Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Defense type：Model hardening Defense type：Permissions and approval Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2610.11005Oct 8
研究：叙事包装可跨语言绕过 LLM 拒答
提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱
arXiv
2610.11005
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-1.7B, Qwen3-4B, GLM-4-9B
- DefensesModel hardening
- AttacksJailbreaks
AbstractGUISE 分开测包装与语域。
作者测量叙事包装下的拒答失效，并训练一个在未见包装上拒绝、同时仍回答同风格良性请求的适配器。问题是：安全对齐模型拒绝直说的有害请求，却回答嵌进角色或叙事里的同一请求。文言文被用来把语域和包装拆开。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.10358Oct 8
Open-MMUnlearning 发布：统一多模态大模型遗忘方法与评测框架
提出统一框架评测多模态大模型的遗忘方法
arXiv
2610.10358
Published
Oct 8
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B
- DefensesModel hardening
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.05840Oct 5
研究：任务范围授权可将工具调用有害执行降至零
用配对回放评测任务范围授权能否阻断越权工具执行
arXiv
2610.05840
Published
Oct 5
Layer
Application layer
Setting
AI Agent
Evaluated models
Llama 3.2 3B Instruct Q4 K M, Qwen3 4B Instruct, Gemma 3 4B and others8
- DefensesPermissions and approval
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.02664Oct 2
论文提出 GHOST：长程智能体在良性对话中遗忘早期安全约束
提出 STAR-Guard 双层防御，抑制长程 Agent 遗忘跨轮安全约束
arXiv
2610.02664
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Evaluated models
GPT-5.5, DeepSeek-V4-Pro, GLM-5.2 and others7
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract揭示 GHOST 跨轮约束遗忘风险，构建 SCARBench 基准并通过 STAR-Guard 双层防御消除违规。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.01508Oct 1
OverAct：衡量并缓解 LLM 工具调用智能体的主动越权取数
发布 OVERACT 衡量工具智能体主动越权取数并评测 SELFAUDIT
arXiv
2610.01508
Published
Oct 1
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.6-Flash, Qwen3.6-Plus, Qwen3.7-Max and others7
- DefensesPermissions and approval
- RiskDangerous agent actions
Abstract七模型普遍超额调用。
七个来自四个家族的工具调用模型，在保守的字面授权准则下会检索超出请求的私人数据。作者把该行为称为 proactive over-authorization，用 OVERACT 做无 LLM 评审的测量，并用 SELFAUDIT 做不依赖 oracle 的执行前过滤。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.40286Oct 1
研究者提出 COVER：在语言预算下选择源语言实现跨语言遗忘
提出 COVER，在语言预算下选择源语言实现跨语言知识遗忘
arXiv
2609.40286
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Tiny Aya Global, Qwen3-4B-Instruct-2507, Llama-3.2-3B-Instruct
- DefensesModel hardening
- AttacksExtraction and theft
AbstractCOVER 在语言预算下选源语言，以降低未监督语言上相对 oracle 的残余访问。
语言预算下的多语言遗忘：遗忘监督只放在 K 种源语言上，目标是降低其余语言对同一事实的残余访问，而不是把每种评测语言都译成监督数据。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.35557Sep 29
论文：容器、权限规则与沙箱都无法区分读取研究代码的是编译器还是编码 Agent
评测容器、权限规则与沙箱能否区分编译器与编码 Agent 的文件读取
arXiv
2609.35557
Published
Sep 29
Layer
Application layer
Setting
coding agent
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract此 harness 表达不了编译器可读而智能体不可读，五条路径两边都不覆盖。
作者在物理流求解器上检查一套编码智能体配置：编译器必须读本组材料与反应模型，这些字节又不得进入模型上下文或离开本机的记录。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34092Sep 28
机器遗忘在 ASR 中是否有效：arXiv 论文评估现有算法与评测工具
arXiv
2609.34092
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
E-Branchformer
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentAudio
Abstract梯度上升类方法更接近简单评测下的重训参照，复杂方法会被知情攻击认出，多说话人更差。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33640Sep 27
SafeMol：分子多模态模型的双模态安全对齐
提出 SafeMol，联合对齐分子多模态模型的文本与图输入
arXiv
2609.33640
Published
Sep 27
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Omni-Mol v2, ReactXT, SafeMol
- DefensesModel hardening
- AttacksJailbreaks
AbstractSafeMol 用 MMD 和双分类头对齐分子多模态模型，在 Omni-Mol v2 上压低图条件攻击成功。
SafeMol 研究分子多模态模型在危险分子相关请求上的安全对齐，并同时看过拒和任务效用。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.33481Sep 27
IDUnlearn-Bench：面向视觉语言模型的个体级遗忘基准
提出 IDUnlearn-Bench，评测 VLM 个体级遗忘后的身份残留
arXiv
2609.33481
Published
Sep 27
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others6
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentVision
AbstractIDUnlearn-Bench 用四族探针显示：压低直接属性访问后，身份仍常能被反向查出、绑定或重构。
IDUnlearn-Bench 评测 VLM 是否忘掉一个可跨模态识别的人，而不只是答不出某条监督事实。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.25579Sep 22
研究重新审视后门修复评测：区分总体干净效用与良性性能保持
用 Dmax 与尾部损失评测后门修复的类别性能保持
arXiv
2609.25579
Published
Sep 22
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet18, PreActResNet18, VGG19-BN
- DefensesModel hardening
- AttacksPoisoning and backdoors
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.22076Sep 19
APort Vault released: evaluating AI agent payment authorization with 4,371 human-written attacks
构建 APort Vault 基准，对比支付智能体模型拒答与确定性授权
arXiv
2609.22076
Published
Sep 19
Layer
Application layer
Setting
AI Agent
Evaluated models
Claude Fable 5.1, Claude Sonnet 5, Claude Haiku 4.5 and others14
- DefensesPermissions and approval
- AttacksJailbreaks
- ComponentPermissions and sandboxing
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.08943Sep 9
研究提出 Fact-Ablated Evaluation，揭示 LLM 事实核查更依赖参数知识
提出 FAE 衡量事实核查对证据的依赖，并用 REAL 训练这种依赖
arXiv
2609.08943
Published
Sep 9
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
REAL (Llama-3.1-8B-Instruct), REAL (Qwen-2.5-7B-Instruct)
- DefensesModel hardening
AbstractFAE 用多轮证据消融测接地，REAL 用对比监督让判决随证据可用性改变。
FAE 与 REAL 分别用来测量并训练 LLM 事实核查器对所给证据的依赖，而不只看一次性的标签准确率。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.08901Sep 8
论文揭示 BatchNorm 架构下机器遗忘评测的归一化伪影
诊断 BatchNorm 架构下机器遗忘评测的归一化伪影
arXiv
2609.08901
Published
Sep 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
ResNet-18, ResNet-50, ViT-S/16 and others4
- DefensesModel hardening
- AttacksModel tampering
Abstract一次不改权重的 BN 重校准能翻转多数方法的表面遗忘，但不改变权重里的编码器泄露。
BN illusion 是作者对近似机器遗忘评测中一种 BatchNorm 测量伪影的命名：不改权重、只用 retain 数据重算运行统计，就可以把表面遗忘准确率翻过来。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2608.18607Aug 19
VA-Judger：面向联合视频-音频生成的人类偏好反馈奖励建模
提出 VA-Judger，用人类偏好训练联合音视频奖励模型
arXiv
2608.18607
Published
Aug 19
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
VA-Judger, LTX-2 + VA-Judger
- DefensesModel hardening
- RiskReward hacking
- ComponentGuardrails and judges
AbstractVA-Judger 用易到难的人类偏好学习做联合音视频奖励，并用于 LTX-2 后训练。
VA-Judger 是面向联合音视频生成的思维链全模态奖励模型，用来替代由分维度专家指标拼成的强化学习奖励。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.14859May 14
论文提出 AuthBench 基准，评测编码 Agent 能否推断最小权限边界
提出 AuthBench 评测编码 Agent 最小权限，并验证充足性-紧缩性分解
arXiv
2605.14859
Published
May 14
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5, GPT-5.3-Codex, GPT-5.4 and others9
- DefensesPermissions and approval
- RiskDangerous agent actions
- ComponentPermissions and sandboxing
Abstract论文提出权限边界推断基准与两阶段分解方法，有效降低安全暴露。
本文研究代码智能体在执行终端任务前自主推断最小文件权限边界的能力。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2605.14605May 14
研究：恶意微调防御在持续训练下失效，72 条防御轨迹危害度全部上升
用代价曲线评估恶意微调防御在持续训练下的衰减
arXiv
2605.14605
Published
May 14
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-2-7B-chat, Qwen3-8B, Llama-3.1-8B-Instruct and others8
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract论文指出恶意微调防御在持续训练下均会衰减，表明基于有限攻击者假设的防御无法为开源模型提供持久保护。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop