Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
攻破混合 FHE 推理的置换式保密，精确恢复线性层排序谱
Published Sep 11
Evaluated models ResNet-20 , ResNet-56 , ResNet-50 and others12 提出端到端全同态加密方案 ODIN，在云端密文上完成推理以保护提示词
Published Sep 11
Evaluated models Meta-Llama-3-8B Abstract ODIN 用可复用的特征主序打包和联合误差预算，在单张 H100 上完成 Llama-3-8B 的 CKKS 推理。ODIN 是面向 Llama 的服务器侧 CKKS 推理系统：客户加密提示词，诚实但好奇的服务器用明文权重在密文上算完 Llama-3，只返回结果密文。
Propose GIFT, isolating user data in shared LLM serving using encryption and GPU information flow tracking
Published Aug 26
Evaluated models Qwen2.5-14B , Qwen2.5-32B , Qwen2.5-72B and others6 Abstract GIFT uses cryptographic isolation plus GPU information flow rules to enforce user data isolation on vLLM and DistServe, and reports throughput overhead.GIFT is the authors' user data isolation system for shared LLM serving, with GIFT-CC enabling confidential computing. In the conclusion, the authors state it is the first IFT design for this scenario.
Proposing KeyPooling to measure where API relays break prompt cache isolation
Published Aug 18
Evaluated models grok-4-fast-non-reasoning , grok-4-1-fast-non-reasoning , grok-3 and others11 Abstract Shared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.
Proposes PrefixWall, which selectively isolates shared prefixes to mitigate timing side channels
Published Mar 11
Evaluated models gemma-3-4b-it , llava-onevision-qwen2-0.5b-ov-hf , llava-onevision-qwen2-7b-ov-chat-hf and others9 Abstract PrefixWall uses cache metadata to selectively cut off cross-user prefix continuation, preserving APC while limiting the TTFT side channel.PrefixWall is a system-level defense for multi-tenant LLM services that limits the TTFT side channel of Automatic Prefix Caching while preserving prefix reuse.
提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示
Published Feb 24
Evaluated models Qwen-2.5-3B-Instruct , Qwen-2.5-7B-Instruct , Qwen-2.5-14B-Instruct and others4 Abstract OPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。
提出面向渗出的权重压缩，评估推理服务器权重窃取可行性
Published Jan 4
Evaluated models Qwen2-1.5B , Qwen2-7B , Qwen2.5-1.5B and others8 Abstract 作者用残差量化加微调压缩权重，并称法医水印便宜且微调后仍可解码。这篇工作把 LLM 权重渗出看成 APT：攻击者已有未加密权重，但必须把完整权重藏进推理 API 的合法输出。作者认为可压缩性是被忽略的因素，因为推理量化要求解压后仍能低开销前向，而偷权重的人可以接受事后微调。
You have reached the end