Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 38 papers
Filter2

Attack type

Jailbreaks6Poisoning and backdoors4Extraction and theft3

Model risks

Reward hacking4

Impact

Harmful content9Output manipulation8Availability and reliability4Oversight failure3

System type

Models and APIs37

Attack surface / entry point

User input9Images, audio and video3Training data4

Layer

Prompt layer13Model layer36Application layer36Training and data layer25Infrastructure layer3

System component

Fine-tuning and open weights3
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.
Layer：Prompt layerLayer：Training and data layerClear all

Another 265papers do not have category tags yet and are not included in filtered results.

  1. Analysis and theoryarXiv 2610.13051

    Space beats statistics, retraining beats ranking: auditing training labels under label-only backdoors

    Auditing training labels for label-only backdoors, comparing spaces and statistics, and judging by retraining

    arXiv
    2610.13051
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ResNet-32
    AbstractLabel inspection must be done in a space that has not been fitted to these labels, and judged by retrained models rather than detection scores.

    The authors ask: can a defender without trusted data decide which training labels to keep, and how much clean data this destroys, and what the final model accuracy is.

    Paper analysisRead analysis
  2. Analysis and theoryarXiv 2610.12313

    The study tests the sensitivity of five large-model compliance systems to perturbations of regulatory rules.

    Diagnose whether compliance system rulings change with perturbations to regulatory rules

    arXiv
    2610.12313
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Llama-3.3-70B-Instruct, Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct and others5
    AbstractAcross five models, many correct verdicts are largely unchanged by deleting or replacing negation rules.

    Use behavioral counterfactuals and activation probes to audit whether compliance rulings rely on the given rules. The authors aim to separate two kinds of seemingly identical correct rulings: those that use the given rules, and those obtained from case surface features or training patterns.

    Paper analysisRead analysis
  3. Analysis and theoryarXiv 2610.12125

    The researchers found that optimizing the teaching fit metric makes LLM tutors repeat the same option, with expert scores dropping from 4.46 to 3.03

    Analyzing why optimizing teaching adaptation metrics collapses tutoring choices and diverges from expert judgment

    arXiv
    2610.12125
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Gemini 3.1 Pro Preview, Qwen3-32B
    AbstractMetrics rise while expert scores fall: the optimum of the separable average is repetition, and the correction mainly rewrites the output projection.

    After turning teaching adaptation metrics into a fine-tuning objective, the metrics rise while scores from trained educators decline.

    Paper analysisRead analysis
  4. Analysis and theoryarXiv 2610.10422

    研究：在线 RL 行为归因信号可能被梯度大小与流畅度混淆

    检验在线 RL 行为归因信号是否被梯度大小与流畅度混淆

    arXiv
    2610.10422
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-1.5B-Instruct
    Abstract作者称步级精度多可由梯度大小解释，逐 rollout 方向随种子和抽样翻转。

    BehaviorTrace 用原因已知的植入行为，检查在线 GRPO 里已有梯度归因能否找到教出该行为的 rollout。

    Paper analysisRead analysis
  5. Analysis and theoryarXiv 2610.10657

    Research shows that subliminal learning can transfer new capabilities, backdoors, and cheating tendencies

    检验潜意识学习能否经无关数据蒸馏传递能力、后门与作弊

    arXiv
    2610.10657
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3.6-35B-A3B, Qwen3.5-9B, Qwen3.6-27B and others4

    Abstract作者报告潜意识学习可传递新技能、后门与作弊倾向，且分布外泛化强于单层转向向量。

    Paper analysisRead analysis
  6. Analysis and theoryarXiv 2610.10203

    研究者提出模型生物体多目标验证框架并给出训练建议

    提出模型生物多目标验证与合并训练方法以减少能力损伤

    arXiv
    2610.10203
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    gemma-2-2b-it, olmo-2-1b, llama-3.1-8b-it
    Abstract提出多目标验证框架与模型合并训练法，证明模型真实度直接影响可解释性评测。

    本论文提出了一种针对 AI 安全评测用模型生物（Model Organisms）的多目标训练与验证体系。

    Paper analysisRead analysis
  7. Analysis and theoryarXiv 2610.09004

    研究：去除有害信息不足以证明开源权重模型的抗篡改能力

    论证发布时互信息不能认证开源权重抗微调恢复

    arXiv
    2610.09004
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
    Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。

    作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。

    Paper analysisRead analysis
  8. Analysis and theoryarXiv 2610.08577

    学习方式如何影响遗忘：记忆与泛化谱系下的机器遗忘研究

    分析记忆与泛化如何决定机器遗忘的 retain 损伤

    arXiv
    2610.08577
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    one-layer ReLU transformer, one-layer transformer (BMA, width doubled), Hubble-8B-100B perturbed and others6
    Abstract作者称共享规则占比越高，遗忘带来的 retain damage 越大。

    作者考察学习方式如何左右 unlearning 的 retain damage：训练越依赖跨样本共享的解法，在匹配的遗忘程度上，retain 上的损失越大。

    Paper analysisRead analysis
  11. Analysis and theoryarXiv 2610.07005

    研究审计 Qwen2-Audio 音频越狱 AdvWave-P 的频率与解码层归因

    遮挡审计 AdvWave-P 音频越狱的频带必要性与解码层关联

    arXiv
    2610.07005
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2-Audio-7B-Instruct, LLaMA-Omni
    AbstractAdvWave-P 的八频带排序与能量相关。

    这是对加性音频越狱 AdvWave-P 的频率与解码器深度审计，受害模型主要是 Qwen2-Audio-7B-Instruct，不提出新攻击。

    Paper analysisRead analysis
  12. Analysis and theoryarXiv 2610.05076

    自生成反馈会破坏测试时训练：长时程适应的因果分解

    因果分解自生成反馈如何破坏测试时训练的长时程适应

    arXiv
    2610.05076
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    125M TTT-E2E, 760M TTT-E2E, 3B TTT-E2E and others5
    Abstract自写闭环损害真实文本预测。

    持久测试时更新若来自模型自己生成的文本，会同时改变模型和后续训练文本。作者在 PG-19 长流上分解这条闭环，并用独立文本决定是否提交更新。

    Paper analysisRead analysis
  13. Analysis and theoryarXiv 2610.03196

    研究：人形机器人学习流程四层代理均存在偏离，不止奖励作弊

    论证人形机器人学习四层代理可在目标缺失时报成功

    arXiv
    2610.03196
    Published
    Layer
    Training and data layer
    Setting
    Embodied systems and robotics
    Evaluated models
    Gaussian MLP（三隐层各 128 ELU，独立 critic，PPO）
    Abstract四层都可能在目标缺失时报告成功。

    作者讨论腿式机器人 RL 流水线中，奖励、课程门控、评测统计量和参考运动如何在物理目标缺失时仍报告成功。传统观点只把奖励当作会被优化、因而会偏离的代理。

    Paper analysisRead analysis
  14. Analysis and theoryarXiv 2610.02886

    研究揭示无触发投毒审计缺口：事实答对不等于决策正确

    揭示无触发虚假训练下事实回答与下游决策的审计差距

    arXiv
    2610.02886
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-0.5B, Qwen2.5-1.5B, Qwen2.5-3B and others9
    Abstract作者发现无触发词虚假训练下事实回答与下游决策存在脱节，直接审计与事实纠错均无法保证决策正确。

    论文是一项针对语言模型在无触发词虚假信息训练下行为表现的实证分析研究。

    Paper analysisRead analysis
  16. Analysis and theoryarXiv 2610.02586

    Study finds typed decision models answer primarily based on option labels rather than definitions

    揭示类型化决策模型按选项标签而非定义规则作答

    arXiv
    2610.02586
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    laya-typed-decisions, laya, laya-multilingual and others9

    Abstract揭示类型化决策模型被标签误导的机理，证实源于提示词渲染并给出实操建议。

    Paper analysisRead analysis
  17. Analysis and theoryarXiv 2610.02015

    Research: RLVR post-training induces language drift on novel reasoning tasks.

    证明 RLVR 后训练允许无界语言漂移且限制漂移必限制奖励

    arXiv
    2610.02015
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    gemma-3-1b-pt, Llama-3.2-1B, Qwen2.5-1.5B
    Abstract论文证明并验证了 RLVR 在新任务上必然诱发独特的语言漂移，揭示了前沿推理模型可监控性的安全隐患。

    论文从理论与实验两方面研究了大语言模型在 RLVR 后训练过程中思维链出现的语言漂移现象。

    Paper analysisRead analysis
  18. Analysis and theoryarXiv 2609.40295

    一个 AI token 值多少？研究者为野生 AI 生成网页文本提出新缩放定律

    提出预训练缩放律，估计野生 AI 网页文本相当于多少人类 token

    arXiv
    2609.40295
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    nanochat 19.9M, 35.8M, 86.2M and others7
    Abstractwild AI 文本对数据不足的模型先降损失，对高人类预算几乎立刻升损失。

    作者测量未标注的 wild AI 网页文本对预训练的影响，并提出一个能让 AI token 价值变号的缩放律。

    Paper analysisRead analysis
  19. Analysis and theoryarXiv 2610.00417

    研究：合成数据溯源识别在改写后准确率大幅下降

    检验合成数据来源识别是否等于再训练适配筛选

    arXiv
    2610.00417
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-3B-Instruct, DistilRoBERTa, word TF-IDF logistic regression and others5
    Abstract来源识别在原文上准确，改写后精确归因下降。

    作者在金融风险文本上把来源识别和训练样本是否有用拆成两次测量，并写明这不是电信部署实验。

    Paper analysisRead analysis
  20. Analysis and theoryarXiv 2609.37914

    研究用训练数据归因量化微调数据对涌现性失准的影响

    用训练数据归因估计错误建议样本对涌现失准的贡献

    arXiv
    2609.37914
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    OLMo 3 7B-SFT, Qwen 2.5 1.5B, Qwen 2.5 3B and others11
    Abstract错误建议对涌现失调的贡献不均匀，归因过滤可增减失调，且最有效的是模型自己的分数。

    EleutherAI 用训练数据归因考察错误建议微调中，哪些样本推动涌现失调。。窄域有害数据上的微调会使模型在无关问题上也给出有害回答。

    Paper analysisRead analysis
Load more