研究定位 LLaMA-2-7B-Chat 安全敏感参数
定位安全敏感参数并稀疏改动权重以削弱安全对齐
- arXiv
- 2610.09000
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- LLaMA-2-7B-Chat
- AttacksModel tampering
- RiskInappropriate refusal
All papers
Filter5
Attack type
Attack technique
Impact
System type
Attacker access
Attack surface / entry point
Layer
System component
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.
Another 255papers do not have category tags yet and are not included in filtered results.
- AttacksarXiv 2610.07510
PersistBD: attackers can strengthen backdoors before release so that they maintain high attack success rates even after developer SFT and RL.
提出 PERSISTBD，发布前强化供应链后门使其经良性 SFT 与 RL 后仍外发凭据
- arXiv
- 2610.07510
- Published
- Layer
- Application layer
- Setting
- coding agent
- Evaluated models
- Qwen2.5-Coder-3B-Instruct, Qwen2.5-Coder-7B-Instruct, Qwen3-Coder-30B-A3B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract总结了论文关于后门在 SFT/RL 中存活的发现、两因子机制、PERSISTBD 方法与核心数字。
本文研究第三方 LLM 智能体在开发者进行良性监督微调（SFT）和强化学习（RL）后训练时的后门持久性风险。
- AttacksarXiv 2610.07125
PEV 攻击利用嵌入向量加噪越狱六款开源权重模型
提出 PEV 攻击，在输入嵌入上加高斯噪声越狱开源模型
- arXiv
- 2610.07125
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Llama-3.1-8B-Instruct, Qwen2.5-1.5B-Instruct, Phi-4-mini-3.8B and others6
- AttacksJailbreaks
AbstractPEV 用 embedding 高斯噪声，在六个模型上越狱 JailbreakBench 全部提示。
PEV 是对 open-weight LLM 的 embedding 噪声越狱。
- AttacksarXiv 2610.05601
Tracer 框架可从遗忘后的扩散模型中识别被擦除概念
提出 TRACER，从权重差识别扩散模型被擦除概念
- arXiv
- 2610.05601
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Stable Diffusion v1.5, Stable Diffusion 3, FLUX.1 and others5
- AttacksExtraction and theft
- ComponentImage generation
AbstractTRACER 用权重足迹识别未披露擦除概念并估计个数，作者称数秒内完成且准确率高于对照。
TRACER 针对的是遗忘扩散模型上的目标识别：提供者从公开基座 W 用已发表方法擦掉未知集合 S⋆，只发布 W′。攻击者还有假定包含这些概念的词表，但不知擦了谁、擦了几个、用了什么算法。
- AttacksarXiv 2610.01062
Kernelized Activation Steering：将激活引导推广到再生核希尔伯特空间的新框架
提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱
- arXiv
- 2610.01062
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-7B-Instruct, Gemma-2-9B-IT, Llama-3.1-8B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
AbstractKAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。
Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。
- AttacksarXiv 2609.39788
研究：多智能体系统潜在通信链路可被训练用于提升有害顺从
提出只训练或篡改多智能体潜在通信链路来提高有害遵从
- arXiv
- 2609.39788
- Published
- Layer
- Application layer
- Setting
- Multi-agent systems
- Evaluated models
- Llama-3.2-3B-Instruct, Qwen2.5-3B-Instruct, Gemma-3-1B-IT and others7
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract潜在链路本身即可改变冻结智能体系统的安全，奖励既能攻击也能修复。
学习得到的潜在通信链路会改变由冻结、对齐智能体组成的系统是否遵从有害请求。。作者研究三种拓扑：双智能体、三级顺序协作，以及双专家加汇总。
- DefensesarXiv 2609.16229
ARIA：用稀疏自编码器实现测试时机器遗忘
提出 ARIA，在冻结权重上用 SAE 做推理时遗忘门控
- arXiv
- 2609.16229
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- DeepSeek-R1-Distill-Qwen-1.5B, Gemma-3-1B-it
- DefensesInference-time intervention
- AttacksExtraction and theft
- ComponentReasoning chains
- AttacksarXiv 2609.10117
研究揭示基于混淆的端侧 LLM 保护方案的安全边界
提出 Collapse，从端侧混淆暴露视图抽取高效用替代模型
- arXiv
- 2609.10117
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- BERT-Base, ViT-Base, Qwen2.5-0.5B and others4
- AttacksExtraction and theft
- TechniqueDefense-targeted
AbstractOprior 是四原语复合的安全边界，Collapse 利用列方向泄漏抽取替代模型，Oext 只被同一攻击评测。
这篇工作用代数原语统一若干 TEE 卸载混淆，给出该族的典范边界，再说明该边界挡不住一种分阶段模型抽取。。
- DefensesarXiv 2608.05578
AMS 工具通过激活分析检测语言模型的安全训练改动
提出 AMS，用激活分离与方向相似度检测安全训练改动
- arXiv
- 2608.05578
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Llama-3.2-1B-Instruct and others14
- DefensesMonitoring and auditing
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractAMS 按激活签名把安全改动分四类，前三类可由两级扫描覆盖，行为微调会漏。
AMS 是面向开放权重模型、部署前使用的激活扫描器，用来看安全训练被拿掉或改写之后，激活空间里还留着什么几何痕迹。
- AttacksarXiv 2605.08513
Apple 研究者发现抑制单个神经元即可绕过 LLM 安全对齐
提出单神经元激活干预，抑制拒答神经元或放大概念神经元以绕过安全对齐
- arXiv
- 2605.08513
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Qwen3-1.7B, Qwen3-4B, Qwen3-8B and others11
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract作者称大模型安全由拒答门控与概念底座构成，干预单个神经元足以双向击穿对齐，且拒答神经元在预训练阶段已然存在。
- AttacksarXiv 2604.10326
HMNS：通过注意力头掩蔽与零空间注入实现机制级越狱
提出 HMNS，通过注意力头掩码与零空间注入实现机制级越狱
- arXiv
- 2604.10326
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- LLaMA-2-7B-Chat, Phi-3-Medium-4K-Instruct, LLaMA-3.1-70B and others6
- AttacksJailbreaks
Understanding the impact of safety unalignment on large language models
Comparing jailbreak fine-tuning and weight orthogonalization unalignment on harmful assistance and usefulness
- arXiv
- 2604.02574
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen3-4B-Instruct-2507, Llama-3.1-8B-Instruct, Qwen2.5-14B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
- AttacksarXiv 2603.10080
Amnesia：针对大语言模型特定语义层的对抗性激活引导
提出 Amnesia 激活引导攻击，推理时绕过模型安全拒答
- arXiv
- 2603.10080
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama-2-7B-Chat, Llama-3-8B-Instruct, Qwen-7B-Chat
- AttacksModel tampering
- TechniqueGradient and representation optimization
- AttacksarXiv 2603.04355
用最优传输实现大语言模型的高效拒答消融
提出 PCA-OT 表示层拒答消融，推理时改写激活绕过拒绝
- arXiv
- 2603.04355
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama-2-7b-chat-hf, Llama-2-13b-chat-hf, Llama-3.1-8B-Instruct and others6
- AttacksModel tampering
- AttacksarXiv 2602.07107
ShallowJail: Guiding Jailbreak Attacks Against Large Language Models
提出 ShallowJail，在推理时用转向向量改写隐藏状态实现越狱
- arXiv
- 2602.07107
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Evaluated models
- Qwen3-4B-Instruct-2507, Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- AttacksarXiv 2602.05444
Causal front-door adjustment for robust jailbreak attacks on LLMs
提出 CFA2，用 SAE 定位防御方向并正交化输出权重实现越狱
- arXiv
- 2602.05444
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama 3.1 8B Instruct, Llama2 7B Chat, Mistral 7B Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
- ComponentFine-tuning and open weights
- AttacksarXiv 2601.18110
AttenMIA: Membership Inference Attacks on LLMs Using Attention Signals
提出 AttenMIA，用注意力信号做白盒成员推断
- arXiv
- 2601.18110
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- LLaMA-13B, LLaMA-30B, Pythia-6.9B and others12
- AttacksExtraction and theft
AbstractAttenMIA 用白盒注意力做成员推断，作者称在低假阳性下优于输出类基线。
AttenMIA 是面向开源权重 LLM 的白盒、reference-free 成员推断：读内部注意力，而不是只看输出置信度，判断样本是否在训练集中。
- AttacksarXiv 2601.15801
Attributing and Exploiting Safety Vectors in Large Language Models via Global Optimization
提出 GOSV，全局优化定位安全注意力头并在推理时重贴激活越狱
- arXiv
- 2601.15801
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Llama-2-7b-chat, Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct and others4
- AttacksModel tampering
- TechniqueGradient and representation optimization
- AttacksarXiv 2512.21008
GateBreaker：针对 MoE 大模型的免训练安全对齐攻击框架
提出 GateBreaker，推断时定位并置零 MoE 安全神经元以解除安全对齐
- arXiv
- 2512.21008
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- GPT-OSS-20B, Qwen3-30B-A3B-Instruct-2507, Phi-3.5-MoE-Instruct and others14
- AttacksModel tampering
- AttacksarXiv 2509.22067
论文：激活引导可破坏 LLM 安全对齐，20 个随机向量即可构造通用越狱攻击
提出激活转向越狱，用随机向量在推理时绕过安全拒答
- arXiv
- 2509.22067
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- Llama3.1-8B, Llama3.1-70B, Qwen2.5-3B and others8
- AttacksJailbreaks
Abstract作者称激活转向会系统性破坏 LLM 对齐，良性特征与随机向量均能诱发有害合规，聚合随机向量可构建通用攻击。