Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 19 papers Another 227 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
提出用 API 推理摘要重建轨迹再蒸馏加强化学习，攻破蒸馏防御
Published Sep 29
Evaluated models Qwen2.5-0.5B , Qwen2.5-1.5B , Qwen2.5-3B and others12 Abstract 更现实的蒸馏攻击是蒸馏后再 RL。这篇工作修订蒸馏攻击的威胁模型：攻击者经合法 API 收集闭源推理数据，先蒸馏自有模型，再做强化学习。作者认为只在蒸馏后评估防御，会漏掉后续 RL，从而高估防御。
提出推理通道预填与输出前缀组合攻击以越狱推理模型
Published Sep 24
Evaluated models Gemini 3 Flash Preview , DeepSeek V4 Flash , Claude Haiku 4.5 提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器
Published Sep 15
Evaluated models Qwen2.5-Coder-7B-Instruct , Qwen3-8B , DeepSeek-R1-0528 and others6 Abstract 论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。
提出任意字母置换密码越狱，无需微调即可诱导有害输出
Published Sep 9
Evaluated models Claude Sonnet 4 , Claude Sonnet 4.5 , Gemini 3 Flash (preview) and others7 Abstract 前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
揭示推理加深引发的对齐坍塌，用 Reasoning Trap 放大越狱
Published Sep 8
Evaluated models Qwen3-8B , Qwen3-14B , Llama2-7B and others8 Abstract 更深推理提升题目准确率，同时提高扰动下的相对损失。作者研究扩展推理是否以对齐稳健性为代价，提出 ALR、RT 与 RRA。 。
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
Published Sep 7
Evaluated models BERT-base , RoBERTa-base , T5-base and others6 提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
Published Sep 1
Evaluated models Claude-Sonnet-5 , GPT-5.5 , Gemini-3.5-flash and others7 Abstract 论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
Published Aug 11
Evaluated models Claude Opus 4.8 , Claude Sonnet 4.6 , Claude Haiku 4.5 and others13 Abstract 论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
提出 RolePlay 框架，用人设条件放大 LLM 单次推理开销
Published Jul 29
Evaluated models DeepSeek-V4-Pro , Gemini-3.5-Flash , Qwen-3.5-Plus and others5 构造可通过计费审计的 token 虚报，使服务商系统性超收
Published May 28
Evaluated models PALACE domain-adapted auditor Abstract 不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。 。
提出层级遗传算法 HGA，扰动题目逻辑结构诱发推理模型过度思考
Published May 13
Evaluated models DeepSeek-R1 (671B) , Qwen3-Thinking , GPT-o3 and others5 Abstract HGA 在黑盒推理模型上用逻辑扰动拉长输出，作者称可从小代理迁移，查询成本是其局限。
Proposes composite jailbreaks, stacking contrast structure, authoritative persona, and self-evaluation to saturate the instruction hierarchy
Published Apr 3
Evaluated models OpenAI gpt-oss-20b 提出多流扰动攻击，交织有害与良性任务绕过思考型 LLM 安全对齐
Published Mar 10
Evaluated models Qwen3 1.7B , Qwen3 4B , Qwen3 8B and others11 Abstract 多流扰动用任务交织测试 thinking 模式，作者称它同时冲击内容安全与推理稳定性。多流扰动攻击把有害任务与良性任务织进同一提示词，测试 thinking 模式的内容安全与推理稳定性。作者认为，交织多任务会拉长思考，使安全检测面对被打散的有害意图，并可能把推理用于合理化，或陷入崩溃与重复。方法不访问梯度。
提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型
Published Mar 10
Evaluated models GPT-4o , Claude 3.7 Sonnet , GLM-4V-Plus and others7 Abstract VROP 以良性视觉 gadget 与控制流提示词做组合越狱。VROP 是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。
提出 Zero2Text，无需训练地跨域反演文本嵌入
Published Feb 2
Evaluated models GTR-Base , Qwen3-Embedding-0.6B , Text-Embedding-3-small and others4 Abstract 零训练在线对齐可在未知域、无泄漏对时从黑盒 embedding 还原句子。Zero2Text 是一种不训练 decoder、也不使用泄漏文本–向量对的文本 embedding 反演，针对 RAG 向量库在严格黑盒、目标域未知时的还原。
Attacks arXiv 2512.05853 · Dec 6, 2025 提出视觉推理序列攻击 VRSA，以图像序列越狱多模态大模型
Published Dec 6, 2025
Evaluated models DeepSeek-VL2-tiny , InternVL-3.5-8B , LLaVA-1.6-Mistral-7B and others8 Attacks arXiv 2510.11570 · Oct 14, 2025 提出四种阶段转换攻击，绕过推理模型的安全推理护栏
Published Oct 14, 2025
Evaluated models gpt-oss-20b , gpt-oss-120b , Qwen3-4B-Thinking-2507 and others10 Attacks arXiv 2406.12814 · Jun 19, 2024 提出 ARE 框架与图像文本攻击，评测多模态网页 Agent 的对抗鲁棒性
Published Jun 19, 2024
Evaluated models GPT-4o , GPT-4V , Claude-3-Opus and others4 Abstract 系统评估多模态网页智能体的脆弱性，指出推理时计算组件被攻破会加剧系统风险。
You have reached the end