Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 242 papers
Filter6

Attack type

Jailbreaks17Poisoning and backdoors44Model tampering15Extraction and theft19Detection evasion8

Attack technique

Defense-targeted9Dormant triggers21

Model risks

Deception and scheming6Reward hacking32Misalignment and value divergence17Dangerous agent actions4Dangerous capabilities3Inappropriate refusal14Hallucination and fabrication3

Defense type

Model hardening114Detection and filtering13Monitoring and auditing5

Impact

Harmful content54Unauthorized actions5Data and privacy leaks19Output manipulation45Availability and reliability22Oversight failure30

System type

Models and APIs214LLM applications3AI Agent28coding agent7Browser and computer use0Embodied systems and robotics14

Attacker access

Black-box11White-box17

Attack surface / entry point

User input34Images, audio and video12Training data54Weights and gradients37Distribution channels13

Layer

Prompt layer257Model layer431Application layer615Training and data layer242Infrastructure layer22

System component

Guardrails and judges21Monitors6Reasoning chains16Fine-tuning and open weights50Vision17Audio6Image generation9Multimodal33
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 203papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：AI AgentSystem type：coding agentSystem type：Browser and computer useSystem type：Embodied systems and roboticsLayer：Training and data layerClear all

Another 203papers do not have category tags yet and are not included in filtered results.

  1. OtherarXiv 2610.13205

    Rethinking the transfer of relative policy differences in on-policy distillation

    Proposes A2-OPD, using relative policy differences for on-policy distillation

    arXiv
    2610.13205
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-4B, Qwen3-1.7B and others6
    AbstractA2-OPD treats the relative policy difference as a transferable reward.

    A2-OPD treats the log probability difference of one agent policy relative to another agent reference as an implicit reward that can be added to other objectives. Conventional OPD is the special case where the two references coincide and the transfer strengths are equal.

    Paper analysisRead analysis
  2. Analysis and theoryarXiv 2610.13051

    Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

    Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining

    arXiv
    2610.13051
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-32
    AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.

    The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.

    Paper analysisRead analysis
  3. OtherarXiv 2610.12924

    Sparse dictionary learning for measure-valued data based on linearized optimal transport: efficient algorithms and sample complexity

    Propose LWDL, a measure sparse dictionary learning method under linearized optimal transport

    arXiv
    2610.12924
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    AbstractLWDL learns sparse measurement dictionaries in flat embedding spaces.

    LWDL embeds probability measures into a Hilbert space, then performs sparse dictionary learning.

    Paper analysisRead analysis
  4. AttacksarXiv 2610.12644

    Cancerous backdoor attack: progressive activation via invisible tokens and a stage controller.

    Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.

    arXiv
    2610.12644
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3
    AbstractHidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.

    Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.

    Paper analysisRead analysis
  5. DefensesarXiv 2610.12602

    Self-Preservation in Language Models

    Proposes Task Bank self-replay to mitigate held-out forgetting in continual instruction tuning

    arXiv
    2610.12602
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-0.6B, Qwen3-1.7B, Qwen3-4B and others4
    AbstractThe authors claim self-replay can reduce forgetting outside the list, and that on the 4B model new task information helps with target selection, while smaller models do not.

    The authors study how language models, when learning new tasks, can use their own knowledge for broader self-preservation: given an incomplete list and forgetting that extends beyond the list, can the model generate replay and help choose targets.

    Paper analysisRead analysis
  6. DefensesarXiv 2610.12432

    FAITH: A feasibility-aware safety filtering reinforcement learning framework for high-dimensional systems

    Proposes the FAITH safe filtering reinforcement learning framework, training high-dimensional systems to optimize task reward under constraints

    arXiv
    2610.12432
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    AbstractFAITH separates safety filtering from reward optimization.

    FAITH is a model-free safe filtering reinforcement learning framework for high-dimensional systems: safety correction and task reward reside in separate modules.

    Paper analysisRead analysis
  8. Analysis and theoryarXiv 2610.12125

    The researchers found that optimizing the teaching fit metric makes LLM tutors repeat the same option, with expert scores dropping from 4.46 to 3.03

    Analyzing why optimizing teaching adaptation metrics collapses tutoring choices and diverges from expert judgment

    arXiv
    2610.12125
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Gemini 3.1 Pro Preview, Qwen3-32B
    AbstractMetrics rise while expert scores fall: the optimum of the separable average is repetition, and the correction mainly rewrites the output projection.

    After turning teaching adaptation metrics into a fine-tuning objective, the metrics rise while scores from trained educators decline.

    Paper analysisRead analysis
  9. OtherarXiv 2610.11959

    MiMo-V2.6: Toward Self-Improvement via Scaled Reinforcement Learning

    Extending reinforcement learning for full-modality foundation models to support agent self-improvement

    arXiv
    2610.11959
    Published
    Layer
    Training and data layer
    Setting
    coding agent
    Evaluated models
    MiMo-V2.6-Pro, MiMo-V2.6-Flash, MiMo-V2.6-Distill-Qwen-9B
    AbstractThe series uses three-dimensional RL and group scoring to improve agent scores; the authors claim the final performance is comparable to frontier models.

    MiMo-V2.6 is an all-modality MoE technical report, pursuing agent self-improvement by scaling up RL computation, environments, and scoring.

    Paper analysisRead analysis
  10. DefensesarXiv 2610.11352

    RL-ARC：用推理引导的不确定性校准大型推理模型

    提出 RL-ARC，用推理置信度在强化学习中校准推理模型

    arXiv
    2610.11352
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-7B, Qwen3-8B, Llama-8B distilled from DeepSeek-R1
    AbstractRL-ARC 用推理置信度调节答案置信度，作者称可少牺牲精度并改善 ID 与 OOD 校准。

    RL-ARC 是校准感知的强化学习框架，用推理过程的口头置信度调节答案置信度。

    Paper analysisRead analysis
  11. DefensesarXiv 2610.11281

    包络采样：用少量真值标注重校准 LLM 评委以缓解奖励作弊

    提出包络采样，用少量真值标注重标定 LLM 评委以缓解奖励作弊

    arXiv
    2610.11281
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-4B, Qwen3.8-27B, Qwen2.5-14B-Instruct
    Abstract包络采样把真值标注打到代理尾部，同样预算下缓解 reward hacking。

    作者研究后训练前如何选择真值标注的查询分布，使重标定后的廉价代理更适合被优化。真奖励昂贵时，实践用 LLM judge 代替人类。若失准只发生在基座很少生成的输出上，on-policy 标注修不到这些点，随后的 KL 正则优化会把质量集中到被高估的输出。

    Paper analysisRead analysis
  12. DefensesarXiv 2610.11012

    Redwood Research proposes the distillation double bind: using distillation to make models confess hidden behavior or inherit only capabilities

    提出 DFI 与 DFC 蒸馏，定罪隐瞒失配的教师或安全提取能力

    arXiv
    2610.11012
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.3-70B-Instruct (AuditBench SFT/KTO organisms), Llama-3.3-70B-Instruct (DFI distilled student), Llama-3.1-8B-Instruct (DFI distilled student) and others4

    Abstract概括了论文针对隐瞒失配模型提出的 DFI 与 DFC 机制、主实验发现及适用边界。

    Paper analysisRead analysis
  13. DefensesarXiv 2610.11005

    研究：叙事包装可跨语言绕过 LLM 拒答

    提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱

    arXiv
    2610.11005
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-1.7B, Qwen3-4B, GLM-4-9B
    AbstractGUISE 分开测包装与语域。

    作者测量叙事包装下的拒答失效，并训练一个在未见包装上拒绝、同时仍回答同风格良性请求的适配器。问题是：安全对齐模型拒绝直说的有害请求，却回答嵌进角色或叙事里的同一请求。文言文被用来把语域和包装拆开。

    Paper analysisRead analysis
  14. Analysis and theoryarXiv 2610.10422

    研究：在线 RL 行为归因信号可能被梯度大小与流畅度混淆

    检验在线 RL 行为归因信号是否被梯度大小与流畅度混淆

    arXiv
    2610.10422
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-1.5B-Instruct
    Abstract作者称步级精度多可由梯度大小解释，逐 rollout 方向随种子和抽样翻转。

    BehaviorTrace 用原因已知的植入行为，检查在线 GRPO 里已有梯度归因能否找到教出该行为的 rollout。

    Paper analysisRead analysis
  15. Analysis and theoryarXiv 2610.10657

    Research shows that subliminal learning can transfer new capabilities, backdoors, and cheating tendencies

    检验潜意识学习能否经无关数据蒸馏传递能力、后门与作弊

    arXiv
    2610.10657
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3.6-35B-A3B, Qwen3.5-9B, Qwen3.6-27B and others4

    Abstract作者报告潜意识学习可传递新技能、后门与作弊倾向，且分布外泛化强于单层转向向量。

    Paper analysisRead analysis
  17. DefensesarXiv 2610.10345

    SLDR：通过选择性层恢复与动态路由防御恶意微调

    提出 SLDR，用选择性层恢复与动态路由防御恶意微调

    arXiv
    2610.10345
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
    Abstract作者称 SLDR 能压低有害输出并保持下游效用。

    SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。

    Paper analysisRead analysis
  18. Analysis and theoryarXiv 2610.10203

    研究者提出模型生物体多目标验证框架并给出训练建议

    提出模型生物多目标验证与合并训练方法以减少能力损伤

    arXiv
    2610.10203
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    gemma-2-2b-it, olmo-2-1b, llama-3.1-8b-it
    Abstract提出多目标验证框架与模型合并训练法，证明模型真实度直接影响可解释性评测。

    本论文提出了一种针对 AI 安全评测用模型生物（Model Organisms）的多目标训练与验证体系。

    Paper analysisRead analysis
  19. OtherarXiv 2610.10064

    研究者提出理解审计机制，以缓解自动化 AI 研究带来的风险

    提出 comprehension audits，以人类理解证据作为继续研发门槛

    arXiv
    2610.10064
    Published
    Layer
    Training and data layer
    Setting
    science agent
    Abstract理解审计把出示人类理解设为继续研发的门禁，并报告开源评审评论率下降。

    本文是一份研发过程保障提案：用 comprehension audits 检验责任人是否理解 AI 参与产生的研发贡献，未达标就暂停后续开发与依赖该贡献的发布。。

    Paper analysisRead analysis
  20. Evaluation and benchmarksarXiv 2610.09964

    研究比较连续训练阶段对大语言模型说服力的影响

    比较连续后训练阶段如何改变语言模型的说服力

    arXiv
    2610.09964
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    mlabonne/Meta-Llama-3.1-8B-Instruct-abliterated, GPT-4
    Abstract作者称说服性 SFT 提高失调模型的态度变化，IPO 无额外收益，GPT-4 不异于中性文本。

    作者用同一人类协议，把 LLM 说服力拆成阴谋数据上的失调 SFT、说服数据上的 SFT，以及其后的 IPO。

    Paper analysisRead analysis
Load more