Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出利用路由元数据推断敏感话题的侧信道攻击
Published Oct 7
Evaluated models RouteLLM (BERT router) , notdiamond-0001 , Vela (vLLM Semantic Router) Abstract 论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
评估应用决策层的输入注入与隐私推断风险
Published Oct 4
Evaluated models Jev , NanoJev Abstract Jev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
提出 PrivDrift 基准，审计话题漂移后的用户秘密复述
Published Sep 25
Evaluated models GPT-OSS-120B , DeepSeek-R1 , Qwen3-VL-235B 提出 KeyPooling，测量 API 中继何处瓦解提示缓存隔离
Published Aug 18
Evaluated models grok-4-fast-non-reasoning , grok-4-1-fast-non-reasoning , grok-3 and others11 Abstract 共享上游凭证使中继客户进入同一缓存域，保留身份或独立 principal 可分开。KeyPooling 测量 LLM API 中继在何处丢掉客户身份，使 prompt cache 不再按下游客户隔离。
提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示
Published Feb 24
Evaluated models Qwen-2.5-3B-Instruct , Qwen-2.5-7B-Instruct , Qwen-2.5-14B-Instruct and others4 Abstract OPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。
提出 Aegis 红队框架，多轮攻击高风险语音 Agent
Published Feb 7
Evaluated models GPT-4o , GPT-4o-mini , Gemini-1.5 Pro and others7 Abstract Aegis 红队评测三类语音智能体：查询式访问消掉认证与泄密成功，行为类攻击仍在。Aegis 用多轮红队评测已接入业务系统的 ALLM 语音智能体。作者称这是该设定下的 the first systematic red-teaming framework。
You have reached the end