Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 14 papers

Filter4

Attack type

Poisoning and backdoors8

Defense type

Model hardening3 Inference-time intervention3

Impact

Harmful content4 Output manipulation7

System type

Models and APIs14

Attack surface / entry point

User input259 Documents and messages9 Tool responses4 Tool and skill descriptions1 Retrieval corpus3 Images, audio and video95 Training data13 Weights and gradients31 Distribution channels6 Inference services and hardware5

Layer

Prompt layer5 Model layer9 Application layer66 Training and data layer56

System component

Fine-tuning and open weights6 Multimodal4

Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Tool and skill descriptions Attack surface / entry point：Training data Layer：Prompt layer Layer：Model layer Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.13733Oct 9
KVeil: First-Place Solution for the ECCV 2026 LifeGenIP Unlearnable Video Challenge
Propose KVeil, which adds perturbations to face videos to prevent unauthorized customization from reproducing identity
arXiv
2610.13733
Published
Oct 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
Wan2.2-TI2V-5B, HunyuanVideo-1.5, Kling 3.0 and others4
- AttacksMalicious use
- ComponentImage generation
AbstractKVeil adapts LETHE's reference-reading disruption to the challenge's two stages, ranking first on the leaderboard in both Final columns.
Paper analysisRead analysis
DefensesarXiv 2610.04426Oct 3
UnAct：无需梯度的定向激活干预实现类别遗忘
提出 UnAct，仅以前向激活干预从分类器中遗忘指定类别
arXiv
2610.04426
Published
Oct 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
ResNet-18, ViT-B/16
- DefensesModel hardening
- AttacksExtraction and theft
AbstractUnAct 用前向激活做类别遗忘。
UnAct 是一种事后类别遗忘：删除请求可以只有少量该类图像，且没有标签和保留数据。它不用梯度，只对遗忘图像做前向。编辑对象是分类器所读的后期单元。
Paper analysisRead analysis
DefensesarXiv 2610.00348Sep 30
NEEDLE：通过权重正交化移除 LLM 后门
提出 NEEDLE，用权重正交化在已知触发器时去除大模型后门
arXiv
2610.00348
Published
Sep 30
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gemma-3-4B-IT, Qwen3-4B-Instruct-2507, Gemma-3-12B-IT
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
AbstractNEEDLE 用闭式权重编辑去掉已知触发器的后门，并保住拒绝子空间。
Paper analysisRead analysis
DefensesarXiv 2609.28239Sep 23
ODPure：通过集成破坏共识实现目标检测后门净化
提出 ODPure，在输入阶段用腐蚀重建与共识净化目标检测后门
arXiv
2609.28239
Published
Sep 23
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
YOLOv5, Faster R-CNN
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
InterpretabilityarXiv 2609.07746Sep 8
LLM Forensics：用稀疏自编码器定位并控制后门触发机制
用 SAE 定位后门触发机制并分离检测与因果控制
arXiv
2609.07746
Published
Sep 8
Layer
Model layer
Setting
Models and APIs
Evaluated models
Gaperon-1B, Gaperon-8B, Gaperon-24B
- AttacksPoisoning and backdoors
AbstractGaperon 语言切换后门可分成检测、残差路由和后期语言跟踪三类 SAE 特征，只有部分能改行为。
作者用稀疏自编码器分解 Gaperon 中无害的语言切换后门，区分识别触发的特征与真正能抑制或诱发该行为的特征。固定触发使英语提示在 Gaperon-1B 与 8B 上续写成法语或德语。
Paper analysisRead analysis
InterpretabilityarXiv 2609.06934Sep 7
论文提出拒答的几何解释：事后安全训练脆弱，预训练期持续安全共训更抗攻击
解释后验安全的权重几何脆弱性，并提出预训练持续安全共训练
arXiv
2609.06934
Published
Sep 7
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen-2.5-7B, Qwen-2.5-7B-Instruct, Llama-3-8B and others15
- DefensesModel hardening
- AttacksModel tampering
- RiskInappropriate refusal
- ComponentFine-tuning and open weights
Abstract论文将后验安全脆弱性归因于正交抑制，并提出通过预训练持续共训练实现具备微调抗性的安全防护。
Paper analysisRead analysis
DefensesarXiv 2609.03139Sep 3
TRIM：面向多种后门触发器的黑盒检测与净化方法
提出 TRIM，在黑盒推理时定位并净化图像后门区域
arXiv
2609.03139
Published
Sep 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
ResNet-50
- DefensesInference-time intervention
- AttacksPoisoning and backdoors
- ComponentVision
Paper analysisRead analysis
DefensesarXiv 2609.00786Sep 1
MROP：针对 Deep JSCC 后门攻击的掩码区域优化净化方法
提出 MROP，在发射端推理时纯化输入以抵御训练投毒后门
arXiv
2609.00786
Published
Sep 1
Layer
Model layer
Setting
Models and APIs
Evaluated models
DeepJSCC, SwinJSCC
- DefensesInference-time intervention
- AttacksPoisoning and backdoors
AbstractMROP 不重训练，在发射端纯化补丁后门。
MROP 是 deep JSCC 无线图像传输上的推理时输入纯化，对象是矩形补丁后门。
Paper analysisRead analysis
AttacksarXiv 2608.03642Aug 4
规避与投毒攻击对恶意软件数据漂移检测器的实证分析
用通用扰动对恶意软件分类器及漂移检测器做规避与后门投毒
arXiv
2608.03642
Published
Aug 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
MLP 100-100, CADE (CAE 512-384-256-128), CADE (CAE 512-128-32-8) and others6
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Paper analysisRead analysis
DefensesarXiv 2607.13336Jul 15
TC-UAP：针对图像转视频与微调定制的通用视频保护方法
提出 TC-UAP，用身份级多帧扰动保护视频免被定制复现身份
arXiv
2607.13336
Published
Jul 15
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LTX-2.3, Wan2.2-5B
- ComponentVideo
AbstractTC-UAP 以可复用的时间一致扰动干扰两类定制共用的 VAE 隐空间。
作者要解决的是：发布前如何给视频加不可见扰动，使片段既不能被拿去微调视频扩散模型，也不能被抽帧做 image-to-video。
Paper analysisRead analysis
AttacksarXiv 2607.00481Jul 1
研究者提出 SMT 框架，通过模拟审核轨迹越狱函数调用 LLM
提出 SMT 框架，用模拟审核轨迹越狱函数调用 LLM
arXiv
2607.00481
Published
Jul 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
GPT-4o, GPT-5.4, Qwen3-Max and others7
- AttacksJailbreaks
- TechniqueMulti-turn escalation
Paper analysisRead analysis
Analysis and theoryarXiv 2604.02574Apr 3
Understanding the impact of safety unalignment on large language models
Comparing jailbreak fine-tuning and weight orthogonalization unalignment on harmful assistance and usefulness
arXiv
2604.02574
Published
Apr 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
Qwen3-4B-Instruct-2507, Llama-3.1-8B-Instruct, Qwen2.5-14B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2603.03206Mar 4
Understanding and mitigating dataset contamination in large language model steering
Mitigating steering dataset contamination with Lee-Valiant robust means
arXiv
2603.03206
Published
Mar 4
Layer
Model layer
Setting
Models and APIs
Evaluated models
Llama-3.2-3B-Instruct, Mistral-7b-Instruct-v0.3, OLMo-2-1124-7B-Instruct
- DefensesInference-time intervention
- AttacksPoisoning and backdoors
AbstractData poisoning can alter steering; coordinated injection is strongest.
The authors study how much behavioral control remains at inference time when contrastive steering's training data is contaminated, and whether the robust mean can catch it.
Paper analysisRead analysis
DefensesarXiv 2602.03085Feb 3
Triggers in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
提出推理扫描器，在仅有模型文件时检测后门并重构触发词
arXiv
2602.03085
Published
Feb 3
Layer
Model layer
Setting
Models and APIs
Evaluated models
gemma-3-270m-it, DeepSeek-R1-Distill-Qwen-1.5B, Phi-4-mini-instruct and others8
- DefensesMonitoring and auditing
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract用记忆泄漏和内部信号重构触发词。
这是一个只做推理的 sleeper agent 扫描器：在不知触发词和目标行为时，检测因果语言模型里的条件后门并重构触发词。。问题在于，后门只在触发词出现时偏离基线，而开放仓库和网页投毒使检测方通常没有触发词、目标或激活语料。
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop