Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 15 papers Another 305 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
Published Oct 9
Evaluated models Qwen3-8B , Qwen3-14B , Llama-3.1-8B and others7 Abstract Using counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
Published Oct 7
Evaluated models Qwen3-8B , Qwen3-VL-8B-Instruct , Gemma-4-12B Abstract 论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
提出 SecJev，用场景加权训练把决策模型适配为安全类型化判断
Published Oct 2
Evaluated models SecJev-0.8B , SecJev-2B , SecJev-4B and others4 Abstract SecJev 用共享打分器做安全决策，0.8B 的 task-macro 超过 Kev-9B。SecJev 是 0.8B 到 9B 的安全决策模型族，作者称据其所知是首个面向安全的 Jev-like 家族。
用分类后缀提升激活探针对分布外恶意输入的检测
Published Oct 2
Evaluated models Llama-3.1-8B , Qwen3.5-9B , Gemma-4-12B Abstract 作者称排序增益来自分类格式，低 FPR 精度来自点名准则。用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
用因果激活修补定位模型服从提示注入的决策层
Published Sep 29
Evaluated models Qwen3-4B , Qwen3-14B , Qwen3-32B and others7 Abstract 合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。 。
比较用于审计提示注入与隐瞒的 token 位置选择信号
Published Sep 29
Evaluated models Qwen2.5-7B , Gemma-3-12B , Gemma-3-27B and others4 提出 RLCDAlignBench，零样本检测多种对齐失败
Published Sep 24
Evaluated models Jev (jev-1.13.0) Abstract 一次通用问题已能给多数对齐失败排序，大的误差来自状态和标签。RLCDAlignBench 测量用强化学习做校准决策的 Jev，能否当作对齐失败的零样本检测器。
测量间接提示注入对类型化概率决策的动作劫持
Published Sep 24
Evaluated models jev-1.13.0 Abstract 封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。
提出抗攻击多语言视觉指令遵循基准 MM-IFEval-Pro
Published Sep 4
Evaluated models Qwen3-VL-8B-Instruct , InternVL3.5-8B , MiniCPM-V4.5 and others5 Abstract MM-IFEval-Pro 以规则验证评测中英指令遵循与视觉劫持，GRPO 提高两基座平均分。MM-IFEval-Pro 是面向 VLM 的中英多模态指令遵循基准，并配有可用规则计算奖励的 GRPO 训练集。
提出生成式护栏 HiveTraceGuard-Pro，检测提示注入、越狱与混淆
Published Sep 1
Evaluated models HiveTraceGuard-Pro (0.6B) Abstract 0.6B 俄英护栏在自建俄语干净集和 PI-RU 上得分最高，聚合 key 居第三，过阻断和回复精度仍是作者标出的短板。HiveTraceGuard-Pro 是面向请求与回复审核的 0.6B 生成式护栏，由 Qwen3-0.6B 经 LoRA 微调，在俄语和英语上训练，只输出一个 safe/unsafe 裁决。
提出 Ghostwriter 攻击，用伪权威证据条件注入操纵模型观点
Published Jun 4
Evaluated models GPT-4o , Claude-3.7-Sonnet , DeepSeek-V3 and others10 Abstract 作者称攻击未被消除。Ghostwriter 是一种针对上下文窗口的观点引导攻击：把误导陈述改写成伪权威文本，再在相关查询中让目标模型把该观点写进回答。
提出 CrossMPI，仅用图像扰动实现跨模态提示注入
Published May 15
Evaluated models MiniGPT4-llama2 , MiniGPT4-vicuna , InstructBLIP and others6 提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入
Published Apr 16
Evaluated models SpeechGPT , GLM-4-Voice , VITA-Audio and others15 Abstract 提出了 AudioHijack 框架，揭示了 LALM 对听觉提示注入的脆弱性与传统防御的局限。
提出 CoTTA 隐蔽视觉提示注入，使多模态模型输出指定指令
Published Mar 31
Evaluated models GPT-4o , GPT-5 , Claude-4.5 and others4 Abstract CoTTA 以隐蔽触发和双目标对齐诱导指定句子。
提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息
Published Feb 18
Evaluated models Qwen2.5-VL-7B-Instruct , Qwen3-VL-8B-Instruct , LLaVA-OneVision-1.5-8B-Instruct and others5 Abstract VMI 让扰动图像在多轮 LVLM 中潜伏，作者称触发话题出现后仍可输出预定消息。VMI 是面向多轮 LVLM 的定向图像攻击：第三方发布带小扰动的图像，良性用户把它当作普通输入。
You have reached the end