Skip to content
Oct 12 · Monday

All papers

1904 papers
Filter

Attack type

Jailbreaks224Prompt injection232Poisoning and backdoors143Model tampering34Extraction and theft75Detection evasion71Denial of service10Malicious use26

Attack technique

Gradient and representation optimization53Automated search104Multi-turn escalation26Encoding and obfuscation51Role-play and persuasion28Conversation structure manipulation16Reasoning-chain manipulation13Cross-modal payloads51Side channels4Defense-targeted43Dormant triggers52Selection manipulation12

Model risks

Deception and scheming63Reward hacking68Misalignment and value divergence56Dangerous agent actions81Dangerous capabilities29Inappropriate refusal67Hallucination and fabrication42Bias and discrimination21

Defense type

Model hardening139Inference-time intervention51Detection and filtering99Instruction–data separation57Permissions and approval71Monitoring and auditing63Watermarking and provenance20

Impact

Harmful content284Unauthorized actions207Data and privacy leaks125Output manipulation302Availability and reliability85Oversight failure119Increased misuse capability17

System type

Models and APIs809LLM applications127AI Agent626coding agent131science agent32web agent33Browser and computer use18Multi-agent systems76Embodied systems and robotics45

Attacker access

Black-box146Gray-box15White-box54No-box (offline transfer)6

Attack surface / entry point

User input367Web pages and interfaces66Documents and messages81Tool responses104Tool and skill descriptions57Code repositories and dependencies30Retrieval corpus33Memory writes37Inter-agent messages27Images, audio and video113Training data69Weights and gradients64Distribution channels57Inference services and hardware21

Layer

Prompt layer213Model layer413Application layer681Training and data layer224Infrastructure layer23

System component

MCP and skills79Memory71RAG46Guardrails and judges156Monitors89Reasoning chains72Permissions and sandboxing93Fine-tuning and open weights61Vision124Audio37Video13Image generation46Embeddings10Multimodal208
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 350papers have no tags yet and are not included in filtered results.
  1. OtherarXiv 2610.13912

    RSI-Anything: Unlocking Recursive Self-Improvement with World Models

    RSI-Anything uses world models for selection and retention.

    arXiv
    2610.13912
    Published
    Evaluated models
    ReasonFlux-Coder-7B、4B policy、W1
    AbstractRSI-Anything integrates world models into recursive self-improvement through prediction, feedback, and retention checks, and reports gains across multiple domains.

    RSI-Anything is a cross-domain framework: it uses world model predictions to decide which candidates to take external feedback for, then uses the feedback to decide whether the policy, workflow, or predictor is updated, and uses checks to decide which pair is retained. The difficulty to address is the limited interaction budget, and the fact that once the policy changes, the candidate distribution faced by the predictor also changes. The authors argue that improving only one side does not guarantee that the assembled system will be better.

    Deep readingFull reading
  4. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box、Black-box
    Evaluated models
    Wan2.2-TI2V-5B、HunyuanVideo-1.5、Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Deep readingFull reading
  6. OtherarXiv 2610.13479

    A local agentic AI framework generates edge-case scenarios for safety assurance

    Proposes a local dual-model closed loop to generate edge scenarios for autonomous system safety assurance

    arXiv
    2610.13479
    Published
    Layer
    Application layer
    Setting
    LLM applications、Embodied systems and robotics
    Evaluated models
    PPO
    AbstractLocal closed-loop generation of JSON edge cases.

    The authors built a local agentic loop that runs on a laptop to generate edge cases for safety arguments of autonomous systems, rather than releasing a new public test set.

    Deep readingFull reading
  8. OtherarXiv 2610.13372

    Toward Safe World Models: Risks, Defenses, and Evaluation

    A survey of risks, defenses, and evaluation in the six-stage lifecycle of world models

    arXiv
    2610.13372
    Published
    Layer
    Application layer
    Setting
    Embodied systems and robotics
    AbstractSafety is written as a property of the prediction-decision closed loop; claims must be linked to observed consequences and versions.

    World model safety is organized by the nature of the prediction-decision loop, not by isolated prediction scores.

    Deep readingFull reading
  9. DefensesarXiv 2610.13333

    LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

    Proposes LETHE, which perturbs reference images to block unauthorized image-to-video

    arXiv
    2610.13333
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-I2V-14B、CogVideoX-5B-I2V、LightX2V and others6
    AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.

    LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.

    Deep readingFull reading
  11. InterpretabilityarXiv 2610.13078

    Attention sees, MLP refuses: tracing the safety pathway from attention to MLP in LLMs

    Trace attention to identify harmfulness to the MLP refusal write pathway and propose Sentinel

    arXiv
    2610.13078
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct、Qwen2.5-7B-Instruct、Qwen3-8B-Instruct and others18
    AbstractAttention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.

    The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.

    Deep readingFull reading
  12. Analysis and theoryarXiv 2610.13051

    Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

    Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining

    arXiv
    2610.13051
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-32
    AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.

    The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.

    Deep readingFull reading
  13. InterpretabilityarXiv 2610.12989

    GPT-2-Small, Gemma-2-2B, and Llama-3.1-8B have interpretable narrative mechanisms

    Using NVC to locate and ablate narrative-related components in language models

    arXiv
    2610.12989
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    GPT-2-Small-124M、Gemma-2-2B、Llama-3.1-8B
    AbstractNeurons and SAE features related to narrativity across three models, when ablated, changed some narrative-related behaviors.

    The authors connect a three-dimensional definition from narratology to mechanistic interventions, examining whether components related to narrativity in pretrained language models participate in prediction, generation, and downstream tasks.

    Deep readingFull reading
  14. OtherarXiv 2610.12924

    Sparse dictionary learning for measure-valued data based on linearized optimal transport: efficient algorithms and sample complexity

    Propose LWDL, a measure sparse dictionary learning method under linearized optimal transport

    arXiv
    2610.12924
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    AbstractLWDL learns sparse measurement dictionaries in flat embedding spaces.

    LWDL embeds probability measures into a Hilbert space, then performs sparse dictionary learning.

    Deep readingFull reading
  15. InterpretabilityarXiv 2610.12842

    Neural networks are more modular than single neurons suggest

    Using a three-level nested decomposition to test whether mixed-selectivity networks can be functionally separated on subspaces

    arXiv
    2610.12842
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Pythia 410M、Pythia 160M、GPT-2 XL and others18
    AbstractUnit non-specialization and subspace separability can coexist.

    The authors propose a nested definition of modularity to separate "neurons not being specialized" from "computation not being separable."

    Deep readingFull reading
  16. Risky behaviorarXiv 2610.12822

    Reward hacking as a transmissible strategy in multi-agent coding systems

    Show that reward hacking can propagate through code, memory, and plans in multi-agent coding systems

    arXiv
    2610.12822
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems、coding agent
    Evaluated models
    Qwen2.5-Coder-14B、Gemma-3-12B、Qwen2.5-Coder-7B and others16
    AbstractThe authors state that reward hacking can spread across models and affect routing and aggregation, and that review can reduce delivery.

    Reward hacking induced by coding RL can leave the source agent and enter subsequent collaboration and system coordination.

    Deep readingFull reading
  17. Evaluation and benchmarksarXiv 2610.12758

    DistressBench: Evaluating multi-dimensional crisis support in large language models

    Introduces DistressBench, evaluating models' multidimensional support in crisis conversations

    arXiv
    2610.12758
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Muse Spark 1.2、Muse Spark 1.3、Muse Glimmer 30B and others20
    AbstractThe model is more restrained and acts less.

    DistressBench uses SSH dialogues written and revised by clinical personnel, and evaluates how much necessary care general chat models deliver according to weighted atomic criteria, rather than whether they refuse. When users disclose suicidal ideation or self-harm to a chat model, the authors consider the expected behavior to be recognizing the crisis, calibrating empathy, de-escalating, and referring to human help. Refusal-based evaluations cannot detect failing to act after recognizing the crisis.

    Deep readingFull reading
  18. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct、Qwen2.5-7B-Instruct、Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Deep readingFull reading
  19. Evaluation and benchmarksarXiv 2610.12569

    SWE-Duel: Toward a Self-Expanding Arena for Coding Agents

    Proposes SWE-Duel, which lets coding agents mutually evaluate, create problems, and blindly review fixes during evaluation.

    arXiv
    2610.12569
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.5、Claude Opus 4.8、Kimi K2.7 Code and others11
    AbstractThe mutual evaluation arena creates questions during evaluation.

    SWE-Duel is a coding agent arena that generates tasks and judges only at evaluation time, to avoid leakage and saturation of static benchmarks.

    Deep readingFull reading
Load more