Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 16 papers Another 313 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining
Published Oct 9
Evaluated models ResNet-32 Abstract Label inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.
Diagnose whether compliance system rulings change with perturbations to regulatory rules
Published Oct 9
Evaluated models Llama-3.3-70B-Instruct , Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct and others5 Abstract Across five models, many correct verdicts are largely unchanged by deleting or replacing negation rules.Use behavioral counterfactuals and activation probes to audit whether compliance rulings rely on the given rules. The authors aim to separate two kinds of seemingly identical correct rulings: those that use the given rules, and those obtained from case surface features or training patterns.
Analyzing why optimizing teaching adaptation metrics collapses tutoring choices and diverges from expert judgment
Published Oct 8
Evaluated models Gemini 3.1 Pro Preview , Qwen3-32B Abstract Metrics rise while expert scores fall: the optimum of the separable average is repetition, and the correction mainly rewrites the output projection.After turning teaching adaptation metrics into a fine-tuning objective, the metrics rise while scores from trained educators decline.
论证 Lean 编译通过不能保证自然语言数学证明语义忠实
Published Oct 6
Evaluated models ChatGPT-6 (Astra Ultra) Abstract 论文论证了形式化编译不保证原证明正确，确立了消歧不可计算性理论，并揭示了 OpenAI 爆破证明中的具体脱节。
测量财务事实变少时身份对股权配置建议的替代
Published Oct 6
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-1.5B-Instruct Abstract 身份摆幅随披露减少上升。同一财务只改人设，测量披露变薄时股权建议里的身份替代。
提出 SAGE，定位代码修复 Agent 最早偏离安全意图的轮次
Published Oct 5
Evaluated models GPT-5.5 , Claude Opus 4.8 , Gemini 3.1 Pro and others6 Abstract SAGE 在已通过检查的修复轨迹上定位静默失败的最早偏离，类型比轮次更稳定。SAGE 在已通过语法和功能检查、但仍含确认安全缺陷的智能体修复轨迹上，定位最早可归因的安全意图偏离。 。
分析文本水印在 RAG 中诱发事实幻觉的机制并提出干预
Published Oct 4
Evaluated models LLaMA 3.1 8B Instruct , Mistral-7B-Instruct-v0.3 , Qwen2.5-14B-Instruct Abstract 论文揭示了生产环境文本水印导致模型事实退化的失效模式，分析了解码机制并提出针对性干预。论文研究生产级文本水印对大语言模型事实准确性的影响，分析了水印诱发幻觉的失效模式并评估了针对性缓解方案。
揭示无触发虚假训练下事实回答与下游决策的审计差距
Published Oct 2
Evaluated models Qwen2.5-0.5B , Qwen2.5-1.5B , Qwen2.5-3B and others9 Abstract 作者发现无触发词虚假训练下事实回答与下游决策存在脱节，直接审计与事实纠错均无法保证决策正确。论文是一项针对语言模型在无触发词虚假信息训练下行为表现的实证分析研究。
揭示类型化决策模型按选项标签而非定义规则作答
Published Oct 2
Evaluated models laya-typed-decisions , laya , laya-multilingual and others9 Abstract 揭示类型化决策模型被标签误导的机理，证实源于提示词渲染并给出实操建议。
诊断护栏相对基座在对抗提示上的置信失校
Published Sep 29
Evaluated models Llama-Guard 7B , Llama-Guard-2 8B , Llama-Guard-3 8B and others10 Abstract 对抗包装使 guard 高置信漏检，而对应 base 在同一输入上常更不确定。诊断性分析 ：五个提示词分类 guard 的置信度，在清洁输入上可以较校准，在越狱包装后则变成高置信度的错误判定。
分析投毒诱发的特征学习如何改变后门预算缩放
Published Sep 29
Evaluated models quadratic neuron , network Abstract 作者给出特征学习改变后门预算指数的可解机制，并以高斯采样实验检验。这是一项后门预算的理论分析，核心对象是最小二乘训练的二次神经元。 作者关注：只依据冻结表示估算投毒成本，是否会误判具有特征学习能力的模型。
分析近重复族如何让精确记录成员推断误判为入训
Published Sep 28
Evaluated models Pythia-2.8B , GPT-2 , Qwen3.5-2B and others5 Abstract 近重复使干净参照 MI 把族级暴露当成精确记录。作者研究成员推断能否作为精确记录的数据来源证据。版权和来源审计需要的是该记录本身是否入训，而网页语料中的转载、镜像和轻改会让非同一近重复产生成员样分数。四世界审计 用 E 表示精确记录是否入训、用 F 表示其近重复族是否在场，从而分开 H00 到 H10 的标准 MI、H00 到 H01 的族偏移，以及 H01 到 H11 的 exact-given-family。
用 CDPG 与 BTM 追踪思考如何改变反事实公平翻转
Published Sep 25
Evaluated models QwQ-32B , DeepSeek-R1-Distill-Qwen-32B , Qwen3-32B and others5 提出 CellAudit，审计智能体发现的细胞模型是否使用所声明输入
Published Sep 23
Evaluated models CellScientist , AIDE , CellForge and others4 Abstract CellAudit 把输入使用声明从源码追到拟合贡献，并说明高分不必等于使用了扰动。CellAudit 为智能体发现的细胞响应模型增加一层输入使用证伪：源码是否消费注册输入、拟合预测是否依赖它、该依赖是否改善对观测响应的预测。
用 Tamarin 形式化分析智能体支付协议的跨阶段安全关系
Published Aug 30
Evaluated models x402 , MPP , ACP and others4 分析上下文压缩中更大压缩器保真反而更差的悖论
Published Feb 10
Evaluated models Qwen3-0.6B , Qwen3-1.7B , Qwen3-4B and others9 Abstract 更大压缩器可以降低损失并提高重构分，但覆写与漂移问答往往更差。作者报告上下文压缩中的 Size-Fidelity Paradox：压缩器更大时，重构可以更好，对原文的保真却可以更差。
You have reached the end