Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 36 papers Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
Published Oct 9
Evaluated models Wan2.2-TI2V-5B , HunyuanVideo-1.5 , Kling 3.0 and others4 Abstract KVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
Published Oct 9
Evaluated models Wan2.1-I2V-14B , CogVideoX-5B-I2V , LightX2V and others6 Abstract LETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
Published Oct 7
Evaluated models Llama2-7B-chat , Qwen2.5-7B-Instruct , Gemma-2-9B-it and others4 Abstract Persist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。 。
AI summary 研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。
Published Oct 6
Evaluated models Qwen3-VL-30B-A3B-Instruct , Kimi-VL-A3B-Instruct Abstract 读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。
评测文生图模型的有害内容生成能力与审核检测缺口
Published Oct 5
Evaluated models SDXL , Stable Diffusion 3.5 Large , FLUX.1-dev and others12 提出危害窗口与区间指标，统一评测分解攻击和提示注入下的智能体滥用监视
Published Oct 5
Evaluated models Gemma 4 26B-A4B , Qwen3.6 27B , Qwen3.5 27B and others12 Abstract 统一智能体滥用监视框架，动作视角兼顾两类威胁但危害定位仍存瓶颈。
提出审计感知遗忘框架 AVCE，从文本与视觉通路擦除扩散模型概念
Published Oct 5
Evaluated models Stable Diffusion XL (SDXL) , Stable Diffusion v1.5 (SD v1.5) , Flux 1.0 Abstract AVCE 在审计锚点上改两条注意力通路。AVCE 是面向扩散模型的概念擦除方法，要让擦除经得起绕过文本条件的潜空间审计，而不只是挡住对抗提示词。
提出 FADE，对文生视频模型做帧感知多概念擦除
Published Oct 3
Evaluated models Wan2.1-T2V-1.3B , Wan2.1-T2V-14B , CogVideoX-2B and others4 Abstract FADE 用闭式编辑、帧感知适配器和软路由，在单骨干上擦除多概念并压低逐帧残差。FADE 是面向文生视频扩散 Transformer 的多概念遗忘方法，用来抑制指定物体、画风、裸体、暴力、仇恨和名人身份，并尽量保持其他生成。作者要处理两件事。与帧无关的抑制会让概念在少数帧重现，片段均值会掩盖这一失败。
提出 RASteer，推理时按保留子空间校正激活以擦除文生图目标概念
Published Oct 2
Evaluated models Stable Diffusion v1.4 , Stable Diffusion v1.5 , Stable Diffusion v2.1 and others4 Abstract RASteer 用保留子空间校正擦除方向，在固定权重下同时压低目标并保住保留概念。Retain-aware Activation Steering（RASteer） 是一种不改权重的推理时概念擦除方法，用于文生图扩散模型去掉指定概念并减少对保留概念的误伤。
用持续更新的探针做微调，降低有害性并保持线性可监测性
Published Sep 30
Evaluated models Mistral 7B Instruct v0.1 , Llama 3 8B Instruct Abliterated , Qwen3-14B Abstract 持续重拟合的探针可降低有害性、提高诚实性，训练后概念仍能被线性探针读出。Probe-guided fine-tuning 把探针分数当作唯一对齐信号，用来推动 harmlessness 与 honesty，并检查训练后这些概念是否仍线性可读。
提出 CollageAttack，用空间文本碎片重组越狱文生图模型
Published Sep 29
Evaluated models GPT-Image-2 , Doubao-Seedream-5.0-Lite , Wan2.7-Image-Pro and others5 Abstract 系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
证明无显式危害的图文窄微调可诱发跨任务涌现未对齐
Published Sep 28
Evaluated models GPT-4o , GPT-4.1 , Gemini 2.5 and others15 Abstract 证实窄多模态微调可引发全面的多渠道未对齐行为转变，揭示了后训练阶段对齐被隐蔽重塑的安全隐患。论文系统探究了视觉-语言模型中由窄任务微调诱发的跨模态涌现未对齐（Emergent Misalignment, EM）现象。
提出 RISE，迭代演化可复用策略对文生图模型做红队
Published Sep 28
Evaluated models DALL·E 3 , Nano Banana 2 , GPT-Image-2 and others7 提出跨架构攻击 CSR，用概念分数参数重学习恢复文生图被擦除概念
Published Sep 27
Evaluated models FLUX.1-dev , Stable Diffusion-v1.4 提出 TempQ-Jail，以查询受限候选排序越狱文生视频模型
Published Sep 25 用能量势垒信号检测扩散语言模型的越狱
Published Sep 25
Evaluated models LLaDA-8B-Instruct , LLaDA-1.5 , Dream-v0-Instruct-7B and others4 Abstract 能量势垒把 dLLM 越狱分成掩盖初始状态或中途越垒，三个 logit 信号据此互补检测。Bach 等提出用去噪能量景观解释 masked diffusion 语言模型上的越狱，并由此得到三个免训练检测信号。 。
提出局部稀疏无监督安全检测，标记偏离安全分布的输入
Published Sep 17
Evaluated models qwen2-1.5b-instruct , ministral-8b-instruct , llama3-8b-instruct and others6 提出 HERALD，用跨层有害投影轨迹检测越狱提示
Published Sep 12
Evaluated models Llama-3.1-8B-Instruct , Mistral-7B-Instruct , OLMo2-7B-Instruct and others4 Abstract HPD 用跨层投影形状区分有害与良性提示。
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
Published Sep 7
Evaluated models Wan , CogVideoX , LTX-Video and others9 Abstract DIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。 。
提出 AV-SafetyBench 评测文生音视频模型的不安全生成
Published Sep 7
Evaluated models LTX-2.3 , Ovi-1.1 , JavisDiT++ and others7 Abstract AV-SafetyBench 用三视角评五个 T2AV 模型，显示只看视频会漏掉音频与联合风险。AV-SafetyBench 是面向文本生成音视频（T2AV）的安全基准：一条提示词同时规定画面和音频，评测同时看两轨以及它们的交互。作者要测的是，不安全含义不只出现在画面上：它可以主要由语音或声音承载，也可以只有两轨合起来才成立。T2VSafetyBench 不评音频，TTA-Bench 不评与画面的交互，作者认为二者都盖不住这些路径。