Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Defense type：Inference-time intervention Defense type：Detection and filtering Defense type：Instruction–data separation Defense type：Monitoring and auditing Layer：Model layer Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

InterpretabilityarXiv 2610.13078Oct 9
Attention sees, MLP refuses: tracing the safety pathway from attention to MLP in LLMs
Trace attention to identify harmfulness to the MLP refusal write pathway and propose Sentinel
arXiv
2610.13078
Published
Oct 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Qwen3-8B-Instruct and others18
- DefensesInstruction–data separation
- AttacksJailbreaks
- RiskInappropriate refusal
AbstractAttention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.
The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.
Paper analysisRead analysis
DefensesarXiv 2610.10655Oct 8
Nullify：面向 LLM 遗忘的零空间激活引导免训练方法
提出零空间激活引导 Nullify，免训练擦除指定记忆并保持效用
arXiv
2610.10655
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Qwen3-8B
- DefensesInference-time intervention
- AttacksExtraction and theft
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10276Oct 7
PatchBench 提出激活补丁局部评测协议，揭示越狱修复的附带损伤
提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤
arXiv
2610.10276
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B-Instruct, Qwen2.5-14B-Instruct, gemma-3-4b-it and others8
- DefensesInference-time intervention
- AttacksJailbreaks
Abstract论文提出 PatchBench 与局部评估协议，揭示了激活补丁在全局能力无损下仍存局部良性退化。
Paper analysisRead analysis
DefensesarXiv 2610.09703Oct 7
研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
arXiv
2610.09703
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVA-1.5-7B
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Abstract剪枝去掉背景 token 后注意力塌向恶意前景。
这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
Paper analysisRead analysis
DefensesarXiv 2610.09167Oct 7
Persist-3 用顺序检验识别未见越狱来源，提升 MTK 与 Prompt Guard 2 防御效果
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
arXiv
2610.09167
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama2-7B-chat, Qwen2.5-7B-Instruct, Gemma-2-9B-it and others4
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
AbstractPersist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。
Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。。
Paper analysisRead analysis
DefensesarXiv 2610.08678Oct 7
研究揭示投机解码的安全代价并提出 SecureSD 加固方法
测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证
arXiv
2610.08678
Published
Oct 7
Layer
Model layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-32B, Llama-3.1-8B-Instruct and others6
- DefensesInference-time intervention
- AttacksJailbreaks
Abstract有损推测解码的早期偏离更快抬高越狱与注入风险。
作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。
Paper analysisRead analysis
InterpretabilityarXiv 2610.08559Oct 6
Study: Debiasing directions in LLM latent space primarily encode confidence rather than fairness
分析 LLM 去偏激活方向，发现其编码置信度而非公平性
arXiv
2610.08559
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B, Llama-3.1-8B-Instruct, Falcon3-7B-Base and others8
- DefensesInference-time intervention
- RiskBias and discrimination
Abstract论文揭示激活引导去偏见方向主要编码模型置信度而非公平性，偏见评分下降实为诱发弃答或使概率均分的假象。
Paper analysisRead analysis
DefensesarXiv 2610.07774Oct 6
研究者提出读取路由 logits 的 MoE 视觉语言模型多模态安全检测器
AI summary研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。
arXiv
2610.07774
Published
Oct 6
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-30B-A3B-Instruct, Kimi-VL-A3B-Instruct
- DefensesMonitoring and auditing
- RiskInappropriate refusal
- ComponentMonitors
Abstract读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。
作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。
Paper analysisRead analysis
InterpretabilityarXiv 2610.06576Oct 5
研究：智能体欺骗行为在外部显现前已可从内部表征预测
提出基于决策前隐藏状态的检测与引导，预测并抑制智能体欺骗
arXiv
2610.06576
Published
Oct 5
Layer
Model layer
Setting
AI Agent
Evaluated models
Qwen3-14B
- DefensesMonitoring and auditing
- RiskDeception and scheming
- ComponentMonitors
Abstract论文展示了智能体自发欺骗可在行为显现前由内部表征预测，并通过激活引导证实了表征的行为可操作性。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06503Oct 5
研究评测五款开源文生图模型的有害内容生成与审核缺口
评测文生图模型的有害内容生成能力与审核检测缺口
arXiv
2610.06503
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SDXL, Stable Diffusion 3.5 Large, FLUX.1-dev and others12
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis
DefensesarXiv 2610.06383Oct 5
基于影响力的曲率感知数据加权激活引导方法
提出曲率感知数据加权的激活转向方法，用于毒性抑制与概念控制
arXiv
2610.06383
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma-2-2B, Llama-3.2-3B
- DefensesInference-time intervention
Abstract影响加权传输压低毒性率，闭式 IF-Act 常换来更高困惑度与更低 MMLU。
推理时的影响加权激活传输，用曲率修正的样本权重替换传输转向里的均匀类均值。要做的是概念控制，而不是再训练。作者认为类均值被无关概念、噪声和少数 token 主导，编码的是词元级而非主题。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06339Oct 5
BabelFake：面向多语言音视频 DeepFake 检测的基准数据集
构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
arXiv
2610.06339
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SpeechForensics, AVH-Align, (B)RAVEn
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentAudio
AbstractBabelFake 为五语同意采集基准。
BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
Paper analysisRead analysis
DefensesarXiv 2610.05166Oct 4
安全动作不等于可行动作：VICS-G 为 VLA 策略做可行未来解码
提出 VICS-G 可行未来解码，重排冻结 VLA 策略的动作候选
arXiv
2610.05166
Published
Oct 4
Layer
Model layer
Setting
Embodied systems and robotics
Evaluated models
SafeVLA (task-optimized / base), SafeVLA (safety-aligned / safe)
- DefensesInference-time intervention
- RiskDangerous agent actions
Abstract作者用可行未来解码重排冻结 VLA 的下一步，并称 VICS-G 降低观测代价且完成率接近策略采样。
训练无关解码器 VICS 在冻结 VLA 的推理阶段重排动作块，使当前选择带上该动作仍可能留下的安全完成质量。
Paper analysisRead analysis
DefensesarXiv 2610.04998Oct 4
EmoRSS：缓解大语言模型由情绪引发的过度拒答
提出 EmoRSS，推理时在拒绝子空间反向抵消情绪激活偏移以缓解过度拒答
arXiv
2610.04998
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-it, Qwen3-8B
- DefensesInference-time intervention
- RiskInappropriate refusal
Paper analysisRead analysis
DefensesarXiv 2610.04967Oct 4
One Token Can Be Enough：用 Prefix Steering 连接提示与激活引导
提出 Prefix Steering，以短前缀激活引导控制行为并保住能力
arXiv
2610.04967
Published
Oct 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
OLMo 3 7B, OLMo 3 32B, Qwen3 1.7B and others4
- DefensesInference-time intervention
- RiskInappropriate refusal
Abstract短前缀 steering 用已有方向做短暂干预。
本文用注意力层匹配连接提示词与激活干预，并把干预改成从末提示词 token 开始的短前缀。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.04860Oct 4
Research reveals that text watermarks induce model hallucinations and proposes two mitigation interventions
分析文本水印在 RAG 中诱发事实幻觉的机制并提出干预
arXiv
2610.04860
Published
Oct 4
Layer
Model layer
Setting
LLM applications
Evaluated models
LLaMA 3.1 8B Instruct, Mistral-7B-Instruct-v0.3, Qwen2.5-14B-Instruct
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentRAG
Abstract论文揭示了生产环境文本水印导致模型事实退化的失效模式，分析了解码机制并提出针对性干预。
论文研究生产级文本水印对大语言模型事实准确性的影响，分析了水印诱发幻觉的失效模式并评估了针对性缓解方案。
Paper analysisRead analysis
DefensesarXiv 2610.04470Oct 3
SENTINEL：通过意图感知的输入-输出匹配防御 LLM 越狱
提出生成时防御 SENTINEL，匹配输入输出以抽出越狱意图并停写
arXiv
2610.04470
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama2-7B, Llama3-8B, Mistral-7B-v0.2 and others6
- DefensesInference-time intervention
- AttacksJailbreaks
Paper analysisRead analysis
DefensesarXiv 2610.03498Oct 2
检测与抑制：针对 VLA 模型对抗补丁的机制可解释性防御
提出条件特征抑制防御，检出对抗补丁后抑制 VLA 内部特征
arXiv
2610.03498
Published
Oct 2
Layer
Model layer
Setting
Embodied systems and robotics
Evaluated models
π0.5, SmolVLA
- DefensesInference-time intervention
- ComponentVision
Abstract条件抑制与 patch 相关的 SAE 特征，间歇攻击下可提高 SR，持续攻击下则不能。
Paper analysisRead analysis
DefensesarXiv 2610.02999Oct 2
OmniConfess：用 Token 级「忏悔」缓解全模态幻觉
提出 OmniConfess，冻结候选并按通道重打分以缓解全模态幻觉
arXiv
2610.02999
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-Omni-7B, Qwen3-Omni-30B-A3B, Nemotron-3-Nano-Omni-30B
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2610.02844Oct 2
DNAlign：面向 LLM 的动态零空间安全对齐框架
提出 DNAlign，在不改权重的推理期用零空间约束控制信号做安全对齐
arXiv
2610.02844
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Evaluated models
Vicuna-7B, Qwen-7B
- DefensesInference-time intervention
- RiskInappropriate refusal
AbstractDNAlign 用零空间约束的推理期控制做安全对齐，Table I 平均奖励高于所列基线。
DNAlign 是一个不改 LLM 参数的安全对齐框架，用来在推理时压低有害输出，并减少对中性知识所支持的流畅、事实回答的改动。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop