Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack type：Extraction and theft Attack type：Detection evasion Attack surface / entry point：Training data Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.06636Oct 6
差分隐私混合公共数据集提升隐私学习效果
提出 DP-MixMin，私有学习公开数据混合并做差分隐私微调
arXiv
2610.06636
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18, GPT-2 Medium
- AttacksExtraction and theft
AbstractDP-MixMin 私下学公开混合再 DP 微调，胸片 macro AUC 与邮件困惑度优于均匀混合。
DP-MixMin 是一条端到端的差分隐私训练流程：先私下决定多个公开数据集的预训练混合，再预训练并在敏感数据上 DP 微调。作者称这是首个这样的流程。
Paper analysisRead analysis
DefensesarXiv 2610.04426Oct 3
UnAct：无需梯度的定向激活干预实现类别遗忘
提出 UnAct，仅以前向激活干预从分类器中遗忘指定类别
arXiv
2610.04426
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
ResNet-18, ViT-B/16
- DefensesModel hardening
- AttacksExtraction and theft
AbstractUnAct 用前向激活做类别遗忘。
UnAct 是一种事后类别遗忘：删除请求可以只有少量该类图像，且没有标签和保留数据。它不用梯度，只对遗忘图像做前向。编辑对象是分类器所读的后期单元。
Paper analysisRead analysis
AttacksarXiv 2610.01365Oct 1
ReGap：无需真实隐私数据即可通过微调重新提取模型隐私关联
提出 ReGap，用自生成伪监督微调恢复模型中的隐私关联
arXiv
2610.01365
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Gray-box
Evaluated models
GPT-2 Small, GPT-2 Medium, GPT-2 Large and others6
- AttacksExtraction and theft
- ComponentFine-tuning and open weights
Abstract提出无真实私有监督的恢复攻击 ReGap，实验显示微调可通过自生成数据唤醒模型潜在隐私关联，突显后适应隐私风险。
Paper analysisRead analysis
DefensesarXiv 2609.37858Sep 29
存储不等于策略：面向 LLM 遗忘的状态条件支持控制
提出 Intervention Score 与 DIR-R，按干预效果选择并修订遗忘参数支持
arXiv
2609.37858
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama 3 8B, Gemma 2 2B, Qwen2.5-7B and others4
- DefensesModel hardening
- AttacksExtraction and theft
Abstract作者把局部化遗忘拆成初始干预选择和检查点修订，并在三个设置里分别给证据和边界。
Storage Is Not Strategy 研究局部化 LLM 遗忘里两个常被混在一起的决定：一开始该更新哪些参数，以及优化改变模型之后这个选择要不要改。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34092Sep 28
机器遗忘在 ASR 中是否有效：arXiv 论文评估现有算法与评测工具
arXiv
2609.34092
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
E-Branchformer
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentAudio
Abstract梯度上升类方法更接近简单评测下的重训参照，复杂方法会被知情攻击认出，多说话人更差。
Paper analysisRead analysis
AttacksarXiv 2609.33985Sep 28
研究：众包微调数据投毒可放大专有指令抽取
提出主题锚点投毒，放大众包微调后的专有指令提取
arXiv
2609.33985
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct, Llama-3.1-8B-Instruct and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出基于主题锚点的数据中毒攻击，证明低比例的中毒样本可在黑盒条件下隐蔽放大微调指令泄漏。
Paper analysisRead analysis
AttacksarXiv 2609.27124Sep 23
Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习
提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复
arXiv
2609.27124
Published
Sep 23
Layer
Training and data layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
CNN（MNIST：2 Conv + 3 FC）, CNN（Fashion-MNIST：6 Conv + 1 FC）, ResNet18（CIFAR-10）
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。
Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。
Paper analysisRead analysis
DefensesarXiv 2610.00209Sep 21
基于差分隐私扩散模型的能源时间序列插补：裁剪感知的目标条件化方法
提出时间步感知目标条件化，改善差分隐私能源时序插补效用
arXiv
2610.00209
Published
Sep 21
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
DiT-style Transformer
- AttacksExtraction and theft
Abstract固定阈值 DP-SGD 下，v-prediction 加 ᾱt 加权降低能源时序插补误差，并降低后期低 SNR 的裁剪前梯度。
作者研究固定阈值 DP-SGD 训练的扩散模型，如何在余弦调度的后期低 SNR 时间步避免 ε-prediction 产生易被裁剪的大梯度，从而做能源时序缺失值恢复。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2605.30040May 28
研究揭示 LLM 按 token 计费可被服务商系统性虚报
构造可通过计费审计的 token 虚报，使服务商系统性超收
arXiv
2605.30040
Published
May 28
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
PALACE domain-adapted auditor
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMonitors
Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。
不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。
Paper analysisRead analysis
AttacksarXiv 2603.08104Mar 9
Invisible Security Threat: Malicious Fine-Tuning of LLMs via Steganography
提出隐写恶意微调，使模型界面显良性并隐蔽传出有害内容
arXiv
2603.08104
Published
Mar 9
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
GPT-4.1-2025-04-14, Llama-3.3-70B-Instruct, Phi-4 and others7
- AttacksModel tampering
- TechniqueEncoding and obfuscation
- ComponentFine-tuning and open weights
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop