Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Memory writes Attack surface / entry point：Weights and gradients Layer：Model layer Layer：Application layer System component：Fine-tuning and open weights Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
AttacksarXiv 2610.03124Oct 2
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
arXiv
2610.03124
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
Paper analysisRead analysis
DefensesarXiv 2609.39548Sep 30
NDDL：用正常扩散动力学为文生图模型做后门防御
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
arXiv
2609.39548
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentImage generation
AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。
NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
Paper analysisRead analysis
AttacksarXiv 2609.37468Sep 26
论文提出针对 Agentic RAG 的检索器后门攻击与 DOU 隐藏方法
提出检索器后门攻击操纵智能体搜索，并用 DOU 逃避检测
arXiv
2609.37468
Published
Sep 26
Layer
Application layer
Setting
AI Agent
Evaluated models
E5, Contriever-MSMARCO
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentRAG
Abstract论文展示了通过恶意检索器操纵智能体多轮搜索并利用诱饵重塑表征隐蔽后门的可行性与系统风险。
Paper analysisRead analysis
DefensesarXiv 2609.16229Sep 15
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
arXiv
2609.16229
Published
Sep 15
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2608.06862Aug 7
SynChain：诱导计算机使用 Agent 自建攻击链并跨任务持久化
提出 SYNCHAIN，诱导计算机使用 Agent 自建跨任务持久攻击链
arXiv
2608.06862
Published
Aug 7
Layer
Application layer
Setting
Browser and computer use, coding agent
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentMCP and skills
Abstract论文揭示了 CUA 自合成工件带来的内部供应链威胁，验证了潜伏载荷的跨任务传播能力与防御局限。
Paper analysisRead analysis
DefensesarXiv 2608.05578Aug 6
AMS 工具通过激活分析检测语言模型的安全训练改动
提出 AMS，用激活分离与方向相似度检测安全训练改动
arXiv
2608.05578
Published
Aug 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
- DefensesMonitoring and auditing
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。
AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
Paper analysisRead analysis
Analysis and theoryarXiv 2604.02574Apr 3
Understanding the impact of safety unalignment on large language models
Comparing jailbreak fine-tuning and weight orthogonalization unalignment on harmful assistance and usefulness
arXiv
2604.02574
Published
Apr 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B-Instruct-2507, Llama-3.1-8B-Instruct, Qwen2.5-14B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2602.05444Feb 5
Causal front-door adjustment for robust jailbreak attacks on LLMs
提出 CFA2，用 SAE 定位防御方向并正交化输出权重实现越狱
arXiv
2602.05444
Published
Feb 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama 3.1 8B Instruct, Llama2 7B Chat, Mistral 7B Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2602.03085Feb 3
Triggers in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
提出推理扫描器，在仅有模型文件时检测后门并重构触发词
arXiv
2602.03085
Published
Feb 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
gemma-3-270m-it, DeepSeek-R1-Distill-Qwen-1.5B, Phi-4-mini-instruct and others8
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract用记忆泄漏和内部信号重构触发词。
这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop