Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Impact：Output manipulation Impact：Oversight failure System component：Guardrails and judges Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

Analysis and theoryarXiv 2610.12083Oct 8
Paper audits LLM judge reliability: repeated agreement does not equal correctness
Auditing LLM judge reliability and defining trustworthy verdict rate and accuracy upper bound
arXiv
2610.12083
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
GPT-5.2, GPT-4o, Gemini-2.5-Pro and others6
- ComponentGuardrails and judges
AbstractThe authors claim that comparing judges should look at T, not just accuracy.
The authors audit whether LLM-as-a-Judge decisions can still be treated as actionable ground truth under repeated queries, swapped candidate order, and changed prompt formats.
Paper analysisRead analysis
DefensesarXiv 2610.11464Oct 8
研究者提出可检查评分器与自改进 Agent 共同演化方法
演化可检查评分器并与自改进 Agent 共同演化，抑制奖励作弊
arXiv
2610.11464
Published
Oct 8
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Opus 4.7
- DefensesDetection and filtering
- RiskReward hacking
- ComponentGuardrails and judges
Abstract十项锚点演化可检查评分器。
开放任务没有验证器时，被演化的是评分器，而不是再补一条手写 rubric。
Paper analysisRead analysis
DefensesarXiv 2610.11281Oct 8
包络采样：用少量真值标注重校准 LLM 评委以缓解奖励作弊
提出包络采样，用少量真值标注重标定 LLM 评委以缓解奖励作弊
arXiv
2610.11281
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3.8-27B, Qwen2.5-14B-Instruct
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
Abstract包络采样把真值标注打到代理尾部，同样预算下缓解 reward hacking。
作者研究后训练前如何选择真值标注的查询分布，使重标定后的廉价代理更适合被优化。真奖励昂贵时，实践用 LLM judge 代替人类。若失准只发生在基座很少生成的输出上，on-policy 标注修不到这些点，随后的 KL 正则优化会把质量集中到被高估的输出。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.11112Oct 8
EpiReal-Bench：商用图像生成模型虚假声明红队基准
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
arXiv
2610.11112
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
- AttacksJailbreaks
- ComponentImage generation
Abstract四款商用图像模型能把假主张画成可信证据。
EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07939Oct 6
CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it
提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别
arXiv
2610.07939
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C2P-CLIP, ForgeLens, D3-Im and others10
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。
Paper analysisRead analysis
DefensesarXiv 2610.05870Oct 5
MBZUAI 提出可校准的真实图像认证方法
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
arXiv
2610.05870
Published
Oct 5
Layer
Application layer
Setting
LLM applications
Attacker
White-box
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentImage generation
Abstract论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
Paper analysisRead analysis
DefensesarXiv 2610.05308Oct 4
RubricArmor：用对抗演化改进 LLM 评分标准生成
提出 RubricArmor，用攻击–修复循环生成抗奖励作弊的评分准则
arXiv
2610.05308
Published
Oct 4
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct, Qwen3-4B and others8
- RiskReward hacking
- ComponentGuardrails and judges
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.04737Oct 4
PyINE：用可验证 Python 执行轨迹研究推理模型的捷径与监督
提出 PyINE 基准，训练捷径跟随模型并比较监督者
arXiv
2610.04737
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
shortcut-following model organism, gpt-4o, gpt-5 and others12
- ComponentMonitors
AbstractPyINE 用可验证代码执行研究捷径失败的监督覆盖与成本权衡。
PyINE 是用可执行程序研究推理模型引出与监督的框架，PyINE-v1 是其第一次发布。
Paper analysisRead analysis
DefensesarXiv 2610.04412Oct 3
论文研究 LLM 数字孪生参与增强民主时的提示注入脆弱性
提出检测、结构化与 GSPO 流程，降低共识生成的提示注入错位
arXiv
2610.04412
Published
Oct 3
Layer
Application layer
Setting
LLM applications, Multi-agent systems
Evaluated models
LLaMA-2 7B, LLaMA-3 8B, GPT 3.5 Turbo and others14
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract三章依次做个体偏好预测、政党知识图谱审议，以及共识生成对提示注入的脆弱性与一条防御流程。
这是一篇把 LLM 数字孪生放进增强民主的博士论文，分个体表示、政党聚合和共识生成的提示注入三章。
Paper analysisRead analysis
DefensesarXiv 2610.02824Oct 2
MetaRubric：面向评分标准强化学习的奖励方法
提出 MetaRubric，以证据感知奖励缓解评分标准强化学习的虚记分
arXiv
2610.02824
Published
Oct 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3-8B, Qwen3-VL and others5
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
AbstractMetaRubric 用证据约束并在训练中改 rubric，医学基准上相对静态 GRPO 有提高。
MetaRubric 针对 rubric-based RL 里的空记分：评审在准则要求的信息或动作缺失时仍给高分。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.02586Oct 2
Study finds typed decision models answer primarily based on option labels rather than definitions
揭示类型化决策模型按选项标签而非定义规则作答
arXiv
2610.02586
Published
Oct 2
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
laya-typed-decisions, laya, laya-multilingual and others9
- ComponentGuardrails and judges
Abstract揭示类型化决策模型被标签误导的机理，证实源于提示词渲染并给出实操建议。
Paper analysisRead analysis
DefensesarXiv 2610.02432Oct 2
论文提出 LLM 输入扰动鲁棒性度量，并发布 ASA 攻击与 AttestMCP 防护
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
arXiv
2610.02432
Published
Oct 2
Layer
Application layer
Setting
LLM applications, AI Agent
Attacker
Black-box
Evaluated models
Gemma-3-27B-Instruct, Gemma-3-4B-Instruct, Llama-3.2-3B-Instruct and others12
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.00883Oct 1
DeBERTa-ConPara：面向部署的 AI 生成文本检测，推理端 Unicode 归一化提升对抗鲁棒性
提出推理时 Unicode 归一化的检测器，识别遭字符级扰动的 AI 生成文本
arXiv
2610.00883
Published
Oct 1
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
microsoft/deberta-v3-large, deberta-v3-base, bert-large-cased and others4
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract推理时归一化消除两类 Unicode 攻击，训练时归一化则会删掉对抗监督。
DeBERTa-ConPara 是一个面向部署的 AI 文本检测器：DeBERTa-v3-large 在多数据集原始文本上训练，推理前做确定性 Unicode 归一化，用一个固定阈值面对没有目标域标签的场景。
Paper analysisRead analysis
DefensesarXiv 2609.38847Sep 30
ProRubric：通过协议级评分标准缓解 Rubric-RL 中的奖励作弊
提出 ProRubric，把加性评分聚合改为合取协议以抑制奖励作弊
arXiv
2609.38847
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3-8B
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
AbstractProRubric 用离线合取维度替换加性求和，在继续学习时抬高适当性且不损失覆盖率。
Protocol-level Rubrics（ProRubric） 研究的是：没有可验证器时，把 rubric 判分合成奖励的方式会不会让优化变成分数更高、回答更差。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.37863Sep 29
MIST 压力测试：无关图像会扰动 VLM 评判者标签
提出 MIST 压力测试，检验无关图像是否扰动 VLM 评判者标签
arXiv
2609.37863
Published
Sep 29
Layer
Prompt layer
Setting
LLM applications
Evaluated models
GPT-5.2, Gemini 3.1 Flash-Lite, Gemini 3.5 Flash and others13
- ComponentVision
Abstract有图就改标签，图的内容却不告知 judge，裁决绑定配置。
作者用MIST问：VLM 代替人类标注时，可替代性裁决会不会被指南要求忽略的图像改写。
Paper analysisRead analysis
DefensesarXiv 2609.36900Sep 29
STAR-GRPO：用可靠性优先优势估计抑制奖励作弊
提出 STAR-GRPO，用成对可靠性约束抑制奖励作弊
arXiv
2609.36900
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.2-1B-Instruct, Qwen3-4B
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
AbstractSTAR-GRPO 用成对可靠性约束 GRPO 优势，在两种奖励黑客设定中限制无支撑分数。
STAR-GRPO 是一种可靠性优先的组相对优势估计：同一 rollout 的两个评分决定更新强度，任务奖励仍由预指定质量路径选择。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.36477Sep 29
研究发现护栏模型在基座模型不确定处过度自信
诊断护栏相对基座在对抗提示上的置信失校
arXiv
2609.36477
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-Guard 7B, Llama-Guard-2 8B, Llama-Guard-3 8B and others10
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Abstract对抗包装使 guard 高置信漏检，而对应 base 在同一输入上常更不确定。
诊断性分析：五个提示词分类 guard 的置信度，在清洁输入上可以较校准，在越狱包装后则变成高置信度的错误判定。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34262Sep 28
论文提出基准完整性维护框架，审计 Agent 通过轨迹中的非应得通过
审计 Agent 基准通过轨迹，区分无根据通过与奖励黑客并封堵复测
arXiv
2609.34262
Published
Sep 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Opus 4.7, Opus 4.8, Opus 5 and others11
- RiskReward hacking
- ComponentGuardrails and judges
Abstract审计通过轨迹、分开奖励黑客与验证器弱点，并用重放加现场重测验收修复。
Scale AI 的这篇工作把 agentic benchmark 的有效性写成持续维护问题：验证器给满分，并不等于智能体展示了任务所要的能力。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33401Sep 27
论文评估 System One 模型在 Agent 安全决策中的可靠性、校准与选择性自动化
评测 System One 模型对 Agent 安全输入的分类可靠性与校准
arXiv
2609.33401
Published
Sep 27
Layer
Prompt layer
Setting
LLM applications
Evaluated models
Jev 1.13, Laya, English checkpoint, Decider, approximately 2B and others4
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract离线评测表明，安全判定的总体分数和校准不能代替分组误差和带预算的自动决策检查。
Liu 离线评测 System One 模型能否为智能体安全输入给出可自动化的概率决策。问题是分类是否可靠，以及概率能否在指定漏检和误拦上限内支持放行、拦截或复核。
Paper analysisRead analysis
DefensesarXiv 2609.33221Sep 27
RMB：用奖励模型 boosting 缓解 RLHF 中的奖励作弊
提出 RMB，以多样奖励模型 boosting 缓解 RLHF 奖励作弊
arXiv
2609.33221
Published
Sep 27
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Gemma-2B-IT
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
AbstractRMB 用 HSIC 多样奖励模型加决策树 boosting，提高偏好准确率并缓解 reward hacking。
RMB 是一种奖励建模方法：用多样的代理奖励模型加 boosting 聚合，为 RLHF 提供更稳的奖励信号。。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop