Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Multi-turn escalation Attacker access：Black-box Clear all

Another 254papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2609.15383Sep 14
微软团队提出 capability laundering 攻击：弱模型拆分任务向对齐前沿模型套取能力
提出能力洗钱攻击，拆分任务向对齐模型套取能力
arXiv
2609.15383
Published
Sep 14
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-5.5, Claude Opus 4.8, Grok-4.3 and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者提出了能力洗钱攻击，发现未对齐编排器分解咨询对齐模型可恢复能力差距，指出需建立跨会话防御。
Paper analysisRead analysis
AttacksarXiv 2609.02414Sep 2
Blueprint 框架用世界观模拟与 18 个影响因子提升多轮越狱成功率
提出多轮越狱框架 BLUEPRINT，用世界观模拟与心理因素诱导有害输出
arXiv
2609.02414
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen3-Next-80B, DeepSeek-V3.2, GLM-4.7 and others6
- AttacksJailbreaks
- TechniqueMulti-turn escalation
AbstractBLUEPRINT 解耦多轮越狱策略与情境模拟，揭示任务具象化是摆脱拒绝的核心机制，为多轮安全防御提供新视角。
BLUEPRINT 是一个将因子化社会影响力策略空间与跨轮世界观模拟解耦的多轮大语言模型安全评测框架。
Paper analysisRead analysis
AttacksarXiv 2608.07430Aug 8
研究者提出 SN-Guided Diffusion，利用扩散大模型安全神经元实现离线越狱
提出 SN-Guided Diffusion，利用安全神经元实现离线越狱
arXiv
2608.07430
Published
Aug 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen2.5-7B-Instruct, LLaDA-8B-Instruct, Dream-Instruct-7B and others15
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。
论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。
Paper analysisRead analysis
AttacksarXiv 2607.23496Jul 26
Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景
提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
arXiv
2607.23496
Published
Jul 26
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B and others6
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。
Paper analysisRead analysis
AttacksarXiv 2607.00481Jul 1
研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM
提出 SMT 框架，用模拟审核轨迹越狱函数调用 LLM
arXiv
2607.00481
Published
Jul 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o, GPT-5.4, Qwen3-Max and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2606.00150May 29
Persona Attack：通过增量记忆注入越狱大语言模型
提出 Persona Attack，分步写入对话记忆指令以越狱
arXiv
2606.00150
Published
May 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Llama-3.2-3B-Instruct, ChatGPT-4o and others5
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2605.21541May 20
研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
arXiv
2605.21541
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。
FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
Paper analysisRead analysis
AttacksarXiv 2605.07399May 8
研究者提出 GPO-V，用全局概率优化越狱扩散视觉语言模型
提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
arXiv
2605.07399
Published
May 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
LLaDA-V, LaViDA
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Abstract作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。
GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。。
Paper analysisRead analysis
AttacksarXiv 2605.04446May 6
Misrouter：利用 MoE 路由机制对混合专家大模型发起仅输入攻击
提出 Misrouter，借 MoE 路由优化仅输入前缀并迁移攻击
arXiv
2605.04446
Published
May 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o mini, Qwen-Plus, Phi-4 and others18
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2604.24082Apr 27
研究者提出意图伪装多轮越狱方法，可攻破 GPT-5-thinking 与 Claude-Sonnet-4.5
提出多轮意图欺骗越狱 iDecep，用良性意图伪装引出有害内容
arXiv
2604.24082
Published
Apr 27
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Gemini-2.5-Flash, Claude-Sonnet-4.5 and others4
- AttacksJailbreaks
- TechniqueMulti-turn escalation
AbstractiDecep 用意图欺骗做多轮越狱，在 GPT-5 与 Claude-Sonnet-4.5 上同时测到直接成功和 para 成功。
iDecep 是一种黑盒多轮越狱：用表面良性的意图维持与恶意目标贴近的对话，并单独计入 safe completion 替代内容中的有害信息。。
Paper analysisRead analysis
AttacksarXiv 2603.23269Mar 24
Not All Tokens Are Equally Important: Query-Efficient Jailbreak Fuzzing for LLMs
提出 TriageFuzz，用替代模型定位敏感片段做查询高效越狱
arXiv
2603.23269
Published
Mar 24
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemma-7B-Instruct, Gemma2-9B-Instruct, LLaMA3-8B-Instruct and others9
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2603.15684Mar 15
多轮语言模型交互中的状态依赖安全失效
提出 STAR 多轮角色扮演框架，利用对话状态演化绕过安全对齐
arXiv
2603.15684
Published
Mar 15
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Claude 3.5 Sonnet, Gemini 2.0-Flash and others5
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2603.13847Mar 14
SWhisper 用近超声隐蔽声学通道对语音驱动 LLM 实现黑盒越狱
提出 SWhisper，用近超声波向语音驱动 LLM 隐蔽注入越狱提示
arXiv
2603.13847
Published
Mar 14
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta-Llama-3.1-8B-Instruct, Gemma-3-4B, Qwen2.5-7B-Instruct and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2603.20198Feb 5
研究者提出 MM-Plan 多模态越狱框架
提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标
arXiv
2603.20198
Published
Feb 5
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3.2-11B, InternVL3-8B, Qwen3-VL-8B and others8
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Abstract作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。
MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。
Paper analysisRead analysis
AttacksarXiv 2602.03265Feb 3
Beyond Suffixes: The Impact of Token Position in GCG Adversarial Attacks on Large Language Models
比较 GCG 对抗 token 作为前缀与后缀的越狱效果
arXiv
2602.03265
Published
Feb 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
deepseek-llm-7b-chat, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3 and others5
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2601.21233Jan 29
Just Ask: Curious Code Agents Reveal System Prompts of Frontier LLMs
提出 JustAsk，用在线技能选择提取模型系统提示词
arXiv
2601.21233
Published
Jan 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
anthropic/claude-opus-4.5, openai/gpt-5.2-codex, GPT-5.2 and others19
- AttacksExtraction and theft
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2601.20903Jan 28
ICON: Efficient Multi-Turn Jailbreak Attacks via Intention-Context Coupling
提出 ICON 多轮越狱，用意图-上下文先验生成攻击序列
arXiv
2601.20903
Published
Jan 28
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-4-Maverick-Instruct, Llama-3.1-405B-Instruct, Qwen-Max-2025-01-25 and others11
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2601.05466Jan 9
Jailbreaking large language models through reinforcement learning with iterative tool disguise attacks
提出 iMIST，用工具伪装和 PPO 迭代越狱大语言模型
arXiv
2601.05466
Published
Jan 9
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
DeepSeek-V3, Qwen3-32B, GPT-OSS-120B
- AttacksJailbreaks
- TechniqueAutomated search
AbstractiMIST 用工具伪装和在线 PPO 做黑盒越狱，Table I 中 JADES 高于同格基线。
iMIST是黑盒越狱方法：把恶意查询伪装成合法工具调用，再用在线强化学习把响应的有害性分数往上推。
Paper analysisRead analysis
AttacksarXiv 2601.05445Jan 9
Knowledge-driven multi-turn jailbreak for large language models
提出知识驱动多轮越狱 Mastermind，用策略知识闭环攻击对齐模型
arXiv
2601.05445
Published
Jan 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama 3.1 8B Instruct, Llama 3.3 70B Instruct, Qwen 2.5 7B Instruct and others16
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2601.05339Jan 9
多模态大语言模型的多轮越狱攻击与 FragGuard 防御
提出多轮多模态越狱，并用 FragGuard 拦截有害响应
arXiv
2601.05339
Published
Jan 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVa-1.6 (7B), LLaVa-1.6 (13B), Qwen-2-7B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentVision
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop