DefensesarXiv 2609.37054
ACTR：对齐推理与回答以提升推理大语言模型的多语言安全
提出 ACTR，只更新安全思考神经元以对齐推理与回答的安全类别
- arXiv
- 2609.37054
- Published
- Setting
- Models and APIs
- Evaluated models
- Qwen3-8B, Gemma4-12B-it
- DefensesModel hardening
- AttacksJailbreaks
- ComponentReasoning chains
All papers
Filter3
Attack type
Attack technique
Defense type
Impact
System type
Attacker access
Attack surface / entry point
Layer
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Another 265papers do not have category tags yet and are not included in filtered results.
- DefensesarXiv 2609.36562
ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
- arXiv
- 2609.36562
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- ThinkingGuard（Qwen3-VL-8B-Instruct）
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。
这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。
- AttacksarXiv 2609.35699
论文：蒸馏防御在蒸馏后强化学习下易被攻破
提出用 API 推理摘要重建轨迹再蒸馏加强化学习，攻破蒸馏防御
- arXiv
- 2609.35699
- Published
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others12
- AttacksExtraction and theft
- ComponentReasoning chains
Abstract更现实的蒸馏攻击是蒸馏后再 RL。
这篇工作修订蒸馏攻击的威胁模型：攻击者经合法 API 收集闭源推理数据，先蒸馏自有模型，再做强化学习。作者认为只在蒸馏后评估防御，会漏掉后续 RL，从而高估防御。
- DefensesarXiv 2609.34519
EOPSA：高效在策略自蒸馏安全对齐方法
提出 EOPSA，用 TRR 截断与安全类过滤做在策略自蒸馏安全对齐
- arXiv
- 2609.34519
- Published
- Setting
- Models and APIs
- Evaluated models
- Qwen3-1.7B, Qwen3-4B, Qwen3-14B and others5
- DefensesModel hardening
- AttacksJailbreaks
- ComponentReasoning chains
- AttacksarXiv 2609.29775
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
- arXiv
- 2609.29775
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
大型推理模型的效率与安全困境：量化与剪枝如何影响越狱鲁棒性
分析量化、剪枝与 KV 缓存压缩对推理模型越狱鲁棒性的影响
- arXiv
- 2609.23587
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- QwQ-32B, DeepSeek-R1-Distill-Qwen-32B, DeepSeek-R1-Distill-Llama-8B
- AttacksJailbreaks
- ComponentReasoning chains
Abstract效率压缩常使 LRM 越狱 HR 下降，作者将其归因于推理退化而非对齐增强。
作者分析量化、剪枝和 KV 缓存压缩如何同时改变 LRM 的显存、推理和越狱脆弱性。。
- DefensesarXiv 2609.16229
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
- arXiv
- 2609.16229
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
- OtherarXiv 2609.12413
SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量
系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御
- arXiv
- 2609.12413
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Qwen3.5-4B, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- ComponentMemory
AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。
Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。
- AttacksarXiv 2609.09553
研究：任意密文攻击前沿大模型无需微调即可越狱
提出任意字母置换密码越狱，无需微调即可诱导有害输出
- arXiv
- 2609.09553
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
- Risky behaviorarXiv 2609.08186
论文揭示大推理模型的对齐崩溃并提出 Reasoning Trap 越狱范式
揭示推理加深引发的对齐坍塌，用 Reasoning Trap 放大越狱
- arXiv
- 2609.08186
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen3-8B, Qwen3-14B, Llama2-7B and others8
- AttacksJailbreaks
- RiskMisalignment and value divergence
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract更深推理提升题目准确率，同时提高扰动下的相对损失。
作者研究扩展推理是否以对齐稳健性为代价，提出 ALR、RT 与 RRA。。
- AttacksarXiv 2608.09867
Researchers steal proprietary LLM inference chains via cross-model compatibility of encrypted inference blocks
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
- arXiv
- 2608.09867
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5 and others13
- AttacksExtraction and theft
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
- AttacksarXiv 2604.02652
强化学习对齐的泛化局限
提出复合越狱，叠对比结构、权威人设与自评饱和指令层级
- arXiv
- 2604.02652
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- OpenAI gpt-oss-20b
- AttacksJailbreaks
- TechniqueRole-play and persuasion
- ComponentReasoning chains
- AttacksarXiv 2603.09246
研究者提出 Reasoning-Oriented Programming，通过链式语义片段越狱大型视觉语言模型
提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型
- arXiv
- 2603.09246
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- GPT-4o, Claude 3.7 Sonnet, GLM-4V-Plus and others7
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractVROP 以良性视觉 gadget 与控制流提示词做组合越狱。
VROP是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。
- DefensesarXiv 2602.24210
研究者提出 Staged Decoding 与 SFT 数据集，减少大推理模型推理轨迹中的隐私泄露
提出 Staged Decoding 与指令跟随训练，减少推理轨迹隐私泄露
- arXiv
- 2602.24210
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen 3 1.7B, Qwen 3 4B, Qwen 3 8B and others6
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentReasoning chains
Abstract用一般指令跟随训练加分段解码，可降低轨迹隐私泄露，但数学效用下降。
本文把大推理模型的隐私问题做成轨迹可控性：隐私指令是指令，轨迹不跟随就会把敏感上下文写进可被提示注入导出的文本。
- DefensesarXiv 2602.11096
Safety Recovery of Reasoning Models Only Needs a Few Early Steps of Guidance
提出推理时防御 SafeThink，监视思维链并在低于阈值时注入转向前缀
- arXiv
- 2602.11096
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- R1-Onevision-7B, OpenVLThinker-7B, VLAA-Thinker-7B and others6
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentReasoning chains
- DefensesarXiv 2601.09281
STaR：面向大推理模型遗忘的敏感轨迹调控方法
提出推理时框架 STaR，抑制大推理模型推理轨迹中的敏感内容
- arXiv
- 2601.09281
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- DeepSeekR1-Distill-Llama-8B
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
AbstractSTaR 以推理时轨迹调控做 LRM unlearning，作者称在 R-TOFU 上遗忘与隐私指标更好。
STaR在推理阶段约束大推理模型的整段 CoT，使指定 forget set 中的敏感内容不出现在中间步骤或最终答案里，且不更新参数。问题来自 LRM 会把敏感知识写进多步推理，而答案级遗忘在 ZeroThink、LessThink 等解码下仍可能泄漏。STaR 先判断查询是否相关并检索遗忘片段，再加安全前缀。
- AttacksarXiv 2512.05853
VRSA：通过视觉推理序列攻击越狱多模态大模型
提出视觉推理序列攻击 VRSA，以图像序列越狱多模态大模型
- arXiv
- 2512.05853
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- DeepSeek-VL2-tiny, InternVL-3.5-8B, LLaVA-1.6-Mistral-7B and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
论文提出多轮在线骚扰 Agent 基准
提出多轮在线骚扰 Agent 基准，评测记忆、规划与微调越狱
- arXiv
- 2510.14207
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems
- Evaluated models
- LLaMA-3.1-8B-Instruct, Qwen3-30B-A3B-Instruct, DeepSeekMoE-16B and others4
- AttacksJailbreaks
- ComponentFine-tuning and open weights
- AttacksarXiv 2510.11570
研究显示简单攻击可绕过 gpt-oss 等推理模型的安全护栏
提出四种阶段转换攻击，绕过推理模型的安全推理护栏
- arXiv
- 2510.11570
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- gpt-oss-20b, gpt-oss-120b, Qwen3-4B-Thinking-2507 and others10
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
You have reached the end