文本越狱中图像属性的作用(original, opens in a new tab)

固定有害指令，单轴归因图像到文本越狱的图像属性。

超越线性表征假设：KANSteer 用非线性激活引导文本到图像模型(original, opens in a new tab)

提出 KANSteer，用非线性激活引导拟合文生图有序概念轨迹。

研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器(original, opens in a new tab)

研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。

DIBench: A Safety Benchmark for Decision Integrity in Multi-Candidate Selection by Mobile GUI Agents(original, opens in a new tab)

Researchers at Hong Kong Polytechnic University use DIBench to evaluate the decision integrity of mobile GUI agents after UI injection.

Why it was selectedDIBench uses paired evaluation to quantify the decision integrity of mobile GUI agents separately and provides concrete data showing that completion rates overestimate trustworthiness.

论文提出针对手语翻译与儿童安全过滤交叉地带的部署前审计框架(original, opens in a new tab)

提出手语转文本接入儿童安全过滤的部署前审计协议。

研究者发布视频世界模型物理一致性基准 World Models' Last Exam in Physics(original, opens in a new tab)

提出 World Models' Last Exam 评测视频物理一致性。

亚利桑那上诉法院因 AI 受害者视频撤销钱德勒路怒案量刑(original, opens in a new tab)

亚利桑那州上诉法院撤销了 Gabriel Horcasitas 因 2021 年钱德勒路怒枪杀案被判的 10 年半刑期，理由是量刑法官受到一段 AI 受害者视频的影响。该视频由受害者 Christopher Pelkey 的家人用一段旧录像、一张照片和 Pelkey 姐姐撰写的脚本生成，并在量刑时播放。量刑法官当时表示他“很喜欢这个 AI”，并提到 Pelkey 的 AI 陈述表达了“明显的宽恕”。上诉法院认为这段 AI 视频使量刑法官产生偏见，导致判决从根本上不公，因此维持过失杀人定罪，但撤销刑期并发回重新量刑。

DrivingBench 发布：让视觉语言模型驾驶丰田 Corolla 绕桩(original, opens in a new tab)

提出 DrivingBench，评测通用视觉语言模型能否闭环驾驶真车。

RA-Det：利用鲁棒性不对称检测 AI 生成图像(original, opens in a new tab)

提出 RA-Det，利用鲁棒性不对称检测 AI 生成图像。

研究：视觉语言模型在协作任务中很少主动表达指代不确定性(original, opens in a new tab)

研究视觉语言模型在协作中能否表示并说出指称不确定性。

Potts 律所请求美国联邦司法小组合并 Grok 涉未成年人性化图像诉讼(original, opens in a new tab)

Potts 律所向美国司法小组 multidistrict litigation（JPML）提出动议，请求将全美多起指控 xAI 的 Grok 生成描绘未成年人的性化图像的联邦诉讼集中到一个联邦地区法院进行协调预审。律所称这些案件涉及 Grok、xAI 在系统开发、设计、护栏、警示与监督方面的重叠事实与法律问题，集中审理可避免裁决不一致、减少重复取证与动议。案件名为 In Re: Artificial Intelligence Minor Sexual Exploitation Litigation，案号 1:26-P-49。JPML 将裁定是否符合合并审理条件以及协调程序在何地进行。

Researchers propose Privacy-Leaking Watermarks, which can leak conversation privacy in local multimodal models(original, opens in a new tab)

提出 PLW，用微调把先前对话敏感触发编码进后续生成图像。

Mistral releases 1T parameter multimodal model Mistral Large 4, currently only available with guardrailed interface(original, opens in a new tab)

Mistral AI released Mistral Large 4 (ML4), a 1 trillion parameter multimodal model. Weights are not open for now, accessible only via a public API with guardrails, with plans to open the weights within three weeks after safety testing is completed. The model was trained entirely on Mistral's own compute, using only 4,000 Nvidia GPUs, which the company says is two to three times fewer than Chinese competitors. ML4 focuses on optimizing scenarios such as cybersecurity, finance, and chip design; benchmark results have not yet been published.

Agora 审计欧盟 27 国议员遭深度伪造色情暴露情况(original, opens in a new tab)

Agora Digitale Transformation 的早期研究考察欧盟各国议员受到性化深伪内容影响的情况。机构报告称，在研究涉及的 5,872 名各国议员中，147 人被相关内容描绘或关联，其中 138 人为女性、9 人为男性。这与后续针对欧洲议会议员的 50 人统计属于不同研究群体。

Why it was selected这份审计覆盖欧盟 27 国 5872 名现任议员，量化了深度伪造色情内容的暴露分布与执法落差，可供治理讨论参考。

GhostCommit research demonstrates trust boundary risks between image content and AI code review(original, opens in a new tab)

The ASSET research group reports GhostCommit, discussing the risk that untrusted instructions in images are not identified by code review tools and subsequently affect coding agent behavior. The study notes that the same underlying model may perform differently across different product environments. The results come from the authors' controlled tests and code review surveys; no real victim incidents were reported, and individual test results cannot be generalized to all product configurations being affected.

Why it was selected研究显示同一模型在不同编码工具下对图片载荷的反应截然相反，说明决定结果的是工具外壳而非模型本身。

研究显示 VLA 模型文本护栏漏检隐含危害指令，最高 95% 任务完成且无告警(original, opens in a new tab)

评测文本守卫与激活探针能否拦住机器人隐含伤害指令。