Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

System type：Models and APIs System type：coding agent Attacker access：Black-box Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11112Oct 8
EpiReal-Bench：商用图像生成模型虚假声明红队基准
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
arXiv
2610.11112
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
- AttacksJailbreaks
- ComponentImage generation
Abstract四款商用图像模型能把假主张画成可信证据。
EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
Paper analysisRead analysis
AttacksarXiv 2610.07323Oct 6
ATLAS：用自适应信任域与主动学习搜索潜在对抗样本集
提出 ATLAS 用水平集估计恢复黑盒分类器的对抗输入集合
arXiv
2610.07323
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LeNet5, ResNet50 (CIFAR-10 standard), ResNet50 (ImageNet standard) and others5
- AttacksDetection evasion
- TechniqueAutomated search
AbstractATLAS 用主动水平集估计构造黑盒对抗集，作者称其集合比单点攻击更具代表性。
ATLAS 是一个查询式 black-box 框架，用来构造诱发失败的对抗输入集合，供鲁棒性审计使用。
Paper analysisRead analysis
AttacksarXiv 2610.06848Oct 6
TranScope：利用 CPU 性能计数器对 Transformer 做成员推断攻击
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
arXiv
2610.06848
Published
Oct 6
Layer
Infrastructure layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
BERT (4.4M-340M), ViT (22M-307M), Pythia (70M-2.8B) and others5
- AttacksExtraction and theft
- TechniqueSide channels
AbstractTRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
Paper analysisRead analysis
AttacksarXiv 2610.05282Oct 4
Red-TTT：用测试时训练实现大语言模型自动化越狱
提出 Red-TTT，在攻击过程中更新攻击者实现自动化越狱
arXiv
2610.05282
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3-8B-Instruct, gpt-oss-20b, gpt-4.1-mini and others4
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2610.03124Oct 2
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
arXiv
2610.03124
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
Paper analysisRead analysis
AttacksarXiv 2609.39902Sep 30
CodeMimicry: Exploiting code-domain safety generalization lag for structured code completion jailbreaks.
提出 CodeMimicry，以结构化代码补全诱导模型生成有害内容
arXiv
2609.39902
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, GPT-4.1, GPT-5-chat and others10
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.38899Sep 30
SceneJail: Jailbreaking multimodal large models using video scene context
提出 SceneJail，利用视频情境上下文越狱视频多模态模型
arXiv
2609.38899
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-VL-7B-Instruct, Qwen2.5-VL-32B-Instruct, Qwen3-VL-8B-Instruct and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2609.38253Sep 29
CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.
提出 CollageAttack，用空间文本碎片重组越狱文生图模型
arXiv
2609.38253
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
Paper analysisRead analysis
AttacksarXiv 2609.36956Sep 29
研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
arXiv
2609.36956
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GLM-5, Gemini-3.5-Flash, Qwen3-32B and others4
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Abstract作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。
BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架，研究没有目标数值概率时，采样能否支持逐步控制。
Paper analysisRead analysis
AttacksarXiv 2609.36941Sep 29
研究者提出针对黑盒 LLM 的实用密钥提取框架
提出用扰动蒸馏本地代理并离线过滤来提取黑盒模型凭据
arXiv
2609.36941
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
DeepSeek-Coder-7B, LLaMA-3-8B, Qwen2.5-Coder-7B and others6
- AttacksExtraction and theft
Abstract论文提出扰动蒸馏与离线过滤两阶段框架，实现了 output-only 访问下延迟降低的黑盒大模型 API key 提取。
Paper analysisRead analysis
AttacksarXiv 2609.36474Sep 29
FinRT：将自适应红队策略蒸馏为消费金融领域的可复用对抗生成器
提出 FinRT，将消费金融自适应红队轨迹蒸馏为可复用对抗提示生成器
arXiv
2609.36474
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3.3-70B, Llama-3.1-8B, Mixtral-8x7B and others6
- AttacksJailbreaks
- TechniqueAutomated search
AbstractFinRT 用前向失效发现加校准代理 DPO，把消费金融红队收成单次前向生成器。
FinRT 是面向消费金融的红队框架：先发现政策失效，再训练一个按政策、领域与目标行为出提示的生成器。
Paper analysisRead analysis
AttacksarXiv 2609.36331Sep 29
无需参考模型：用邻居样本校准单轮成员推理攻击
提出用邻居分数替代参考模型的单轮成员推断
arXiv
2609.36331
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
目标分类模型（架构与训练流程遵循 Aerni et al.）
- AttacksExtraction and theft
Abstract邻居查询在单模型上恢复逐样本校准，合成邻居加早期检查点最接近 LiRA。
本文研究 one-round 成员推断：只有一个目标模型、不能再训练参考模型时，如何仍做逐样本校准，并用于单次运行的 DP 审计。
Paper analysisRead analysis
AttacksarXiv 2609.35699Sep 29
论文：蒸馏防御在蒸馏后强化学习下易被攻破
提出用 API 推理摘要重建轨迹再蒸馏加强化学习，攻破蒸馏防御
arXiv
2609.35699
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others12
- AttacksExtraction and theft
- ComponentReasoning chains
Abstract更现实的蒸馏攻击是蒸馏后再 RL。
这篇工作修订蒸馏攻击的威胁模型：攻击者经合法 API 收集闭源推理数据，先蒸馏自有模型，再做强化学习。作者认为只在蒸馏后评估防御，会漏掉后续 RL，从而高估防御。
Paper analysisRead analysis
AttacksarXiv 2609.34920Sep 28
RISE：用迭代策略演化对现代文生图模型做红队测试
提出 RISE，迭代演化可复用策略对文生图模型做红队
arXiv
2609.34920
Published
Sep 28
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
DALL·E 3, Nano Banana 2, GPT-Image-2 and others7
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2609.33985Sep 28
研究：众包微调数据投毒可放大专有指令抽取
提出主题锚点投毒，放大众包微调后的专有指令提取
arXiv
2609.33985
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct, Llama-3.1-8B-Instruct and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出基于主题锚点的数据中毒攻击，证明低比例的中毒样本可在黑盒条件下隐蔽放大微调指令泄漏。
Paper analysisRead analysis
AttacksarXiv 2609.33136Sep 27
Leaky Students：针对 on-policy distillation 的成员推断攻击
提出 Leaky，用新鲜轨迹的 token 对数概率差推断 OPD 训练记录成员身份
arXiv
2609.33136
Published
Sep 27
Layer
Model layer
Setting
Models and APIs
Attacker
Gray-box, Black-box
Evaluated models
Qwen3-1.7B, Qwen3-4B, Qwen3.5-2B and others5
- AttacksExtraction and theft
Paper analysisRead analysis
AttacksarXiv 2609.29775Sep 24
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
arXiv
2609.29775
Published
Sep 24
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2609.23596Sep 20
StyleAT：用对抗训练防御人脸识别的语义攻击
提出 BoundStyle 与 StyleAT，对抗训练防御人脸识别语义攻击
arXiv
2609.23596
Published
Sep 20
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
MobileFaceNet (MobileFace), ResNet (ResNet-152, IR-SE), RepVGG and others7
- DefensesModel hardening
- AttacksDetection evasion
AbstractBoundStyle 用 StyleGAN3 有界潜编辑快速攻击 FR。
StyleAT 用可调的 StyleGAN3 潜空间攻击 BoundStyle 对人脸识别做对抗训练，以抵抗一般语义编辑，并在评测中面对训练时未见的 DiffPrivate。
Paper analysisRead analysis
AttacksarXiv 2609.31664Sep 15
什么驱动方言越狱？对表层形式、文化框架与策略库的消融研究
消融比较方言越狱中表层形式、文化框架与策略库的作用
arXiv
2609.31664
Published
Sep 15
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, DeepSeek-Reasoner, DeepSeek-Chat
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2609.12909Sep 11
研究者在双 T4 上复现并插桩 Tree-Ring 语义水印伪造攻击
复现 Tree-Ring 语义水印的黑盒伪造并恢复检测统计量
arXiv
2609.12909
Published
Sep 11
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Stable Diffusion XL base 1.0
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentImage generation
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop