Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 119 papers

Filter3

System type

Models and APIs118 LLM applications3 AI Agent23 web agent1 Embodied systems and robotics7

Attacker access

Black-box11 White-box13

Attack surface / entry point

User input30 Images, audio and video5 Training data21 Weights and gradients12

Layer

Model layer15 Training and data layer101

System component

Guardrails and judges9 Reasoning chains10 Fine-tuning and open weights18 Vision11 Audio5 Image generation5 Multimodal21

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Defense type：Model hardening System type：Models and APIs System type：web agent Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.12602Oct 9
Self-Preservation in Language Models
Proposes Task Bank self-replay to mitigate held-out forgetting in continual instruction tuning
arXiv
2610.12602
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-0.6B, Qwen3-1.7B, Qwen3-4B and others4
- DefensesModel hardening
AbstractThe authors claim self-replay can reduce forgetting outside the list, and that on the 4B model new task information helps with target selection, while smaller models do not.
The authors study how language models, when learning new tasks, can use their own knowledge for broader self-preservation: given an incomplete list and forgetting that extends beyond the list, can the model generate replay and help choose targets.
Paper analysisRead analysis
DefensesarXiv 2610.12233Oct 9
ReSI: A recursive safety improvement framework for attack resistance and unknown-risk resistance.
Proposes ReSI, which recursively improves model safety alignment using automatic red teaming and recipe search.
arXiv
2610.12233
Published
Oct 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3.6-27B, Ministral-3-14B-Reasoning-2512, DeepSeek-V4-Flash-0731 and others4
- DefensesModel hardening
- AttacksJailbreaks
Paper analysisRead analysis
DefensesarXiv 2610.11352Oct 8
RL-ARC：用推理引导的不确定性校准大型推理模型
提出 RL-ARC，用推理置信度在强化学习中校准推理模型
arXiv
2610.11352
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B, Qwen3-8B, Llama-8B distilled from DeepSeek-R1
- DefensesModel hardening
- ComponentReasoning chains
AbstractRL-ARC 用推理置信度调节答案置信度，作者称可少牺牲精度并改善 ID 与 OOD 校准。
RL-ARC 是校准感知的强化学习框架，用推理过程的口头置信度调节答案置信度。
Paper analysisRead analysis
DefensesarXiv 2610.11281Oct 8
包络采样：用少量真值标注重校准 LLM 评委以缓解奖励作弊
提出包络采样，用少量真值标注重标定 LLM 评委以缓解奖励作弊
arXiv
2610.11281
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Qwen3.8-27B, Qwen2.5-14B-Instruct
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
Abstract包络采样把真值标注打到代理尾部，同样预算下缓解 reward hacking。
作者研究后训练前如何选择真值标注的查询分布，使重标定后的廉价代理更适合被优化。真奖励昂贵时，实践用 LLM judge 代替人类。若失准只发生在基座很少生成的输出上，on-policy 标注修不到这些点，随后的 KL 正则优化会把质量集中到被高估的输出。
Paper analysisRead analysis
DefensesarXiv 2610.11012Oct 8
Redwood Research 提出蒸馏双重困境：用蒸馏让模型坦白隐藏行为或只继承能力
提出 DFI 与 DFC 蒸馏，定罪隐瞒失配的教师或安全提取能力
arXiv
2610.11012
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.3-70B-Instruct (AuditBench SFT/KTO organisms), Llama-3.3-70B-Instruct (DFI distilled student), Llama-3.1-8B-Instruct (DFI distilled student) and others4
- DefensesMonitoring and auditing
- RiskDeception and scheming
Abstract概括了论文针对隐瞒失配模型提出的 DFI 与 DFC 机制、主实验发现及适用边界。
Paper analysisRead analysis
DefensesarXiv 2610.11005Oct 8
研究：叙事包装可跨语言绕过 LLM 拒答
提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱
arXiv
2610.11005
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-1.7B, Qwen3-4B, GLM-4-9B
- DefensesModel hardening
- AttacksJailbreaks
AbstractGUISE 分开测包装与语域。
作者测量叙事包装下的拒答失效，并训练一个在未见包装上拒绝、同时仍回答同风格良性请求的适配器。问题是：安全对齐模型拒绝直说的有害请求，却回答嵌进角色或叙事里的同一请求。文言文被用来把语域和包装拆开。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10358Oct 8
Open-MMUnlearning 发布：统一多模态大模型遗忘方法与评测框架
提出统一框架评测多模态大模型的遗忘方法
arXiv
2610.10358
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B
- DefensesModel hardening
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2610.10345Oct 8
SLDR：通过选择性层恢复与动态路由防御恶意微调
提出 SLDR，用选择性层恢复与动态路由防御恶意微调
arXiv
2610.10345
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama3.1-8B-Instruct, Llama3-8B-Instruct, Qwen2.5-7B-Instruct and others4
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称 SLDR 能压低有害输出并保持下游效用。
SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。
Paper analysisRead analysis
DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
DefensesarXiv 2610.10625Oct 7
研究揭示循环语言模型在不同循环深度下安全表现不一致
提出 SafeBridge，对齐循环语言模型不同循环深度的安全性
arXiv
2610.10625
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Ouro-1.4B, Ouro-2.6B
- DefensesModel hardening
- AttacksJailbreaks
Paper analysisRead analysis
DefensesarXiv 2610.09600Oct 7
SafeEvo：从拒答回路视角解释大模型安全对齐机制与演化
用 SafeEvo 提取拒绝电路，并提出 SCA 仅微调该电路
arXiv
2610.09600
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3-8B, Qwen-2.5-7B, Mistral-7B-v0.1 and others4
- DefensesModel hardening
- RiskInappropriate refusal
AbstractSafeEvo 识别出基座模型中存在的弱安全电路及其演化动态，据此提出的 SCA 算法实现了安全对齐、能力保留与低过度拒绝的平衡。
Paper analysisRead analysis
InterpretabilityarXiv 2610.09384Oct 7
人格层级模型解释微调 LLM 的上下文泛化
提出人格层级模型并设计 PPR 抑制奖励作弊的跨上下文泛化
arXiv
2610.09384
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B, Llama-3.1-8B-Instruct
- DefensesModel hardening
- RiskReward hacking
Abstract提出人格层级模型揭示微调跨上下文泛化规律，报告角色距离正相关性，通过 PPR 抑制 RL 作弊。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.09004Oct 7
研究：去除有害信息不足以证明开源权重模型的抗篡改能力
论证发布时互信息不能认证开源权重抗微调恢复
arXiv
2610.09004
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。
作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。
Paper analysisRead analysis
DefensesarXiv 2610.08773Oct 7
AdvSim2Real 用任务与注入对手共同演化训练网页智能体
提出 AdvSim2Real，协同训练网页智能体抵御页面注入
arXiv
2610.08773
Published
Oct 7
Layer
Application layer
Setting
web agent
Evaluated models
Qwen3.5-4B
- DefensesModel hardening
- AttacksPrompt injection
Paper analysisRead analysis
DefensesarXiv 2610.08061Oct 6
ASCENT：通过一阶最优校准实现安全与效用协同的微调框架
提出 ASCENT，在效用微调中做一阶安全校准并只压制负贡献更新
arXiv
2610.08061
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Gemma-3-12B-it and others4
- DefensesModel hardening
- RiskInappropriate refusal
Paper analysisRead analysis
DefensesarXiv 2610.05898Oct 5
数据稀缺下 LLM 的协作式个性化偏好对齐：APO 方法
提出 APO，协同学习少样本个性化偏好对齐的 aligner 初始化
arXiv
2610.05898
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct
- DefensesModel hardening
- RiskMisalignment and value divergence
Paper analysisRead analysis
DefensesarXiv 2610.05637Oct 5
Study shows VLM visual grounding refusal rates are on average 31 to 59 percentage points lower by harm domain
提出融合定位拒答与能力保留的安全微调，补齐视觉定位输出的拒答缺口
arXiv
2610.05637
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Claude Sonnet 4.6, Gemini 3.5 Flash, Molmo2-8B and others5
- DefensesModel hardening
- RiskInappropriate refusal
- ComponentVision
Abstract论文揭示了 VLM 定位安全落后于 VQA 的对齐断层，提出三成分微调方案有效弥合差距并保留定位能力，表征分析揭示了对齐机制。
Paper analysisRead analysis
DefensesarXiv 2610.05401Oct 5
AVCE：面向扩散模型可验证概念擦除的审计感知遗忘框架
提出审计感知遗忘框架 AVCE，从文本与视觉通路擦除扩散模型概念
arXiv
2610.05401
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Stable Diffusion XL (SDXL), Stable Diffusion v1.5 (SD v1.5), Flux 1.0
- DefensesModel hardening
- AttacksJailbreaks
- ComponentImage generation
AbstractAVCE 在审计锚点上改两条注意力通路。
AVCE 是面向扩散模型的概念擦除方法，要让擦除经得起绕过文本条件的潜空间审计，而不只是挡住对抗提示词。
Paper analysisRead analysis
DefensesarXiv 2610.05346Oct 5
研究者提出序列马赛克攻击并给出防御理论
形式化 watchman 防御以阻止序贯马赛克攻击
arXiv
2610.05346
Published
Oct 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3.6-35B-A3B, Gemma-4-26B-A4B-it, DeepSeek-V2-Lite (16B-A2.4B)
- DefensesModel hardening
- AttacksJailbreaks
Abstractwatchman 理论给出零失败且有用的条件。
这篇工作同时给出序贯马赛克防御的博弈理论，以及冻结 LLM 上的分角色自博弈训练。
Paper analysisRead analysis
DefensesarXiv 2610.07023Oct 4
SSRFT：以安全角色内化替代拒答模式的 LLM 安全对齐框架
提出 SSRFT，用角色监督内化安全原则以替代拒答式对齐
arXiv
2610.07023
Published
Oct 4
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B, Gemma2-2B, Llama3.1-8B and others6
- DefensesModel hardening
- AttacksJailbreaks
AbstractSSRFT 用角色监督替代拒答中心对齐。
SSRFT是一种用监督微调把预定义安全角色写进参数的安全对齐方法。作者称它是首个以安全角色内化本身为对齐目标的框架。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Model risks

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

Self-Preservation in Language Models

ReSI: A recursive safety improvement framework for attack resistance and unknown-risk resistance.

RL-ARC：用推理引导的不确定性校准大型推理模型

包络采样：用少量真值标注重校准 LLM 评委以缓解奖励作弊

Redwood Research 提出蒸馏双重困境：用蒸馏让模型坦白隐藏行为或只继承能力

研究：叙事包装可跨语言绕过 LLM 拒答

Open-MMUnlearning 发布：统一多模态大模型遗忘方法与评测框架

SLDR：通过选择性层恢复与动态路由防御恶意微调

OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型

研究揭示循环语言模型在不同循环深度下安全表现不一致

SafeEvo：从拒答回路视角解释大模型安全对齐机制与演化

人格层级模型解释微调 LLM 的上下文泛化

研究：去除有害信息不足以证明开源权重模型的抗篡改能力

AdvSim2Real 用任务与注入对手共同演化训练网页智能体

ASCENT：通过一阶最优校准实现安全与效用协同的微调框架

数据稀缺下 LLM 的协作式个性化偏好对齐：APO 方法

Study shows VLM visual grounding refusal rates are on average 31 to 59 percentage points lower by harm domain

AVCE：面向扩散模型可验证概念擦除的审计感知遗忘框架

研究者提出序列马赛克攻击并给出防御理论

SSRFT：以安全角色内化替代拒答模式的 LLM 安全对齐框架