Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 148 papers

Filter5

System component

MCP and skills25 Memory11 Guardrails and judges93 Monitors48 Reasoning chains64 Permissions and sandboxing12 Fine-tuning and open weights60 Vision101 Audio32 Video11 Image generation46 Embeddings4 Multimodal180

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

System type：Models and APIs System type：coding agent System component：Monitors System component：Reasoning chains System component：Image generation Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.13333Oct 9
LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
arXiv
2610.13333
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
- AttacksMalicious use
- ComponentImage generation
AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.
LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Paper analysisRead analysis
AttacksarXiv 2610.12644Oct 9
Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
arXiv
2610.12644
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentReasoning chains
AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.
Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Paper analysisRead analysis
InterpretabilityarXiv 2610.12361Oct 9
Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
arXiv
2610.12361
Published
Oct 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-14B, Llama-3.1-8B and others7
- AttacksPrompt injection
- ComponentReasoning chains
AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.
This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
Paper analysisRead analysis
Analysis and theoryarXiv 2610.11765Oct 8
研究提出三项指标衡量 LLM 不思考行为，发现被要求停止思考时仍持续显式推理
度量关闭思考指令下终答前是否仍有可见显式推理
arXiv
2610.11765
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3-32B, Qwen3-235B-A22B and others6
- ComponentReasoning chains
Abstract作者用三级指标测 no-thinking，并称模型有随答案空间加重的思考惯性。
作者把 no-thinking 定义为可测量的回答行为，而不是从思考开关、特殊标记或输出长度推断。
Paper analysisRead analysis
DefensesarXiv 2610.11352Oct 8
RL-ARC：用推理引导的不确定性校准大型推理模型
提出 RL-ARC，用推理置信度在强化学习中校准推理模型
arXiv
2610.11352
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B, Qwen3-8B, Llama-8B distilled from DeepSeek-R1
- DefensesModel hardening
- ComponentReasoning chains
AbstractRL-ARC 用推理置信度调节答案置信度，作者称可少牺牲精度并改善 ID 与 OOD 校准。
RL-ARC 是校准感知的强化学习框架，用推理过程的口头置信度调节答案置信度。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.11112Oct 8
EpiReal-Bench：商用图像生成模型虚假声明红队基准
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
arXiv
2610.11112
Published
Oct 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Nano Banana 2, Grok Imagen 2.0 and others4
- AttacksJailbreaks
- ComponentImage generation
Abstract四款商用图像模型能把假主张画成可信证据。
EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.10405Oct 8
研究发现大语言模型被要求不诚实作答时推理 token 数上升
检验推理 token 数能否区分被提示的诚实与不诚实作答
arXiv
2610.10405
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma-4-e4b, Qwen-3.5-9b, GPT-OSS-120B
- RiskDeception and scheming
- ComponentReasoning chains
Abstract被提示不诚实时推理 token 组水平更高。
三个推理模型在被提示的回答政策下出现组水平推理 token 差异。作者把它当作不读思维链内容的 black-box 候选信号，而不是自发欺骗检测器。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.09667Oct 7
东京大学研究：推理模型按 UUID 阈值或整除规则挑选审计样本，控制标识符即可躲开复核
揭示推理模型用标识符规则替代随机抽样，使审计可被预测
arXiv
2610.09667
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
GPT-6 Sol, GPT-6 Luna, GPT-5.4 mini and others6
- ComponentReasoning chains
Abstract研究揭示推理智能体将标识符转化为确定性规则，破坏群体独立性并导致审计预测漏洞，建议显式提供随机输入。
Paper analysisRead analysis
DefensesarXiv 2610.09167Oct 7
Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
arXiv
2610.09167
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。
Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。
Paper analysisRead analysis
InterpretabilityarXiv 2610.09087Oct 7
U-Space：揭示语言模型不确定性何时与为何产生
提出 U-SPACE 与 U-LENS，从残差流估计推理轨迹不确定性
arXiv
2610.09087
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma-4-31B-it, Qwen3.5-27B, Magistral-Small-2507
- ComponentReasoning chains
AbstractU-SPACE 与 U-LENS 用语义方向和预测熵读推理不确定性，长度控制后仍高于所比基线。
U-SPACE 与 U-LENS 是面向推理模型的无训练读出：用语义方向定位不确定性的形式，并用一个轨迹分数区分更可能错的回答。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.08791Oct 7
研究者发布视频世界模型物理一致性基准 World Models' Last Exam in Physics
提出 World Models' Last Exam 评测视频物理一致性
arXiv
2610.08791
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Seedance-2.5, MiniMax-H3, Cosmos3-Super and others8
- ComponentImage generation
Paper analysisRead analysis
Analysis and theoryarXiv 2610.08178Oct 6
研究给出潜空间图像水印的鲁棒性上限理论分析
分析潜空间图像水印对像素扰动的内在鲁棒性上限
arXiv
2610.08178
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v2-1
- DefensesWatermarking and provenance
- ComponentImage generation
Abstract作者称当前潜空间水印在低 FPR 下受扩张映射与分布偏移的限制。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.07939Oct 6
CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it
提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别
arXiv
2610.07939
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
C2P-CLIP, ForgeLens, D3-Im and others10
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
Abstract提出消除格式捷径的监控深度伪造基准 CCDF，揭示现有检测器难以识别商用生成视频。
Paper analysisRead analysis
DefensesarXiv 2610.07774Oct 6
研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器
AI summary研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。
arXiv
2610.07774
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-30B-A3B-Instruct, Kimi-VL-A3B-Instruct
- DefensesMonitoring and auditing
- RiskInappropriate refusal
- ComponentMonitors
Abstract读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。
作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.06851Oct 6
研究发现基础模型仅靠固定开头 token 即可达到 RL 级推理表现
证明短开头词可唤醒基模型推理，且效应来自训练数据
arXiv
2610.06851
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Olmo-3-7B, Olmo-3-32B, Qwen3-4B and others10
- ComponentReasoning chains
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06503Oct 5
研究评测五款开源文生图模型的有害内容生成与审核缺口
评测文生图模型的有害内容生成能力与审核检测缺口
arXiv
2610.06503
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SDXL, Stable Diffusion 3.5 Large, FLUX.1-dev and others12
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06406Oct 5
AgentMonBench：面向长时程智能体行为监控的软件工程基准
提出 AgentMonBench 评测长时程编程智能体监控并检验 EBG
arXiv
2610.06406
Published
Oct 5
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol and others8
- DefensesMonitoring and auditing
- RiskDangerous agent actions
- ComponentMonitors
AbstractAgentMonBench 评测后果性决策监控，EBG 组织证据。
长时程软件工程任务里，用户要判断智能体哪些选择值得核验。作者用 AgentMonBench 评测监控器，并用免训练的 EBG 组织带源证据。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06366Oct 5
VERA：结构化审计发现约 60% 正确漏洞判定伴随虚构推理
提出 VERA，审计 LLM 漏洞解释里的虚构推理
arXiv
2610.06366
Published
Oct 5
Layer
Model layer
Setting
coding agent
Evaluated models
sonnet-5, gemma-4-26b, llama-4-maverick and others8
- RiskHallucination and fabrication
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2610.05601Oct 5
Tracer 框架可从遗忘后的扩散模型中识别被擦除概念
提出 TRACER，从权重差识别扩散模型被擦除概念
arXiv
2610.05601
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
- AttacksExtraction and theft
- ComponentImage generation
AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。
TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

Study: legal reasoning models citing legal provisions does not equal relying on legal provisions.

研究提出三项指标衡量 LLM 不思考行为，发现被要求停止思考时仍持续显式推理

RL-ARC：用推理引导的不确定性校准大型推理模型

EpiReal-Bench：商用图像生成模型虚假声明红队基准

研究发现大语言模型被要求不诚实作答时推理 token 数上升

东京大学研究：推理模型按 UUID 阈值或整除规则挑选审计样本，控制标识符即可躲开复核

Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果

U-Space：揭示语言模型不确定性何时与为何产生

研究者发布视频世界模型物理一致性基准 World Models' Last Exam in Physics

研究给出潜空间图像水印的鲁棒性上限理论分析

CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it

研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器

研究发现基础模型仅靠固定开头 token 即可达到 RL 级推理表现

研究评测五款开源文生图模型的有害内容生成与审核缺口

AgentMonBench：面向长时程智能体行为监控的软件工程基准

VERA：结构化审计发现约 60% 正确漏洞判定伴随虚构推理

Tracer 框架可从遗忘后的扩散模型中识别被擦除概念