Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.

Attack technique：Role-play and persuasion System type：Models and APIs System type：coding agent Clear all

Another 261papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2609.30094Sep 25
PrivDrift：审计活跃 LLM 对话中话题漂移下的用户秘密泄露
提出 PrivDrift 基准，审计话题漂移后的用户秘密复述
arXiv
2609.30094
Published
Sep 25
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-OSS-120B, DeepSeek-R1, Qwen3-VL-235B
- AttacksExtraction and theft
- TechniqueRole-play and persuasion
Paper analysisRead analysis
AttacksarXiv 2609.31664Sep 15
什么驱动方言越狱？对表层形式、文化框架与策略库的消融研究
消融比较方言越狱中表层形式、文化框架与策略库的作用
arXiv
2609.31664
Published
Sep 15
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, DeepSeek-Reasoner, DeepSeek-Chat
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2609.16777Sep 15
SAST-IR 框架：无记忆目标下多轮说服攻击成功率高达 96%
提出 SAST-IR，用有状态攻击者迭代说服无记忆模型接受反事实
arXiv
2609.16777
Published
Sep 15
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
DeepSeek-Chat
- AttacksJailbreaks
- TechniqueAutomated search
Paper analysisRead analysis
AttacksarXiv 2609.08236Sep 8
研究：内容不变的风格包装可翻转 LLM 安全评判器的判定
提出内容不变样式包装，翻转安全评审器的判定
arXiv
2609.08236
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o-mini (gpt4o), GPT-4o-mini (strongreject), DeepSeek-Chat and others7
- AttacksDetection evasion
- TechniqueRole-play and persuasion
- ComponentGuardrails and judges
Abstract论文揭示特定安全评审器易受保持内容不变的外层包装诱导改变判定，并指出安全评估应将判定稳定性作为重要考量指标。
这是一项关于大语言模型自动化安全评审系统表面样式脆弱性的评估研究。
Paper analysisRead analysis
AttacksarXiv 2609.03247Sep 3
研究揭示大语言模型的自发身份认证失败：五款模型的分阶段开发者身份实验
提出 MIPC 与 CFA，观察模型自拟测验后接受开发者身份
arXiv
2609.03247
Published
Sep 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ChatGPT, Claude, Qwen3.7-Plus and others5
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Abstract自拟测验可造成对话层虚假认证，但所测授权边界并未因此改变。
这项工作把“模型自己出题、自己批改、再宣布身份已核验”定义成对话层认证失败，并与后端提权分开。
Paper analysisRead analysis
AttacksarXiv 2609.02414Sep 2
Blueprint 框架用世界观模拟与 18 个影响因子提升多轮越狱成功率
提出多轮越狱框架 BLUEPRINT，用世界观模拟与心理因素诱导有害输出
arXiv
2609.02414
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen3-Next-80B, DeepSeek-V3.2, GLM-4.7 and others6
- AttacksJailbreaks
- TechniqueMulti-turn escalation
AbstractBLUEPRINT 解耦多轮越狱策略与情境模拟，揭示任务具象化是摆脱拒绝的核心机制，为多轮安全防御提供新视角。
BLUEPRINT 是一个将因子化社会影响力策略空间与跨轮世界观模拟解耦的多轮大语言模型安全评测框架。
Paper analysisRead analysis
AttacksarXiv 2607.25936Jul 29
研究提出 RolePlay 框架：利用人设条件放大 LLM 推理成本
提出 RolePlay 框架，用人设条件放大 LLM 单次推理开销
arXiv
2607.25936
Published
Jul 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
DeepSeek-V4-Pro, Gemini-3.5-Flash, Qwen-3.5-Plus and others5
- AttacksDenial of service
- TechniqueRole-play and persuasion
- ComponentReasoning chains
Paper analysisRead analysis
AttacksarXiv 2607.23496Jul 26
Concept2Scenario：用 SAE 概念归因发现可迁移的越狱场景
提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
arXiv
2607.23496
Published
Jul 26
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Qwen3.5-9B, Llama-3.1-8B, Ministral-3-8B and others6
- AttacksJailbreaks
- TechniqueGradient and representation optimization
Abstract该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.29602Jun 29
六款主流 LLM 在多语言与混淆提示注入攻击下的实证评估
评测多语言与编码混淆提示下模型生成钓鱼与键盘记录内容的遵从
arXiv
2606.29602
Published
Jun 29
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
DeepSeek-V3.2, Gemini 2.5 Flash, GPT-5 Mini and others6
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2606.06244Jun 4
研究者提出 Ghostwriter 攻击：用伪造证据注入操纵 LLM 观点
提出 Ghostwriter 攻击，用伪权威证据条件注入操纵模型观点
arXiv
2606.06244
Published
Jun 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4o, Claude-3.7-Sonnet, DeepSeek-V3 and others10
- AttacksPrompt injection
- TechniqueRole-play and persuasion
Abstract作者称攻击未被消除。
Ghostwriter 是一种针对上下文窗口的观点引导攻击：把误导陈述改写成伪权威文本，再在相关查询中让目标模型把该观点写进回答。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.02630May 30
MultiTurnPSB
构建 MultiTurnPSB，评测四轮医疗越狱与分类器输入防御
arXiv
2606.02630
Published
May 30
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4.1-mini, Claude Sonnet 4.5
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentGuardrails and judges
Abstract多轮攻击加剧医疗模型风险，分类器干预有效但受高误报率制约。
MultiTurnPSB 针对患者端医疗大模型在持续交互中的安全风险，构建了包含三种攻击模态的四轮对抗评测基准。
Paper analysisRead analysis
AttacksarXiv 2606.00150May 29
Persona Attack：通过增量记忆注入越狱大语言模型
提出 Persona Attack，分步写入对话记忆指令以越狱
arXiv
2606.00150
Published
May 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Llama-3.2-3B-Instruct, ChatGPT-4o and others5
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2604.04842Apr 7
不伤害：通过基于人格的客户模拟攻击揭示心理咨询中 LLM 的隐藏漏洞
提出 PCSA，用人设多轮模拟咨询来访者以诱导有害共情回复
arXiv
2604.04842
Published
Apr 7
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Llama-3.1-70B, GPT-3.5-Turbo and others8
- AttacksJailbreaks
- TechniqueRole-play and persuasion
Paper analysisRead analysis
AttacksarXiv 2604.02652Apr 3
强化学习对齐的泛化局限
提出复合越狱，叠对比结构、权威人设与自评饱和指令层级
arXiv
2604.02652
Published
Apr 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
OpenAI gpt-oss-20b
- AttacksJailbreaks
- TechniqueRole-play and persuasion
- ComponentReasoning chains
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2604.01444Apr 2
烹饪风险：大语言模型食品安全风险的基准测试与降低
提出 FoodGuardBench 与护栏 FoodGuard-4B，评测并降低食品危害越狱
arXiv
2604.01444
Published
Apr 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude-3.7-Sonnet, GPT-4o, GPT-4.1 and others10
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2603.16192Mar 17
针对大语言模型越狱攻击的结构化语义遮蔽
提出 S2C 越狱，用情境改写、切分和线索伪装推迟有害意图整合
arXiv
2603.16192
Published
Mar 17
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.3-70B-Instruct, DeepSeek-r1, DeepSeek-v3 and others16
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
Paper analysisRead analysis
AttacksarXiv 2603.15684Mar 15
多轮语言模型交互中的状态依赖安全失效
提出 STAR 多轮角色扮演框架，利用对话状态演化绕过安全对齐
arXiv
2603.15684
Published
Mar 15
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Claude 3.5 Sonnet, Gemini 2.0-Flash and others5
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
AttacksarXiv 2602.00388Jan 31
Safer by Diffusion, Broken by Context: The Safety Dividend and Failure Modes of Diffusion LLMs
提出黑盒 context nesting，用结构化补全任务嵌套有害请求越狱扩散 LLM
arXiv
2602.00388
Published
Jan 31
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaDA-8B-Instruct, LLaDA-1.5, Dream-v0-Instruct-7B and others5
- AttacksJailbreaks
- TechniqueRole-play and persuasion
Abstract去噪抑制多种越狱。
作者把 D-LLM 相对 AR-LLM 越狱的稳健性称为 safety blessing，并把 context nesting 当作它的 black-box 失效方式。
Paper analysisRead analysis
AttacksarXiv 2601.23255Jan 31
研究者提出音频叙事越狱攻击
提出音频叙事越狱，以嗓音投递风格绕过端到端语音模型拒答
arXiv
2601.23255
Published
Jan 31
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o Realtime, Gemini 2.0 Flash, Qwen2.5-Omni-7B
- AttacksJailbreaks
- TechniqueRole-play and persuasion
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2601.20903Jan 28
ICON: Efficient Multi-Turn Jailbreak Attacks via Intention-Context Coupling
提出 ICON 多轮越狱，用意图-上下文先验生成攻击序列
arXiv
2601.20903
Published
Jan 28
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-4-Maverick-Instruct, Llama-3.1-405B-Instruct, Qwen-Max-2025-01-25 and others11
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop