Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Defenses and guardrails · Papers Found 15 papers “
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
Published Oct 7
Evaluated models LLaVA-1.5-7B Abstract 剪枝去掉背景 token 后注意力塌向恶意前景。这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证
Published Oct 7
Evaluated models Qwen3-8B , Qwen3-32B , Llama-3.1-8B-Instruct and others6 Abstract 有损推测解码的早期偏离更快抬高越狱与注入风险。作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。
提出 EmoRSS，推理时在拒绝子空间反向抵消情绪激活偏移以缓解过度拒答
Published Oct 4
Evaluated models Llama-3.1-8B-it , Qwen3-8B 提出 Prefix Steering，以短前缀激活引导控制行为并保住能力
Published Oct 4
Evaluated models OLMo 3 7B , OLMo 3 32B , Qwen3 1.7B and others4 Abstract 短前缀 steering 用已有方向做短暂干预。本文用注意力层匹配连接提示词与激活干预，并把干预改成从末提示词 token 开始的短前缀。
提出生成时防御 SENTINEL，匹配输入输出以抽出越狱意图并停写
Published Oct 3
Evaluated models Llama2-7B , Llama3-8B , Mistral-7B-v0.2 and others6 提出 DNAlign，在不改权重的推理期用零空间约束控制信号做安全对齐
Published Oct 2
Evaluated models Vicuna-7B , Qwen-7B Abstract DNAlign 用零空间约束的推理期控制做安全对齐，Table I 平均奖励高于所列基线。DNAlign 是一个不改 LLM 参数的安全对齐框架，用来在推理时压低有害输出，并减少对中性知识所支持的流畅、事实回答的改动。
提出 HeadEdit，经冻结 unembedding 做随输入变化的 logit 校正
Published Oct 1
Evaluated models Qwen3-4B , Gemma-3-4B-IT , Llama-3.2-3B-Instruct and others4 Abstract 低秩 unembedding 校正抬高九个设置的总体准确率，并可部分预测 DPO 更新。HeadEdit 是一种不更新参数的行为校准方法，作用点是冻结的 unembedding，而不是中间层残差或新的梯度优化。
提出 Constitutional adapters，蒸馏宪法行为以缓解越狱与失准
Published Sep 29
Evaluated models Qwen3.5-4B , Llama-3.1-8B-Instruct , Gemma-4-E4B and others4 Abstract 差分宪法适配器在长上下文和多轮上更稳，并可按 α 换取遵从。
提出 CAM-Steer，推理时按多类别风险引导隐藏状态以降低有害回复
Published Sep 28
Evaluated models Qwen3-8B , Llama-3.1-8B-Instruct , Gemma-2-9B-IT 提出 AEGIS，用中层内部信号选择性激活后层适配器拦截音频越狱
Published Sep 24
Evaluated models Qwen2-Audio-7B , VITA-1.5 , Ultravox v0.5 and others6 提出 SPARK，在预填充阶段修复多模态 KV 记忆以防御视觉语言模型越狱
Published Sep 13
Evaluated models LLaVA-OneVision-7B , Chameleon-7B , Qwen2-VL-7B and others4 提出 REINS，在 SAE 空间抑制有害延续并增强拒答
Published Aug 28
Evaluated models Qwen3.5-4B-Base , Qwen3.5-2B-Base , Gemma-3-1B-IT Abstract REINS 分角色抑制有害延续并增强拒答。REINS 是一种推理时 SAE 安全转向方法，并配有用于上下文伪装的基准 GUISE 。
提出 SciTrace，为科学发现智能体加入跨阶段安全推理与工具轨迹核验
Published Jun 6
Evaluated models Llama-3.1-70B-Instruct , Qwen2.5-72B-Instruct , DeepSeek-V3 and others4 Abstract SciTrace 把安全推理织入科学智能体各阶段，在 SciSafetyBench 上提高安全指标并保持输出质量。SciTrace 是加在科学发现智能体流水线上的安全框架，不是再在各阶段出口放一个独立过滤器。
Analyzing the attention head mechanism of continuation-triggered jailbreaks and proposing HCS
Published Mar 9
Evaluated models LLaMA-2-7B-Chat , Qwen2.5-7B-Instruct Abstract The authors state that jailbreaks arise from competition between two types of heads, and that HCS plus distillation can use this competition for inference-time intervention.The authors use attention head mechanism analysis for continuation-triggered jailbreaks: under the same harmful instruction, moving the continuation suffix from after the instruction to outside the prompt boundary makes the model more likely to continue generating along the suffix.
提出推理时防御 SafeThink，监视思维链并在低于阈值时注入转向前缀
Published Feb 12
Evaluated models R1-Onevision-7B , OpenVLThinker-7B , VLAA-Thinker-7B and others6 You have reached the end