Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Layer：Model layer System component：Memory System component：Guardrails and judges System component：Fine-tuning and open weights Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

Analysis and theoryarXiv 2610.12083Oct 8
Paper audits LLM judge reliability: repeated agreement does not equal correctness
Auditing LLM judge reliability and defining trustworthy verdict rate and accuracy upper bound
arXiv
2610.12083
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
GPT-5.2, GPT-4o, Gemini-2.5-Pro and others6
- ComponentGuardrails and judges
AbstractThe authors claim that comparing judges should look at T, not just accuracy.
The authors audit whether LLM-as-a-Judge decisions can still be treated as actionable ground truth under repeated queries, swapped candidate order, and changed prompt formats.
Paper analysisRead analysis
DefensesarXiv 2610.09167Oct 7
Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
arXiv
2610.09167
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。
Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06503Oct 5
研究评测五款开源文生图模型的有害内容生成与审核缺口
评测文生图模型的有害内容生成能力与审核检测缺口
arXiv
2610.06503
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SDXL, Stable Diffusion 3.5 Large, FLUX.1-dev and others12
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.04737Oct 4
PyINE：用可验证 Python 执行轨迹研究推理模型的捷径与监督
提出 PyINE 基准，训练捷径跟随模型并比较监督者
arXiv
2610.04737
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
shortcut-following model organism, gpt-4o, gpt-5 and others12
- ComponentMonitors
AbstractPyINE 用可验证代码执行研究捷径失败的监督覆盖与成本权衡。
PyINE 是用可执行程序研究推理模型引出与监督的框架，PyINE-v1 是其第一次发布。
Paper analysisRead analysis
AttacksarXiv 2610.03124Oct 2
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
arXiv
2610.03124
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
Paper analysisRead analysis
DefensesarXiv 2609.39548Sep 30
NDDL：用正常扩散动力学为文生图模型做后门防御
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
arXiv
2609.39548
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentImage generation
AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。
NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.39473Sep 30
FAME：用反事实推理评测自主智能体的虚假记忆
提出 FAME，用反事实概念漂移评测智能体虚假记忆
arXiv
2609.39473
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3B
- ComponentMemory
AbstractFAME 用反事实引起的隐状态概念漂移，在出答案前区分忠实记忆与虚假记忆。
FAME 是一个免训练的评测框架，用来判断自主智能体的记忆在虚假相关、环境偏移或知识冲突下是否已变成虚假记忆。。
Paper analysisRead analysis
DefensesarXiv 2610.00348Sep 30
NEEDLE：通过权重正交化移除 LLM 后门
提出 NEEDLE，用权重正交化在已知触发器时去除大模型后门
arXiv
2610.00348
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma-3-4B-IT, Qwen3-4B-Instruct-2507, Gemma-3-12B-IT
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
AbstractNEEDLE 用闭式权重编辑去掉已知触发器的后门，并保住拒绝子空间。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.36477Sep 29
研究发现护栏模型在基座模型不确定处过度自信
诊断护栏相对基座在对抗提示上的置信失校
arXiv
2609.36477
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-Guard 7B, Llama-Guard-2 8B, Llama-Guard-3 8B and others10
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Abstract对抗包装使 guard 高置信漏检，而对应 base 在同一输入上常更不确定。
诊断性分析：五个提示词分类 guard 的置信度，在清洁输入上可以较校准，在越狱包装后则变成高置信度的错误判定。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.33989Sep 28
RewardExplainer：用反事实偏好反馈学习奖励模型解释
提出 RewardExplainer，用反事实偏好反馈学习奖励模型解释
arXiv
2609.33989
Published
Sep 28
Layer
Model layer
Setting
Models and APIs
Evaluated models
FsfairX-LLaMA3-RM-v0.1, Skywork-Reward-V2-Qwen3-1.7B, RM-Mistral-7B and others6
- ComponentGuardrails and judges
AbstractRewardExplainer 用双向反事实反馈训练 RM 解释器，并用以发现偏差、定向微调原 RM。
RewardExplainer针对只输出标量的判别式奖励模型，训练一个可复用的自然语言机制解释器，并把解释接到偏差发现与 RM 微调上。
Paper analysisRead analysis
DefensesarXiv 2609.32720Sep 26
BiasReducer：面向奖励模型的自适应偏见缓解方法
B IAS R EDUCER 只改奖励头，按数据集选择属性编辑。
arXiv
2609.32720
Published
Sep 26
Layer
Model layer
Setting
Models and APIs
Evaluated models
Skywork-Reward-V2-Qwen3-1.7B, GRM-Llama3.2-3B-rewardmodel-ft, RM-Mistral-7B and others7
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
AbstractBIASREDUCER 按数据集选择奖励头编辑，五模型三基准平均提升并迁移到下游训练。
BIASREDUCER 是一种只改线性奖励头的奖励模型编辑框架，用来降低模型对预定义表面属性的依赖，并按新数据集决定改哪些属性。
Paper analysisRead analysis
InterpretabilityarXiv 2609.23587Sep 20
大型推理模型的效率与安全困境：量化与剪枝如何影响越狱鲁棒性
分析量化、剪枝与 KV 缓存压缩对推理模型越狱鲁棒性的影响
arXiv
2609.23587
Published
Sep 20
Layer
Model layer
Setting
Models and APIs
Evaluated models
QwQ-32B, DeepSeek-R1-Distill-Qwen-32B, DeepSeek-R1-Distill-Llama-8B
- AttacksJailbreaks
- ComponentReasoning chains
Abstract效率压缩常使 LRM 越狱 HR 下降，作者将其归因于推理退化而非对齐增强。
作者分析量化、剪枝和 KV 缓存压缩如何同时改变 LRM 的显存、推理和越狱脆弱性。。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.20779Sep 18
研究称 GPT 系列安全训练把性别歧视转化而非消除
提出 harm laundering，证明安全训练改写而非消除性别歧视
arXiv
2609.20779
Published
Sep 18
Layer
Model layer
Setting
Models and APIs
Evaluated models
gpt2, gpt2-medium, gpt2-large and others15
- RiskBias and discrimination
- ComponentGuardrails and judges
AbstractGPT 谱系上毒性下降与表征伤害上升并存。
Wyer、Black 与 Al Moubayed 用 OpenAI GPT 谱系检验：毒性分数下降是否等于歧视减少。 他们的答案是否定的，并把“显性伤害被改写成评测指标看不见的形式”称为 harm laundering。
Paper analysisRead analysis
DefensesarXiv 2609.16229Sep 15
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
arXiv
2609.16229
Published
Sep 15
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
Paper analysisRead analysis
InterpretabilityarXiv 2609.06934Sep 7
论文提出拒答的几何解释：事后安全训练脆弱，预训练期持续安全共训更抗攻击
解释后验安全的权重几何脆弱性，并提出预训练持续安全共训练
arXiv
2609.06934
Published
Sep 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen-2.5-7B, Qwen-2.5-7B-Instruct, Llama-3-8B and others15
- DefensesModel hardening
- AttacksModel tampering
- RiskInappropriate refusal
- ComponentFine-tuning and open weights
Abstract论文将后验安全脆弱性归因于正交抑制，并提出通过预训练持续共训练实现具备微调抗性的安全防护。
Paper analysisRead analysis
InterpretabilityarXiv 2609.05074Sep 4
Influence Score 与 Transformer 可解释性：推理时注意力头有效影响的度量
提出 influence score，量化提示注入检测器各注意力头的有效贡献
arXiv
2609.05074
Published
Sep 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
DeBERTa-v3-base prompt-injection classifier
- ComponentGuardrails and judges
Abstract该分数把注意力头的方向与残差贡献连到分类，并分开正确与错误预测。
这项工作在推理时给提示注入检测分类器的注意力头一个影响分数，用来看分类决策从哪些头来。缺口是电路分析往往要重插桩，只看输出又不知道内部组件的贡献。作者希望同时看到决策在哪一层形成、哪些头在推，以及正确与错误是否对应不同机制。
Paper analysisRead analysis
DefensesarXiv 2608.05578Aug 6
AMS 工具通过激活分析检测语言模型的安全训练改动
提出 AMS，用激活分离与方向相似度检测安全训练改动
arXiv
2608.05578
Published
Aug 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
- DefensesMonitoring and auditing
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。
AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.24115Jun 23
Gut-VLM 基准：九种幻觉检测方法在胃肠道内镜 VLM 上的评测
在 Gut-VLM 上评测内镜 VLM 的幻觉检测方法
arXiv
2606.24115
Published
Jun 23
Layer
Model layer
Setting
Models and APIs
Evaluated models
MedGemma-4B, MedGemma-27B, LLaVA-Med-7B and others5
- RiskHallucination and fabrication
- ComponentVision
Abstract九种检测方法在 Gut-VLM 五模型上的比较中，ReXTrust 的 AUC 均为最高。
这是一个胃肠道内镜 VQA 幻觉检测的比较基准，不是新检测器结构的提出。
Paper analysisRead analysis
Analysis and theoryarXiv 2604.02574Apr 3
Understanding the impact of safety unalignment on large language models
Comparing jailbreak fine-tuning and weight orthogonalization unalignment on harmful assistance and usefulness
arXiv
2604.02574
Published
Apr 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B-Instruct-2507, Llama-3.1-8B-Instruct, Qwen2.5-14B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2603.05618Mar 6
Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in Large Language Models
测量思维链将提示中 PII 复述进轨迹的泄漏并评测轻量检测器
arXiv
2603.05618
Published
Mar 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama 3.3:70B, Claude Opus, Mixtral 8×22B and others7
- DefensesDetection and filtering
- ComponentReasoning chains
Abstract作者称 CoT 抬高逐字泄漏且随模型与预算而变，检测器也需按模型选择。
在“不要复述 PII”的输出策略下，本文用 black-box 协议测量提示词中的 PII 被写回 CoT 与答案的情况，并比较轻量 gatekeeper。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop