Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 28 papers Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 PrivDrift 基准，审计话题漂移后的用户秘密复述
Published Sep 25
Evaluated models GPT-OSS-120B , DeepSeek-R1 , Qwen3-VL-235B 消融比较方言越狱中表层形式、文化框架与策略库的作用
Published Sep 15
Evaluated models GPT-4o , DeepSeek-Reasoner , DeepSeek-Chat 提出 SAST-IR，用有状态攻击者迭代说服无记忆模型接受反事实
Published Sep 15
Evaluated models DeepSeek-Chat 提出内容不变样式包装，翻转安全评审器的判定
Published Sep 8
Evaluated models GPT-4o-mini (gpt4o) , GPT-4o-mini (strongreject) , DeepSeek-Chat and others7 Abstract 论文揭示特定安全评审器易受保持内容不变的外层包装诱导改变判定，并指出安全评估应将判定稳定性作为重要考量指标。这是一项关于大语言模型自动化安全评审系统表面样式脆弱性的评估研究。
提出 MIPC 与 CFA，观察模型自拟测验后接受开发者身份
Published Sep 3
Evaluated models ChatGPT , Claude , Qwen3.7-Plus and others5 Abstract 自拟测验可造成对话层虚假认证，但所测授权边界并未因此改变。这项工作把“模型自己出题、自己批改、再宣布身份已核验”定义成对话层认证失败，并与后端提权分开。
提出多轮越狱框架 BLUEPRINT，用世界观模拟与心理因素诱导有害输出
Published Sep 2
Evaluated models Qwen3-Next-80B , DeepSeek-V3.2 , GLM-4.7 and others6 Abstract BLUEPRINT 解耦多轮越狱策略与情境模拟，揭示任务具象化是摆脱拒绝的核心机制，为多轮安全防御提供新视角。BLUEPRINT 是一个将因子化社会影响力策略空间与跨轮世界观模拟解耦的多轮大语言模型安全评测框架。
提出 RolePlay 框架，用人设条件放大 LLM 单次推理开销
Published Jul 29
Evaluated models DeepSeek-V4-Pro , Gemini-3.5-Flash , Qwen-3.5-Plus and others5 提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
Published Jul 26
Evaluated models Qwen3.5-9B , Llama-3.1-8B , Ministral-3-8B and others6 Abstract 该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。
评测多语言与编码混淆提示下模型生成钓鱼与键盘记录内容的遵从
Published Jun 29
Evaluated models DeepSeek-V3.2 , Gemini 2.5 Flash , GPT-5 Mini and others6 提出 Ghostwriter 攻击，用伪权威证据条件注入操纵模型观点
Published Jun 4
Evaluated models GPT-4o , Claude-3.7-Sonnet , DeepSeek-V3 and others10 Abstract 作者称攻击未被消除。Ghostwriter 是一种针对上下文窗口的观点引导攻击：把误导陈述改写成伪权威文本，再在相关查询中让目标模型把该观点写进回答。
构建 MultiTurnPSB，评测四轮医疗越狱与分类器输入防御
Published May 30
Evaluated models GPT-4.1-mini , Claude Sonnet 4.5 Abstract 多轮攻击加剧医疗模型风险，分类器干预有效但受高误报率制约。MultiTurnPSB 针对患者端医疗大模型在持续交互中的安全风险，构建了包含三种攻击模态的四轮对抗评测基准。
提出 Persona Attack，分步写入对话记忆指令以越狱
Published May 29
Evaluated models GPT-4o , Llama-3.2-3B-Instruct , ChatGPT-4o and others5 Propose PCSA, which uses persona-based multi-turn simulation of counseling clients to induce harmful empathetic responses.
Published Apr 7
Evaluated models Llama-3.1-8B , Llama-3.1-70B , GPT-3.5-Turbo and others8 Proposes composite jailbreaks, stacking contrast structure, authoritative persona, and self-evaluation to saturate the instruction hierarchy
Published Apr 3
Evaluated models OpenAI gpt-oss-20b Propose FoodGuardBench and the guardrail FoodGuard-4B to evaluate and reduce food hazard jailbreaks
Published Apr 2
Evaluated models Claude-3.7-Sonnet , GPT-4o , GPT-4.1 and others10 Propose S2C jailbreak, which delays harmful intent integration using contextual rewriting, fragmentation, and clue-guided camouflage.
Published Mar 17
Evaluated models Llama3.3-70B-Instruct , DeepSeek-r1 , DeepSeek-v3 and others16 Proposes the STAR multi-turn role-playing framework, which bypasses safety alignment through dialogue state evolution
Published Mar 15
Evaluated models GPT-4o , Claude 3.5 Sonnet , Gemini 2.0-Flash and others5 Proposes the Aegis red-teaming framework for multi-turn attacks on high-risk voice agents.
Published Feb 7
Evaluated models GPT-4o , GPT-4o-mini , Gemini-1.5 Pro and others7 Abstract Aegis red-teams three types of voice agents: query-based access eliminates authentication and leakage successes, but behavioral attacks remain.Aegis uses multi-turn red-teaming evaluation on ALLM voice agents already integrated into business systems. The authors call this the first systematic red-teaming framework in this setting.
提出黑盒 context nesting，用结构化补全任务嵌套有害请求越狱扩散 LLM
Published Jan 31
Evaluated models LLaDA-8B-Instruct , LLaDA-1.5 , Dream-v0-Instruct-7B and others5 Abstract 去噪抑制多种越狱。作者把 D-LLM 相对 AR-LLM 越狱的稳健性称为 safety blessing，并把 context nesting 当作它的 black-box 失效方式。
提出音频叙事越狱，以嗓音投递风格绕过端到端语音模型拒答
Published Jan 31
Evaluated models GPT-4o Realtime , Gemini 2.0 Flash , Qwen2.5-Omni-7B