研究显示 VLA 模型文本护栏漏检隐含危害指令
评测文本守卫与激活探针能否拦住机器人隐含伤害指令
- arXiv
- 2610.05818
- Published
- Layer
- Prompt layer
- Evaluated models
- π0.5, OpenVLA-OFT, Llama Guard 3 and others10
- RiskDangerous agent actions
- ComponentGuardrails and judges
All papers
Filter5
Attack technique
Model risks
Defense type
Impact
System type
Layer
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
Another 254papers do not have category tags yet and are not included in filtered results.
- Risky behaviorarXiv 2610.03458
Paper: Low monitoring readings do not prove behavior is under control
检验低监控读数能否证明代码生成中的奖励作弊已受控
- arXiv
- 2610.03458
- Published
- Setting
- coding agent
- Evaluated models
- Llama-3.1-8B-Instruct
- RiskReward hacking
- ComponentMonitors
Abstract论文指出监控器训练读数接近零无法确立作弊受控，模型可利用通用外壳推迟提交绕过监控，强化学习亟需带外行为验证。
本文是一篇针对强化学习可验证奖励后训练（RLVR）中监控器有效性与奖励作弊行为的实证分析研究。论文要解决的核心问题是：在训练目标中引入监控器以抑制代码生成中的作弊行为时，接近零的监控器读数是否足以确立模型行为已真正受控。
- DefensesarXiv 2609.38645
用探针引导微调对齐模型且不损失可监控性
用持续更新的探针做微调，降低有害性并保持线性可监测性
- arXiv
- 2609.38645
- Published
- Setting
- Models and APIs
- Evaluated models
- Mistral 7B Instruct v0.1, Llama 3 8B Instruct Abliterated, Qwen3-14B
- DefensesModel hardening
- RiskInappropriate refusal
- ComponentMonitors
Abstract持续重拟合的探针可降低有害性、提高诚实性，训练后概念仍能被线性探针读出。
Probe-guided fine-tuning 把探针分数当作唯一对齐信号，用来推动 harmlessness 与 honesty，并检查训练后这些概念是否仍线性可读。
- AttacksarXiv 2609.15989
研究者提出 plan injection 攻击，可绕过思维链监控
提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器
- arXiv
- 2609.15989
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Gray-box
- Evaluated models
- Qwen2.5-Coder-7B-Instruct, Qwen3-8B, DeepSeek-R1-0528 and others6
- AttacksDetection evasion
- TechniqueReasoning-chain manipulation
- ComponentMonitors
Abstract论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。
- DefensesarXiv 2609.05797
Paper finds safety monitors mainly block requests the model would already refuse
评估安全监视器并提出双侧梯级微调以减少会答有害请求的漏检
- arXiv
- 2609.05797
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Gemma-4-31B-IT, Qwen3-32B, Llama Guard 3 8B and others6
- DefensesDetection and filtering
- RiskInappropriate refusal
- ComponentGuardrails and judges
Abstract论文发现安全监视器大多拦截模型已拒答请求，指出明确度偏差是共性原因，并通过双侧梯级微调提升回答请求的召回表现。
- DefensesarXiv 2609.04665
HackProbe：面向自演化语言模型奖励作弊的黑盒检测与免疫方法
提出 HackProbe，黑盒检测并免疫自演化中的奖励作弊
- arXiv
- 2609.04665
- Published
- Setting
- Models and APIs
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentMonitors
Abstract黑盒探针检测自演化奖励黑客，并以带宽受限重选回收真实能力。
HackProbe 是挂在自演化循环上的黑盒监控器，用来发现奖励黑客并改选候选。
- AttacksarXiv 2609.01023
Akrasia：针对推理型代码 LLM 的隐蔽后门攻击
提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
- arXiv
- 2609.01023
- Published
- Layer
- Prompt layer
- Setting
- coding agent
- Evaluated models
- Claude-Sonnet-5, GPT-5.5, Gemini-3.5-flash and others7
- AttacksPrompt injection
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
- Risky behaviorarXiv 2606.04923
CHERRL：可复现、分析与检测评分标准强化学习中的奖励作弊
提出 CHERRL 注入裁判偏差以复现奖励作弊，并用 RHDA 检测训练起点
- arXiv
- 2606.04923
- Published
- Setting
- Models and APIs
- Evaluated models
- Qwen3-4B, Qwen3.5-plus, Qwen3.5-397B-A17B and others4
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentGuardrails and judges
AbstractCHERRL 注入已知偏差以观察奖励黑客，并用于分析偏差和评测起点检测器 RHDA。
CHERRL 是 rubric-based RL 的可控环境，用来复现奖励黑客、观察奖励分歧，并给检测器提供起点参照。
- DefensesarXiv 2602.01750
Adversarial Reward Auditing: Proactively Detecting and Mitigating Reward Hacking
提出 ARA，读取奖励模型激活并门控 RLHF 奖励以缓解奖励作弊
- arXiv
- 2602.01750
- Published
- Setting
- Models and APIs
- Evaluated models
- Llama-2-7B, Llama-3.1-8B, Qwen-2.5-7B
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentMonitors
AbstractARA 用奖励模型内部表示检出利用，并在 RLHF 里按 Auditor 概率压低代理奖励。
ARA 是一套两阶段的 RLHF 审计：先对冻结奖励模型找出利用回复，再在策略优化时按检出概率压低奖励。
- AttacksarXiv 2601.14310
CORVUS：用 LoRA 伪装内部信号绕过单次幻觉检测器
提出 CORVUS，用 LoRA 伪装内部遥测以绕过幻觉检测器
- arXiv
- 2601.14310
- Published
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama-2-7B-Chat, Vicuna-7B (v1.5), Llama-3-8B-Instruct and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMonitors
Abstract作者称内部遥测在自适应模型侧对抗下易被操纵，CORVUS 通过轻量适配器微调降低了多种幻觉检测器的效果。
You have reached the end