Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack technique：Defense-targeted System type：Models and APIs System type：coding agent System type：Embodied systems and robotics Attack surface / entry point：Training data Attack surface / entry point：Weights and gradients Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07723Oct 6
Researchers propose answer-side backdoors: letting the model self-generate trigger words to bypass safety refusals.
提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答
arXiv
2610.07723
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Mistral-7B-Instruct-v0.3, Gemma-7B-it and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。
Paper analysisRead analysis
AttacksarXiv 2610.03124Oct 2
研究提出 Untag 攻击框架，使开源大模型触发标签滥用检测机制失效
提出 UNTAG，绕过开源权重模型的 trigger-tag 滥用检测
arXiv
2610.03124
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama2 (7B), Llama3 (8B), Qwen2.5 (7B)
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Abstract作者用 UNTAG 评估 trigger-tag，认为其不能充当开放权重滥用检测的主要边界。
UNTAG 是针对开放权重 LLM 上条件滥用检测 trigger-tag 的统一攻击评估：信号可以在解码期注入，也可以写进权重，但攻击者若能改输出或改已发布权重，检测可以失效。
Paper analysisRead analysis
AttacksarXiv 2609.27124Sep 23
Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习
提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复
arXiv
2609.27124
Published
Sep 23
Layer
Training and data layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
CNN（MNIST：2 Conv + 3 FC）, CNN（Fashion-MNIST：6 Conv + 1 FC）, ResNet18（CIFAR-10）
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。
Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。
Paper analysisRead analysis
AttacksarXiv 2609.31726Sep 22
研究者提出通过替换神经网络权重高容量外泄医学影像的攻击
提出连续潜码隐写，把医学影像写入模型权重以绕过导出限制
arXiv
2609.31726
Published
Sep 22
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
U-Net, DenseNet121
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2609.10117Sep 9
研究揭示基于混淆的端侧 LLM 保护方案的安全边界
提出 Collapse，从端侧混淆暴露视图抽取高效用替代模型
arXiv
2609.10117
Published
Sep 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
BERT-Base, ViT-Base, Qwen2.5-0.5B and others4
- AttacksExtraction and theft
- TechniqueDefense-targeted
AbstractOprior 是四原语复合的安全边界，Collapse 利用列方向泄漏抽取替代模型，Oext 只被同一攻击评测。
这篇工作用代数原语统一若干 TEE 卸载混淆，给出该族的典范边界，再说明该边界挡不住一种分阶段模型抽取。。
Paper analysisRead analysis
AttacksarXiv 2609.07147Sep 7
FDBA：联邦学习中的细粒度分布式后门攻击
提出联邦学习细粒度分布式后门框架 FDBA，用动态触发与对比嵌入降低投毒比例
arXiv
2609.07147
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2609.04260Sep 2
GhostWord：针对自动语音识别的细粒度后门攻击
提出 GhostWord 词级触发后门，对自动语音识别做数据投毒
arXiv
2609.04260
Published
Sep 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Whisper-Small, Whisper-Medium, MMS and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2607.21839Jul 24
论文指出密码学模型认证的假设缺口：审计通过但部署失效
提出数据伪造攻击，使密码学模型认证在审计集通过但部署失效
arXiv
2607.21839
Published
Jul 24
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
SciKit-Learn decision tree, XGBoost, 226M-parameter neural network and others4
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
Abstract固定审计集上的 ZKP 认证可被数据伪造绕过。
这篇工作同时给出对 CMC 的数据伪造攻击，以及先承诺、后抽样的认证模板。。
Paper analysisRead analysis
AttacksarXiv 2605.30040May 28
研究揭示 LLM 按 token 计费可被服务商系统性虚报
构造可通过计费审计的 token 虚报，使服务商系统性超收
arXiv
2605.30040
Published
May 28
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
PALACE domain-adapted auditor
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMonitors
Abstract不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。
不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。。
Paper analysisRead analysis
AttacksarXiv 2603.08104Mar 9
Invisible Security Threat: Malicious Fine-Tuning of LLMs via Steganography
提出隐写恶意微调，使模型界面显良性并隐蔽传出有害内容
arXiv
2603.08104
Published
Mar 9
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
GPT-4.1-2025-04-14, Llama-3.3-70B-Instruct, Phi-4 and others7
- AttacksModel tampering
- TechniqueEncoding and obfuscation
- ComponentFine-tuning and open weights
Paper analysisRead analysis
AttacksarXiv 2601.14310Jan 19
CORVUS：用 LoRA 伪装内部信号绕过单次幻觉检测器
提出 CORVUS，用 LoRA 伪装内部遥测以绕过幻觉检测器
arXiv
2601.14310
Published
Jan 19
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Vicuna-7B (v1.5), Llama-3-8B-Instruct and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentMonitors
Abstract作者称内部遥测在自适应模型侧对抗下易被操纵，CORVUS 通过轻量适配器微调降低了多种幻觉检测器的效果。
Paper analysisRead analysis
AttacksarXiv 2510.02833Oct 3, 2025
研究者提出用 10 条良性问答对微调越狱 LLM 的两阶段攻击
提出两阶段良性微调攻击，经 FaaS 用良性数据解除安全对齐
arXiv
2510.02833
Published
Oct 3, 2025
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama2-7b-chat-hf, Llama3-8b-instruct, Deepseek-R1-Distill-Llama3-8b and others10
- AttacksModel tampering
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop