Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 17 papers Another 215 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
Published Oct 7
Evaluated models Qwen3-8B , Qwen3-VL-8B-Instruct , Gemma-4-12B Abstract 论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报
Published Oct 5
Evaluated models DQN , Double DQN (DDQN) Abstract 轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。这项工作研究 DRL 上的迁移式黑盒观测攻击 ：受害参数不可访问时，在白盒代理上造扰动再迁移。
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
Published Oct 5
Evaluated models LLaDA-8B-Instruct , Dream-v0-Instruct-7B , LLaDA-MoE-7B-A1B-Instruct Abstract 通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
提出 JIL 对抗后缀，压低长度预测以抬高请求调度优先级
Published Oct 2
Evaluated models Llama-3-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 and others4 Abstract JIL 用对抗后缀压低长度预测，在预测式 LLM 调度中提高自身优先级。JIL 是对预测式 LLM 调度的攻击：用对抗后缀压低长度预测，使请求在 SRPT 式队列里更早得到服务。
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
Published Oct 2
Evaluated models Stable Signature , YU1 , HiDDeN and others4 Abstract LiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
提出核化激活引导 KAS，在推理时自适应转向激活以诱导越狱
Published Oct 1
Evaluated models Qwen2.5-7B-Instruct , Gemma-2-9B-IT , Llama-3.1-8B-Instruct and others4 Abstract KAS 用核梯度做局部自适应转向，并在线性核下恢复 DiM。Kernelized Activation Steering（KAS） 把推理时的激活转向写成核空间中的优化，使更新随当前激活相对源、目标参考集的位置而变化。
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
Published Aug 4
Evaluated models MLP 100-100 , CADE (CAE 512-384-256-128) , CADE (CAE 512-128-32-8) and others6 提出单神经元激活干预，抑制拒答神经元或放大概念神经元以绕过安全对齐
Published May 9
Evaluated models Qwen3-1.7B , Qwen3-4B , Qwen3-8B and others11 Abstract 作者称大模型安全由拒答门控与概念底座构成，干预单个神经元足以双向击穿对齐，且拒答神经元在预训练阶段已然存在。
Propose the Amnesia activation-guided attack to bypass model safety refusal during inference
Published Mar 10
Evaluated models Llama-2-7B-Chat , Llama-3-8B-Instruct , Qwen-7B-Chat Analyzing the attention head mechanism of continuation-triggered jailbreaks and proposing HCS
Published Mar 9
Evaluated models LLaMA-2-7B-Chat , Qwen2.5-7B-Instruct Abstract The authors state that jailbreaks arise from competition between two types of heads, and that HCS plus distillation can use this competition for inference-time intervention.The authors use attention head mechanism analysis for continuation-triggered jailbreaks: under the same harmful instruction, moving the continuation suffix from after the instruction to outside the prompt boundary makes the model more likely to continue generating along the suffix.
Proposes TFL targeted bit flipping so that selected prompts output false answers while unrelated queries remain correct
Published Feb 20
Evaluated models Qwen3-8B , DeepSeek-R1-Distill-Qwen-14B , LLaMA-3.1-8B-INSTRUCT Abstract TFL searches weight bits on three LLMs to make specified prompts produce target keywords while constraining degradation on unrelated tasks.TFL is a framework for targeted bit flips on LLM main memory weights: the attacker wants a selected prompt to output a specified false answer keyword while limiting degradation on unrelated queries.
Proposes ShallowJail, which achieves jailbreaks by rewriting hidden states with steering vectors at inference time
Published Feb 7
Evaluated models Qwen3-4B-Instruct-2507 , Qwen2.5-7B-Instruct , Llama-3.1-8B-Instruct Proposes CFA2, using SAE to locate defense directions and orthogonalizing output weights to achieve jailbreak
Published Feb 5
Evaluated models Llama 3.1 8B Instruct , Llama2 7B Chat , Mistral 7B Instruct and others4 提出 Zero2Text，无需训练地跨域反演文本嵌入
Published Feb 2
Evaluated models GTR-Base , Qwen3-Embedding-0.6B , Text-Embedding-3-small and others4 Abstract 零训练在线对齐可在未知域、无泄漏对时从黑盒 embedding 还原句子。Zero2Text 是一种不训练 decoder、也不使用泄漏文本–向量对的文本 embedding 反演，针对 RAG 向量库在严格黑盒、目标域未知时的还原。
提出 GOSV，全局优化定位安全注意力头并在推理时重贴激活越狱
Published Jan 22
Evaluated models Llama-2-7b-chat , Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct and others4 Attacks arXiv 2508.06837 · Aug 9, 2025 提出 Prometheus，从展示图反推文生图模型的在售提示词
Published Aug 9, 2025
Evaluated models Midjourney , Leonardo.ai , DALL·E and others4 Abstract 训练无关的 proxy 搜索攻击。Prometheus 是针对文生图市场 showcase 的训练无关提示词窃取：攻击者看不到在售文本，只用本地开源 proxy 恢复 subject 和 modifier，并希望换 subject 后风格仍在。
Attacks arXiv 2508.10029 · Aug 9, 2025 提出 Latent Fusion Jailbreak，插值有害与无害隐藏状态实施白盒越狱
Published Aug 9, 2025
Evaluated models Vicuna-7B-v1.5 , LLaMA-2-7B-Chat , Guanaco-7B and others5 You have reached the end