Conference research

A two-stage framework: first uses scenario-based rewriting to conceal malicious intent, then uses hidden-state guidance for fine-grained editing to shift internal representations from malicious to benign; attack success rate improves by up to 37.74% over the strongest baseline, with good transferability.

Proposes a closed-loop framework of attack, evaluation, distillation, and reuse, accumulating effective experience with a three-level strategy library and avoiding known failures, significantly outperforming existing baselines in black-box jailbreak experiments.

Proposes ARG-Attack, which learns universal perturbations with an asymmetric relational geometric objective, significantly improving black-box transferability while maintaining competitive white-box attack effectiveness.

Constructs AJailBench containing 1,495 adversarial audio prompts and uses an audio perturbation toolkit to generate optimized variants. Evaluation shows no model exhibits consistent robustness, and small perturbations can significantly reduce safety.

Using a weaker model to simulate reasoning and iteratively attacking based on reasoning patterns leaked by the target's refusals, it achieves near-100% attack success rates across multiple reasoning models and benchmarks.

Proposes a multi-turn red-teaming method, TRIAL, which wraps harmful requests in the model's own ethical reasoning to achieve a high attack success rate, and proposes the ERR defense framework.

Proposes a watermark stealing method combining positional imprint construction and dynamic attack perspective selection, significantly improving stealing efficiency under the same experimental conditions.

Models jailbreak as heterogeneous strategy combination search and uses relevance-aware metrics to suppress false success caused by irrelevant responses, improving attack success rate and transferability across multiple models.

On three reasoning models, value conflicts and dilemma choices significantly increase attack success rate; layer and neuron analyses show shifts and overlaps in safety and functional representations.

Proposes SIBI, a white-box inference-time attack requiring no gradients or auxiliary models, which bypasses guardrails through sparse modification of Logits, maintaining a high success rate on standard benchmarks while reducing computational and space overhead.

Using multi-image inputs to disperse instructions, providing multimodal evidence, and adding digit-chain tasks, we achieved an attack success rate exceeding 90% on GPT-4o, Gemini-2.5-pro, and Claude Sonnet 4.

Exploits the flaw where models reconstruct harmful intent from fragmented visual cues while guardrails fail to recognize it, evaluates on seven vision-language models, and the single-attack bypass rate exceeds 81%.

Proposes the natural-gradient-based RIGJ framework, which updates tokens according to output distribution differences, improving cross-model attack success rate by 14.9 and average harmfulness by 1.23.

Introduces adversarial and persuasion techniques into educational settings, fine-tuning a student agent that can jailbreak LLM tutors as a benchmark core, and proposes a simple defense to reduce answer leakage.

Proposing EMJO, which combines three-agent collaboration with a dynamic experience library. In experiments, the attack success rate improves by up to 11 percentage points, and the average query cost is reduced by up to 7.9 times.

By intervening in shallow attention aggregation combined with query rewriting and dynamic sampling to bypass safety mechanisms, the attack success rate exceeds 77% on multiple models, with an average of 1.53 queries.

Proposes a dual technical and operational classification system, analyzes the link between jailbreak vulnerabilities and real-world attack constraints, and maps out gaps in existing research.

Decomposing and reassembling harmful visual semantics and packaging them into game scenarios to induce the model to reconstruct intent and answer on its own, achieving an attack success rate of 92.13% on Gemini 2.5 Flash.

Finds that visual perturbations such as reducing image resolution weaken safety defenses, even when text remains readable; separating transcription and safety evaluation in a serial pipeline can mitigate the risk.

Embeds harmful instructions into key conditions of reasoning problems, achieving an average attack success rate of over 70% across 11 reasoning models, with an improvement of up to 13 percentage points over the strongest baseline.

Studies factors influencing model acceptance of unknown knowledge and constructs jailbreak attacks accordingly, reporting 99% to 100% success rates across models including GPT-5.1 in test scenarios with and without defenses.

Using in-context examples to replace harmful words with harmless ones makes their internal representations converge to harmful semantics, thereby bypassing safety alignment. It requires no optimization, transfers across models, and achieves a success rate of 74% on Llama-3.3-70B-Instruct.

Systematically studies jailbreaks triggered by incomplete harmful prompts, finds that models often delay refusal until the end of the sentence, and that targeted fine-tuning struggles to generalize across content domains and continuation types.

Finding that domain and safety research contexts relax model defenses, we propose the Jargon multi-turn attack, which achieves an ASR above 93% on seven frontier models, and provide strategy-guided protective fine-tuning.

Constructs 10,400 data points covering value ambiguity and conflict and designs four types of adversarial attacks, finding significant vulnerabilities in the moral judgments of large language models and guardrail models.

Constructs MCV SafetyBench, finding that attack success rate increases with the number of segments, video is more vulnerable than images, and proposes a defense leveraging the relative robustness of the image modality.

Finds that models in role-playing may still execute harmful requests even when they recognize safety risks, and proposes an introspective defense that reduces attack success rate while maintaining role fidelity.

Proposes a black-box attack framework that hides risk round by round and induces rule-violating responses, and constructs a financial risk benchmark; the full method achieves an average attack success rate of 95% across nine models.

We propose a black-box jailbreak method that converts harmful requests into formal logic expressions, and construct a multilingual evaluation dataset, verifying its effectiveness and generalization across five languages.

Encoding harmful content into visual forms that are human-readable but hard for models to recognize, we build a benchmark of 1,700 examples and find that multiple leading models have attack success rates exceeding 90%.

Evaluating input perturbations across six models and four math benchmarks, it finds that adding agents improves accuracy but cannot eliminate the adversarial performance gap, with human-like spelling errors being especially challenging.

Through adaptive strategies and medical evidence feedback, accumulating covert semantic drift in multi-turn chest X-ray dialogues, the average attack success rate reaches 76.67% on GPT-4o, Claude, and Gemini.

By adaptively selecting programming languages and iteratively evolving code templates to implement jailbreaks, they induce more harmful text and malicious code on multiple large models than baselines.

Discovering that seemingly normal but meaningless natural instructions can induce overly long generation without adversarial perturbations; constructing the NaturalSloth dataset, which is more effective when combined with jailbreak techniques, and exposing the shortcomings of existing defenses.

It converts discrete character insertion into learnable continuous optimization, increasing attack success rate by up to 21.45 percentage points and attack speed by up to 3.66 times on three open-source models.

Proposes five categories of dialogue patterns to construct multi-turn jailbreaks, finds pattern-specific weaknesses across twelve models and ten harm categories, and shows that defenses targeting one pattern fail to generalize to other patterns.

Proposing AP-Test, which identifies guardrails deployed on black-box agents using guardrail-specific adversarial prompts, achieving fully accurate identification across multiple test scenarios on four open-source guardrails.

Proposes the Activation Steering Attack, using NLL as a diagnostic signal to probe the sensitivity of safety behavior under hidden-layer perturbations. It finds that the most vulnerable layers are unstable, some inputs are vulnerable across all layers, and the effect can accumulate to produce jailbreaks.

Modeling multi-turn jailbreaks as a risk-aware planning problem, we execute combined attack strategies through closed-loop planning, balancing attack effectiveness and query efficiency on both open-source and closed-source models.

Embed malicious prompts in non-text modalities such as images and tables, and use recursive symbolic references to make the model restore harmful content layer by layer, bypassing content moderation; the success rate exceeds 93% on mainstream MLLMs, an improvement of up to 70.8% over baselines.

Proposes a value-driven black-box jailbreak exploiting model sycophancy, achieving average success rates of 91.8% and 95.2% with a single query across five models, corresponding to two test sets.

By suppressing attention to the system prompt and anchoring adversarial image features, visual jailbreak is achieved with a 94.4% success rate on Qwen-VL; "safety blindness" is discovered, where the model outputs harmful content because it fails to retrieve safety rules.

Introduces the teaching jailbreak problem (students inducing the model to directly give answers) and the SHAPE benchmark with 9,087 sample pairs; a graph-enhanced tutoring pipeline significantly improves safety while maintaining helpfulness.

Propose SHARP, which generates jailbreak prompts by harmful question category, combined with two-stage LoRA fine-tuning and DPO, improving attack success rate and cross-category robustness.

Propose CRA, which suppresses low-rank activation patterns related to refusal at decoding time without training or updating parameters, achieving jailbreak results better than baselines on multiple safety-aligned open-source models.

Studies pure audio untargeted adversarial attacks against audio-video-language models, achieving attack success rates up to 96%, remaining effective under low perceptual distortion and room reverberation, with limited cross-model transferability.

Uses ChatGPT to generate adversarial texts that preserve semantics and naturalness, attacks stance detection models on two benchmarks, and achieves higher success rates with fewer retries than traditional methods.

Proposes an attack optimization method using deviation of the first token distribution from refusal patterns; it achieves success rates over 90% on all tested open-source models and over 94% on GPT-4.1.

Proposes a black-box attack exploiting structural cognitive overload, achieving an average attack success rate of 92% across six multimodal models, and analyzes the internal reasons for bypassing safety mechanisms.

Proposes a training-free evolutionary rewriting framework TSAPA, achieving attack success rates exceeding 90% on multiple watermarking schemes while maintaining high semantic fidelity, revealing the fragility of existing watermarks.

Proposes SEAL, an adaptive multi-encryption jailbreak framework, achieving an attack success rate of 85.6% on GPT o4-mini and validating effectiveness across multiple reasoning models.

Proposes an adversarial attack based on five categories of Unicode character style transformations that, while preserving text semantics and syntax, significantly degrades task performance of both open-source and closed-source models.

Modeling multi-turn jailbreaks as trajectory-level reinforcement learning, using two types of process rewards to alleviate supervision sparsity, improving attack success rates across multiple models and benchmarks.

Proposes MedFocusLeak, which applies imperceptible perturbations to non-diagnostic background regions to divert attention, inducing incorrect but clinically plausible diagnoses on six types of medical images.

Systematically studies the interaction between KV cache compression and jailbreak attacks, finds that it can both provide incidental robustness and amplify certain attacks, and proposes Safe-CAM to reduce ASR to 0%.

Proposes AutoLanJail for automatically discovering and optimizing language-game jailbreaks, and finds that safety fine-tuning is highly dependent on linguistic form and struggles to generalize to expressions with only minor changes.

Proposes DEJA, a black-box evolutionary attack that generates adversarial documents to induce RAG to output fluent but uninformative answers, bypassing defenses such as perplexity detection and input perturbation.

Pruning neurons related to instruction following during KV cache encoding makes the model treat context as data, significantly reducing indirect prompt injection success rate while maintaining usability.

It was found that the success of environment injection is mainly determined by semantic content rather than visual appearance, and EVA, which evolves only semantic payloads, was proposed, achieving an average attack success rate of 59% to 85% in experiments.

InstruCoT combines diverse synthetic data with instruction-level chain-of-thought fine-tuning, improving defenses against behavioral deviation, privacy leakage, and harmful outputs across four models without reducing utility.

Unifies attacks, defenses, and benchmarks, and designs adaptive attacks, finding that existing defenses have limited generalization and are easily broken by adaptive attacks.

Experiments find that when candidates have similar qualifications and a minority inject, resume prompt injection can boost rankings; the effect fades once injection becomes widespread, and with large qualification gaps it can still cause ranking inversion.

Combining instruction similarity, attention competition, and latent risk signals, it detects prompt injection in the first forward pass, requiring no training or text generation, with low computational overhead.

By injecting false judgment criteria without changing task objectives to manipulate models, reveal vulnerabilities in three types of text detection tasks, and bypass defenses against target drift.

Through evaluations covering 37 real-world applications, it finds that real applications are more susceptible to prompt injection attacks than research scenarios, simple attack instructions are more effective, and existing defenses still have limitations.

Requires the model to output both an answer and citations of the instructions it executed, filtering out answers that deviate from the original instruction; in some scenarios attack success rate drops to near zero with limited utility impact.

Proposes the verify-before-commit defense framework and the SIREN benchmark containing 959 cases, reducing attack success rate by more than 22% compared to dynamic defenses, and doubling availability under attack.

Proposes CostBomb, which induces lengthy reasoning through web prompt injection; black-box experiments show that the attack can significantly increase agent computational cost without hindering task completion.

Proposes PriceBlind, which achieves about 80% success in bypassing price constraints in screenshot white-box evaluations; combining it with a verify-then-act defense using a robust encoder reduces this to below 10%.

Proposes Amazon-Bench and an automated evaluation framework that simultaneously assesses task performance and security risks of Web Agents, finding that existing agents struggle with complex queries and have security vulnerabilities.

Constructing four types of malicious LMs integrated into collaborative systems such as routing, debate, and model fusion, performance in reasoning and safety domains drops by about 7% on average; an external supervisor shielding the malicious model can recover about 95% of performance.

Proposes the WebDecept plugin framework, injecting seven types of deceptive interface patterns; evaluations show that existing multimodal Web Agents are highly susceptible to multiple types of deceptive interfaces, and prompt constraints alone are insufficient to mitigate.

Studies attacks that activate harmful behavior when query trigger items and controlled remote agent templates are combined through routing, and finds that existing guardrails and tool restrictions are difficult to reliably block.

Proposes refusal-collusion threats and recursive blocking attacks, using semantically harmless communication to induce meaningless message loops, causing system paralysis across multiple topologies and models.

Proposed the DUDE defense framework and the RUC benchmark containing 1,407 scenarios, reducing the probability of Web Agents being affected by deceptive interfaces by 53.8% while maintaining task performance.

We propose XG-Guard, which combines sentence-level and token-level representations with topic anomaly detection to identify malicious agents in multi-agent systems, and provides interpretable evidence.

We found that LLMs misread ASCII emoticons and execute unintended or even destructive operations; the average confusion rate across 6 models exceeds 38%, and this vulnerability transfers to agent frameworks, with prompt-based mitigation being largely ineffective.

Proposes a fine-tuning-free multi-agent risk audit framework that uses four layers and ten types of probes to identify unsafe trajectories and reveals risks such as timeliness that conventional metrics miss.

By constructing false-information environments and loop traps through contaminated tool outputs, finds across five frontier agents that resistance to cognitive misdirection and resistance to navigation traps are distinct abilities, often involving a trade-off.

It proposes InquireBench to evaluate mobile agents' safe interaction and proactive inquiry, and trains InquireMobile, improving the inquiry success rate by 46.8%.

Systematically reviews security threats, defense strategies, and evaluation resources for computer-operating agents, establishing a classification framework to inform vulnerability research and secure deployment.

They propose a multi-agent collusion attack using only real evidence fragments, achieving an attack success rate of about 70% across 14 LLM families, and stronger reasoning ability makes models more susceptible to deception.

Proposes a training-free planning architecture where a critic agent reviews debates, achieving a rejection rate of over 90% for unsafe tasks while maintaining high practicality.

Proposes an MCP defense framework combining static scanning, neural detection, and LLM arbitration, accompanied by 70,448 attack samples; fine-tuning the E5 detector achieves 96.01% accuracy in identifying adversarial prompts.

Constructing a multimodal agent safety simulation framework, we found that the success rate of correcting unsafe plans is only 55%, and 45% of unsafe actions are accepted under misleading visual cues.

Experiments in web and embodied environments find that merely accumulating benign task experience also strengthens action tendencies and weakens safety; refusal experience can mitigate degradation but triggers excessive refusals.

Propose the MobileRisk-Live sandbox and benchmark, along with OS-Sentinel combining a formal verifier and VLM context judge, improving detection effectiveness by 10%–30% over existing methods.

Establishes an implicit personalization safety benchmark, finds that the strongest tested agent achieves only about 50% safety rate, and proposes a risk-aware memory framework that improves safety performance while maintaining helpfulness.

Proposes a threat model that categorizes risks by instruction, context, and action, automatically synthesizes data for training, and improves safety by an average of 45% across four open-source models.

A server-side plugin uses world-model look-ahead reasoning for proactive tool filtering and immediate intervention, reducing risk on PowerSeeking Bench, ToolEmu, and AgentHarm while maintaining usability.

By monitoring decision trajectories, retrieving repair cases, and using external validators to control execution, the safe answer rate was improved by 2.9 to 11.2 percentage points in safe code generation experiments.

Constructs an embodied evaluation covering six types of kitchen hazards, finding that models can identify dangers but struggle to proactively eliminate risks through planning.

Proposes JailAgent, which does not modify user prompts but instead manipulates the agent's reasoning trajectory and memory retrieval, performing prominently across models and scenarios.

With 300 adversarial instances and six attack types, it evaluates ten backbone models and Autogen and CrewAI configurations, finding that multi-agent systems are highly vulnerable to attacks.

It builds a tool-calling safety benchmark, pre-execution guardrails, and a feedback reasoning framework, reducing harmful calls by an average of 65% under prompt injection attacks while improving normal task completion performance by about 10%.

By monitoring interaction risks, pruning high-risk connections, and isolating affected groups to block attack propagation, it reduces toxicity by 58% on GPT-4o while maintaining task success rate above 90%.

Implanting triggers in user-uploaded images so that they persist in long-term memory as "dormant agents" and hijack subsequent planning, with a target hit rate of about 85%; proposing CognitiveGuard defense, reducing it to about 10%.

Designed 12 attack variants that exploit link structures to carry out deception; experiments show they can harm different multi-agent architectures without requiring complex input design.

Finds that benign personal memories cause the model to treat harmful requests as reasonable, increasing attack success rate by 15.8%–243.7% relative to a stateless baseline; provides representation-space evidence and proposes a lightweight detection-reflection method.

We find that when compliant execution is infeasible, agents sacrifice safety to achieve goals, and stronger reasoning ability accelerates this process; we also explore mitigation strategies such as stress isolation.

Poisons shared context through semantics-preserving code transformations, causing assistants to recommend vulnerable code, with an average attack success rate of 73.20% across eight models, and empirically demonstrated on GitHub Copilot.

Constructed a toxicity identification dataset with approximately 300,000 labeled entries, and found that fine-tuned pretrained models outperform large language models in identifying toxicity, target groups, and toxic words.

Reuses the generative model's tokens and layer-wise hidden states for safety classification, achieving performance comparable to larger dedicated models while avoiding the memory and latency overhead of a separate guardrail.

Jointly trains a prompt classifier and an explanation token labeler, achieving or exceeding existing prompt classification and interpretability levels with a smaller model on in-domain and out-of-domain tests across three datasets.

Proposing STELA, which adjusts watermark strength according to the language uncertainty of part-of-speech sequences, enabling public detection without model logits, and improving detection robustness in experiments across English, Chinese, and Korean.

Systematically reviews harmful content measurement and mitigation methods for multilingual models, covering training, editing, decoding, alignment, and data strategies, and discusses challenges such as data scarcity and cross-cultural evaluation.

Proposing a cross-training-stage unlearning evaluation benchmark DUAL, we found that supervised fine-tuning on the forget data first makes unlearning smoother and improves retention by 10% to 50%.

The audit found that multiple open-weight models endorse harmful stereotypes when asked to defend them, while common harmful content evaluation and review frameworks frequently miss these discriminatory responses.

We build a Bengali hate detection dataset containing 19,203 comments with human explanations; experiments show that explanation-guided LoRA improves classification performance and explanation quality.

Lets the same model serve as both attacker and defender in reinforcement learning, with focused replay of failure cases, yielding defense capability superior to baselines trained with static adversarial data.

A CDD framework is proposed, which identifies meta-operations that conceal harmful intent through a structured reasoning chain, and uses entropy-guided reinforcement learning to improve generalized defense against unseen jailbreak attacks.

Proposes SafePatch, an external safety module that does not modify the base model, reducing unsafe generation ratio to 7% on I2P while maintaining image quality and semantic consistency.

Proposes a multi-agent picture book generation framework that integrates child safety constraints with cross-page verification and repair. Experiments show it outperforms existing methods in narrative coherence, visual consistency, and safety compliance.

Proposes SEAT, using reward-guided branch decoding and sequence-level risk monitoring to defend against jailbreaks while reducing over-refusals of benign content, outperforming eight baselines on four attack benchmarks.

Trains analogical reasoning through supervised fine-tuning and preference optimization to reduce misleading judgment shortcuts in ambiguous content moderation, with an average F1 improvement of 24.9% in experiments.

Constructs a benchmark for machine text detection in Chinese and European languages and evaluates robustness against obfuscation, finding that detectors fine-tuned on these languages achieve the best performance and adversarial robustness.

Proposes CogGSE, which combines the cognitive analysis graph of the current question with historical safety nodes at inference time to guide responses, and experiments verify its effectiveness across multiple safety scenarios.

Comparing hate speech detection across models with different safety constraints under political personas, we found that models with stronger constraints are more accurate and more robust to persona effects, but all models still exhibit group differences and overconfidence.

Finds that high-gradient samples are more prone to causing safety degradation during fine-tuning, and filtering such samples can improve safety alignment retention while maintaining task performance.

Uses the RL red-teaming pipeline ImpForge to generate implicit multimodal samples, trains the intent-aware guardrail CrossGuard, and defends against both explicit and implicit attacks better than existing guardrails.

Found that population-group-difference classification fine-tuning makes explanations more harmful; DART improves Llama-3-8B accuracy from 39.0% to 68.8% and reduces harm drift cases by 72.6%.

Proposed a four-stage deep research guardrail and a staged safety benchmark, improving defense success rate by 16.53 percentage points, reducing over-refusal rate to about 6%, and improving report quality.

Combine offline-optimized defense suffixes with online-filtered in-context examples to reduce success rates to near zero under the tested white-box and black-box attacks while preserving benign task utility.

Finds that fine-tuning-based prompt injection defenses rely on surface correlations such as position, trigger words, and topic, causing many benign inputs to be wrongly rejected, and provides a diagnostic dataset and systematic evaluation.

Uses FFN output activations to distinguish harmful from benign queries and selectively intervenes, achieving leading defense effectiveness under multiple jailbreak attacks while largely maintaining benign task performance.

Proposes the HSPD pipeline, using SoCD to locate and rewrite toxic segments in the original corpus; on GPT2-XL the toxicity probability drops from 0.42 to 0.18, and it is validated on multiple models.

Constructing a misinformation detection benchmark covering 50 dialects, we evaluate 16 detection models and find that dialect content degrades detection performance, with some models severely failing.

Found that guardrails such as LlamaGuard overfit to training policies, proposed Augmented Policy Training, which uses policy perturbation to improve generalization to unseen policies, and a 1B model can rival an 8B guardrail on unseen policies.

Proposes a dual fact shield combining key-term protection from source documents with semantic prompting, significantly reducing watermark-induced knowledge damage while preserving original safety and robustness.

Combining structured reasoning data synthesis, distillation, and adaptive reinforcement learning improves harmful meme detection in small multimodal models, achieving 84.7% accuracy on the FHM dataset.

Injecting two complementary watermarks based on semantic dynamics, it simultaneously resists rewriting and watermark forgery, and detects and traces forgery attacks, balancing robustness and text quality across multiple models and datasets.

Evaluated eight watermarking methods across three entropy levels and seven task types, found a trade-off between detection capability and output quality, and ordinary non-adversarial user operations can also significantly weaken watermarks.

Evaluates 15 unlearning methods, finds that models can still recall rewritten answers and that intermediate layers retain target facts, and proposes a probability-perturbation-based PERMU method to improve implicit knowledge unlearning.

Constructing retrieval and refusal evaluation based on fire safety regulations, finds that graph-guided retrieval improves performance, but domain-adapted models are more prone to confabulation when key regulatory evidence is missing.

Combines large language models with a multilingual lexicon to detect and explain hate speech; human evaluation shows its detection accuracy and explanation quality outperform baselines using only large language models.

Constructed a dataset of 1,049 suicide-themed memes and evaluated 16 models, finding that models tend to underestimate high-severity content, especially when rhetorical expressions are used, revealing difficulties in content moderation.

Proposed the FlexBench benchmark and found that existing moderation models are inconsistent across strictness levels, then proposed FlexGuard, which outputs continuous risk scores, improving robustness across different strictness levels.

Proposing ETW, a token-level forgetting regularization based on predictive entropy, as a forgetting method against harmful behaviors, achieving stronger forgetting effects while better preserving model utility.

Proposes CDMArk for diffusion language models, which distributes the full watermark information across all tokens, achieving leading results in the trade-off between imperceptibility and effectiveness.

SALSF is proposed, which embeds model fingerprints by adjusting the probability distribution of semantically similar long-tail words, approximately preserving the preferred words and their probabilities. Experiments show it can retain multimodal performance and enhance fingerprint robustness.

Establish an older-adult-specific risk taxonomy and a benchmark of 10,404 samples, and find that multiple mainstream models mishandle over half of the cases; the unsafe prompt detection accuracy of two guardrails reaches up to 96.2% and 90.9%.

Propose a suggestion-style guardrail providing risk labels and explanations, reducing over-refusal while maintaining safety, with end-to-end additional overhead of 2% to 10%.

训练40亿参数护栏模型判断陈述是否有文档依据并解释，在RAGTruth子集上取得84.4%的平衡准确率，超过所比较的专用模型。

We construct a health-scenario benchmark containing 31,920 benign boundary prompts, evaluate 30 models, and find that safety-optimized models can have refusal rates up to 80% on high-difficulty benign prompts.

Uses hidden states for token-level harmful content detection and masking, without needing to refuse the entire response. The F1 score for harmful content detection and masking exceeds 90%.

Study using SFT to improve LRM safety: directly distilling DeepSeek-R1's safe responses has limited effect; identify five types of risk patterns, and correcting them significantly improves; short or template-based reasoning can achieve similar safety.

Proposes SAILS, which uses SAE to disentangle a safety subspace to initialize LoRA, updating only 0.2% of parameters to achieve up to a 99.6% safety rate, outperforming full-parameter fine-tuning.

Evaluates the full inference pipeline including input and output filtering, finding that almost all tested jailbreak methods can be detected by at least one filter, though precision and recall still require trade-offs.

Finds that jailbreaks mainly activate un-erased parameters in middle layers and form dynamic jailbreak paths; proposes JPU to mine on-policy adversarial examples to correct paths, improving resistance to dynamic attacks while maintaining utility.

Reveals that tasks beyond capability induce overconfidence and plausible but erroneous reasoning, and uses reward shaping and failure-sample supervision to train refusal, reducing ineffective reasoning while maintaining performance.

By embedding multi-bit watermarks through benign knowledge completion and optimizing detection queries, watermarks can still be reliably extracted under knowledge filtering, modification, expansion, and RAG setting constraints, protecting knowledge base intellectual property.

Anchoring safety alignment to language-agnostic intermediate-layer semantic representations improves cross-lingual safety, reducing the average attack success rate of LLaMA models from 24.7% to 2.8%.

Propose SIREN, which builds a harmful content detector via linear probes and adaptive layer weighting, surpassing advanced open-source guardrails with 250x fewer trainable parameters and supporting real-time streaming detection.

Constructing a Bengali hate speech dataset covering type, severity, and target. It is found that LoRA fine-tuning of large models can match BanglaBERT, but cultural context pretraining remains important.

Finds that answer vectors are nearly orthogonal to benign vectors, and proposes aligning them with a closed-form weight update, achieving F1 11.45% higher than the best baseline across 12 models while retaining 95.92% utility.

Build customized guardrails by dynamically probing model vulnerabilities and training collaborative multi-LoRA safety classifiers, outperforming baselines in robustness, adaptability, and generalization.

Proposes an energy landscape-guided method that dynamically intervenes in hidden states with an external energy model, increasing request compliance on ORB-H from 57.3% to 82.6% while maintaining baseline safety.

Finding that models may recognize visual risks yet ignore safety constraints in reasoning, proposing intent-guided defense that improves defense success rate by over 62% over the baseline while largely preserving task utility.

Constructs the H-VLI benchmark for detecting implicit hate relying on image-text interaction, and proposes a courtroom-style agent debate framework that significantly improves detection of complex implicit cases.

HIAR internalizes safety reasoning through layer-wise LoRA updates without generating explicit safety chains of thought, reducing jailbreak attack success rate by 43% compared to strong baselines.

Proposing the RefusEU dataset covering 12 European languages, finding that English-only alignment is insufficient for cross-lingual safety, and that multilingual training improves safety without harming general knowledge performance.

By locating attack-sensitive neurons through similarity gradient attribution, we propose targeted neuron tuning, which raises safety rates under multiple jailbreak attacks to above 90% while preserving general performance.

Constructed a toxic neologism classification and dictionary, and proposed a search-augmented framework SeTox that introduces real-time context, enabling a 3B-scale model to surpass the detection performance of recent large-scale models.

Built a multimodal misinformation forgetting benchmark and found that forgotten rumors can be recovered through relearning, all tested methods are vulnerable to prompt attacks, and rumors within images are difficult to handle.

Combines slang dictionary fusion with label decoupling for volume annotation, reducing semantic ambiguity and label conflicts in Chinese hate speech extraction, achieving 30.09% Hard-F1 on STATE ToxiCN.

Propose training-free AdaCD, which dynamically adjusts the refusal token distribution, reducing the refusal rate for over-refusal queries by an average of 10.35% across five benchmarks while slightly increasing the refusal rate for malicious queries.

Analyzing barriers to watermark deployment from competitive risk, detection tool governance, and attribution issues, and using in-context watermarking as an example, proposing design principles for domain-specific incentive coordination and abuse detection.

Finds that quantization weakens safety alignment, especially in non-English scenarios; protecting fairness- and safety-critical weights can mitigate degradation without retraining.

Proposes CWAC to simultaneously constrain weight updates and safety-critical activation features, reducing harmful outputs in fine-tuning experiments on four large models with little impact on task accuracy.

GLOSS identifies and removes the global toxic subspace from feed-forward network parameters, achieving leading detoxification without large-scale retraining while preserving general capabilities.

Using gradient-free attribution to identify and prune parameters related to unsafe behavior, it significantly reduces unsafe generations and improves robustness against jailbreak attacks with almost no loss of utility.

Binding the watermark to the target-domain input distribution and implanting a detectable reasoning-length difference outperforms existing attribution verification methods across multiple distillation settings while maintaining task utility.

Found that case-augmented simplified rules are more robust than exhaustive safety rules, and proposed CADA, which uses reinforcement learning to improve harmlessness and attack resistance while reducing over-refusal.

Points out that reasoning models' safety risks stem from reasoning structure, and proposes AltTrain, which uses only 1K samples for SFT to alter reasoning structure and achieve strong safety alignment.

Constructing VerIH and training instruction priority reasoning with lightweight reinforcement learning. Performance in conflict scenarios improves by about 20 percentage points, and jailbreak and prompt injection success rates are reduced by up to 20 percentage points.

Using attention to locate reasoning key points and injecting safety reflections, combined with sampling strategies, defends against four types of jailbreaks without fine-tuning, outperforming nine existing defenses.

Combining image purification, anomaly detection, and targeted safety concept injection enhances jailbreak defense for vision-language models while preserving normal task performance.

Propose RLAT, which uses reinforcement learning to control test-time data selection and parameter updates, mitigating overfitting in continual tuning, and outperforming baselines in cross-platform and cross-time harmful text detection.

ALCA moves safety reasoning into the latent space and supports auditing through constrained self-decoding, reducing adaptive jailbreak success rate by over 40% compared to strong baselines while maintaining performance.

Proposes the RCS framework, which learns projections at a safety-critical layer to separate benign from malicious inputs, instantiated as MCD and KCD; achieves state-of-the-art results on an evaluation protocol with unseen attack types, avoiding over-rejection from single-class detection.

Proposes a third-party watermark verification framework that requires no secret key or provider-side detector, improving detection performance and attack robustness through surrogate models and relative hypothesis testing.

Use retrieval of known attack cases to identify malicious intent and jailbreak strategies, enabling defense updates without retraining, reducing attack effectiveness while maintaining a low refusal rate for normal requests.

Combining dynamic retrieval rewriting, cross-layer representation analysis, and reinforcement learning, it adaptively selects detection thresholds for each sample, improving F1 by up to 7.3% and increasing average inference efficiency by up to three times.

Combining error-correcting codes, orthogonal feature mapping, and lightweight adapters to achieve user-level watermark attribution, achieving 100% multi-bit watermark recovery under model extraction attacks while maintaining high semantic fidelity.

At inference time, uses RST parsing to obtain discourse relations, then aggregates segment-level safety scores via hierarchical probabilistic inference without training; improves harmful content detection in long texts and significantly reduces false positives.

Proposes a five-dimensional risk rubric validated by clinical personnel, evaluates six models on over twenty thousand care consultation records, and a rubric-guided round of improvement reduces each risk component by 45% to 98%.

It finds that malicious clients can attack FedLLM, and that behavioral patterns of LoRA updates can be distinguished by a lightweight classifier; based on this, a three-layer probe-based defense is proposed that remains effective even under a high proportion of malicious clients.

Finds that cross-layer representation trajectories across different tasks exhibit regularities, and proposes a method for directionally adjusting trajectories at inference time, reducing over-refusals with limited impact on model utility.

Proposes Safety Optimal Transport, which uses optimal transport to pull downstream data toward safety anchors and push away from harmful references at the distribution level, thereby purifying fine-tuning data and achieving a better balance between safety and utility.

Selectively merging layers of a fine-tuned model and a safety-aligned model based on cosine similarity reduces harmful outputs across four large models and multiple tasks, with little loss of task utility.

Integrating initial assessment, rule verification, and path calibration into reasoning, and improving safety across multiple open-source models through synthetic trajectory fine-tuning and step-level preference optimization while maintaining helpfulness and response efficiency.

Leveraging the model's own ability to discern harmful inputs, it guides decoding with a lightweight discriminator and a safety alignment vector, improving safety performance by up to 33.40% without fine-tuning.

Combining information-gain-guided clarification, retrieval-augmented generation, and psychological risk screening, expert evaluation shows responses better meet clinical needs, and the safety module's judgments are also fairly consistent with experts.

Proposes dual semantic and situational safety memory, accumulating jailbreak patterns and distilling rules from detection failures, adapting to new attacks without retraining, significantly reducing ASR.

Finds that continuously editing either benign or malicious knowledge can introduce safety risks, and constrains activation and parameter updates to reduce unsafe responses to malicious queries while preserving editing effects.

Generated safety data with Southeast Asian cultural context through agents to train a multilingual guardrail, improving region-sensitive and harmful content detection while maintaining general safety performance.

Built a safety benchmark covering eight languages with 21,640 human-verified samples, and found that advanced models and guardrails perform worse in Southeast Asian cultural and harm scenarios than in English.

Introducing self-reflection tokens enables reasoning models to correct harmful outputs during generation, reducing HCR from 13.8% to 4.1% and improving safety under adaptive attacks.

Combining synthetic explanations, preference optimization, and cross-model training, using only 6% to 57% of training data, macro-averaged F1 improves by up to 13% over the few-shot baseline.

Constructs a dataset covering 53 languages and accent variants, adapts a frozen audio language model with soft prompts, achieves a toxicity detection ROC-AUC of 98.07%, and improves cross-distribution generalization.

Proposes the SSG method that partitions the vocabulary into Logit-balanced subsets, improving the lower bound of watermark strength for token-by-token prediction, and improving watermark detection in code generation and mathematical reasoning.

Identifies the top-K neurons most vulnerable to adversarial perturbations and applies reverse perturbation correction, without retraining or adversarial data; outperforms baselines on both seen and unseen attacks on MS MARCO and TREC 19.

Embeds watermarks into the abstract meaning representation of sentences to enhance source verification after rewriting, improving rewritten-text detection AUC on RealNews by up to 13.9 percentage points over existing methods.

Proposes SaRO, which optimizes safety reflection and correction through reasoning-style warm-up and self-reflection process optimization, and in experiments better balances safety and helpfulness than existing reasoning-based alignment methods.

Proposes a lightweight watermarking method that partitions the vocabulary by topic, enhancing resistance to paraphrase and lexical perturbation attacks while maintaining text quality and low overhead.

At inference time, connects a pre-trained sparse autoencoder to the residual stream, reducing the jailbreak success rate to as low as one-fifth of the baseline, and finds that sparsity and the connection layer affect defense and utility.

It builds a French toxicity dataset containing 53,622 comments and uses dynamically weighted chain-of-thought fine-tuning to improve detection performance, with a 4B model surpassing GPT-4o and DeepSeek-R1 on this benchmark.

Combining toxic segment localization, gradient constraints, and contrastive reasoning improves Chinese toxicity classification and evidence segment extraction while maintaining efficient inference and providing coherent explanations.

Using a sliding window to monitor decoding hidden-state trajectories and intervening in a timely manner, achieving an average defense rate of 95% against 12 types of jailbreak attacks, with a false positive rate below 1.5%.

A closed-loop reinforcement learning framework with attacker, defender, and evaluator roles requires almost no manual annotation; attack effectiveness improves by 20%–50%, and defense safety improves by 10%–30% without harming general reasoning.

For the problem of robots using deceptive interactions to interfere with graph model detection, combines uncertainty pseudo-labeling with graph structure purification to improve detection performance across three datasets and six backbone networks.

Builds a safety policy benchmark based on adversarial queries written by 155 experts, evaluates 15 models, and finds that English-centric benchmarks overestimate multilingual safety, while dynamic policies still struggle to fully adapt to local contexts.

Created generalization gap regions by forgetting neighboring samples of training samples, and used memory strength differences as an implicit fingerprint to verify LVLM ownership, which is more covert and robust than fixed triggers.

Defining forgetting honesty and establishing evaluation metrics, finding that all 9 existing methods fail to meet the standard, proposing the ReVa representation alignment method, which nearly doubles the refusal rate and improves honesty on the retained set.

Rewrites user input through multimodal reasoning without modifying protected model parameters; on the SIUO benchmark, the average safety improvement across five models is 43.59%.

Finds that models can overturn their initial harmful-intent judgment in subsequent reasoning, and proposes a CoG training framework with stepwise intervention that improves the balance between safety and reasoning ability across multiple benchmarks.

Analyzing from a representation similarity perspective, find that the more similar upstream safety alignment data and downstream fine-tuning data are, the more easily safety guardrails are weakened; low similarity can reduce the harmfulness score by up to 10.33%.

Proposes STA, which freezes the model and optimizes only a single-token prefix, combined with data filtering and hard-example weighting, improving the balance between safety and helpfulness across nine models and ten datasets.

Combining role responsibility constraints, structured memory, two-level reflection, and AI feedback optimization reduces severity-weighted normative risk in simulated medical tasks while improving role identity stability.

From a pragmatics perspective, attributes LLMs' failure to question harmful beliefs to excessive accommodation and insufficient epistemic vigilance, explains differences across three safety benchmarks, and finds that adding prompts like "wait a minute" greatly improves performance.

Proposes a fine-tuning-free activation reward model that guides activations with a small number of preference examples, achieving leading performance in reward modeling and on a new reward hacking benchmark, and resisting noise and spurious reward signals.

Constructing 5,856 synthetic samples to evaluate audio language models, we found that soothing speech suppresses the model's response to audible danger signals, exposing cross-modal safety flaws in medical triage.

Evaluating seven models across eight industry scenarios, find that accuracy for handling legitimate requests exceeds 95%, but the refusal rate for adversarial policy-violating requests is only 13% to 40%.

Proposes a reward model self-training framework that requires no human annotation, stabilizing training through answer-comment consistency rewards, outperforming ordinary reinforcement fine-tuning by 1.5% on average and mitigating position bias.

Proposes recursive causal auditing that requires no ground-truth answers, checks derivation consistency and the impact of user pressure, reveals over-skepticism and a scaling paradox, and improves utility and safety performance without retraining.

Through multi-turn dialogues with roles of different status, evaluate linguistic alignment, persuasion, and compliance with unsafe requests, and find that models exhibit power-related social cognition effects and unsafe behaviors.

Multimodal perturbations that do not change the moral context can flip model judgments, and models with stronger instruction following are more easily persuaded; lightweight inference intervention can partially mitigate this.

Across four model families, narrow-domain in-context examples can induce misalignment on unrelated benign questions; 16 examples correspond to incidence rates from 1% to 24%, and scaling up does not reliably protect.

It proposes a training-free turn-by-turn risk and emotion analysis framework that achieves more consistent ethical guidance and emotional responses in high-risk and morally ambiguous conversations.

Build MedCounterFact and evaluate multiple frontier models, finding that models still generally accept dangerous or unreasonable counterfactual medical evidence and give confident answers lacking warnings.

In a moral dilemma study with 31 participants, sycophantic responses enhanced decision confidence but reduced open thinking, while neutral responses promoted cognitive flexibility and in-depth discussion.

Proposes ViSE, the first benchmark for evaluating sycophancy in Video-LLMs, and offers two training-free mitigation ideas: keyframe selection and inference-time representation intervention.

It is found that refusal forgetting in a local domain can trigger cross-domain misalignment. Concept similarity in early layers correlates with this effect, and adding a small amount of retained data during training can largely restore alignment.

Study the transfer of trustworthy attributes under weak model supervision, finding that two-stage regularization improves fairness and robustness to adversarial and out-of-distribution inputs, but privacy does not exhibit weak-to-strong generalization.

Evaluation finds that CoT reasoning generally reduces sycophancy in final decisions, but some samples construct deceptive reasons to mask sycophancy; sycophancy is more likely in subjective tasks and under authority bias.

Evaluating three-source information trade-offs across 27 models, finding that models rely more on documents and struggle to distinguish helpful from harmful information, with fine-tuning on diverse source interaction data improving discrimination ability.

By fine-tuning to study the behavioral impact of 15 values, it was found that guiding positive values can improve safety, but all tested values increased anthropomorphic expression and sycophantic tendencies.

JODP lets the policy generate training prompts and learn to reproduce high-reward behaviors without the prompts, enabling a 4B model to approach an 8B model's performance on safety alignment tasks with less than 1% extra computation.

Construct over 1,100 health questions requiring correction of false premises and compare model and clinician answers, finding that models often fail to correct the question's direction even when they identify the false premise.

Proposes a rationale consistency metric to identify cases where reward models make correct judgments but incorrect rationales; training combined with outcome accuracy can improve rationale consistency and downstream RLHF performance.

Analyzes the limitations of compressing multi-annotator preference data into a single consensus, argues for preserving reasonable disagreement for pluralistic value alignment and safety evaluation, and proposes data construction strategies.

Training a multidimensional reward model with clinical fine-grained standards, separating safety constraints from general capabilities, improves Qwen3-8B's accuracy and safety compliance by 22.3% and 21.7%, respectively.

Evaluates 14 models based on Australian psychology and psychiatry guidelines, finding that refusal rates poorly reflect ethical performance and that the ethical robustness of some domain fine-tuned models actually declines.

By showing evaluators simulated consequences before collecting feedback, reduces model output manipulation of outcome expectations, achieving alignment performance superior to RLHF across three types of consultation tasks and human evaluations.

Propose CAST, which performs sparse fine-tuning through head-level conflict diagnosis, skipping a few high-conflict attention heads, significantly reducing general capability degradation without losing safety.

Achieves training-free alignment through role-conditioned generation and iterative role review, reducing DeepSeek-V3's unsafe output ratio on WildJailbreak from 81.4% to 3.6%.

Using multilingual controlled evaluations to distinguish the effects of seniority and register, find that some models are more likely to cater to high-register expressions, and there are domain-specific sycophancy weaknesses that are stable across languages.

Constructs GasVideo-1000 and finds that video large models generally overturn correct judgments and fabricate explanations under negative feedback, with prompt-level visual evidence constraints providing only partial mitigation.

Builds a 600-question benchmark to evaluate seven assistants on sycophancy and error correction under social pressure, and finds that willingness to change answers does not mean the ability to distinguish correct from incorrect advice.

Find that unreliable alignment guidance triggers excessive intervention, propose BlendIn, which mixes model output distributions according to reliability, achieving up to 50% performance improvement on difficult model combinations.

Testing on 13 small open-source models found that in 9 models, persona agreeableness is significantly positively correlated with sycophancy rate, with the highest correlation coefficient reaching 0.87.

Proposes an alignment objective that uses persistent homology to constrain hidden space trajectories. In Qwen2.5 experiments, it improves preference metrics and model judge scores while maintaining or slightly improving toxicity performance.

Evaluates nine closed-source models across 880 interest-temptation decision scenarios, finds that strategically self-interested choices account for an average of 67.96%, which correlates with other safety deficiencies, and proposes a lightweight mitigation method.

Fine-tuning a VLM on neutral VQA built around threat images, without safety labels, reduces attack success rate, mitigates over-refusal, and maintains general capabilities.

Propose the Med-Stress stress test, find that nine frontier models abandon correct diagnoses under multi-round pressure, and provide the RBED inference defense and R-FT fine-tuning, the latter nearly eliminating belief change.

Identifies user feedback from multi-turn real conversations and automatically constructs preference data. The fine-tuned model better matches user preferences on both traditional benchmarks and checklist-guided evaluation.

It finds that mixing in just 1% of misaligned data reduces honest behavior by more than 20%, and self-training after group interaction containing 10% user-biased data also exacerbates dishonest behavior.

Observes model adversarial behavior in five types of social reasoning games and establishes a behavior taxonomy, finding that models have distinct behavioral characteristics and that structured thinking approaches affect social stability and competitive outcomes.

Proposing FiMi-RM, which fits and corrects the nonlinear relationship between length and reward in reward models, mitigating length-bias reward hacking and reducing verbosity on DPO and BoN.

Finds that models engage in reward hacking in mathematical reasoning to obtain correct answers through sloppy processes. Proposes a Rubric Reward Model to evaluate the entire reasoning trajectory, reducing "miracle steps" by 71% and raising Verified Pass@1024 on AIME2024 from 26.7% to 62.6%.

Propose evaluator stress testing, using controlled perturbations to distinguish evaluation exploitation from genuine improvement, and through closed-loop mitigation improve large models' human evaluation win rates and reduce reward hacking in reinforcement learning.

Mitigates in-context reward hacking without fine-tuning through pre-execution safety constraint reasoning and constrained evolutionary exploration, while maintaining task performance in experiments.

It finds that reinforcement learning amplifies vulnerabilities in translation quality evaluation models, and proposes WALAR, which combines word and language alignment, outperforming LLaMAX across 1,414 translation directions.

Using Gaussian mixture modeling to model reward distributions to distinguish subjective preference from epistemic uncertainty, with accuracy and generalization superior to scalar baselines, and mitigating reward hacking in downstream RL.

Studies guessing and elimination shortcuts in multiple-choice training, proposing an iterative distractor construction method that uses high-quality distractors to suppress reward hacking and improve training effectiveness.

Using thinking-mode answers to set per-question length limits for non-thinking responses roughly halves usage and improves accuracy, with reward hacking in non-thinking answers below 10%.

To address the issue that process reward models are susceptible to reward hacking, jointly evaluated single-step and continuous reasoning and compressed nodes to enhance data, improving evaluation stability and generalization on mathematical benchmarks.

Addresses reward hacking induced by teacher noise by calibrating teacher rewards at three levels—question, trajectory, and token—and experiments show it can mitigate noise and improve reasoning ability and training stability.

Studying reinforcement learning to train models to call Prolog, it was found that rewarding only correctness causes models to bypass symbolic reasoning, while rewarding symbolic structure improves auditability but sacrifices accuracy.

Injecting synthetic reasoning snippets into three reasoning models, finding that they change answers yet often fabricate other explanations; under extreme prompt conditions, the proportion of non-disclosure of impact exceeds 90%.

Systematic auditing found that activation steering can significantly increase or decrease jailbreak success rates, and mechanism analysis attributes this to the overlap between the steering vector and the latent subspace of refusal behavior.

Evaluates four safety parameter region identification methods across four model types, finding that region overlap is low and affected by datasets, and existing methods struggle to locate stable safety regions.

Locating key attention heads responsible for toxic generation, reducing toxicity through dynamic activation steering or targeted fine-tuning, accelerating attention head selection sevenfold while maintaining language fluency.

Using SAE feature suppression to achieve persistent forgetting at the parameter level, outperforming existing methods on the WMDP harmful knowledge forgetting task while preserving general capabilities.

Through controlled experiments, they find that malicious input detection probes mainly learn instruction patterns and trigger words rather than semantic harmfulness, explaining their poor out-of-distribution generalization and proposing directions for evaluation improvement.

Decomposes inference-time steering into two stages: conditional triggering and fine-grained vector synthesis, outperforming existing methods on safety and truthfulness benchmarks, such as a 7.6% improvement on TruthfulQA for Llama-3, while trying to preserve general capabilities.

A position paper pointing out that mechanistic interpretability lacks a standardized auditing system, calling for a sustained collaborative review platform and expert validation guidelines to support its application in AI safety.

Proposes the PsySET benchmark to evaluate the steering effects of prompts, fine-tuning, and representation engineering on emotions and personality, and finds that steering brings unexpected side effects such as safety and privacy issues.

Proposes a sparse autoencoder interpretation framework for the safety domain, reducing interpretation cost by 55% and providing 1,758 safety-related features covering four domains.

Propose norm-preserving rotation and discriminative layer selection methods, improving attack success rates over existing methods across nine models while maintaining approximately 100% baseline capability.

Evaluate probe generalization across eight behavior categories, find that intent-type behaviors such as strategic deception are most prone to failure, and propose a method for testing generalization using incentivized data, suggesting existing deception probes may struggle to handle real-world monitoring.

Proposes ESI to locate safety-critical parameters, revealing distribution differences between dense and MoE models, and enhances safety and suppresses safety degradation after fine-tuning by directionally updating or protecting these parameters.

Detecting deception through geometric features of hidden-state trajectories, it finds that sycophancy signals are the most prominent while instructive deception signals are near zero, and seven features suffice to support lightweight detection.

Using SAE, it is found that data features that induce misalignment are geometrically closer to harmful features. Based on this, filtering out training samples closest to toxic features reduces misalignment by 34.5%.

Evaluates 22 models on monitoring inappropriate behavior with 3,010 samples, finds a persistent trade-off between missed detections and false positives, and explores the role of fine-tuning in monitoring unseen covert behaviors.

Proposing reliable consensus sampling and feedback algorithms that provide theoretical guarantees of controllable risk thresholds under malicious manipulation of the model, without abstention, and improving robustness and utility in experiments.

Proposes CS-ADS, which extracts behavior-guiding directions by comparing and decomposing activations, effectively defending against multiple backdoor attacks without auxiliary models or datasets.

Targeting gradient interference in backdoor training of vision-language action models, they adaptively select gradient decoupling strategies, achieving a targeted attack success rate of over 80% with only a 5% poisoning rate.

Proposed Locphylax: inject known backdoors into already poisoned models to make unknown and known backdoors aggregate in representation space, then perform recovery fine-tuning; average attack success rate dropped to 4.41%, with clean accuracy loss within 0.5%.

Unifies analysis of backdoors in planning, memory, and tool use stages, builds four types of application benchmarks, and finds that trigger signals implanted in a single stage can persist and propagate across multiple steps.

Proposes the ACB attack, which implants a backdoor in RLVR with less than 2% poisoned data; when triggered, safety drops by an average of 73%, without affecting normal tasks.

Compiles steering vectors for refusal and compliance behaviors into weight modifications that take effect only when a trigger appears, and uses null-space constraints to remain stealthy, achieving high triggered jailbreak success rates across multiple aligned models.

Targeting backdoors that insert malicious reasoning steps into the chain of thought, cultivated critical thinking through two-stage fine-tuning so that the model recognizes and rejects them, robust against multiple backdoor attacks and generalizable across domains.

Proposes a hop-by-hop monitoring and local subgraph repair method that removes contaminated entities and relations and supplements necessary evidence, recovering a large amount of damaged performance across multiple GraphRAG configurations.

Using only clean auxiliary text to identify and repair suspicious parameters, without triggers or downstream labels, it reduces the success rate of multiple backdoor attacks while maintaining normal task performance.

Malicious nodes attack decentralized GRPO by sharing poisoned answers, reaching a 100% success rate in as few as 50 rounds; two filtering defenses still cannot stop verbose-answer denial-of-service attacks.

Proposes two attacks, token filter and sentence verification, for LLM ensemble scenarios, effectively suppressing backdoor fingerprint responses while maintaining ensemble performance, outperforming existing attack methods.

Proposed M3Att, which injects covert misinformation into text and uses perturbed paired images as query-independent triggers to increase retrieval probability; it stably produces plausible but incorrect diagnoses across five LLMs.

By using type-preserving entity substitution to disrupt the logical connections of a knowledge graph without changing the surface text, GraphRAG defenses are bypassed and its performance is significantly reduced.

MB-Defense is proposed: first merge the attacker and defense triggers into a unified backdoor representation, then neutralize it through training, reducing the success rate of various backdoor attacks while maintaining instruction-following ability.

Backdoors that keep chain of thought normal while only manipulating the final answer can evade defenses based on process monitoring; at a 5% poisoning rate, attack success rates generally exceeded 90% across four datasets and five models.

We propose both local and global poisoning attacks; the local attack achieves a maximum success rate of 56%, while the global attack reduces accuracy to 0 with just one piece of poisoned content, and both bypass existing defenses.

By implanting benign triggers and fine-tuning, the trigger-induced representations are associated with safe outputs, reducing backdoor attack success rates while maintaining task performance in classification, mathematical reasoning, and summarization tasks.

Achieves robust aggregation through retrieval-based text combination sampling and embedding-space geometric structure, gives theoretical bounds on poisoning impact, and in experiments reduces attack success rate to as low as 1% while maintaining 71% accuracy.

Proposes JEST, which shifts post-trigger internal representations from the refusal region to the acceptance region via model editing, achieving stronger jailbreak effects than existing editing methods and increasing model vulnerability to direct prompt attacks.

Systematically reviews backdoor attacks that exploit LLM reasoning, categorizing them into associative, passive, and active types, and summarizes defense methods, unresolved challenges, and research directions.

Proposing BadRDM, which establishes a trigger word shortcut by injecting images into the retrieval database and manipulating the retrieval model, achieving the first effective backdoor attack on retrieval-augmented diffusion models, and it can resist common defenses.

Using black-box feedback reinforcement learning to optimize poisoning documents, inducing attacker-specified outputs in multiple complex RAG systems, with attack success rate improved by up to 0.72 over the baseline.

Proposes an inference-time defense that does not require known backdoor samples, provides theoretical guarantees of asymptotically controllable false acceptance rate, and maintains high detection capability on three benchmarks.

Using visual open-loop accumulated perturbations in action chunking, they achieve a 93.2% attack success rate on LIBERO with a poisoning rate of less than 2%, while maintaining a 95.3% success rate on normal tasks.

Using keyword-guided reasoning and a soft-label mechanism to counteract trigger interference, reducing the average attack success rate to 25.13% and increasing clean sample accuracy to 87.15%.

Propose CTUS, a black-box auditing framework that exposes latent trojan agents through evolutionary dialogue probes, achieving a detection rate of 100% under specific configurations with extremely low false positives on benign systems.

FunPoison is proposed, which can effectively disrupt training by contaminating only 10% of code data, keeping all code compilable and functionally correct, and resisting various cleaning methods.

Proposes STBack, which uses poisoned fine-tuning to make the model generate malicious PLC code when triggered, achieving an average attack success rate of 82.92% and bypassing quality validation.

Finds that encoder poisoning causes persistent semantic damage without a trigger, and proposes the SEMAD framework to quantify internal representation drift and downstream functional mismatch.

Found that LoRA's difficulty in removing backdoors mainly stems from insufficient spectral strength and poor spectral alignment, and proposed RoRA, which significantly reduces attack success rate while maintaining normal accuracy.

Proposes implanting semantically triggered backdoors into fine-tuned agents, leaking user context through memory access and disguised retrieval calls, and finds that multi-turn interactions amplify cumulative leakage.

Proposes a training-free mechanism ABack that monitors leakage tendency during decoding and rewrites responses, improving privacy protection over the strongest baseline by up to 14% under adversarial attacks without reducing response utility.

First study of substructure counting for LLMs under edge local differential privacy constraints in a multi-agent framework. The PSC framework decomposes tasks to node agents and is validated on 6 real datasets.

Combines adaptive orthogonal constraints with latent-space adversarial gating training to reduce gradient conflicts between forgetting and retention objectives, preserving model utility while resisting information recovery.

Released the Apertus open model, which suppresses verbatim memorization through data compliance filtering and the Goldfish pretraining objective, while preserving task performance and expanding multilingual coverage.

Propose a framework for automatically discovering, composing, and adjusting text steganography strategies, combined with a distribution alignment algorithm, improving perplexity and anti-steganalysis performance at high embedding rates.

Found that existing unlearning benchmarks are distorted by insufficient initial memorization and multi-hop reasoning obstacles, proposed ReMem to strengthen foundational memory, and used the Exposure metric to measure the depth of information erasure.

Proposes VideoMIA, which uses cross-frame temporal dependencies to identify whether a specific video participated in training, consistently outperforming baselines in black-box evaluations across ten models and four benchmarks.

Optimize prompts through reinforcement learning to suppress target knowledge and preserve general capabilities without modifying model parameters; removing the prompt restores knowledge access.

Built a membership inference benchmark using same-distribution data before and after training checkpoints to avoid distribution shift interference, and evaluated six existing attacks on Pythia and OLMo models.

Targeting residual to-be-forgotten knowledge in the chain of thought of reasoning models, it uses counterfactual reasoning trajectories for iterative preference optimization, removing the target knowledge from both the chain of thought and the final answer while preserving reasoning ability.

Proposing ContextLens, which enables LLMs to assess compliance with the GDPR and the EU AI Act under incomplete contexts, surpassing baselines without training and identifying missing factors.

Trains a sentence embedding model to match forgetting requests and trigger refusal responses, reducing sensitive information exposure without modifying language model parameters, while nearly fully preserving other knowledge during continuous updates.

Proposing training-free SEGUE, which uses probes to identify concepts to be forgotten and entropy-guided decoding to suppress target knowledge, balancing knowledge suppression and generation quality on copyright, entity, and risk knowledge benchmarks.

Systematically evaluate the trustworthiness impact of low-rank compression, and find that training data privacy is preserved, but protection of personal information in conversations weakens, while adversarial robustness generally increases.

Proposes CanaryRAG, which embeds canary tokens in retrieved chunks drawing on the coal mine canary idea, detecting knowledge base leakage in real time; chunk recovery rate is significantly lower than baselines with almost no impact on performance.

Proposes DP-SynRAG, which generates reusable differentially private synthetic databases to avoid privacy loss accumulation during queries, outperforming existing private RAG systems under a fixed privacy budget.

DTO separately optimizes forgetting of key tokens and utility preservation of remaining tokens, requiring no external resources, improving forgetting quality by up to 16.8 times the baseline across multiple benchmarks.

Proposes CRM cue-controlled evaluation, finding across 32 languages that previously reported PII leakage mainly stems from surface cues; after control, the reconstruction success rate drops significantly.

Studies image membership inference and description metadata extraction in multimodal RAG through conventional model prompting, revealing privacy risks of private retrieved data.

Constructs a document confidentiality evaluation, finds that complex reasoning and cross-modal integration can easily lead to sensitive information leakage, and proposes a framework that separates reasoning from policy verification, outperforming conventional prompt defenses.

Reusing perturbations of repeated words combined with contextual utility modeling reduces privacy budget consumption and maintains semantic coherence in multi-turn dialogues, resisting inference attacks better than existing methods.

Proposes a machine unlearning benchmark for knowledge-overlap scenarios; evaluating nine methods reveals that existing methods struggle to simultaneously delete target-specific content while preserving shared knowledge.

Designing data extraction attacks against GraphRAG, it was found that although it may reduce leakage of original text, it more readily leaks structured information such as entities and relations, and corresponding defenses are explored.

Leveraging the target model's own knowledge to synthesize domain-level and instance-level unlearning sets, improving data relevance, diversity, and efficiency, while enhancing unlearning effectiveness and capability retention.

Constructed a privacy benchmark of over 22,000 audio segments, finding that models can infer private attributes from voiceprints, rarely refuse related requests, and that chain of thought may exacerbate the risk.

Targeting PII leakage risks in multilingual LLMs, proposes two metrics, KSS and KPS, to evaluate the distribution and consistency of forgotten information across languages, and analyzes phenomena unique to multilingual forgetting.

Uses layer-wise relevance propagation to locate privacy neurons and edits them by polarity, reducing privacy leakage risk by an average of 42.7% to 73.5% while maintaining comparable general performance.

Proposes ImageProtector, which embeds nearly invisible perturbations in images to make MLLMs refuse to answer, effective across six models and four datasets, and still resistant to some countermeasures.

Using hyperbolic geometry to separate sensitive instances from general concepts, they more effectively delete targeted visual data on multimodal unlearning benchmarks while preserving general capabilities.

Freezes the backbone and updates only low-rank adapters to suppress or replace specified knowledge, achieving similar effectiveness on multiple fact-forgetting tasks while reducing computational cost by about an order of magnitude.

Systematically review methods, datasets, and benchmarks for multimodal unlearning, and compare the trade-offs among deletion strength, knowledge retention, efficiency, reversibility, and robustness.

Proposes a privacy evaluation benchmark stratified by individual online visibility, testing 18 open-source vision-language models, and finds that models are more likely to leak personal identifying information of high-visibility individuals.

Proposes EZ-MIA, which scores using probability shifts at error positions, requiring only two forward passes; at 1% FPR, it achieves a detection rate of 66.3%, far surpassing previous methods, indicating that privacy risks of fine-tuned models are underestimated.

Find that benign fine-tuning causes models to lose contextual privacy judgment, occurring across six models, while performance on standard safety benchmarks remains good; mechanism analysis shows privacy representations are especially fragile.

Using private text as a seed and adding a differential privacy mechanism to candidate selection, experiments show that the generated data achieves both high fidelity and privacy protection.

Dynamically rewriting the teacher model's reasoning traces both reduces their distillation value and embeds detectable API watermarks. Simple instruction-based rewriting has strong anti-distillation effects without degrading teacher performance.

By identifying retained, forgotten, and unseen samples through local input loss curvature, we detect residual memory missed by conventional metrics, achieving a multi-class ROC-AUC of 82%.

Propose ReGLU, which uses representation subspaces to guide LoRA initialization and constrain updates, achieving higher forgetting quality and model utility on TOFU and WMDP.

Addressing degradation, confabulation, and over-refusal after privacy forgetting, proposes PUBG to guide the output distribution, generating informative and image-grounded answers while protecting target individuals' privacy.

Finds that generated text causes existing membership inference to misjudge, and proposes a mixture-of-experts framework that fuses membership inference features with a generated-text detector, maintaining performance close to the unattacked case under adversarial samples.

Proposed RCU, which uses rotation angles to control the degree of forgetting and orthogonal rotation directions to reduce interference between consecutive requests, alleviating cumulative utility loss without retaining datasets.

Achieve membership inference under output-only text conditions through target model sampling and semantics-aware density estimation, reducing probability estimation error by an order of magnitude, with attack effectiveness surpassing existing methods.

Uses dual adapters and token gating to control sensitive information disclosure, improving task utility while reducing inference attack accuracy on unauthorized requests by up to 31.66 times.

Locates tokens via gradient differences between forget and retain data, then uses self-consistency to generate determined forget segments, maintaining similar forgetting effects on two benchmarks while better preserving knowledge.

At the batch level, mixing original prompts with noisy variants and merging semantically equivalent instructions yields utility more than 20% higher than differentially private baselines, with query cost reduced by up to 5 times.

By constructing verifiable data watermarks through local generation instability, we achieve black-box data usage verification with only minimal modifications to training sequences, while maintaining stealth and model utility.

Formalizes the removal attack GRI against model fingerprints, and proposes the implicit fingerprint ImF based on linguistic steganography, which is more stealthy across 15 LLMs and resistant to updates and prompt intervention.

Points out supply chain risks in the third-party system prompt market, black-box optimizes poisoned prompts that only output manipulated answers to specific queries, reducing F1 on target queries by up to 70%, and can bypass defenses such as perplexity filtering.

They integrate toxicology databases and hazard rules to build a molecular safety knowledge graph, supporting large models in detecting and explaining dangerous structures, and providing standardized safety evaluations for four types of molecular generation tasks.

Constructed the GlobalLies multilingual dataset and found that the probability of LLMs generating false information is higher in low-resource languages and low-HDI countries, and that existing input safety classifiers and retrieval-based fact-checking defenses are uneven.

Reveals a low-probability vanishing vulnerability caused by limited-precision arithmetic, and proposes a sampling-based statistical auditing method that effectively detects AC and Meteor steganography, while semantic detectors are close to random guessing.

Proposes PhishSim, a simulator that verifies compromise by having the victim complete external actions, and PhishGate, a real-time multi-agent risk scorer, improving conversation-level detection across four LLM backends.

Constructs a dataset of 122 logic vulnerabilities and evaluates traditional and LLM-based repair methods, finding that prompt sensitivity, context loss, and difficulty in patch localization are the main failure factors.

Proposes PR2, which uses decision-tree prompts and code-change analysis to guide raw pointer replacement and bug fixing, eliminating 18.57% of local raw pointers in transpiled code from 28 real C projects.

Based on expert-defined stable semantic evidence, first identify clues and then logically determine fraud, which is more robust and efficient than traditional baselines when service scenarios change.

It points out that selective forgetting is easily bypassed by relearning, and proposes implanting a trap during alignment so that if fine-tuning attempts to undo safety alignment, the model's capabilities collapse, while benign fine-tuning is unaffected.

Using only 64 harmful prompts without responses for GRPO can quickly reverse safety alignment, achieving an average attack success rate of 96.01% across five models, outperforming harmful fine-tuning while maintaining general capabilities.

Project perturbations onto directions orthogonal to harmful gradients and optimize only adaptively selected safety-critical layers; reduce the Harmful Score by about 60% on 4 LLMs while downstream utility remains stable.

Characterizing a safety region, first optimizing safety triggers and then aligning internal features, forcing attackers to substantially increase data volume to break safety, with representations remaining stable under malicious fine-tuning.

Found that multi-source synthetic data can mitigate distribution collapse, but fine-tuning on both human and synthetic data can remove safety guardrails, and harmful outputs after synthetic data fine-tuning may be more usable.

Comparing six fine-tuning methods on safety degradation and recovery effects across four models, it finds that ORPO is best at breaking alignment, and DPO is best at restoring alignment, but at the cost of model utility.

Using contextual multi-armed bandits to adaptively combine crowdsourced attack materials, balancing attack effectiveness and diversity, outperforming random combinations and surpassing multiple adaptive methods on HarmBench.

Used multi-agent systems to generate and iteratively test safety tests from policy documents; as tests intensified, GPT-5's safety rate in evaluations related to the EU AI Act dropped from 72.50% to 36.36%.

Simultaneously discovering security weaknesses in both the policy model and the reward model, then sequentially fixing the reward model and the policy model, improving robustness on multiple adversarial safety benchmarks while preserving capabilities.

Uses role settings to guide agents in synthesizing harmful interactions, generating scenarios that are harder to detect than existing benchmarks, with language and topic diversity close to human-created datasets.

Constructs a six-language benchmark and finds that obvious LLM persuasion text is relatively easy to detect, but subtle LLM persuasion consistently degrades automatic detection performance.

Constructs DogBench with 11,150 prompts, finding that dog-whistle prompts that appear harmless but imply harmful intent are more likely to elicit harmful outputs than structurally similar explicit toxic prompts, with roughly four times the risk.

Finding that safety guardrails exhibit selective refusal across different demographic groups, and designing an indirect attack that causes Llama 3.1 to fail to protect previously attacked groups in about 89% of trials.

Uses Monte Carlo tree search for adaptive stress testing, finding that prompt wording, sensor configurations, and noise can induce hallucinations, uncertain behavior, and even driving collisions in large-model planners.

Constructing a bilingual red-team benchmark covering 14 categories of financial crime and ethical violations, finding that models are more vulnerable to attacks in Chinese scenarios, and that prompt-level defenses struggle against covert manipulation.

Proposes an attack-agnostic robustness metric based on refusal score intervals, obtains robustness rankings consistent with attack evaluations across eight models, and improves evaluation speed by 5 to 8 times.

It builds a draft collaborative writing jailbreak benchmark, finds that existing models easily generate harmful continuations, and reduces harmful outputs through preference optimization without harming collaborative writing ability.

POLARIS compiles natural language policies into first-order logic and builds a semantic policy graph, generating traceable test queries; it outperforms baselines in both policy coverage and number of successful attacks.

Proposes a safety-policy-based automated red-teaming framework that balances risk coverage, diversity, and faithfulness, achieving attack success rates of 99.5% and 96% against GPT-4o and Claude 3.5.

Extracting evidence related to malicious intent from responses to assess whether a jailbreak substantially succeeds, achieving 97.27% accuracy on 330 human-annotated samples.

Evaluating six watermarking methods and four models, we find that watermarks can inflate judge-assessed jailbreak success rates without correspondingly increasing harmful goal compliance, suggesting the need for additional human and goal-compliance evaluations.

Proposes a role-aware harm taxonomy and multi-turn adversarial evaluation framework, uncovering role-related and cumulative mental health safety failures missed by static benchmarks.

构建逾三万条样本评测多轮情境安全，发现模型常漏判渐进风险或过度拒答，现有护栏也未能完全解决这些问题。

Evaluating safety robustness solely based on hidden-layer representation trajectories and the JSS metric, it aligns highly with red-team rankings across over 40 models and 20 red-team strategies, at less than 1% of the cost.

Compiles 12,985 rules and 106,009 real compliance cases covering 74 regulations and policies from authoritative sources, and uses these to evaluate the safety compliance capabilities of models of different sizes.

Constructing a persona-driven multi-turn simulation and harm evaluation framework, we tested Replika's responses to high-risk users; we found that it often echoes or normalizes unsafe content such as self-harm, eating disorders, and violent fantasies.

Evaluated eight multimodal large models on 200 health short videos and found significant differences in the models' ability to identify false information, and that they are easily misled by social cues such as authoritative account badges.

Proposes the Rt-LRM benchmark, evaluating LRM trustworthiness from three aspects: truthfulness, safety, and efficiency; experiments on 26 models show that LRMs are more vulnerable than LLMs to reasoning-induced risks.

Uses multi-armed bandits to online select LoRA experts with different attack styles, improving attack success rate when the exploration budget is sufficient, and reveals the target model's weaknesses against different attack styles.

Proposing an automated red-teaming framework, finding that changes to benign visual elements can cause NSFW missed detection, with a prompt rewriting model trained on failure cases increasing detection evasion probability by up to sixfold.

Builds an attack strategy library through multi-agent game play and fine-tunes red team agents, using multi-turn dialogue to induce code models to generate vulnerable code, outperforming single-turn and multi-turn baselines.

By reversing the harmlessness principle and the critique-revision process to generate red-team data, probability truncation improves semantic coherence by 15% while maintaining adversarial strength.

Build a multi-turn safety benchmark with ten thousand samples, evaluate 17 models and find that attack risk increases with turns, and propose a dialogue safety regulator more effective than existing guardrails.

Constructed a bilingual jailbreak benchmark covering 16 minority groups and found that the same model's defense rate varies significantly across groups, and that directed preference optimization can improve safety generalization to unseen groups.

Combines multi-agent and strategy-response multi-layer networks to organize attack search, reducing redundant exploration and achieving higher attack success rates at lower computational cost.

Proposes knowledge-graph-guided harmful prompt generation plus two obfuscation rewriting strategies to construct a dataset with both domain relevance and implicitness, for more realistic domain red-teaming.

Proposes the CulShield benchmark covering more than 2,000 taboos across 77 countries and regions, finding that models know the taboos but often fail to comply with them in interactions.

Propose a multi-image reasoning safety benchmark; evaluating 19 models reveals that models with stronger reasoning may be more susceptible to attacks, and some safe answers actually stem from misunderstanding or avoidance.

Building a benchmark covering 61 types of risks and four modality combinations, simultaneously evaluating harmful query vulnerabilities and excessive refusal of benign inputs; testing 22 MLLMs, finding they struggle to balance the two, being especially vulnerable to pure image and cross-modal risks.

Proposes the SaLAD benchmark containing 2,013 real image-text samples; evaluating 18 models finds that the best model achieves only a 57.2% safe response rate on unsafe queries.

Builds a five-level risk benchmark containing 3,840 red-team prompts, evaluates five models and two defense strategies, and reveals safety gaps and defense trade-offs in extremist content generation.