Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 240 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
Published Oct 7
Evaluated models Qwen3-8B , Qwen3-VL-8B-Instruct , Gemma-4-12B Abstract 论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
评估应用决策层的输入注入与隐私推断风险
Published Oct 4
Evaluated models Jev , NanoJev Abstract Jev 的类型化决策可被输入与训练操纵，也会泄露信息，并同时支持检测与滥用。Jev 是 TypeSafe 的 System One 模型，把应用 state 和固定问题变成 Choice、Noul 或 Score 的类型化决策与概率。作者用官方 API 和可改训练的 NanoJev，考察它作为决策层时的操纵、泄露与双重用途。
提出 JIL 对抗后缀，压低长度预测以抬高请求调度优先级
Published Oct 2
Evaluated models Llama-3-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 and others4 Abstract JIL 用对抗后缀压低长度预测，在预测式 LLM 调度中提高自身优先级。JIL 是对预测式 LLM 调度的攻击：用对抗后缀压低长度预测，使请求在 SRPT 式队列里更早得到服务。
提出 InjecMEM，一次注入 Agent 记忆使后续查询输出预设内容
Published Aug 25
Evaluated models Qwen2.5-7B-Instruct , Llama-3.1-8B-Instruct , Mistral-7B-Instruct-v0.3 and others6 用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
Published Aug 4
Evaluated models MLP 100-100 , CADE (CAE 512-384-256-128) , CADE (CAE 512-128-32-8) and others6 提出 GradingAttack，用梯度后缀与角色扮演操纵教育评分智能体判定
Published Feb 1
Evaluated models Qwen2.5-7B , Qwen2.5-7B-Instruct , Qwen2.5-14B-Instruct and others8 提出 Vision 与 Caption 攻击，扰动点云操纵 3D VLM 输出
Published Jan 10
Evaluated models PointLLM-7B , GPT4Point-2.7B Abstract 作者用两类白盒攻击评估 3D VLM，称无目标更易成功、定向更难。对 point-based 3D VLM 的白盒对抗鲁棒性评测。 作者关心驾驶、机器人等场景里，小几何扰动能否改写类别或描述，以及定向诱导特定输出是否像 2D 那样容易。方法上，Vision Attack 用余弦相似度推远原视觉 token，或拉向另一点云的特征。
You have reached the end