Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

Attack type：Extraction and theft Attack type：Detection evasion Attack type：Malicious use System type：Models and APIs System type：coding agent System type：web agent Layer：Model layer Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.11848Oct 8
SemField: training-free semantic watermark
Proposes the semantic watermark SemField, which still identifies the attribution of generated text after paraphrasing and structural changes.
arXiv
2610.11848
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.2-1B, Qwen3-1.7B, OPT-1.3B
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractTraining-independent document-level semantic watermark.
SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.
Paper analysisRead analysis
DefensesarXiv 2610.10655Oct 8
Nullify：面向 LLM 遗忘的零空间激活引导免训练方法
提出零空间激活引导 Nullify，免训练擦除指定记忆并保持效用
arXiv
2610.10655
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Qwen3-8B
- DefensesInference-time intervention
- AttacksExtraction and theft
Paper analysisRead analysis
DefensesarXiv 2610.08316Oct 6
MARCO：面向蛋白质生成模型的放射性水印框架
提出 MARCO 放射性水印，冻结蛋白质生成模型并在去噪时嵌入签名
arXiv
2610.08316
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
RFdiffusion, ESMFold, Chroma and others6
- DefensesWatermarking and provenance
- AttacksExtraction and theft
AbstractMARCO 在冻结的 PGM 上去噪时嵌构象水印，作者称能兼顾保真与抗扰动，并使盗版模型继承水印。
MARCO 是加在蛋白质生成模型推理过程上的构象水印，用来标记知识产权，并为可能的生物安全滥用保留可追溯信号。作者还把它说成数字权利管理工具，以及符合生物武器公约的数字监管链。问题在于：专有 PGM 的三维输出可能被拿去训练盗版模型，也可能在来源被抹掉后绕过筛查。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06503Oct 5
研究评测五款开源文生图模型的有害内容生成与审核缺口
评测文生图模型的有害内容生成能力与审核检测缺口
arXiv
2610.06503
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SDXL, Stable Diffusion 3.5 Large, FLUX.1-dev and others12
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06339Oct 5
BabelFake：面向多语言音视频 DeepFake 检测的基准数据集
构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
arXiv
2610.06339
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SpeechForensics, AVH-Align, (B)RAVEn
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentAudio
AbstractBabelFake 为五语同意采集基准。
BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
Paper analysisRead analysis
AttacksarXiv 2610.05601Oct 5
Tracer 框架可从遗忘后的扩散模型中识别被擦除概念
提出 TRACER，从权重差识别扩散模型被擦除概念
arXiv
2610.05601
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
- AttacksExtraction and theft
- ComponentImage generation
AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。
TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
Paper analysisRead analysis
DefensesarXiv 2610.04763Oct 4
UT Austin 将 SynthID 水印嵌入基因组语言模型，凭 DNA 序列和密钥追溯 AI 生成片段
把 SynthID 嵌入基因组语言模型采样，并用位置无关检测追溯生成序列
arXiv
2610.04763
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
Carbon-500M, GENERator-v2-eukaryote-1.2b-base
- DefensesWatermarking and provenance
- AttacksDetection evasion
Abstract两个六碱基基因组模型嵌入 SynthID 后，位置无关验证能找回水印，作者称这只是统计检测。
作者在两个六碱基基因组模型的采样里嵌入 SynthID，并让验证者在不知道起点、链和 token phase 时做一次校正后的检出。
Paper analysisRead analysis
DefensesarXiv 2610.04426Oct 3
UnAct：无需梯度的定向激活干预实现类别遗忘
提出 UnAct，仅以前向激活干预从分类器中遗忘指定类别
arXiv
2610.04426
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
ResNet-18, ViT-B/16
- DefensesModel hardening
- AttacksExtraction and theft
AbstractUnAct 用前向激活做类别遗忘。
UnAct 是一种事后类别遗忘：删除请求可以只有少量该类图像，且没有标签和保留数据。它不用梯度，只对遗忘图像做前向。编辑对象是分类器所读的后期单元。
Paper analysisRead analysis
DefensesarXiv 2610.04235Oct 3
Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架
提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
arXiv
2610.04235
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-TTS (0.6B), Dots.tts (2B)
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2610.03166Oct 2
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
arXiv
2610.03166
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.02986Oct 2
OLMo-Detect：面向 LLM 成员推断的多阶段混淆控制基准
提出基准 OLMo-Detect 评测 LLM 成员推断
arXiv
2610.02986
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
OLMo 2 1B, OLMo 2 7B, OLMo 2 13B and others9
- AttacksExtraction and theft
Paper analysisRead analysis
DefensesarXiv 2610.02817Oct 2
RMCW：基于 Reed-Muller 码的抗删除 LLM 水印方法
提出抗删除水印 RMCW，在生成时注入 Reed-Muller 结构并做局部检验
arXiv
2610.02817
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
OPT-1.3B, Llama-3.1-8B-Instruct
- DefensesWatermarking and provenance
- AttacksDetection evasion
Paper analysisRead analysis
AttacksarXiv 2610.03124Oct 2
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
arXiv
2610.03124
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
Paper analysisRead analysis
DefensesarXiv 2610.00780Oct 1
TAILOR：面向图像水印的组合方案定制框架
提出 TAILOR，按请求组合图像水印以满足抗攻击与画质延迟规格
arXiv
2610.00780
Published
Oct 1
Layer
Model layer
Setting
Models and APIs
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentImage generation
Paper analysisRead analysis
DefensesarXiv 2609.37310Sep 29
AutoMark：让自动研究流程自主发现更优 LLM 水印方案
提出 AutoMark，自动搜索并统计检验 LLM 文本水印
arXiv
2609.37310
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen3.8-27B, GPT-6 Astra and others5
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractAutoMark 的贡献同时包含搜索出的水印，以及用于约束自动研究误报与评测漏洞的验证框架。
AutoMark 是一套自动水印研究框架：先检查生成分布和误报性质，再比较检测、编辑鲁棒性与质量，最后人工分析组件并做留出评测。
Paper analysisRead analysis
AttacksarXiv 2609.36941Sep 29
Researchers propose a practical key extraction framework for black-box LLMs
提出用扰动蒸馏本地代理并离线过滤来提取黑盒模型凭据
arXiv
2609.36941
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
DeepSeek-Coder-7B, LLaMA-3-8B, Qwen2.5-Coder-7B and others6
- AttacksExtraction and theft
Abstract论文提出扰动蒸馏与离线过滤两阶段框架，实现了 output-only 访问下延迟降低的黑盒大模型 API key 提取。
Paper analysisRead analysis
DefensesarXiv 2609.36372Sep 29
TTMark：超越单 token 熵的成对无失真水印
提出成对无失真水印 TTMARK，增强低熵下的机器文本检测
arXiv
2609.36372
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama3.2-3B-Instruct, Mistral-v0.3-7B-Instruct, Qwen2.5-7B-Instruct
- DefensesWatermarking and provenance
- AttacksDetection evasion
AbstractTTMARK 用水印化相邻 token 对利用条件熵，在多种无失真方案上提高检测并保持生成质量。
TTMARK 是一种成对、无失真的文本水印：对相邻 token 的联合分布重加权，而不是逐 token 独立重加权。
Paper analysisRead analysis
AttacksarXiv 2609.36331Sep 29
No reference model needed: calibrating single-round membership inference attacks with neighboring samples
提出用邻居分数替代参考模型的单轮成员推断
arXiv
2609.36331
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
目标分类模型（架构与训练流程遵循 Aerni et al.）
- AttacksExtraction and theft
Abstract邻居查询在单模型上恢复逐样本校准，合成邻居加早期检查点最接近 LiRA。
本文研究 one-round 成员推断：只有一个目标模型、不能再训练参考模型时，如何仍做逐样本校准，并用于单次运行的 DP 审计。
Paper analysisRead analysis
DefensesarXiv 2609.34744Sep 28
现代图像后置水印信道的优化与安全：SNW 方案
提出带密钥的 SNW，抵御事后图像水印的身份伪造
arXiv
2609.34744
Published
Sep 28
Layer
Model layer
Setting
Models and APIs
Evaluated models
SNW
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentImage generation
AbstractSNW 用密钥与满秩各向同性投影提高事后水印的 Shannon 容量，并对 PCA 完全安全。
Gesny 与 Giboulot 针对生成内容追溯所依赖的多比特事后图像水印，批评端到端 DNN 方案既无容量理论、又无密钥。
Paper analysisRead analysis
AttacksarXiv 2609.33136Sep 27
Leaky Students：针对 on-policy distillation 的成员推断攻击
提出 Leaky，用新鲜轨迹的 token 对数概率差推断 OPD 训练记录成员身份
arXiv
2609.33136
Published
Sep 27
Layer
Model layer
Setting
Models and APIs
Attacker
Gray-box, Black-box
Evaluated models
Qwen3-1.7B, Qwen3-4B, Qwen3.5-2B and others5
- AttacksExtraction and theft
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop