Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 35 papers Another 233 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Using fear activation steering to test the hazard judgment criteria of vision-language models
Published Oct 8
Evaluated models Qwen/Qwen2.5-VL-7B-Instruct 提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B , ColQwen3.5-4.5B , Tomoro-colqwen3-embed-4b and others13 提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
Published Oct 7
Evaluated models OpenVLA , UniVLA , π0.5 开环审计冻结视觉语言安全分，发现其反映场景模板而非危险感知
Published Oct 7
Evaluated models CLIP ViT-B/32 , CLIP ViT-L/14 , Qwen2-VL-7B Abstract 论文审计了冻结 VLM 安全评分机制，指出其反映场景模板而非危险感知，为安全强化学习评估提供了严谨基准。本文是一项针对安全强化学习中冻结视觉语言模型（VLM）安全评分机制的实证审计研究。
提出 ProbeGuard，按共识形成过程对医疗问答做选择性弃答
Published Oct 6
Evaluated models Qwen3-8B , Llama-3.1-8B-Instruct , HuatuoGPT-o1-8B Abstract ProbeGuard 用共识形成过程做可认证弃权，并在全票层分开答对与答错的共识。ProbeGuard 是给多轮共识医学问答用的认证弃权框架：基板照原样作答，弃权只看共识是怎么形成的。
TAPDreamer 用公开编码器做固定补丁。
Published Oct 6
Evaluated models FastWAM , DreamWAM-uncond , DreamWAM-joint and others4 评测文本守卫与激活探针能否拦住机器人隐含伤害指令
Published Oct 5
Evaluated models π0.5 , OpenVLA-OFT , Llama Guard 3 and others10 提出 Perturbot 扰动训练，打破 VLA 的模态捷径
Published Oct 3
Evaluated models π0.5 Abstract Perturbot 改训练数据以削弱三类模态捷径，GroundFscore 用来看成功是否来自任务证据。Perturbot 是一套不改推理的 VLA 训练期数据干预，用来削弱模态捷径，并用离线分数区分“任务变好”和“靠捷径变好”。
提出条件特征抑制防御，检出对抗补丁后抑制 VLA 内部特征
Published Oct 2
Evaluated models π0.5 , SmolVLA Abstract 条件抑制与 patch 相关的 SAE 特征，间歇攻击下可提高 SR，持续攻击下则不能。
审计机器人安全监控的细化缺口，比较表面计划与图细化轨迹的裁决
Published Oct 2 Abstract 表面轨迹可漏掉图诱导的禁区进入。作者审计 RoboGuard 的一个假设：对高层动作轨迹的安全裁决，在补上语义图诱导的导航和已记录隐式效应之后是否仍然成立。做法是不改验证器，并固定同一条 LTL。
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
Published Oct 1
Evaluated models Lumina-mGPT , Gemini 2.5 Flash Image Preview , CLIP ViT-B/16 and others5 提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
Published Oct 1 测量并预测具身 VLM 规划器的任务拒答可变性
Published Sep 30
Evaluated models gemini-robotics-er-2-preview , gemini-robotics-er-1.6-preview Abstract 日常物体能翻转一部分已给出的拒答，可翻转程度取决于任务且可被本地代理预测。作者测量 constitution 守护的具身 VLM 规划器：一次拒答在只往场景里放一个日常物体之后还保不保持得住，并把这种易翻转程度称为任务的 malleability 。
提出 DrivingBench，评测通用视觉语言模型能否闭环驾驶真车
Published Sep 30
Evaluated models GPT-6 Astra , Claude Fable 5.1 , Grok 4.6 and others4 Abstract 仅 Astra 第二次跑完低速锥桶路线。DrivingBench 评测通用 VLM 能否自己闭环开真车，推理延迟也算进任务。
提出 MIST 压力测试，检验无关图像是否扰动 VLM 评判者标签
Published Sep 29
Evaluated models GPT-5.2 , Gemini 3.1 Flash-Lite , Gemini 3.5 Flash and others13 Abstract 有图就改标签，图的内容却不告知 judge，裁决绑定配置。作者用MIST 问：VLM 代替人类标注时，可替代性裁决会不会被指南要求忽略的图像改写。
分析零训练 LLM+OVOD 流水线中 CAAP 与 SNAP 分离的来源
Published Sep 26
Evaluated models Gemma-3 4B , YOLO-World X , Qwen2.5-VL 7B and others4 刻画单迹监控对跨执行超性质的监督缺口
Published Sep 7
Evaluated models Llama-3.1-8B , Mistral-24B , GPT-4o-mini and others9 Abstract 单迹监督的上界由 TV 决定。论文测量单迹安全监控相对 2-safety 超性质 能看见多少：跨租户泄漏、觉察到被评估、策略性表现不佳都由两次执行之差定义，一条轨迹装不下判定。
用 SAE 追踪稠密检索查询扩展的潜变量并用激活转向验证
Published Sep 7
Evaluated models Qwen3-Embedding-0.6B（Qwen-Embed） , SimLM Abstract SAE 追踪稠密检索 QE 的潜变量，转向在四基准上比文本扩展更稳。作者用稀疏自编码器分析稠密检索里的查询扩展：现成检索器不微调时，拼接扩展文本往往增益有限甚至变差，而最终指标和嵌入整体偏移不足以说明内部发生了什么。
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
Published Sep 4
Evaluated models GTR-T5 encoder , DPR Abstract SHAQ replaces document embeddings with shadow query embeddings.SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
提出 Sentinel-RL，将拓扑处置从 LLM 卸载到受约束图策略
Published Sep 4
Evaluated models HetGAT , PPO Abstract Sentinel-RL 用图编码器与 PPO 承担拓扑决策，LLM 负责叙述与门控，并在 LANL 上报告检测与时延。Sentinel-RL 是面向 SOC 的神经符号架构：拓扑决策离开 LLM，改由认证图上的 HetGAT 与 PPO 完成。