Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 17 papers Another 233 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B , ColQwen3.5-4.5B , Tomoro-colqwen3-embed-4b and others13 提出 TRACER，从权重差识别扩散模型被擦除概念
Published Oct 5
Evaluated models Stable Diffusion v1.5 , Stable Diffusion 3 , FLUX.1 and others5 Abstract TRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
构建 AGENTDOXX 基准，评测联网搜索 Agent 对匿名访谈的再识别
Published Oct 5
Evaluated models GPT-5.6 Terra , GPT-5 Mini , GPT-4.1 Mini and others10 Abstract 论文提出了已知身份的重识别基准 AGENTDOXX，揭示搜索与记忆双重风险及现有防御在检索轨迹中的泄露漏洞。
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
Published Oct 1
Evaluated models Lumina-mGPT , Gemini 2.5 Flash Image Preview , CLIP ViT-B/16 and others5 提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
Published Oct 1 提出 PILLAR，用私有词法预筛与客户端重排保护 RAG 查询
Published Sep 29 Abstract PILLAR 用固定模式的私有 BM25 预筛加本地嵌入重排，在两基准上换取延迟或质量。PILLAR 是面向公开语料的隐私 RAG：半诚实服务器学不到查询词项和访问模式，客户端仍拿到用于增强生成的 k 篇文档。
提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别
Published Sep 23
Evaluated models CosyVoice2-0.5B , F5-TTS , FireRedTTS Abstract GUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。
提出 RAPID，离线把抗蒸馏扰动写入文生图解码器
Published Sep 15
Evaluated models PixArt , SSD , SDXL and others4 提出 CIG-MIA，用上下文信息增益推断 RAG 知识库成员身份
Published Sep 14
Evaluated models Llama-3.1-8B-Instruct , Mistral-7B-Instruct-v0.3 , Llama-2-13b-chat-hf and others6 Abstract CIG-MIA 用注入前后的答案似然差推断 RAG 库成员，灰盒可分性高于所列基线。CIG-MIA 是针对 RAG 外部知识库的成员推断攻击，同时覆盖灰盒和纯文本黑盒。
提出 GraphProfiler，用个人知识图谱从帖子历史推断敏感属性并溯源
Published Sep 11 Abstract GraphProfiler 用源链接个人知识图谱做属性推断，准确率接近文本基线，并把证据定位到少量源帖。GraphProfiler 是一个可审计的 LLM 敏感属性画像器：用源链接个人知识图谱，把推断落到具体帖子。
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
Published Sep 4
Evaluated models GTR-T5 encoder , DPR Abstract SHAQ replaces document embeddings with shadow query embeddings.SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
Proposes LeakageBench to evaluate page-level leakage of PII redaction in document images
Published Sep 2
Evaluated models Amazon Comprehend PII , GPT-5.5 , NVIDIA GLiNER PII and others13 提出针对微调 TTS 的黑盒成员推断攻击
Published Sep 2
Evaluated models CosyVoice2 , F5-TTS , XTTS-v2 Abstract 黑盒 TTS 成员推断以 recitation 加分层语音表示为分数，说话人级强于记录级，DP-SGD 可压到随机附近。作者给出一个针对微调文本转语音模型的黑盒成员推断框架，分别审计说话人是否进入微调集，以及某一条文本–音频记录是否进入微调集。微调 TTS 以合成文本和参考语音双条件生成，既有生成模型 MIA 的单条件查询和图像/文本上的逐点比较不能直接套用。作者用 scorable extent 与 memorization elicitation 比较五种查询，认为只有 recitation（用目标转写和干净目标语音要求模型复现）同时满足两条，并把它作为主查询。
提出 LeakGauge，用行为后缀的 prefill 对数概率检测上下文泄露
Published Aug 18
Evaluated models Gemma-4-E4B-it , Gemma-4-31B-it , Qwen2.5-14B-Instruct and others11 提出 MEntA，用非模板查询推断文档是否属于 RAG 检索库
Published May 23
Evaluated models Phi4-14B , Llama3.1-8B , CommandR-7B and others5 提出零知识审计协议，核验多租户 RAG 的合谋差分隐私
Published May 19 Abstract 揭示多租户 RAG 合谋泄露按根号 k 放大，提出带零知识证明的无泄露审计协议。论文针对多租户 RAG 服务在多账户协同攻击下隐私边界失效的问题展开研究。
Attacks arXiv 2508.06837 · Aug 9, 2025 提出 Prometheus，从展示图反推文生图模型的在售提示词
Published Aug 9, 2025
Evaluated models Midjourney , Leonardo.ai , DALL·E and others4 Abstract 训练无关的 proxy 搜索攻击。Prometheus 是针对文生图市场 showcase 的训练无关提示词窃取：攻击者看不到在售文本，只用本地开源 proxy 恢复 subject 和 modifier，并希望换 subject 后风格仍在。
You have reached the end