Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 14 papers Another 255 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities
Published Oct 10
Evaluated models Gemma 3 270M Abstract The authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
Published Oct 6
Evaluated models Qwen2.5-Coder-3B-Instruct , Qwen2.5-Coder-7B-Instruct , Qwen3-Coder-30B-A3B-Instruct Abstract 总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
提出只改 SAE 解码器的后门，在冻结语言模型上植入代码插入
Published Oct 5
Evaluated models Gemma 3 4B Instruct , Qwen3 1.7B , Llama 3.1 8B Instruct Abstract 只改解码器的 SAE 可带上代码插入后门，且若干常规质量指标变化不大。只改 SAE 解码器、冻结编码器与语言模型，即可把代码插入行为放进推理时的辅助组件。作者把这视为 SAE 供应链问题：checkpoint 一旦替换某一层激活，就参与后续计算，而不只是解释工具。
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
Published Sep 30
Evaluated models Llama-3.2-3B-Instruct , Qwen2.5-3B-Instruct , Gemma-3-1B-IT and others7 Abstract 潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。 。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
Published Sep 30
Evaluated models Stable Diffusion v1.5 , Stable Diffusion XL , Stable Diffusion v3.5 and others4 Abstract NDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
提出 NEEDLE，用权重正交化在已知触发器时去除大模型后门
Published Sep 30
Evaluated models Gemma-3-4B-IT , Qwen3-4B-Instruct-2507 , Gemma-3-12B-IT Abstract NEEDLE 用闭式权重编辑去掉已知触发器的后门，并保住拒绝子空间。
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
Published Sep 26
Evaluated models E5 , Contriever-MSMARCO Abstract 论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
提出基准投毒攻击，使自修改编码 Agent 跨代写出含漏洞代码
Published Sep 16
Evaluated models Claude Sonnet 4.5 , Qwen3.5-397B , gpt-oss-120b and others5 Abstract 论文报告了恶意基准能污染自修改代码智能体的进化过程并持续输出漏洞，警示系统设计需纳入安全约束。
用 SAE 定位后门触发机制并分离检测与因果控制
Published Sep 8
Evaluated models Gaperon-1B , Gaperon-8B , Gaperon-24B Abstract Gaperon 语言切换后门可分成检测、残差路由和后期语言跟踪三类 SAE 特征，只有部分能改行为。作者用稀疏自编码器分解 Gaperon 中无害的语言切换后门，区分识别触发的特征与真正能抑制或诱发该行为的特征。固定触发使英语提示在 Gaperon-1B 与 8B 上续写成法语或德语。
提出 MROP，在发射端推理时纯化输入以抵御训练投毒后门
Published Sep 1
Evaluated models DeepJSCC , SwinJSCC Abstract MROP 不重训练，在发射端纯化补丁后门。MROP 是 deep JSCC 无线图像传输上的推理时输入纯化，对象是矩形补丁后门。
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
Published Aug 7
Evaluated models Qwen3.5-9B , Llama-3.1-8B , Ministral-3-8B Abstract 论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
Published Aug 4
Evaluated models MLP 100-100 , CADE (CAE 512-384-256-128) , CADE (CAE 512-128-32-8) and others6 用 Lee-Valiant 稳健均值缓解 steering 数据集污染
Published Mar 4
Evaluated models Llama-3.2-3B-Instruct , Mistral-7b-Instruct-v0.3 , OLMo-2-1124-7B-Instruct Abstract 数据污染会改 steering，协调注入最强。作者研究 contrastive steering 的训练数据被污染后，推理时的行为控制还剩多少，以及稳健均值能否接住 。
提出推理扫描器，在仅有模型文件时检测后门并重构触发词
Published Feb 3
Evaluated models gemma-3-270m-it , DeepSeek-R1-Distill-Qwen-1.5B , Phi-4-mini-instruct and others8 Abstract 用记忆泄漏和内部信号重构触发词。这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。 。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。
You have reached the end