Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 12 papers Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
Published Oct 8
Evaluated models Meta Llama Guard 3 8B , Meta Llama Guard 7B , Meta Llama Guard 3 1B and others18 提出利用路由元数据推断敏感话题的侧信道攻击
Published Oct 7
Evaluated models RouteLLM (BERT router) , notdiamond-0001 , Vela (vLLM Semantic Router) Abstract 论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
提出 LENS，构造集合级 RAG 语料投毒以导向预设答案
Published Sep 28
Evaluated models Qwen3.6-35B-A3B , Llama-3.1-70B-Instruct , DeepSeek-V4-Pro 提出 VerTox，用可验证奖励强化学习生成误导文档并投毒检索语料
Published Sep 1
Evaluated models SimLM-base , BGE-base , Cohere-embed-english-v3.0 and others8 Abstract VerTox 以可验证奖励微调小 LLM，生成能抬高排序并腐蚀事实的投毒文档。VerTox 用可验证奖励把小 LLM 微调成语料投毒生成器，用来探测神经排序器在注入文档下的暴露面。
提出对抗重构，仅改表述以拉高 AI 审稿分数
Published Jun 11
Evaluated models Claude Sonnet 4 , Claude Sonnet 4.5 , GPT-5-mini Abstract 揭示 AI 审稿系统易受纯表述重构操纵，建议在部署前解耦科学与写作评价。
提出 DiscourseFlip，用有限文档投毒操纵黑盒 RAG 的话语级观点
Published May 31
Evaluated models Llama3.1-8B-Instruct , Qwen3-8B-Instruct , BGE and others5 Abstract DiscourseFlip 按语义图分配投毒预算。DiscourseFlip 是针对黑盒 RAG 的话语级观点操纵。作者要处理的缺口是：只打单条查询或主题局部查询时，覆盖窄，目标受审查时容易被隔离，也难沿相关话题传播。攻击者不能看检索器或 LLM 内部，也不能改提示词模板，只能在文档数、生成 token 和 SEO 编辑距离限制下注入少量文档。
提出 BITE，用上下文赌博机选择风格修改抬高 LLM 评委打分
Published May 24
Evaluated models o3-mini , Gemini-2.5-Flash , Llama-3.3-70B-Instruct and others8 Abstract BITE 用黑盒赌博机利用风格偏差抬分，作者称这对 LLM-as-a-judge 构成威胁。BITE 是黑盒风格操纵：在保持答案语义的同时，抬高 LLM 评审给出的分数。
提出 CITA 三阶段框架，生成可绕过毒性检测器的中文隐式毒性文本
Published May 21
Evaluated models Tencent , Baidu , Gemini 3.1 Pro and others11 提出 AdversarialCoT 单文档检索投毒以操纵 RAG 推理答案
Published Apr 14
Evaluated models DeepSeek-R1 , Qwen3 , GLM4.5 and others5 提出 Confundo，微调投毒生成器为 RAG 生成抗分块的鲁棒投毒内容
Published Feb 6
Evaluated models Qwen3-8b , Llama3-8b , DeepSeek and others8 Abstract Confundo 用微调生成器做 RAG 投毒，作者报告事实、观点和幻觉三类目标上的攻击结果。Confundo 把 RAG 投毒做成微调：小模型按目标问题生成短毒文，再放进会被知识库摄入的文档。它针对的是实际系统会切块、用户也不会照抄预设问句，专用投毒因而变弱。攻击者没有目标系统的内部知识，也不能查询它，只能准备待摄入文档。
提出 DECEIVE-AFC，以声明改写诱导搜索增强事实核查误判
Published Jan 31
Evaluated models HiSS , LEMMA , DEFAME and others4 提出保义释义攻击 PAA，抬高 LLM 审稿评分
Published Jan 11
Evaluated models GPT-4o , Gemini 2.5 , Sonnet 4 Abstract PAA 用保义释义抬高 LLM 审稿分。PAA 是对 LLM-as-a-Reviewer 的 black-box 攻击：只改写摘要，用评审分做 ICL 搜索，并用 BERTScore 与困惑度限制语义和自然度。
You have reached the end