Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 21 papers Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
Published Oct 6
Evaluated models Video-LLaVA-7B , Qwen2.5-VL-7B , Dolphins 提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别
Published Oct 6
Evaluated models C2P-CLIP , ForgeLens , D3-Im and others10 Abstract 提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。
构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
Published Oct 5
Evaluated models SpeechForensics , AVH-Align , (B)RAVEn Abstract BabelFake 为五语同意采集基准。BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
Published Oct 5 Abstract 论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
Published Oct 3
Evaluated models Qwen3-TTS (0.6B) , Dots.tts (2B) 提出 TAILOR，按请求组合图像水印以满足抗攻击与画质延迟规格
Published Oct 1 提出带密钥的 SNW，抵御事后图像水印的身份伪造
Published Sep 28
Evaluated models SNW Abstract SNW 用密钥与满秩各向同性投影提高事后水印的 Shannon 容量，并对 PCA 完全安全。Gesny 与 Giboulot 针对生成内容追溯所依赖的多比特事后图像水印，批评端到端 DNN 方案既无容量理论、又无密钥。
提出 VidMark 水印方案，核验视频生成模型的输出来源与所有权
Published Sep 20
Evaluated models Stable Video Diffusion (SVD) , Open-Sora , Wan Abstract VidMark 加解码器引导微调，把模型签名写入 VGM 输出并用于两项核验。Huang 等人提出一套面向视频生成模型的生成内嵌水印方案，用来同时判断一条视频是否来自受保护模型，以及一个嫌疑模型是否为该模型的拷贝。
复现 Tree-Ring 语义水印的黑盒伪造并恢复检测统计量
Published Sep 11
Evaluated models Stable Diffusion XL base 1.0 提出黑盒攻击 DRIFT，偏转生成轨迹以去除扩散水印
Published Sep 8 提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
Published Sep 5
Evaluated models GPT-5.4 mini , GPT-5.5 , DeepSeek V4 Flash and others12 Abstract SinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。SinoGlyphBench 是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
提出 SPARED，用对抗编辑数据训练基于推理的 AI 生成图像检测器
Published Aug 13
Evaluated models Qwen3.5-9B Abstract SPARED 用防捷径的编辑对抗环训练 9B 推理检测器。SPARED 是一套用于可解释 AI 生成图像检测的攻防强化学习流程，报告模型是 Qwen3.5-9B 上的第三轮防御器。
提出 GeoDetect 以几何分数检测视觉语言预训练模型的对抗样本
Published Jul 16
Evaluated models CLIPViT (ViT-B/16) , CLIPCNN (ResNet-50) , ALBEF and others4 Abstract GeoDetect 用几何分数检测 VLP 对抗样本。GeoDetect 是面向视觉-语言预训练模型的对抗样本检测方法，用嵌入几何而不是任务 logits 区分干净样本与对抗样本。
提出 CAVA，将异构智能体运行时事件规范为可哈希动作并绑定审批与回执
Published Jul 15 Abstract CAVA 用规范动作指纹承接异构运行时治理。CAVA 是给异构智能体运行时用的动作语义层，用来回答“被批准和被审计的到底是哪一个动作”。
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
Published May 20
Evaluated models GPT-5.2 , GPT-5.4 , Claude-Opus-4.6 and others15 Abstract FRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.
Published Apr 3
Evaluated models OpenAI CLIP ViT-L/14 , OpenCLIP ViT-B/16 , Meta-CLIP ViT-L/14 and others10 Abstract UCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.
提出无监督对抗微调，加固离散图像 tokenizer
Published Feb 20
Evaluated models UniTok , UniTok-MLLM , TiTok-BL128 and others7 Abstract 无监督嵌入攻击暴露离散 tokenizer 的弱点，只微调 encoder 即可提升多任务鲁棒准确率。作者研究离散图像 tokenizer 的对抗鲁棒性，给出与任务无关的嵌入攻击，以及只微调 encoder 的无监督对抗训练。
Propose SAFT, which uses semantic description ensembles to construct adversarial examples and fine-tune the image encoder
Published Feb 13
Evaluated models ViT-B/32 , CLIP-L/14 Abstract SAFT fine-tunes the CLIP image encoder with ensemble adversarial examples from refined class descriptions to improve the trade-off between zero-shot accuracy and robustness.SAFT is a method for adversarially fine-tuning the CLIP image encoder to improve the accuracy–robustness trade-off in zero-shot classification.
Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models
Published Feb 10
Evaluated models LLaVA , Qwen2.5-VL , InternVL3 and others10 Abstract GDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.
提出 CAGE 攻击，在视觉 token 压缩下用图像扰动使预测偏离
Published Jan 29
Evaluated models LLaVA , Qwen2.5-VL , InternVL3-8B and others5 Abstract CAGE 对齐压缩瓶颈后，压缩 LVLM 的稳健准确率低于全 token 编码器攻击。CAGE 研究的是：LVLM 在推理时剪枝或合并视觉 token 之后，对抗稳健性该怎么估。