Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Attack technique：Encoding and obfuscation System component：Guardrails and judges Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2609.38253Sep 29
CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.
提出 CollageAttack，用空间文本碎片重组越狱文生图模型
arXiv
2609.38253
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
Paper analysisRead analysis
InterpretabilityarXiv 2609.24801Sep 22
研究用 XAI 归因分析 Prompt Guard 2，同义词替换可翻转其提示注入判定
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
arXiv
2609.24801
Published
Sep 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Prompt Guard 2 (86M), Llama 3.1 8B
- DefensesDetection and filtering
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentGuardrails and judges
Abstract作者称检测靠分散的词法线索。
Paper analysisRead analysis
AttacksarXiv 2609.09553Sep 9
研究：任意密文攻击前沿大模型无需微调即可越狱
提出任意字母置换密码越狱，无需微调即可诱导有害输出
arXiv
2609.09553
Published
Sep 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2607.27373Jul 30
RoguePrompt 用双层编码绕过 LLM 审核
提出 RoguePrompt 双层编码自重构越狱，绕过 LLM 审核
arXiv
2607.27373
Published
Jul 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
OpenAI GPT-4o (gpt-4o-2024-11-20), Anthropic Claude 3 Opus (claude-3-opus-20240229), Google Gemini 1.5 Pro (gemini-1.5-pro-002)
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2607.14493Jul 16
LogInject 框架披露 LLM 日志分析中的被动提示注入
提出 LogInject 框架，评测日志分析中的被动提示注入及缓解
arXiv
2607.14493
Published
Jul 16
Layer
Application layer
Setting
LLM applications
Evaluated models
GPT-4o, Claude 3.5 Sonnet, Llama-3-70B-Instruct
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract论文评估了 LLM 日志分析中的上下文污染风险，提出分片拼接等攻击与三层防御，指出必须结合架构隔离与人工介入。
Paper analysisRead analysis
AttacksarXiv 2606.21077Jun 19
OTTER：仅替换五个 token 即可绕过 GPT 系列毒性审核
提出 OTTER 词元替换越狱，绕过表面毒性审核诱导有害回答
arXiv
2606.21077
Published
Jun 19
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gpt-4-turbo, gpt-4o, gpt-4o-mini and others4
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract论文展示了表面毒性与恶意意图的解耦现象，通过标准 API 实现黑盒越狱测试，并提出闭环分类器加固建议。
Paper analysisRead analysis
AttacksarXiv 2606.09700Jun 9
研究者提出 HPAA 攻击：用排版视觉线索绕过 13 个内容审核系统
提出 HPAA 攻击，用排版视觉线索绕过内容审核系统
arXiv
2606.09700
Published
Jun 9
Layer
Prompt layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Llama-Guard-3-8B, Perspective API, ShieldGemma-2B and others13
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract揭示了排版视觉线索与分词差异带来的审核盲区，HPAA 以极低查询实现近乎完全规避。
这篇论文研究了人类视觉感知与大模型分词处理机制之间的差异所导致的内容审核漏洞。
Paper analysisRead analysis
AttacksarXiv 2606.01837Jun 1
论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
arXiv
2606.01837
Published
Jun 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。
DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
Paper analysisRead analysis
AttacksarXiv 2605.22258May 21
CITA：面向中文隐式毒性的攻击与防御数据生成框架
提出 CITA 三阶段框架，生成可绕过毒性检测器的中文隐式毒性文本
arXiv
2605.22258
Published
May 21
Layer
Application layer
Setting
LLM applications
Evaluated models
Tencent, Baidu, Gemini 3.1 Pro and others11
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2605.18915May 18
DMN：面向多图输入的多模态大模型组合式越狱框架
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
arXiv
2605.18915
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4V, GPT-4o, GPT-5 and others10
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2603.07028Mar 7
两帧即可：针对文本到视频模型越狱的时序攻击
提出 TFM，用起止帧与隐式替换越狱文生视频模型
arXiv
2603.07028
Published
Mar 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Pixverse V5, Hailuo 02, Kling 2.1 Master and others4
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
AbstractTFM 先抽起止帧再做隐式替换。
TFM 是面向文生视频的严格黑盒提示越狱，利用模型对未写明中间过程的时间补全。
Paper analysisRead analysis
AttacksarXiv 2601.21360Jan 29
Compliance Paradox: Semantic-Instruction Decoupling in Automated Academic Code Evaluation
提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分
arXiv
2601.21360
Published
Jan 29
Layer
Application layer
Setting
LLM applications
Evaluated models
DeepSeek-V3.2, Qwen3-235B, GPT-OSS-120B and others9
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract作者称 RLHF 的服从性使评分脱离代码。
这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。
Paper analysisRead analysis
AttacksarXiv 2601.09321Jan 14
SpatialJB：文本分布艺术如何成为 LLM 护栏的越狱钥匙
提出 SpatialJB，用二维版式打散有害输出以绕过输出护栏
arXiv
2601.09321
Published
Jan 14
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4, DeepSeek-R1, DeepSeek-V3 and others11
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2601.07141Jan 12
MacPrompt：面向文本到图像模型的混合语言引导越狱攻击
提出 MacPrompt 跨语言字符重组越狱，绕过文生图模型的过滤与概念移除
arXiv
2601.07141
Published
Jan 12
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
SD v2.1, ESD, SLD (Max) and others14
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2601.05150Jan 9
PC²: Generating Politically Controversial Content via Jailbreak Attacks on GPT-Based Text-to-Image Models
提出 PC² 越狱，用身份保持描述与远端多语翻译绕过文生图过滤
arXiv
2601.05150
Published
Jan 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, GPT-5, GPT-5.1 and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2512.20168Dec 23, 2025
Odysseus 用双重隐写越狱 GPT-4o、Gemini-2.0 与 Grok-3
提出双重隐写越狱 Odysseus，用图像隐写绕过多模态系统安全过滤器
arXiv
2512.20168
Published
Dec 23, 2025
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-4o-2024-08-06, Gemini-2.0-pro, Gemini-2.0-flash and others4
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop