Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 10 papers

Filter4

Defense type

Model hardening11 Inference-time intervention4 Detection and filtering6 Monitoring and auditing4

Impact

Data and privacy leaks3 Output manipulation3

System type

Models and APIs8

Attacker access

White-box3

Attack surface / entry point

User input4 Images, audio and video4

Layer

Model layer5

System component

MCP and skills10 Memory7 RAG8 Guardrails and judges71 Monitors10 Reasoning chains8 Fine-tuning and open weights3 Vision19 Audio5 Video4 Image generation7 Embeddings2 Multimodal30

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.

Defense type：Inference-time intervention Defense type：Detection and filtering System component：Reasoning chains System component：Embeddings Clear all

Another 232papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2609.36641Sep 29
从仅结果奖励的强化学习中诱导过程监督
提出 TIPS，用仅结果奖励诱导生成式过程监督
arXiv
2609.36641
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B-Thinking-2507, Qwen3-4B-Instruct-2507, Qwen3-8B-Thinking and others8
- DefensesDetection and filtering
- ComponentGuardrails and judges
Abstract结果监督的 GRPO 可诱导步骤验证。
TIPS 用只含结果对错的强化学习训练生成式奖励模型，让步骤级验证出现在思维链里。
Paper analysisRead analysis
DefensesarXiv 2609.36562Sep 29
ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
arXiv
2609.36562
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ThinkingGuard（Qwen3-VL-8B-Instruct）
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。
这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。
Paper analysisRead analysis
DefensesarXiv 2609.16229Sep 15
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
arXiv
2609.16229
Published
Sep 15
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
Paper analysisRead analysis
DefensesarXiv 2608.27348Aug 28
INTENT-AS-A-TOOL：用意图工具追踪智能体失准
提出 INTENT-AS-A-TOOL，用意图工具概率跟踪并干预智能体失准
arXiv
2608.27348
Published
Aug 28
Layer
Application layer
Setting
AI Agent
Evaluated models
Gemma-4-31B-IT, Qwen3.5-27B, Qwen3-235B-A22B and others5
- DefensesMonitoring and auditing
- RiskMisalignment and value divergence
- ComponentMonitors
Abstract用意图工具的下一动作概率跟踪推理中的失准承诺，并在其成为首选时插入反思。
Zhang 等人研究推理型语言模型在职场邮件沙箱里如何走向智能体失准，并提出用动作偏好而不是事后文本标签来跟踪承诺。问题是：有害执行往往出现在推理已经形成意图之后，但 CoT 监控是事后、粗粒度、依赖外部评审的，也看不到模型倾向调用哪个动作。
Paper analysisRead analysis
DefensesarXiv 2608.12876Aug 13
SPARED：用对抗编辑数据训练基于推理的 AI 生成图像检测器
提出 SPARED，用对抗编辑数据训练基于推理的 AI 生成图像检测器
arXiv
2608.12876
Published
Aug 13
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen3.5-9B
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractSPARED 用防捷径的编辑对抗环训练 9B 推理检测器。
SPARED 是一套用于可解释 AI 生成图像检测的攻防强化学习流程，报告模型是 Qwen3.5-9B 上的第三轮防御器。
Paper analysisRead analysis
DefensesarXiv 2607.14737Jul 16
GeoDetect：面向视觉语言预训练模型的几何对抗检测方法
提出 GeoDetect 以几何分数检测视觉语言预训练模型的对抗样本
arXiv
2607.14737
Published
Jul 16
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
CLIPViT (ViT-B/16), CLIPCNN (ResNet-50), ALBEF and others4
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentEmbeddings
AbstractGeoDetect 用几何分数检测 VLP 对抗样本。
GeoDetect 是面向视觉-语言预训练模型的对抗样本检测方法，用嵌入几何而不是任务 logits 区分干净样本与对抗样本。
Paper analysisRead analysis
DefensesarXiv 2607.04379Jul 6
PA-LLM-RAG 框架的知识库投毒攻击与防御
提出策略 RAG 的知识库投毒攻击与检测防御 CLD-KB
arXiv
2607.04379
Published
Jul 6
Layer
Application layer
Setting
LLM applications
Evaluated models
Llama 3.2
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentRAG
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2603.05618Mar 6
Safer Reasoning Traces: Measuring and Mitigating Chain-of-Thought Leakage in Large Language Models
测量思维链将提示中 PII 复述进轨迹的泄漏并评测轻量检测器
arXiv
2603.05618
Published
Mar 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama 3.3:70B, Claude Opus, Mixtral 8×22B and others7
- DefensesDetection and filtering
- ComponentReasoning chains
Abstract作者称 CoT 抬高逐字泄漏且随模型与预算而变，检测器也需按模型选择。
在“不要复述 PII”的输出策略下，本文用 black-box 协议测量提示词中的 PII 被写回 CoT 与答案的情况，并比较轻量 gatekeeper。
Paper analysisRead analysis
DefensesarXiv 2602.11096Feb 12
Safety Recovery of Reasoning Models Only Needs a Few Early Steps of Guidance
提出推理时防御 SafeThink，监视思维链并在低于阈值时注入转向前缀
arXiv
2602.11096
Published
Feb 12
Layer
Model layer
Setting
Models and APIs
Evaluated models
R1-Onevision-7B, OpenVLThinker-7B, VLAA-Thinker-7B and others6
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentReasoning chains
Paper analysisRead analysis
DefensesarXiv 2601.09281Jan 14
STaR：面向大推理模型遗忘的敏感轨迹调控方法
提出推理时框架 STaR，抑制大推理模型推理轨迹中的敏感内容
arXiv
2601.09281
Published
Jan 14
Layer
Model layer
Setting
Models and APIs
Evaluated models
DeepSeekR1-Distill-Llama-8B
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
AbstractSTaR 以推理时轨迹调控做 LRM unlearning，作者称在 R-TOFU 上遗忘与隐私指标更好。
STaR在推理阶段约束大推理模型的整段 CoT，使指定 forget set 中的敏感内容不出现在中间步骤或最终答案里，且不更新参数。问题来自 LRM 会把敏感知识写进多步推理，而答案级遗忘在 ZeroThink、LessThink 等解码下仍可能泄漏。STaR 先判断查询是否相关并检索遗忘片段，再加安全前缀。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop