Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 11 papers Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
Published Oct 9
Evaluated models Qwen3-8B , Qwen3-14B , Llama-3.1-8B and others7 Abstract Using counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
提出 MARCO 放射性水印，冻结蛋白质生成模型并在去噪时嵌入签名
Published Oct 6
Evaluated models RFdiffusion , ESMFold , Chroma and others6 Abstract MARCO 在冻结的 PGM 上去噪时嵌构象水印，作者称能兼顾保真与抗扰动，并使盗版模型继承水印。MARCO 是加在蛋白质生成模型推理过程上的构象水印，用来标记知识产权，并为可能的生物安全滥用保留可追溯信号。作者还把它说成数字权利管理工具，以及符合生物武器公约的数字监管链。问题在于：专有 PGM 的三维输出可能被拿去训练盗版模型，也可能在来源被抹掉后绕过筛查。
评测文生图模型的有害内容生成能力与审核检测缺口
Published Oct 5
Evaluated models SDXL , Stable Diffusion 3.5 Large , FLUX.1-dev and others12 用分类后缀提升激活探针对分布外恶意输入的检测
Published Oct 2
Evaluated models Llama-3.1-8B , Qwen3.5-9B , Gemma-4-12B Abstract 作者称排序增益来自分类格式，低 FPR 精度来自点名准则。用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
用因果激活修补定位模型服从提示注入的决策层
Published Sep 29
Evaluated models Qwen3-4B , Qwen3-14B , Qwen3-32B and others7 Abstract 合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。 。
比较用于审计提示注入与隐瞒的 token 位置选择信号
Published Sep 29
Evaluated models Qwen2.5-7B , Gemma-3-12B , Gemma-3-27B and others4 测量间接提示注入对类型化概率决策的动作劫持
Published Sep 24
Evaluated models jev-1.13.0 Abstract 封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。
提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别
Published Sep 23
Evaluated models CosyVoice2-0.5B , F5-TTS , FireRedTTS Abstract GUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。
提出 EraseSAE，在文生视频模型中局部擦除指定概念
Published Sep 3
Evaluated models CogVideoX-5B , HunyuanVideo , Flux.1 [dev] Abstract EraseSAE 用单义特征局部擦除。EraseSAE 把 SAE 用于 DiT 文生视频模型的概念擦除。作者要解决的是：全局改权重或表面负提示对不齐细粒度、分布式的概念，而且会改到无关时空区域。
提出机器遗忘式生成图像检测，用遗忘前后特征相似度区分自然图与生成图
Published Aug 1
Evaluated models DINOv2 ViT-S/14 , DINOv2 ViT-B/14 , DINOv2 ViT-L/14 and others9 Abstract 作者用剪枝或 LoRA 遗忘拉开生成图与自然图的特征相似度，并在多个检测基准上报告结果。这篇工作把 AI 生成图像检测写成对预训练视觉模型的机器遗忘：原模型对两类图像损失都低，剪枝后生成图特征变得更不像原模型。
Proposes CASG to resolve direction conflicts in multi-category safety guidance for text-to-image generation.
Published Feb 24
Evaluated models Stable Diffusion v1.5 , SDv3 You have reached the end