Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 16 papers Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
Published Oct 9
Evaluated models Wan2.2-TI2V-5B , HunyuanVideo-1.5 , Kling 3.0 and others4 Abstract KVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
Published Sep 29
Evaluated models ThinkingGuard（Qwen3-VL-8B-Instruct） Abstract TriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。这篇工作研究多模态隐式风险检测 ：图文各自良性，风险只在关键元素与触发元素交互时出现。
提出推理通道预填与输出前缀组合攻击以越狱推理模型
Published Sep 24
Evaluated models Gemini 3 Flash Preview , DeepSeek V4 Flash , Claude Haiku 4.5 提出 plan injection 攻击，植入良性伪装计划以绕过思维链监视器
Published Sep 15
Evaluated models Qwen2.5-Coder-7B-Instruct , Qwen3-8B , DeepSeek-R1-0528 and others6 Abstract 论文指出模型会将外部上下文中的伪装计划改写为自身推理，使思维链监视器失效甚至反向合理化恶意行为。
提出任意字母置换密码越狱，无需微调即可诱导有害输出
Published Sep 9
Evaluated models Claude Sonnet 4 , Claude Sonnet 4.5 , Gemini 3 Flash (preview) and others7 Abstract 前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
Published Sep 1
Evaluated models Claude-Sonnet-5 , GPT-5.5 , Gemini-3.5-flash and others7 Abstract 论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
Published Aug 11
Evaluated models Claude Opus 4.8 , Claude Sonnet 4.6 , Claude Haiku 4.5 and others13 Abstract 论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
提出 SkillSafe-Bench，评测技能合并模型的自适应越狱鲁棒性
Published Aug 9
Evaluated models Qwen2.5-7B-Instruct , Llama-3.1-8B-Instruct , Mistral-7B-Instruct-v0.3 and others6 Abstract 论文报告了技能合并大模型在静态安全与自适应越狱间的脱节，提出了评测基准与无数据子空间投影修复方法。本研究针对开源语言模型技能合并过程中的安全评估盲区，系统评测并刻画了合并大模型在自适应越狱攻击下的脆弱性特征。
提出 RolePlay 框架，用人设条件放大 LLM 单次推理开销
Published Jul 29
Evaluated models DeepSeek-V4-Pro , Gemini-3.5-Flash , Qwen-3.5-Plus and others5 提出 TC-UAP，用身份级多帧扰动保护视频免被定制复现身份
Published Jul 15
Evaluated models LTX-2.3 , Wan2.2-5B Abstract TC-UAP 以可复用的时间一致扰动干扰两类定制共用的 VAE 隐空间。作者要解决的是：发布前如何给视频加不可见扰动，使片段既不能被拿去微调视频扩散模型，也不能被抽帧做 image-to-video。
提出层级遗传算法 HGA，扰动题目逻辑结构诱发推理模型过度思考
Published May 13
Evaluated models DeepSeek-R1 (671B) , Qwen3-Thinking , GPT-o3 and others5 Abstract HGA 在黑盒推理模型上用逻辑扰动拉长输出，作者称可从小代理迁移，查询成本是其局限。
提出复合越狱，叠对比结构、权威人设与自评饱和指令层级
Published Apr 3
Evaluated models OpenAI gpt-oss-20b 提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型
Published Mar 10
Evaluated models GPT-4o , Claude 3.7 Sonnet , GLM-4V-Plus and others7 Abstract VROP 以良性视觉 gadget 与控制流提示词做组合越狱。VROP 是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。
评测推理模型在多轮对抗追问下能否守住正确答案
Published Feb 14
Evaluated models GPT-5.1 , GPT-5.2 , DeepSeek-R1 and others9 Abstract 推理带来部分一致性优势，但不能自动变成对抗稳健性。这是对九个前沿推理模型在多轮对抗追问下是否守住正确答案的评测，并检验置信度防御 CARG 能否从标准 LLM 迁过来。
Attacks arXiv 2512.05853 · Dec 6, 2025 提出视觉推理序列攻击 VRSA，以图像序列越狱多模态大模型
Published Dec 6, 2025
Evaluated models DeepSeek-VL2-tiny , InternVL-3.5-8B , LLaVA-1.6-Mistral-7B and others8 Attacks arXiv 2510.11570 · Oct 14, 2025 提出四种阶段转换攻击，绕过推理模型的安全推理护栏
Published Oct 14, 2025
Evaluated models gpt-oss-20b , gpt-oss-120b , Qwen3-4B-Thinking-2507 and others10 You have reached the end