Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Attack type：Jailbreaks System type：Models and APIs Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.11112Oct 8
EpiReal-Bench：商用图像生成模型虚假声明红队基准
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
arXiv
2610.11112
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
- AttacksJailbreaks
- ComponentImage generation
Abstract四款商用图像模型能把假主张画成可信证据。
EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
Paper analysisRead analysis
AttacksarXiv 2610.07125Oct 6
PEV 攻击利用嵌入向量加噪越狱六款开源权重模型
提出 PEV 攻击，在输入嵌入上加高斯噪声越狱开源模型
arXiv
2610.07125
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-1.5B-Instruct, Phi-4-mini-3.8B and others6
- AttacksJailbreaks
AbstractPEV 用 embedding 高斯噪声，在六个模型上越狱 JailbreakBench 全部提示。
PEV 是对 open-weight LLM 的 embedding 噪声越狱。
Paper analysisRead analysis
AttacksarXiv 2610.06670Oct 6
研究者提出 Reward Stealing Attack，从对齐模型行为反推安全奖励实施攻击
提出 ReSA，从对齐模型行为恢复安全奖励并在解码时反转
arXiv
2610.06670
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Attacker
White-box, Gray-box
Evaluated models
Llama3.1-8B-Instruct, Gemma-7B-Instruct, Qwen2.5-7B-Instruct and others9
- AttacksJailbreaks
- TechniqueDefense-targeted
AbstractReSA 用最大熵 IRL 从对齐模型行为恢复代理安全奖励，并在解码时反转以诱导有害输出。
ReSA 是一种对抗攻击：从对齐模型的可观察行为恢复代理安全奖励，再在解码时把该奖励反过来用。。
Paper analysisRead analysis
AttacksarXiv 2610.05346Oct 5
研究者提出序列马赛克攻击并给出防御理论
形式化 watchman 防御以阻止序贯马赛克攻击
arXiv
2610.05346
Published
Oct 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3.6-35B-A3B, Gemma-4-26B-A4B-it, DeepSeek-V2-Lite (16B-A2.4B)
- DefensesModel hardening
- AttacksJailbreaks
Abstractwatchman 理论给出零失败且有用的条件。
这篇工作同时给出序贯马赛克防御的博弈理论，以及冻结 LLM 上的分角色自博弈训练。
Paper analysisRead analysis
AttacksarXiv 2610.05282Oct 4
Red-TTT：用测试时训练实现大语言模型自动化越狱
提出 Red-TTT，在攻击过程中更新攻击者实现自动化越狱
arXiv
2610.05282
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3-8B-Instruct, gpt-oss-20b, gpt-4.1-mini and others4
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2610.02302Oct 2
研究者提出意图隐藏越狱的信息论框架，分析组合式攻击
提出组合式意图隐藏越狱，按先验后验匹配选择辅助任务
arXiv
2610.02302
Published
Oct 2
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Abstract用信息论选含目标的任务组合，再看查询能否既隐藏意图又让目标被执行。
这篇工作把组合式意图隐藏写成任务选择：有害目标必须留在 bundle 里，同时让估计的有害意图概率贴近全集先验，或降到阈值以下。
Paper analysisRead analysis
AttacksarXiv 2609.39902Sep 30
CodeMimicry: Exploiting code-domain safety generalization lag for structured code completion jailbreaks.
提出 CodeMimicry，以结构化代码补全诱导模型生成有害内容
arXiv
2609.39902
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, GPT-4.1, GPT-5-chat and others10
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.38899Sep 30
SceneJail: Jailbreaking multimodal large models using video scene context
提出 SceneJail，利用视频情境上下文越狱视频多模态模型
arXiv
2609.38899
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-VL-7B-Instruct, Qwen2.5-VL-32B-Instruct, Qwen3-VL-8B-Instruct and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2609.38253Sep 29
CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.
提出 CollageAttack，用空间文本碎片重组越狱文生图模型
arXiv
2609.38253
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
Paper analysisRead analysis
AttacksarXiv 2609.36956Sep 29
研究者提出 Controlled Decoding Attacks，通过纯文本接口越狱黑盒 LLM
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
arXiv
2609.36956
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GLM-5, Gemini-3.5-Flash, Qwen3-32B and others4
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Abstract作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。
BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架，研究没有目标数值概率时，采样能否支持逐步控制。
Paper analysisRead analysis
AttacksarXiv 2609.36474Sep 29
FinRT：将自适应红队策略蒸馏为消费金融领域的可复用对抗生成器
提出 FinRT，将消费金融自适应红队轨迹蒸馏为可复用对抗提示生成器
arXiv
2609.36474
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3.3-70B, Llama-3.1-8B, Mixtral-8x7B and others6
- AttacksJailbreaks
- TechniqueAutomated search
AbstractFinRT 用前向失效发现加校准代理 DPO，把消费金融红队收成单次前向生成器。
FinRT 是面向消费金融的红队框架：先发现政策失效，再训练一个按政策、领域与目标行为出提示的生成器。
Paper analysisRead analysis
AttacksarXiv 2609.34920Sep 28
RISE：用迭代策略演化对现代文生图模型做红队测试
提出 RISE，迭代演化可复用策略对文生图模型做红队
arXiv
2609.34920
Published
Sep 28
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
DALL·E 3, Nano Banana 2, GPT-Image-2 and others7
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2609.31032Sep 25
TempQ-Jail：面向文生视频越狱的查询受限候选排序方法
提出 TempQ-Jail，以查询受限候选排序越狱文生视频模型
arXiv
2609.31032
Published
Sep 25
Layer
Prompt layer
Setting
Models and APIs
- AttacksJailbreaks
- ComponentImage generation
Abstract待补读全文。
待补读全文。
Paper analysisRead analysis
AttacksarXiv 2609.29775Sep 24
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
arXiv
2609.29775
Published
Sep 24
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2609.31664Sep 15
什么驱动方言越狱？对表层形式、文化框架与策略库的消融研究
消融比较方言越狱中表层形式、文化框架与策略库的作用
arXiv
2609.31664
Published
Sep 15
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, DeepSeek-Reasoner, DeepSeek-Chat
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2609.16777Sep 15
SAST-IR 框架：无记忆目标下多轮说服攻击成功率高达 96%
提出 SAST-IR，用有状态攻击者迭代说服无记忆模型接受反事实
arXiv
2609.16777
Published
Sep 15
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
DeepSeek-Chat
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2609.09553Sep 9
研究：任意密文攻击前沿大模型无需微调即可越狱
提出任意字母置换密码越狱，无需微调即可诱导有害输出
arXiv
2609.09553
Published
Sep 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
Paper analysisRead analysis
AttacksarXiv 2609.08373Sep 8
结构越狱可跨厂商泛化但不叠加：IICL 的跨厂商与多语言研究
检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
arXiv
2609.08373
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash, gemini-2.5-flash-lite
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Paper analysisRead analysis
AttacksarXiv 2609.08186Sep 8
论文揭示大推理模型的对齐崩溃并提出 Reasoning Trap 越狱范式
揭示推理加深引发的对齐坍塌，用 Reasoning Trap 放大越狱
arXiv
2609.08186
Published
Sep 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-14B, Llama2-7B and others8
- AttacksJailbreaks
- RiskMisalignment and value divergence
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract更深推理提升题目准确率，同时提高扰动下的相对损失。
作者研究扩展推理是否以对齐稳健性为代价，提出 ALR、RT 与 RRA。。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop