Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 12 papers Another 265 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
用翻译前缀做跨语言训练数据提取，恢复英语训练文本中的 PII
Published Oct 5
Evaluated models GPT-Neo 1.3B , GPT-Neo 2.7B , GPT-J 6B and others7 Abstract 跨语言 TDE 能恢复英语记忆的 PII，转移随多语训练和措辞保真变化。这篇工作检验训练数据抽取是否跨语言：英语段落里记住的 PII，能否被其他语言的前缀逐字抽出。
提出 PrivDrift 基准，审计话题漂移后的用户秘密复述
Published Sep 25
Evaluated models GPT-OSS-120B , DeepSeek-R1 , Qwen3-VL-235B 提出扩散潜空间地理扰动防御，抑制视觉语言模型泄露精确地理位置
Published Sep 18
Evaluated models GPT-4.1 , GPT-5 , Gemini 2.5 Pro and others5 提出红蓝对抗评测平台 ACEA，分开计量攻击强度与防御效果
Published Sep 8
Evaluated models openai/gpt-4o , google/gemini-2.5-pro , google/gemma-3-27b-it and others5 Abstract ACEA 用 ASAP 让红蓝对同一目标对打。ACEA 是让可插拔红队和蓝队共享一个目标 LLM 的对打场地，把攻击强度和防御效果分开记分。作者要补三处空缺：双方只能对着固定对手分开练。LLM judge 分不清真实泄露和幻觉，拦截后又看不到攻击有多强。
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
Published Aug 11
Evaluated models Claude Opus 4.8 , Claude Sonnet 4.6 , Claude Haiku 4.5 and others13 Abstract 论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
提出 TC-UAP，用身份级多帧扰动保护视频免被定制复现身份
Published Jul 15
Evaluated models LTX-2.3 , Wan2.2-5B Abstract TC-UAP 以可复用的时间一致扰动干扰两类定制共用的 VAE 隐空间。作者要解决的是：发布前如何给视频加不可见扰动，使片段既不能被拿去微调视频扩散模型，也不能被抽帧做 image-to-video。
提出隐私感知基准 CyberMaskQA，评测网络安全问答与敏感实体掩码
Published May 24
Evaluated models Llama-3.1-8B-Instruct , InternLM3-8B-Instruct , Mistral-3-8B-Instruct and others4 Abstract CyberMaskQA 联合评测带上下文的网安问答与掩码。作者构建隐私感知网安问答基准 CyberMaskQA ，用来同时看依赖组织上下文的选择题推理，以及敏感实体掩码。
用编码与结构化请求抽取系统指令，并用 CoT 改写加固
Published Apr 1
Evaluated models GPT-4.1-mini , GPT-3.5-turbo , Gemini-2.5-flash and others7 Abstract 编码式请求可在直接拒答后引出系统指令。这项工作评测并加固 LLM 系统指令在编码式抽取下的保密性。作者关心的是：直接抽取已被拒绝时，把同一请求改写成格式化或编码任务，模型是否仍交出受保护内容。
提出用户侧防御 TRACE-RPS，分享前匿名化文本并追加后缀以抑制属性推断
Published Feb 12
Evaluated models Llama2-7B-Chat , Llama2-13B-Chat , Llama3.1-8B-Instruct and others10 Abstract 用户侧 TRACE 加 RPS/MPS，在分享前降低 LLM 对敏感属性的推断准确率。这是一项用户侧防御：在文本公开前降低 LLM 对敏感属性的推断，而不是改攻击提示或削弱模型推理。
提出 JustAsk，用在线技能选择提取模型系统提示词
Published Jan 29
Evaluated models anthropic/claude-opus-4.5 , openai/gpt-5.2-codex , GPT-5.2 and others19 Attacks arXiv 2512.16059 · Dec 18, 2025 提出 ContextLeak，用金丝雀成员推断审计私有 ICL 泄漏
Published Dec 18, 2025
Evaluated models Llama3.3-70b , Qwen2.5-72b , GPT-4.1 and others6 Abstract ContextLeak 审计私有 ICL 的 worst-case 泄漏。ContextLeak 是一套用成员推断审计私有 ICL 的框架，目标是给 worst-case 泄漏一个经验下界，而不是只引用理论 ε。
Attacks arXiv 2509.09488 · Sep 11, 2025 提出 SeedSnitch 与 PromptPirate，恢复种子后窃取扩散提示词
Published Sep 11, 2025
Evaluated models Stable Diffusion 3.5 Large , Stable Diffusion 3.5 Medium , Stable Diffusion 3.5 Turbo and others4 You have reached the end