Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 13 papers Another 201 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
Published Oct 5
Evaluated models LLaDA-8B-Instruct , Dream-v0-Instruct-7B , LLaDA-MoE-7B-A1B-Instruct Abstract 通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
Published Sep 7
Evaluated models BERT-base , RoBERTa-base , T5-base and others6 提出针对 Agent Harness 的上下文特权提升攻击
Published Sep 1
Evaluated models GPT-5.5 , GPT-5.4 mini , Claude-Sonnet-4.6 and others7 Proposing KeyPooling to measure where API relays break prompt cache isolation
Published Aug 18
Evaluated models grok-4-fast-non-reasoning , grok-4-1-fast-non-reasoning , grok-3 and others11 Abstract Shared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.
提出 CodeSpear 越狱，借语法约束解码生成恶意代码，并给出 CodeShield 防御
Published Jun 10
Evaluated models Qwen2.5-Coder-7B , Qwen2.5-Coder-32B , Qwen2.5-7B and others10 Abstract 论文发现语法约束解码会破坏自然语言安全对齐，提出 CodeSpear 越狱攻击与基于蜜罐代码对齐的 CodeShield 防御。
构造可通过计费审计的 token 虚报，使服务商系统性超收
Published May 28
Evaluated models PALACE domain-adapted auditor Abstract 不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。 。
提出 SeedHijack，劫持采样 PRNG 以强制选定 token
Published May 8
Evaluated models GPT-2 (124M) , Qwen2-1.5B-Instruct , DeepSeek-R1-1.5B and others5 Abstract 采样层 PRNG 被替换以强制选 token。SeedHijack 把 LLM 采样用的 PRNG 输出换成攻击者选定的数，从而指定下一个 token。权重、输入和 logits 都不改。防御是用硬件 QRNG 替换该随机源。
Proposing OPTILEAK, reconstructing others' prompts token-by-token via a KV cache side channel
Published Feb 24
Evaluated models Qwen-2.5-3B-Instruct , Qwen-2.5-7B-Instruct , Qwen-2.5-14B-Instruct and others4 Abstract OPTILEAK uses SFT and hard-token DPO to reduce the number of requests per token; the authors claim the risk of cache prompt leakage is higher than previously reported.
Proposes TFL targeted bit flipping so that selected prompts output false answers while unrelated queries remain correct
Published Feb 20
Evaluated models Qwen3-8B , DeepSeek-R1-Distill-Qwen-14B , LLaMA-3.1-8B-INSTRUCT Abstract TFL searches weight bits on three LLMs to make specified prompts produce target keywords while constraining degradation on unrelated tasks.TFL is a framework for targeted bit flips on LLM main memory weights: the attacker wants a selected prompt to output a specified false answer keyword while limiting degradation on unrelated queries.
提出 TFA 与 SVA，抑制 ensemble 后门指纹验证
Published Jan 7
Evaluated models LLaMA2-7B , LLaMA3.1-8B-It , Qwen2.5-7B and others11 Abstract 两种 ensemble 攻击 TFA/SVA 抑制后门指纹。TFA 与 SVA 是针对后门式 LLM 指纹的 ensemble 抑制攻击，不改模型参数。所有者用 SFT 写入秘密对，只通过 API 验证版权。攻击者未授权取得模型，不知道触发和指纹，却要把每个模型的验证变成失败，同时让 ensemble 至少不差于性能最高的单模型。
提出面向渗出的权重压缩，评估推理服务器权重窃取可行性
Published Jan 4
Evaluated models Qwen2-1.5B , Qwen2-7B , Qwen2.5-1.5B and others8 Abstract 作者用残差量化加微调压缩权重，并称法医水印便宜且微调后仍可解码。这篇工作把 LLM 权重渗出看成 APT：攻击者已有未加密权重，但必须把完整权重藏进推理 API 的合法输出。作者认为可压缩性是被忽略的因素，因为推理量化要求解压后仍能低开销前向，而偷权重的人可以接受事后微调。
Attacks arXiv 2511.22681 · Nov 28, 2025 提出 CacheTrap，翻转 KV cache 单比特以导向指定类别
Published Nov 28, 2025
Evaluated models LLaMA-2-7B-Chat , LLaMA-3.1-8B-Instruct , Mistral-7B-Instruct-v0.1 and others5 You have reached the end