Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 15 papers Another 213 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出利用路由元数据推断敏感话题的侧信道攻击
Published Oct 7
Evaluated models RouteLLM (BERT router) , notdiamond-0001 , Vela (vLLM Semantic Router) Abstract 论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
提出 HXAI 分层隐私解释框架，本地保留细解释并只发布加噪摘要
Published Oct 2
Evaluated models gradient-boosted tree regression models Abstract HXAI 把无噪声局部 SHAP 留在家庭内，只聚合差分隐私摘要。HXAI 是面向分布式能源系统的分层隐私保护解释框架，服务规划、监测与诊断，而不是实时控制。
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
Published Oct 1
Evaluated models Lumina-mGPT , Gemini 2.5 Flash Image Preview , CLIP ViT-B/16 and others5 比较高效与高成本训练的对抗和隐私脆弱性并分析损失几何
Published Sep 28
Evaluated models ResNet-18 , Swin Transformer , Qwen2.5-Math-7B-Instruct and others7 Abstract 效用匹配下，三种高效训练都伴随更高的隐私与对抗脆弱性及更尖的损失几何。作者在视觉分类和数学推理语言模型上，检查用更少数据或更简对齐换取训练效率时，安全性质是否一起变化。比较在任务效用接近的前提下进行。视觉侧用 KNN-Shapley 的高重要性小子集对照低重要性大子集，并用预训练微调对照从头训练。
提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留
Published Sep 27
Evaluated models Qwen3-VL-2B , Qwen3-VL-4B , Qwen3-VL-8B and others6 Abstract IDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。
提出 VidMark 水印方案，核验视频生成模型的输出来源与所有权
Published Sep 20
Evaluated models Stable Video Diffusion (SVD) , Open-Sora , Wan Abstract VidMark 加解码器引导微调，把模型签名写入 VGM 输出并用于两项核验。Huang 等人提出一套面向视频生成模型的生成内嵌水印方案，用来同时判断一条视频是否来自受保护模型，以及一个嫌疑模型是否为该模型的拷贝。
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
Published Sep 7
Evaluated models BERT-base , RoBERTa-base , T5-base and others6 Propose GIFT, isolating user data in shared LLM serving using encryption and GPU information flow tracking
Published Aug 26
Evaluated models Qwen2.5-14B , Qwen2.5-32B , Qwen2.5-72B and others6 Abstract GIFT uses cryptographic isolation plus GPU information flow rules to enforce user data isolation on vLLM and DistServe, and reports throughput overhead.GIFT is the authors' user data isolation system for shared LLM serving, with GIFT-CC enabling confidential computing. In the conclusion, the authors state it is the first IFT design for this scenario.
Proposing KeyPooling to measure where API relays break prompt cache isolation
Published Aug 18
Evaluated models grok-4-fast-non-reasoning , grok-4-1-fast-non-reasoning , grok-3 and others11 Abstract Shared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.
复现 AgentCF 上的多智能体攻防并刻画连通性作用
Published Aug 4
Evaluated models Qwen3-235B-A22B , Claude Haiku 4.5 , Mixtral 8×7B and others4 Abstract 连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。
Proposes PrefixWall, which selectively isolates shared prefixes to mitigate timing side channels
Published Mar 11
Evaluated models gemma-3-4b-it , llava-onevision-qwen2-0.5b-ov-hf , llava-onevision-qwen2-7b-ov-chat-hf and others9 Abstract PrefixWall uses cache metadata to selectively cut off cross-user prefix continuation, preserving APC while limiting the TTFT side channel.PrefixWall is a system-level defense for multi-tenant LLM services that limits the TTFT side channel of Automatic Prefix Caching while preserving prefix reuse.
Proposing OPTILEAK, reconstructing others' prompts token-by-token via a KV cache side channel
Published Feb 24
Evaluated models Qwen-2.5-3B-Instruct , Qwen-2.5-7B-Instruct , Qwen-2.5-14B-Instruct and others4 Abstract OPTILEAK uses SFT and hard-token DPO to reduce the number of requests per token; the authors claim the risk of cache prompt leakage is higher than previously reported.
提出面向渗出的权重压缩，评估推理服务器权重窃取可行性
Published Jan 4
Evaluated models Qwen2-1.5B , Qwen2-7B , Qwen2.5-1.5B and others8 Abstract 作者用残差量化加微调压缩权重，并称法医水印便宜且微调后仍可解码。这篇工作把 LLM 权重渗出看成 APT：攻击者已有未加密权重，但必须把完整权重藏进推理 API 的合法输出。作者认为可压缩性是被忽略的因素，因为推理量化要求解压后仍能低开销前向，而偷权重的人可以接受事后微调。
Attacks arXiv 2508.06837 · Aug 9, 2025 提出 Prometheus，从展示图反推文生图模型的在售提示词
Published Aug 9, 2025
Evaluated models Midjourney , Leonardo.ai , DALL·E and others4 Abstract 训练无关的 proxy 搜索攻击。Prometheus 是针对文生图市场 showcase 的训练无关提示词窃取：攻击者看不到在售文本，只用本地开源 proxy 恢复 subject 和 modifier，并希望换 subject 后风格仍在。
You have reached the end