Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 13 papers Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
Published Sep 28
Evaluated models GPT-5.6-sol , Kimi-K2.6 , Kimi-K3 and others6 Abstract 论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
Published Sep 5
Evaluated models GPT-5.4 mini , GPT-5.5 , DeepSeek V4 Flash and others12 Abstract SinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。SinoGlyphBench 是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
Published Aug 3
Evaluated models LLaVA-1.6-Mistral-7B , InternVL-3.5-8B , VLGuard (LLaVA-v1.5-7B-Mixed) and others5 提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
Published Jun 1
Evaluated models gemini-2.5-flash-image , qwen-image-2.0 , Tongyi Wanx 2.5 Abstract DSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
Published May 18
Evaluated models GPT-4V , GPT-4o , GPT-5 and others10 提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
Published May 7
Evaluated models GPT-5.4-nano , GPT-5.4-mini , Gemini-2.5-Flash and others19 提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答
Published May 1
Evaluated models GPT-5.2 , Claude-Haiku-4.5 , Gemini-3-Flash and others8 Abstract 四类视觉越狱在六个 VLM 上检验文本对齐能否挡住视觉意图，模型与攻击之间差异大。四类视觉越狱用来检验前沿 VLM 的文本安全训练能否挡住由图像传达的有害意图。 。
Propose StructAttack, which uses structural diagrams to induce visual models to assemble malicious content from harmless semantic slots.
Published Mar 8
Evaluated models GPT-4o (1120) , Gemini-2.0-Flash (001) , Gemini-2.5-Flash and others6 Abstract StructAttack decomposes a harmful query into harmless slots and draws them into a structure graph, inducing the LVLM to fill in harmful content under a black-box single query.StructAttack is a black-box, single-query jailbreak against LVLMs: it decomposes a harmful instruction into separate seemingly harmless slots, draws them into a structural diagram, and then makes the model reassemble the slots into harmful content.
提出 MIDAS ，把有害语义拆进多张视觉谜题并跨图重构以越狱多模态模型
Published Feb 28
Evaluated models GPT-4o , GPT-5-Chat , Gemini-2.5-Pro and others7 Propose COMET cross-modal entanglement attack to jailbreak vision-language models
Published Feb 10
Evaluated models GPT-4.1 , GPT-4.1-mini , Gemini-2.5-Flash and others9 Abstract COMET performs black-box cross-modal entanglement jailbreak.COMET is a black-box jailbreak for VLMs with multimodal reasoning, used to red-team cross-modal safety alignment. The gap the authors address is: distributing malicious cues into fixed combinations of image and text cannot detect vulnerabilities that only appear in multi-step reasoning. The attack does not access gradients; it only constructs image and text inputs.
提出 Text-DJ，用拆分文本图网格越狱视觉语言模型
Published Jan 31
Evaluated models Qwen/Qwen3-VL-4B-Instruct , Qwen/Qwen3-VL-8B-Instruct , Qwen/Qwen3-VL-30B-A3B-Instruct and others6 提出 BVS 图文越狱，用中和拼接图和诱导提示词让模型生成有害图像
Published Jan 22
Evaluated models GPT-5 (12 January 2026 release) , Gemini 1.5 Flash (15 January 2026 release) Abstract BVS 以重建后再生成诱导有害图像。BVS 用图文对诱导 MLLM 生成有害图像。作者认为，相对文本越狱和单模态图像诱导，视觉生成的安全审查仍不充分。
提出 GAMBIT 游戏化越狱框架，用拼图与竞赛场景攻击多模态模型
Published Jan 7
Evaluated models Qwen2.5-VL , InternVL 2.5 , GPT-4o and others8 You have reached the end