Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Defense type：Inference-time intervention Attack surface / entry point：User input Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.10655Oct 8
Nullify：面向 LLM 遗忘的零空间激活引导免训练方法
提出零空间激活引导 Nullify，免训练擦除指定记忆并保持效用
arXiv
2610.10655
Published
Oct 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat-hf, Qwen3-8B
- DefensesInference-time intervention
- AttacksExtraction and theft
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10276Oct 7
PatchBench 提出激活补丁局部评测协议，揭示越狱修复的附带损伤
提出 PatchBench-Local 协议，评测激活补丁修复越狱的局部附带损伤
arXiv
2610.10276
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-3B-Instruct, Qwen2.5-14B-Instruct, gemma-3-4b-it and others8
- DefensesInference-time intervention
- AttacksJailbreaks
Abstract论文提出 PatchBench 与局部评估协议，揭示了激活补丁在全局能力无损下仍存局部良性退化。
Paper analysisRead analysis
DefensesarXiv 2610.09703Oct 7
研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
arXiv
2610.09703
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVA-1.5-7B
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Abstract剪枝去掉背景 token 后注意力塌向恶意前景。
这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
Paper analysisRead analysis
DefensesarXiv 2610.08678Oct 7
研究揭示投机解码的安全代价并提出 SecureSD 加固方法
测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证
arXiv
2610.08678
Published
Oct 7
Layer
Model layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-32B, Llama-3.1-8B-Instruct and others6
- DefensesInference-time intervention
- AttacksJailbreaks
Abstract有损推测解码的早期偏离更快抬高越狱与注入风险。
作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。
Paper analysisRead analysis
DefensesarXiv 2610.04470Oct 3
SENTINEL：通过意图感知的输入-输出匹配防御 LLM 越狱
提出生成时防御 SENTINEL，匹配输入输出以抽出越狱意图并停写
arXiv
2610.04470
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama2-7B, Llama3-8B, Mistral-7B-v0.2 and others6
- DefensesInference-time intervention
- AttacksJailbreaks
Paper analysisRead analysis
DefensesarXiv 2609.36657Sep 29
Constitutional adapters：用推理期干预防御越狱与失准
提出 Constitutional adapters，蒸馏宪法行为以缓解越狱与失准
arXiv
2609.36657
Published
Sep 29
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3.5-4B, Llama-3.1-8B-Instruct, Gemma-4-E4B and others4
- DefensesInference-time intervention
- AttacksJailbreaks
- RiskMisalignment and value divergence
Abstract差分宪法适配器在长上下文和多轮上更稳，并可按 α 换取遵从。
Paper analysisRead analysis
DefensesarXiv 2609.34514Sep 28
CAM-Steer：面向大语言模型的多类别自适应安全引导框架
提出 CAM-Steer，推理时按多类别风险引导隐藏状态以降低有害回复
arXiv
2609.34514
Published
Sep 28
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Llama-3.1-8B-Instruct, Gemma-2-9B-IT
- DefensesInference-time intervention
- AttacksJailbreaks
Paper analysisRead analysis
DefensesarXiv 2609.31056Sep 25
SCALPEL：用对比稀疏自编码器实现选择性表征层遗忘
提出 SCALPEL，用对比 SAE 在表征层选择性遗忘特定事实
arXiv
2609.31056
Published
Sep 25
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen2.5-1.5B-Instruct, Llama-3.2-1B-Instruct, Gemma-2-2B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
AbstractSCALPEL 以对比稀疏特征做窄目标表征遗忘，在 TOFU 上与优化基线相当且可检查。
SCALPEL 是不改基座权重的表征层遗忘方法，面向与保留数据重叠的窄目标。
Paper analysisRead analysis
DefensesarXiv 2609.29287Sep 24
AEGIS：用内部信号在中间层拦截大型音频语言模型越狱
提出 AEGIS，用中层内部信号选择性激活后层适配器拦截音频越狱
arXiv
2609.29287
Published
Sep 24
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-Audio-7B, VITA-1.5, Ultravox v0.5 and others6
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2609.16229Sep 15
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
arXiv
2609.16229
Published
Sep 15
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
Paper analysisRead analysis
DefensesarXiv 2609.14258Sep 13
SPARK：在 KV 记忆层对齐表征以防御视觉语言模型越狱
提出 SPARK，在预填充阶段修复多模态 KV 记忆以防御视觉语言模型越狱
arXiv
2609.14258
Published
Sep 13
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaVA-OneVision-7B, Chameleon-7B, Qwen2-VL-7B and others4
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Paper analysisRead analysis
InterpretabilityarXiv 2609.04721Sep 4
研究：拒答方向可跨架构迁移，安全工具可按写入位置重新估计
在写入点定位拒答方向，经刚性旋转跨架构迁移并门控放大
arXiv
2609.04721
Published
Sep 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
Falcon-Mamba-7B, Falcon3-Mamba-7B, Llama-3.1-8B and others8
- DefensesInference-time intervention
- AttacksJailbreaks
- RiskInappropriate refusal
- ComponentMonitors
Abstract拒答方向可经刚性旋转跨架构迁移，但必须在各架构的写入点读取。
作者研究拒答表示是否随架构改变，结论是表示共享、读取位置随架构变。
Paper analysisRead analysis
DefensesarXiv 2609.03629Sep 3
EraseSAE：用稀疏自编码器在文生视频扩散模型中实现精准概念擦除
提出 EraseSAE，在文生视频模型中局部擦除指定概念
arXiv
2609.03629
Published
Sep 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
CogVideoX-5B, HunyuanVideo, Flux.1 [dev]
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentImage generation
AbstractEraseSAE 用单义特征局部擦除。
EraseSAE 把 SAE 用于 DiT 文生视频模型的概念擦除。作者要解决的是：全局改权重或表面负提示对不齐细粒度、分布式的概念，而且会改到无关时空区域。
Paper analysisRead analysis
DefensesarXiv 2608.28233Aug 28
REINS：用 SAE 特征同时抑制有害续写并增强拒答的引导方法
提出 REINS，在 SAE 空间抑制有害延续并增强拒答
arXiv
2608.28233
Published
Aug 28
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3.5-4B-Base, Qwen3.5-2B-Base, Gemma-3-1B-IT
- DefensesInference-time intervention
- AttacksJailbreaks
AbstractREINS 分角色抑制有害延续并增强拒答。
REINS 是一种推理时 SAE 安全转向方法，并配有用于上下文伪装的基准 GUISE。
Paper analysisRead analysis
DefensesarXiv 2607.24017Jul 27
多模态大模型注意力中的语义与结构偏差解耦：SPAR 免训练干预方法
提出 SPAR 免训练注意力干预，削弱多模态模型的结构偏置
arXiv
2607.24017
Published
Jul 27
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, LLaVA-NeXT
- DefensesInference-time intervention
- RiskHallucination and fabrication
- ComponentVision
AbstractSPAR 以结构偏置净化缓解视觉幻觉，结果需区分误导后收益与原始任务例外。
SPAR 是一种无需训练、直接修改多模态内部注意力的幻觉防御。 作者关注视觉信息被查询不变的注意力偏置稀释，以及误导文本进一步推动模型依赖语言先验的问题。
Paper analysisRead analysis
DefensesarXiv 2606.22673Jun 22
Agent MechSuits：面向多轮 CLI Agent 的机制子空间安全引导
提出 Agent MechSuits，对多轮 CLI Agent 做步级检测与子空间转向
arXiv
2606.22673
Published
Jun 22
Layer
Application layer
Setting
coding agent
Evaluated models
LLaMA-3.1-8B, Qwen-2.5-7B, Gemma-2-9B
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentMonitors
Abstract白盒步级探针加稀疏转向可压低三模型恶意动作，同时提高生成崩溃率。
Agent MechSuits 是面向多轮 CLI 智能体的白盒、步级表示防御，并配有可执行轨迹基准 MAS。
Paper analysisRead analysis
DefensesarXiv 2606.18673Jun 17
理解并缓解真实世界 LLM 应用中的提示词泄露攻击
提出软提示防御 AREA，重锚定注意力以缓解系统提示泄露
arXiv
2606.18673
Published
Jun 17
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Llama-2-7B-chat-hf, Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3 and others8
- DefensesInference-time intervention
- AttacksExtraction and theft
Abstract作者测量商用提示词泄漏，提出 attention drift，并用 AREA 在可用性与抗泄漏间取折中。
作者研究真实 LLM 应用中的 system prompt 泄漏，并给出不改权重的缓解方法 AREA。
Paper analysisRead analysis
DefensesarXiv 2606.08234Jun 6
SciTrace：面向科学发现智能体的轨迹感知安全推理框架
提出 SciTrace，为科学发现智能体加入跨阶段安全推理与工具轨迹核验
arXiv
2606.08234
Published
Jun 6
Layer
Application layer
Setting
science agent, Multi-agent systems
Evaluated models
Llama-3.1-70B-Instruct, Qwen2.5-72B-Instruct, DeepSeek-V3 and others4
- DefensesInference-time intervention
- AttacksPrompt injection
- RiskDangerous capabilities
- ComponentGuardrails and judges
AbstractSciTrace 把安全推理织入科学智能体各阶段，在 SciSafetyBench 上提高安全指标并保持输出质量。
SciTrace 是加在科学发现智能体流水线上的安全框架，不是再在各阶段出口放一个独立过滤器。
Paper analysisRead analysis
InterpretabilityarXiv 2603.08234Mar 9
续写与拒答之争：大语言模型中续写触发越狱的机制分析
分析续写触发越狱的注意力头机制并提出 HCS
arXiv
2603.08234
Published
Mar 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
LLaMA-2-7B-Chat, Qwen2.5-7B-Instruct
- DefensesInference-time intervention
- AttacksJailbreaks
- TechniqueConversation structure manipulation
Abstract作者称越狱来自两类头竞争，HCS 加蒸馏可把该竞争用于推理时干预。
作者用注意力头机制分析 continuation-triggered jailbreak：同一有害指令下，把 continuation 后缀从指令后面挪到提示词边界外，模型更容易顺着后缀继续生成。
Paper analysisRead analysis
DefensesarXiv 2602.20880Feb 24
When safety conflicts: resolving multi-category harmful conflicts in text-to-image diffusion models with adaptive safety guidance
提出 CASG，解决文生图多类别安全引导的方向冲突
arXiv
2602.20880
Published
Feb 24
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Diffusion v1.5, SDv3
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentImage generation
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop