Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 32 papers Another 254 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
Published Sep 29
Evaluated models GLM-5 , Gemini-3.5-Flash , Qwen3-32B and others4 Abstract 作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架 ，研究没有目标数值概率时，采样能否支持逐步控制。
评测多轮对话中 GradSafe 越狱检测的可分性与脆弱性
Published Sep 29
Evaluated models Llama 3.1 8B Instruct , Qwen2.5-7B-Instruct Abstract CWS 显示不安全梯度在真实多轮流量中变弱，且随攻击族和模型而变。作者评估梯度越狱检测从单条提示词迁到多轮对话后还剩多少可分性，方法是用 Context Window Scanner 把 GradSafe 原封不动地套到用户轮窗口上。
提出推理通道预填与输出前缀组合攻击以越狱推理模型
Published Sep 24
Evaluated models Gemini 3 Flash Preview , DeepSeek V4 Flash , Claude Haiku 4.5 检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
Published Sep 8
Evaluated models gemini-2.5-flash , gemini-2.5-flash-lite 提出 MIPC 与 CFA，观察模型自拟测验后接受开发者身份
Published Sep 3
Evaluated models ChatGPT , Claude , Qwen3.7-Plus and others5 Abstract 自拟测验可造成对话层虚假认证，但所测授权边界并未因此改变。这项工作把“模型自己出题、自己批改、再宣布身份已核验”定义成对话层认证失败，并与后端提权分开。
提出多轮越狱框架 BLUEPRINT，用世界观模拟与心理因素诱导有害输出
Published Sep 2
Evaluated models Qwen3-Next-80B , DeepSeek-V3.2 , GLM-4.7 and others6 Abstract BLUEPRINT 解耦多轮越狱策略与情境模拟，揭示任务具象化是摆脱拒绝的核心机制，为多轮安全防御提供新视角。BLUEPRINT 是一个将因子化社会影响力策略空间与跨轮世界观模拟解耦的多轮大语言模型安全评测框架。
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
Published Aug 11
Evaluated models Claude Opus 4.8 , Claude Sonnet 4.6 , Claude Haiku 4.5 and others13 Abstract 论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
提出面向意图的多轮 LLM 越狱分类体系
Published Aug 2
Evaluated models Llama-3 , Llama-3.3-70B , DeepSeek-V3 and others11 Abstract 作者用四维意图分类整理多轮越狱，并称组织方式影响效果与观察范围。这是一篇关于多轮 LLM 越狱的 SoK：按有害意图在交互中的组织位置分类，而不是按单步提示技巧分类。
提出生物红队模型 Intern-BioBreaker，多轮越狱诱导模型输出可操作生物危害
Published Jul 20
Evaluated models DeepSeek-V3 , Kimi-K2.6 , DeepSeek-V4-Pro and others14 Abstract 论文通过构建专用红队模型评估前沿大模型的生物安全漏洞与物理转化风险。
提出 SMT 框架，用模拟审核轨迹越狱函数调用 LLM
Published Jul 1
Evaluated models GPT-4o , GPT-5.4 , Qwen3-Max and others7 提出 AdvGRPO，用 GRPO 闭环共训多轮越狱攻击者与防御者
Published Jun 9
Evaluated models Qwen2.5-7B-Instruct , Qwen2.5-14B-Instruct , Qwen3.5-9B and others7 解释自回归一致性如何导致浅层安全对齐，并提出随机插入攻击
Published Jun 3 Abstract 作者用自回归一致性串起浅层对齐、插入攻击和最坏延续对齐。作者把浅层安全对齐和一类续写攻击都归到自回归一致性上。
构建 MultiTurnPSB，评测四轮医疗越狱与分类器输入防御
Published May 30
Evaluated models GPT-4.1-mini , Claude Sonnet 4.5 Abstract 多轮攻击加剧医疗模型风险，分类器干预有效但受高误报率制约。MultiTurnPSB 针对患者端医疗大模型在持续交互中的安全风险，构建了包含三种攻击模态的四轮对抗评测基准。
提出 Persona Attack，分步写入对话记忆指令以越狱
Published May 29
Evaluated models GPT-4o , Llama-3.2-3B-Instruct , ChatGPT-4o and others5 提出多轮意图欺骗越狱 iDecep，用良性意图伪装引出有害内容
Published Apr 27
Evaluated models GPT-4o , Gemini-2.5-Flash , Claude-Sonnet-4.5 and others4 Abstract iDecep 用意图欺骗做多轮越狱，在 GPT-5 与 Claude-Sonnet-4.5 上同时测到直接成功和 para 成功。iDecep 是一种黑盒多轮越狱：用表面良性的意图维持与恶意目标贴近的对话，并单独计入 safe completion 替代内容中的有害信息。 。
提出 STAR 多轮角色扮演框架，利用对话状态演化绕过安全对齐
Published Mar 15
Evaluated models GPT-4o , Claude 3.5 Sonnet , Gemini 2.0-Flash and others5 用 ADVERSA 测量多轮对抗下护栏退化与评审可靠性
Published Mar 10
Evaluated models Claude Opus 4.6 , Gemini 3.1 Pro , GPT-5.2 Abstract ADVERSA 用逐轮合规轨迹和三评审共识测量多轮护栏变化。ADVERSA 是一套自动多轮红队测量框架，把护栏行为记成逐轮合规轨迹，并同时测量评审是否一致。要处理的问题是：单轮二元通过或失败既看不到持续对抗下安全属性如何变化，也分不开拒答逐步巩固和分数保持稳定。作者认为真实使用中的对手会改写并持续多轮。
分析续写触发越狱的注意力头机制并提出 HCS
Published Mar 9
Evaluated models LLaMA-2-7B-Chat , Qwen2.5-7B-Instruct Abstract 作者称越狱来自两类头竞争，HCS 加蒸馏可把该竞争用于推理时干预。作者用注意力头机制分析 continuation-triggered jailbreak：同一有害指令下，把 continuation 后缀从指令后面挪到提示词边界外，模型更容易顺着后缀继续生成。
提出 FERRET 框架，用扩展生成多轮多模态越狱对话
Published Feb 18
Evaluated models Llama Maverick , Claude Haiku , GPT-4o