Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 10 papers Another 233 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
Published Oct 7
Evaluated models LLaVA-1.5-7B Abstract 剪枝去掉背景 token 后注意力塌向恶意前景。这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
提出条件特征抑制防御，检出对抗补丁后抑制 VLA 内部特征
Published Oct 2
Evaluated models π0.5 , SmolVLA Abstract 条件抑制与 patch 相关的 SAE 特征，间歇攻击下可提高 SR，持续攻击下则不能。
为 Agent 提出资源层授权系统 Pincer，用数字分身执行动态最小权限
Published Oct 1
Evaluated models Claude Haiku 4.5 , Muse Spark 1.2 Contributor Abstract Pincer 在资源层以三票合取做授权。Pincer 是加在现成 coding agent 上的资源层授权防御：用只受用户侧信息影响的 digital twin 做动态最小权限，并与 tool-call 层防御并存。要处理的是用户维护策略带来的权限蠕变和授权疲劳，以及不学习用户策略的 tool-call 分类器。作者引述工作称 auto mode 会放行多数不安全操作，并认为推理代码或复杂 shell 的效果在这一层不实际。
提出 Tracekit，审计编码 Agent 的意图、推理与动作并检测账本篡改
Published Sep 29
Evaluated models Claude Code (claude -p, version 2.1) , 独立评审（同一 CLI，无工具） Abstract Tracekit 把意图、自述和动作写入可锚定的哈希链。Tracekit 是无第三方依赖的编码智能体审计层：把人类请求、模型自述和已执行动作并排写入可外部锚定的哈希链，执行前用正则门，事后用规则和独立模型互查。
提出 AttestChain，将供应链安全智能体报告签名上链并据此控制发布
Published Sep 25
Evaluated models GPT-class LLM Abstract AttestChain 将智能体报告与链上发布门控结合，现有证据来自受控合成构建的总体结果。AttestChain 是一个把 LLM 安全检查、智能体身份验证和许可链发布策略连接起来的软件供应链防御框架。 。
提出 AEGIS，用中层内部信号选择性激活后层适配器拦截音频越狱
Published Sep 24
Evaluated models Qwen2-Audio-7B , VITA-1.5 , Ultravox v0.5 and others6 提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别
Published Sep 23
Evaluated models CosyVoice2-0.5B , F5-TTS , FireRedTTS Abstract GUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。
提出 SPARK，在预填充阶段修复多模态 KV 记忆以防御视觉语言模型越狱
Published Sep 13
Evaluated models LLaVA-OneVision-7B , Chameleon-7B , Qwen2-VL-7B and others4 提出推理时防御 SafeThink，监视思维链并在低于阈值时注入转向前缀
Published Feb 12
Evaluated models R1-Onevision-7B , OpenVLThinker-7B , VLAA-Thinker-7B and others6 提出 Aura，用可信内核中介移动 Agent 的身份、感知与动作控制
Published Feb 11
Evaluated models Gemini-3-Flash Abstract Aura mediates structured interactions via the Agent Kernel.Aura uses kernel-mediated structured agent interaction, replacing screen-interface mobile assistants. .
You have reached the end