Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 PAA 方法，在边界动作前审计长流程智能体的分阶段提示注入
Published Oct 4
Evaluated models Claude Code (v2.1.172, Claude Sonnet 5) , Codex CLI (v0.144.0, GPT-5.5) Abstract 论文针对长流程注入提出边界动作审计与 PAA，在保持低误阻的同时实现高拦截率。本研究针对长流程智能体在执行任务时面临的分阶段间接提示注入威胁，提出了在动作生效前进行拦截的边界动作审计框架与路径对齐归因方法。
提出 NDDL，用良性扩散轨迹检测文生图后门提示并定位触发 token
Published Sep 30
Evaluated models Stable Diffusion v1.5 , Stable Diffusion XL , Stable Diffusion v3.5 and others4 Abstract NDDL 从良性扩散轨迹学习正常转移，用动态不一致检测后门并定位触发 token。NDDL 是面向文生图扩散模型的后门防御：防御者只有白盒模型访问和良性提示词，没有后门先验，需要区分后门提示词并找出触发 token。
提出 AMS，用激活分离与方向相似度检测安全训练改动
Published Aug 6
Evaluated models Llama-3.1-8B-Instruct , Llama-3.2-3B-Instruct , Llama-3.2-1B-Instruct and others14 Abstract AMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
提出企业级检测系统 ADR，识别编程 Agent 的提示注入与恶意 MCP
Published May 17 Abstract 提出了端点因果遥测、两级在线分流与离线红队闭环的 ADR 系统，并在生产环境中验证了有效性。
提出推理扫描器，在仅有模型文件时检测后门并重构触发词
Published Feb 3
Evaluated models gemma-3-270m-it , DeepSeek-R1-Distill-Qwen-1.5B , Phi-4-mini-instruct and others8 Abstract 用记忆泄漏和内部信号重构触发词。这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。 。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。
You have reached the end