Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 36 papers Another 254 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出利用路由元数据推断敏感话题的侧信道攻击
Published Oct 7
Evaluated models RouteLLM (BERT router) , notdiamond-0001 , Vela (vLLM Semantic Router) Abstract 论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
Published Oct 7
Evaluated models Llama-3.1-8B-Instruct , Ministral-8B-Instruct-2410 提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
评估应用决策层的输入注入与隐私推断风险
Published Oct 4
Evaluated models Jev , NanoJev Abstract Jev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
Published Sep 29
Evaluated models GLM-5 , Gemini-3.5-Flash , Qwen3-32B and others4 Abstract 作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架 ，研究没有目标数值概率时，采样能否支持逐步控制。
提出推理通道预填与输出前缀组合攻击以越狱推理模型
Published Sep 24
Evaluated models Gemini 3 Flash Preview , DeepSeek V4 Flash , Claude Haiku 4.5 检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
Published Sep 8
Evaluated models gemini-2.5-flash , gemini-2.5-flash-lite 提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化
Published Sep 2
Evaluated models Llama-2-7B-Chat , Yi-1.5-9B-Chat , Qwen2-7B-Instruct and others8 Abstract BOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
Published Sep 2
Evaluated models LLaDA-V , MMaDA , LLaDA2.0-Uni Proposing KeyPooling to measure where API relays break prompt cache isolation
Published Aug 18
Evaluated models grok-4-fast-non-reasoning , grok-4-1-fast-non-reasoning , grok-3 and others11 Abstract Shared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
Published Aug 11
Evaluated models Claude Opus 4.8 , Claude Sonnet 4.6 , Claude Haiku 4.5 and others13 Abstract 论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
提出 SN-Guided Diffusion，利用安全神经元实现离线越狱
Published Aug 8
Evaluated models Qwen2.5-7B-Instruct , LLaDA-8B-Instruct , Dream-Instruct-7B and others15 Abstract 论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。
提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
Published Jul 26
Evaluated models Qwen3.5-9B , Llama-3.1-8B , Ministral-3-8B and others6 Abstract 该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。
提出 SMT 框架，用模拟审核轨迹越狱函数调用 LLM
Published Jul 1
Evaluated models GPT-4o , GPT-5.4 , Qwen3-Max and others7 提出 SlotGCG，按注意力选槽插入对抗 token 以越狱指令模型
Published Jun 4
Evaluated models LLAMA2-7B-CHAT , LLAMA2-13B-CHAT , LLAMA-3.1-8B-INSTRUCT and others10 解释自回归一致性如何导致浅层安全对齐，并提出随机插入攻击
Published Jun 3 Abstract 作者用自回归一致性串起浅层对齐、插入攻击和最坏延续对齐。作者把浅层安全对齐和一类续写攻击都归到自回归一致性上。
提出 CodecAttack，在编解码器隐空间构造可穿透有损压缩的对抗音频
Published May 20
Evaluated models Qwen2-Audio-7B-Instruct , Audio Flamingo 3 , Qwen2.5-Omni 提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
Published May 8
Evaluated models LLaDA-V , LaViDA Abstract 作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。 。
提出 Misrouter，借 MoE 路由优化仅输入前缀并迁移攻击
Published May 6
Evaluated models GPT-4o mini , Qwen-Plus , Phi-4 and others18 提出 PEO，直接优化原提示词嵌入实现白盒越狱
Published Apr 28
Evaluated models Vicuna-7B-v1.3 , Llama-2-7B-Chat , Qwen3-4B-Instruct and others4 Abstract PEO 原位优化提示词嵌入、多轮只重攻失败样本。PEO 是一种不追加对抗 token 的 white-box 越狱：直接改已有提示词嵌入，并只对未成功样本更换续写目标再优化。