Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
Another 201 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes digital lock compilation, encrypting executable networks into host weights to hide arbitrary capabilities
Published Oct 10
Evaluated models Gemma 3 270M Abstract The authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.
提出只改 SAE 解码器的后门，在冻结语言模型上植入代码插入
Published Oct 5
Evaluated models Gemma 3 4B Instruct , Qwen3 1.7B , Llama 3.1 8B Instruct Abstract 只改解码器的 SAE 可带上代码插入后门，且若干常规质量指标变化不大。只改 SAE 解码器、冻结编码器与语言模型，即可把代码插入行为放进推理时的辅助组件。作者把这视为 SAE 供应链问题：checkpoint 一旦替换某一层激活，就参与后续计算，而不只是解释工具。
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
Published Aug 4
Evaluated models MLP 100-100 , CADE (CAE 512-384-256-128) , CADE (CAE 512-128-32-8) and others6 提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息
Published Feb 18
Evaluated models Qwen2.5-VL-7B-Instruct , Qwen3-VL-8B-Instruct , LLaVA-OneVision-1.5-8B-Instruct and others5 Abstract VMI 让扰动图像在多轮 LVLM 中潜伏，作者称触发话题出现后仍可输出预定消息。VMI 是面向多轮 LVLM 的定向图像攻击：第三方发布带小扰动的图像，良性用户把它当作普通输入。
提出隐式记忆时间炸弹，使模型跨独立交互累积隐藏状态后激活
Published Feb 9
Evaluated models GPT-4o , GPT-4.1 , GPT-5.2 and others12 Abstract 作者展示时间炸弹可由提示词或微调诱导。作者把这篇工作定位为立场论文：再摄入存在时，按无状态设计的 LLM 仍可能经自身输出携带状态。要处理的问题是，这种不依赖外部记忆模块的通道会让风险跨过单次请求，而单触发测试看不到完整条件。
提出 BadTemplate，通过改 chat template 植入免训练后门
Published Feb 5
Evaluated models Llama-3.1-8B-INST , Deepseek-7B-chat , Llama-3.1-70B-INST and others9 You have reached the end