Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 29 papers Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposing an option channel attack that renames option labels so that agent guardrails allow prohibited operations
Published Oct 9
Evaluated models LAYA-TD , LAYA-EN , LAYA-ML and others5 Abstract The authors' evaluation indicates that typed models should not serve as final safety arbiters; they are susceptible to off-policy text and option name manipulation, and confidence filtering cannot resist attacks.
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
Published Oct 8
Evaluated models Meta Llama Guard 3 8B , Meta Llama Guard 7B , Meta Llama Guard 3 1B and others18 提出 SAFESHIELD，组织小语言模型部署时的安全决策
Published Oct 6
Evaluated models Qwen3-4B-Instruct Abstract SAFESHIELD 用可审计决策轨迹组织 SLM 部署时的四项安全决策，并报告协调依赖影响端到端结果。SAFESHIELD 是面向小语言模型的部署时安全框架，把运行时安全从单项审核改写成可检查的决策过程。
评估应用决策层的输入注入与隐私推断风险
Published Oct 4
Evaluated models Jev , NanoJev Abstract Jev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
提出检测、结构化与 GSPO 流程，降低共识生成的提示注入错位
Published Oct 3
Evaluated models LLaMA-2 7B , LLaMA-3 8B , GPT 3.5 Turbo and others14 Abstract 三章依次做个体偏好预测、政党知识图谱审议，以及共识生成对提示注入的脆弱性与一条防御流程。这是一篇把 LLM 数字孪生放进增强民主的博士论文，分个体表示、政党聚合和共识生成的提示注入三章。
提出 ASA 与 AttestMCP，度量并降低 LLM 对输入序列扰动的敏感
Published Oct 2
Evaluated models Gemma-3-27B-Instruct , Gemma-3-4B-Instruct , Llama-3.2-3B-Instruct and others12 提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
Published Oct 1
Evaluated models Lumina-mGPT , Gemini 2.5 Flash Image Preview , CLIP ViT-B/16 and others5 提出 PILLAR，用私有词法预筛与客户端重排保护 RAG 查询
Published Sep 29 Abstract PILLAR 用固定模式的私有 BM25 预筛加本地嵌入重排，在两基准上换取延迟或质量。PILLAR 是面向公开语料的隐私 RAG：半诚实服务器学不到查询词项和访问模式，客户端仍拿到用于增强生成的 k 篇文档。
提出 ClaimMirage，以域名自述声称改变 LLM 威胁告警判断
Published Sep 24
Evaluated models Llama 3.3 70B Instruct-Turbo , Gemma 3 4B it , Gemma 3 12B it and others5 提出 PIDS-Bench，评测提示注入检测器在过度防御与分布偏移下的表现
Published Sep 14
Evaluated models TF-IDF + logistic regression , DistilBERT , DeBERTa-v3-FT and others7 Abstract PIDS-Bench 显示高分布内 F1 仍会过度拦截外部来源的安全相关良性输入。PIDS-Bench 是一个冻结的检测器级基准，用来在固定阈值下同时看提示注入检测和良性误报。
提出 CIG-MIA，用上下文信息增益推断 RAG 知识库成员身份
Published Sep 14
Evaluated models Llama-3.1-8B-Instruct , Mistral-7B-Instruct-v0.3 , Llama-2-13b-chat-hf and others6 Abstract CIG-MIA 用注入前后的答案似然差推断 RAG 库成员，灰盒可分性高于所列基线。CIG-MIA 是针对 RAG 外部知识库的成员推断攻击，同时覆盖灰盒和纯文本黑盒。
提出意图驱动本地框架 Veilmind，净化发往远程模型的提示词
Published Sep 10
Evaluated models Veilmind-4B Abstract 本地模型按意图净化提示词，在 Uprise 上给出两个隐私-效用工作点。本地侧的意图驱动净化，用来降低用户提示词发往不受信任远程模型时的敏感属性暴露。
提出 CodePoisonRAG，对检索增强代码生成的知识库投毒以植入漏洞
Published Sep 3
Evaluated models Qwen 3.5 9B , Code Llama 13B , DeepSeek-Coder-V2 16B Abstract CodePoisonRAG 展示了 RACG 外部知识库的新攻击面，在较低投毒率下可定向诱发指定漏洞并部分抵御防御。
提出 LeakGauge，用行为后缀的 prefill 对数概率检测上下文泄露
Published Aug 18
Evaluated models Gemma-4-E4B-it , Gemma-4-31B-it , Qwen2.5-14B-Instruct and others11 形式化跨不可关联身份的分解攻击并评测状态化防御边界
Published Aug 18
Evaluated models Granite Guardian 3.1 2B 提出分片监督，将评判标准分配给独立调用以抵御展示攻击
Published Aug 6
Evaluated models Claude Opus 4.8 , Claude Sonnet 4.6 , Claude Opus 4.6 and others4 Abstract 论文揭示决策负载是大模型监督的独立瓶颈，提出分片与辩论机制有效分离注意力与平衡证据，在多项高难度基准上实现稳健评判。本文系统研究了大语言模型在执行多标准监督与评判时的决策负载瓶颈及其安全风险。
提出 SeTox 检索增强框架，检测中文新词的隐性毒性
Published Jul 5
Evaluated models SeTox-Qwen2.5-7B Abstract SeTox 用检索把公共共识接入静态 LLM，以检测中文毒性新词。SeTox 研究中文新词上的隐性毒性检测：词表加检索增强，使静态 LLM 在不重训练的情况下利用公开网页上下文。
提出嵌入推断攻击 EIA，在黑盒 IR 中识别所用嵌入模型
Published Jul 1
Evaluated models e5-small , e5-small-v2 , e5-base and others19 Abstract EIA 用无序文档集的差异从候选中识别嵌入模型，并给出 reranker 与阈值下的计数。EIA 是在黑盒 IR 上识别所用嵌入模型的攻击。 。
Propose soft prompt defense AREA, re-anchoring attention to mitigate system prompt leakage
Published Jun 17
Evaluated models Llama-2-7B-chat-hf , Llama-3.1-8B-Instruct , Mistral-7B-Instruct-v0.3 and others8 Abstract The authors measure commercial prompt leakage, propose attention drift, and use AREA to strike a trade-off between usability and leakage resistance.The authors study system prompt leakage in real LLM applications and propose AREA, a mitigation method that does not modify weights.
提出 MEntA，用非模板查询推断文档是否属于 RAG 检索库
Published May 23
Evaluated models Phi4-14B , Llama3.1-8B , CommandR-7B and others5