Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 26 papers Another 213 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
Published Oct 7
Evaluated models LLaVA-1.5-7B Abstract 剪枝去掉背景 token 后注意力塌向恶意前景。这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
提出扩散潜空间地理扰动防御，抑制视觉语言模型泄露精确地理位置
Published Sep 18
Evaluated models GPT-4.1 , GPT-5 , Gemini 2.5 Pro and others5 提出 MAMJ，在元层面交替优化多模态越狱的策略提示与攻击者权重
Published Aug 27
Evaluated models GPT-4o , Gemini-3-Pro-Preview , Seed 2.0 提出 SPARED，用对抗编辑数据训练基于推理的 AI 生成图像检测器
Published Aug 13
Evaluated models Qwen3.5-9B Abstract SPARED 用防捷径的编辑对抗环训练 9B 推理检测器。SPARED 是一套用于可解释 AI 生成图像检测的攻防强化学习流程，报告模型是 Qwen3.5-9B 上的第三轮防御器。
提出 INFER+ 信息过载方法，越狱大型视觉语言模型
Published Jul 3
Evaluated models Qwen3-VL-8B , Qwen2-VL-7B , InternVL3.5-8B and others8 Abstract 用图文过载越狱 LVLM。这篇工作用信息过载 越狱 LVLM，而不是靠 OOD 变换隐藏意图。
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
Published Jun 1
Evaluated models gemini-2.5-flash-image , qwen-image-2.0 , Tongyi Wanx 2.5 Abstract DSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
Published May 20
Evaluated models GPT-5.2 , GPT-5.4 , Claude-Opus-4.6 and others15 Abstract FRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
Published May 18
Evaluated models GPT-4V , GPT-4o , GPT-5 and others10 提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
Published May 8
Evaluated models LLaDA-V , LaViDA Abstract 作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。 。
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
Published May 7
Evaluated models GPT-5.4-nano , GPT-5.4-mini , Gemini-2.5-Flash and others19 提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型
Published Mar 10
Evaluated models GPT-4o , Claude 3.7 Sonnet , GLM-4V-Plus and others7 Abstract VROP 以良性视觉 gadget 与控制流提示词做组合越狱。VROP 是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。
Propose StructAttack, which uses structural diagrams to induce visual models to assemble malicious content from harmless semantic slots.
Published Mar 8
Evaluated models GPT-4o (1120) , Gemini-2.0-Flash (001) , Gemini-2.5-Flash and others6 Abstract StructAttack decomposes a harmful query into harmless slots and draws them into a structure graph, inducing the LVLM to fill in harmful content under a black-box single query.StructAttack is a black-box, single-query jailbreak against LVLMs: it decomposes a harmful instruction into separate seemingly harmless slots, draws them into a structural diagram, and then makes the model reassemble the slots into harmful content.
提出 MIDAS ，把有害语义拆进多张视觉谜题并跨图重构以越狱多模态模型
Published Feb 28
Evaluated models GPT-4o , GPT-5-Chat , Gemini-2.5-Pro and others7 Propose COMET cross-modal entanglement attack to jailbreak vision-language models
Published Feb 10
Evaluated models GPT-4.1 , GPT-4.1-mini , Gemini-2.5-Flash and others9 Abstract COMET performs black-box cross-modal entanglement jailbreak.COMET is a black-box jailbreak for VLMs with multimodal reasoning, used to red-team cross-modal safety alignment. The gap the authors address is: distributing malicious cues into fixed combinations of image and text cannot detect vulnerabilities that only appear in multi-step reasoning. The attack does not access gradients; it only constructs image and text inputs.
提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标
Published Feb 5
Evaluated models Llama-3.2-11B , InternVL3-8B , Qwen3-VL-8B and others8 Abstract 作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。
提出 Zero2Text，无需训练地跨域反演文本嵌入
Published Feb 2
Evaluated models GTR-Base , Qwen3-Embedding-0.6B , Text-Embedding-3-small and others4 Abstract 零训练在线对齐可在未知域、无泄漏对时从黑盒 embedding 还原句子。Zero2Text 是一种不训练 decoder、也不使用泄漏文本–向量对的文本 embedding 反演，针对 RAG 向量库在严格黑盒、目标域未知时的还原。
提出 UltraBreak，用单张对抗图像对视觉语言模型实施可迁移越狱
Published Feb 1
Evaluated models Qwen2-VL-7B-Instruct , Qwen-VL-Chat , Qwen2.5-VL-7B-Instruct and others13 提出 Text-DJ，用拆分文本图网格越狱视觉语言模型
Published Jan 31
Evaluated models Qwen/Qwen3-VL-4B-Instruct , Qwen/Qwen3-VL-8B-Instruct , Qwen/Qwen3-VL-30B-A3B-Instruct and others6 提出 ReAct 双策略，按反馈改写提示并扰动图像绕过 VLM 安全过滤
Published Jan 30
Evaluated models Gemini-2.0-Flash 提出多轮多模态越狱，并用 FragGuard 拦截有害响应
Published Jan 9
Evaluated models LLaVa-1.6 (7B) , LLaVa-1.6 (13B) , Qwen-2-7B and others5