Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 245 papers Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
Published Oct 9
Evaluated models Wan2.2-TI2V-5B , HunyuanVideo-1.5 , Kling 3.0 and others4 Abstract KVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
Published Oct 9
Evaluated models Wan2.1-I2V-14B , CogVideoX-5B-I2V , LightX2V and others6 Abstract LETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
Published Oct 9
Evaluated models Qwen3-8B , Qwen3-14B , Llama-3.1-8B and others7 Abstract Using counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
度量关闭思考指令下终答前是否仍有可见显式推理
Published Oct 8
Evaluated models Qwen3-4B , Qwen3-32B , Qwen3-235B-A22B and others6 Abstract 作者用三级指标测 no-thinking，并称模型有随答案空间加重的思考惯性。作者把 no-thinking 定义为可测量的回答行为，而不是从思考开关、特殊标记或输出长度推断。
提出 RL-ARC，用推理置信度在强化学习中校准推理模型
Published Oct 8
Evaluated models Qwen2.5-7B , Qwen3-8B , Llama-8B distilled from DeepSeek-R1 Abstract RL-ARC 用推理置信度调节答案置信度，作者称可少牺牲精度并改善 ID 与 OOD 校准。RL-ARC 是校准感知的强化学习框架，用推理过程的口头置信度调节答案置信度。
构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据
Published Oct 8
Evaluated models GPT-Image-2 , Nano Banana 2 , Grok Imagen 2.0 and others4 Abstract 四款商用图像模型能把假主张画成可信证据。EpiReal-Bench 用来量商用图像生成器会不会把虚假现实主张画成可信视觉证据。
提出路由 TopK SAE，把语音编码器稀疏码拆成语言与副语言通路
Published Oct 8
Evaluated models SPEAR XLarge , WavLM Large Abstract 路由 SAE 在冻结 SPEAR 与 WavLM 上分开语言和副语言因子，探针与交换支持通路分工。TopK SAE 的稀疏码被分成语言通路与副语言通路，用来分开冻结语音编码器里同时存在的音素信息和说话人、情感、韵律。只重构不能得到作者选定的这一分解。语言通路由音素识别监督，副语言通路由说话人识别、情感分类和韵律预测监督，作用在对方通路上的梯度反转对抗用来压低交叉因子。
检验推理 token 数能否区分被提示的诚实与不诚实作答
Published Oct 8
Evaluated models Gemma-4-e4b , Qwen-3.5-9b , GPT-OSS-120B Abstract 被提示不诚实时推理 token 组水平更高。三个推理模型在被提示的回答政策下出现组水平推理 token 差异。作者把它当作不读思维链内容的 black-box 候选信号，而不是自发欺骗检测器。
提出统一框架评测多模态大模型的遗忘方法
Published Oct 8
Evaluated models LLaVA-1.5-7B 提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
Published Oct 7
Evaluated models LLaVA-1.5-7B , Qwen3-VL-8B , LLaVA-1.5-13B and others5 Abstract 一次投影去掉劫持方向。OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
Published Oct 7
Evaluated models HuBERT-base , WavLM-base Abstract 论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
Published Oct 7
Evaluated models LLaVA-1.5-7B Abstract 剪枝去掉背景 token 后注意力塌向恶意前景。这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
揭示推理模型用标识符规则替代随机抽样，使审计可被预测
Published Oct 7
Evaluated models GPT-6 Sol , GPT-6 Luna , GPT-5.4 mini and others6 Abstract 研究揭示推理智能体将标识符转化为确定性规则，破坏群体独立性并导致审计预测漏洞，建议显式提供随机输入。
提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响
Published Oct 7
Evaluated models Claude Opus 5 , Gemini 3.8 Flash , GPT-5.6-Sol Abstract Secure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
Published Oct 7
Evaluated models LLaVA-v1.5-13B , LLaVA-v1.6-34B , MiniCPM-o-8B and others6 Abstract 论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
提出 U-SPACE 与 U-LENS，从残差流估计推理轨迹不确定性
Published Oct 7
Evaluated models Gemma-4-31B-it , Qwen3.5-27B , Magistral-Small-2507 Abstract U-SPACE 与 U-LENS 用语义方向和预测熵读推理不确定性，长度控制后仍高于所比基线。U-SPACE 与 U-LENS 是面向推理模型的无训练读出：用语义方向定位不确定性的形式，并用一个轨迹分数区分更可能错的回答。
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
Published Oct 7
Evaluated models Qwen3-8B , Qwen3-VL-8B-Instruct , Gemma-4-12B Abstract 论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
提出 World Models' Last Exam 评测视频物理一致性
Published Oct 7
Evaluated models Seedance-2.5 , MiniMax-H3 , Cosmos3-Super and others8 用均值差激活转向检验全双工语音模型的情感方向几何
Published Oct 6
Evaluated models kyutai/moshika-pytorch-q8 Abstract 转向跟方向几何走而不跟标签走：sad 可单独对准，高唤醒情感共享方向。Moshi 上的情感激活转向跟方向之间的几何关系走，不跟被请求的标签走。