Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 103 papers
Filter4

Attack type

Jailbreaks8Poisoning and backdoors5Extraction and theft5

Model risks

Deception and scheming4Reward hacking6Misalignment and value divergence4Dangerous agent actions4Inappropriate refusal4Bias and discrimination6

Defense type

Detection and filtering3

Impact

Harmful content15Unauthorized actions4Data and privacy leaks3Output manipulation16Availability and reliability6Oversight failure10

System type

Models and APIs74LLM applications12AI Agent29coding agent6Browser and computer use0Multi-agent systems6

Attack surface / entry point

User input13Images, audio and video3Training data5

Layer

Prompt layer13Model layer35Application layer27Training and data layer25Infrastructure layer3

System component

MCP and skills4Guardrails and judges6Monitors3Reasoning chains13Permissions and sandboxing3Fine-tuning and open weights4Vision3Multimodal5
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 254papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：AI AgentSystem type：coding agentSystem type：Browser and computer useClear all

Another 254papers do not have category tags yet and are not included in filtered results.

  1. Analysis and theoryarXiv 2610.13051

    Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

    Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining

    arXiv
    2610.13051
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-32
    AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.

    The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.

    Paper analysisRead analysis
  2. Analysis and theoryarXiv 2610.12436

    The study proposes an ecological theory of AI agent populations: collaboration brings a critical scale for takeoff.

    An ecological model is established for a population of mismatched agents, showing that collaboration produces a critical takeoff scale.

    arXiv
    2610.12436
    Published
    Layer
    Application layer
    Setting
    Multi-agent systems
    AbstractThe authors say that collaboration changes takeoff from an individual capability threshold to a population threshold, so small-population evaluations are insufficient.

    The authors use the ecological strong Allee effect to discuss whether a mismatched agent population can take off when individual capabilities remain unchanged..

    Paper analysisRead analysis
  3. Analysis and theoryarXiv 2610.12409

    The researchers conduct a psychometric review of HELM Safety and HarmBench, questioning whether their scores can represent a single attribute

    Auditing whether HarmBench scores can represent a single harmful refusal attribute

    arXiv
    2610.12409
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    AbstractThe authors claim HarmBench does not correspond to a single harmful refusal, and behaviors should be separated when comparing models.

    This is a construct validity audit of HarmBench in HELM Safety, examining whether harmful refusal can be read as a single attribute when interpreting scores.

    Paper analysisRead analysis
  4. Analysis and theoryarXiv 2610.12313

    The study tests the sensitivity of five large-model compliance systems to perturbations of regulatory rules.

    Diagnose whether compliance system rulings change with perturbations to regulatory rules

    arXiv
    2610.12313
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.3-70B-Instruct, Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct and others5
    AbstractAcross five models, many correct verdicts are largely unchanged by deleting or replacing negation rules.

    Use behavioral counterfactuals and activation probes to audit whether compliance rulings rely on the given rules. The authors aim to separate two kinds of seemingly identical correct rulings: those that use the given rules, and those obtained from case surface features or training patterns.

    Paper analysisRead analysis
  5. Analysis and theoryarXiv 2610.12125

    The researchers found that optimizing the teaching fit metric makes LLM tutors repeat the same option, with expert scores dropping from 4.46 to 3.03

    Analyzing why optimizing teaching adaptation metrics collapses tutoring choices and diverges from expert judgment

    arXiv
    2610.12125
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Gemini 3.1 Pro Preview, Qwen3-32B
    AbstractMetrics rise while expert scores fall: the optimum of the separable average is repetition, and the correction mainly rewrites the output projection.

    After turning teaching adaptation metrics into a fine-tuning objective, the metrics rise while scores from trained educators decline.

    Paper analysisRead analysis
  6. Analysis and theoryarXiv 2610.12083

    Paper audits LLM judge reliability: repeated agreement does not equal correctness

    Auditing LLM judge reliability and defining trustworthy verdict rate and accuracy upper bound

    arXiv
    2610.12083
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.2, GPT-4o, Gemini-2.5-Pro and others6
    AbstractThe authors claim that comparing judges should look at T, not just accuracy.

    The authors audit whether LLM-as-a-Judge decisions can still be treated as actionable ground truth under repeated queries, swapped candidate order, and changed prompt formats.

    Paper analysisRead analysis
  7. Analysis and theoryarXiv 2610.11765

    研究提出三项指标衡量 LLM 不思考行为，发现被要求停止思考时仍持续显式推理

    度量关闭思考指令下终答前是否仍有可见显式推理

    arXiv
    2610.11765
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-4B, Qwen3-32B, Qwen3-235B-A22B and others6
    Abstract作者用三级指标测 no-thinking，并称模型有随答案空间加重的思考惯性。

    作者把 no-thinking 定义为可测量的回答行为，而不是从思考开关、特殊标记或输出长度推断。

    Paper analysisRead analysis
  9. Analysis and theoryarXiv 2610.10422

    研究：在线 RL 行为归因信号可能被梯度大小与流畅度混淆

    检验在线 RL 行为归因信号是否被梯度大小与流畅度混淆

    arXiv
    2610.10422
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-1.5B-Instruct
    Abstract作者称步级精度多可由梯度大小解释，逐 rollout 方向随种子和抽样翻转。

    BehaviorTrace 用原因已知的植入行为，检查在线 GRPO 里已有梯度归因能否找到教出该行为的 rollout。

    Paper analysisRead analysis
  10. Analysis and theoryarXiv 2610.10405

    研究发现大语言模型被要求不诚实作答时推理 token 数上升

    检验推理 token 数能否区分被提示的诚实与不诚实作答

    arXiv
    2610.10405
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Gemma-4-e4b, Qwen-3.5-9b, GPT-OSS-120B
    Abstract被提示不诚实时推理 token 组水平更高。

    三个推理模型在被提示的回答政策下出现组水平推理 token 差异。作者把它当作不读思维链内容的 black-box 候选信号，而不是自发欺骗检测器。

    Paper analysisRead analysis
  11. Analysis and theoryarXiv 2610.10657

    Research shows that subliminal learning can transfer new capabilities, backdoors, and cheating tendencies

    检验潜意识学习能否经无关数据蒸馏传递能力、后门与作弊

    arXiv
    2610.10657
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3.6-35B-A3B, Qwen3.5-9B, Qwen3.6-27B and others4

    Abstract作者报告潜意识学习可传递新技能、后门与作弊倾向，且分布外泛化强于单层转向向量。

    Paper analysisRead analysis
  12. Analysis and theoryarXiv 2610.10285

    论文证明部分可观测且限时行动环境下完美智能体也无法保证安全

    证明限时且部分可观测环境下完美智能体不能保证安全

    arXiv
    2610.10285
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Abstract作者称须连同环境与安全状态考虑安全，信号混合可要求无限前瞻。

    作者讨论的是：必须在有限额外观测后行动的控制器，在只能部分观测的环境里，能否有与模型无关的安全保证。要处理的情况是，延误本身有代价，而观测又可能分不清必须采取互斥安全动作的两个潜状态。分拣中心的透明药瓶是作者给出的例子。

    Paper analysisRead analysis
  13. Analysis and theoryarXiv 2610.10203

    研究者提出模型生物体多目标验证框架并给出训练建议

    提出模型生物多目标验证与合并训练方法以减少能力损伤

    arXiv
    2610.10203
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    gemma-2-2b-it, olmo-2-1b, llama-3.1-8b-it
    Abstract提出多目标验证框架与模型合并训练法，证明模型真实度直接影响可解释性评测。

    本论文提出了一种针对 AI 安全评测用模型生物（Model Organisms）的多目标训练与验证体系。

    Paper analysisRead analysis
  15. Analysis and theoryarXiv 2610.09667

    东京大学研究：推理模型按 UUID 阈值或整除规则挑选审计样本，控制标识符即可躲开复核

    揭示推理模型用标识符规则替代随机抽样，使审计可被预测

    arXiv
    2610.09667
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    GPT-6 Sol, GPT-6 Luna, GPT-5.4 mini and others6

    Abstract研究揭示推理智能体将标识符转化为确定性规则，破坏群体独立性并导致审计预测漏洞，建议显式提供随机输入。

    Paper analysisRead analysis
  16. Analysis and theoryarXiv 2610.09517

    审计发现 CLIP 安全分数主要反映画面与提示词场景的相似度

    开环审计冻结视觉语言安全分，发现其反映场景模板而非危险感知

    arXiv
    2610.09517
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    CLIP ViT-B/32, CLIP ViT-L/14, Qwen2-VL-7B
    Abstract论文审计了冻结 VLM 安全评分机制，指出其反映场景模板而非危险感知，为安全强化学习评估提供了严谨基准。

    本文是一项针对安全强化学习中冻结视觉语言模型（VLM）安全评分机制的实证审计研究。

    Paper analysisRead analysis
  17. Analysis and theoryarXiv 2610.09004

    研究：去除有害信息不足以证明开源权重模型的抗篡改能力

    论证发布时互信息不能认证开源权重抗微调恢复

    arXiv
    2610.09004
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
    Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。

    作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。

    Paper analysisRead analysis
  18. Analysis and theoryarXiv 2610.08577

    学习方式如何影响遗忘：记忆与泛化谱系下的机器遗忘研究

    分析记忆与泛化如何决定机器遗忘的 retain 损伤

    arXiv
    2610.08577
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    one-layer ReLU transformer, one-layer transformer (BMA, width doubled), Hubble-8B-100B perturbed and others6
    Abstract作者称共享规则占比越高，遗忘带来的 retain damage 越大。

    作者考察学习方式如何左右 unlearning 的 retain damage：训练越依赖跨样本共享的解法，在匹配的遗忘程度上，retain 上的损失越大。

    Paper analysisRead analysis
Load more