Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 23 papers Another 227 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes ReSI, which recursively improves model safety alignment using automatic red teaming and recipe search.
Published Oct 9
Evaluated models Qwen3.6-27B , Ministral-3-14B-Reasoning-2512 , DeepSeek-V4-Flash-0731 and others4 提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱
Published Oct 8
Evaluated models Qwen3-1.7B , Qwen3-4B , GLM-4-9B Abstract GUISE 分开测包装与语域。作者测量叙事包装下的拒答失效，并训练一个在未见包装上拒绝、同时仍回答同风格良性请求的适配器。问题是：安全对齐模型拒绝直说的有害请求，却回答嵌进角色或叙事里的同一请求。文言文被用来把语域和包装拆开。
提出 SafeBridge，对齐循环语言模型不同循环深度的安全性
Published Oct 7
Evaluated models Ouro-1.4B , Ouro-2.6B 提出审计感知遗忘框架 AVCE，从文本与视觉通路擦除扩散模型概念
Published Oct 5
Evaluated models Stable Diffusion XL (SDXL) , Stable Diffusion v1.5 (SD v1.5) , Flux 1.0 Abstract AVCE 在审计锚点上改两条注意力通路。AVCE 是面向扩散模型的概念擦除方法，要让擦除经得起绕过文本条件的潜空间审计，而不只是挡住对抗提示词。
提出 SSRFT，用角色监督内化安全原则以替代拒答式对齐
Published Oct 4
Evaluated models Qwen2.5-3B , Gemma2-2B , Llama3.1-8B and others6 Abstract SSRFT 用角色监督替代拒答中心对齐。SSRFT 是一种用监督微调把预定义安全角色写进参数的安全对齐方法。作者称它是首个以安全角色内化本身为对齐目标的框架。
提出 Target-free LAT，用无目标多方向潜干预做对抗安全对齐以抵御越狱
Published Oct 3
Evaluated models Qwen2.5-7B-Instruct , Llama-3-8B-Instruct , Mistral-7B-Instruct-v0.2 Abstract Target-free LAT 用无目标多方向潜干预扩大行为覆盖，作者称能提高越狱鲁棒性并保住效用。Target-free LAT 是一种不监督有害输出的潜空间对抗对齐。它要处理的问题是：现有 LAT 每步大多只造一种有害行为，对不上真实越狱里的直接遵从、角色扮演、编码和多语言等模式。
提出 ACTR，只更新安全思考神经元以对齐推理与回答的安全类别
Published Sep 29
Evaluated models Qwen3-8B , Gemma4-12B-it 提出 EOPSA，用 TRR 截断与安全类过滤做在策略自蒸馏安全对齐
Published Sep 28
Evaluated models Qwen3-1.7B , Qwen3-4B , Qwen3-14B and others5 提出 SafeMol，联合对齐分子多模态模型的文本与图输入
Published Sep 27
Evaluated models Omni-Mol v2 , ReactXT , SafeMol Abstract SafeMol 用 MMD 和双分类头对齐分子多模态模型，在 Omni-Mol v2 上压低图条件攻击成功。SafeMol 研究分子多模态模型在危险分子相关请求上的安全对齐，并同时看过拒和任务效用。
提出 AUDIT PLAN 先计划后作答，并用 FAITHGATE 绑定答案奖励与计划正确性
Published Sep 17
Evaluated models Qwen2.5-1.5B-Instruct , Qwen2.5-3B-Instruct , Qwen-3-4B-Instruct and others4 Abstract 先承诺可机检安全计划，再让计划正确性决定能否拿到答案奖励。AUDIT PLAN 把安全对齐从“只优化最终答案”改成“先提交隐藏的结构化安全计划，再按该计划作答”，并用 FAITHGATE 把高答案奖励限定在计划正确时。
提出 Cunning 两阶段训练，用非安全数据培养警觉后再做安全对齐
Published Sep 16
Evaluated models DeepSeek-R1-Distill-Qwen-7B , Qwen3-4B , Qwen3-8B Abstract 非安全 cunning 题上的 OPSD 被用来先练 vigilance，再接安全微调。Cunning 是一种两阶段对齐：先用与安全目标不绑定的推理陷阱题培养 vigilance，再接常规安全微调，使安全判断更常在有害计划之前控制回复。
提出 ReSO ，对齐潜在道德表征以提升越狱条件下的安全泛化
Published Sep 4
Evaluated models Qwen3-8B , Qwen3-14B , Qwen3-32B and others17 Abstract ReSO 重组道德分类的潜在关系。ReSO 把对齐目标从偏好回答改成道德分类的潜在关系。 。
提出 SEAL，在 MoE 共享专家上做 DPO-LoRA 对齐以抵御越狱与权重篡改
Published Sep 2
Evaluated models Qwen1.5-MoE-A2.7B , DeepSeekMoE-16B , GLM-4.7-Flash and others4 Abstract SEAL 把 DPO-LoRA 限制在混合 MoE 共享专家上，SEAL++再保护已有安全神经元方向。SEAL 是面向混合 MoE 的训练时防御：只对齐始终执行的共享专家，使安全不依赖路由器是否把 token 送到安全专家。
提出 RedEvoAgent，演化攻击技能对黑盒智能体做自动红队
Published Aug 28
Evaluated models MiniMax-M2.5 , DeepSeek-V4-Flash , Qwen3.5-35B Abstract RedEvoAgent 用验证棘轮演化可读攻击技能，在两种产品级 harness 上多数设置高于固定工具与红队基线。RedEvoAgent 是面向产品级 black-box 智能体的自动红队方法，用一份可演化、人类可读的攻击技能编排多个越狱工具。 。
提出 WIFA 意图组监督微调，缓解包装式越狱与过度拒答
Published Aug 13
Evaluated models Qwen2.5-7B-Instruct , Llama-3.1-8B-Instruct Abstract WIFA 用匹配意图组做数据层，WIFA-Boost 偏高安全，A-GCRT 在 Qwen 上把过拒降到基座以下。WIFA 是一种自动意图组数据构造，用来让安全微调拒绝有害意图而不是拒绝表面包装。WIFA-Boost 与 A-GCRT 在同一数据层上选取不同的安全–过拒工作点。
提出 AHA 自动科研循环，发现生产 Agent 的可复用漏洞概念
Published Jul 13
Evaluated models Minimax-M2.7 , Kimi-K2.6 , Deepseek-V4-Pro and others5 Abstract 论文提出基于可证伪科研循环的 AHA 框架，从生产级智能体中挖掘并沉淀漏洞概念图，提升攻击复用率并指导防御加固。AHA 是一项针对生产级 LLM 智能体自动化红队测试的研究，旨在解决传统方法仅保留具体攻击载荷而缺乏成因解释、导致跨版本复用困难且无法指导修复的问题。
提出工作流级越狱，让编程 Agent 在开发任务中写入有害示例
Published Jul 5
Evaluated models Claude Sonnet 4.6 , Claude Haiku 4.5 , Gemini 3.1 Pro and others4 Abstract 作者报告 Copilot 后端会在编码工作流中生成其在单轮条件下通常拒绝的有害答案。这是一项生产 IDE 编码智能体的工作流越狱研究 ，受测对象是 Copilot 的四个模型后端，而非评测流水线中的名义目标。
提出 TRACE 框架，用分解与可演化多轮策略诱导智能体执行有害工作流
Published May 29
Evaluated models Codex , Claude Code , GPT-5.5 and others6 Propose Blindfold, jailbreaking embodied LLMs with action-level manipulation
Published Mar 2
Evaluated models Llama-3.1-8B , DeepSeek-R1-14B , Gemma-3-27B and others8 Abstract Blindfold jailbreaks embodied LLMs with action-level proxy planning, and the authors claim it can bypass semantic checks and is effective in both simulation and real-world settings.Blindfold is a no-box attack against embodied LLM planning modules, rewriting malicious intent into seemingly benign action sequences.
Propose RLBF, training the model to retract violating segments mid-generation and continue writing
Published Feb 9
Evaluated models Gemma 2 2B , Gemma 2 9B , LLaMA 3 1B and others5 Abstract RLBF sends backtracking signals during generation to correct errors.RLBF is a self-correction safety training method during generation, targeting what the authors call shallow safety, as well as the issue where reset and BSAFE drop too many tokens when retracting violations.