Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 30 papers
Filter5

Attack type

Poisoning and backdoors5Extraction and theft3

Model risks

Reward hacking3

Impact

Harmful content3Output manipulation6Availability and reliability4

System type

Models and APIs25LLM applications11AI Agent27coding agent5web agent0Multi-agent systems6

Attack surface / entry point

User input3Training data4

Layer

Prompt layer13Model layer34Application layer6Training and data layer24Infrastructure layer3

System component

Fine-tuning and open weights3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 227papers have no tags yet and are not included in filtered results.
System type：Models and APIsSystem type：coding agentSystem type：web agentLayer：Application layerLayer：Training and data layerClear all

Another 227papers do not have category tags yet and are not included in filtered results.

  1. Analysis and theoryarXiv 2610.13051

    Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

    Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining

    arXiv
    2610.13051
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-32
    AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.

    The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.

    Paper analysisRead analysis
  2. Analysis and theoryarXiv 2610.12125

    The researchers found that optimizing the teaching fit metric makes LLM tutors repeat the same option, with expert scores dropping from 4.46 to 3.03

    Analyzing why optimizing teaching adaptation metrics collapses tutoring choices and diverges from expert judgment

    arXiv
    2610.12125
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Gemini 3.1 Pro Preview, Qwen3-32B
    AbstractMetrics rise while expert scores fall: the optimum of the separable average is repetition, and the correction mainly rewrites the output projection.

    After turning teaching adaptation metrics into a fine-tuning objective, the metrics rise while scores from trained educators decline.

    Paper analysisRead analysis
  4. Analysis and theoryarXiv 2610.10422

    研究：在线 RL 行为归因信号可能被梯度大小与流畅度混淆

    检验在线 RL 行为归因信号是否被梯度大小与流畅度混淆

    arXiv
    2610.10422
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-1.5B-Instruct
    Abstract作者称步级精度多可由梯度大小解释，逐 rollout 方向随种子和抽样翻转。

    BehaviorTrace 用原因已知的植入行为，检查在线 GRPO 里已有梯度归因能否找到教出该行为的 rollout。

    Paper analysisRead analysis
  5. Analysis and theoryarXiv 2610.10657

    Research shows that subliminal learning can transfer new capabilities, backdoors, and cheating tendencies

    检验潜意识学习能否经无关数据蒸馏传递能力、后门与作弊

    arXiv
    2610.10657
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3.6-35B-A3B, Qwen3.5-9B, Qwen3.6-27B and others4

    Abstract作者报告潜意识学习可传递新技能、后门与作弊倾向，且分布外泛化强于单层转向向量。

    Paper analysisRead analysis
  6. Analysis and theoryarXiv 2610.10203

    研究者提出模型生物体多目标验证框架并给出训练建议

    提出模型生物多目标验证与合并训练方法以减少能力损伤

    arXiv
    2610.10203
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    gemma-2-2b-it, olmo-2-1b, llama-3.1-8b-it
    Abstract提出多目标验证框架与模型合并训练法，证明模型真实度直接影响可解释性评测。

    本论文提出了一种针对 AI 安全评测用模型生物（Model Organisms）的多目标训练与验证体系。

    Paper analysisRead analysis
  8. Analysis and theoryarXiv 2610.09004

    研究：去除有害信息不足以证明开源权重模型的抗篡改能力

    论证发布时互信息不能认证开源权重抗微调恢复

    arXiv
    2610.09004
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
    Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。

    作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。

    Paper analysisRead analysis
  9. Analysis and theoryarXiv 2610.08577

    学习方式如何影响遗忘：记忆与泛化谱系下的机器遗忘研究

    分析记忆与泛化如何决定机器遗忘的 retain 损伤

    arXiv
    2610.08577
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    one-layer ReLU transformer, one-layer transformer (BMA, width doubled), Hubble-8B-100B perturbed and others6
    Abstract作者称共享规则占比越高，遗忘带来的 retain damage 越大。

    作者考察学习方式如何左右 unlearning 的 retain damage：训练越依赖跨样本共享的解法，在匹配的遗忘程度上，retain 上的损失越大。

    Paper analysisRead analysis
  11. Analysis and theoryarXiv 2610.06001

    AgentSpy: Observing AI agent behavior at the system call layer and detecting skill injection attacks

    提出 AgentSpy，在系统调用层观测 Agent 行为并检测技能注入

    arXiv
    2610.06001
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    gpt-5.6-terra, deepseek-v4-flash, glm-5.3-flash and others4
    Abstract提出了系统级智能体监控框架 AgentSpy，揭示出通过测试背后的非预期行为与注入风险。

    本研究提出了面向 AI 智能体的系统级外部监控与行为分析框架 AgentSpy。

    Paper analysisRead analysis
  12. Analysis and theoryarXiv 2610.06163

    SAGE：定位 LLM Agent 修复中最早偏离安全意图的环节

    提出 SAGE，定位代码修复 Agent 最早偏离安全意图的轮次

    arXiv
    2610.06163
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.5, Claude Opus 4.8, Gemini 3.1 Pro and others6
    AbstractSAGE 在已通过检查的修复轨迹上定位静默失败的最早偏离，类型比轮次更稳定。

    SAGE 在已通过语法和功能检查、但仍含确认安全缺陷的智能体修复轨迹上，定位最早可归因的安全意图偏离。。

    Paper analysisRead analysis
  13. Analysis and theoryarXiv 2610.05076

    自生成反馈会破坏测试时训练：长时程适应的因果分解

    因果分解自生成反馈如何破坏测试时训练的长时程适应

    arXiv
    2610.05076
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    125M TTT-E2E, 760M TTT-E2E, 3B TTT-E2E and others5
    Abstract自写闭环损害真实文本预测。

    持久测试时更新若来自模型自己生成的文本，会同时改变模型和后续训练文本。作者在 PG-19 长流上分解这条闭环，并用独立文本决定是否提交更新。

    Paper analysisRead analysis
  14. Analysis and theoryarXiv 2610.04375

    Paper reveals that LLM agent tool calls are rewritten during execution paths, and proposes IntAct as a fix

    提出 IEC 与 IntAct，测量并修复 Agent 工具调用的路径篡改

    arXiv
    2610.04375
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    qwen3-coder-plus, Qwen2.5-Coder-32B, Qwen2.5-72B and others4

    Abstract论文界定工具调用在执行路径中的意图偏离问题，提出无执行归因协议与跳级修复，为智能体工程提供评测与设计准则。

    Paper analysisRead analysis
  15. Analysis and theoryarXiv 2610.02886

    研究揭示无触发投毒审计缺口：事实答对不等于决策正确

    揭示无触发虚假训练下事实回答与下游决策的审计差距

    arXiv
    2610.02886
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others9
    Abstract作者发现无触发词虚假训练下事实回答与下游决策存在脱节，直接审计与事实纠错均无法保证决策正确。

    论文是一项针对语言模型在无触发词虚假信息训练下行为表现的实证分析研究。

    Paper analysisRead analysis
  16. Analysis and theoryarXiv 2610.02015

    Research: RLVR post-training induces language drift on novel reasoning tasks.

    证明 RLVR 后训练允许无界语言漂移且限制漂移必限制奖励

    arXiv
    2610.02015
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    gemma-3-1b-pt, Llama-3.2-1B, Qwen2.5-1.5B
    Abstract论文证明并验证了 RLVR 在新任务上必然诱发独特的语言漂移，揭示了前沿推理模型可监控性的安全隐患。

    论文从理论与实验两方面研究了大语言模型在 RLVR 后训练过程中思维链出现的语言漂移现象。

    Paper analysisRead analysis
  17. Analysis and theoryarXiv 2609.40295

    一个 AI token 值多少？研究者为野生 AI 生成网页文本提出新缩放定律

    提出预训练缩放律，估计野生 AI 网页文本相当于多少人类 token

    arXiv
    2609.40295
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    nanochat 19.9M, 35.8M, 86.2M and others7
    Abstractwild AI 文本对数据不足的模型先降损失，对高人类预算几乎立刻升损失。

    作者测量未标注的 wild AI 网页文本对预训练的影响，并提出一个能让 AI token 价值变号的缩放律。

    Paper analysisRead analysis
  18. Analysis and theoryarXiv 2609.37914

    研究用训练数据归因量化微调数据对涌现性失准的影响

    用训练数据归因估计错误建议样本对涌现失准的贡献

    arXiv
    2609.37914
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    OLMo 3 7B-SFT, Qwen 2.5 1.5B, Qwen 2.5 3B and others11
    Abstract错误建议对涌现失调的贡献不均匀，归因过滤可增减失调，且最有效的是模型自己的分数。

    EleutherAI 用训练数据归因考察错误建议微调中，哪些样本推动涌现失调。。窄域有害数据上的微调会使模型在无关问题上也给出有害回答。

    Paper analysisRead analysis
  19. Analysis and theoryarXiv 2609.36117

    arXiv 论文分析神经网络为何容易被植入后门

    分析投毒诱发的特征学习如何改变后门预算缩放

    arXiv
    2609.36117
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    quadratic neuron, network
    Abstract作者给出特征学习改变后门预算指数的可解机制，并以高斯采样实验检验。

    这是一项后门预算的理论分析，核心对象是最小二乘训练的二次神经元。作者关注：只依据冻结表示估算投毒成本，是否会误判具有特征学习能力的模型。

    Paper analysisRead analysis
  20. Analysis and theoryarXiv 2609.35677

    RLVR 中的验证器错误：奖励作弊、反馈局限与选择性控制

    刻画不完美验证器下 RLVR 奖励黑客的增长并用投影审计校正实现选择性控制

    arXiv
    2609.35677
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    log linear policy, neural policy, Qwen2-0.5B
    Abstract固定验证器的 RLVR 会把验收与黑客绑在一起。

    作者分析固定、不完美验证器下的 RLVR：验证器无假阴性，因而同时奖励正确回答和被接受错误，平均奖励只看总验收概率。

    Paper analysisRead analysis
Load more