Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器
Published Sep 15
Evaluated models Qwen2.5-Coder-7B-Instruct , Qwen3-8B , DeepSeek-R1-0528 and others6 Abstract 论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。
提出 INFER+ 信息过载方法，越狱大型视觉语言模型
Published Jul 3
Evaluated models Qwen3-VL-8B , Qwen2-VL-7B , InternVL3.5-8B and others8 Abstract 用图文过载越狱 LVLM。这篇工作用信息过载 越狱 LVLM，而不是靠 OOD 变换隐藏意图。
提出 ASO，用 GRPO 优化视觉风格以放大越狱攻击
Published Jun 1
Evaluated models GPT-4.1-mini , Gemini-2.5-Flash , Qwen3-VL and others6 Abstract 论文揭示了 MLLM 的风格敏感性脆弱面，提出 ASO 框架利用强化学习优化风格触发器，有效放大了现有视觉越狱效果。
Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.
Published Apr 3
Evaluated models OpenAI CLIP ViT-L/14 , OpenCLIP ViT-B/16 , Meta-CLIP ViT-L/14 and others10 Abstract UCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.
提出 CAGE 攻击，在视觉 token 压缩下用图像扰动使预测偏离
Published Jan 29
Evaluated models LLaVA , Qwen2.5-VL , InternVL3-8B and others5 Abstract CAGE 对齐压缩瓶颈后，压缩 LVLM 的稳健准确率低于全 token 编码器攻击。CAGE 研究的是：LVLM 在推理时剪枝或合并视觉 token 之后，对抗稳健性该怎么估。
Attacks arXiv 2503.02174 · Mar 4, 2025 提出 AdvTok 对抗分词攻击，不改文本只改分词来越狱并规避安全分类器
Published Mar 4, 2025
Evaluated models Llama3.2-1B , Llama3.2-3B , Llama3.1-8B and others7 Abstract 作者称非规范分词能躲开对齐并仍得到针对原请求的回复。作者用非规范分词攻击已对齐的子词 LLM：恶意字符串的字符不变，只改 token 边界。
You have reached the end