Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 15 papers Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
Published Sep 7
Evaluated models Wan , CogVideoX , LTX-Video and others9 Abstract DIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。 。
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
Published Jun 1
Evaluated models gemini-2.5-flash-image , qwen-image-2.0 , Tongyi Wanx 2.5 Abstract DSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
Published May 20
Evaluated models GPT-5.2 , GPT-5.4 , Claude-Opus-4.6 and others15 Abstract FRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
Published May 18
Evaluated models GPT-4V , GPT-4o , GPT-5 and others10 提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
Published May 8
Evaluated models LLaDA-V , LaViDA Abstract 作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。 。
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
Published May 7
Evaluated models GPT-5.4-nano , GPT-5.4-mini , Gemini-2.5-Flash and others19 提出 SWhisper，用近超声波向语音驱动 LLM 隐蔽注入越狱提示
Published Mar 14
Evaluated models Meta-Llama-3.1-8B-Instruct , Gemma-3-4B , Qwen2.5-7B-Instruct and others9 Propose StructAttack, which uses structural diagrams to induce visual models to assemble malicious content from harmless semantic slots.
Published Mar 8
Evaluated models GPT-4o (1120) , Gemini-2.0-Flash (001) , Gemini-2.5-Flash and others6 Abstract StructAttack decomposes a harmful query into harmless slots and draws them into a structure graph, inducing the LVLM to fill in harmful content under a black-box single query.StructAttack is a black-box, single-query jailbreak against LVLMs: it decomposes a harmful instruction into separate seemingly harmless slots, draws them into a structural diagram, and then makes the model reassemble the slots into harmful content.
提出 MIDAS ，把有害语义拆进多张视觉谜题并跨图重构以越狱多模态模型
Published Feb 28
Evaluated models GPT-4o , GPT-5-Chat , Gemini-2.5-Pro and others7 提出 COMET 跨模态纠缠攻击，越狱视觉语言模型
Published Feb 10
Evaluated models GPT-4.1 , GPT-4.1-mini , Gemini-2.5-Flash and others9 Abstract COMET 做黑盒跨模态纠缠越狱。COMET 是面向具备多模态推理的 VLM 的黑盒越狱，用来红队测试跨模态安全对齐。作者要处理的缺口是：把恶意线索分到图文的固定组合，测不到多步推理里才出现的漏洞。攻击不访问梯度，只构造图文输入。
提出 Text-DJ，用拆分文本图网格越狱视觉语言模型
Published Jan 31
Evaluated models Qwen/Qwen3-VL-4B-Instruct , Qwen/Qwen3-VL-8B-Instruct , Qwen/Qwen3-VL-30B-A3B-Instruct and others6 提出 GAMBIT 游戏化越狱框架，用拼图与竞赛场景攻击多模态模型
Published Jan 7
Evaluated models Qwen2.5-VL , InternVL 2.5 , GPT-4o and others8 Attacks arXiv 2512.20168 · Dec 23, 2025 提出双重隐写越狱 Odysseus，用图像隐写绕过多模态系统安全过滤器
Published Dec 23, 2025
Evaluated models GPT-4o-2024-08-06 , Gemini-2.0-pro , Gemini-2.0-flash and others4 Attacks arXiv 2511.16110 · Nov 20, 2025 提出 MFA 框架，协同突破视觉语言模型的对齐、提示与审核层
Published Nov 20, 2025
Evaluated models MiniGPT-4 , LLaMA-4-Scout-Inst , LLaMA-3.2-11B-Vision-Instruct and others17 Abstract 作者称多层防御的 VLM 仍存在跨模型漏洞，MFA 整合三项技术实现了端到端越狱。
Attacks arXiv 2504.01094 · Apr 2, 2025 提出 MULTI-AUDIOJAIL，以多语多口音和声学扰动越狱音频模型
Published Apr 2, 2025
Evaluated models Qwen2-Audio , DiVA-llama-3-v0-8b , MERaLiON-AudioLLM-Whisper-SEA-LION and others5 Abstract 黑盒多语多口音音频加声学扰动可抬高 LALM 的 JSR，文本示范防御并非在每个模型上都下降。
You have reached the end