Some text is shown in its original language while the English translation is being prepared.
Oct 12 · Monday
All papers Found 128 papers Another 336 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Organized first” shows papers with tags or public deep readings first. Each group is ordered by original publication date, newest first, with undated papers last. “Latest publication” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and deep readings are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes a local dual-model closed loop to generate edge scenarios for autonomous system safety assurance
Published Oct 9
Evaluated models PPO Abstract Local closed-loop generation of JSON edge cases.The authors built a local agentic loop that runs on a laptop to generate edge cases for safety arguments of autonomous systems, rather than releasing a new public test set.
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
Published Oct 9
Evaluated models LAYA-TD 、 LAYA-EN 、 LAYA-ML and others5 Abstract The authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
Using fear activation steering to test the hazard judgment criteria of vision-language models
Published Oct 8
Evaluated models Qwen/Qwen2.5-VL-7B-Instruct Measures citation fragility in AI search, demonstrating that ordinary public posts can enter citations and answers.
Published Oct 8
Evaluated models Grok 、 Doubao 、 ChatGPT and others10 Abstract The authors claim the paper quantifies vulnerabilities in AI search caused by citation preferences and low posting thresholds; tests show public web posts can penetrate AI citations, and they call for auditing the citation supply chain.
提出 LTBD，用可学习分隔符隔离可信指令与不可信数据
Published Oct 8
Evaluated models Llama3-8B-Instruct 、 Llama3.1-8B-Instruct 、 Falcon3-7B-Instruct and others4 Abstract LTBD 只训练四个分隔符嵌入。LTBD 是一种不改基座权重的提示注入防御：只学习用来标出可信指令与不可信数据边界的四个 token 嵌入。
构建统一奖励作弊检测基准 RH-Detect 并评测零样本检测器
Published Oct 8
Evaluated models Qwen 3.5 Flash 、 Gemini 3.1 Flash Lite 、 Grok 4.1 Fast and others7 提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
Published Oct 8
Evaluated models Meta Llama Guard 3 8B 、 Meta Llama Guard 7B 、 Meta Llama Guard 3 1B and others18 提出热启动 Bandit 的部署前有界离线注入攻击
Published Oct 7
Evaluated models UCB 、 Thompson Sampling 、 ϵ-greedy 提出利用路由元数据推断敏感话题的侧信道攻击
Published Oct 7
Evaluated models RouteLLM (BERT router) 、 notdiamond-0001 、 Vela (vLLM Semantic Router) Abstract 论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
提出流匹配逆向框架，从多向量视觉文档索引重构页面
Published Oct 7
Evaluated models Tomoro-ColQwen3-8B 、 ColQwen3.5-4.5B 、 Tomoro-colqwen3-embed-4b and others13 提出 CARE 框架，在误分类风险约束下减少人机协作的人工查询
Published Oct 7
Evaluated models Qwen3-VL-2B-Instruct 、 Perspective 、 Moderation and others9 Abstract CARE 以残差校正加逐步校准做人机决策，四个任务上少查询并控制集成风险。CARE 是面向人机协同二分类的端到端流水线，要在误分类风险不超过用户容忍的前提下减少人类查询。设定是 i.i.d.数据流、人类 oracle 标签正确、AI 为任意黑盒概率分类器。
构建 MedDistract 基准，测量偶发信息对临床文书与推理的污染
Published Oct 6
Evaluated models GPT-5.4 、 GPT-5.6 Sol 、 Claude Opus 5 and others9 提出 RAG-PIBench，评测 RAG 上下文中提示注入检测器
Published Oct 6
Evaluated models DistilBERT-base-uncased 、 DeBERTa-v3-base 、 MiniLM 定义任务充分收缩，认证用 GC 替换全信源后速率–遗憾曲线不变
Published Oct 6 Abstract 任务可在优化前定出压缩信源。任务充分收缩 处理机器信息接口上的信源选择：已声明任务有时可以在编码器、码本、速率、失真目标或优化器选定之前，定出一个更小的信源。
提出 ProbeGuard，按共识形成过程对医疗问答做选择性弃答
Published Oct 6
Evaluated models Qwen3-8B 、 Llama-3.1-8B-Instruct 、 HuatuoGPT-o1-8B Abstract ProbeGuard 用共识形成过程做可认证弃权，并在全票层分开答对与答错的共识。ProbeGuard 是给多轮共识医学问答用的认证弃权框架：基板照原样作答，弃权只看共识是怎么形成的。
提出手语转文本接入儿童安全过滤的部署前审计协议
Published Oct 6 Abstract 作者提议聋人知情的部署前审计，以检查手语转文本是否改变儿童安全决策。手语儿童到达基于文本的儿童安全机制时，机制看到的是机器翻译，不是儿童所做的手语。作者要解决的是：这条边界在部署前应如何审计。
评测记忆门控对激活诱导与记忆诱导谄媚的防御效果
Published Oct 6
Evaluated models Llama-3.1-8B-Instruct 、 Qwen2.5-7B-Instruct 、 Mistral-7B-Instruct-v0.3 and others4 Abstract 作者称外部记忆过滤成立，数据未显示反向转向再有贡献。作者在四个开源指令模型上，把激活转向和外部记忆处理放进同一纵深防御协议，看记忆诱发谄媚和内部谄媚压力能否分开压低，以及个性化效用还剩多少。要处理的问题是：检索到的用户历史会推动模型顺从存储信念。只改外部上下文，并不直接动模型内部的谄媚表征。
提出 SAFESHIELD，组织小语言模型部署时的安全决策
Published Oct 6
Evaluated models Qwen3-4B-Instruct Abstract SAFESHIELD 用可审计决策轨迹组织 SLM 部署时的四项安全决策，并报告协调依赖影响端到端结果。SAFESHIELD 是面向小语言模型的部署时安全框架，把运行时安全从单项审核改写成可检查的决策过程。
提出校准重合成方法，以生成器反演保真度认证真实图像并防御对抗扰动
Published Oct 5 Abstract 论文提出基于反演保真度与阈值校准的健全认证框架，在对抗扰动下维持错误率界限，并指出真实内容可认证性随生成器演进而萎缩。
提出临时可见性协议，限制持续摄入 RAG 向量库的投毒暴露
Published Oct 5 Abstract 用截止期限制未核验可见时长。这篇工作给持续摄入的 RAG 向量库一个失败关闭的临时可见性协议，把协议能限制的未核验暴露和依赖检测器的中毒暴露分开。