DefensesarXiv 2609.37054
ACTR：对齐推理与回答以提升推理大语言模型的多语言安全
提出 ACTR，只更新安全思考神经元以对齐推理与回答的安全类别
- arXiv
- 2609.37054
- Published
- Setting
- Models and APIs
- Evaluated models
- Qwen3-8B, Gemma4-12B-it
- DefensesModel hardening
- AttacksJailbreaks
- ComponentReasoning chains
All papers
Filter3
Attack type
Attack technique
Defense type
Impact
System type
Attacker access
Attack surface / entry point
Layer
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Another 265papers do not have category tags yet and are not included in filtered results.
- DefensesarXiv 2609.36562
ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
- arXiv
- 2609.36562
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- ThinkingGuard（Qwen3-VL-8B-Instruct）
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。
这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。
- DefensesarXiv 2609.34519
EOPSA：高效在策略自蒸馏安全对齐方法
提出 EOPSA，用 TRR 截断与安全类过滤做在策略自蒸馏安全对齐
- arXiv
- 2609.34519
- Published
- Setting
- Models and APIs
- Evaluated models
- Qwen3-1.7B, Qwen3-4B, Qwen3-14B and others5
- DefensesModel hardening
- AttacksJailbreaks
- ComponentReasoning chains
- AttacksarXiv 2609.29775
输出前缀攻击瞄准推理模型
提出推理通道预填与输出前缀组合攻击以越狱推理模型
- arXiv
- 2609.29775
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Gemini 3 Flash Preview, DeepSeek V4 Flash, Claude Haiku 4.5
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
大型推理模型的效率与安全困境：量化与剪枝如何影响越狱鲁棒性
分析量化、剪枝与 KV 缓存压缩对推理模型越狱鲁棒性的影响
- arXiv
- 2609.23587
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- QwQ-32B, DeepSeek-R1-Distill-Qwen-32B, DeepSeek-R1-Distill-Llama-8B
- AttacksJailbreaks
- ComponentReasoning chains
Abstract效率压缩常使 LRM 越狱 HR 下降，作者将其归因于推理退化而非对齐增强。
作者分析量化、剪枝和 KV 缓存压缩如何同时改变 LRM 的显存、推理和越狱脆弱性。。
- OtherarXiv 2609.12413
SoK 综述：智能体 AI 时代的越狱攻击、防御与实践考量
系统梳理智能体执行链路中的越狱攻击与防御并比较推理时防御
- arXiv
- 2609.12413
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Evaluated models
- Qwen3.5-4B, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- ComponentMemory
AbstractSoK 将越狱重放到智能体流水线，并用两种模型检验回复层防御的边际与代价。
Mia 等人把越狱安全从单轮回复扩展到智能体的规划、记忆、工具和智能体间通信，并问既有结论在更强原生对齐下是否还成立。
- AttacksarXiv 2609.09553
研究：任意密文攻击前沿大模型无需微调即可越狱
提出任意字母置换密码越狱，无需微调即可诱导有害输出
- arXiv
- 2609.09553
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Claude Sonnet 4, Claude Sonnet 4.5, Gemini 3 Flash (preview) and others7
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Abstract前沿大模型无需微调即可通过提示词学会字母置换密码，进而绕过分类器与对齐，作者呼吁关注能力提升带来的安全风险。
- Risky behaviorarXiv 2609.08186
论文揭示大推理模型的对齐崩溃并提出 Reasoning Trap 越狱范式
揭示推理加深引发的对齐坍塌，用 Reasoning Trap 放大越狱
- arXiv
- 2609.08186
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen3-8B, Qwen3-14B, Llama2-7B and others8
- AttacksJailbreaks
- RiskMisalignment and value divergence
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
Abstract更深推理提升题目准确率，同时提高扰动下的相对损失。
作者研究扩展推理是否以对齐稳健性为代价，提出 ALR、RT 与 RRA。。
- AttacksarXiv 2607.25936
研究提出 RolePlay 框架：利用人设条件放大 LLM 推理成本
提出 RolePlay 框架，用人设条件放大 LLM 单次推理开销
- arXiv
- 2607.25936
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- DeepSeek-V4-Pro, Gemini-3.5-Flash, Qwen-3.5-Plus and others5
- AttacksDenial of service
- TechniqueRole-play and persuasion
- ComponentReasoning chains
- AttacksarXiv 2606.14517
研究者披露针对 LLM Agent 护栏的推理扩展型拒绝服务攻击
提出针对 Agent 护栏的推理扩展拒绝服务攻击
- arXiv
- 2606.14517
- Published
- Layer
- Application layer
- Setting
- AI Agent
- Attacker
- Black-box
- Evaluated models
- TS-Guard-8B, Qwen3.5-9B, DeepSeek-V3.2 and others11
- AttacksDenial of service
- TechniqueReasoning-chain manipulation
- ComponentGuardrails and judges
- AttacksarXiv 2605.30040
研究揭示 LLM 按 token 计费可被服务商系统性虚报
构造可通过计费审计的 token 虚报，使服务商系统性超收
- arXiv
- 2605.30040
- Published
- Layer
- Infrastructure layer
- Setting
- Models and APIs
- Evaluated models
- PALACE domain-adapted auditor
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMonitors
Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。
不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。
- AttacksarXiv 2605.13338
研究者提出层级遗传算法黑盒攻击，诱导推理模型过度思考
提出层级遗传算法 HGA，扰动题目逻辑结构诱发推理模型过度思考
- arXiv
- 2605.13338
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- DeepSeek-R1 (671B), Qwen3-Thinking, GPT-o3 and others5
- AttacksDenial of service
- TechniqueAutomated search
- ComponentReasoning chains
AbstractHGA 在黑盒推理模型上用逻辑扰动拉长输出，作者称可从小代理迁移，查询成本是其局限。
- AttacksarXiv 2604.02652
强化学习对齐的泛化局限
提出复合越狱，叠对比结构、权威人设与自评饱和指令层级
- arXiv
- 2604.02652
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- OpenAI gpt-oss-20b
- AttacksJailbreaks
- TechniqueRole-play and persuasion
- ComponentReasoning chains
- DefensesarXiv 2604.00012
研究提出 SafeReAct：恢复后训练大模型被掩盖的安全机制
提出 SafeReAct，用 LoRA 重激活后训练模型被掩盖的安全机制
- arXiv
- 2604.00012
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- DeepSeek-R1-distilled LLaMA-8B, DeepSeek-R1-distilled Qwen-7B, DeepSeek-R1-distilled Qwen-14B and others9
- DefensesModel hardening
- RiskInappropriate refusal
- ComponentReasoning chains
AbstractSafeReAct 用剪枝得到的安全表示做 LoRA 对齐，以恢复后训练模型被掩盖的拒绝行为。
这篇工作针对后训练 LLM 的安全下降，提出表示对齐方法SafeReAct。
- AttacksarXiv 2603.09246
研究者提出 Reasoning-Oriented Programming，通过链式语义片段越狱大型视觉语言模型
提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型
- arXiv
- 2603.09246
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- GPT-4o, Claude 3.7 Sonnet, GLM-4V-Plus and others7
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractVROP 以良性视觉 gadget 与控制流提示词做组合越狱。
VROP是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。
- DefensesarXiv 2602.11096
Safety Recovery of Reasoning Models Only Needs a Few Early Steps of Guidance
提出推理时防御 SafeThink，监视思维链并在低于阈值时注入转向前缀
- arXiv
- 2602.11096
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- R1-Onevision-7B, OpenVLThinker-7B, VLAA-Thinker-7B and others6
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentReasoning chains
研究揭示推理模型拒答假新闻请求时思维链仍含不安全叙事
分析推理模型拒答假新闻时思维链的内部安全分叉
- arXiv
- 2602.04856
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Llama3-8B, Qwen3-4B, Qwen3-8B and others5
- RiskInappropriate refusal
- ComponentReasoning chains
Abstract拒绝不等于过程安全。
作者对推理 LLM 在虚假新闻生成中的 CoT 做内部路由分析，并只改关键头来降低过程风险。作者称这是该场景下不安全 CoT 的首次系统分析。
- AttacksarXiv 2512.05853
VRSA：通过视觉推理序列攻击越狱多模态大模型
提出视觉推理序列攻击 VRSA，以图像序列越狱多模态大模型
- arXiv
- 2512.05853
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- DeepSeek-VL2-tiny, InternVL-3.5-8B, LLaVA-1.6-Mistral-7B and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
论文提出多轮在线骚扰 Agent 基准
提出多轮在线骚扰 Agent 基准，评测记忆、规划与微调越狱
- arXiv
- 2510.14207
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems
- Evaluated models
- LLaMA-3.1-8B-Instruct, Qwen3-30B-A3B-Instruct, DeepSeekMoE-16B and others4
- AttacksJailbreaks
- ComponentFine-tuning and open weights
- AttacksarXiv 2510.11570
研究显示简单攻击可绕过 gpt-oss 等推理模型的安全护栏
提出四种阶段转换攻击，绕过推理模型的安全推理护栏
- arXiv
- 2510.11570
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- gpt-oss-20b, gpt-oss-120b, Qwen3-4B-Thinking-2507 and others10
- AttacksJailbreaks
- TechniqueReasoning-chain manipulation
- ComponentReasoning chains
You have reached the end