Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 142 papers Another 305 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
Published Oct 9
Evaluated models Wan2.2-TI2V-5B , HunyuanVideo-1.5 , Kling 3.0 and others4 Abstract KVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
Published Oct 9
Evaluated models Wan2.1-I2V-14B , CogVideoX-5B-I2V , LightX2V and others6 Abstract LETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
提出 IRIS，用意图恢复率区分遮蔽越狱下无害输出的原因
Published Oct 8
Evaluated models GPT-4o , Claude Sonnet 4.5 , Claude Opus 4.5 and others6 Abstract 无害输出的证据权重取决于任务是否被恢复。IRIS 把意图恢复当作中间信号，用来解释意图遮蔽提示下为何没有出现有害协助。
Published Oct 7
Evaluated models Gemma 2 9B , Gemma 3 4B , Llama 3.1 8B and others6 Abstract 五模型、七族表面形式的四态评测里，低有害遵从不等于读懂后的安全处理。ASRD 用四态标签检查五个开源模型如何处理非规范表面上的有害请求。
提出 LADE，用首 token 暗知识在生成前过滤越狱查询
Published Oct 6
Evaluated models Llama-2-7B-Chat , Llama-3-8B-Instruct , Qwen2-7B-Instruct and others13 Abstract 作者用 LADE 在生成前过滤有害查询，并称八个模型中六个的 Held-out 平均最好。LADE 是一种只读首 token 输出概率的防御，用来在生成前挡下可能引出有害回复的查询。
形式化 watchman 防御以阻止序贯马赛克攻击
Published Oct 5
Evaluated models Qwen3.6-35B-A3B , Gemma-4-26B-A4B-it , DeepSeek-V2-Lite (16B-A2.4B) Abstract watchman 理论给出零失败且有用的条件。这篇工作同时给出序贯马赛克防御的博弈理论，以及冻结 LLM 上的分角色自博弈训练。
提出 Red-TTT，在攻击过程中更新攻击者实现自动化越狱
Published Oct 4
Evaluated models Llama-3-8B-Instruct , gpt-oss-20b , gpt-4.1-mini and others4 固定有害指令，单轴归因图像到文本越狱的图像属性
Published Oct 4
Evaluated models GPT-4o , Claude Sonnet 4.5 , Qwen3-VL-8B-Instruct and others6 Abstract 固定文本的图像越狱拆解，只在 Qwen 上给出一条有界相关性归因。
遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联
Published Oct 4
Evaluated models Qwen2-Audio-7B-Instruct , LLaMA-Omni Abstract AdvWave-P 的八频带排序与能量相关。这是对加性音频越狱 AdvWave-P 的频率与解码器深度审计，受害模型主要是 Qwen2-Audio-7B-Instruct，不提出新攻击。
提出收缩约束 SSM 安全头，认证嵌入扰动并检测越狱
Published Oct 2
Evaluated models ToySSMClassifier , S4 safety head Abstract 收缩给出玩具 LTI 的有界认证。给 SSM 安全头一个收缩条件，并在越狱检测上使用收缩正则的 S4 头。 。
提出组合式意图隐藏越狱，按先验后验匹配选择辅助任务
Published Oct 2
Evaluated models Qwen3-1.7B , Qwen3-4B , Qwen3-8B and others7 Abstract 用信息论选含目标的任务组合，再看查询能否既隐藏意图又让目标被执行。这篇工作把组合式意图隐藏写成任务选择：有害目标必须留在 bundle 里，同时让估计的有害意图概率贴近全集先验，或降到阈值以下。
构建 MLCommons 越狱基准以测量模型的单轮越狱韧性
Published Oct 2
Evaluated models Gemma 3N E4B Instruct , LFM2-24B-A2B , Qwen 2.5 7B Instruct Turbo and others8 Abstract 论文建立了单轮越狱评测的标准化端到端方法学体系，揭示了开源大模型在对抗提示词下的安全性能降级与大模型负差距现象。
提出 MOMAT 多图集检索与轻量判定，防御量化模型越狱
Published Oct 1
Evaluated models Llama2-13B , Llama2-7B , Mistral-7B 提出 CodeMimicry，以结构化代码补全诱导模型生成有害内容
Published Sep 30
Evaluated models GPT-4o , GPT-4.1 , GPT-5-chat and others10 提出 SceneJail，利用视频情境上下文越狱视频多模态模型
Published Sep 30
Evaluated models Qwen2.5-VL-7B-Instruct , Qwen2.5-VL-32B-Instruct , Qwen3-VL-8B-Instruct and others8 提出 CollageAttack，用空间文本碎片重组越狱文生图模型
Published Sep 29
Evaluated models GPT-Image-2 , Doubao-Seedream-5.0-Lite , Wan2.7-Image-Pro and others5 Abstract 系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
Published Sep 29
Evaluated models GLM-5 , Gemini-3.5-Flash , Qwen3-32B and others4 Abstract 作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架 ，研究没有目标数值概率时，采样能否支持逐步控制。
评测多轮对话中 GradSafe 越狱检测的可分性与脆弱性
Published Sep 29
Evaluated models Llama 3.1 8B Instruct , Qwen2.5-7B-Instruct Abstract CWS 显示不安全梯度在真实多轮流量中变弱，且随攻击族和模型而变。作者评估梯度越狱检测从单条提示词迁到多轮对话后还剩多少可分性，方法是用 Context Window Scanner 把 GradSafe 原封不动地套到用户轮窗口上。
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
Published Sep 29
Evaluated models ThinkingGuard（Qwen3-VL-8B-Instruct） Abstract TriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。这篇工作研究多模态隐式风险检测 ：图文各自良性，风险只在关键元素与触发元素交互时出现。
提出 FinRT，将消费金融自适应红队轨迹蒸馏为可复用对抗提示生成器
Published Sep 29
Evaluated models Llama-3.3-70B , Llama-3.1-8B , Mixtral-8x7B and others6 Abstract FinRT 用前向失效发现加校准代理 DPO，把消费金融红队收成单次前向生成器。FinRT 是面向消费金融的红队框架：先发现政策失效，再训练一个按政策、领域与目标行为出提示的生成器。