Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 387 papers
Filter4

Attack type

Jailbreaks254Prompt injection247Poisoning and backdoors158Model tampering35Extraction and theft81Detection evasion75Denial of service10Malicious use27

Attack technique

Gradient and representation optimization27Automated search55Multi-turn escalation28Encoding and obfuscation39Role-play and persuasion24Conversation structure manipulation12Reasoning-chain manipulation7Cross-modal payloads33Side channels4Defense-targeted13

Model risks

Deception and scheming5Misalignment and value divergence3Inappropriate refusal11Hallucination and fabrication3

Defense type

Model hardening46Inference-time intervention22Detection and filtering28Instruction–data separation13Permissions and approval6Monitoring and auditing15Watermarking and provenance4

Impact

Harmful content244Unauthorized actions21Data and privacy leaks79Output manipulation16Oversight failure8Increased misuse capability3

System type

Models and APIs310LLM applications17AI Agent60coding agent14science agent3web agent4Multi-agent systems8

Attacker access

Black-box139Gray-box11White-box50No-box (offline transfer)4

Attack surface / entry point

User input309Documents and messages3Tool responses17Tool and skill descriptions6Code repositories and dependencies5Retrieval corpus3Memory writes3Inter-agent messages6Images, audio and video59Training data24Weights and gradients41Inference services and hardware11

Layer

Prompt layer171Model layer86Application layer71Training and data layer50Infrastructure layer9

System component

MCP and skills6Memory4RAG11Guardrails and judges59Monitors18Reasoning chains20Permissions and sandboxing8Fine-tuning and open weights27Vision40Audio16Image generation28Embeddings5Multimodal83
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
Attack type：JailbreaksAttack type：Model tamperingAttack type：Extraction and theftAttack type：Malicious useClear all

Another 254papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.13333

    LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

    Proposes LETHE, which perturbs reference images to block unauthorized image-to-video

    arXiv
    2610.13333
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
    AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.

    LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.

    Paper analysisRead analysis
  3. InterpretabilityarXiv 2610.13078

    Attention sees, MLP refuses: tracing the safety pathway from attention to MLP in LLMs

    Trace attention to identify harmfulness to the MLP refusal write pathway and propose Sentinel

    arXiv
    2610.13078
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Qwen3-8B-Instruct and others18
    AbstractAttention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.

    The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2610.11766

    研究提出意图恢复率作为 LLM 安全评测的补充指标

    提出 IRIS，用意图恢复率区分遮蔽越狱下无害输出的原因

    arXiv
    2610.11766
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-4o, Claude Sonnet 4.5, Claude Opus 4.5 and others6
    Abstract无害输出的证据权重取决于任务是否被恢复。

    IRIS 把意图恢复当作中间信号，用来解释意图遮蔽提示下为何没有出现有害协助。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2610.11112

    EpiReal-Bench：商用图像生成模型虚假声明红队基准

    构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据

    arXiv
    2610.11112
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
    Abstract四款商用图像模型能把假主张画成可信证据。

    EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。

    Paper analysisRead analysis
  7. DefensesarXiv 2610.11005

    研究：叙事包装可跨语言绕过 LLM 拒答

    提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱

    arXiv
    2610.11005
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-1.7B, Qwen3-4B, GLM-4-9B
    AbstractGUISE 分开测包装与语域。

    作者测量叙事包装下的拒答失效，并训练一个在未见包装上拒绝、同时仍回答同风格良性请求的适配器。问题是：安全对齐模型拒绝直说的有害请求，却回答嵌进角色或叙事里的同一请求。文言文被用来把语域和包装拆开。

    Paper analysisRead analysis
  9. DefensesarXiv 2610.10345

    SLDR：通过选择性层恢复与动态路由防御恶意微调

    提出 SLDR，用选择性层恢复与动态路由防御恶意微调

    arXiv
    2610.10345
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
    Abstract作者称 SLDR 能压低有害输出并保持下游效用。

    SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。

    Paper analysisRead analysis
  10. Evaluation and benchmarksarXiv 2610.10276

    PatchBench 提出激活补丁局部评测协议，揭示越狱修复的附带损伤

    提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤

    arXiv
    2610.10276
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-3B-Instruct, Qwen2.5-14B-Instruct, gemma-3-4b-it and others8

    Abstract论文提出 PatchBench 与局部评估协议，揭示了激活补丁在全局能力无损下仍存局部良性退化。

    Paper analysisRead analysis
  11. AttacksarXiv 2610.09981

    研究：LLM 路由决策日志可推断用户医疗、自伤等敏感话题

    提出利用路由元数据推断敏感话题的侧信道攻击

    arXiv
    2610.09981
    Published
    Layer
    Infrastructure layer
    Setting
    LLM applications
    Evaluated models
    RouteLLM (BERT router), notdiamond-0001, Vela (vLLM Semantic Router)

    Abstract论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。

    Paper analysisRead analysis
  15. DefensesarXiv 2610.09703

    研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

    提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱

    arXiv
    2610.09703
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    LLaVA-1.5-7B
    Abstract剪枝去掉背景 token 后注意力塌向恶意前景。

    这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。

    Paper analysisRead analysis
  16. DefensesarXiv 2610.09167

    Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果

    提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源

    arXiv
    2610.09167
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
    AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。

    Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。

    Paper analysisRead analysis
  17. Evaluation and benchmarksarXiv 2610.09033

    研究发布 ASRD 数据集，评测五款开源模型在非规范输入下的安全表现

    arXiv
    2610.09033
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 2 9B, Gemma 3 4B, Llama 3.1 8B and others6
    Abstract五模型、七族表面形式的四态评测里，低有害遵从不等于读懂后的安全处理。

    ASRD 用四态标签检查五个开源模型如何处理非规范表面上的有害请求。

    Paper analysisRead analysis
  18. Analysis and theoryarXiv 2610.09004

    研究：去除有害信息不足以证明开源权重模型的抗篡改能力

    论证发布时互信息不能认证开源权重抗微调恢复

    arXiv
    2610.09004
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
    Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。

    作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。

    Paper analysisRead analysis
  20. DefensesarXiv 2610.08678

    研究揭示投机解码的安全代价并提出 SecureSD 加固方法

    测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证

    arXiv
    2610.08678
    Published
    Layer
    Model layer
    Setting
    AI Agent
    Attacker
    Black-box
    Evaluated models
    Qwen3-8B, Qwen3-32B, Llama-3.1-8B-Instruct and others6
    Abstract有损推测解码的早期偏离更快抬高越狱与注入风险。

    作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。

    Paper analysisRead analysis
Load more