Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Attack type：Jailbreaks Attack type：Extraction and theft System component：Monitors System component：Audio System component：Video Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.09167Oct 7
Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
arXiv
2610.09167
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。
Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07089Oct 5
研究者提出统一滥用监控基准，覆盖分解攻击与提示注入约 6200 条轨迹
提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视
arXiv
2610.07089
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma 4 26B-A4B, Qwen3.6 27B, Qwen3.5 27B and others12
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.07005Oct 4
研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因
遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联
arXiv
2610.07005
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2-Audio-7B-Instruct, LLaMA-Omni
- AttacksJailbreaks
- ComponentAudio
AbstractAdvWave-P 的八频带排序与能量相关。
这是对加性音频越狱 AdvWave-P 的频率与解码器深度审计，受害模型主要是 Qwen2-Audio-7B-Instruct，不提出新攻击。
Paper analysisRead analysis
DefensesarXiv 2610.02413Oct 2
研究：分类后缀可提升激活探针的分布外恶意输入检测
用分类后缀提升激活探针对分布外恶意输入的检测
arXiv
2610.02413
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。
用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
Paper analysisRead analysis
DefensesarXiv 2610.00400Sep 30
DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift
提出 DART，用去噪表征转移检测多轮智能体攻击并注入提醒
arXiv
2610.00400
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-14B, Qwen3-32B and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
AttacksarXiv 2609.38899Sep 30
SceneJail: Jailbreaking multimodal large models using video scene context
提出 SceneJail，利用视频情境上下文越狱视频多模态模型
arXiv
2609.38899
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-VL-7B-Instruct, Qwen2.5-VL-32B-Instruct, Qwen3-VL-8B-Instruct and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVideo
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34092Sep 28
机器遗忘在 ASR 中是否有效：arXiv 论文评估现有算法与评测工具
arXiv
2609.34092
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
E-Branchformer
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentAudio
Abstract梯度上升类方法更接近简单评测下的重训参照，复杂方法会被知情攻击认出，多说话人更差。
Paper analysisRead analysis
DefensesarXiv 2609.30841Sep 25
为何扩散语言模型的越狱会成功：能量景观分析
用能量势垒信号检测扩散语言模型的越狱
arXiv
2609.30841
Published
Sep 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Instruct, LLaDA-1.5, Dream-v0-Instruct-7B and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract能量势垒把 dLLM 越狱分成掩盖初始状态或中途越垒，三个 logit 信号据此互补检测。
Bach 等提出用去噪能量景观解释 masked diffusion 语言模型上的越狱，并由此得到三个免训练检测信号。。
Paper analysisRead analysis
DefensesarXiv 2609.29287Sep 24
AEGIS：用内部信号在中间层拦截大型音频语言模型越狱
提出 AEGIS，用中层内部信号选择性激活后层适配器拦截音频越狱
arXiv
2609.29287
Published
Sep 24
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-Audio-7B, VITA-1.5, Ultravox v0.5 and others6
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2609.27378Sep 23
PALS：面向全双工语音对话模型对抗鲁棒性的心理声学对齐潜空间平滑
提出 PALS，用潜空间平滑防御全双工语音对话的对抗扰动
arXiv
2609.27378
Published
Sep 23
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Moshi-style agent
- DefensesModel hardening
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2609.20129Sep 17
局部稀疏性实现无监督 LLM 安全检测
提出局部稀疏无监督安全检测，标记偏离安全分布的输入
arXiv
2609.20129
Published
Sep 17
Layer
Model layer
Setting
Models and APIs
Evaluated models
qwen2-1.5b-instruct, ministral-8b-instruct, llama3-8b-instruct and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2609.13534Sep 12
HPD 与 HERALD：用跨层有害性传播轨迹检测越狱提示
提出 HERALD，用跨层有害投影轨迹检测越狱提示
arXiv
2609.13534
Published
Sep 12
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Mistral-7B-Instruct, OLMo2-7B-Instruct and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractHPD 用跨层投影形状区分有害与良性提示。
Paper analysisRead analysis
InterpretabilityarXiv 2609.04721Sep 4
研究：拒答方向可跨架构迁移，安全工具可按写入位置重新估计
在写入点定位拒答方向，经刚性旋转跨架构迁移并门控放大
arXiv
2609.04721
Published
Sep 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
Falcon-Mamba-7B, Falcon3-Mamba-7B, Llama-3.1-8B and others8
- DefensesInference-time intervention
- AttacksJailbreaks
- RiskInappropriate refusal
- ComponentMonitors
Abstract拒答方向可经刚性旋转跨架构迁移，但必须在各架构的写入点读取。
作者研究拒答表示是否随架构改变，结论是表示共享、读取位置随架构变。
Paper analysisRead analysis
AttacksarXiv 2609.01723Sep 2
研究者提出针对微调 TTS 模型的黑盒成员推断攻击
提出针对微调 TTS 的黑盒成员推断攻击
arXiv
2609.01723
Published
Sep 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
CosyVoice2, F5-TTS, XTTS-v2
- AttacksExtraction and theft
- ComponentAudio
Abstract黑盒 TTS 成员推断以 recitation 加分层语音表示为分数，说话人级强于记录级，DP-SGD 可压到随机附近。
作者给出一个针对微调文本转语音模型的黑盒成员推断框架，分别审计说话人是否进入微调集，以及某一条文本–音频记录是否进入微调集。微调 TTS 以合成文本和参考语音双条件生成，既有生成模型 MIA 的单条件查询和图像/文本上的逐点比较不能直接套用。作者用 scorable extent 与 memorization elicitation 比较五种查询，认为只有 recitation（用目标转写和干净目标语音要求模型复现）同时满足两条，并把它作为主查询。
Paper analysisRead analysis
AttacksarXiv 2608.15578Aug 16
ARENA：面向大型音频语言模型的自动化红队框架
提出 ARENA 音频红队框架，自动构造文本安全且音频接地的越狱输入
arXiv
2608.15578
Published
Aug 16
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Audio Flamingo 3, Qwen2-Audio-7B-Instruct, MiMo-Audio-7B-Instruct and others4
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentAudio
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.06037Jun 4
SpeechJBB：语码转换语音下大型音频语言模型的越狱基准
提出 SpeechJBB，评测语码转换语音下音频语言模型的越狱稳健性
arXiv
2606.06037
Published
Jun 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-Omni-7B, Qwen3-Omni-30B-A3B-Instruct, Voxtral-Small-24B and others9
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentAudio
AbstractSpeechJBB 用五语语码转换语音和伪词探针评测九个 LALM，作者将越狱归为对齐失败而非听不懂。
SpeechJBB 用合成语音测量 LALM 在五语、语码转换和局部伪词混淆下的安全对齐，并另设口语理解对照。
Paper analysisRead analysis
DefensesarXiv 2605.25893May 25
D²-Monitor：基于犹豫信号的扩散大语言模型动态安全监控
提出 D²-Monitor，按犹豫步数把难提示路由到更强探针
arXiv
2605.25893
Published
May 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Base, LLaDA-8B-Instruct, LLaDA-1.5-8B and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
AttacksarXiv 2605.20519May 20
CodecAttack：在音频编解码器潜空间构造对抗扰动，绕过有损压缩防御
提出 CodecAttack，在编解码器隐空间构造可穿透有损压缩的对抗音频
arXiv
2605.20519
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-Audio-7B-Instruct, Audio Flamingo 3, Qwen2.5-Omni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2605.18168May 18
研究者提出声学干扰攻击 AIA，可通用越狱 10 个大型音频语言模型
提出声学干扰攻击 AIA，用良性音频潜语义越狱音频语言模型
arXiv
2605.18168
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen3-Omni, Qwen2.5-Omni, Qwen2-Audio and others10
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2603.13847Mar 14
SWhisper 用近超声隐蔽声学通道对语音驱动 LLM 实现黑盒越狱
提出 SWhisper，用近超声波向语音驱动 LLM 隐蔽注入越狱提示
arXiv
2603.13847
Published
Mar 14
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta-Llama-3.1-8B-Instruct, Gemma-3-4B, Qwen2.5-7B-Instruct and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentAudio
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop