Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 201papers have no tags yet and are not included in filtered results.

Defense type：Monitoring and auditing System type：Models and APIs System type：coding agent System type：Browser and computer use Layer：Model layer Layer：Training and data layer Clear all

Another 201papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.11012Oct 8
Redwood Research proposes the distillation double bind: using distillation to make models confess hidden behavior or inherit only capabilities
提出 DFI 与 DFC 蒸馏，定罪隐瞒失配的教师或安全提取能力
arXiv
2610.11012
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.3-70B-Instruct (AuditBench SFT/KTO organisms), Llama-3.3-70B-Instruct (DFI distilled student), Llama-3.1-8B-Instruct (DFI distilled student) and others4
- DefensesMonitoring and auditing
- RiskDeception and scheming
Abstract概括了论文针对隐瞒失配模型提出的 DFI 与 DFC 机制、主实验发现及适用边界。
Paper analysisRead analysis
DefensesarXiv 2610.09167Oct 7
Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
arXiv
2610.09167
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。
Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。
Paper analysisRead analysis
DefensesarXiv 2610.07774Oct 6
研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器
AI summary研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。
arXiv
2610.07774
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-30B-A3B-Instruct, Kimi-VL-A3B-Instruct
- DefensesMonitoring and auditing
- RiskInappropriate refusal
- ComponentMonitors
Abstract读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。
作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.02741Oct 2
研究系统评估循环语言模型的思维链可监控性
系统评估循环语言模型加深 loop 后的 CoT 可监控性
arXiv
2610.02741
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Ouro-1.4B-Thinking, Ouro-2.6B-Thinking, Nanbeige4.2-3B and others4
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentReasoning chains
Abstract加深 loop 可在部分压力测试任务降低可监测性，循环架构本身并不必然更难监测。
这项工作评估 LoopLM 的 CoT 可监测性：加深共享层的重复次数，以及“有循环结构”本身，会不会让决策关键因素更少出现在可监测文本里。
Paper analysisRead analysis
DefensesarXiv 2610.02557Oct 2
新 AI 辩论协议实现实例级最优：最坏情况正确且诚实为占优策略
提出 FBS Debate 协议，使诚实为占优策略且最坏情况正确
arXiv
2610.02557
Published
Oct 2
Layer
Training and data layer
Setting
Models and APIs
- DefensesMonitoring and auditing
- RiskDeception and scheming
AbstractFBS 辩论用 fbs 约束敏感分解，给出最坏情况占优策略，并匹配黑盒查询下界。
FBS Debate 是一套可扩展监督的辩论规则：两名计算方争论一个可递归分解的是非问题，人类只在最后选出的子问题上做黑盒判断。要处理的缺口是，prover-estimator debate 虽能覆盖稳定分解，但只在输入分布的平均意义下成立，而且 Bob 的获胜策略一般要跟着 Alice 的作弊策略变。作者要在同一问题类上，让每个错误实例都能被抓住，并让诚实且正确成为双方的占优策略。
Paper analysisRead analysis
DefensesarXiv 2610.02413Oct 2
研究：分类后缀可提升激活探针的分布外恶意输入检测
用分类后缀提升激活探针对分布外恶意输入的检测
arXiv
2610.02413
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract作者称排序增益来自分类格式，低 FPR 精度来自点名准则。
用户轮后的分类后缀，被作者用作激活探针的分布外检测干预：排序看格式，低 FPR 精度看是否点名恶意/良性。
Paper analysisRead analysis
DefensesarXiv 2609.39548Sep 30
NDDL: Backdoor Defense for Text-to-Image Models with Normal Diffusion Dynamics
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
arXiv
2609.39548
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.5, Stable Diffusion XL, Stable Diffusion v3.5 and others4
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentImage generation
AbstractNDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。
NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
Paper analysisRead analysis
Analysis and theoryarXiv 2609.37312Sep 29
研究：隐蔽推理必然留下信息痕迹，但思维链未必可读
分析隐蔽推理在思维链监控下的信息足迹下界与不可读性
arXiv
2609.37312
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Qwen 3.5 397B-A17B and others12
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract论文从理论与实证探明了思维链监控的边界：复杂隐蔽计算必然泄露信息足迹且需承担长度税，但该足迹可被在线加密而不可读。
Paper analysisRead analysis
DefensesarXiv 2609.30841Sep 25
为何扩散语言模型的越狱会成功：能量景观分析
用能量势垒信号检测扩散语言模型的越狱
arXiv
2609.30841
Published
Sep 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Instruct, LLaDA-1.5, Dream-v0-Instruct-7B and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Abstract能量势垒把 dLLM 越狱分成掩盖初始状态或中途越垒，三个 logit 信号据此互补检测。
Bach 等提出用去噪能量景观解释 masked diffusion 语言模型上的越狱，并由此得到三个免训练检测信号。。
Paper analysisRead analysis
DefensesarXiv 2609.21996Sep 19
PIR：从模型内部激活读出被隐藏的答案
提出免参考探测 PIR，从激活读出被隐瞒答案并区分擦除
arXiv
2609.21996
Published
Sep 19
Layer
Model layer
Setting
Models and APIs
Evaluated models
gemma-2-9b, gemma-3-12b, Qwen2.5-7B and others9
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract论文提出免参考内部识别探测 PIR，划分了隐瞒与遗忘的边界，为评估沙盒审计与遗忘真实性提供了内部依据。
Paper analysisRead analysis
DefensesarXiv 2609.20129Sep 17
局部稀疏性实现无监督 LLM 安全检测
提出局部稀疏无监督安全检测，标记偏离安全分布的输入
arXiv
2609.20129
Published
Sep 17
Layer
Model layer
Setting
Models and APIs
Evaluated models
qwen2-1.5b-instruct, ministral-8b-instruct, llama3-8b-instruct and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2609.13534Sep 12
HPD 与 HERALD：用跨层有害性传播轨迹检测越狱提示
提出 HERALD，用跨层有害投影轨迹检测越狱提示
arXiv
2609.13534
Published
Sep 12
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Mistral-7B-Instruct, OLMo2-7B-Instruct and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractHPD 用跨层投影形状区分有害与良性提示。
Paper analysisRead analysis
DefensesarXiv 2609.04665Sep 4
HackProbe：面向自演化语言模型奖励作弊的黑盒检测与免疫方法
提出 HackProbe，黑盒检测并免疫自演化中的奖励作弊
arXiv
2609.04665
Published
Sep 4
Layer
Training and data layer
Setting
Models and APIs
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentMonitors
Abstract黑盒探针检测自演化奖励黑客，并以带宽受限重选回收真实能力。
HackProbe 是挂在自演化循环上的黑盒监控器，用来发现奖励黑客并改选候选。
Paper analysisRead analysis
DefensesarXiv 2608.30703Aug 31
SingProbe 发布开源内在护栏框架，适配 29 个开源模型
提出内生护栏 SingProbe，复用解码隐状态监测查询意图、回复安全与幻觉
arXiv
2608.30703
Published
Aug 31
Layer
Model layer
Setting
Models and APIs
Evaluated models
Ling-3.0-tiny-singprobe, Ling-3.0-flash-singprobe
- DefensesMonitoring and auditing
- RiskInappropriate refusal
AbstractSingProbe 用轻量内生探针做生成时三类监测，并给出流式基准与低开销服务接入。
SingProbe 是面向生成时监测的开源内生护栏：复用基座解码隐状态，而不是另起模型反复编码文本。
Paper analysisRead analysis
InterpretabilityarXiv 2608.30480Aug 31
VisER：面向 LVLM 物体幻觉检测的视觉证据与视觉依赖双面指标
提出 VisER，用内部视觉证据检测 LVLM 物体幻觉
arXiv
2608.30480
Published
Aug 31
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, LLaVA-NeXT-7B, InstructBLIP and others8
- DefensesMonitoring and auditing
- RiskHallucination and fabrication
- ComponentVision
AbstractVisER 用证据门与图像–前缀比给物体提及打落地分。
VisER 是面向 LVLM 开放式图像描述的免训练物体级幻觉检测分数，用来处理内部支持的来源混淆。
Paper analysisRead analysis
DefensesarXiv 2608.05578Aug 6
AMS 工具通过激活分析检测语言模型的安全训练改动
提出 AMS，用激活分离与方向相似度检测安全训练改动
arXiv
2608.05578
Published
Aug 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
- DefensesMonitoring and auditing
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。
AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
Paper analysisRead analysis
DefensesarXiv 2608.14632Jul 24
DeMTS：将去噪轨迹建模为多变量时间序列，检测扩散语言模型的幻觉
提出 DeMTS，把扩散语言模型去噪轨迹建成多元时间序列以检测幻觉
arXiv
2608.14632
Published
Jul 24
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Instruct, Dream-7B-Instruct
- DefensesMonitoring and auditing
- RiskHallucination and fabrication
- ComponentMonitors
Paper analysisRead analysis
Risky behaviorarXiv 2606.04923Jun 3
CHERRL：可复现、分析与检测评分标准强化学习中的奖励作弊
提出 CHERRL 注入裁判偏差以复现奖励作弊，并用 RHDA 检测训练起点
arXiv
2606.04923
Published
Jun 3
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3.5-plus, Qwen3.5-397B-A17B and others4
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentGuardrails and judges
AbstractCHERRL 注入已知偏差以观察奖励黑客，并用于分析偏差和评测起点检测器 RHDA。
CHERRL 是 rubric-based RL 的可控环境，用来复现奖励黑客、观察奖励分歧，并给检测器提供起点参照。
Paper analysisRead analysis
DefensesarXiv 2605.25893May 25
D²-Monitor：基于犹豫信号的扩散大语言模型动态安全监控
提出 D²-Monitor，按犹豫步数把难提示路由到更强探针
arXiv
2605.25893
Published
May 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaDA-8B-Base, LLaDA-8B-Instruct, LLaDA-1.5-8B and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2602.14161Feb 15
When benchmarks lie: evaluating malicious prompt classifiers under real-world distribution shift
提出 LODO 评测恶意提示探针的跨数据集泛化
arXiv
2602.14161
Published
Feb 15
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Gemma-3-27B, Qwen-3.5-4B and others5
- DefensesMonitoring and auditing
- AttacksPrompt injection
- ComponentMonitors
Abstract作者称 LODO 露出 CV 高估，数据集身份与安全方向部分重叠，标准域泛化干预关不上。
LODO 用来检查恶意提示词分类器换成没见过的数据集后，还剩多少检测能力。。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop