Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 18 papers Another 321 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 ReSA，从对齐模型行为恢复安全奖励并在解码时反转
Published Oct 6
Evaluated models Llama3.1-8B-Instruct , Gemma-7B-Instruct , Qwen2.5-7B-Instruct and others9 Abstract ReSA 用最大熵 IRL 从对齐模型行为恢复代理安全奖励，并在解码时反转以诱导有害输出。ReSA 是一种对抗攻击：从对齐模型的可观察行为恢复代理安全奖励，再在解码时把该奖励反过来用。 。
提出 TRACER，从权重差识别扩散模型被擦除概念
Published Oct 5
Evaluated models Stable Diffusion v1.5 , Stable Diffusion 3 , FLUX.1 and others5 Abstract TRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
提出生成时防御 SENTINEL，匹配输入输出以抽出越狱意图并停写
Published Oct 3
Evaluated models Llama2-7B , Llama3-8B , Mistral-7B-v0.2 and others6 提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
Published Oct 2
Evaluated models Stable Signature , YU1 , HiDDeN and others4 Abstract LiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
Published Oct 2
Evaluated models Llama2 (7B) , Llama3 (8B) , Qwen2.5 (7B) Abstract 作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
提出 AEGIS，用中层内部信号选择性激活后层适配器拦截音频越狱
Published Sep 24
Evaluated models Qwen2-Audio-7B , VITA-1.5 , Ultravox v0.5 and others6 提出 PALS，用潜空间平滑防御全双工语音对话的对抗扰动
Published Sep 23
Evaluated models Moshi-style agent 提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
Published Sep 15
Evaluated models DeepSeek-R1-Distill-Qwen-1.5B , Gemma-3-1B-it 提出 SPARK，在预填充阶段修复多模态 KV 记忆以防御视觉语言模型越狱
Published Sep 13
Evaluated models LLaVA-OneVision-7B , Chameleon-7B , Qwen2-VL-7B and others4 提出参考嫁接，在推理阶段用激活干预诱导沙袋隐藏能力
Published Aug 30
Evaluated models Qwen2.5-1.5B , Qwen2.5-3B , Qwen2.5-14B and others15 Abstract 提出参考嫁接在推理阶段以低成本匹配微调诱导效果，揭示隐瞒表征重叠与阈值门控机制。
提出 GeoDetect 以几何分数检测视觉语言预训练模型的对抗样本
Published Jul 16
Evaluated models CLIPViT (ViT-B/16) , CLIPCNN (ResNet-50) , ALBEF and others4 Abstract GeoDetect 用几何分数检测 VLP 对抗样本。GeoDetect 是面向视觉-语言预训练模型的对抗样本检测方法，用嵌入几何而不是任务 logits 区分干净样本与对抗样本。
提出单神经元激活干预，抑制拒答神经元或放大概念神经元以绕过安全对齐
Published May 9
Evaluated models Qwen3-1.7B , Qwen3-4B , Qwen3-8B and others11 Abstract 作者称大模型安全由拒答门控与概念底座构成，干预单个神经元足以双向击穿对齐，且拒答神经元在预训练阶段已然存在。
提出 HMNS，通过注意力头掩码与零空间注入实现机制级越狱
Published Apr 12
Evaluated models LLaMA-2-7B-Chat , Phi-3-Medium-4K-Instruct , LLaMA-3.1-70B and others6 提出 Amnesia 激活引导攻击，推理时绕过模型安全拒答
Published Mar 10
Evaluated models Llama-2-7B-Chat , Llama-3-8B-Instruct , Qwen-7B-Chat 提出 PCA-OT 表示层拒答消融，推理时改写激活绕过拒绝
Published Mar 5
Evaluated models Llama-2-7b-chat-hf , Llama-2-13b-chat-hf , Llama-3.1-8B-Instruct and others6 提出 CFA2，用 SAE 定位防御方向并正交化输出权重实现越狱
Published Feb 5
Evaluated models Llama 3.1 8B Instruct , Llama2 7B Chat , Mistral 7B Instruct and others4 Attacks arXiv 2512.21008 · Dec 24, 2025 提出 GateBreaker，推断时定位并置零 MoE 安全神经元以解除安全对齐
Published Dec 24, 2025
Evaluated models GPT-OSS-20B , Qwen3-30B-A3B-Instruct-2507 , Phi-3.5-MoE-Instruct and others14 Attacks arXiv 2508.10029 · Aug 9, 2025 提出 Latent Fusion Jailbreak，插值有害与无害隐藏状态实施白盒越狱
Published Aug 9, 2025
Evaluated models Vicuna-7B-v1.5 , LLaMA-2-7B-Chat , Guanaco-7B and others5 You have reached the end