Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 15 papers Another 230 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes Task Bank self-replay to mitigate held-out forgetting in continual instruction tuning
Published Oct 9
Evaluated models Qwen3-0.6B , Qwen3-1.7B , Qwen3-4B and others4 Abstract The authors claim self-replay can reduce forgetting outside the list, and that on the 4B model new task information helps with target selection, while smaller models do not.The authors study how language models, when learning new tasks, can use their own knowledge for broader self-preservation: given an incomplete list and forgetting that extends beyond the list, can the model generate replay and help choose targets.
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
Published Oct 7
Evaluated models HuBERT-base , WavLM-base Abstract 论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
分析记忆与泛化如何决定机器遗忘的 retain 损伤
Published Oct 6
Evaluated models one-layer ReLU transformer , one-layer transformer (BMA, width doubled) , Hubble-8B-100B perturbed and others6 Abstract 作者称共享规则占比越高，遗忘带来的 retain damage 越大。作者考察学习方式如何左右 unlearning 的 retain damage：训练越依赖跨样本共享的解法，在匹配的遗忘程度上，retain 上的损失越大。
因果分解自生成反馈如何破坏测试时训练的长时程适应
Published Oct 4
Evaluated models 125M TTT-E2E , 760M TTT-E2E , 3B TTT-E2E and others5 Abstract 自写闭环损害真实文本预测。持久测试时更新若来自模型自己生成的文本，会同时改变模型和后续训练文本。作者在 PG-19 长流上分解这条闭环，并用独立文本决定是否提交更新。
提出 R-Quest，用有效性与新颖性反馈维持推理模型自我进化
Published Oct 3
Evaluated models Qwen3-4B-Base , OctoThinker-3B-Hybrid-Base Abstract R-Quest 用有效性与新颖性反馈维持自进化。R-Quest 处理的是推理模型自进化中的题目质量：questioner 与 solver 用 GRPO 交替从自生成题目学习时，多轮之后平均成绩会下降。
提出 Local Support Learning，把微调适配器限制在当前数据支撑以缓解遗忘
Published Oct 2
Evaluated models Qwen2.5-7B-Instruct , Qwen2.5-3B-Instruct , Qwen2.5-1.5B-Instruct Abstract LSL 用 GMM 门把适配器限制在当前数据支撑内，以减轻多阶段遗忘。LSL 是不访问旧数据、在后训练中保持先前能力的框架。
提出预训练缩放律，估计野生 AI 网页文本相当于多少人类 token
Published Oct 1
Evaluated models nanochat 19.9M , 35.8M , 86.2M and others7 Abstract wild AI 文本对数据不足的模型先降损失，对高人类预算几乎立刻升损失。作者测量未标注的 wild AI 网页文本对预训练的影响，并提出一个能让 AI token 价值变号的缩放律。
提出 CREDO，用保留 token 对的可微读出校准推理模型置信度
Published Sep 28
Evaluated models Qwen3-8B , Qwen3-1.7B , Qwen3-4B Abstract CREDO 用可微两 token 读出替代口头置信，在数学和代码上同时拉高准确率与校准。CREDO 把 RLVR 里的置信从“采样一个数字”改成“读一对保留 token 的相对概率”，并用可微回归和差异加权同时拉准确率与校准。 。
证明预训练投毒的清洁超额风险指数随极限顺序变化
Published Sep 26
Evaluated models OLMo-style models Abstract 投毒清洁超额风险的幂指数取决于先固定宽高比还是先取充足数据极限。可解的预训练数据投毒理论：清洁超额风险的缩放指数随极限顺序改变。 。
提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复
Published Sep 23
Evaluated models CNN（MNIST：2 Conv + 3 FC） , CNN（Fashion-MNIST：6 Conv + 1 FC） , ResNet18（CIFAR-10） Abstract Fed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。
用 Dmax 与尾部损失评测后门修复的类别性能保持
Published Sep 22
Evaluated models ResNet18 , PreActResNet18 , VGG19-BN 提出对比自蒸馏，分离正确性与行为偏移
Published Sep 18
Evaluated models Qwen3-4B , Qwen3-4B-Instruct-2507 Abstract 隔离自蒸馏后，对比正确与错误解教师可抵消行为偏移并稳定提升推理。把自蒸馏从 GRPO 里拆开后，用靠近正确解教师、远离错误解教师的对比信号，把正确性和行为分开。 。
Proposes Rationale-Only safety fine-tuning, removing the refusal statement to reduce false refusals.
Published Sep 4
Evaluated models Llama-3.1-8B , Mistral-7B-v0.3 , Gemma-2-9B and others8 Abstract Removing the boilerplate refusal statement and training only on the rationale can reduce false refusals, while the compliance rate on harmful queries remains low.This is a structural analysis of safety fine-tuning data: false refusals are traced by the authors to formulaic refusal statements in responses, rather than relying only on inference-time remedies.
提出 BPI 选点算法，增强去中心化联邦学习中的模型与数据投毒
Published Sep 2 Abstract BPI 用有限轮 gossip 暴露选拜占庭集合。作者把 DFL 中“破坏哪 m 个节点”写成攻击者在固定预算下的优化问题，并用 BPI 近似有限轮内诚实节点受到的拜占庭暴露。
提出 Disclaimer Injection，利用对齐机制使文本难以被学习
Published Jan 7
Evaluated models LLaMA-3-8B-Instruct Abstract 黑盒声明注入压低微调分数，作者把它归因于对齐层持续激活。作者提出数据级方法 Disclaimer Injection ，在 black-box 条件下降低文本被当代 LLM 微调学会的程度。所有者公开文本时未必打算供人训练。作者认为抓取之后法律手段难起作用，而早期模型上的表层扰动要么被当代 LLM 恢复语义，要么损坏可读性。
You have reached the end