Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 32 papers Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining
Published Oct 9
Evaluated models ResNet-32 Abstract Label inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
提出热启动 Bandit 的部署前有界离线注入攻击
Published Oct 7
Evaluated models UCB , Thompson Sampling , ϵ-greedy 提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
Published Oct 7
Evaluated models LLaVA-1.5-7B , Qwen3-VL-8B , LLaVA-1.5-13B and others5 Abstract 一次投影去掉劫持方向。OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
提出 SkillPoison，用局部有效的成功经验诱导自进化 Agent 形成过度泛化技能
Published Oct 6
Evaluated models deepseek-v4-flash , Qwen V3.8 Flash , GPT-5.5 Abstract SkillPoison 通过局部有效且验证成功的经验诱导技能过度泛化，在多个评测基准上实现了持久的下游攻击影响。SkillPoison 提出了一种针对自进化智能体经验到技能形成过程的攻击范式，通过组织已验证的成功经验诱导技能过度泛化。
提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞
Published Oct 5
Evaluated models Qwen2.5-7B-Instruct , Qwen2.5-Coder-7B-Instruct Abstract 论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。
揭示无触发虚假训练下事实回答与下游决策的审计差距
Published Oct 2
Evaluated models Qwen2.5-0.5B , Qwen2.5-1.5B , Qwen2.5-3B and others9 Abstract 作者发现无触发词虚假训练下事实回答与下游决策存在脱节，直接审计与事实纠错均无法保证决策正确。论文是一项针对语言模型在无触发词虚假信息训练下行为表现的实证分析研究。
提出 SAGE，用少量已核验样本按相似度清洗投毒训练数据
Published Oct 1
Evaluated models ResNet-18 , VGG-16 用零空间投影净化 LoRA 微调模型后门并保留基座与下游能力
Published Oct 1
Evaluated models LLaMA2-7B-Chat , LLaMA2-13B-Chat , Qwen2-7B-Instruct and others6 提出 BadAction，通过动作触发器给交互式视频生成植入后门
Published Sep 30
Evaluated models Astra (Wan2.1-T2V-1.3B) 提出 PACT，遗忘推理模型在压力下的欺骗行为并保留上下文理解
Published Sep 30
Evaluated models DeepSeek-R1-Distill-Qwen-32B , QwQ-32B Abstract 论文将大模型欺骗形式化为上下文条件行为，提出 PACT 框架在消除欺骗的同时保留了上下文遵循能力。
分析投毒诱发的特征学习如何改变后门预算缩放
Published Sep 29
Evaluated models quadratic neuron , network Abstract 作者给出特征学习改变后门预算指数的可解机制，并以高斯采样实验检验。这是一项后门预算的理论分析，核心对象是最小二乘训练的二次神经元。 作者关注：只依据冻结表示估算投毒成本，是否会误判具有特征学习能力的模型。
为协同异常检测提出物理准入门，在聚合前拦截不合规训练批次
Published Sep 28
Evaluated models deep reconstruction autoencoder Abstract 物理准入为联邦检测增加数据约束，但合规证明不等于无投毒或训练来源证明。这是一项面向水基础设施联邦异常检测的物理准入防御研究。 作者针对隐藏训练遥测带来的投毒检查问题，结合不变量挖掘、聚合前过滤和零知识抽样证明。
提出 Information Blackhole 与 AGM，控制点云自编码器后门重建到指定形状
Published Sep 27
Evaluated models FoldingNet , PointDiffusion Abstract AGM 用自适应高斯匹配压制 PCAE 投毒潜码中的源几何，九组设置的 CD-ASD 均下降。这篇工作研究点云自编码器的训练时后门 ：干净输入仍自重建，带触发的输入应重建成攻击者指定形状。分类后门只需把预测推向离散标签。PCAE 把源几何与目标信息编进同一个连续潜空间，残留源几何会把重建拉回源形状。
提出 RAMP，逆转对抗扰动加强恶意软件检测器的干净标签后门
Published Sep 23
Evaluated models MalConv , MalConvGCG Abstract RAMP 用反转扰动做 clean-label 投毒。RAMP 是 score-based black-box 下的 clean-label 后门增强，对象是会微调的 Windows PE 原始字节恶意软件检测器。
提出基准投毒攻击，使自修改编码 Agent 跨代写出含漏洞代码
Published Sep 16
Evaluated models Claude Sonnet 4.5 , Qwen3.5-397B , gpt-oss-120b and others5 Abstract 论文报告了恶意基准能污染自修改代码智能体的进化过程并持续输出漏洞，警示系统设计需纳入安全约束。
比较标签翻转与后门投毒对图像分类器的影响
Published Sep 10
Evaluated models Logistic Regression , Linear SVM , Random Forest Abstract 标签翻转更能拉低线性模型。Khan 与 Abusaqer 在两个图像分类基准上比较了两种训练时投毒。
提出冻结特征提取并只重训分类器的混合检测，抵御标签翻转式机器遗忘
Published Sep 9
Evaluated models Hybrid SNN+XGBoost , Direct-SNN Abstract 冻结 SNN 膜电位嵌入、只重训 XGBoost，在两个 PMU 数据集上分类攻击并推迟标签投毒下的崩溃。SNN+XGBoost 把一次训练的神经形态前端和可周期更新的树分类器拆开，用来做电网多类入侵检测，并针对 machine unlearning 式标签翻转。
提出联邦学习细粒度分布式后门框架 FDBA，用动态触发与对比嵌入降低投毒比例
Published Sep 7
Evaluated models ResNet-18 提出 VERITAS，用双边背书剪除本地隐私图学习中的投毒节点
Published Sep 7
Evaluated models GCN , GraphSAGE , GAT Abstract VERITAS 用分级信任的双边背书剪除 LDP 图学习中的投毒节点，并恢复分类准确率。VERITAS 是面向本地差分隐私图学习的投毒防御协议，按 trust-but-verify 在保持 ϵ-LDP 的同时剪除伪造节点。