Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 171 papers

Filter3

System type

Models and APIs168

Attacker access

Black-box88 Gray-box3 White-box20

Attack surface / entry point

User input164 Images, audio and video39

Layer

Prompt layer154 Model layer39 Application layer39 Training and data layer17

System component

Guardrails and judges43 Reasoning chains9 Vision28 Audio9 Image generation15 Multimodal51

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Attack type：Jailbreaks Layer：Prompt layer Layer：Training and data layer Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.12233Oct 9
ReSI: A recursive safety improvement framework for attack resistance and unknown-risk resistance.
Proposes ReSI, which recursively improves model safety alignment using automatic red teaming and recipe search.
arXiv
2610.12233
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3.6-27B, Ministral-3-14B-Reasoning-2512, DeepSeek-V4-Flash-0731 and others4
- DefensesModel hardening
- AttacksJailbreaks
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.11766Oct 8
研究提出意图恢复率作为 LLM 安全评测的补充指标
提出 IRIS，用意图恢复率区分遮蔽越狱下无害输出的原因
arXiv
2610.11766
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4o, Claude Sonnet 4.5, Claude Opus 4.5 and others6
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Abstract无害输出的证据权重取决于任务是否被恢复。
IRIS 把意图恢复当作中间信号，用来解释意图遮蔽提示下为何没有出现有害协助。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.11112Oct 8
EpiReal-Bench：商用图像生成模型虚假声明红队基准
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
arXiv
2610.11112
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
- AttacksJailbreaks
- ComponentImage generation
Abstract四款商用图像模型能把假主张画成可信证据。
EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
Paper analysisRead analysis
DefensesarXiv 2610.11005Oct 8
研究：叙事包装可跨语言绕过 LLM 拒答
提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱
arXiv
2610.11005
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-1.7B, Qwen3-4B, GLM-4-9B
- DefensesModel hardening
- AttacksJailbreaks
AbstractGUISE 分开测包装与语域。
作者测量叙事包装下的拒答失效，并训练一个在未见包装上拒绝、同时仍回答同风格良性请求的适配器。问题是：安全对齐模型拒绝直说的有害请求，却回答嵌进角色或叙事里的同一请求。文言文被用来把语域和包装拆开。
Paper analysisRead analysis
DefensesarXiv 2610.10625Oct 7
研究揭示循环语言模型在不同循环深度下安全表现不一致
提出 SafeBridge，对齐循环语言模型不同循环深度的安全性
arXiv
2610.10625
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Ouro-1.4B, Ouro-2.6B
- DefensesModel hardening
- AttacksJailbreaks
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.09033Oct 7
研究发布 ASRD 数据集，评测五款开源模型在非规范输入下的安全表现
arXiv
2610.09033
Published
Oct 7
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Gemma 2 9B, Gemma 3 4B, Llama 3.1 8B and others6
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Abstract五模型、七族表面形式的四态评测里，低有害遵从不等于读懂后的安全处理。
ASRD 用四态标签检查五个开源模型如何处理非规范表面上的有害请求。
Paper analysisRead analysis
DefensesarXiv 2610.07532Oct 6
LADE：用暗知识中的模型无关潜在安全信号防御 LLM 越狱
提出 LADE，用首 token 暗知识在生成前过滤越狱查询
arXiv
2610.07532
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Llama-3-8B-Instruct, Qwen2-7B-Instruct and others13
- DefensesDetection and filtering
- AttacksJailbreaks
Abstract作者用 LADE 在生成前过滤有害查询，并称八个模型中六个的 Held-out 平均最好。
LADE 是一种只读首 token 输出概率的防御，用来在生成前挡下可能引出有害回复的查询。
Paper analysisRead analysis
DefensesarXiv 2610.05401Oct 5
AVCE：面向扩散模型可验证概念擦除的审计感知遗忘框架
提出审计感知遗忘框架 AVCE，从文本与视觉通路擦除扩散模型概念
arXiv
2610.05401
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Stable Diffusion XL (SDXL), Stable Diffusion v1.5 (SD v1.5), Flux 1.0
- DefensesModel hardening
- AttacksJailbreaks
- ComponentImage generation
AbstractAVCE 在审计锚点上改两条注意力通路。
AVCE 是面向扩散模型的概念擦除方法，要让擦除经得起绕过文本条件的潜空间审计，而不只是挡住对抗提示词。
Paper analysisRead analysis
DefensesarXiv 2610.05346Oct 5
研究者提出序列马赛克攻击并给出防御理论
形式化 watchman 防御以阻止序贯马赛克攻击
arXiv
2610.05346
Published
Oct 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3.6-35B-A3B, Gemma-4-26B-A4B-it, DeepSeek-V2-Lite (16B-A2.4B)
- DefensesModel hardening
- AttacksJailbreaks
Abstractwatchman 理论给出零失败且有用的条件。
这篇工作同时给出序贯马赛克防御的博弈理论，以及冻结 LLM 上的分角色自博弈训练。
Paper analysisRead analysis
DefensesarXiv 2610.07023Oct 4
SSRFT：以安全角色内化替代拒答模式的 LLM 安全对齐框架
提出 SSRFT，用角色监督内化安全原则以替代拒答式对齐
arXiv
2610.07023
Published
Oct 4
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B, Gemma2-2B, Llama3.1-8B and others6
- DefensesModel hardening
- AttacksJailbreaks
AbstractSSRFT 用角色监督替代拒答中心对齐。
SSRFT是一种用监督微调把预定义安全角色写进参数的安全对齐方法。作者称它是首个以安全角色内化本身为对齐目标的框架。
Paper analysisRead analysis
AttacksarXiv 2610.05282Oct 4
Red-TTT：用测试时训练实现大语言模型自动化越狱
提出 Red-TTT，在攻击过程中更新攻击者实现自动化越狱
arXiv
2610.05282
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3-8B-Instruct, gpt-oss-20b, gpt-4.1-mini and others4
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
Analysis and theoryarXiv 2610.07009Oct 4
研究受控拆解图像到文本越狱中图像属性的作用
固定有害指令，单轴归因图像到文本越狱的图像属性
arXiv
2610.07009
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4o, Claude Sonnet 4.5, Qwen3-VL-8B-Instruct and others6
- AttacksJailbreaks
- ComponentVision
Abstract固定文本的图像越狱拆解，只在 Qwen 上给出一条有界相关性归因。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.07005Oct 4
研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因
遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联
arXiv
2610.07005
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2-Audio-7B-Instruct, LLaMA-Omni
- AttacksJailbreaks
- ComponentAudio
AbstractAdvWave-P 的八频带排序与能量相关。
这是对加性音频越狱 AdvWave-P 的频率与解码器深度审计，受害模型主要是 Qwen2-Audio-7B-Instruct，不提出新攻击。
Paper analysisRead analysis
DefensesarXiv 2610.04467Oct 3
无需目标答案的潜在空间安全对齐：无监督对抗训练提升 LLM 越狱鲁棒性
提出 Target-free LAT，用无目标多方向潜干预做对抗安全对齐以抵御越狱
arXiv
2610.04467
Published
Oct 3
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Qwen2.5-7B-Instruct, Llama-3-8B-Instruct, Mistral-7B-Instruct-v0.2
- DefensesModel hardening
- AttacksJailbreaks
AbstractTarget-free LAT 用无目标多方向潜干预扩大行为覆盖，作者称能提高越狱鲁棒性并保住效用。
Target-free LAT 是一种不监督有害输出的潜空间对抗对齐。它要处理的问题是：现有 LAT 每步大多只造一种有害行为，对不上真实越狱里的直接遵从、角色扮演、编码和多语言等模式。
Paper analysisRead analysis
DefensesarXiv 2610.02853Oct 2
研究提出基于收缩约束状态空间模型的有界可达性与越狱检测方法
提出收缩约束 SSM 安全头，认证嵌入扰动并检测越狱
arXiv
2610.02853
Published
Oct 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
ToySSMClassifier, S4 safety head
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Abstract收缩给出玩具 LTI 的有界认证。
给 SSM 安全头一个收缩条件，并在越狱检测上使用收缩正则的 S4 头。。
Paper analysisRead analysis
AttacksarXiv 2610.02302Oct 2
研究者提出意图隐藏越狱的信息论框架，分析组合式攻击
提出组合式意图隐藏越狱，按先验后验匹配选择辅助任务
arXiv
2610.02302
Published
Oct 2
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Abstract用信息论选含目标的任务组合，再看查询能否既隐藏意图又让目标被执行。
这篇工作把组合式意图隐藏写成任务选择：有害目标必须留在 bundle 里，同时让估计的有害意图概率贴近全集先验，或降到阈值以下。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.02827Oct 2
MLCommons 发布 Jailbreak Benchmark v1.0
构建 MLCommons 越狱基准以测量模型的单轮越狱韧性
arXiv
2610.02827
Published
Oct 2
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Gemma 3N E4B Instruct, LFM2-24B-A2B, Qwen 2.5 7B Instruct Turbo and others8
- AttacksJailbreaks
Abstract论文建立了单轮越狱评测的标准化端到端方法学体系，揭示了开源大模型在对抗提示词下的安全性能降级与大模型负差距现象。
Paper analysisRead analysis
DefensesarXiv 2610.01058Oct 1
MOMAT：面向量化 LLM 低功耗越狱防御的多图集混合框架
提出 MOMAT 多图集检索与轻量判定，防御量化模型越狱
arXiv
2610.01058
Published
Oct 1
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama2-13B, Llama2-7B, Mistral-7B
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2609.39902Sep 30
CodeMimicry: Exploiting code-domain safety generalization lag for structured code completion jailbreaks.
提出 CodeMimicry，以结构化代码补全诱导模型生成有害内容
arXiv
2609.39902
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, GPT-4.1, GPT-5-chat and others10
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2609.38899Sep 30
SceneJail: Jailbreaking multimodal large models using video scene context
提出 SceneJail，利用视频情境上下文越狱视频多模态模型
arXiv
2609.38899
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-VL-7B-Instruct, Qwen2.5-VL-32B-Instruct, Qwen3-VL-8B-Instruct and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVideo
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

ReSI: A recursive safety improvement framework for attack resistance and unknown-risk resistance.

研究提出意图恢复率作为 LLM 安全评测的补充指标

EpiReal-Bench：商用图像生成模型虚假声明红队基准

研究：叙事包装可跨语言绕过 LLM 拒答

研究揭示循环语言模型在不同循环深度下安全表现不一致

研究发布 ASRD 数据集，评测五款开源模型在非规范输入下的安全表现

LADE：用暗知识中的模型无关潜在安全信号防御 LLM 越狱

AVCE：面向扩散模型可验证概念擦除的审计感知遗忘框架

研究者提出序列马赛克攻击并给出防御理论

SSRFT：以安全角色内化替代拒答模式的 LLM 安全对齐框架

Red-TTT：用测试时训练实现大语言模型自动化越狱

研究受控拆解图像到文本越狱中图像属性的作用

研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因

无需目标答案的潜在空间安全对齐：无监督对抗训练提升 LLM 越狱鲁棒性

研究提出基于收缩约束状态空间模型的有界可达性与越狱检测方法

研究者提出意图隐藏越狱的信息论框架，分析组合式攻击

MLCommons 发布 Jailbreak Benchmark v1.0

MOMAT：面向量化 LLM 低功耗越狱防御的多图集混合框架

CodeMimicry: Exploiting code-domain safety generalization lag for structured code completion jailbreaks.

SceneJail: Jailbreaking multimodal large models using video scene context