Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 19 papers Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Using fear activation steering to test the hazard judgment criteria of vision-language models
Published Oct 8
Evaluated models Qwen/Qwen2.5-VL-7B-Instruct 提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B , ColQwen3.5-4.5B , Tomoro-colqwen3-embed-4b and others13 评测记忆门控对激活诱导与记忆诱导谄媚的防御效果
Published Oct 6
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 and others4 Abstract 作者称外部记忆过滤成立，数据未显示反向转向再有贡献。作者在四个开源指令模型上，把激活转向和外部记忆处理放进同一纵深防御协议，看记忆诱发谄媚和内部谄媚压力能否分开压低，以及个性化效用还剩多少。要处理的问题是：检索到的用户历史会推动模型顺从存储信念。只改外部上下文，并不直接动模型内部的谄媚表征。
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
Published Oct 1
Evaluated models Lumina-mGPT , Gemini 2.5 Flash Image Preview , CLIP ViT-B/16 and others5 提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
Published Oct 1 提出 MIST 压力测试，检验无关图像是否扰动 VLM 评判者标签
Published Sep 29
Evaluated models GPT-5.2 , Gemini 3.1 Flash-Lite , Gemini 3.5 Flash and others13 Abstract 有图就改标签，图的内容却不告知 judge，裁决绑定配置。作者用MIST 问：VLM 代替人类标注时，可替代性裁决会不会被指南要求忽略的图像改写。
预注册检验智能体记忆中选择原始轮次能否替代事实抽取
Published Sep 28
Evaluated models jev-1.13.0 分析零训练 LLM+OVOD 流水线中 CAAP 与 SNAP 分离的来源
Published Sep 26
Evaluated models Gemma-3 4B , YOLO-World X , Qwen2.5-VL 7B and others4 用 SAE 追踪稠密检索查询扩展的潜变量并用激活转向验证
Published Sep 7
Evaluated models Qwen3-Embedding-0.6B（Qwen-Embed） , SimLM Abstract SAE 追踪稠密检索 QE 的潜变量，转向在四基准上比文本扩展更稳。作者用稀疏自编码器分析稠密检索里的查询扩展：现成检索器不微调时，拼接扩展文本往往增益有限甚至变差，而最终指标和嵌入整体偏移不足以说明内部发生了什么。
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
Published Sep 4
Evaluated models GTR-T5 encoder , DPR Abstract SHAQ replaces document embeddings with shadow query embeddings.SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
Proposes LeakageBench to evaluate page-level leakage of PII redaction in document images
Published Sep 2
Evaluated models Amazon Comprehend PII , GPT-5.5 , NVIDIA GLiNER PII and others13 提出 Mind2Web-Injection 评测网页 Agent 视觉注入护栏
Published Sep 2
Evaluated models GPT-5.6-luna , Qwen3-VL-32B , Qwen3-VL-8B and others6 Abstract 作者称检测、定位和反事实响应在六个 VLM 上可分开。Mind2Web-Injection 用来检查网页截图护栏的判决是否对齐到该用的画面证据。 。
提出策略 RAG 的知识库投毒攻击与检测防御 CLD-KB
Published Jul 6
Evaluated models Llama 3.2 提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
Published Jul 1
Evaluated models e5-small , e5-small-v2 , e5-base and others19 Abstract EIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。 。
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
Published Jun 11
Evaluated models Claude-sonnet-4.5 , GPT-4o , GPT-4.1 and others11 Abstract PaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。PaperGuard 同时评测并检测多模态 AI 审稿中的评分操纵。
提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成
Published May 27
Evaluated models Llama-2-7B-Chat , Mistral-7B-Instruct-v0.2 , Qwen-7B-Chat and others10 Abstract 两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。
提出 M3 Att，在不知查询时投毒医学多模态 RAG 并误导临床决策
Published May 11
Evaluated models GPT-4o , GPT-5 Chat , Gemini-2.5-Flash and others8 提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
Published Jan 31
Evaluated models Qwen-1.5-7B-Instruct , SFR-Embedding-Mistral , E5-Mistral-7B-Instruct and others10 Abstract DQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Attacks arXiv 2512.01335 · Dec 1, 2025 提出 EmoRAG，向查询与知识库注入同一表情以劫持 RAG 检索
Published Dec 1, 2025
Evaluated models SPECTER , Contriever , Qwen2-7B and others11 Abstract EmoRAG 用表情联动查询与库文本。EmoRAG 测量 RAG 对符号扰动的反应：同一表情同时出现在查询和库文本里时，检索会偏离语义匹配。作者要检查的是，检索是否真由语义相关性决定。
You have reached the end