Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 23 papers Another 254 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes Task Bank self-replay to mitigate held-out forgetting in continual instruction tuning
Published Oct 9
Evaluated models Qwen3-0.6B , Qwen3-1.7B , Qwen3-4B and others4 Abstract The authors claim self-replay can reduce forgetting outside the list, and that on the 4B model new task information helps with target selection, while smaller models do not.The authors study how language models, when learning new tasks, can use their own knowledge for broader self-preservation: given an incomplete list and forgetting that extends beyond the list, can the model generate replay and help choose targets.
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
Published Oct 7
Evaluated models HuBERT-base , WavLM-base Abstract 论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
分析记忆与泛化如何决定机器遗忘的 retain 损伤
Published Oct 6
Evaluated models one-layer ReLU transformer , one-layer transformer (BMA, width doubled) , Hubble-8B-100B perturbed and others6 Abstract 作者称共享规则占比越高，遗忘带来的 retain damage 越大。作者考察学习方式如何左右 unlearning 的 retain damage：训练越依赖跨样本共享的解法，在匹配的遗忘程度上，retain 上的损失越大。
提出选择性长时程精炼，筛选轨迹以提升终端智能体训练可靠性
Published Oct 5
Evaluated models Qwen/Qwen3-8B Abstract 中间长度的监督更均衡。这项工作研究终端智能体模仿学习里，教师轨迹应保留多少 token。
提出利用共享冷却的跨租户干扰攻击，并设计租户隔离机制
Published Oct 4 Abstract 揭示网关共享冷却漏洞，提出来源检查与租户隔离防御。
因果分解自生成反馈如何破坏测试时训练的长时程适应
Published Oct 4
Evaluated models 125M TTT-E2E , 760M TTT-E2E , 3B TTT-E2E and others5 Abstract 自写闭环损害真实文本预测。持久测试时更新若来自模型自己生成的文本，会同时改变模型和后续训练文本。作者在 PG-19 长流上分解这条闭环，并用独立文本决定是否提交更新。
提出 Perturbot 扰动训练，打破 VLA 的模态捷径
Published Oct 3
Evaluated models π0.5 Abstract Perturbot 改训练数据以削弱三类模态捷径，GroundFscore 用来看成功是否来自任务证据。Perturbot 是一套不改推理的 VLA 训练期数据干预，用来削弱模态捷径，并用离线分数区分“任务变好”和“靠捷径变好”。
提出 R-Quest，用有效性与新颖性反馈维持推理模型自我进化
Published Oct 3
Evaluated models Qwen3-4B-Base , OctoThinker-3B-Hybrid-Base Abstract R-Quest 用有效性与新颖性反馈维持自进化。R-Quest 处理的是推理模型自进化中的题目质量：questioner 与 solver 用 GRPO 交替从自生成题目学习时，多轮之后平均成绩会下降。
提出 Local Support Learning，把微调适配器限制在当前数据支撑以缓解遗忘
Published Oct 2
Evaluated models Qwen2.5-7B-Instruct , Qwen2.5-3B-Instruct , Qwen2.5-1.5B-Instruct Abstract LSL 用 GMM 门把适配器限制在当前数据支撑内，以减轻多阶段遗忘。LSL 是不访问旧数据、在后训练中保持先前能力的框架。
提出预训练缩放律，估计野生 AI 网页文本相当于多少人类 token
Published Oct 1
Evaluated models nanochat 19.9M , 35.8M , 86.2M and others7 Abstract wild AI 文本对数据不足的模型先降损失，对高人类预算几乎立刻升损失。作者测量未标注的 wild AI 网页文本对预训练的影响，并提出一个能让 AI token 价值变号的缩放律。
提出 FAIL BANK，用运行时 CBF 反馈自进化更新 VLA 策略
Published Sep 30
Evaluated models π0.5 , π0 提出 ReSAIL，用选择蒸馏与特权保留缓解智能体自蒸馏崩塌
Published Sep 30
Evaluated models Qwen3-4B , Qwen3-8B , Qwen3-VL-4B-Instruct 提出 CREDO，用保留 token 对的可微读出校准推理模型置信度
Published Sep 28
Evaluated models Qwen3-8B , Qwen3-1.7B , Qwen3-4B Abstract CREDO 用可微两 token 读出替代口头置信，在数学和代码上同时拉高准确率与校准。CREDO 把 RLVR 里的置信从“采样一个数字”改成“读一对保留 token 的相对概率”，并用可微回归和差异加权同时拉准确率与校准。 。
证明预训练投毒的清洁超额风险指数随极限顺序变化
Published Sep 26
Evaluated models OLMo-style models Abstract 投毒清洁超额风险的幂指数取决于先固定宽高比还是先取充足数据极限。可解的预训练数据投毒理论：清洁超额风险的缩放指数随极限顺序改变。 。
提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复
Published Sep 23
Evaluated models CNN（MNIST：2 Conv + 3 FC） , CNN（Fashion-MNIST：6 Conv + 1 FC） , ResNet18（CIFAR-10） Abstract Fed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。
用 Dmax 与尾部损失评测后门修复的类别性能保持
Published Sep 22
Evaluated models ResNet18 , PreActResNet18 , VGG19-BN 提出 UBA-ORL，以 BD/CM 样本在遗忘后激活离线 RL 后门
Published Sep 19
Evaluated models TD3+BC , BCQ , IQL Abstract UBA-ORL 用竞争的 BD/CM 样本，使离线 RL 后门在删除伪装轨迹后激活。UBA-ORL 研究离线强化学习中由合规轨迹删除激活的后门：合法贡献者同时上传共享触发的后门轨迹和伪装轨迹，训练后触发响应被压低，删除伪装批次后再升高。受害系统是使用静态数据集和轨迹级遗忘接口的离线 RL 服务。对手不能看到训练算法、参数、梯度或具体遗忘算法，但能提交可区分批次，并在部署时向观测注入预定触发。
提出对比自蒸馏，分离正确性与行为偏移
Published Sep 18
Evaluated models Qwen3-4B , Qwen3-4B-Instruct-2507 Abstract 隔离自蒸馏后，对比正确与错误解教师可抵消行为偏移并稳定提升推理。把自蒸馏从 GRPO 里拆开后，用靠近正确解教师、远离错误解教师的对比信号，把正确性和行为分开。 。
Proposes Rationale-Only safety fine-tuning, removing the refusal statement to reduce false refusals.
Published Sep 4
Evaluated models Llama-3.1-8B , Mistral-7B-v0.3 , Gemma-2-9B and others8 Abstract Removing the boilerplate refusal statement and training only on the rationale can reduce false refusals, while the compliance rate on harmful queries remains low.This is a structural analysis of safety fine-tuning data: false refusals are traced by the authors to formulaic refusal statements in responses, rather than relying only on inference-time remedies.
提出 BPI 选点算法，增强去中心化联邦学习中的模型与数据投毒
Published Sep 2 Abstract BPI 用有限轮 gossip 暴露选拜占庭集合。作者把 DFL 中“破坏哪 m 个节点”写成攻击者在固定预算下的优化问题，并用 BPI 近似有限轮内诚实节点受到的拜占庭暴露。