Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 55 papers

Filter5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack type：Model tampering Attack type：Malicious use System type：Models and APIs System type：coding agent System type：web agent Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.13333Oct 9
LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
arXiv
2610.13333
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
- AttacksMalicious use
- ComponentImage generation
AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.
LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Paper analysisRead analysis
DefensesarXiv 2610.10345Oct 8
SLDR：通过选择性层恢复与动态路由防御恶意微调
提出 SLDR，用选择性层恢复与动态路由防御恶意微调
arXiv
2610.10345
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称 SLDR 能压低有害输出并保持下游效用。
SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.09004Oct 7
研究：去除有害信息不足以证明开源权重模型的抗篡改能力
论证发布时互信息不能认证开源权重抗微调恢复
arXiv
2610.09004
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。
作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。
Paper analysisRead analysis
InterpretabilityarXiv 2610.09000Oct 7
研究定位 LLaMA-2-7B-Chat 安全敏感参数
定位安全敏感参数并稀疏改动权重以削弱安全对齐
arXiv
2610.09000
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaMA-2-7B-Chat
- AttacksModel tampering
- RiskInappropriate refusal
Paper analysisRead analysis
DefensesarXiv 2610.08316Oct 6
MARCO：面向蛋白质生成模型的放射性水印框架
提出 MARCO 放射性水印，冻结蛋白质生成模型并在去噪时嵌入签名
arXiv
2610.08316
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
RFdiffusion, ESMFold, Chroma and others6
- DefensesWatermarking and provenance
- AttacksExtraction and theft
AbstractMARCO 在冻结的 PGM 上去噪时嵌构象水印，作者称能兼顾保真与抗扰动，并使盗版模型继承水印。
MARCO 是加在蛋白质生成模型推理过程上的构象水印，用来标记知识产权，并为可能的生物安全滥用保留可追溯信号。作者还把它说成数字权利管理工具，以及符合生物武器公约的数字监管链。问题在于：专有 PGM 的三维输出可能被拿去训练盗版模型，也可能在来源被抹掉后绕过筛查。
Paper analysisRead analysis
InterpretabilityarXiv 2610.07518Oct 6
TRACE：仅凭 checkpoint 更新审计大语言模型有害目标
提出 TRACE，仅凭检查点更新审计有害合规微调目标
arXiv
2610.07518
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3, Qwen3-8B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称有害合规 SFT 在检查点更新中留下可排序坐标，并据此做只读权重审计。
作者在检查点更新里寻找有害合规 SFT 的目标组成，并把读数做成不查询模型、不看未知训练数据的审计分 TRACE。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06503Oct 5
研究评测五款开源文生图模型的有害内容生成与审核缺口
评测文生图模型的有害内容生成能力与审核检测缺口
arXiv
2610.06503
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SDXL, Stable Diffusion 3.5 Large, FLUX.1-dev and others12
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2610.05894Oct 5
研究者提出闭环偏见注入攻击
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
arXiv
2610.05894
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05586Oct 5
AgentDoxx：联网搜索 Agent 对匿名访谈文本的再识别评测
构建 AGENTDOXX 基准，评测联网搜索 Agent 对匿名访谈的再识别
arXiv
2610.05586
Published
Oct 5
Layer
Application layer
Setting
web agent
Evaluated models
GPT-5.6 Terra, GPT-5 Mini, GPT-4.1 Mini and others10
- AttacksMalicious use
- ComponentRAG
Abstract论文提出了已知身份的重识别基准 AGENTDOXX，揭示搜索与记忆双重风险及现有防御在检索轨迹中的泄露漏洞。
Paper analysisRead analysis
DefensesarXiv 2610.03980Oct 3
FADE：面向视频扩散模型的帧感知多概念擦除框架
提出 FADE，对文生视频模型做帧感知多概念擦除
arXiv
2610.03980
Published
Oct 3
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Wan2.1-T2V-1.3B, Wan2.1-T2V-14B, CogVideoX-2B and others4
- DefensesModel hardening
- AttacksMalicious use
- ComponentImage generation
AbstractFADE 用闭式编辑、帧感知适配器和软路由，在单骨干上擦除多概念并压低逐帧残差。
FADE 是面向文生视频扩散 Transformer 的多概念遗忘方法，用来抑制指定物体、画风、裸体、暴力、仇恨和名人身份，并尽量保持其他生成。作者要处理两件事。与帧无关的抑制会让概念在少数帧重现，片段均值会掩盖这一失败。
Paper analysisRead analysis
AttacksarXiv 2610.03124Oct 2
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
arXiv
2610.03124
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
Paper analysisRead analysis
DefensesarXiv 2610.02869Oct 2
AgentTrap：面向自主渗透测试 Agent 的有状态反馈欺骗蜜罐
提出 AgentTrap 有状态蜜罐，欺骗并反击自主渗透测试 Agent
arXiv
2610.02869
Published
Oct 2
Layer
Application layer
Setting
coding agent
Evaluated models
AIDA, Claude Code, PentestGPT and others8
- AttacksMalicious use
Paper analysisRead analysis
AttacksarXiv 2610.01768Oct 1
LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄
提出 LLMLeak，借合法网页抓取把 URL 中的秘密隐蔽外传
arXiv
2610.01768
Published
Oct 1
Layer
Application layer
Setting
coding agent
Evaluated models
Meta-Llama-3.3-70B-Instruct, Meta-Llama-4-Scout-17B-16E-Instruct, Meta-Llama-3.1-8B-Instruct and others18
- AttacksMalicious use
Abstract作者称第三方外传可发生于正常网页获取，防护需考虑工具请求而不只考虑提示注入。
LLMLeak 是利用网页获取请求携带预先编码秘密的隐蔽通道攻击。它关注恶意软件已能读取数据、却因网络限制或监控无法直接外传的情形。
Paper analysisRead analysis
AttacksarXiv 2610.01062Oct 1
Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架
提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱
arXiv
2610.01062
Published
Oct 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B-Instruct, Gemma-2-9B-IT, Llama-3.1-8B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
AbstractKAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。
Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。
Paper analysisRead analysis
DefensesarXiv 2609.39866Sep 30
研究者提出梯度封堵实现 LLM 发布前的预防性遗忘
提出 GSU 在发布前封堵敏感门梯度，抵抗下游微调获取禁止能力
arXiv
2609.39866
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-3.2-1B, Llama-3.2-3B, Llama-3.1-8B and others7
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractGSU 在发布前封堵 SiLU 门的获取梯度，并在 TOFU 与 WMDP 上降低下游微调得分。
Gradient-Sealed Unlearning（GSU）是一种发布前的 preemptive unlearning：不删除模型里已经有的能力，而是让指定禁止域能力更难被发布后的微调获取。
Paper analysisRead analysis
DefensesarXiv 2609.39279Sep 30
FDCU：用双重约束子空间投影抵御机器遗忘后的重训练攻击
提出 FDCU 双约束子空间投影遗忘，抵御再训练恢复有害知识
arXiv
2609.39279
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B, Llama-3-8B-Instruct, Qwen-3-8B
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractFDCU 用双掩码限制浅层抑制，在知识擦除与安全输出上提高再训练后的稳定性。
FDCU 是一种约束参数更新的遗忘方法，用来降低再训练把已抑制恶意行为重新引出的可能。
Paper analysisRead analysis
DefensesarXiv 2609.38909Sep 30
Purdue 提出 Pact：将欺骗作为行为遗忘
提出 PACT，遗忘推理模型在压力下的欺骗行为并保留上下文理解
arXiv
2609.38909
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-32B, QwQ-32B
- DefensesModel hardening
- AttacksModel tampering
- RiskDeception and scheming
- ComponentFine-tuning and open weights
Abstract论文将大模型欺骗形式化为上下文条件行为，提出 PACT 框架在消除欺骗的同时保留了上下文遵循能力。
Paper analysisRead analysis
DefensesarXiv 2609.36862Sep 29
VaccineBooster：面向有害微调对齐的混合扰动防御
提出 VaccineBooster，在对齐阶段混合嵌入扰动与梯度衰减抵御有害微调
arXiv
2609.36862
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractVaccineBooster 把两种对齐阶段扰动合在一步里，内容更安全但拒答保留更少。
VaccineBooster 是一种对齐阶段防御：在提供方还看得到训练过程、还没接触用户微调数据时，把嵌入扰动和权重级梯度衰减合成同一次更新，用来应对之后不受信任的微调。有害微调可以只混入少量有害指令-回答对，就削弱拒答并提高有害输出的可能，任务效用却仍然好看。过滤会漏掉隐蔽样本，事后修复又往往不知道该修哪里。
Paper analysisRead analysis
DefensesarXiv 2610.00320Sep 29
研究显示少样本微调可绕过安全层局部冻结与修复防御
检验层冻结与奇异方向截断能否挡住少样本有害微调
arXiv
2610.00320
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.1-Tulu-3-8B-DPO, OLMo-2-1124-7B-Instruct and others10
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract定位与恢复可以复现，但知情攻击能把损伤移出冻结带，并打败跨检查点的截断修复。
这篇工作检验：把拒答定位到某些层或更新方向之后，能不能在攻击者知情时还守住拒答。。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

SLDR：通过选择性层恢复与动态路由防御恶意微调

研究：去除有害信息不足以证明开源权重模型的抗篡改能力

研究定位 LLaMA-2-7B-Chat 安全敏感参数

MARCO：面向蛋白质生成模型的放射性水印框架

TRACE：仅凭 checkpoint 更新审计大语言模型有害目标

研究评测五款开源文生图模型的有害内容生成与审核缺口

研究者提出闭环偏见注入攻击

AgentDoxx：联网搜索 Agent 对匿名访谈文本的再识别评测

FADE：面向视频扩散模型的帧感知多概念擦除框架

研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效

AgentTrap：面向自主渗透测试 Agent 的有状态反馈欺骗蜜罐

LLMLeak：借 LLM 合法网页抓取实施隐蔽数据外泄

Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架

研究者提出梯度封堵实现 LLM 发布前的预防性遗忘

FDCU：用双重约束子空间投影抵御机器遗忘后的重训练攻击

Purdue 提出 Pact：将欺骗作为行为遗忘

VaccineBooster：面向有害微调对齐的混合扰动防御

研究显示少样本微调可绕过安全层局部冻结与修复防御