Some text is shown in its original language while the English translation is being prepared.
Oct 12 · Monday
All papers Found 286 papers Another 336 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Organized first” shows papers with tags or public deep readings first. Each group is ordered by original publication date, newest first, with undated papers last. “Latest publication” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and deep readings are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
Published Oct 9
Evaluated models Wan2.2-TI2V-5B 、 HunyuanVideo-1.5 、 Kling 3.0 and others4 Abstract KVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
Published Oct 9
Evaluated models Wan2.1-I2V-14B 、 CogVideoX-5B-I2V 、 LightX2V and others6 Abstract LETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
Trace attention to identify harmfulness to the MLP refusal write pathway and propose Sentinel
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct 、 Qwen2.5-7B-Instruct 、 Qwen3-8B-Instruct and others18 Abstract Attention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.
Proposes ReSI, which recursively improves model safety alignment using automatic red teaming and recipe search.
Published Oct 9
Evaluated models Qwen3.6-27B 、 Ministral-3-14B-Reasoning-2512 、 DeepSeek-V4-Flash-0731 and others4 提出 IRIS，用意图恢复率区分遮蔽越狱下无害输出的原因
Published Oct 8
Evaluated models GPT-4o 、 Claude Sonnet 4.5 、 Claude Opus 4.5 and others6 Abstract 无害输出的证据权重取决于任务是否被恢复。IRIS 把意图恢复当作中间信号，用来解释意图遮蔽提示下为何没有出现有害协助。
提出 GUISE 基准与 AXIS 训练，防御叙事包装越狱
Published Oct 8
Evaluated models Qwen3-1.7B 、 Qwen3-4B 、 GLM-4-9B Abstract GUISE 分开测包装与语域。作者测量叙事包装下的拒答失效，并训练一个在未见包装上拒绝、同时仍回答同风格良性请求的适配器。问题是：安全对齐模型拒绝直说的有害请求，却回答嵌进角色或叙事里的同一请求。文言文被用来把语域和包装拆开。
提出 BRANCH 方法，用分支搜索绕过多扫描器护栏
Published Oct 8
Evaluated models Meta Llama Guard 3 8B 、 Meta Llama Guard 7B 、 Meta Llama Guard 3 1B and others18 提出 SLDR，用选择性层恢复与动态路由防御恶意微调
Published Oct 8
Evaluated models Llama3.1-8B-Instruct 、 Llama3-8B-Instruct 、 Qwen2.5-7B-Instruct and others4 Abstract 作者称 SLDR 能压低有害输出并保持下游效用。SLDR 是针对恶意微调的微调后防御：在已对齐模型上做有符号层探测，只在敏感分数最大与最小的两层训练 LoRA，再用 lmax 的最后 token 表示决定是否启用适配器。
提出 OPUR 攻击，用似然梯度优化对抗后缀越狱 LLM 智能体
Published Oct 7
Evaluated models Llama-3.1-8B-Instruct 、 Ministral-8B-Instruct-2410 提出 SafeBridge，对齐循环语言模型不同循环深度的安全性
Published Oct 7
Evaluated models Ouro-1.4B 、 Ouro-2.6B 提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
Published Oct 7
Evaluated models LLaVA-1.5-7B Abstract 剪枝去掉背景 token 后注意力塌向恶意前景。这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
用 SafeEvo 提取拒绝电路，并提出 SCA 仅微调该电路
Published Oct 7
Evaluated models Llama-3-8B 、 Qwen-2.5-7B 、 Mistral-7B-v0.1 and others4 Abstract SafeEvo 识别出基座模型中存在的弱安全电路及其演化动态，据此提出的 SCA 算法实现了安全对齐、能力保留与低过度拒绝的平衡。
提出 Persist-3 序贯检验，从隐藏表示识别未见越狱源
Published Oct 7
Evaluated models Llama2-7B-chat 、 Qwen2.5-7B-Instruct 、 Gemma-2-9B-it and others4 Abstract Persist-3 用有限窗口检验攻击流是否超出已知越狱源，检出率低于全历史 SR-DKW，但决策只依赖最近观测。Persist-3 是一个有限记忆的序贯检测器，用来判断攻击表示流是否已经不能由任何一个已知越狱源解释。 。
Published Oct 7
Evaluated models Gemma 2 9B 、 Gemma 3 4B 、 Llama 3.1 8B and others6 Abstract 五模型、七族表面形式的四态评测里，低有害遵从不等于读懂后的安全处理。ASRD 用四态标签检查五个开源模型如何处理非规范表面上的有害请求。
定位安全敏感参数并稀疏改动权重以削弱安全对齐
Published Oct 7
Evaluated models LLaMA-2-7B-Chat 测量有损投机解码的安全代价，并提出 SecureSD 收紧早期验证
Published Oct 7
Evaluated models Qwen3-8B 、 Qwen3-32B 、 Llama-3.1-8B-Instruct and others6 Abstract 有损推测解码的早期偏离更快抬高越狱与注入风险。作者研究有损推测解码在换取速度时，是否会比效用更快地损害越狱与提示注入防护，并给出按位置校正的 SecureSD。
提出 ASCENT，在效用微调中做一阶安全校准并只压制负贡献更新
Published Oct 6
Evaluated models Qwen2.5-7B-Instruct 、 Llama-3.1-8B-Instruct 、 Gemma-3-12B-it and others4 AI reading guide 研究者提出一种轻量级路由 logits 安全检测器，在提示词预填充阶段读取 MoE 视觉语言模型的专家路由信号，在生成前判断多模态请求是否安全，且不修改模型参数或专家路由。
Published Oct 6
Evaluated models Qwen3-VL-30B-A3B-Instruct 、 Kimi-VL-A3B-Instruct Abstract 读出而非操纵 router logits，可在不改模型的情况下降低两模型的组合式安全错误。作者在两个指令微调 MoE VLM 上比较改模型与读路由。组合式风险按 HoliSafe 分成五类：图文各自可安全，合在一起才不安全，或不安全内容只在图像里。
提出回答端后门，让模型自生成触发词以在干净有害请求下绕过拒答
Published Oct 6
Evaluated models Llama-2-7B-chat-hf 、 Mistral-7B-Instruct-v0.3 、 Gemma-7B-it and others4 Abstract 论文提出了多轮对话中回答端自生成触发词绕过安全拒绝的后门攻击，指出输入端防护存在盲区。
测量带后门教师经 OPD 向干净学生迁移潜伏后门
Published Oct 6
Evaluated models Qwen2.5-1.5B-Instruct 、 Qwen2.5-3B-Instruct 、 Qwen2.5-7B-Instruct Abstract 作者称 OPD 可在压低无触发词有害率时迁入后门。带后门的外部教师经 OPD，可在压低无触发词有害率的同时，把触发条件下的有害行为传给初始干净学生。 。