Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
Another 203 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出任意字母置换密码越狱，无需微调即可诱导有害输出
Published Sep 9
Evaluated models Claude Sonnet 4 , Claude Sonnet 4.5 , Gemini 3 Flash (preview) and others7 Abstract 前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
Published Jun 11
Evaluated models Claude-sonnet-4.5 , GPT-4o , GPT-4.1 and others11 Abstract PaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。PaperGuard 同时评测并检测多模态 AI 审稿中的评分操纵。
提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成
Published May 27
Evaluated models Llama-2-7B-Chat , Mistral-7B-Instruct-v0.2 , Qwen-7B-Chat and others10 Abstract 两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。
提出多流扰动攻击，交织有害与良性任务绕过思考型 LLM 安全对齐
Published Mar 10
Evaluated models Qwen3 1.7B , Qwen3 4B , Qwen3 8B and others11 Abstract 多流扰动用任务交织测试 thinking 模式，作者称它同时冲击内容安全与推理稳定性。多流扰动攻击把有害任务与良性任务织进同一提示词，测试 thinking 模式的内容安全与推理稳定性。作者认为，交织多任务会拉长思考，使安全检测面对被打散的有害意图，并可能把推理用于合理化，或陷入崩溃与重复。方法不访问梯度。
用简历中的不可见指令做间接提示注入，操纵招聘推荐
Published Feb 20
Evaluated models Qwen 3 30B A3B Instruct 2507 , Qwen 3 30B A3B Thinking 2507 Abstract 作者称推理在简单注入下会帮攻击圆谎，在不合逻辑的复杂注入下又会把欺骗漏出来。
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
Published Jan 31
Evaluated models Qwen-1.5-7B-Instruct , SFR-Embedding-Mistral , E5-Mistral-7B-Instruct and others10 Abstract DQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
Attacks arXiv 2510.11570 · Oct 14, 2025 提出四种阶段转换攻击，绕过推理模型的安全推理护栏
Published Oct 14, 2025
Evaluated models gpt-oss-20b , gpt-oss-120b , Qwen3-4B-Thinking-2507 and others10 Attacks arXiv 2406.12814 · Jun 19, 2024 提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
Published Jun 19, 2024
Evaluated models GPT-4o , GPT-4V , Claude-3-Opus and others4 Abstract 系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
You have reached the end