Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 18 papers Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 ReSA，从对齐模型行为恢复安全奖励并在解码时反转
Published Oct 6
Evaluated models Llama3.1-8B-Instruct , Gemma-7B-Instruct , Qwen2.5-7B-Instruct and others9 Abstract ReSA 用最大熵 IRL 从对齐模型行为恢复代理安全奖励，并在解码时反转以诱导有害输出。ReSA 是一种对抗攻击：从对齐模型的可观察行为恢复代理安全奖励，再在解码时把该奖励反过来用。 。
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
Published Oct 5
Evaluated models LLaDA-8B-Instruct , Dream-v0-Instruct-7B , LLaDA-MoE-7B-A1B-Instruct Abstract 通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
提出 TRACER，从权重差识别扩散模型被擦除概念
Published Oct 5
Evaluated models Stable Diffusion v1.5 , Stable Diffusion 3 , FLUX.1 and others5 Abstract TRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
Published Oct 2
Evaluated models Stable Signature , YU1 , HiDDeN and others4 Abstract LiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
Published Oct 2
Evaluated models Llama2 (7B) , Llama3 (8B) , Qwen2.5 (7B) Abstract 作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
提出 Leaky，用新鲜轨迹的 token 对数概率差推断 OPD 训练记录成员身份
Published Sep 27
Evaluated models Qwen3-1.7B , Qwen3-4B , Qwen3.5-2B and others5 提出 CGMIA，检测代码生成基准样本是否泄漏进训练集
Published Sep 9
Evaluated models Qwen2.5-Coder (3B) , CodeGemma (2B) , DeepSeek-Coder (1.3B) and others5 Abstract CGMIA 融合相似度、通过率、困惑度与 CodeBERT，在模拟泄漏上优于八个 MIA 基线。CGMIA 用成员推断检测代码生成基准是否泄入 LLM 训练集，使评测不依赖对训练语料的直接访问。
提出 Q-SKEW，利用 token 级记忆不对称推断微调扩散语言模型的成员
Published Sep 1
Evaluated models LLaDA-8B-Base , LLaDA-8B-Instruct , Dream-Base-7B and others4 Abstract Q-SKEW 用 token 损失差的右偏区分微调 DLM 成员，并可辅助 PII 排序。Q-SKEW 是针对微调扩散语言模型的 gray-box 成员推断指标，依据是 token 记忆增益随掩码率下降而增大、成员序列因此右偏。 。
提出参考嫁接，在推理阶段用激活干预诱导沙袋隐藏能力
Published Aug 30
Evaluated models Qwen2.5-1.5B , Qwen2.5-3B , Qwen2.5-14B and others15 Abstract 提出参考嫁接在推理阶段以低成本匹配微调诱导效果，揭示隐瞒表征重叠与阈值门控机制。
提出单神经元激活干预，抑制拒答神经元或放大概念神经元以绕过安全对齐
Published May 9
Evaluated models Qwen3-1.7B , Qwen3-4B , Qwen3-8B and others11 Abstract 作者称大模型安全由拒答门控与概念底座构成，干预单个神经元足以双向击穿对齐，且拒答神经元在预训练阶段已然存在。
提出 HMNS，通过注意力头掩码与零空间注入实现机制级越狱
Published Apr 12
Evaluated models LLaMA-2-7B-Chat , Phi-3-Medium-4K-Instruct , LLaMA-3.1-70B and others6 Propose the Amnesia activation-guided attack to bypass model safety refusal during inference
Published Mar 10
Evaluated models Llama-2-7B-Chat , Llama-3-8B-Instruct , Qwen-7B-Chat Propose PCA-OT representation-layer refusal ablation, rewriting activations at inference time to bypass refusals
Published Mar 5
Evaluated models Llama-2-7b-chat-hf , Llama-2-13b-chat-hf , Llama-3.1-8B-Instruct and others6 提出 CFA2，用 SAE 定位防御方向并正交化输出权重实现越狱
Published Feb 5
Evaluated models Llama 3.1 8B Instruct , Llama2 7B Chat , Mistral 7B Instruct and others4 提出 AttenMIA，用注意力信号做白盒成员推断
Published Jan 26
Evaluated models LLaMA-13B , LLaMA-30B , Pythia-6.9B and others12 Abstract AttenMIA 用白盒注意力做成员推断，作者称在低假阳性下优于输出类基线。AttenMIA 是面向开源权重 LLM 的白盒、reference-free 成员推断：读内部注意力，而不是只看输出置信度，判断样本是否在训练集中。
提出 GOSV，全局优化定位安全注意力头并在推理时重贴激活越狱
Published Jan 22
Evaluated models Llama-2-7b-chat , Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct and others4 Attacks arXiv 2512.21008 · Dec 24, 2025 提出 GateBreaker，推断时定位并置零 MoE 安全神经元以解除安全对齐
Published Dec 24, 2025
Evaluated models GPT-OSS-20B , Qwen3-30B-A3B-Instruct-2507 , Phi-3.5-MoE-Instruct and others14 Attacks arXiv 2508.10029 · Aug 9, 2025 提出 Latent Fusion Jailbreak，插值有害与无害隐藏状态实施白盒越狱
Published Aug 9, 2025
Evaluated models Vicuna-7B-v1.5 , LLaMA-2-7B-Chat , Guanaco-7B and others5 You have reached the end