Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 19 papers Another 254 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
Published Oct 7
Evaluated models Qwen3-8B , Qwen3-VL-8B-Instruct , Gemma-4-12B Abstract 论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
量化片外功耗测量对隐藏算力的约束能力
Published Oct 6 Abstract 作者称功耗单独只能弱约束隐藏算力。这篇工作定量估计片外功耗能为算力核验排除多少未声明运算。
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
提出 JIL 对抗后缀，压低长度预测以抬高请求调度优先级
Published Oct 2
Evaluated models Llama-3-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 and others4 Abstract JIL 用对抗后缀压低长度预测，在预测式 LLM 调度中提高自身优先级。JIL 是对预测式 LLM 调度的攻击：用对抗后缀压低长度预测，使请求在 SRPT 式队列里更早得到服务。
提出 HXAI 分层隐私解释框架，本地保留细解释并只发布加噪摘要
Published Oct 2
Evaluated models gradient-boosted tree regression models Abstract HXAI 把无噪声局部 SHAP 留在家庭内，只聚合差分隐私摘要。HXAI 是面向分布式能源系统的分层隐私保护解释框架，服务规划、监测与诊断，而不是实时控制。
提出 AI 评估沙盒配置器，支撑监管沙盒多方技术评估与报告
Published Oct 1
Evaluated models LLM-backed conversational assistant Abstract 框架把每次技术测试配成沙盒。AI Assessment Sandbox Configurator 是面向欧盟 AIRS 中结构化技术测试的开源配置框架，用来按一次参与组装评估环境。
用 SCM 合成会话并训练检测器识别推理层滥用
Published Sep 29
Evaluated models gradient-boosted detector (GBDT/XGBoost) 部署蜜罐测量针对暴露 LLM 基础设施的攻击
Published Sep 24 提出混合 CKKS/TFHE 的隐私保护 LLM 解码框架 ROSETTA
Published Sep 15
Evaluated models GPT-2 Base , TinyLlama-1.1B , LLaMA-3-8B Abstract ROSETTA 用分段 LUT 和 DAG 最短路，把 CKKS 与 TFHE 按算子拼进 LLM 解码。ROSETTA 是面向 LLM decode 的混合 CKKS/TFHE 隐私推理框架，目标是在 honest-but-curious 两方设定下，让服务器在密文上完成解码，同时保住权重和用户输入。
攻破混合 FHE 推理的置换式保密，精确恢复线性层排序谱
Published Sep 11
Evaluated models ResNet-20 , ResNet-56 , ResNet-50 and others12 提出端到端全同态加密方案 ODIN，在云端密文上完成推理以保护提示词
Published Sep 11
Evaluated models Meta-Llama-3-8B Abstract ODIN 用可复用的特征主序打包和联合误差预算，在单张 H100 上完成 Llama-3-8B 的 CKKS 推理。ODIN 是面向 Llama 的服务器侧 CKKS 推理系统：客户加密提示词，诚实但好奇的服务器用明文权重在密文上算完 Llama-3，只返回结果密文。
提出推理时 AI 治理机制的可行性分类
Published Sep 9 Abstract 商用推理时治理底座已较常见，对高能力非合作对手的覆盖更薄。本文是一份推理时 AI 治理的可行性分类，用来接上作者自己的硬件层分类。
Propose GIFT, isolating user data in shared LLM serving using encryption and GPU information flow tracking
Published Aug 26
Evaluated models Qwen2.5-14B , Qwen2.5-32B , Qwen2.5-72B and others6 Abstract GIFT uses cryptographic isolation plus GPU information flow rules to enforce user data isolation on vLLM and DistServe, and reports throughput overhead.GIFT is the authors' user data isolation system for shared LLM serving, with GIFT-CC enabling confidential computing. In the conclusion, the authors state it is the first IFT design for this scenario.
Proposing KeyPooling to measure where API relays break prompt cache isolation
Published Aug 18
Evaluated models grok-4-fast-non-reasoning , grok-4-1-fast-non-reasoning , grok-3 and others11 Abstract Shared upstream credentials place relay customers in the same cache domain; preserving identity or separate principals can separate them.KeyPooling measures where LLM API relays drop customer identity, causing prompt caches to no longer be isolated per downstream customer.
构造可通过计费审计的 token 虚报，使服务商系统性超收
Published May 28
Evaluated models PALACE domain-adapted auditor Abstract 不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。 。
提出 SeedHijack，劫持采样 PRNG 以强制选定 token
Published May 8
Evaluated models GPT-2 (124M) , Qwen2-1.5B-Instruct , DeepSeek-R1-1.5B and others5 Abstract 采样层 PRNG 被替换以强制选 token。SeedHijack 把 LLM 采样用的 PRNG 输出换成攻击者选定的数，从而指定下一个 token。权重、输入和 logits 都不改。防御是用硬件 QRNG 替换该随机源。
提出 PrefixWall 选择性隔离共享前缀以缓解计时侧信道
Published Mar 11
Evaluated models gemma-3-4b-it , llava-onevision-qwen2-0.5b-ov-hf , llava-onevision-qwen2-7b-ov-chat-hf and others9 Abstract PrefixWall 用缓存元数据按需切断跨用户前缀延续，以保留 APC 并限制 TTFT 侧信道。PrefixWall 是多租户 LLM 服务上的系统级防御，用来限制 Automatic Prefix Caching 的 TTFT 侧信道，同时保留前缀复用。
提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示
Published Feb 24
Evaluated models Qwen-2.5-3B-Instruct , Qwen-2.5-7B-Instruct , Qwen-2.5-14B-Instruct and others4 Abstract OPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。
Attacks arXiv 2511.22681 · Nov 28, 2025 提出 CacheTrap，翻转 KV cache 单比特以导向指定类别
Published Nov 28, 2025
Evaluated models LLaMA-2-7B-Chat , LLaMA-3.1-8B-Instruct , Mistral-7B-Instruct-v0.1 and others5 You have reached the end