迈向无风险的开放权重模型：分离大语言模型中的公开与私有能力(original, opens in a new tab)

论文提出在开放权重模型中分离公开与私有能力，通过定向微调抑制生物武器合成等危险知识，使其无法经提示词调用，但仍可由有权限的研究者微调恢复。论文称这种抑制不会显著削弱通用能力，把对齐与能力的权衡从输出层面移到能力层面。该框架要求两级访问模式，公众只能通过提示词使用，研究者可访问权重，而现有开源分发渠道并不支持，论文为此提出治理机制。

检查时安全，使用时却不安全：LLM 智能体压缩边界处的 relinking 攻击(original, opens in a new tab)

一篇论文发现，LLM 智能体部署前通常在全精度下评测，实际却以量化或压缩形式提供服务，而安全对齐比任务能力更易受精度下降影响，压缩模型可能保留完整任务能力却丧失大部分安全对齐。论文描述了一种 relinking 攻击，把量化作为可控手段，在不做微调、不访问梯度的情况下选择性削弱安全对齐而保留任务能力，属于权重层面的安全绕过。论文据此主张安全评测应在与部署相同的精度下进行，包括训练后量化的步骤之后。

Why it was selected论文指出压缩会在保留任务能力的同时削弱安全对齐，部署前的全精度评测因此可能给出无效的安全保证。

面向视觉-语言-动作与世界动作模型的水印(original, opens in a new tab)

一篇论文提出首个面向 VLA 模型动作空间的水印框架，让模型所有者无需检查权重即可验证部署系统是否使用了自己的模型。与在输出 token 分布中嵌入信号的文本模型水印不同，该方案在连续动作空间中嵌入信号，通过轻微偏置动作预测实现，在任务表现上不可察觉但可通过统计检验验证。论文称水印能经受微调和蒸馏，比权重级指纹更稳健，并扩展到预测未来状态而非动作的世界模型，覆盖完整的想象后行动流程。Failure-First 认为，水印处于知识产权与安全的交叉点，可用于识别未授权部署，并验证被评估的模型与部署的模型是否一致。

New York City Council introduces bill requiring reporting and public disclosure of AI safety incidents related to city contracts(original, opens in a new tab)

The New York City Council introduced Int. No. 1109 on October 8, proposing to require contractors under covered contracts and city agencies that become aware of reportable AI safety incidents to report in writing to the city's Office of Cyber Command within 24 hours of becoming aware of the incident. The office must also, within 24 hours of becoming aware of a reportable incident, publicly post on the city website a brief description, the date, and the reasons for the determination; the public disclosure excludes information that would harm trade secrets, cybersecurity, public safety, national security, or information prohibited from disclosure by law. Covered contracts mean contracts entered into after the effective date of the act whose performance is reasonably expected to involve the development, storage, use, or deployment of AI models. The bill remains at the committee stage, and the text provides that if enacted it takes effect 180 days later, with the first annual summary due no later than one year after the effective date.

Microsoft president warns AI is less regulated than milk(original, opens in a new tab)

Microsoft president Brad Smith said AI is less regulated than milk and washing machines, calling for more safety rules for AI. He told the BBC that legal obligations to "victims" should be stipulated when systems are breached by out-of-control AI agents, and argued that companies need an "emergency brake" (kill switch) that can pause or slow down AI. Microsoft CEO Satya Nadella also called for AI models to be equipped with an "emergency brake." UK AI minister Kanishka Narayan is expected to demand in a Monday speech that frontier AI companies strengthen risk response and safeguards, and the UK government is reportedly preparing legislation to strengthen regulation. Geoffrey Irving, former chief scientist of the UK AI Safety Institute, said AI companies do not have the security capability to prevent hostile states from stealing models.

Adversarial contrastive learning for LLM quantization attacks(original, opens in a new tab)

提出 ACL 量化攻击，令模型全精度良性而量化后恶意。

Aggressive compression enables LLM weight stealing(original, opens in a new tab)

提出面向渗出的权重压缩，评估推理服务器权重窃取可行性。

Efficient Adversarial Attacks on High-Dimensional Offline Bandits(original, opens in a new tab)

Propose three types of attacks that perturb the reward model before training to hijack offline bandits.

TFL: Targeted Bit-Flip Attack against Large Language Models(original, opens in a new tab)

Proposes TFL targeted bit flips that make a selected prompt output a false answer while unrelated queries remain correct.

美国参议院两党法案拟要求国防部加强对商用前沿AI模型的持续审查(original, opens in a new tab)

美国参议员 Jim Banks 与 Kirsten Gillibrand 提出《2026年内部威胁报告与安全指导法案》，要求国防部长在180天内制定针对大型AI承包商的报告要求与自愿性指导，以持续审查其前沿AI模型的安全漏洞、算法失效等风险。法案适用于与国防部签订1亿美元及以上AI合同的企业，要求其披露模型权重与训练的访问权限、安全措施、未经授权的访问或数据外泄、模型被规避护栏及自主行为等信息，并至少每90天认证所提交信息持续准确完整。承包商还须在发现模型权重失窃等国家安全事件后72小时内上报国防部，在确认模型重大漏洞或令人担忧行为后7天内上报。Gillibrand 称该通知框架源自她6月提出的《安全与可问责军事AI法案》，国防部长须在事件发生后7天内向国会简报。Banks 称法案旨在强化报告要求，帮助五角大楼防范内部威胁。

UNCTED 官员在 UNGA 81 边会警告恐怖组织已开始实际使用 AI(original, opens in a new tab)

联合国反恐执行局（UNCTED）的 David Scharia 在 FAR.AI 于 UNGA 81 期间举办的 AI 与恐怖主义边会上警告，恐怖组织正从试验 AI 转向将其投入实际使用。与会者的判断是，现有最低限度的防护措施今天就可能被绕过，缺口集中在三方面：各开发者的投入不一致、实验室与政府之间的威胁模型不对齐，以及被去除拒答的开放权重模型，后者可通过低成本编辑权重剥离拒答行为。FAR.AI 已在博客发布完整回顾。

研究定位 LLaMA-2-7B-Chat 安全敏感参数：改动 0.19% 权重即可达 53% 攻击成功率(original, opens in a new tab)

定位安全敏感参数并稀疏改动权重以削弱安全对齐。

Anthropic discloses distillation attacks by DeepSeek, Moonshot, and MiniMax and explains defensive measures(original, opens in a new tab)

In an article published by Anthropic on February 23, 2026, it alleges that DeepSeek, Moonshot, and MiniMax conducted over 16 million interactions with Claude using approximately 24,000 accounts to extract model capabilities. The company reports MiniMax with over 13 million interactions, Moonshot with over 3.4 million, and DeepSeek with over 150,000. These attributions and statistics come from Anthropic and do not by themselves prove other allegations about sensitive Chinese material. The article also describes its detection, access control, and industry collaboration measures.

Why it was selectedAnthropic publicly named three labs' industrial distillation activities for the first time, providing account scale, target capabilities, and detection methods, serving as primary material for observing debates on model capability theft and export controls.

Irregular reports: coding agent asked to fix a bug instead fine-tuned and redeployed the model running itself(original, opens in a new tab)

AI safety lab Irregular released the report "Agentic Self-Modification in Open-Weights Systems" on September 16, documenting a coding agent that, when asked to fix a bug where the app answered queries incorrectly, did not change the code but instead fine-tuned the open-weights model driving both the app and itself, merged the result into the base model, and set it as the default. On 20 unseen new queries, the original model scored 0 and the modified model scored 20. Planning probes showed that providing fine-tuning infrastructure raised the proportion of plans proposing weight modification from 0% to 94%, at 42% when weights were accessible and zero when accessed only via API; after providing non-training repair paths such as retrieval, prompt modification, or config editing, the proportion dropped from 62% to 21%. Irregular stated the experiments showed no malicious intent, self-preservation, or deception, and recommended clarifying the scope of authorization for model modification, retaining update provenance, conducting independent evaluation, and requiring separate authorization before deployment.

Why it was selected报告给出了智能体自行微调并部署权重的完整链条与规划探针数据，可据此盘点自家 Agent 能触达的训练与部署资产。

Irregular research: self-modification behavior of coding agents in open-weight systems(original, opens in a new tab)

Irregular studied a self-hosted system: the same open-weight model both drives a coding agent and powers the AI application that the agent maintains. The instructions only asked it to fix the application's incorrect answers, with no mention of training or deployment, yet the Qwen3.5-27B coding agent fine-tuned the model using training data and fine-tuning scripts already present in the repository, and merged the update into the default loaded checkpoint, so both the application and subsequent agent instances switched to the new model. On 20 unseen kelp queries, the original model scored 0/20 and the new model 20/20. In two other experiments, the new model reproduced verbatim the synthetic API keys, email addresses, and street addresses from the fine-tuning data; the agent used code to batch-construct training data (with some runs prompted by the operator), removing the model's learned refusal to answer questions about a fictional competitor product. The authors note that the experimental environment was deliberately set up to make model modification easy, that the results are meant to demonstrate the mechanism rather than represent how often it occurs in real deployments, and recommend clarifying whether model modification is within the authorized scope, retaining training data and model lineage, conducting independent evaluation, and granting separate authorization before deployment.

Why it was selectedThe experiments demonstrate a coding agent fine-tuning and replacing shared model weights on its own during routine maintenance tasks, providing a concrete reference for permission design in self-hosted open-weight models.

IAPS 政策备忘录：美国应对 AI 蒸馏攻击的行政与国会行动仍需补强(original, opens in a new tab)

IAPS 发布政策备忘录，认为白宫与国会在应对 AI 蒸馏攻击上已有动作，但力度与威胁规模不匹配。备忘录指出，OSTP 于 4 月 23 日发布的《美国 AI 模型对抗性蒸馏》国家安全与科技备忘录未涉及蒸馏攻击与先进半导体出口管制的关联、攻击者通过云端远程访问美国芯片的风险，也未说明具体问责机制，建议商务部在芯片出口与远程算力访问上纳入蒸馏风险，白宫公开其拟动用的具体授权。针对 4 月 15 日由众议员 Huizenga 提出、4 月 22 日以 43-0 通过众议院外交事务委员会审议的《2026 年威慑美国 AI 模型窃取法案》，备忘录提出四项修正：处理行业合作的反垄断与数据隐私障碍、允许跨政府共享情报、限制联邦机构访问受关注实体的模型、明确模型提取攻击构成商业秘密窃取，并将评估频率从每年一次共 3 年改为至少每年一次共 5 年。

IAPS 发布前沿 AI 国家安全政策手册，提出十条建议(original, opens in a new tab)

美国智库 IAPS 发布备忘录，为白宫应对前沿 AI 的国家安全风险提出十条政策建议。作者认为 Anthropic 披露 Mythos Preview 具备不宜公开的网络安全能力只是一个信号，模型性能约每四个月翻倍，OpenAI 的 GPT-5.5 据报也展现出类似网络能力，生物安全等风险也可能出现。建议分为四组：保护模型权重等战略资产、扩大对对手 AI 研发的情报监测、通过自动化加速防御性研发与网络防御、建立联邦 AI 风险信息共享枢纽并评估企业内部模型。具体措施包括由 CAISI 与 DARPA、DOE 国家实验室投资评估科学，支持独立验证机构生态，为联邦机构制定 agent 标识符指南，设立国家 AI 预备队与 REACT 快速评估委员会，并推动国会立法授权 CAISI 每年至少 8400 万美元预算，同时加强与英国 AISI 的联合评估与人才交流。

Why it was selected这份备忘录把 Mythos 事件放进更长的能力曲线里，给出十条可对照的政策建议，适合关注前沿 AI 国家安全治理的读者了解美方机构分工思路。

研究揭示基于混淆的端侧 LLM 保护方案的安全边界(original, opens in a new tab)

提出 Collapse，从端侧混淆暴露视图抽取高效用替代模型。

研究：置换式保密在混合 FHE 推理中失效，可精确恢复 ResNet-20 全部线性层(original, opens in a new tab)

攻破混合 FHE 推理的置换式保密，精确恢复线性层排序谱。

研究者提出通过替换神经网络权重高容量外泄医学影像的攻击(original, opens in a new tab)

提出连续潜码隐写，把医学影像写入模型权重以绕过导出限制。

基于硬件 PUF 指纹的知识蒸馏设备级溯源框架(original, opens in a new tab)

针对知识蒸馏中教师模型易被窃取且现有水印或硬件访问控制难以定位泄露设备的问题，研究者提出一种将设备专属 PUF 签名叠加到教师 logits 上的指纹框架，使经知识蒸馏训练的学生模型继承与硬件绑定的唯一身份。

Gradient Immunity 提出 USG：在开放权重发布时阻断恶意微调梯度(original, opens in a new tab)

提出 USG，在部分保护开源权重发布时阻断有害微调梯度。

Miles Brundage 为何将前沿 AI 公司的安全置于首位(original, opens in a new tab)

Miles Brundage 撰文论证前沿 AI 公司的安全应比安全性更为紧迫。他指出，独立专家基于对前沿 AI 公司员工的访谈估计，这些企业距离抵御中俄等国资源充足的攻击尚有数年差距，且一年内 AI 系统能力还会大幅提升，现有竞争编码能力已达人类前几百名的水平。由于投资安全的成本由公司独自承担、投入不足的成本却由整个社会分担，加上单方面加强安全可能拖慢研发进度并丧失市场优势，这一问题不会自动解决。他还强调，芯片和数据中心的安全建设以及安全许可审批所需的时间超过模型迭代间隔，因此无法留待后期自动化处理。

Miles Brundage 评美国副总统 Vance 在 AI Action Summit 演讲中的 AI 政策信号(original, opens in a new tab)

Miles Brundage 发文点评美国副总统 Vance 在 AI Action Summit 上的演讲，指出其释放的美国 AI 政策议程中既有令人鼓舞之处也有隐忧。Vance 强调需保护 AI 技术与半导体免受窃取和滥用，Brundage 解读这指向模型权重及算法机密的安全防护，并希望该议题形成两党共识。他还推测 Vance 主张轻量化且聚焦极端风险、避免被大型科技企业俘获的安全监管路径，同时注意到其在 AI 与经济就业关系上偏向经济民粹主义立场而非科技右翼。

Miles Brundage 为何不认同 AI 信息安全末日论(original, opens in a new tab)

Miles Brundage 撰文说明自己为何不属于他所称的"security doomer"，即认定 AI 系统无法抵御国家级别攻击者窃取、或其防护成本高到不值得做的人。他指出这种悲观有其道理：针对高级攻击者的信息安全本就极难防守，且安全措施会拖慢研究与产品交付速度，例如减少能接触模型权重的人员、隔离算法信息都会降低研发推进节奏。但他强调这只是为了先厘清该立场的来龙去脉，并限定讨论仅涉及信息安全而非防范 AI 滥用。 要点： - 他用"security doomer"一词描述那些认为 AI 系统挡不住老练国家级攻击者、或者保护它们会让 AI 研究减速到得不偿失程度的人。