Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 66 papers
Filter6

Attack type

Poisoning and backdoors8Detection evasion3Denial of service4

Attack technique

Gradient and representation optimization3Automated search5

Model risks

Dangerous agent actions4Dangerous capabilities6Inappropriate refusal8Bias and discrimination3

Defense type

Model hardening13Inference-time intervention3

Impact

Harmful content293Unauthorized actions65Data and privacy leaks81Output manipulation194Availability and reliability57Oversight failure84Increased misuse capability9

System type

Models and APIs39LLM applications6AI Agent66coding agent15science agent3web agent4Browser and computer use0Embodied systems and robotics12

Attack surface / entry point

User input7Images, audio and video5Training data8Weights and gradients5

Layer

Prompt layer10Model layer17Application layer16Training and data layer22

System component

Reasoning chains3Fine-tuning and open weights4Vision4Multimodal8
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.
Impact：Availability and reliabilityImpact：Increased misuse capabilitySystem type：Models and APIsSystem type：coding agentSystem type：Browser and computer useSystem type：Embodied systems and roboticsClear all

Another 227papers do not have category tags yet and are not included in filtered results.

  1. Evaluation and benchmarksarXiv 2610.12758

    DistressBench: Evaluating multi-dimensional crisis support in large language models

    Introduces DistressBench, evaluating models' multidimensional support in crisis conversations

    arXiv
    2610.12758
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Muse Spark 1.2, Muse Spark 1.3, Muse Glimmer 30B and others20
    AbstractThe model is more restrained and acts less.

    DistressBench uses SSH dialogues written and revised by clinical personnel, and evaluates how much necessary care general chat models deliver according to weighted atomic criteria, rather than whether they refuse. When users disclose suicidal ideation or self-harm to a chat model, the authors consider the expected behavior to be recognizing the crisis, calibrating empathy, de-escalating, and referring to human help. Refusal-based evaluations cannot detect failing to act after recognizing the crisis.

    Paper analysisRead analysis
  2. DefensesarXiv 2610.12602

    Self-Preservation in Language Models

    Proposes Task Bank self-replay to mitigate held-out forgetting in continual instruction tuning

    arXiv
    2610.12602
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-0.6B, Qwen3-1.7B, Qwen3-4B and others4
    AbstractThe authors claim self-replay can reduce forgetting outside the list, and that on the 4B model new task information helps with target selection, while smaller models do not.

    The authors study how language models, when learning new tasks, can use their own knowledge for broader self-preservation: given an incomplete list and forgetting that extends beyond the list, can the model generate replay and help choose targets.

    Paper analysisRead analysis
  3. Evaluation and benchmarksarXiv 2610.11647

    One More Skill Installed: How Co-Installed Skills in Coding Agents Conflict

    评测编码 Agent 中相似技能共同安装对已装技能核心功能的替代

    arXiv
    2610.11647
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    claude-sonnet-4-6, claude-haiku-4-5-20251001, claude-opus-5 and others6
    Abstract冲突藏在任务成功后面。

    作者对共同安装、做同一件事的良性 skill 做实证研究，用核心功能是否还在，而不是任务过不过，来看冲突。。

    Paper analysisRead analysis
  4. Evaluation and benchmarksarXiv 2610.11599

    研究：大语言模型版本更替削弱 AI 辅助科研写作筛查

    测量 LLM 版本更替对科学摘要 AI 改写检测器的影响

    arXiv
    2610.11599
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    RoBERTa-base, Pangram
    Abstract作者称检测器的基准准确率只是临时的，每次发布都要连同更早版本重验。

    作者量化的是：科学摘要的 AI 改写筛查，在 LLM 版本不断更换、而人类摘要误标必须少见时，会怎样变。问题来自期刊和会议已经按分数阈值筛查投稿，但基准多停在评估时可得的版本上。

    Paper analysisRead analysis
  5. Evaluation and benchmarksarXiv 2610.10276

    PatchBench 提出激活补丁局部评测协议，揭示越狱修复的附带损伤

    提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤

    arXiv
    2610.10276
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-3B-Instruct, Qwen2.5-14B-Instruct, gemma-3-4b-it and others8

    Abstract论文提出 PatchBench 与局部评估协议，揭示了激活补丁在全局能力无损下仍存局部良性退化。

    Paper analysisRead analysis
  6. Evaluation and benchmarksarXiv 2610.09944

    AgentTime 基准测试智能体时长遵循能力，GPT-6 Astra 出现 14 次做完后休眠

    提出 AgentTime 基准，评测智能体按时长工作与估时能力

    arXiv
    2610.09944
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Fable 5.1, GPT-5.6 Sol, GPT-6 Astra and others7
    Abstract作者把完成任务和管理所用时间分开。

    AgentTime 是对智能体时间自控的评测：预测任务耗时、按要求时长工作、事后估计已用时间。

    Paper analysisRead analysis
  7. AttacksarXiv 2610.09819

    FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵

    提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门

    arXiv
    2610.09819
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    HuBERT-base, WavLM-base

    Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。

    Paper analysisRead analysis
  8. Analysis and theoryarXiv 2610.09004

    研究：去除有害信息不足以证明开源权重模型的抗篡改能力

    论证发布时互信息不能认证开源权重抗微调恢复

    arXiv
    2610.09004
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
    Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。

    作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。

    Paper analysisRead analysis
  9. OtherarXiv 2610.08917

    CARE：为视觉-语言-动作模型推理加速提供认证式选择

    提出 CARE，离线认证 VLA 加速配置的回合级失败风险并选出最快合格候选

    arXiv
    2610.08917
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-OFT, π0.5, π0 and others5
    AbstractCARE 以配对回合认证加速诱发失败，在预算内选最快候选，不足则保留参考。

    CARE 在部署前从加速配置中选出最快、且加速诱发失败风险能被有限样本认证为低于用户预算的候选。证据不足就保留全计算参考策略。

    Paper analysisRead analysis
  10. Evaluation and benchmarksarXiv 2610.08662

    ParanoiaEval：编码智能体不必要风险处置评测基准发布

    提出 ParanoiaEval 评测编码智能体的不必要风险处置

    arXiv
    2610.08662
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Opus-5, Sonnet-5, Sonnet-4.6 and others8
    Abstract作者用证据受控任务对评测风险处置，称其普遍、独立于任务能力并降低满意度。

    作者提出 ParanoiaEval，并称它是编码智能体风险处置能力的首个统一基准。要解决的问题是：证据已经确定风险应如何处置之后，智能体仍可能扩大验证、增加保护或备份，而现有评测要么只看功能正确性，要么把相关行为拆开研究。做法是把 NIST 的 ATMA 落到仓库任务。

    Paper analysisRead analysis
  11. Analysis and theoryarXiv 2610.08577

    学习方式如何影响遗忘：记忆与泛化谱系下的机器遗忘研究

    分析记忆与泛化如何决定机器遗忘的 retain 损伤

    arXiv
    2610.08577
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    one-layer ReLU transformer, one-layer transformer (BMA, width doubled), Hubble-8B-100B perturbed and others6
    Abstract作者称共享规则占比越高，遗忘带来的 retain damage 越大。

    作者考察学习方式如何左右 unlearning 的 retain damage：训练越依赖跨样本共享的解法，在匹配的遗忘程度上，retain 上的损失越大。

    Paper analysisRead analysis
  13. Evaluation and benchmarksarXiv 2610.06584

    论文：AI 在非公开漏洞上更帮攻击者还是防御者

    评测 coding agent 在非公开漏洞上的利用生成、修复与后续攻击

    arXiv
    2610.06584
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    Opus 5, GPT-5.6 Sol, GPT-6 Sol and others10
    Abstract攻防孰强随环境、系统和弱点改变。

    作者比较编程智能体在利用生成与漏洞修复上的自主表现，并检查修复之后还能不能被攻破。文中的 help 指自主完成任务，不是提升人类操作者。

    Paper analysisRead analysis
  14. Evaluation and benchmarksarXiv 2610.06193

    SWE-CC 基准：编码 Agent 功能正确仍违反 43.1% 仓库贡献规范

    提出 SWE-CC 基准，评测编码 Agent 对仓库贡献策略的遵守

    arXiv
    2610.06193
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6 Luna, Gemini 3.7 Flash, DeepSeek V4 Flash 0731 and others4
    AbstractSWE-CC 中功能正确仍可能违规。

    SWE-CC 评测编码智能体是否遵守仓库贡献策略，而不只看补丁能否通过测试。

    Paper analysisRead analysis
  16. AttacksarXiv 2610.06083

    研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击

    提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报

    arXiv
    2610.06083
    Published
    Layer
    Model layer
    Setting
    Embodied systems and robotics
    Evaluated models
    DQN, Double DQN (DDQN)
    Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。

    这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。

    Paper analysisRead analysis
  18. Analysis and theoryarXiv 2610.05076

    自生成反馈会破坏测试时训练：长时程适应的因果分解

    因果分解自生成反馈如何破坏测试时训练的长时程适应

    arXiv
    2610.05076
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    125M TTT-E2E, 760M TTT-E2E, 3B TTT-E2E and others5
    Abstract自写闭环损害真实文本预测。

    持久测试时更新若来自模型自己生成的文本，会同时改变模型和后续训练文本。作者在 PG-19 长流上分解这条闭环，并用独立文本决定是否提交更新。

    Paper analysisRead analysis
  20. OtherarXiv 2610.04792

    多模态一定更好吗？缺失模态鲁棒性的几何视角与 Geodesic Unlearning 方法

    提出 Geodesic Unlearning，沿测地线编辑权重以提升缺模态鲁棒性

    arXiv
    2610.04792
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    RoBERTa, ResNet50, Qwen2.5-3B and others6
    AbstractGU 用测地线子空间编辑应对部署时缺模态下降，并尽量保住全模态精度。

    这项工作讨论多模态模型在部署时整段缺一个模态的性能下降，并把校正写成训练后的子空间编辑。

    Paper analysisRead analysis
Load more