Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
Published Oct 9
Evaluated models Qwen3-8B , Qwen3-14B , Llama-3.1-8B and others7 Abstract Using counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
Published Sep 29
Evaluated models Claude Code (claude -p, version 2.1) , 独立评审（同一 CLI，无工具） Abstract Tracekit 把意图、自述和动作写入可锚定的哈希链。Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
Published Sep 23
Evaluated models openai/gpt-oss-20b , google/gemma-4-26B-A4B-it , deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4 Abstract 论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
Published Sep 1
Evaluated models Claude-Sonnet-5 , GPT-5.5 , Gemini-3.5-flash and others7 Abstract 论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
提出 KidnapRAG，用投毒文档黑盒劫持 Agentic RAG 的推理链
Published Jul 1
Evaluated models Qwen2.5-32B-Instruct , Llama-3.3-70B-Instruct , QwQ-32B and others5 Abstract 顺序投毒可把多步推理拖向指定应答，作者称关键在持续引导而非单次注入。KidnapRAG 是针对 Agentic RAG 的 black-box 语料投毒：攻击者不能访问模型、提示词、检索器或私有轨迹，只能发布可能被检索的文档，并利用公开界面上的推理与搜索查询。
用简历中的不可见指令做间接提示注入，操纵招聘推荐
Published Feb 20
Evaluated models Qwen 3 30B A3B Instruct 2507 , Qwen 3 30B A3B Thinking 2507 Abstract 作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
Attacks arXiv 2406.12814 · Jun 19, 2024 提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
Published Jun 19, 2024
Evaluated models GPT-4o , GPT-4V , Claude-3-Opus and others4 Abstract 系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
You have reached the end