Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 29 papers

Filter4

Attack type

Prompt injection9 Poisoning and backdoors4 Extraction and theft15

Attack technique

Defense-targeted3 Dormant triggers4

Defense type

Model hardening5 Instruction–data separation3

Impact

Harmful content45 Unauthorized actions73 Data and privacy leaks29 Output manipulation57 Availability and reliability10 Oversight failure10

System component

Permissions and sandboxing3 Fine-tuning and open weights7 Multimodal5

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.

Impact：Data and privacy leaks Attack surface / entry point：Tool responses Attack surface / entry point：Training data Attack surface / entry point：Weights and gradients Clear all

Another 233papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.07510Oct 6
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
arXiv
2610.07510
Published
Oct 6
Layer
Application layer
Setting
coding agent
Evaluated models
Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
Paper analysisRead analysis
DefensesarXiv 2610.06636Oct 6
差分隐私混合公共数据集提升隐私学习效果
提出 DP-MixMin，私有学习公开数据混合并做差分隐私微调
arXiv
2610.06636
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
ResNet-18, GPT-2 Medium
- AttacksExtraction and theft
AbstractDP-MixMin 私下学公开混合再 DP 微调，胸片 macro AUC 与邮件困惑度优于均匀混合。
DP-MixMin 是一条端到端的差分隐私训练流程：先私下决定多个公开数据集的预训练混合，再预训练并在敏感数据上 DP 微调。作者称这是首个这样的流程。
Paper analysisRead analysis
AttacksarXiv 2610.05601Oct 5
Tracer 框架可从遗忘后的扩散模型中识别被擦除概念
提出 TRACER，从权重差识别扩散模型被擦除概念
arXiv
2610.05601
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
- AttacksExtraction and theft
- ComponentImage generation
AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。
TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
Paper analysisRead analysis
AttacksarXiv 2610.05453Oct 5
研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私
提出 PLW，用微调把先前对话敏感触发编码进后续生成图像
arXiv
2610.05453
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
OmniGen2, BAGEL-7B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。
Paper analysisRead analysis
DefensesarXiv 2610.04426Oct 3
UnAct：无需梯度的定向激活干预实现类别遗忘
提出 UnAct，仅以前向激活干预从分类器中遗忘指定类别
arXiv
2610.04426
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
ResNet-18, ViT-B/16
- DefensesModel hardening
- AttacksExtraction and theft
AbstractUnAct 用前向激活做类别遗忘。
UnAct 是一种事后类别遗忘：删除请求可以只有少量该类图像，且没有标签和保留数据。它不用梯度，只对遗忘图像做前向。编辑对象是分类器所读的后期单元。
Paper analysisRead analysis
AttacksarXiv 2610.04128Oct 3
研究显示拆分学习中的梯度可提升客户端文本重建率
衡量分裂学习中梯度相对激活对客户文本重建的额外贡献
arXiv
2610.04128
Published
Oct 3
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
GPT-2 (openai-community/gpt2, 124M), Qwen3-0.6B
- AttacksExtraction and theft
Abstract激活已恢复大部分 token。
这篇工作测量 split learning 分裂点上的文本泄漏：激活单独能恢复多少，训练回传的梯度再增加多少，以及按 token 还是按整篇计分会不会改写结论。
Paper analysisRead analysis
AttacksarXiv 2610.01365Oct 1
ReGap：无需真实隐私数据即可通过微调重新提取模型隐私关联
提出 ReGap，用自生成伪监督微调恢复模型中的隐私关联
arXiv
2610.01365
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Gray-box
Evaluated models
GPT-2 Small, GPT-2 Medium, GPT-2 Large and others6
- AttacksExtraction and theft
- ComponentFine-tuning and open weights
Abstract提出无真实私有监督的恢复攻击 ReGap，实验显示微调可通过自生成数据唤醒模型潜在隐私关联，突显后适应隐私风险。
Paper analysisRead analysis
DefensesarXiv 2610.02418Oct 1
Whiteout：用混淆样本阻止 LLM 泄露个人敏感信息
提出 Whiteout，用伪装样本微调覆盖个人敏感信息关联
arXiv
2610.02418
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama 3.2, Phi-3-mini, Gemma 3 and others7
- DefensesModel hardening
- AttacksExtraction and theft
Paper analysisRead analysis
DefensesarXiv 2609.37858Sep 29
存储不等于策略：面向 LLM 遗忘的状态条件支持控制
提出 Intervention Score 与 DIR-R，按干预效果选择并修订遗忘参数支持
arXiv
2609.37858
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama 3 8B, Gemma 2 2B, Qwen2.5-7B and others4
- DefensesModel hardening
- AttacksExtraction and theft
Abstract作者把局部化遗忘拆成初始干预选择和检查点修订，并在三个设置里分别给证据和边界。
Storage Is Not Strategy 研究局部化 LLM 遗忘里两个常被混在一起的决定：一开始该更新哪些参数，以及优化改变模型之后这个选择要不要改。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.34092Sep 28
机器遗忘在 ASR 中是否有效：arXiv 论文评估现有算法与评测工具
arXiv
2609.34092
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
E-Branchformer
- DefensesModel hardening
- AttacksExtraction and theft
- ComponentAudio
Abstract梯度上升类方法更接近简单评测下的重训参照，复杂方法会被知情攻击认出，多说话人更差。
Paper analysisRead analysis
AttacksarXiv 2609.33985Sep 28
研究：众包微调数据投毒可放大专有指令抽取
提出主题锚点投毒，放大众包微调后的专有指令提取
arXiv
2609.33985
Published
Sep 28
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-14B-Instruct, Llama-3.1-8B-Instruct and others4
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文提出基于主题锚点的数据中毒攻击，证明低比例的中毒样本可在黑盒条件下隐蔽放大微调指令泄漏。
Paper analysisRead analysis
DefensesarXiv 2609.33371Sep 27
论文提出保险库中介执行边界，评估 LLM Agent 的 API 凭据处理风险
提出并评测保险库中介执行边界，隔离 Agent 的 API 凭据
arXiv
2609.33371
Published
Sep 27
Layer
Application layer
Setting
AI Agent
Evaluated models
Corvic Security Vault
- DefensesInstruction–data separation
- AttacksPrompt injection
- ComponentPermissions and sandboxing
Abstract作者称，凭据分离可减少披露路径，但权限、操作授权和配置验证仍需独立控制。
这是一项智能体 API 凭据威胁分析及 Vault 执行边界的功能评测。作者关心的不是模型能否承诺保密，而是认证材料是否会进入模型、日志、记忆和执行代码。
Paper analysisRead analysis
AttacksarXiv 2609.27542Sep 23
Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring
提出控制标记注入，清空工具 Agent 的思维链以绕过推理监控
arXiv
2609.27542
Published
Sep 23
Layer
Application layer
Setting
AI Agent
Evaluated models
openai/gpt-oss-20b, google/gemma-4-26B-A4B-it, deepseek-ai/DeepSeek-R1-Distill-Qwen-7B and others4
- AttacksPrompt injection
- TechniqueConversation structure manipulation
- ComponentReasoning chains
Abstract论文阐明控制标记注入可抑制 CoT 使监控失效并促成拒绝绕过，且工具执行受解析器宽容度影响。
Paper analysisRead analysis
AttacksarXiv 2609.31726Sep 22
研究者提出通过替换神经网络权重高容量外泄医学影像的攻击
提出连续潜码隐写，把医学影像写入模型权重以绕过导出限制
arXiv
2609.31726
Published
Sep 22
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
U-Net, DenseNet121
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2609.20532Sep 17
面向旧款 GPU 的可验证差分隐私训练框架：用 CPU 侧 TEE 校验 GPU 梯度
AI summary论文提出一种在旧款 GPU 上实现可验证差分隐私（DP）训练的框架，用 CPU 侧 TEE 配合不受信任的 GPU 完成校验。
arXiv
2609.20532
Published
Sep 17
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
5-layer MLP, WideResNet, GPT-2-medium and others4
AbstractCPU TEE 概率抽查不可信 GPU 上的 DP-SGD，以小开销约束频繁偏离。
TEE-Certified DP 用已部署的 CPU TEE 监视不可信旧 GPU 上的 DP-SGD，使监管方能在不看训练数据的情况下检查声明的隐私机制是否被执行。
Paper analysisRead analysis
AttacksarXiv 2609.18217Sep 16
研究：跨通道碎片化攻击可绕过 MCP 单通道防御
提出跨通道分段攻击，利用 MCP 隐式信任外发敏感文件
arXiv
2609.18217
Published
Sep 16
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-4o, GPT-4o-mini, GPT-5.4 and others15
- AttacksPrompt injection
- TechniqueEncoding and obfuscation
- ComponentMCP and skills
Abstract论文揭示了 MCP 多通道隐式信任层级，通过跨通道分段与协议级利用突破现有防御，展示了严重的凭证外发风险。
Paper analysisRead analysis
DefensesarXiv 2609.16229Sep 15
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
arXiv
2609.16229
Published
Sep 15
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
Paper analysisRead analysis
DefensesarXiv 2609.15671Sep 14
QPriv-VL：面向视觉语言模型的问题引导 token 裁剪隐私防御
提出 QPriv-VL，用问题引导剪枝降低分布式视觉问答的隐私泄露
arXiv
2609.15671
Published
Sep 14
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Llama-2
- AttacksExtraction and theft
- ComponentVision
AbstractQPriv-VL 在切层前按问题相关度与 DINOv2 敏感度剪视觉 token，作者称能在约四成 token 下兼顾准确率与四类攻击。
QPriv-VL 把问题引导的视觉 token 剪枝做成分布式 VQA 的客户端隐私防御，而不是只做集中式推理加速。
Paper analysisRead analysis
AttacksarXiv 2609.10117Sep 9
研究揭示基于混淆的端侧 LLM 保护方案的安全边界
提出 Collapse，从端侧混淆暴露视图抽取高效用替代模型
arXiv
2609.10117
Published
Sep 9
Layer
Model layer
Setting
Models and APIs
Evaluated models
BERT-Base, ViT-Base, Qwen2.5-0.5B and others4
- AttacksExtraction and theft
- TechniqueDefense-targeted
AbstractOprior 是四原语复合的安全边界，Collapse 利用列方向泄漏抽取替代模型，Oext 只被同一攻击评测。
这篇工作用代数原语统一若干 TEE 卸载混淆，给出该族的典范边界，再说明该边界挡不住一种分阶段模型抽取。。
Paper analysisRead analysis
DefensesarXiv 2609.07529Sep 7
CoER：用对抗协同演化与精炼防御自适应间接提示注入
提出 CoER，用对抗共进化与精炼训练工具智能体抵御自适应间接提示注入
arXiv
2609.07529
Published
Sep 7
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-9B
- DefensesModel hardening
- AttacksPrompt injection
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop

All papers

Attack type

Attack technique

Defense type

Impact

System type

Attacker access

Attack surface / entry point

Layer

System component

PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.

差分隐私混合公共数据集提升隐私学习效果

Tracer 框架可从遗忘后的扩散模型中识别被擦除概念

研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私

UnAct：无需梯度的定向激活干预实现类别遗忘

研究显示拆分学习中的梯度可提升客户端文本重建率

ReGap：无需真实隐私数据即可通过微调重新提取模型隐私关联

Whiteout：用混淆样本阻止 LLM 泄露个人敏感信息

存储不等于策略：面向 LLM 遗忘的状态条件支持控制

机器遗忘在 ASR 中是否有效：arXiv 论文评估现有算法与评测工具

研究：众包微调数据投毒可放大专有指令抽取

论文提出保险库中介执行边界，评估 LLM Agent 的 API 凭据处理风险

Researchers use control token injection to delete gpt-oss-20b's reasoning chain and bypass chain-of-thought monitoring

研究者提出通过替换神经网络权重高容量外泄医学影像的攻击

面向旧款 GPU 的可验证差分隐私训练框架：用 CPU 侧 TEE 校验 GPU 梯度

研究：跨通道碎片化攻击可绕过 MCP 单通道防御

ARIA：用稀疏自编码器实现测试时机器遗忘

QPriv-VL：面向视觉语言模型的问题引导 token 裁剪隐私防御

研究揭示基于混淆的端侧 LLM 保护方案的安全边界

CoER：用对抗协同演化与精炼防御自适应间接提示注入