Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 19 papers Another 247 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联
Published Oct 4
Evaluated models Qwen2-Audio-7B-Instruct , LLaMA-Omni Abstract AdvWave-P 的八频带排序与能量相关。这是对加性音频越狱 AdvWave-P 的频率与解码器深度审计，受害模型主要是 Qwen2-Audio-7B-Instruct，不提出新攻击。
提出免训练框架 SED，将有害智能体轨迹蒸馏为可检索安全策略
Published Sep 29
Evaluated models DeepSeek-V4-Flash , GLM-5.2 , Kimi K3
Published Sep 28
Evaluated models E-Branchformer Abstract 梯度上升类方法更接近简单评测下的重训参照，复杂方法会被知情攻击认出，多说话人更差。
提出 AEGIS，用中层内部信号选择性激活后层适配器拦截音频越狱
Published Sep 24
Evaluated models Qwen2-Audio-7B , VITA-1.5 , Ultravox v0.5 and others6 提出 PALS，用潜空间平滑防御全双工语音对话的对抗扰动
Published Sep 23
Evaluated models Moshi-style agent 系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御
Published Sep 11
Evaluated models Qwen3.5-4B , Llama-3.1-8B-Instruct Abstract SoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。
提出针对微调 TTS 的黑盒成员推断攻击
Published Sep 2
Evaluated models CosyVoice2 , F5-TTS , XTTS-v2 Abstract 黑盒 TTS 成员推断以 recitation 加分层语音表示为分数，说话人级强于记录级，DP-SGD 可压到随机附近。作者给出一个针对微调文本转语音模型的黑盒成员推断框架，分别审计说话人是否进入微调集，以及某一条文本–音频记录是否进入微调集。微调 TTS 以合成文本和参考语音双条件生成，既有生成模型 MIA 的单条件查询和图像/文本上的逐点比较不能直接套用。作者用 scorable extent 与 memorization elicitation 比较五种查询，认为只有 recitation（用目标转写和干净目标语音要求模型复现）同时满足两条，并把它作为主查询。
提出 ARENA 音频红队框架，自动构造文本安全且音频接地的越狱输入
Published Aug 16
Evaluated models Audio Flamingo 3 , Qwen2-Audio-7B-Instruct , MiMo-Audio-7B-Instruct and others4 复现 AgentCF 上的多智能体攻防并刻画连通性作用
Published Aug 4
Evaluated models Qwen3-235B-A22B , Claude Haiku 4.5 , Mixtral 8×7B and others4 Abstract 连通性沿 k 与ρ改变攻防，且用户/物品与早期/稳态需要分开看。作者在 AgentCF 上研究连通性如何改变多智能体协同过滤的攻防，复现已有方法而不是提出新载荷。
提出 CFD 跨会话分解攻击，利用工件来源缺口绕过工具型 Agent 的本地检查
Published Jun 8
Evaluated models GPT-4.1 , GPT-5-nano , Claude-3.5-Sonnet and others6 Abstract CFD 用无指令 artifact 把越狱拆到跨会话。CFD 针对工具型 LLM 智能体：利用 artifact 来源不被跟踪这一部署失败模式，把有害目标拆开后延迟组合。
提出 SpeechJBB，评测语码转换语音下音频语言模型的越狱稳健性
Published Jun 4
Evaluated models Qwen2.5-Omni-7B , Qwen3-Omni-30B-A3B-Instruct , Voxtral-Small-24B and others9 Abstract SpeechJBB 用五语语码转换语音和伪词探针评测九个 LALM，作者将越狱归为对齐失败而非听不懂。SpeechJBB 用合成语音测量 LALM 在五语、语码转换和局部伪词混淆下的安全对齐，并另设口语理解对照。
提出 CodecAttack，在编解码器隐空间构造可穿透有损压缩的对抗音频
Published May 20
Evaluated models Qwen2-Audio-7B-Instruct , Audio Flamingo 3 , Qwen2.5-Omni 提出声学干扰攻击 AIA，用良性音频潜语义越狱音频语言模型
Published May 18
Evaluated models Qwen3-Omni , Qwen2.5-Omni , Qwen2-Audio and others10 提出 SWhisper，用近超声波向语音驱动 LLM 隐蔽注入越狱提示
Published Mar 14
Evaluated models Meta-Llama-3.1-8B-Instruct , Gemma-3-4B , Qwen2.5-7B-Instruct and others9 提出 Aegis 红队框架，多轮攻击高风险语音 Agent
Published Feb 7
Evaluated models GPT-4o , GPT-4o-mini , Gemini-1.5 Pro and others7 Abstract Aegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.
提出音频叙事越狱，以嗓音投递风格绕过端到端语音模型拒答
Published Jan 31
Evaluated models GPT-4o Realtime , Gemini 2.0 Flash , Qwen2.5-Omni-7B Attacks arXiv 2511.10692 · Nov 12, 2025 提出 StyleBreak 风格化音频越狱，利用语音属性绕过音频语言模型对齐
Published Nov 12, 2025
Evaluated models Qwen2-Audio-7B-Instruct , MERaLiON-AudioLLM-Whisper-SEA-LION , Ultravox-v0.4.1-Llama-3.1-8B and others6 Attacks arXiv 2504.01094 · Apr 2, 2025 提出 MULTI-AUDIOJAIL，以多语多口音和声学扰动越狱音频模型
Published Apr 2, 2025
Evaluated models Qwen2-Audio , DiVA-llama-3-v0-8b , MERaLiON-AudioLLM-Whisper-SEA-LION and others5 Abstract 黑盒多语多口音音频加声学扰动可抬高 LALM 的 JSR，文本示范防御并非在每个模型上都下降。
提出 Jailbreak-AudioBench 评测音频语言模型的音频编辑越狱
Published Jan 23, 2025
Evaluated models BLSP , SpeechGPT , Qwen2-Audio-7B and others10 You have reached the end