Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 82 papers
Filter5

Attack type

Jailbreaks23Prompt injection3Poisoning and backdoors4Extraction and theft7Detection evasion10Malicious use7

Attack technique

Automated search8Encoding and obfuscation7Cross-modal payloads4Defense-targeted6

Model risks

Deception and scheming9Reward hacking4Inappropriate refusal5

Defense type

Model hardening6Inference-time intervention5Detection and filtering4Monitoring and auditing22Watermarking and provenance4

Impact

Harmful content34Data and privacy leaks7Output manipulation12Oversight failure13

System type

Models and APIs77LLM applications14AI Agent65coding agent22science agent3Browser and computer use5Multi-agent systems7Embodied systems and robotics3

Attacker access

Black-box18White-box6

Attack surface / entry point

User input32Images, audio and video14Training data3Weights and gradients8Distribution channels4

Layer

Prompt layer20Model layer43Application layer4Training and data layer14

System component

Memory3Guardrails and judges87Monitors31Reasoning chains59Fine-tuning and open weights61Vision106Audio32Video11Image generation47Embeddings4Multimodal185
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：Browser and computer useSystem component：MonitorsSystem component：Image generationSystem component：EmbeddingsClear all

Another 201papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.13333

    LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

    Proposes LETHE, which perturbs reference images to block unauthorized image-to-video

    arXiv
    2610.13333
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
    AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.

    LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.

    Paper analysisRead analysis
  4. Evaluation and benchmarksarXiv 2610.11112

    EpiReal-Bench：商用图像生成模型虚假声明红队基准

    构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据

    arXiv
    2610.11112
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
    Abstract四款商用图像模型能把假主张画成可信证据。

    EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。

    Paper analysisRead analysis
  5. DefensesarXiv 2610.09167

    Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果

    提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源

    arXiv
    2610.09167
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
    AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。

    Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。

    Paper analysisRead analysis
  8. Evaluation and benchmarksarXiv 2610.07939

    CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it

    提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别

    arXiv
    2610.07939
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    C2P-CLIP, ForgeLens, D3-Im and others10

    Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。

    Paper analysisRead analysis
  9. DefensesarXiv 2610.07774

    研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器

    AI summary研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。

    arXiv
    2610.07774
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-VL-30B-A3B-Instruct, Kimi-VL-A3B-Instruct
    Abstract读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。

    作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。

    Paper analysisRead analysis
  11. AttacksarXiv 2610.05601

    Tracer 框架可从遗忘后的扩散模型中识别被擦除概念

    提出 TRACER，从权重差识别扩散模型被擦除概念

    arXiv
    2610.05601
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
    AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。

    TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。

    Paper analysisRead analysis
  12. AttacksarXiv 2610.05453

    研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私

    提出 PLW，用微调把先前对话敏感触发编码进后续生成图像

    arXiv
    2610.05453
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    OmniGen2, BAGEL-7B

    AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。

    Paper analysisRead analysis
  13. DefensesarXiv 2610.05401

    AVCE：面向扩散模型可验证概念擦除的审计感知遗忘框架

    提出审计感知遗忘框架 AVCE，从文本与视觉通路擦除扩散模型概念

    arXiv
    2610.05401
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Stable Diffusion XL (SDXL), Stable Diffusion v1.5 (SD v1.5), Flux 1.0
    AbstractAVCE 在审计锚点上改两条注意力通路。

    AVCE 是面向扩散模型的概念擦除方法，要让擦除经得起绕过文本条件的潜空间审计，而不只是挡住对抗提示词。

    Paper analysisRead analysis
  14. Evaluation and benchmarksarXiv 2610.04737

    PyINE：用可验证 Python 执行轨迹研究推理模型的捷径与监督

    提出 PyINE 基准，训练捷径跟随模型并比较监督者

    arXiv
    2610.04737
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    shortcut-following model organism, gpt-4o, gpt-5 and others12
    AbstractPyINE 用可验证代码执行研究捷径失败的监督覆盖与成本权衡。

    PyINE 是用可执行程序研究推理模型引出与监督的框架，PyINE-v1 是其第一次发布。

    Paper analysisRead analysis
  15. InterpretabilityarXiv 2610.06945

    超越线性表征假设：KANSteer 用非线性激活引导文本到图像模型

    提出 KANSteer，用非线性激活引导拟合文生图有序概念轨迹

    arXiv
    2610.06945
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    FLUX.1-schnell, FLUX.1-dev
    AbstractKANSteer 用曲线替代固定方向。

    KANSteer 研究文生图扩散模型里，有序视觉概念能否沿单一激活方向被遍历，并改用一维曲线做 steering。

    Paper analysisRead analysis
  16. DefensesarXiv 2610.03980

    FADE：面向视频扩散模型的帧感知多概念擦除框架

    提出 FADE，对文生视频模型做帧感知多概念擦除

    arXiv
    2610.03980
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-T2V-1.3B, Wan2.1-T2V-14B, CogVideoX-2B and others4
    AbstractFADE 用闭式编辑、帧感知适配器和软路由，在单骨干上擦除多概念并压低逐帧残差。

    FADE 是面向文生视频扩散 Transformer 的多概念遗忘方法，用来抑制指定物体、画风、裸体、暴力、仇恨和名人身份，并尽量保持其他生成。作者要处理两件事。与帧无关的抑制会让概念在少数帧重现，片段均值会掩盖这一失败。

    Paper analysisRead analysis
  17. DefensesarXiv 2610.02967

    用偏好奖励与评分标准奖励组合后训练前沿文生图模型

    组合偏好奖励与评分标准奖励后训练文生图模型以抑制奖励作弊

    arXiv
    2610.02967
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    FLUX.2-dev, Ideogram-4
    Abstract组合奖励后训练 FLUX.2-dev 与 Ideogram-4，并报告高于基座的胜率与 Elo。

    作者给出一套开放域文生图后训练配方：把人类偏好奖励和 prompt 条件的 rubric 奖励合在一起，而不是换一个新优化器。问题是单一奖励盖不住用户意图。偏好模型能看整体观感，但对“是否实现每个要求”这类稀疏属性不敏感。

    Paper analysisRead analysis
  18. Evaluation and benchmarksarXiv 2610.02741

    研究系统评估循环语言模型的思维链可监控性

    系统评估循环语言模型加深 loop 后的 CoT 可监控性

    arXiv
    2610.02741
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Ouro-1.4B-Thinking, Ouro-2.6B-Thinking, Nanbeige4.2-3B and others4
    Abstract加深 loop 可在部分压力测试任务降低可监测性，循环架构本身并不必然更难监测。

    这项工作评估 LoopLM 的 CoT 可监测性：加深共享层的重复次数，以及“有循环结构”本身，会不会让决策关键因素更少出现在可监测文本里。

    Paper analysisRead analysis
  20. DefensesarXiv 2610.02413

    研究：分类后缀可提升激活探针的分布外恶意输入检测

    用分类后缀提升激活探针对分布外恶意输入的检测

    arXiv
    2610.02413
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
    Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。

    用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。

    Paper analysisRead analysis
Load more