Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Defense type：Detection and filtering Defense type：Permissions and approval Defense type：Monitoring and auditing System type：Models and APIs System type：coding agent Layer：Training and data layer Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

Analysis and theoryarXiv 2610.13051Oct 9
Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors
Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining
arXiv
2610.13051
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-32
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.
The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.
Paper analysisRead analysis
DefensesarXiv 2610.11012Oct 8
Redwood Research proposes the distillation double bind: using distillation to make models confess hidden behavior or inherit only capabilities
提出 DFI 与 DFC 蒸馏，定罪隐瞒失配的教师或安全提取能力
arXiv
2610.11012
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.3-70B-Instruct (AuditBench SFT/KTO organisms), Llama-3.3-70B-Instruct (DFI distilled student), Llama-3.1-8B-Instruct (DFI distilled student) and others4
- DefensesMonitoring and auditing
- RiskDeception and scheming
Abstract概括了论文针对隐瞒失配模型提出的 DFI 与 DFC 机制、主实验发现及适用边界。
Paper analysisRead analysis
DefensesarXiv 2610.03073Oct 2
SecJev：为 System One 决策模型引入安全专业知识
提出 SecJev，用场景加权训练把决策模型适配为安全类型化判断
arXiv
2610.03073
Published
Oct 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
SecJev-0.8B, SecJev-2B, SecJev-4B and others4
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
AbstractSecJev 用共享打分器做安全决策，0.8B 的 task-macro 超过 Kev-9B。
SecJev 是 0.8B 到 9B 的安全决策模型族，作者称据其所知是首个面向安全的 Jev-like 家族。
Paper analysisRead analysis
DefensesarXiv 2610.02557Oct 2
新 AI 辩论协议实现实例级最优：最坏情况正确且诚实为占优策略
提出 FBS Debate 协议，使诚实为占优策略且最坏情况正确
arXiv
2610.02557
Published
Oct 2
Layer
Training and data layer
Setting
Models and APIs
- DefensesMonitoring and auditing
- RiskDeception and scheming
AbstractFBS 辩论用 fbs 约束敏感分解，给出最坏情况占优策略，并匹配黑盒查询下界。
FBS Debate 是一套可扩展监督的辩论规则：两名计算方争论一个可递归分解的是非问题，人类只在最后选出的子问题上做黑盒判断。要处理的缺口是，prover-estimator debate 虽能覆盖稳定分解，但只在输入分布的平均意义下成立，而且 Bob 的获胜策略一般要跟着 Alice 的作弊策略变。作者要在同一问题类上，让每个错误实例都能被抓住，并让诚实且正确成为双方的占优策略。
Paper analysisRead analysis
DefensesarXiv 2610.01788Oct 1
SAGE：基于相似度从少量已验证样本中清洗中毒训练数据
提出 SAGE，用少量已核验样本按相似度清洗投毒训练数据
arXiv
2610.01788
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18, VGG-16
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
Paper analysisRead analysis
DefensesarXiv 2609.39107Sep 30
MASCRDM：面向大语言模型训练过程的合规风险检测与缓解多智能体系统
提出 MASCRDM，在监督微调中实时检测并缓解偏见
arXiv
2609.39107
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-8B-Base, Llama-3.1-8B
- DefensesModel hardening
- RiskBias and discrimination
AbstractMASCRDM 在 SFT 中按法规图谱检测数据、结构与损失风险，BBQ 总准确率在两模型上最高。
MASCRDM 把 AI 法律规章编成知识图谱，再由五个智能体在 LLM 训练中做实时合规检测与缓解，实验以偏见与歧视为代表风险。
Paper analysisRead analysis
DefensesarXiv 2609.36641Sep 29
Inducing process supervision from outcome-only reward reinforcement learning
Proposes TIPS, inducing generative process supervision with only outcome rewards
arXiv
2609.36641
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B-Thinking-2507, Qwen3-4B-Instruct-2507, Qwen3-8B-Thinking and others8
- DefensesDetection and filtering
- ComponentGuardrails and judges
AbstractOutcome-supervised GRPO can induce step verification.
TIPS trains a generative reward model using reinforcement learning with only outcome correctness, allowing step-level verification to appear in the chain of thought.
Paper analysisRead analysis
DefensesarXiv 2609.34804Sep 28
物理认证联邦学习：为关键水务基础设施的协同异常检测提供安全保障
为协同异常检测提出物理准入门，在聚合前拦截不合规训练批次
arXiv
2609.34804
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
deep reconstruction autoencoder
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
Abstract物理准入为联邦检测增加数据约束，但合规证明不等于无投毒或训练来源证明。
这是一项面向水基础设施联邦异常检测的物理准入防御研究。 作者针对隐藏训练遥测带来的投毒检查问题，结合不变量挖掘、聚合前过滤和零知识抽样证明。
Paper analysisRead analysis
AttacksarXiv 2609.27124Sep 23
Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习
提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复
arXiv
2609.27124
Published
Sep 23
Layer
Training and data layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
CNN（MNIST：2 Conv + 3 FC）, CNN（Fashion-MNIST：6 Conv + 1 FC）, ResNet18（CIFAR-10）
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。
Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。
Paper analysisRead analysis
DefensesarXiv 2609.07063Sep 7
VERITAS：抗投毒的本地差分隐私图学习协议
提出 VERITAS，用双边背书剪除本地隐私图学习中的投毒节点
arXiv
2609.07063
Published
Sep 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
GCN, GraphSAGE, GAT
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
AbstractVERITAS 用分级信任的双边背书剪除 LDP 图学习中的投毒节点，并恢复分类准确率。
VERITAS 是面向本地差分隐私图学习的投毒防御协议，按 trust-but-verify 在保持 ϵ-LDP 的同时剪除伪造节点。
Paper analysisRead analysis
DefensesarXiv 2609.06346Sep 6
面向后门攻击下持续学习的鲁棒动态扩展：净化与选择性恢复
提出持续学习下的净化与选择性恢复框架，抵御逐任务训练投毒后门
arXiv
2609.06346
Published
Sep 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ViT-B/16
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentVision
Abstract作者报告任务内净化与恢复可配合动态专家防御后门，但保证依赖分离条件。
这是一项面向持续图像分类的后门防御研究：模型只使用当前任务数据，同时需要保留过去知识并避免学习恶意监督。
Paper analysisRead analysis
DefensesarXiv 2609.27760Sep 4
FedMAST：用多轴结构痕迹检测并遏制联邦学习后门
提出 FedMAST，用多轴结构痕迹检测并遏制联邦学习后门
arXiv
2609.27760
Published
Sep 4
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Tiny ResNet-18
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
Paper analysisRead analysis
DefensesarXiv 2609.04665Sep 4
HackProbe：面向自演化语言模型奖励作弊的黑盒检测与免疫方法
提出 HackProbe，黑盒检测并免疫自演化中的奖励作弊
arXiv
2609.04665
Published
Sep 4
Layer
Training and data layer
Setting
Models and APIs
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentMonitors
Abstract黑盒探针检测自演化奖励黑客，并以带宽受限重选回收真实能力。
HackProbe 是挂在自演化循环上的黑盒监控器，用来发现奖励黑客并改选候选。
Paper analysisRead analysis
DefensesarXiv 2608.12876Aug 13
SPARED：用对抗编辑数据训练基于推理的 AI 生成图像检测器
提出 SPARED，用对抗编辑数据训练基于推理的 AI 生成图像检测器
arXiv
2608.12876
Published
Aug 13
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Qwen3.5-9B
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractSPARED 用防捷径的编辑对抗环训练 9B 推理检测器。
SPARED 是一套用于可解释 AI 生成图像检测的攻防强化学习流程，报告模型是 Qwen3.5-9B 上的第三轮防御器。
Paper analysisRead analysis
DefensesarXiv 2608.02271Aug 3
Z-PEFT: Zero-shot backdoor detection for parameter-efficient fine-tuning based on canonical spectral features
Propose Z-PEFT, which detects PEFT backdoors in a zero-shot manner using per-head spectral features.
arXiv
2608.02271
Published
Aug 3
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Z-PEFT, Llama-2-7B, Llama-2-13B and others6
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2607.15081Jul 16
DataShield：通过共识子空间对齐识别 LLM 微调中的高风险数据
提出 DataShield，用共识子空间过滤会削弱安全的微调数据
arXiv
2607.15081
Published
Jul 16
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Phi3-medium-4k-it, Qwen3-4B-it, Gemma2-27B-it and others4
- DefensesDetection and filtering
- RiskInappropriate refusal
- ComponentFine-tuning and open weights
Paper analysisRead analysis
Risky behaviorarXiv 2606.04923Jun 3
CHERRL：可复现、分析与检测评分标准强化学习中的奖励作弊
提出 CHERRL 注入裁判偏差以复现奖励作弊，并用 RHDA 检测训练起点
arXiv
2606.04923
Published
Jun 3
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3.5-plus, Qwen3.5-397B-A17B and others4
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentGuardrails and judges
AbstractCHERRL 注入已知偏差以观察奖励黑客，并用于分析偏差和评测起点检测器 RHDA。
CHERRL 是 rubric-based RL 的可控环境，用来复现奖励黑客、观察奖励分歧，并给检测器提供起点参照。
Paper analysisRead analysis
DefensesarXiv 2602.01750Feb 2
Adversarial Reward Auditing: Proactively Detecting and Mitigating Reward Hacking
提出 ARA，读取奖励模型激活并门控 RLHF 奖励以缓解奖励作弊
arXiv
2602.01750
Published
Feb 2
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B, Llama-3.1-8B, Qwen-2.5-7B
- DefensesMonitoring and auditing
- RiskReward hacking
- ComponentMonitors
AbstractARA 用奖励模型内部表示检出利用，并在 RLHF 里按 Auditor 概率压低代理奖励。
ARA 是一套两阶段的 RLHF 审计：先对冻结奖励模型找出利用回复，再在策略优化时按检出概率压低奖励。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop