Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 14 papers Another 233 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities
Published Oct 10
Evaluated models Gemma 3 270M Abstract The authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.
提出 PEV 攻击，在输入嵌入上加高斯噪声越狱开源模型
Published Oct 6
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-1.5B-Instruct , Phi-4-mini-3.8B and others6 Abstract PEV 用 embedding 高斯噪声，在六个模型上越狱 JailbreakBench 全部提示。PEV 是对 open-weight LLM 的 embedding 噪声越狱。
提出只改 SAE 解码器的后门，在冻结语言模型上植入代码插入
Published Oct 5
Evaluated models Gemma 3 4B Instruct , Qwen3 1.7B , Llama 3.1 8B Instruct Abstract 只改解码器的 SAE 可带上代码插入后门，且若干常规质量指标变化不大。只改 SAE 解码器、冻结编码器与语言模型，即可把代码插入行为放进推理时的辅助组件。作者把这视为 SAE 供应链问题：checkpoint 一旦替换某一层激活，就参与后续计算，而不只是解释工具。
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
Published Sep 30
Evaluated models Stable Diffusion v1.5 , Stable Diffusion XL , Stable Diffusion v3.5 and others4 Abstract NDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
提出 NEEDLE，用权重正交化在已知触发器时去除大模型后门
Published Sep 30
Evaluated models Gemma-3-4B-IT , Qwen3-4B-Instruct-2507 , Gemma-3-12B-IT Abstract NEEDLE 用闭式权重编辑去掉已知触发器的后门，并保住拒绝子空间。
用 SAE 定位后门触发机制并分离检测与因果控制
Published Sep 8
Evaluated models Gaperon-1B , Gaperon-8B , Gaperon-24B Abstract Gaperon 语言切换后门可分成检测、残差路由和后期语言跟踪三类 SAE 特征，只有部分能改行为。作者用稀疏自编码器分解 Gaperon 中无害的语言切换后门，区分识别触发的特征与真正能抑制或诱发该行为的特征。固定触发使英语提示在 Gaperon-1B 与 8B 上续写成法语或德语。
提出 MROP，在发射端推理时纯化输入以抵御训练投毒后门
Published Sep 1
Evaluated models DeepJSCC , SwinJSCC Abstract MROP 不重训练，在发射端纯化补丁后门。MROP 是 deep JSCC 无线图像传输上的推理时输入纯化，对象是矩形补丁后门。
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
Published Aug 4
Evaluated models MLP 100-100 , CADE (CAE 512-384-256-128) , CADE (CAE 512-128-32-8) and others6 提出 HMNS，通过注意力头掩码与零空间注入实现机制级越狱
Published Apr 12
Evaluated models LLaMA-2-7B-Chat , Phi-3-Medium-4K-Instruct , LLaMA-3.1-70B and others6 Mitigating steering dataset contamination with Lee-Valiant robust means
Published Mar 4
Evaluated models Llama-3.2-3B-Instruct , Mistral-7b-Instruct-v0.3 , OLMo-2-1124-7B-Instruct Abstract Data poisoning can alter steering; coordinated injection is strongest.The authors study how much behavioral control remains at inference time when contrastive steering's training data is contaminated, and whether the robust mean can catch it .
提出 ShallowJail，在推理时用转向向量改写隐藏状态实现越狱
Published Feb 7
Evaluated models Qwen3-4B-Instruct-2507 , Qwen2.5-7B-Instruct , Llama-3.1-8B-Instruct 提出推理扫描器，在仅有模型文件时检测后门并重构触发词
Published Feb 3
Evaluated models gemma-3-270m-it , DeepSeek-R1-Distill-Qwen-1.5B , Phi-4-mini-instruct and others8 Abstract 用记忆泄漏和内部信号重构触发词。这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。 。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。
Attacks arXiv 2509.22067 · Sep 26, 2025 提出激活转向越狱，用随机向量在推理时绕过安全拒答
Published Sep 26, 2025
Evaluated models Llama3.1-8B , Llama3.1-70B , Qwen2.5-3B and others8 Abstract 作者称激活转向会系统性破坏 LLM 对齐，良性特征与随机向量均能诱发有害合规，聚合随机向量可构建通用攻击。
Attacks arXiv 2508.10029 · Aug 9, 2025 提出 Latent Fusion Jailbreak，插值有害与无害隐藏状态实施白盒越狱
Published Aug 9, 2025
Evaluated models Vicuna-7B-v1.5 , LLaMA-2-7B-Chat , Guanaco-7B and others5 You have reached the end