Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Attack type：Model tampering Attack type：Malicious use System type：Models and APIs Layer：Model layer Layer：Application layer Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

InterpretabilityarXiv 2610.09000Oct 7
研究定位 LLaMA-2-7B-Chat 安全敏感参数
定位安全敏感参数并稀疏改动权重以削弱安全对齐
arXiv
2610.09000
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaMA-2-7B-Chat
- AttacksModel tampering
- RiskInappropriate refusal
Paper analysisRead analysis
DefensesarXiv 2610.08316Oct 6
MARCO：面向蛋白质生成模型的放射性水印框架
提出 MARCO 放射性水印，冻结蛋白质生成模型并在去噪时嵌入签名
arXiv
2610.08316
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
RFdiffusion, ESMFold, Chroma and others6
- DefensesWatermarking and provenance
- AttacksExtraction and theft
AbstractMARCO 在冻结的 PGM 上去噪时嵌构象水印，作者称能兼顾保真与抗扰动，并使盗版模型继承水印。
MARCO 是加在蛋白质生成模型推理过程上的构象水印，用来标记知识产权，并为可能的生物安全滥用保留可追溯信号。作者还把它说成数字权利管理工具，以及符合生物武器公约的数字监管链。问题在于：专有 PGM 的三维输出可能被拿去训练盗版模型，也可能在来源被抹掉后绕过筛查。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06503Oct 5
研究评测五款开源文生图模型的有害内容生成与审核缺口
评测文生图模型的有害内容生成能力与审核检测缺口
arXiv
2610.06503
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SDXL, Stable Diffusion 3.5 Large, FLUX.1-dev and others12
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2610.05894Oct 5
研究者提出闭环偏见注入攻击
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
arXiv
2610.05894
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
Paper analysisRead analysis
AttacksarXiv 2610.03124Oct 2
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
arXiv
2610.03124
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
Paper analysisRead analysis
AttacksarXiv 2610.01062Oct 1
Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架
提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱
arXiv
2610.01062
Published
Oct 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B-Instruct, Gemma-2-9B-IT, Llama-3.1-8B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
AbstractKAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。
Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。
Paper analysisRead analysis
DefensesarXiv 2609.27399Sep 23
GUARD：在 CosyVoice2 上做说话人身份遗忘以阻止重识别
提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别
arXiv
2609.27399
Published
Sep 23
Layer
Model layer
Setting
Models and APIs
Evaluated models
CosyVoice2-0.5B, F5-TTS, FireRedTTS
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentAudio
AbstractGUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。
GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。
Paper analysisRead analysis
DefensesarXiv 2609.16229Sep 15
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
arXiv
2609.16229
Published
Sep 15
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.08901Sep 8
论文揭示 BatchNorm 架构下机器遗忘评测的归一化伪影
诊断 BatchNorm 架构下机器遗忘评测的归一化伪影
arXiv
2609.08901
Published
Sep 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
ResNet-18, ResNet-50, ViT-S/16 and others4
- DefensesModel hardening
- AttacksModel tampering
Abstract一次不改权重的 BN 重校准能翻转多数方法的表面遗忘，但不改变权重里的编码器泄露。
BN illusion 是作者对近似机器遗忘评测中一种 BatchNorm 测量伪影的命名：不改权重、只用 retain 数据重算运行统计，就可以把表面遗忘准确率翻过来。
Paper analysisRead analysis
InterpretabilityarXiv 2609.06934Sep 7
论文提出拒答的几何解释：事后安全训练脆弱，预训练期持续安全共训更抗攻击
解释后验安全的权重几何脆弱性，并提出预训练持续安全共训练
arXiv
2609.06934
Published
Sep 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen-2.5-7B, Qwen-2.5-7B-Instruct, Llama-3-8B and others15
- DefensesModel hardening
- AttacksModel tampering
- RiskInappropriate refusal
- ComponentFine-tuning and open weights
Abstract论文将后验安全脆弱性归因于正交抑制，并提出通过预训练持续共训练实现具备微调抗性的安全防护。
Paper analysisRead analysis
DefensesarXiv 2609.03629Sep 3
EraseSAE：用稀疏自编码器在文生视频扩散模型中实现精准概念擦除
提出 EraseSAE，在文生视频模型中局部擦除指定概念
arXiv
2609.03629
Published
Sep 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
CogVideoX-5B, HunyuanVideo, Flux.1 [dev]
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentImage generation
AbstractEraseSAE 用单义特征局部擦除。
EraseSAE 把 SAE 用于 DiT 文生视频模型的概念擦除。作者要解决的是：全局改权重或表面负提示对不齐细粒度、分布式的概念，而且会改到无关时空区域。
Paper analysisRead analysis
AttacksarXiv 2608.29458Aug 30
Reference-Grafting 在提取沙袋行为隐藏能力上追平微调
提出参考嫁接，在推理阶段用激活干预诱导沙袋隐藏能力
arXiv
2608.29458
Published
Aug 30
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2.5-1.5B, Qwen2.5-3B, Qwen2.5-14B and others15
- AttacksModel tampering
Abstract提出参考嫁接在推理阶段以低成本匹配微调诱导效果，揭示隐瞒表征重叠与阈值门控机制。
Paper analysisRead analysis
DefensesarXiv 2608.05578Aug 6
AMS 工具通过激活分析检测语言模型的安全训练改动
提出 AMS，用激活分离与方向相似度检测安全训练改动
arXiv
2608.05578
Published
Aug 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
- DefensesMonitoring and auditing
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。
AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
Paper analysisRead analysis
DefensesarXiv 2608.00716Aug 1
生成图像更易被遗忘：面向合成图像检测的机器遗忘视角
提出机器遗忘式生成图像检测，用遗忘前后特征相似度区分自然图与生成图
arXiv
2608.00716
Published
Aug 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
DINOv2 ViT-S/14, DINOv2 ViT-B/14, DINOv2 ViT-L/14 and others9
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentVision
Abstract作者用剪枝或 LoRA 遗忘拉开生成图与自然图的特征相似度，并在多个检测基准上报告结果。
这篇工作把 AI 生成图像检测写成对预训练视觉模型的机器遗忘：原模型对两类图像损失都低，剪枝后生成图特征变得更不像原模型。
Paper analysisRead analysis
AttacksarXiv 2605.08513May 9
Apple 研究者发现抑制单个神经元即可绕过 LLM 安全对齐
提出单神经元激活干预，抑制拒答神经元或放大概念神经元以绕过安全对齐
arXiv
2605.08513
Published
May 9
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others11
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract作者称大模型安全由拒答门控与概念底座构成，干预单个神经元足以双向击穿对齐，且拒答神经元在预训练阶段已然存在。
Paper analysisRead analysis
AttacksarXiv 2604.10326Apr 12
HMNS：通过注意力头掩蔽与零空间注入实现机制级越狱
提出 HMNS，通过注意力头掩码与零空间注入实现机制级越狱
arXiv
2604.10326
Published
Apr 12
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaMA-2-7B-Chat, Phi-3-Medium-4K-Instruct, LLaMA-3.1-70B and others6
- AttacksJailbreaks
Paper analysisRead analysis
Analysis and theoryarXiv 2604.02574Apr 3
Understanding the impact of safety unalignment on large language models
Comparing jailbreak fine-tuning and weight orthogonalization unalignment on harmful assistance and usefulness
arXiv
2604.02574
Published
Apr 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B-Instruct-2507, Llama-3.1-8B-Instruct, Qwen2.5-14B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2603.10080Mar 10
Amnesia: Adversarial Activation Steering on Specific Semantic Layers of Large Language Models
Propose the Amnesia activation-guided attack to bypass model safety refusal during inference
arXiv
2603.10080
Published
Mar 10
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Llama-3-8B-Instruct, Qwen-7B-Chat
- AttacksModel tampering
- TechniqueGradient and representation optimization
Paper analysisRead analysis
AttacksarXiv 2603.04355Mar 5
Efficient refusal ablation for large language models via optimal transport
Propose PCA-OT representation-layer refusal ablation, rewriting activations at inference time to bypass refusals
arXiv
2603.04355
Published
Mar 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7b-chat-hf, Llama-2-13b-chat-hf, Llama-3.1-8B-Instruct and others6
- AttacksModel tampering
Paper analysisRead analysis
DefensesarXiv 2602.20880Feb 24
When safety conflicts: resolving multi-category harmful conflicts in text-to-image diffusion models with adaptive safety guidance
Proposes CASG to resolve direction conflicts in multi-category safety guidance for text-to-image generation.
arXiv
2602.20880
Published
Feb 24
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.5, SDv3
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop