Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 138 papers Another 201 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
Published Oct 9
Evaluated models Wan2.2-TI2V-5B , HunyuanVideo-1.5 , Kling 3.0 and others4 Abstract KVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
Published Oct 9
Evaluated models Wan2.1-I2V-14B , CogVideoX-5B-I2V , LightX2V and others6 Abstract LETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Proposes the semantic watermark SemField, which still identifies the attribution of generated text after paraphrasing and structural changes.
Published Oct 8
Evaluated models Llama-3.2-1B , Qwen3-1.7B , OPT-1.3B Abstract Training-independent document-level semantic watermark.SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.
提出零空间激活引导 Nullify，免训练擦除指定记忆并保持效用
Published Oct 8
Evaluated models Llama-2-7B-chat-hf , Qwen3-8B 提出 PyCache Trap，用字节码缓存替换绕过 Agent 技能扫描器
Published Oct 7
Evaluated models CISCO , HSS , AUDITOR and others8 Abstract 论文剖析智能体技能审查与执行脱节盲区，提出 PyCache Trap 攻击并构建基于可信复现的 EAV 防御。这篇论文研究了智能体技能（Agent Skills）安全扫描中的“审查–执行脱节”问题，并提出了对应的攻击验证与防御方案。
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
Published Oct 6
Evaluated models Video-LLaVA-7B , Qwen2.5-VL-7B , Dolphins 提出 MARCO 放射性水印，冻结蛋白质生成模型并在去噪时嵌入签名
Published Oct 6
Evaluated models RFdiffusion , ESMFold , Chroma and others6 Abstract MARCO 在冻结的 PGM 上去噪时嵌构象水印，作者称能兼顾保真与抗扰动，并使盗版模型继承水印。MARCO 是加在蛋白质生成模型推理过程上的构象水印，用来标记知识产权，并为可能的生物安全滥用保留可追溯信号。作者还把它说成数字权利管理工具，以及符合生物武器公约的数字监管链。问题在于：专有 PGM 的三维输出可能被拿去训练盗版模型，也可能在来源被抹掉后绕过筛查。
提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别
Published Oct 6
Evaluated models C2P-CLIP , ForgeLens , D3-Im and others10 Abstract 提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。
提出 ATLAS 用水平集估计恢复黑盒分类器的对抗输入集合
Published Oct 6
Evaluated models LeNet5 , ResNet50 (CIFAR-10 standard) , ResNet50 (ImageNet standard) and others5 Abstract ATLAS 用主动水平集估计构造黑盒对抗集，作者称其集合比单点攻击更具代表性。ATLAS 是一个查询式 black-box 框架，用来构造诱发失败的对抗输入集合，供鲁棒性审计使用。
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
提出 DP-MixMin，私有学习公开数据混合并做差分隐私微调
Published Oct 6
Evaluated models ResNet-18 , GPT-2 Medium Abstract DP-MixMin 私下学公开混合再 DP 微调，胸片 macro AUC 与邮件困惑度优于均匀混合。DP-MixMin 是一条端到端的差分隐私训练流程：先私下决定多个公开数据集的预训练混合，再预训练并在敏感数据上 DP 微调。作者称这是首个这样的流程。
评测文生图模型的有害内容生成能力与审核检测缺口
Published Oct 5
Evaluated models SDXL , Stable Diffusion 3.5 Large , FLUX.1-dev and others12 构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
Published Oct 5
Evaluated models SpeechForensics , AVH-Align , (B)RAVEn Abstract BabelFake 为五语同意采集基准。BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
用翻译前缀做跨语言训练数据提取，恢复英语训练文本中的 PII
Published Oct 5
Evaluated models GPT-Neo 1.3B , GPT-Neo 2.7B , GPT-J 6B and others7 Abstract 跨语言 TDE 能恢复英语记忆的 PII，转移随多语训练和措辞保真变化。这篇工作检验训练数据抽取是否跨语言：英语段落里记住的 PII，能否被其他语言的前缀逐字抽出。
提出 TRACER，从权重差识别扩散模型被擦除概念
Published Oct 5
Evaluated models Stable Diffusion v1.5 , Stable Diffusion 3 , FLUX.1 and others5 Abstract TRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
把 SynthID 嵌入基因组语言模型采样，并用位置无关检测追溯生成序列
Published Oct 4
Evaluated models Carbon-500M , GENERator-v2-eukaryote-1.2b-base Abstract 两个六碱基基因组模型嵌入 SynthID 后，位置无关验证能找回水印，作者称这只是统计检测。作者在两个六碱基基因组模型的采样里嵌入 SynthID，并让验证者在不知道起点、链和 token phase 时做一次校正后的检出。
提出 UnAct，仅以前向激活干预从分类器中遗忘指定类别
Published Oct 3
Evaluated models ResNet-18 , ViT-B/16 Abstract UnAct 用前向激活做类别遗忘。UnAct 是一种事后类别遗忘：删除请求可以只有少量该类图像，且没有标签和保留数据。它不用梯度，只对遗忘图像做前向。编辑对象是分类器所读的后期单元。
提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
Published Oct 3
Evaluated models Qwen3-TTS (0.6B) , Dots.tts (2B) 衡量分裂学习中梯度相对激活对客户文本重建的额外贡献
Published Oct 3
Evaluated models GPT-2 (openai-community/gpt2, 124M) , Qwen3-0.6B Abstract 激活已恢复大部分 token。这篇工作测量 split learning 分裂点上的文本泄漏：激活单独能恢复多少，训练回传的梯度再增加多少，以及按 token 还是按整篇计分会不会改写结论。
提出 FADE，对文生视频模型做帧感知多概念擦除
Published Oct 3
Evaluated models Wan2.1-T2V-1.3B , Wan2.1-T2V-14B , CogVideoX-2B and others4 Abstract FADE 用闭式编辑、帧感知适配器和软路由，在单骨干上擦除多概念并压低逐帧残差。FADE 是面向文生视频扩散 Transformer 的多概念遗忘方法，用来抑制指定物体、画风、裸体、暴力、仇恨和名人身份，并尽量保持其他生成。作者要处理两件事。与帧无关的抑制会让概念在少数帧重现，片段均值会掩盖这一失败。