Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 255 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答
Published Oct 6
Evaluated models Llama-2-7B-chat-hf , Mistral-7B-Instruct-v0.3 , Gemma-7B-it and others4 Abstract 论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。
提出 PACT，遗忘推理模型在压力下的欺骗行为并保留上下文理解
Published Sep 30
Evaluated models DeepSeek-R1-Distill-Qwen-32B , QwQ-32B Abstract 论文将大模型欺骗形式化为上下文条件行为，提出 PACT 框架在消除欺骗的同时保留了上下文遵循能力。
构造可通过计费审计的 token 虚报，使服务商系统性超收
Published May 28
Evaluated models PALACE domain-adapted auditor Abstract 不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。 。
Propose a structured JSON backdoor that triggers malicious actions in robot control via a poisoned LoRA
Published Apr 5
Evaluated models Llama-3.1-8B-Instruct , Gemma-2-9B-IT , DeepSeek-R1-Distill-Llama-8B and others4 提出多轮在线骚扰 Agent 基准，评测记忆、规划与微调越狱
Published Oct 16, 2025
Evaluated models LLaMA-3.1-8B-Instruct , Qwen3-30B-A3B-Instruct , DeepSeekMoE-16B and others4 Attacks arXiv 2510.02833 · Oct 3, 2025 提出两阶段良性微调攻击，经 FaaS 用良性数据解除安全对齐
Published Oct 3, 2025
Evaluated models Llama2-7b-chat-hf , Llama3-8b-instruct , Deepseek-R1-Distill-Llama3-8b and others10 You have reached the end