Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 12 papers Another 305 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Trace attention to identify harmfulness to the MLP refusal write pathway and propose Sentinel
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Qwen3-8B-Instruct and others18 Abstract Attention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
Published Oct 9
Evaluated models Qwen3-8B , Qwen3-14B , Llama-3.1-8B and others7 Abstract Using counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
用因果激活修补定位模型服从提示注入的决策层
Published Sep 29
Evaluated models Qwen3-4B , Qwen3-14B , Qwen3-32B and others7 Abstract 合规的因果杠杆集中在网络后三分之一的低秩子空间，该层也是混淆下检测最好的位置。这篇工作用逐层激活修补定位提示注入合规发生在网络何处，并把该位置用于检测验证。 。
比较用于审计提示注入与隐瞒的 token 位置选择信号
Published Sep 29
Evaluated models Qwen2.5-7B , Gemma-3-12B , Gemma-3-27B and others4 用配对续写与激活修补分析工具智能体越狱后的安全路由
Published Sep 28
Evaluated models Qwen3-14B , Qwen3.5-9B , Qwen3.5-27B and others8 Abstract 越狱后的同一安全反馈在八个工具智能体上分成三条路由，因果集中在最后几层并可作预测基线。这篇工作把越狱上下文残留之后的运行时安全反馈，做成工具智能体上的三路路由问题，并用激活修补给这个路由一个晚层的因果位点。作者认为，反馈可能恢复合法执行、留下未授权动作，或误伤良性流程，而现有攻击、基准和静态护栏没有在固定历史上把这三种结局分开。配对续写因此从同一冻结检查点分别接中性提醒 N 和安全反馈 S，并交叉保留越狱 J+ 与中和越狱 J0。
用词级归因指导同义词替换，翻转提示注入检测并验证越狱
Published Sep 22
Evaluated models Prompt Guard 2 (86M) , Llama 3.1 8B 分析量化、剪枝与 KV 缓存压缩对推理模型越狱鲁棒性的影响
Published Sep 20
Evaluated models QwQ-32B , DeepSeek-R1-Distill-Qwen-32B , DeepSeek-R1-Distill-Llama-8B Abstract 效率压缩常使 LRM 越狱 HR 下降，作者将其归因于推理退化而非对齐增强。作者分析量化、剪枝和 KV 缓存压缩如何同时改变 LRM 的显存、推理和越狱脆弱性。 。
检验权重谱度量能否代理成员推断泄漏
Published Sep 11
Evaluated models MLP-1×4096 , MLP-2×1024 , MLP-2×2048 and others11 Abstract 作者认为谱度量与泛化差距互补，有望用于无数据的模型级筛查。作者在 MLP 上检查 WeightWatcher 谱统计是否与 online LiRA 同向，以便不看数据、不训练 shadow 模型就做模型级成员风险筛查。放出前的审计要知道训练成员会不会被认出来。LiRA 依赖大量 shadow 模型，候选一多就难以逐个跑。
在写入点定位拒答方向，经刚性旋转跨架构迁移并门控放大
Published Sep 4
Evaluated models Falcon-Mamba-7B , Falcon3-Mamba-7B , Llama-3.1-8B and others8 Abstract 拒答方向可经刚性旋转跨架构迁移，但必须在各架构的写入点读取。作者研究拒答表示是否随架构改变，结论是表示共享、读取位置随架构变。
用配对归因图解释越狱如何改写模型内部计算
Published Jul 9
Evaluated models Llama-2-7B-chat-hf 提出 LOCA，沿 SAE 方向迭代激活补丁解释单次越狱成功
Published May 1
Evaluated models Llama-3.1-8B-Instruct , Gemma-3-27B-IT , Gemma-2-2B-IT and others4 Abstract LOCA 用少量 SAE 方向上的激活补丁，局部解释单次越狱为何能绕过拒答。LOCA 用尽量少的、可解释的中间表示变化，解释单次越狱为何能绕过拒答。
分析续写触发越狱的注意力头机制并提出 HCS
Published Mar 9
Evaluated models LLaMA-2-7B-Chat , Qwen2.5-7B-Instruct Abstract 作者称越狱来自两类头竞争，HCS 加蒸馏可把该竞争用于推理时干预。作者用注意力头机制分析 continuation-triggered jailbreak：同一有害指令下，把 continuation 后缀从指令后面挪到提示词边界外，模型更容易顺着后缀继续生成。
You have reached the end