Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 24 papers Another 233 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B , ColQwen3.5-4.5B , Tomoro-colqwen3-embed-4b and others13 提出 Secure-CUA，用动作事务约束计算机使用智能体的不可信影响
Published Oct 7
Evaluated models Claude Opus 5 , Gemini 3.8 Flash , GPT-5.6-Sol Abstract Secure-CUA 用每步事务约束不可信影响，良性 TSR 接近 Vanilla-CUA。Secure-CUA 要限制图形界面里不可信内容对 CUA 决策和 GUI 执行的影响，同时保留合法任务所需的不可信信息。
提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作
Published Oct 7
Evaluated models LLaVA-v1.5-13B , LLaVA-v1.6-34B , MiniCPM-o-8B and others6 Abstract 论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
Published Oct 1
Evaluated models Lumina-mGPT , Gemini 2.5 Flash Image Preview , CLIP ViT-B/16 and others5 提出 RECAST，本地改写图表与语音并做可逆数值映射以保护远程推理隐私
Published Oct 1 提出 Pictionary，将不可信文本渲染成图像以防御提示注入
Published Sep 29
Evaluated models Claude Opus 4.7 , Claude Haiku 4.5 , GPT-5.5 and others12 提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
Published Sep 28
Evaluated models GPT-5.6-sol , Kimi-K2.6 , Kimi-K3 and others6 Abstract 论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留
Published Sep 27
Evaluated models Qwen3-VL-2B , Qwen3-VL-4B , Qwen3-VL-8B and others6 Abstract IDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。
提出扩散潜空间地理扰动防御，抑制视觉语言模型泄露精确地理位置
Published Sep 18
Evaluated models GPT-4.1 , GPT-5 , Gemini 2.5 Pro and others5 提出 QPriv-VL，用问题引导剪枝降低分布式视觉问答的隐私泄露
Published Sep 14
Evaluated models LLaVA-1.5-7B , Llama-2 Abstract QPriv-VL 在切层前按问题相关度与 DINOv2 敏感度剪视觉 token，作者称能在约四成 token 下兼顾准确率与四类攻击。QPriv-VL 把问题引导的视觉 token 剪枝做成分布式 VQA 的客户端隐私防御，而不是只做集中式推理加速。
用 MMPIBench 评测多模态提示注入对 Agent 框架的影响
Published Sep 9
Evaluated models Claude Opus 4.8 , GPT-5.4 , Gemini 3.1 Pro and others6 Abstract 论文提出 MMPIBench 评测多模态提示注入对智能体的影响，发现模型主导行为、尝试远超完成，音频通道缺乏防护。
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
Published Sep 7
Evaluated models BERT-base , RoBERTa-base , T5-base and others6 Proposes SHAQ, which replaces document embeddings with shadow query embeddings to defend against embedding inversion.
Published Sep 4
Evaluated models GTR-T5 encoder , DPR Abstract SHAQ replaces document embeddings with shadow query embeddings.SHAQ is a defense against EIA for cloud vector databases: instead of directly modifying document embeddings, it replaces them with shadow query embeddings.
提出 Repeat-After-Me 自适应视觉提示注入，诱导 VLM 智能体执行指定任务
Published Sep 4
Evaluated models Claude-Opus-4.7 , GPT-5.5 , Gemini-3.1-Pro and others6 Abstract 论文提出了针对黑盒 VLM 的前缀诱导自适应视觉提示注入，在多款模型上诱发了工具调用与隐私泄露。
Proposes LeakageBench to evaluate page-level leakage of PII redaction in document images
Published Sep 2
Evaluated models Amazon Comprehend PII , GPT-5.5 , NVIDIA GLiNER PII and others13 提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
Published Jul 1
Evaluated models e5-small , e5-small-v2 , e5-base and others19 Abstract EIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。 。
提出 HazardArena 基准，用孪生场景评测 VLA 的语义安全
Published Apr 14
Evaluated models OpenVLA-OFT , π0 , NORA and others4 Abstract safe-only 微调提升良性执行，也提升匹配不安全孪生上的危险完成。HazardArena 评测 VLA 在运动要求不变时，能否因语义风险而停手。
Proposes out-of-process dual-channel comparison classification to intercept erroneous clicks by computer-use agents
Published Mar 16
Evaluated models multi-modal-embed-small Abstract Perception errors can be exploited by swapping screen pixels.The authors frame CUA's perception failure as a security vulnerability, visual confused deputy : the agent authorizes click(x,y) based on a misread screen, and the actual landing point differs from the element it believes it is clicking.
提出 LABSHIELD，评测科学实验室智能体的安全推理与规划
Published Mar 12
Evaluated models GPT-5.2 , GPT-o3 , GPT-o4-mini and others20 提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制
Published Feb 11
Evaluated models Gemini-3-Flash Abstract Aura mediates structured interactions via the Agent Kernel.Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants. .