Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 432 papers
Filter5

Attack type

Jailbreaks219Prompt injection37Poisoning and backdoors23Model tampering27Extraction and theft63Detection evasion5Malicious use12

Attack technique

Gradient and representation optimization26Automated search57Multi-turn escalation24Encoding and obfuscation45Role-play and persuasion20Conversation structure manipulation11Reasoning-chain manipulation9Cross-modal payloads33Side channels3Defense-targeted13Dormant triggers17Selection manipulation3

Model risks

Deception and scheming5Misalignment and value divergence13Dangerous agent actions10Dangerous capabilities3Inappropriate refusal49Bias and discrimination4

Defense type

Model hardening55Inference-time intervention25Detection and filtering24Instruction–data separation16Permissions and approval10Monitoring and auditing15

Impact

Harmful content311Unauthorized actions217Data and privacy leaks121Output manipulation276Availability and reliability87Oversight failure119Increased misuse capability18

System type

Models and APIs347LLM applications23AI Agent85coding agent20science agent4web agent7Multi-agent systems14

Attacker access

Black-box123Gray-box8White-box45No-box (offline transfer)3

Attack surface / entry point

User input265Web pages and interfaces6Documents and messages8Tool responses16Tool and skill descriptions13Code repositories and dependencies5Memory writes11Inter-agent messages8Images, audio and video56Training data27Weights and gradients40Distribution channels12Inference services and hardware8

Layer

Prompt layer170Model layer107Application layer77Training and data layer70Infrastructure layer8

System component

MCP and skills16Memory15Guardrails and judges57Monitors19Reasoning chains24Permissions and sandboxing11Fine-tuning and open weights36Vision46Audio13Video3Image generation29Multimodal86
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Impact：Harmful contentImpact：Data and privacy leaksSystem type：Models and APIsSystem type：AI AgentSystem type：coding agentClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.13733

    KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge

    Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity

    arXiv
    2610.13733
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4

    AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.13333

    LETHE: Defending Against Unauthorized Image-to-Video Generation via Value Diversity Collapse

    Proposes LETHE, which perturbs reference images to block unauthorized image-to-video

    arXiv
    2610.13333
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Wan2.1-I2V-14B, CogVideoX-5B-I2V, LightX2V and others6
    AbstractLETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.

    LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.

    Paper analysisRead analysis
  3. InterpretabilityarXiv 2610.13078

    Attention sees, MLP refuses: tracing the safety pathway from attention to MLP in LLMs

    Trace attention to identify harmfulness to the MLP refusal write pathway and propose Sentinel

    arXiv
    2610.13078
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Qwen3-8B-Instruct and others18
    AbstractAttention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.

    The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2610.11773

    研究提出 Agent 安全新维度：识别未履行的安全义务

    提出义务识别基准 ObligationBench，并训练护栏识别 Agent 未履行的安全义务

    arXiv
    2610.11773
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    ObligationGuard, Claude-Opus-4.8, GPT-5.6-Sol and others17
    Abstract义务是护栏缺口。

    作者认为编码智能体的安全不能只靠拦截禁止动作，还要找出终止时仍未做的安全关键动作，并将其称为义务。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2610.11766

    研究提出意图恢复率作为 LLM 安全评测的补充指标

    提出 IRIS，用意图恢复率区分遮蔽越狱下无害输出的原因

    arXiv
    2610.11766
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-4o, Claude Sonnet 4.5, Claude Opus 4.5 and others6
    Abstract无害输出的证据权重取决于任务是否被恢复。

    IRIS 把意图恢复当作中间信号，用来解释意图遮蔽提示下为何没有出现有害协助。

    Paper analysisRead analysis
  7. Evaluation and benchmarksarXiv 2610.11561

    Workerville: Toward an Organizational Behavior Explanation of Agent Safety

    构建 Workerville 基准，测量组织条件如何改变 Agent 的安全行为

    arXiv
    2610.11561
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    GPT-5.2, Claude-Sonnet-4.6, Gemini-3.1-Pro and others6
    Abstract作者用 ACB 与 Workerville 测量组织条件对智能体安全的影响，并称结果支持可量化的组织行为框架。

    Workerville 用组织行为测量智能体安全如何随监督、同伴和记忆条件变化。。要处理的缺口是：持续运行的 LLM 智能体同时接收用户指令、同伴消息和长期记忆，但既有安全评测多把这些通道拆开，没有统一的定量测量。

    Paper analysisRead analysis
  8. AttacksarXiv 2610.12524

    An exploration of attacks on AI agent systems

    重测并扩展对 AI Agent 的提示注入，并用 Agent Card 欺骗操纵 A2A 选择

    arXiv
    2610.12524
    Published
    Layer
    Application layer
    Setting
    AI Agent
    Evaluated models
    Ollama Mistral 0.9.5, llama3-8b-8192, gemini-2.0-flash-lite and others5
    Abstract单智能体过滤与分类可被格式或措辞绕过，A2A 选卡还会偏向名称和描述。

    作者在自建的 LangChain、AutoGen 和 A2A 系统上重测提示注入，并改 Agent Card 看选择是否偏移。摘要称试验主要凸显单智能体弱点，同时把攻击扩到多智能体。

    Paper analysisRead analysis
  9. DefensesarXiv 2610.11005

    研究：叙事包装可跨语言绕过 LLM 拒答

    提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱

    arXiv
    2610.11005
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-1.7B, Qwen3-4B, GLM-4-9B
    AbstractGUISE 分开测包装与语域。

    作者测量叙事包装下的拒答失效，并训练一个在未见包装上拒绝、同时仍回答同风格良性请求的适配器。问题是：安全对齐模型拒绝直说的有害请求，却回答嵌进角色或叙事里的同一请求。文言文被用来把语域和包装拆开。

    Paper analysisRead analysis
  11. DefensesarXiv 2610.10345

    SLDR：通过选择性层恢复与动态路由防御恶意微调

    提出 SLDR，用选择性层恢复与动态路由防御恶意微调

    arXiv
    2610.10345
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
    Abstract作者称 SLDR 能压低有害输出并保持下游效用。

    SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。

    Paper analysisRead analysis
  14. DefensesarXiv 2610.09703

    研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

    提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱

    arXiv
    2610.09703
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    LLaVA-1.5-7B
    Abstract剪枝去掉背景 token 后注意力塌向恶意前景。

    这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。

    Paper analysisRead analysis
  15. DefensesarXiv 2610.09600

    SafeEvo：从拒答回路视角解释大模型安全对齐机制与演化

    用 SafeEvo 提取拒绝电路，并提出 SCA 仅微调该电路

    arXiv
    2610.09600
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3-8B, Qwen-2.5-7B, Mistral-7B-v0.1 and others4

    AbstractSafeEvo 识别出基座模型中存在的弱安全电路及其演化动态，据此提出的 SCA 算法实现了安全对齐、能力保留与低过度拒绝的平衡。

    Paper analysisRead analysis
  16. DefensesarXiv 2610.09167

    Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果

    提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源

    arXiv
    2610.09167
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
    AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。

    Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。

    Paper analysisRead analysis
  17. Evaluation and benchmarksarXiv 2610.09033

    研究发布 ASRD 数据集，评测五款开源模型在非规范输入下的安全表现

    arXiv
    2610.09033
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Gemma 2 9B, Gemma 3 4B, Llama 3.1 8B and others6
    Abstract五模型、七族表面形式的四态评测里，低有害遵从不等于读懂后的安全处理。

    ASRD 用四态标签检查五个开源模型如何处理非规范表面上的有害请求。

    Paper analysisRead analysis
  19. DefensesarXiv 2610.08678

    研究揭示投机解码的安全代价并提出 SecureSD 加固方法

    测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证

    arXiv
    2610.08678
    Published
    Layer
    Model layer
    Setting
    AI Agent
    Attacker
    Black-box
    Evaluated models
    Qwen3-8B, Qwen3-32B, Llama-3.1-8B-Instruct and others6
    Abstract有损推测解码的早期偏离更快抬高越狱与注入风险。

    作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。

    Paper analysisRead analysis
Load more