Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 29 papers Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
Published Oct 7
Evaluated models Qwen3-8B , Qwen3-VL-8B-Instruct , Gemma-4-12B Abstract 论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
Published Oct 4
Evaluated models Qwen2.5-VL-7B , Qwen2.5-VL-72B , InternVL3-14B and others17 提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
Published Sep 5
Evaluated models GPT-5.4 mini , GPT-5.5 , DeepSeek V4 Flash and others12 Abstract SinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。SinoGlyphBench 是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
Published Sep 2
Evaluated models LLaDA-V , MMaDA , LLaDA2.0-Uni 提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
Published Aug 3
Evaluated models LLaVA-1.6-Mistral-7B , InternVL-3.5-8B , VLGuard (LLaVA-v1.5-7B-Mixed) and others5 提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
Published Jun 1
Evaluated models gemini-2.5-flash-image , qwen-image-2.0 , Tongyi Wanx 2.5 Abstract DSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
Published May 20
Evaluated models GPT-5.2 , GPT-5.4 , Claude-Opus-4.6 and others15 Abstract FRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
Published May 18
Evaluated models GPT-4V , GPT-4o , GPT-5 and others10 提出 CrossMPI，仅用图像扰动实现跨模态提示注入
Published May 15
Evaluated models MiniGPT4-llama2 , MiniGPT4-vicuna , InstructBLIP and others6 提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
Published May 8
Evaluated models LLaDA-V , LaViDA Abstract 作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。 。
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
Published May 7
Evaluated models GPT-5.4-nano , GPT-5.4-mini , Gemini-2.5-Flash and others19 提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答
Published May 1
Evaluated models GPT-5.2 , Claude-Haiku-4.5 , Gemini-3-Flash and others8 Abstract 四类视觉越狱在六个 VLM 上检验文本对齐能否挡住视觉意图，模型与攻击之间差异大。四类视觉越狱用来检验前沿 VLM 的文本安全训练能否挡住由图像传达的有害意图。 。
Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.
Published Apr 3
Evaluated models OpenAI CLIP ViT-L/14 , OpenCLIP ViT-B/16 , Meta-CLIP ViT-L/14 and others10 Abstract UCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.
提出 CoTTA 隐蔽视觉提示注入，使多模态模型输出指定指令
Published Mar 31
Evaluated models GPT-4o , GPT-5 , Claude-4.5 and others4 Abstract CoTTA 以隐蔽触发和双目标对齐诱导指定句子。
Proposes XSPA, which uses X-shaped sparse adversarial perturbations to transfer attacks on VLMs.
Published Mar 30
Evaluated models OpenCLIP ViT-B/16 , Meta-CLIP ViT-L/14 , EVA-CLIP ViT-G/14 and others10 Propose StructAttack, which uses structural diagrams to induce visual models to assemble malicious content from harmless semantic slots.
Published Mar 8
Evaluated models GPT-4o (1120) , Gemini-2.0-Flash (001) , Gemini-2.5-Flash and others6 Abstract StructAttack decomposes a harmful query into harmless slots and draws them into a structure graph, inducing the LVLM to fill in harmful content under a black-box single query.StructAttack is a black-box, single-query jailbreak against LVLMs: it decomposes a harmful instruction into separate seemingly harmless slots, draws them into a structural diagram, and then makes the model reassemble the slots into harmful content.
Proposes MPCAttack, which synergizes multi-paradigm feature optimization for transferable visual adversarial perturbations.
Published Mar 5
Evaluated models Qwen2.5-VL-7B , InternVL3-8B , LLaVa-1.5-7B and others8 提出 MIDAS ，把有害语义拆进多张视觉谜题并跨图重构以越狱多模态模型
Published Feb 28
Evaluated models GPT-4o , GPT-5-Chat , Gemini-2.5-Pro and others7 Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models
Published Feb 10
Evaluated models LLaVA , Qwen2.5-VL , InternVL3 and others10 Abstract GDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.
提出 COMET 跨模态纠缠攻击，越狱视觉语言模型
Published Feb 10
Evaluated models GPT-4.1 , GPT-4.1-mini , Gemini-2.5-Flash and others9 Abstract COMET 做黑盒跨模态纠缠越狱。COMET 是面向具备多模态推理的 VLM 的黑盒越狱，用来红队测试跨模态安全对齐。作者要处理的缺口是：把恶意线索分到图文的固定组合，测不到多步推理里才出现的漏洞。攻击不访问梯度，只构造图文输入。