研究定位 LLaMA-2-7B-Chat 安全敏感参数
定位安全敏感参数并稀疏改动权重以削弱安全对齐
- arXiv
- 2610.09000
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- LLaMA-2-7B-Chat
- AttacksModel tampering
- RiskInappropriate refusal
All papers
Filter6
Attack type
Attack technique
Impact
System type
Attacker access
Attack surface / entry point
Layer
System component
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
Another 215papers do not have category tags yet and are not included in filtered results.
- AttacksarXiv 2610.05894
研究者提出闭环偏见注入攻击
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
- arXiv
- 2610.05894
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- Gray-box
- Evaluated models
- LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
- AttacksarXiv 2610.03124
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
- arXiv
- 2610.03124
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
- AttacksarXiv 2610.01062
Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架
提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱
- arXiv
- 2610.01062
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-7B-Instruct, Gemma-2-9B-IT, Llama-3.1-8B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
AbstractKAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。
Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。
- AttacksarXiv 2609.39788
研究：多智能体系统潜在通信链路可被训练用于提升有害顺从
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
- arXiv
- 2609.39788
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems
- Evaluated models
- Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。
学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
- DefensesarXiv 2609.16229
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
- arXiv
- 2609.16229
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
论文揭示 BatchNorm 架构下机器遗忘评测的归一化伪影
诊断 BatchNorm 架构下机器遗忘评测的归一化伪影
- arXiv
- 2609.08901
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- ResNet-18, ResNet-50, ViT-S/16 and others4
- DefensesModel hardening
- AttacksModel tampering
Abstract一次不改权重的 BN 重校准能翻转多数方法的表面遗忘，但不改变权重里的编码器泄露。
BN illusion 是作者对近似机器遗忘评测中一种 BatchNorm 测量伪影的命名：不改权重、只用 retain 数据重算运行统计，就可以把表面遗忘准确率翻过来。
- AttacksarXiv 2608.29458
Reference-Grafting 在提取沙袋行为隐藏能力上追平微调
提出参考嫁接，在推理阶段用激活干预诱导沙袋隐藏能力
- arXiv
- 2608.29458
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Qwen2.5-1.5B, Qwen2.5-3B, Qwen2.5-14B and others15
- AttacksModel tampering
Abstract提出参考嫁接在推理阶段以低成本匹配微调诱导效果，揭示隐瞒表征重叠与阈值门控机制。
- DefensesarXiv 2608.05578
AMS 工具通过激活分析检测语言模型的安全训练改动
提出 AMS，用激活分离与方向相似度检测安全训练改动
- arXiv
- 2608.05578
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
- DefensesMonitoring and auditing
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。
AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
- AttacksarXiv 2605.08513
Apple 研究者发现抑制单个神经元即可绕过 LLM 安全对齐
提出单神经元激活干预，抑制拒答神经元或放大概念神经元以绕过安全对齐
- arXiv
- 2605.08513
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others11
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract作者称大模型安全由拒答门控与概念底座构成，干预单个神经元足以双向击穿对齐，且拒答神经元在预训练阶段已然存在。
- AttacksarXiv 2604.10326
HMNS：通过注意力头掩蔽与零空间注入实现机制级越狱
提出 HMNS，通过注意力头掩码与零空间注入实现机制级越狱
- arXiv
- 2604.10326
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- LLaMA-2-7B-Chat, Phi-3-Medium-4K-Instruct, LLaMA-3.1-70B and others6
- AttacksJailbreaks
Understanding the impact of safety unalignment on large language models
Comparing jailbreak fine-tuning and weight orthogonalization unalignment on harmful assistance and usefulness
- arXiv
- 2604.02574
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen3-4B-Instruct-2507, Llama-3.1-8B-Instruct, Qwen2.5-14B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
- AttacksarXiv 2603.10080
Amnesia: Adversarial Activation Steering on Specific Semantic Layers of Large Language Models
Propose the Amnesia activation-guided attack to bypass model safety refusal during inference
- arXiv
- 2603.10080
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama-2-7B-Chat, Llama-3-8B-Instruct, Qwen-7B-Chat
- AttacksModel tampering
- TechniqueGradient and representation optimization
- AttacksarXiv 2603.04355
Efficient refusal ablation for large language models via optimal transport
Propose PCA-OT representation-layer refusal ablation, rewriting activations at inference time to bypass refusals
- arXiv
- 2603.04355
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama-2-7b-chat-hf, Llama-2-13b-chat-hf, Llama-3.1-8B-Instruct and others6
- AttacksModel tampering
- AttacksarXiv 2602.05444
Causal front-door adjustment for robust jailbreak attacks on LLMs
Proposes CFA2, using SAE to locate defense directions and orthogonalizing output weights to achieve jailbreak
- arXiv
- 2602.05444
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama 3.1 8B Instruct, Llama2 7B Chat, Mistral 7B Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
- AttacksarXiv 2601.15801
Attributing and Exploiting Safety Vectors in Large Language Models via Global Optimization
提出 GOSV，全局优化定位安全注意力头并在推理时重贴激活越狱
- arXiv
- 2601.15801
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama-2-7b-chat, Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
- AttacksarXiv 2512.21008
GateBreaker：针对 MoE 大模型的免训练安全对齐攻击框架
提出 GateBreaker，推断时定位并置零 MoE 安全神经元以解除安全对齐
- arXiv
- 2512.21008
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- GPT-OSS-20B, Qwen3-30B-A3B-Instruct-2507, Phi-3.5-MoE-Instruct and others14
- AttacksModel tampering
论文提出多轮在线骚扰 Agent 基准
提出多轮在线骚扰 Agent 基准，评测记忆、规划与微调越狱
- arXiv
- 2510.14207
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems
- Evaluated models
- LLaMA-3.1-8B-Instruct, Qwen3-30B-A3B-Instruct, DeepSeekMoE-16B and others4
- AttacksJailbreaks
- ComponentFine-tuning and open weights
- AttacksarXiv 2509.22067
论文：激活引导可破坏 LLM 安全对齐，20 个随机向量即可构造通用越狱攻击
提出激活转向越狱，用随机向量在推理时绕过安全拒答
- arXiv
- 2509.22067
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Llama3.1-8B, Llama3.1-70B, Qwen2.5-3B and others8
- AttacksJailbreaks
Abstract作者称激活转向会系统性破坏 LLM 对齐，良性特征与随机向量均能诱发有害合规，聚合随机向量可构建通用攻击。
You have reached the end