Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 17 papers
Filter4

Attack type

Jailbreaks6Extraction and theft3

Model risks

Inappropriate refusal5

Defense type

Model hardening15Inference-time intervention43Detection and filtering7Instruction–data separation2Permissions and approval0Monitoring and auditing19Watermarking and provenance13

Impact

Harmful content8Data and privacy leaks3Output manipulation3

System type

Models and APIs17

Attack surface / entry point

User input7Training data3

Layer

Prompt layer7Model layer17Application layer112Training and data layer113

System component

Multimodal3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
Defense type：Model hardeningDefense type：Instruction–data separationDefense type：Permissions and approvalLayer：Model layerClear all

Another 232papers do not have category tags yet and are not included in filtered results.

  1. InterpretabilityarXiv 2610.13078

    Attention sees, MLP refuses: tracing the safety pathway from attention to MLP in LLMs

    Trace attention to identify harmfulness to the MLP refusal write pathway and propose Sentinel

    arXiv
    2610.13078
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, Qwen3-8B-Instruct and others18
    AbstractAttention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.

    The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.

    Paper analysisRead analysis
  3. DefensesarXiv 2610.04426

    UnAct：无需梯度的定向激活干预实现类别遗忘

    提出 UnAct，仅以前向激活干预从分类器中遗忘指定类别

    arXiv
    2610.04426
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-18, ViT-B/16
    AbstractUnAct 用前向激活做类别遗忘。

    UnAct 是一种事后类别遗忘：删除请求可以只有少量该类图像，且没有标签和保留数据。它不用梯度，只对遗忘图像做前向。编辑对象是分类器所读的后期单元。

    Paper analysisRead analysis
  4. DefensesarXiv 2610.00348

    NEEDLE：通过权重正交化移除 LLM 后门

    提出 NEEDLE，用权重正交化在已知触发器时去除大模型后门

    arXiv
    2610.00348
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Gemma-3-4B-IT, Qwen3-4B-Instruct-2507, Gemma-3-12B-IT

    AbstractNEEDLE 用闭式权重编辑去掉已知触发器的后门，并保住拒绝子空间。

    Paper analysisRead analysis
  5. DefensesarXiv 2609.32720

    BiasReducer：面向奖励模型的自适应偏见缓解方法

    B IAS R EDUCER 只改奖励头，按数据集选择属性编辑。

    arXiv
    2609.32720
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Skywork-Reward-V2-Qwen3-1.7B, GRM-Llama3.2-3B-rewardmodel-ft, RM-Mistral-7B and others7
    AbstractBIASREDUCER 按数据集选择奖励头编辑，五模型三基准平均提升并迁移到下游训练。

    BIASREDUCER 是一种只改线性奖励头的奖励模型编辑框架，用来降低模型对预定义表面属性的依赖，并按新数据集决定改哪些属性。

    Paper analysisRead analysis
  10. Evaluation and benchmarksarXiv 2609.08901

    论文揭示 BatchNorm 架构下机器遗忘评测的归一化伪影

    诊断 BatchNorm 架构下机器遗忘评测的归一化伪影

    arXiv
    2609.08901
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-18, ResNet-50, ViT-S/16 and others4
    Abstract一次不改权重的 BN 重校准能翻转多数方法的表面遗忘，但不改变权重里的编码器泄露。

    BN illusion 是作者对近似机器遗忘评测中一种 BatchNorm 测量伪影的命名：不改权重、只用 retain 数据重算运行统计，就可以把表面遗忘准确率翻过来。

    Paper analysisRead analysis
  11. InterpretabilityarXiv 2609.06934

    论文提出拒答的几何解释：事后安全训练脆弱，预训练期持续安全共训更抗攻击

    解释后验安全的权重几何脆弱性，并提出预训练持续安全共训练

    arXiv
    2609.06934
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen-2.5-7B, Qwen-2.5-7B-Instruct, Llama-3-8B and others15

    Abstract论文将后验安全脆弱性归因于正交抑制，并提出通过预训练持续共训练实现具备微调抗性的安全防护。

    Paper analysisRead analysis
  14. AttacksarXiv 2606.11817

    研究：语法约束解码可越狱 LLM 生成恶意代码，并提出 CodeShield 防御

    提出 CodeSpear 越狱，借语法约束解码生成恶意代码，并给出 CodeShield 防御

    arXiv
    2606.11817
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Qwen2.5-Coder-7B, Qwen2.5-Coder-32B, Qwen2.5-7B and others10

    Abstract论文发现语法约束解码会破坏自然语言安全对齐，提出 CodeSpear 越狱攻击与基于蜜罐代码对齐的 CodeShield 防御。

    Paper analysisRead analysis
  15. DefensesarXiv 2604.00012

    研究提出 SafeReAct：恢复后训练大模型被掩盖的安全机制

    提出 SafeReAct，用 LoRA 重激活后训练模型被掩盖的安全机制

    arXiv
    2604.00012
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    DeepSeek-R1-distilled LLaMA-8B, DeepSeek-R1-distilled Qwen-7B, DeepSeek-R1-distilled Qwen-14B and others9
    AbstractSafeReAct 用剪枝得到的安全表示做 LoRA 对齐，以恢复后训练模型被掩盖的拒绝行为。

    这篇工作针对后训练 LLM 的安全下降，提出表示对齐方法SafeReAct。

    Paper analysisRead analysis
  16. DefensesarXiv 2602.24210

    研究者提出 Staged Decoding 与 SFT 数据集，减少大推理模型推理轨迹中的隐私泄露

    提出 Staged Decoding 与指令跟随训练，减少推理轨迹隐私泄露

    arXiv
    2602.24210
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Qwen 3 1.7B, Qwen 3 4B, Qwen 3 8B and others6
    Abstract用一般指令跟随训练加分段解码，可降低轨迹隐私泄露，但数学效用下降。

    本文把大推理模型的隐私问题做成轨迹可控性：隐私指令是指令，轨迹不跟随就会把敏感上下文写进可被提示注入导出的文本。

    Paper analysisRead analysis
  17. Analysis and theoryarXiv 2506.06404

    研究揭示价值对齐 LLM 的意外危害并提出上下文对齐方法

    分析按 Schwartz 价值对齐后的意外危害，并提出上下文对齐方法

    arXiv
    2506.06404
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Evaluated models
    Llama-2 7B, Llama-3.1 8B, Gemma-2 9B and others6
    Abstract价值对齐会随 Schwartz 价值改变有害倾向。

    作者研究按 Schwartz 价值对齐的 LLM 为何在安全评测里更易有害，并用提示做了一个不直说要安全的缓解试验。

    Paper analysisRead analysis
You have reached the end