Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 49 papers

Filter5

System type

Models and APIs39 LLM applications3 AI Agent10 coding agent1 web agent0 Embodied systems and robotics3

Attacker access

White-box4

Attack surface / entry point

User input21 Images, audio and video6 Training data3

Layer

Model layer41 Application layer5

System component

Monitors6 Reasoning chains4 Vision8 Audio4 Image generation3 Multimodal13

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.

Defense type：Inference-time intervention System type：Models and APIs System type：AI Agent System type：coding agent System type：web agent Clear all

Another 240papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.12432Oct 9
FAITH: A feasibility-aware safety filtering reinforcement learning framework for high-dimensional systems
Proposes the FAITH safe filtering reinforcement learning framework, training high-dimensional systems to optimize task reward under constraints
arXiv
2610.12432
Published
Oct 9
Layer
Training and data layer
Setting
Embodied systems and robotics
- DefensesModel hardening
- RiskDangerous agent actions
AbstractFAITH separates safety filtering from reward optimization.
FAITH is a model-free safe filtering reinforcement learning framework for high-dimensional systems: safety correction and task reward reside in separate modules.
Paper analysisRead analysis
DefensesarXiv 2610.10655Oct 8
Nullify：面向 LLM 遗忘的零空间激活引导免训练方法
提出零空间激活引导 Nullify，免训练擦除指定记忆并保持效用
arXiv
2610.10655
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Qwen3-8B
- DefensesInference-time intervention
- AttacksExtraction and theft
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10276Oct 7
PatchBench 提出激活补丁局部评测协议，揭示越狱修复的附带损伤
提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤
arXiv
2610.10276
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B-Instruct, Qwen2.5-14B-Instruct, gemma-3-4b-it and others8
- DefensesInference-time intervention
- AttacksJailbreaks
Abstract论文提出 PatchBench 与局部评估协议，揭示了激活补丁在全局能力无损下仍存局部良性退化。
Paper analysisRead analysis
DefensesarXiv 2610.09703Oct 7
研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
arXiv
2610.09703
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVA-1.5-7B
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Abstract剪枝去掉背景 token 后注意力塌向恶意前景。
这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
Paper analysisRead analysis
DefensesarXiv 2610.08678Oct 7
研究揭示投机解码的安全代价并提出 SecureSD 加固方法
测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证
arXiv
2610.08678
Published
Oct 7
Layer
Model layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-32B, Llama-3.1-8B-Instruct and others6
- DefensesInference-time intervention
- AttacksJailbreaks
Abstract有损推测解码的早期偏离更快抬高越狱与注入风险。
作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。
Paper analysisRead analysis
InterpretabilityarXiv 2610.08559Oct 6
Study: Debiasing directions in LLM latent space primarily encode confidence rather than fairness
分析 LLM 去偏激活方向，发现其编码置信度而非公平性
arXiv
2610.08559
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Llama-3.1-8B-Instruct, Falcon3-7B-Base and others8
- DefensesInference-time intervention
- RiskBias and discrimination
Abstract论文揭示激活引导去偏见方向主要编码模型置信度而非公平性，偏见评分下降实为诱发弃答或使概率均分的假象。
Paper analysisRead analysis
InterpretabilityarXiv 2610.06576Oct 5
研究：智能体欺骗行为在外部显现前已可从内部表征预测
提出基于决策前隐藏状态的检测与引导，预测并抑制智能体欺骗
arXiv
2610.06576
Published
Oct 5
Layer
Model layer
Setting
AI Agent
Evaluated models
Qwen3-14B
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract论文展示了智能体自发欺骗可在行为显现前由内部表征预测，并通过激活引导证实了表征的行为可操作性。
Paper analysisRead analysis
DefensesarXiv 2610.06383Oct 5
基于影响力的曲率感知数据加权激活引导方法
提出曲率感知数据加权的激活转向方法，用于毒性抑制与概念控制
arXiv
2610.06383
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma-2-2B, Llama-3.2-3B
- DefensesInference-time intervention
Abstract影响加权传输压低毒性率，闭式 IF-Act 常换来更高困惑度与更低 MMLU。
推理时的影响加权激活传输，用曲率修正的样本权重替换传输转向里的均匀类均值。要做的是概念控制，而不是再训练。作者认为类均值被无关概念、噪声和少数 token 主导，编码的是词元级而非主题。
Paper analysisRead analysis
DefensesarXiv 2610.05166Oct 4
安全动作不等于可行动作：VICS-G 为 VLA 策略做可行未来解码
提出 VICS-G 可行未来解码，重排冻结 VLA 策略的动作候选
arXiv
2610.05166
Published
Oct 4
Layer
Model layer
Setting
Embodied systems and robotics
Evaluated models
SafeVLA (task-optimized / base), SafeVLA (safety-aligned / safe)
- DefensesInference-time intervention
- RiskDangerous agent actions
Abstract作者用可行未来解码重排冻结 VLA 的下一步，并称 VICS-G 降低观测代价且完成率接近策略采样。
训练无关解码器 VICS 在冻结 VLA 的推理阶段重排动作块，使当前选择带上该动作仍可能留下的安全完成质量。
Paper analysisRead analysis
DefensesarXiv 2610.04998Oct 4
EmoRSS：缓解大语言模型由情绪引发的过度拒答
提出 EmoRSS，推理时在拒绝子空间反向抵消情绪激活偏移以缓解过度拒答
arXiv
2610.04998
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-it, Qwen3-8B
- DefensesInference-time intervention
- RiskInappropriate refusal
Paper analysisRead analysis
DefensesarXiv 2610.04967Oct 4
One Token Can Be Enough：用 Prefix Steering 连接提示与激活引导
提出 Prefix Steering，以短前缀激活引导控制行为并保住能力
arXiv
2610.04967
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
OLMo 3 7B, OLMo 3 32B, Qwen3 1.7B and others4
- DefensesInference-time intervention
- RiskInappropriate refusal
Abstract短前缀 steering 用已有方向做短暂干预。
本文用注意力层匹配连接提示词与激活干预，并把干预改成从末提示词 token 开始的短前缀。
Paper analysisRead analysis
DefensesarXiv 2610.04470Oct 3
SENTINEL：通过意图感知的输入-输出匹配防御 LLM 越狱
提出生成时防御 SENTINEL，匹配输入输出以抽出越狱意图并停写
arXiv
2610.04470
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama2-7B, Llama3-8B, Mistral-7B-v0.2 and others6
- DefensesInference-time intervention
- AttacksJailbreaks
Paper analysisRead analysis
DefensesarXiv 2610.03498Oct 2
检测与抑制：针对 VLA 模型对抗补丁的机制可解释性防御
提出条件特征抑制防御，检出对抗补丁后抑制 VLA 内部特征
arXiv
2610.03498
Published
Oct 2
Layer
Model layer
Setting
Embodied systems and robotics
Evaluated models
π0.5, SmolVLA
- DefensesInference-time intervention
- ComponentVision
Abstract条件抑制与 patch 相关的 SAE 特征，间歇攻击下可提高 SR，持续攻击下则不能。
Paper analysisRead analysis
DefensesarXiv 2610.02999Oct 2
OmniConfess：用 Token 级「忏悔」缓解全模态幻觉
提出 OmniConfess，冻结候选并按通道重打分以缓解全模态幻觉
arXiv
2610.02999
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-Omni-7B, Qwen3-Omni-30B-A3B, Nemotron-3-Nano-Omni-30B
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2610.02844Oct 2
DNAlign：面向 LLM 的动态零空间安全对齐框架
提出 DNAlign，在不改权重的推理期用零空间约束控制信号做安全对齐
arXiv
2610.02844
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Vicuna-7B, Qwen-7B
- DefensesInference-time intervention
- RiskInappropriate refusal
AbstractDNAlign 用零空间约束的推理期控制做安全对齐，Table I 平均奖励高于所列基线。
DNAlign 是一个不改 LLM 参数的安全对齐框架，用来在推理时压低有害输出，并减少对中性知识所支持的流畅、事实回答的改动。
Paper analysisRead analysis
DefensesarXiv 2610.01969Oct 2
RASteer：面向扩散模型概念擦除的保留感知激活引导方法
提出 RASteer，推理时按保留子空间校正激活以擦除文生图目标概念
arXiv
2610.01969
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.4, Stable Diffusion v1.5, Stable Diffusion v2.1 and others4
- DefensesInference-time intervention
- ComponentImage generation
AbstractRASteer 用保留子空间校正擦除方向，在固定权重下同时压低目标并保住保留概念。
Retain-aware Activation Steering（RASteer） 是一种不改权重的推理时概念擦除方法，用于文生图扩散模型去掉指定概念并减少对保留概念的误伤。
Paper analysisRead analysis
DefensesarXiv 2610.01170Oct 1
HeadEdit：通过冻结的 unembedding 矩阵校准语言模型行为
提出 HeadEdit，经冻结 unembedding 做随输入变化的 logit 校正
arXiv
2610.01170
Published
Oct 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Gemma-3-4B-IT, Llama-3.2-3B-Instruct and others4
- DefensesInference-time intervention
- RiskInappropriate refusal
Abstract低秩 unembedding 校正抬高九个设置的总体准确率，并可部分预测 DPO 更新。
HeadEdit 是一种不更新参数的行为校准方法，作用点是冻结的 unembedding，而不是中间层残差或新的梯度优化。
Paper analysisRead analysis
DefensesarXiv 2609.37568Sep 29
SECRET：用源条件化中继引导缓解音视频大语言模型的幻觉
提出训练无关的 SECRET，对问题表征做源条件转向以缓解音视频模型幻觉
arXiv
2609.37568
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
VideoLLaMA2-AV-7B, Qwen2.5-Omni-7B, Qwen3-Omni-30B-A3B
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentAudio
AbstractSECRET 在问题状态上做源条件转向，三个 AVLLM 上减轻了跨模态接地幻觉。
SECRET 是一种训练无关的问题状态转向方法，用来减轻 AVLLM 的 source-confused grounding hallucination。
Paper analysisRead analysis
DefensesarXiv 2609.36657Sep 29
Constitutional adapters：用推理期干预防御越狱与失准
提出 Constitutional adapters，蒸馏宪法行为以缓解越狱与失准
arXiv
2609.36657
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3.5-4B, Llama-3.1-8B-Instruct, Gemma-4-E4B and others4
- DefensesInference-time intervention
- AttacksJailbreaks
- RiskMisalignment and value divergence
Abstract差分宪法适配器在长上下文和多轮上更稳，并可按 α 换取遵从。
Paper analysisRead analysis
DefensesarXiv 2609.34514Sep 28
CAM-Steer：面向大语言模型的多类别自适应安全引导框架
提出 CAM-Steer，推理时按多类别风险引导隐藏状态以降低有害回复
arXiv
2609.34514
Published
Sep 28
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Llama-3.1-8B-Instruct, Gemma-2-9B-IT
- DefensesInference-time intervention
- AttacksJailbreaks
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

FAITH: A feasibility-aware safety filtering reinforcement learning framework for high-dimensional systems

Nullify：面向 LLM 遗忘的零空间激活引导免训练方法

PatchBench 提出激活补丁局部评测协议，揭示越狱修复的附带损伤

研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

研究揭示投机解码的安全代价并提出 SecureSD 加固方法

Study: Debiasing directions in LLM latent space primarily encode confidence rather than fairness

研究：智能体欺骗行为在外部显现前已可从内部表征预测

基于影响力的曲率感知数据加权激活引导方法

安全动作不等于可行动作：VICS-G 为 VLA 策略做可行未来解码

EmoRSS：缓解大语言模型由情绪引发的过度拒答

One Token Can Be Enough：用 Prefix Steering 连接提示与激活引导

SENTINEL：通过意图感知的输入-输出匹配防御 LLM 越狱

检测与抑制：针对 VLA 模型对抗补丁的机制可解释性防御

OmniConfess：用 Token 级「忏悔」缓解全模态幻觉

DNAlign：面向 LLM 的动态零空间安全对齐框架

RASteer：面向扩散模型概念擦除的保留感知激活引导方法

HeadEdit：通过冻结的 unembedding 矩阵校准语言模型行为

SECRET：用源条件化中继引导缓解音视频大语言模型的幻觉

Constitutional adapters：用推理期干预防御越狱与失准

CAM-Steer：面向大语言模型的多类别自适应安全引导框架