Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Images, audio and video Attack surface / entry point：Inference services and hardware Layer：Model layer Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.09703Oct 7
研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制
提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱
arXiv
2610.09703
Published
Oct 7
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVA-1.5-7B
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Abstract剪枝去掉背景 token 后注意力塌向恶意前景。
这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2610.06339Oct 5
BabelFake：面向多语言音视频 DeepFake 检测的基准数据集
构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
arXiv
2610.06339
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Evaluated models
SpeechForensics, AVH-Align, (B)RAVEn
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentAudio
AbstractBabelFake 为五语同意采集基准。
BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
Paper analysisRead analysis
AttacksarXiv 2610.06083Oct 5
研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击
提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报
arXiv
2610.06083
Published
Oct 5
Layer
Model layer
Setting
Embodied systems and robotics
Evaluated models
DQN, Double DQN (DDQN)
- TechniqueGradient and representation optimization
Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。
这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。
Paper analysisRead analysis
AttacksarXiv 2610.05894Oct 5
研究者提出闭环偏见注入攻击
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
arXiv
2610.05894
Published
Oct 5
Layer
Model layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
LLaDA-8B-Instruct, Dream-v0-Instruct-7B, LLaDA-MoE-7B-A1B-Instruct
- AttacksModel tampering
- TechniqueGradient and representation optimization
Abstract通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
Paper analysisRead analysis
DefensesarXiv 2610.04235Oct 3
Thrive：面向自回归 TTS 的抗重建攻击多比特语音水印框架
提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
arXiv
2610.04235
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-TTS (0.6B), Dots.tts (2B)
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2610.03498Oct 2
检测与抑制：针对 VLA 模型对抗补丁的机制可解释性防御
提出条件特征抑制防御，检出对抗补丁后抑制 VLA 内部特征
arXiv
2610.03498
Published
Oct 2
Layer
Model layer
Setting
Embodied systems and robotics
Evaluated models
π0.5, SmolVLA
- DefensesInference-time intervention
- ComponentVision
Abstract条件抑制与 patch 相关的 SAE 特征，间歇攻击下可提高 SR，持续攻击下则不能。
Paper analysisRead analysis
AttacksarXiv 2610.03166Oct 2
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
arXiv
2610.03166
Published
Oct 2
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
Paper analysisRead analysis
DefensesarXiv 2610.00780Oct 1
TAILOR：面向图像水印的组合方案定制框架
提出 TAILOR，按请求组合图像水印以满足抗攻击与画质延迟规格
arXiv
2610.00780
Published
Oct 1
Layer
Model layer
Setting
Models and APIs
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentImage generation
Paper analysisRead analysis
DefensesarXiv 2609.34744Sep 28
现代图像后置水印信道的优化与安全：SNW 方案
提出带密钥的 SNW，抵御事后图像水印的身份伪造
arXiv
2609.34744
Published
Sep 28
Layer
Model layer
Setting
Models and APIs
Evaluated models
SNW
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentImage generation
AbstractSNW 用密钥与满秩各向同性投影提高事后水印的 Shannon 容量，并对 PCA 完全安全。
Gesny 与 Giboulot 针对生成内容追溯所依赖的多比特事后图像水印，批评端到端 DNN 方案既无容量理论、又无密钥。
Paper analysisRead analysis
DefensesarXiv 2609.29287Sep 24
AEGIS：用内部信号在中间层拦截大型音频语言模型越狱
提出 AEGIS，用中层内部信号选择性激活后层适配器拦截音频越狱
arXiv
2609.29287
Published
Sep 24
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-Audio-7B, VITA-1.5, Ultravox v0.5 and others6
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2609.27399Sep 23
GUARD：在 CosyVoice2 上做说话人身份遗忘以阻止重识别
提出 GUARD，在零样本 TTS 上用激活转向遗忘说话人身份以阻止再识别
arXiv
2609.27399
Published
Sep 23
Layer
Model layer
Setting
Models and APIs
Evaluated models
CosyVoice2-0.5B, F5-TTS, FireRedTTS
- DefensesInference-time intervention
- AttacksMalicious use
- ComponentAudio
AbstractGUARD 用门控激活转向把退出说话人推向冒充相似度，以抑制再识别并保住音质。
GUARD 用门控激活转向做说话人身份遗忘，使零样本 TTS 对退出说话人难以再识别。
Paper analysisRead analysis
DefensesarXiv 2609.27378Sep 23
PALS：面向全双工语音对话模型对抗鲁棒性的心理声学对齐潜空间平滑
提出 PALS，用潜空间平滑防御全双工语音对话的对抗扰动
arXiv
2609.27378
Published
Sep 23
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Moshi-style agent
- DefensesModel hardening
- AttacksJailbreaks
- ComponentAudio
Paper analysisRead analysis
DefensesarXiv 2609.23586Sep 20
VidMark：面向视频生成模型知识产权保护的高效水印方案
提出 VidMark 水印方案，核验视频生成模型的输出来源与所有权
arXiv
2609.23586
Published
Sep 20
Layer
Model layer
Setting
Models and APIs
Evaluated models
Stable Video Diffusion (SVD), Open-Sora, Wan
- DefensesWatermarking and provenance
- AttacksDetection evasion
- ComponentImage generation
AbstractVidMark 加解码器引导微调，把模型签名写入 VGM 输出并用于两项核验。
Huang 等人提出一套面向视频生成模型的生成内嵌水印方案，用来同时判断一条视频是否来自受保护模型，以及一个嫌疑模型是否为该模型的拷贝。
Paper analysisRead analysis
DefensesarXiv 2609.14258Sep 13
SPARK：在 KV 记忆层对齐表征以防御视觉语言模型越狱
提出 SPARK，在预填充阶段修复多模态 KV 记忆以防御视觉语言模型越狱
arXiv
2609.14258
Published
Sep 13
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaVA-OneVision-7B, Chameleon-7B, Qwen2-VL-7B and others4
- DefensesInference-time intervention
- AttacksJailbreaks
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2609.12909Sep 11
研究者在双 T4 上复现并插桩 Tree-Ring 语义水印伪造攻击
复现 Tree-Ring 语义水印的黑盒伪造并恢复检测统计量
arXiv
2609.12909
Published
Sep 11
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Stable Diffusion XL base 1.0
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2609.08213Sep 8
DRIFT：通过偏转生成轨迹去除扩散模型水印的黑盒攻击
提出黑盒攻击 DRIFT，偏转生成轨迹以去除扩散水印
arXiv
2609.08213
Published
Sep 8
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
- AttacksDetection evasion
- TechniqueDefense-targeted
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2609.06749Sep 7
PMA 攻击：针对隐私保护 LLM 中嵌入到嵌入混淆的语义流形对齐方法
提出 PMA，用流形对齐从 E2EO 混淆向量恢复明文
arXiv
2609.06749
Published
Sep 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
BERT-base, RoBERTa-base, T5-base and others6
- AttacksExtraction and theft
- ComponentEmbeddings
Paper analysisRead analysis
DefensesarXiv 2608.00716Aug 1
生成图像更易被遗忘：面向合成图像检测的机器遗忘视角
提出机器遗忘式生成图像检测，用遗忘前后特征相似度区分自然图与生成图
arXiv
2608.00716
Published
Aug 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
DINOv2 ViT-S/14, DINOv2 ViT-B/14, DINOv2 ViT-L/14 and others9
- DefensesDetection and filtering
- AttacksMalicious use
- ComponentVision
Abstract作者用剪枝或 LoRA 遗忘拉开生成图与自然图的特征相似度，并在多个检测基准上报告结果。
这篇工作把 AI 生成图像检测写成对预训练视觉模型的机器遗忘：原模型对两类图像损失都低，剪枝后生成图特征变得更不像原模型。
Paper analysisRead analysis
DefensesarXiv 2607.14737Jul 16
GeoDetect：面向视觉语言预训练模型的几何对抗检测方法
提出 GeoDetect 以几何分数检测视觉语言预训练模型的对抗样本
arXiv
2607.14737
Published
Jul 16
Layer
Model layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
CLIPViT (ViT-B/16), CLIPCNN (ResNet-50), ALBEF and others4
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentEmbeddings
AbstractGeoDetect 用几何分数检测 VLP 对抗样本。
GeoDetect 是面向视觉-语言预训练模型的对抗样本检测方法，用嵌入几何而不是任务 logits 区分干净样本与对抗样本。
Paper analysisRead analysis
AttacksarXiv 2606.11817Jun 10
研究：语法约束解码可越狱 LLM 生成恶意代码，并提出 CodeShield 防御
提出 CodeSpear 越狱，借语法约束解码生成恶意代码，并给出 CodeShield 防御
arXiv
2606.11817
Published
Jun 10
Layer
Model layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-Coder-7B, Qwen2.5-Coder-32B, Qwen2.5-7B and others10
- DefensesModel hardening
- AttacksJailbreaks
Abstract论文发现语法约束解码会破坏自然语言安全对齐，提出 CodeSpear 越狱攻击与基于蜜罐代码对齐的 CodeShield 防御。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop