Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
Published Oct 8
Evaluated models Meta Llama Guard 3 8B , Meta Llama Guard 7B , Meta Llama Guard 3 1B and others18 提出收缩约束 SSM 安全头，认证嵌入扰动并检测越狱
Published Oct 2
Evaluated models ToySSMClassifier , S4 safety head Abstract 收缩给出玩具 LTI 的有界认证。给 SSM 安全头一个收缩条件，并在越狱检测上使用收缩正则的 S4 头。 。
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
Published Sep 22
Evaluated models Prompt Guard 2 (86M) , Llama 3.1 8B 提出 SeTox 检索增强框架，检测中文新词的隐性毒性
Published Jul 5
Evaluated models SeTox-Qwen2.5-7B Abstract SeTox 用检索把公共共识接入静态 LLM，以检测中文毒性新词。SeTox 研究中文新词上的隐性毒性检测：词表加检索增强，使静态 LLM 在不重训练的情况下利用公开网页上下文。
提出 CITA 三阶段框架，生成可绕过毒性检测器的中文隐式毒性文本
Published May 21
Evaluated models Tencent , Baidu , Gemini 3.1 Pro and others11 提出 HASTE，挖掘 hard negative 再训练恶意提示检测器
Published Jan 27
Evaluated models protectai/deberta-v3-base-prompt-injection Abstract HASTE 用 hard negative 再训练检测器。HASTE 是检测器侧的闭环硬化框架：持续构造能绕过当前检测的对抗提示，再用来更新恶意提示分类器。
Attacks arXiv 2503.02174 · Mar 4, 2025 提出 AdvTok 对抗分词攻击，不改文本只改分词来越狱并规避安全分类器
Published Mar 4, 2025
Evaluated models Llama3.2-1B , Llama3.2-3B , Llama3.1-8B and others7 Abstract 作者称非规范分词能躲开对齐并仍得到针对原请求的回复。作者用非规范分词攻击已对齐的子词 LLM：恶意字符串的字符不变，只改 token 边界。
You have reached the end