Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Attack type：Jailbreaks Attack type：Malicious use Attack technique：Multi-turn escalation Attack technique：Encoding and obfuscation Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.11766Oct 8
研究提出意图恢复率作为 LLM 安全评测的补充指标
提出 IRIS，用意图恢复率区分遮蔽越狱下无害输出的原因
arXiv
2610.11766
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4o, Claude Sonnet 4.5, Claude Opus 4.5 and others6
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Abstract无害输出的证据权重取决于任务是否被恢复。
IRIS 把意图恢复当作中间信号，用来解释意图遮蔽提示下为何没有出现有害协助。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.09033Oct 7
研究发布 ASRD 数据集，评测五款开源模型在非规范输入下的安全表现
arXiv
2610.09033
Published
Oct 7
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Gemma 2 9B, Gemma 3 4B, Llama 3.1 8B and others6
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Abstract五模型、七族表面形式的四态评测里，低有害遵从不等于读懂后的安全处理。
ASRD 用四态标签检查五个开源模型如何处理非规范表面上的有害请求。
Paper analysisRead analysis
AttacksarXiv 2610.02302Oct 2
研究者提出意图隐藏越狱的信息论框架，分析组合式攻击
提出组合式意图隐藏越狱，按先验后验匹配选择辅助任务
arXiv
2610.02302
Published
Oct 2
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Abstract用信息论选含目标的任务组合，再看查询能否既隐藏意图又让目标被执行。
这篇工作把组合式意图隐藏写成任务选择：有害目标必须留在 bundle 里，同时让估计的有害意图概率贴近全集先验，或降到阈值以下。
Paper analysisRead analysis
AttacksarXiv 2609.39902Sep 30
CodeMimicry: Exploiting code-domain safety generalization lag for structured code completion jailbreaks.
提出 CodeMimicry，以结构化代码补全诱导模型生成有害内容
arXiv
2609.39902
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, GPT-4.1, GPT-5-chat and others10
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.38253Sep 29
CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.
提出 CollageAttack，用空间文本碎片重组越狱文生图模型
arXiv
2609.38253
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.36849Sep 29
研究评估 GradSafe 在多轮对话中的越狱检测脆弱性
评测多轮对话中 GradSafe 越狱检测的可分性与脆弱性
arXiv
2609.36849
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama 3.1 8B Instruct, Qwen2.5-7B-Instruct
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentGuardrails and judges
AbstractCWS 显示不安全梯度在真实多轮流量中变弱，且随攻击族和模型而变。
作者评估梯度越狱检测从单条提示词迁到多轮对话后还剩多少可分性，方法是用 Context Window Scanner 把 GradSafe 原封不动地套到用户轮窗口上。
Paper analysisRead analysis
AttacksarXiv 2609.15383Sep 14
微软团队提出 capability laundering 攻击：弱模型拆分任务向对齐前沿模型套取能力
提出能力洗钱攻击，拆分任务向对齐模型套取能力
arXiv
2609.15383
Published
Sep 14
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-5.5, Claude Opus 4.8, Grok-4.3 and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者提出了能力洗钱攻击，发现未对齐编排器分解咨询对齐模型可恢复能力差距，指出需建立跨会话防御。
Paper analysisRead analysis
AttacksarXiv 2609.09553Sep 9
研究：任意密文攻击前沿大模型无需微调即可越狱
提出任意字母置换密码越狱，无需微调即可诱导有害输出
arXiv
2609.09553
Published
Sep 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
AttacksarXiv 2609.03247Sep 3
研究揭示大语言模型的自发身份认证失败：五款模型的分阶段开发者身份实验
提出 MIPC 与 CFA，观察模型自拟测验后接受开发者身份
arXiv
2609.03247
Published
Sep 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ChatGPT, Claude, Qwen3.7-Plus and others5
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract自拟测验可造成对话层虚假认证，但所测授权边界并未因此改变。
这项工作把“模型自己出题、自己批改、再宣布身份已核验”定义成对话层认证失败，并与后端提权分开。
Paper analysisRead analysis
AttacksarXiv 2609.02414Sep 2
Blueprint 框架用世界观模拟与 18 个影响因子提升多轮越狱成功率
提出多轮越狱框架 BLUEPRINT，用世界观模拟与心理因素诱导有害输出
arXiv
2609.02414
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen3-Next-80B, DeepSeek-V3.2, GLM-4.7 and others6
- AttacksJailbreaks
- TechniqueMulti-turn escalation
AbstractBLUEPRINT 解耦多轮越狱策略与情境模拟，揭示任务具象化是摆脱拒绝的核心机制，为多轮安全防御提供新视角。
BLUEPRINT 是一个将因子化社会影响力策略空间与跨轮世界观模拟解耦的多轮大语言模型安全评测框架。
Paper analysisRead analysis
AttacksarXiv 2608.04034Aug 3
HACA：原子越狱策略解耦组合的多模态自动红队方法
提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
arXiv
2608.04034
Published
Aug 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-1.6-Mistral-7B, InternVL-3.5-8B, VLGuard (LLaVA-v1.5-7B-Mixed) and others5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
OtherarXiv 2608.01117Aug 2
SoK 论文提出面向意图的多轮 LLM 越狱分类体系
提出面向意图的多轮 LLM 越狱分类体系
arXiv
2608.01117
Published
Aug 2
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama-3, Llama-3.3-70B, DeepSeek-V3 and others11
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者用四维意图分类整理多轮越狱，并称组织方式影响效果与观察范围。
这是一篇关于多轮 LLM 越狱的 SoK：按有害意图在交互中的组织位置分类，而不是按单步提示技巧分类。
Paper analysisRead analysis
AttacksarXiv 2607.27373Jul 30
RoguePrompt 用双层编码绕过 LLM 审核
提出 RoguePrompt 双层编码自重构越狱，绕过 LLM 审核
arXiv
2607.27373
Published
Jul 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
OpenAI GPT-4o (gpt-4o-2024-11-20), Anthropic Claude 3 Opus (claude-3-opus-20240229), Google Gemini 1.5 Pro (gemini-1.5-pro-002)
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2607.18056Jul 20
上海 AI 实验室提出 Intern-BioBreaker，在 14 个前沿模型上暴露生物安全越狱风险
提出生物红队模型 Intern-BioBreaker，多轮越狱诱导模型输出可操作生物危害
arXiv
2607.18056
Published
Jul 20
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
DeepSeek-V3, Kimi-K2.6, DeepSeek-V4-Pro and others14
- AttacksJailbreaks
- TechniqueAutomated search
Abstract论文通过构建专用红队模型评估前沿大模型的生物安全漏洞与物理转化风险。
Paper analysisRead analysis
AttacksarXiv 2607.03968Jul 5
The study reveals workflow-level jailbreaks in IDE programming agents: GitHub Copilot generated harmful content across four backends at 816/816
提出工作流级越狱，让编程 Agent 在开发任务中写入有害示例
arXiv
2607.03968
Published
Jul 5
Layer
Application layer
Setting
coding agent
Evaluated models
Claude Sonnet 4.6, Claude Haiku 4.5, Gemini 3.1 Pro and others4
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract作者报告 Copilot 后端会在编码工作流中生成其在单轮条件下通常拒绝的有害答案。
这是一项生产 IDE 编码智能体的工作流越狱研究，受测对象是 Copilot 的四个模型后端，而非评测流水线中的名义目标。
Paper analysisRead analysis
AttacksarXiv 2607.00481Jul 1
研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM
提出 SMT 框架，用模拟审核轨迹越狱函数调用 LLM
arXiv
2607.00481
Published
Jul 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o, GPT-5.4, Qwen3-Max and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.29602Jun 29
六款主流 LLM 在多语言与混淆提示注入攻击下的实证评估
评测多语言与编码混淆提示下模型生成钓鱼与键盘记录内容的遵从
arXiv
2606.29602
Published
Jun 29
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
DeepSeek-V3.2, Gemini 2.5 Flash, GPT-5 Mini and others6
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2606.21077Jun 19
OTTER：仅替换五个 token 即可绕过 GPT 系列毒性审核
提出 OTTER 词元替换越狱，绕过表面毒性审核诱导有害回答
arXiv
2606.21077
Published
Jun 19
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gpt-4-turbo, gpt-4o, gpt-4o-mini and others4
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract论文展示了表面毒性与恶意意图的解耦现象，通过标准 API 实现黑盒越狱测试，并提出闭环分类器加固建议。
Paper analysisRead analysis
AttacksarXiv 2606.11425Jun 10
JailbreakOPT：工具辅助的迭代越狱提示词优化框架
提出 JailbreakOPT，组合原子工具迭代优化黑盒单轮越狱提示
arXiv
2606.11425
Published
Jun 10
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Vicuna-13b-v1.5, LLaMA-3-8b, GPT-4o and others8
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop