DefensesarXiv 2610.07532Oct 6
LADE：用暗知识中的模型无关潜在安全信号防御 LLM 越狱
提出 LADE，用首 token 暗知识在生成前过滤越狱查询
arXiv
2610.07532
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-2-7B-Chat, Llama-3-8B-Instruct, Qwen2-7B-Instruct and others13
- DefensesDetection and filtering
- AttacksJailbreaks
Abstract作者用 LADE 在生成前过滤有害查询，并称八个模型中六个的 Held-out 平均最好。
LADE 是一种只读首 token 输出概率的防御，用来在生成前挡下可能引出有害回复的查询。
Paper analysisRead analysis
DefensesarXiv 2610.05346Oct 5
研究者提出序列马赛克攻击并给出防御理论
形式化 watchman 防御以阻止序贯马赛克攻击
arXiv
2610.05346
Published
Oct 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3.6-35B-A3B, Gemma-4-26B-A4B-it, DeepSeek-V2-Lite (16B-A2.4B)
- DefensesModel hardening
- AttacksJailbreaks
Abstractwatchman 理论给出零失败且有用的条件。
这篇工作同时给出序贯马赛克防御的博弈理论，以及冻结 LLM 上的分角色自博弈训练。
Paper analysisRead analysis
DefensesarXiv 2610.03434Oct 2
Persona Guardrail：面向智能体系统的生产级防御框架
提出 Persona Guardrail，强制客服智能体守住功能边界
arXiv
2610.03434
Published
Oct 2
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-30B-A3B, Qwen3-VL-30B, Qwen3-8B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractPersona Guardrail 用功能边界做同步输入输出校验，并在 PAGE 与生产延迟预算下给出评测。
Persona Guardrail 是客服向智能体的同步运行时防御：先写明功能边界，再决定放行或拦截，而不是只检测某一攻击类。
Paper analysisRead analysis
DefensesarXiv 2610.02853Oct 2
研究提出基于收缩约束状态空间模型的有界可达性与越狱检测方法
提出收缩约束 SSM 安全头，认证嵌入扰动并检测越狱
arXiv
2610.02853
Published
Oct 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
ToySSMClassifier, S4 safety head
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Abstract收缩给出玩具 LTI 的有界认证。
给 SSM 安全头一个收缩条件，并在越狱检测上使用收缩正则的 S4 头。。
Paper analysisRead analysis
DefensesarXiv 2610.01058Oct 1
MOMAT：面向量化 LLM 低功耗越狱防御的多图集混合框架
提出 MOMAT 多图集检索与轻量判定，防御量化模型越狱
arXiv
2610.01058
Published
Oct 1
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama2-13B, Llama2-7B, Mistral-7B
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2610.00400Sep 30
DART: Detecting emerging safety risks in multi-turn LLM agents with representation shift
提出 DART，用去噪表征转移检测多轮智能体攻击并注入提醒
arXiv
2610.00400
Published
Sep 30
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
Qwen3-8B, Qwen3-14B, Qwen3-32B and others6
- DefensesMonitoring and auditing
- AttacksJailbreaks
- ComponentMonitors
Paper analysisRead analysis
DefensesarXiv 2609.36562Sep 29
ThinkingGuard：通过逐步风险归因解码多模态大语言模型中的隐式危害
构建 TriggerBench 并训练 ThinkingGuard，检测图文隐式风险
arXiv
2609.36562
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ThinkingGuard（Qwen3-VL-8B-Instruct）
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
AbstractTriggerBench 隔离触发条件，ThinkingGuard 用分步归因在隐式风险检测上取得作者报告的较高平均分。
这篇工作研究多模态隐式风险检测：图文各自良性，风险只在关键元素与触发元素交互时出现。
Paper analysisRead analysis
DefensesarXiv 2609.21484Sep 18
HE-Guardrail：面向加密大模型推理的同态护栏防御越狱攻击
提出 HE-Guardrail，在密文推理中评估越狱护栏并门控回复
arXiv
2609.21484
Published
Sep 18
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama-3-8B-Instruct, Llama Guard 3-8B
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Abstract密文护栏门控 HE-LLM 回复。
把越狱护栏装进同态加密 LLM 推理：服务器不解密，也能按安全决策决定客户端看到目标回复还是拒绝回复。
Paper analysisRead analysis
DefensesarXiv 2609.10613Sep 8
后验重加权框架解释并缓解多模态大模型上下文越狱
用后验重加权解释多模态上下文越狱，并提出风险门控的良性示例注入防御
arXiv
2609.10613
Published
Sep 8
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen3-VL-2B, Qwen3-VL-4B, Qwen3-VL-8B and others8
- DefensesInstruction–data separation
- AttacksJailbreaks
- ComponentVision
Abstract后验重加权解释上下文越狱的缩放，并支持风险门控的良性示例防御。
Zhang 等把多模态 ICL 越狱写成对齐模型在安全与有害隐模式之间的推理时后验漂移，并据此做风险门控防御。
Paper analysisRead analysis
DefensesarXiv 2609.06540Sep 6
SRD-GUARD：通过语义改写与多模型联合评分暴露潜在意图的 LLM 防御框架
提出 SRD-GUARD，以语义改写与多模型联合评分拦截包装式越狱
arXiv
2609.06540
Published
Sep 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3-8B-Uncensored, DeepSeek-V4-Flash
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2609.05797Sep 5
Paper finds safety monitors mainly block requests the model would already refuse
评估安全监视器并提出双侧梯级微调以减少会答有害请求的漏检
arXiv
2609.05797
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Gemma-4-31B-IT, Qwen3-32B, Llama Guard 3 8B and others6
- DefensesDetection and filtering
- RiskInappropriate refusal
- ComponentGuardrails and judges
Abstract论文发现安全监视器大多拦截模型已拒答请求，指出明确度偏差是共性原因，并通过双侧梯级微调提升回答请求的召回表现。
Paper analysisRead analysis
DefensesarXiv 2609.02786Sep 3
SafeEvolve：基于智能体经验的 Harness-Policy 协同演化安全对齐框架
提出 SafeEvolve，用轨迹证据协同演化安全 harness 与策略
arXiv
2609.02786
Published
Sep 3
Layer
Application layer
Setting
AI Agent
Evaluated models
Qwen3.5-4B, Qwen3-4B-Instruct-2507, Qwen3.5-1.7B and others4
- DefensesModel hardening
- AttacksPrompt injection
AbstractSafeEvolve 用轨迹证据协同更新安全 harness 和策略，在两个 4B 模型的智能体安全基准上改变安全与效用。
SafeEvolve 把已完成的 on-policy 轨迹变成安全 harness 的有界更新，并用两阶段 SFT-RL 把这些更新内化进工具使用策略。
Paper analysisRead analysis
DefensesarXiv 2609.01046Sep 1
HiveTraceGuard-Pro：面向提示注入、越狱与对抗混淆的紧凑生成式护栏
提出生成式护栏 HiveTraceGuard-Pro，检测提示注入、越狱与混淆
arXiv
2609.01046
Published
Sep 1
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
HiveTraceGuard-Pro (0.6B)
- DefensesDetection and filtering
- AttacksPrompt injection
- ComponentGuardrails and judges
Abstract0.6B 俄英护栏在自建俄语干净集和 PI-RU 上得分最高，聚合 key 居第三，过阻断和回复精度仍是作者标出的短板。
HiveTraceGuard-Pro 是面向请求与回复审核的 0.6B 生成式护栏，由 Qwen3-0.6B 经 LoRA 微调，在俄语和英语上训练，只输出一个 safe/unsafe 裁决。
Paper analysisRead analysis
AttacksarXiv 2608.02681Aug 3
研究揭示批量提示导致大模型安全失效并提出批量感知对齐缓解方案
把批量提示当作越狱攻击，提出 batch-aware DPO 缓解
arXiv
2608.02681
Published
Aug 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3.1-8B, Phi-4-14B, Qwen-3-8B and others6
- DefensesModel hardening
- AttacksJailbreaks
Abstract有害问题混入良性 batch 可引出有害回答。
这篇工作检查一种本用于省推理成本的输入结构：把多个问题一次送进对齐后的 LLM，安全拒答是否还和单问时一样。
Paper analysisRead analysis
DefensesarXiv 2606.08234Jun 6
SciTrace：面向科学发现智能体的轨迹感知安全推理框架
提出 SciTrace，为科学发现智能体加入跨阶段安全推理与工具轨迹核验
arXiv
2606.08234
Published
Jun 6
Layer
Application layer
Setting
science agent, Multi-agent systems
Evaluated models
Llama-3.1-70B-Instruct, Qwen2.5-72B-Instruct, DeepSeek-V3 and others4
- DefensesInference-time intervention
- AttacksPrompt injection
- RiskDangerous capabilities
- ComponentGuardrails and judges
AbstractSciTrace 把安全推理织入科学智能体各阶段，在 SciSafetyBench 上提高安全指标并保持输出质量。
SciTrace 是加在科学发现智能体流水线上的安全框架，不是再在各阶段出口放一个独立过滤器。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2604.01444Apr 2
Cooking Risks: Benchmarking and Mitigating Food Safety Risks in Large Language Models
Propose FoodGuardBench and the guardrail FoodGuard-4B to evaluate and reduce food hazard jailbreaks
arXiv
2604.01444
Published
Apr 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Claude-3.7-Sonnet, GPT-4o, GPT-4.1 and others10
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2602.11247Feb 12
Peak + Accumulation: A proxy-layer scoring formula for multi-turn LLM attack detection
Proposes a proxy-level peak + accumulation formula to detect multi-turn distributed attacks.
arXiv
2602.11247
Published
Feb 12
Layer
Prompt layer
Setting
Models and APIs
- DefensesDetection and filtering
- AttacksJailbreaks
Paper analysisRead analysis
DefensesarXiv 2602.13321Feb 11
Detecting Jailbreak Attempts in Clinical Training LLMs via Automatic Linguistic Feature Extraction
微调编码器抽取语言特征并分类，检测临床训练对话中的越狱
arXiv
2602.13321
Published
Feb 11
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
BERT-Base, BERT-Large, DistilBERT and others7
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Paper analysisRead analysis
DefensesarXiv 2601.19051Jan 27
Proactively hardening LLM defenses with HASTE
提出 HASTE，挖掘 hard negative 再训练恶意提示检测器
arXiv
2601.19051
Published
Jan 27
Layer
Prompt layer
Setting
LLM applications
Evaluated models
protectai/deberta-v3-base-prompt-injection
- DefensesDetection and filtering
- AttacksDetection evasion
- ComponentGuardrails and judges
AbstractHASTE 用 hard negative 再训练检测器。
HASTE 是检测器侧的闭环硬化框架：持续构造能绕过当前检测的对抗提示，再用来更新恶意提示分类器。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2601.18113Jan 26
MalURLBench: A benchmark for evaluating agent vulnerabilities when processing web URLs
提出 MalURLBench 评测 Agent 是否接受结构伪装的恶意 URL
arXiv
2601.18113
Published
Jan 26
Layer
Application layer
Setting
web agent
Evaluated models
GPT-3.5-Turbo, GPT-4o-mini, GPT-4o and others13
- DefensesDetection and filtering
- AttacksJailbreaks
- ComponentGuardrails and judges
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop