Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出利用路由元数据推断敏感话题的侧信道攻击
Published Oct 7
Evaluated models RouteLLM (BERT router) , notdiamond-0001 , Vela (vLLM Semantic Router) Abstract 论文揭示并测量了 LLM 路由决策在无文本日志中的敏感话题泄露，验证了按类别公平性防御的有效性与边界。
提出 TRANSCOPE，用 CPU 硬件计数器推断训练集成员
Published Oct 6
Evaluated models BERT (4.4M-340M) , ViT (22M-307M) , Pythia (70M-2.8B) and others5 Abstract TRANSCOPE 揭示了分词器在嵌入表引发的硬件访问局部性差异，证实微架构计数器可突破恒定时间与置信度遮蔽防御。
提出利用共享冷却的跨租户干扰攻击，并设计租户隔离机制
Published Oct 4 Abstract 揭示网关共享冷却漏洞，提出来源检查与租户隔离防御。
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
Published Sep 7
Evaluated models BERT-base , RoBERTa-base , T5-base and others6 提出 GIFT，用加密与 GPU 信息流跟踪隔离共享 LLM 服务中的用户数据
Published Aug 26
Evaluated models Qwen2.5-14B , Qwen2.5-32B , Qwen2.5-72B and others6 Abstract GIFT 以加密隔离加 GPU 信息流规则，在 vLLM 与 DistServe 上强制用户数据隔离，并报告了吞吐开销。GIFT 是作者为共享 LLM serving 做的用户数据隔离系统，并有启用机密计算的 GIFT-CC。作者在结论中称它是该场景的首个 IFT 设计。
提出 KeyPooling，测量 API 中继何处瓦解提示缓存隔离
Published Aug 18
Evaluated models grok-4-fast-non-reasoning , grok-4-1-fast-non-reasoning , grok-3 and others11 Abstract 共享上游凭证使中继客户进入同一缓存域，保留身份或独立 principal 可分开。KeyPooling 测量 LLM API 中继在何处丢掉客户身份，使 prompt cache 不再按下游客户隔离。
构造可通过计费审计的 token 虚报，使服务商系统性超收
Published May 28
Evaluated models PALACE domain-adapted auditor Abstract 不诚实提供方可在三种 token 审计上虚报并通过检查，作者认为需改用提供方不控制的证据。不透明 LLM 的按 token 计费里，现有审计核验的是提供方可控的证据，不诚实提供方可以虚报并通过检查。 。
提出 PrefixWall 选择性隔离共享前缀以缓解计时侧信道
Published Mar 11
Evaluated models gemma-3-4b-it , llava-onevision-qwen2-0.5b-ov-hf , llava-onevision-qwen2-7b-ov-chat-hf and others9 Abstract PrefixWall 用缓存元数据按需切断跨用户前缀延续，以保留 APC 并限制 TTFT 侧信道。PrefixWall 是多租户 LLM 服务上的系统级防御，用来限制 Automatic Prefix Caching 的 TTFT 侧信道，同时保留前缀复用。
提出 OPTILEAK，经 KV 缓存侧信道逐 token 重建他人提示
Published Feb 24
Evaluated models Qwen-2.5-3B-Instruct , Qwen-2.5-7B-Instruct , Qwen-2.5-14B-Instruct and others4 Abstract OPTILEAK 用 SFT 与 hard-token DPO 降低每 token 请求数，作者称缓存提示泄露的风险高于先前报告。
You have reached the end