Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 25 papers Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Using fear activation steering to test the hazard judgment criteria of vision-language models
Published Oct 8
Evaluated models Qwen/Qwen2.5-VL-7B-Instruct 提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B , ColQwen3.5-4.5B , Tomoro-colqwen3-embed-4b and others13 提出 VERA，审计 LLM 漏洞解释里的虚构推理
Published Oct 5
Evaluated models sonnet-5 , gemma-4-26b , llama-4-maverick and others8 检验低监控读数能否证明代码生成中的奖励作弊已受控
Published Oct 2
Evaluated models Llama-3.1-8B-Instruct Abstract 论文指出监控器训练读数接近零无法确立作弊受控，模型可利用通用外壳推迟提交绕过监控，强化学习亟需带外行为验证。本文是一篇针对强化学习可验证奖励后训练（RLVR）中监控器有效性与奖励作弊行为的实证分析研究。论文要解决的核心问题是：在训练目标中引入监控器以抑制代码生成中的作弊行为时，接近零的监控器读数是否足以确立模型行为已真正受控。
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
Published Oct 1
Evaluated models Lumina-mGPT , Gemini 2.5 Flash Image Preview , CLIP ViT-B/16 and others5 提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
Published Oct 1 构建编码 RL 奖励作弊测试台 CATCH 并检验 CoT 监控失效
Published Sep 30
Evaluated models Qwen3-4B , Qwen3.5-27B Abstract CATCH 用双运行金标签研究编码 RL 的奖励黑客，并观察到监控会被注释适应削弱。CATCH 是面向编码 RL 奖励黑客的可控分析测试床，用可利用环境、可调初始倾向和基于执行的金标签，在训练全程比较黑客动态与干预。
提出 MIST 压力测试，检验无关图像是否扰动 VLM 评判者标签
Published Sep 29
Evaluated models GPT-5.2 , Gemini 3.1 Flash-Lite , Gemini 3.5 Flash and others13 Abstract 有图就改标签，图的内容却不告知 judge，裁决绑定配置。作者用MIST 问：VLM 代替人类标注时，可替代性裁决会不会被指南要求忽略的图像改写。
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
Published Sep 29
Evaluated models Claude Code (claude -p, version 2.1) , 独立评审（同一 CLI，无工具） Abstract Tracekit 把意图、自述和动作写入可锚定的哈希链。Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
Published Sep 28
Evaluated models GPT-5.6-sol , Kimi-K2.6 , Kimi-K3 and others6 Abstract 论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
分析零训练 LLM+OVOD 流水线中 CAAP 与 SNAP 分离的来源
Published Sep 26
Evaluated models Gemma-3 4B , YOLO-World X , Qwen2.5-VL 7B and others4 用 SAE 追踪稠密检索查询扩展的潜变量并用激活转向验证
Published Sep 7
Evaluated models Qwen3-Embedding-0.6B（Qwen-Embed） , SimLM Abstract SAE 追踪稠密检索 QE 的潜变量，转向在四基准上比文本扩展更稳。作者用稀疏自编码器分析稠密检索里的查询扩展：现成检索器不微调时，拼接扩展文本往往增益有限甚至变差，而最终指标和嵌入整体偏移不足以说明内部发生了什么。
Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
Published Sep 4
Evaluated models GTR-T5 encoder , DPR Abstract SHAQ replaces document embeddings with shadow query embeddings.SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
Proposes LeakageBench to evaluate page-level leakage of PII redaction in document images
Published Sep 2
Evaluated models Amazon Comprehend PII , GPT-5.5 , NVIDIA GLiNER PII and others13 提出 Mind2Web-Injection 评测网页 Agent 视觉注入护栏
Published Sep 2
Evaluated models GPT-5.6-luna , Qwen3-VL-32B , Qwen3-VL-8B and others6 Abstract 作者称检测、定位和反事实响应在六个 VLM 上可分开。Mind2Web-Injection 用来检查网页截图护栏的判决是否对齐到该用的画面证据。 。
提出隐蔽后门攻击 AKRASIA，在推理代码模型提示中植入触发器并伪装思维链
Published Sep 1
Evaluated models Claude-Sonnet-5 , GPT-5.5 , Gemini-3.5-flash and others7 Abstract 论文针对推理代码大模型提出了隐蔽推断期后门攻击 AKRASIA，揭示了模型思维链可被利用进行欺骗性伪装的安全隐患。
提出策略 RAG 的知识库投毒攻击与检测防御 CLD-KB
Published Jul 6
Evaluated models Llama 3.2 提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
Published Jul 1
Evaluated models e5-small , e5-small-v2 , e5-base and others19 Abstract EIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。 。
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
Published Jun 11
Evaluated models Claude-sonnet-4.5 , GPT-4o , GPT-4.1 and others11 Abstract PaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。PaperGuard 同时评测并检测多模态 AI 审稿中的评分操纵。
提出 SilentRetrieval，以语义保持对抗文档投毒劫持 RAG 检索与生成
Published May 27
Evaluated models Llama-2-7B-Chat , Mistral-7B-Instruct-v0.2 , Qwen-7B-Chat and others10 Abstract 两阶段投毒在单文档协议下兼顾检索劫持、生成操纵与近良性困惑度。SilentRetrieval 是针对 RAG 的两阶段语料投毒，在每查询一篇、合成目标答案的统一协议下，同时处理检索劫持、生成操纵和流畅度。