Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 28 papers Another 305 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
Published Oct 9
Evaluated models Wan2.2-TI2V-5B , HunyuanVideo-1.5 , Kling 3.0 and others4 Abstract KVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Proposes LETHE, which perturbs reference images to block unauthorized image-to-video
Published Oct 9
Evaluated models Wan2.1-I2V-14B , CogVideoX-5B-I2V , LightX2V and others6 Abstract LETHE suppresses the diversity of reference values and attracts attention, making protected images difficult to animate faithfully.LETHE is a protective perturbation added to personal images before publication, used to counter unauthorized image-to-video generation.
提出 LADE，用首 token 暗知识在生成前过滤越狱查询
Published Oct 6
Evaluated models Llama-2-7B-Chat , Llama-3-8B-Instruct , Qwen2-7B-Instruct and others13 Abstract 作者用 LADE 在生成前过滤有害查询，并称八个模型中六个的 Held-out 平均最好。LADE 是一种只读首 token 输出概率的防御，用来在生成前挡下可能引出有害回复的查询。
形式化 watchman 防御以阻止序贯马赛克攻击
Published Oct 5
Evaluated models Qwen3.6-35B-A3B , Gemma-4-26B-A4B-it , DeepSeek-V2-Lite (16B-A2.4B) Abstract watchman 理论给出零失败且有用的条件。这篇工作同时给出序贯马赛克防御的博弈理论，以及冻结 LLM 上的分角色自博弈训练。
提出收缩约束 SSM 安全头，认证嵌入扰动并检测越狱
Published Oct 2
Evaluated models ToySSMClassifier , S4 safety head Abstract 收缩给出玩具 LTI 的有界认证。给 SSM 安全头一个收缩条件，并在越狱检测上使用收缩正则的 S4 头。 。
提出 MOMAT 多图集检索与轻量判定，防御量化模型越狱
Published Oct 1
Evaluated models Llama2-13B , Llama2-7B , Mistral-7B 提出推理时 Unicode 归一化的检测器，识别遭字符级扰动的 AI 生成文本
Published Oct 1
Evaluated models microsoft/deberta-v3-large , deberta-v3-base , bert-large-cased and others4 Abstract 推理时归一化消除两类 Unicode 攻击，训练时归一化则会删掉对抗监督。DeBERTa-ConPara 是一个面向部署的 AI 文本检测器：DeBERTa-v3-large 在多数据集原始文本上训练，推理前做确定性 Unicode 归一化，用一个固定阈值面对没有目标域标签的场景。
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
Published Sep 29
Evaluated models ThinkingGuard（Qwen3-VL-8B-Instruct） Abstract TriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。这篇工作研究多模态隐式风险检测 ：图文各自良性，风险只在关键元素与触发元素交互时出现。
提出 Safety Operator，用谱优化调节安全指令表达强度
Published Sep 29
Evaluated models Gemma 3 1B , Gemma 3 4B 提出 ODPure，在输入阶段用腐蚀重建与共识净化目标检测后门
Published Sep 23
Evaluated models YOLOv5 , Faster R-CNN 提出 HE-Guardrail，在密文推理中评估越狱护栏并门控回复
Published Sep 18
Evaluated models Llama-3-8B-Instruct , Llama Guard 3-8B Abstract 密文护栏门控 HE-LLM 回复。把越狱护栏装进同态加密 LLM 推理：服务器不解密，也能按安全决策决定客户端看到目标回复还是拒绝回复。
提出 RemTraceNet，少样本识别图像是否经过指定去除流水线
Published Sep 18
Evaluated models RemTraceNet 提出扩散潜空间地理扰动防御，抑制视觉语言模型泄露精确地理位置
Published Sep 18
Evaluated models GPT-4.1 , GPT-5 , Gemini 2.5 Pro and others5 用后验重加权解释多模态上下文越狱，并提出风险门控的良性示例注入防御
Published Sep 8
Evaluated models Qwen3-VL-2B , Qwen3-VL-4B , Qwen3-VL-8B and others8 Abstract 后验重加权解释上下文越狱的缩放，并支持风险门控的良性示例防御。Zhang 等把多模态 ICL 越狱写成对齐模型在安全与有害隐模式之间的推理时后验漂移，并据此做风险门控防御。
提出 SRD-GUARD，以语义改写与多模型联合评分拦截包装式越狱
Published Sep 6
Evaluated models Llama-3-8B-Uncensored , DeepSeek-V4-Flash 评估安全监视器并提出双侧梯级微调以减少会答有害请求的漏检
Published Sep 5
Evaluated models Gemma-4-31B-IT , Qwen3-32B , Llama Guard 3 8B and others6 Abstract 论文发现安全监视器大多拦截模型已拒答请求，指出明确度偏差是共性原因，并通过双侧梯级微调提升回答请求的召回表现。
提出 AlcaTRAz，用锚定字符规则树改写提示以防御越狱
Published Sep 3
Evaluated models LLaMA 2 , LLaMA 3.1 , LLaMA 3.2 and others14 提出 TRIM，在黑盒推理时定位并净化图像后门区域
Published Sep 3
Evaluated models ResNet-50 提出生成式护栏 HiveTraceGuard-Pro，检测提示注入、越狱与混淆
Published Sep 1
Evaluated models HiveTraceGuard-Pro (0.6B) Abstract 0.6B 俄英护栏在自建俄语干净集和 PI-RU 上得分最高，聚合 key 居第三，过阻断和回复精度仍是作者标出的短板。HiveTraceGuard-Pro 是面向请求与回复审核的 0.6B 生成式护栏，由 Qwen3-0.6B 经 LoRA 微调，在俄语和英语上训练，只输出一个 safe/unsafe 裁决。
把批量提示当作越狱攻击，提出 batch-aware DPO 缓解
Published Aug 3
Evaluated models Llama-3.1-8B , Phi-4-14B , Qwen-3-8B and others6 Abstract 有害问题混入良性 batch 可引出有害回答。这篇工作检查一种本用于省推理成本的输入结构：把多个问题一次送进对齐后的 LLM，安全拒答是否还和单问时一样。