Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 63 papers Another 262 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
提出 ATLAS 用水平集估计恢复黑盒分类器的对抗输入集合
Published Oct 6
Evaluated models LeNet5 , ResNet50 (CIFAR-10 standard) , ResNet50 (ImageNet standard) and others5 Abstract ATLAS 用主动水平集估计构造黑盒对抗集，作者称其集合比单点攻击更具代表性。ATLAS 是一个查询式 black-box 框架，用来构造诱发失败的对抗输入集合，供鲁棒性审计使用。
提出 Red-TTT，在攻击过程中更新攻击者实现自动化越狱
Published Oct 4
Evaluated models Llama-3-8B-Instruct , gpt-oss-20b , gpt-4.1-mini and others4 提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本
Published Oct 1
Evaluated models Llama2-7B-Chat , Llama3-8B-Instruct , Qwen2-7B-Instruct and others5 Abstract 质量筛选挡不住部分高分样本的安全削弱。Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。
提出 CodeMimicry，以结构化代码补全诱导模型生成有害内容
Published Sep 30
Evaluated models GPT-4o , GPT-4.1 , GPT-5-chat and others10 提出 SceneJail，利用视频情境上下文越狱视频多模态模型
Published Sep 30
Evaluated models Qwen2.5-VL-7B-Instruct , Qwen2.5-VL-32B-Instruct , Qwen3-VL-8B-Instruct and others8 提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
Published Sep 29
Evaluated models GLM-5 , Gemini-3.5-Flash , Qwen3-32B and others4 Abstract 作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架 ，研究没有目标数值概率时，采样能否支持逐步控制。
提出 FinRT，将消费金融自适应红队轨迹蒸馏为可复用对抗提示生成器
Published Sep 29
Evaluated models Llama-3.3-70B , Llama-3.1-8B , Mixtral-8x7B and others6 Abstract FinRT 用前向失效发现加校准代理 DPO，把消费金融红队收成单次前向生成器。FinRT 是面向消费金融的红队框架：先发现政策失效，再训练一个按政策、领域与目标行为出提示的生成器。
提出 RISE，迭代演化可复用策略对文生图模型做红队
Published Sep 28
Evaluated models DALL·E 3 , Nano Banana 2 , GPT-Image-2 and others7 提出 ENDOPROMPT，以受害者侧伪参考学习降低良性任务效用的前缀
Published Sep 24
Evaluated models Qwen2.5-7B , Llama-3.1-8B , Mistral-7B-v0.3 and others4 Abstract 作者用受害模型续写监督良性效用攻击，并把行为位移、任务退化与请求匹配效果分开评测。ENDOPROMPT 是一种用受害模型自身续写监督前缀生成的 white-box 效用攻击方法。 它针对良性任务失败，不要求产生有害内容或明确拒答。
提出推理通道预填与输出前缀组合攻击以越狱推理模型
Published Sep 24
Evaluated models Gemini 3 Flash Preview , DeepSeek V4 Flash , Claude Haiku 4.5 测量间接提示注入对类型化概率决策的动作劫持
Published Sep 24
Evaluated models jev-1.13.0 Abstract 封闭动作集改变提示注入的表现，但没有去掉概率被不可信内容移动的风险。作者在 jev-1.13.0 上研究 decision hijacking：不可信内容能否在用户任务和可选动作都不变时，把类型化决策推向攻击者目标。
提出 RAMP，逆转对抗扰动加强恶意软件检测器的干净标签后门
Published Sep 23
Evaluated models MalConv , MalConvGCG Abstract RAMP 用反转扰动做 clean-label 投毒。RAMP 是 score-based black-box 下的 clean-label 后门增强，对象是会微调的 Windows PE 原始字节恶意软件检测器。
消融比较方言越狱中表层形式、文化框架与策略库的作用
Published Sep 15
Evaluated models GPT-4o , DeepSeek-Reasoner , DeepSeek-Chat 提出 SAST-IR，用有状态攻击者迭代说服无记忆模型接受反事实
Published Sep 15
Evaluated models DeepSeek-Chat 检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
Published Sep 8
Evaluated models gemini-2.5-flash , gemini-2.5-flash-lite 提出 AdvPIE，在黑盒下搜索表面无害却生成有害图像的提示
Published Sep 5
Evaluated models Stable Diffusion 3.5 Large , FLUX.1-schnell , Safe-StableDiffusion 1.5 and others5 提出 CRACK，用多智能体辩论在黑盒下越狱文生图多层安全过滤
Published Sep 1
Evaluated models Stable Diffusion v1.4 , SDXL , DALL·E 3 and others4 Abstract CRACK 以分层诊断的多智能体辩论搜索多层 T2I 过滤器的联合规避区域。CRACK 是面向文本生成图像模型多层安全栈的黑盒越狱框架，用几何上的 Detection Surface 解释为何粗粒度反馈不够。
提出 MAMJ，在元层面交替优化多模态越狱的策略提示与攻击者权重
Published Aug 27
Evaluated models GPT-4o , Gemini-3-Pro-Preview , Seed 2.0 提出 JailbreakSkill，用可演化技能自动搜索并复用越狱提示
Published Aug 17
Evaluated models GLM 5.2 , DeepSeek-V4-Pro Preview , Llama-3.3-70B-Instruct and others8