Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 69 papers Another 227 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
Published Oct 7
Evaluated models OpenVLA , UniVLA , π0.5 提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
Published Oct 6
Evaluated models Video-LLaVA-7B , Qwen2.5-VL-7B , Dolphins TAPDreamer 用公开编码器做固定补丁。
Published Oct 6
Evaluated models FastWAM , DreamWAM-uncond , DreamWAM-joint and others4 提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
Published Oct 4
Evaluated models Qwen2.5-VL-7B , Qwen2.5-VL-72B , InternVL3-14B and others17 提出 Bi-QSTO，优化能穿过质量筛选并在微调中削弱安全对齐的投毒样本
Published Oct 1
Evaluated models Llama2-7B-Chat , Llama3-8B-Instruct , Qwen2-7B-Instruct and others5 Abstract 质量筛选挡不住部分高分样本的安全削弱。Bi-QSTO 研究一个实际训练缺口：基于质量的数据选择会先于微调决定样本去留，而以往微调投毒多假设毒样本直接进入训练集。已对齐 LLM 的拒答会被少量有害或看似无害的微调样本削弱。作者用三个问题串起实验：选择能否排除毒样本。
提出 BLINDBIAS，通过纯文本续写与前缀控制越狱黑盒模型
Published Sep 29
Evaluated models GLM-5 , Gemini-3.5-Flash , Qwen3-32B and others4 Abstract 作者认为，隐藏数值概率并不足以消除支持重复采样和前缀续写的解码攻击面。BLINDBIAS 是一种针对 sample-only 续写接口的 black-box 解码时越狱框架 ，研究没有目标数值概率时，采样能否支持逐步控制。
评测多轮对话中 GradSafe 越狱检测的可分性与脆弱性
Published Sep 29
Evaluated models Llama 3.1 8B Instruct , Qwen2.5-7B-Instruct Abstract CWS 显示不安全梯度在真实多轮流量中变弱，且随攻击族和模型而变。作者评估梯度越狱检测从单条提示词迁到多轮对话后还剩多少可分性，方法是用 Context Window Scanner 把 GradSafe 原封不动地套到用户轮窗口上。
提出推理通道预填与输出前缀组合攻击以越狱推理模型
Published Sep 24
Evaluated models Gemini 3 Flash Preview , DeepSeek V4 Flash , Claude Haiku 4.5 用词级归因指导同义词替换，翻转提示注入检测并验证越狱
Published Sep 22
Evaluated models Prompt Guard 2 (86M) , Llama 3.1 8B 检验结构越狱 IICL 能否跨厂商泛化并与语言约束叠加
Published Sep 8
Evaluated models gemini-2.5-flash , gemini-2.5-flash-lite 提出 MIPC 与 CFA，观察模型自拟测验后接受开发者身份
Published Sep 3
Evaluated models ChatGPT , Claude , Qwen3.7-Plus and others5 Abstract 自拟测验可造成对话层虚假认证，但所测授权边界并未因此改变。这项工作把“模型自己出题、自己批改、再宣布身份已核验”定义成对话层认证失败，并与后端提权分开。
提出多轮越狱框架 BLUEPRINT，用世界观模拟与心理因素诱导有害输出
Published Sep 2
Evaluated models Qwen3-Next-80B , DeepSeek-V3.2 , GLM-4.7 and others6 Abstract BLUEPRINT 解耦多轮越狱策略与情境模拟，揭示任务具象化是摆脱拒绝的核心机制，为多轮安全防御提供新视角。BLUEPRINT 是一个将因子化社会影响力策略空间与跨轮世界观模拟解耦的多轮大语言模型安全评测框架。
提出广度优先后缀搜索 BOSS，改进 GCG 越狱优化
Published Sep 2
Evaluated models Llama-2-7B-Chat , Yi-1.5-9B-Chat , Qwen2-7B-Instruct and others8 Abstract BOSS 把 GCG 类优化从单条深搜索改为多条短轨迹加源侧诊断。BOSS 是插在 GCG 类离散 suffix 优化上的搜索框架：局部梯度更新不变，变的是固定预算花在深度还是广度。
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
Published Sep 2
Evaluated models LLaDA-V , MMaDA , LLaDA2.0-Uni 提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作
Published Aug 11
Evaluated models OpenVLA-7B , π0-FAST , openvla-7B Abstract DURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。
利用加密思维块的跨模型重放，诱导弱模型逐字转写专有推理链
Published Aug 11
Evaluated models Claude Opus 4.8 , Claude Sonnet 4.6 , Claude Haiku 4.5 and others13 Abstract 论文揭示了客户端加密思维块跨模型互换漏洞，提出了低成本提取方法并给出防御方案。
提出 SN-Guided Diffusion，利用安全神经元实现离线越狱
Published Aug 8
Evaluated models Qwen2.5-7B-Instruct , LLaDA-8B-Instruct , Dream-Instruct-7B and others15 Abstract 论文揭示了扩散语言模型对自回归安全神经元的继承性，并提出纯离线黑盒越狱框架 SN-Guided Diffusion。论文系统评估了扩散大语言模型（DLLM）在安全对齐中的双重角色——既作为白盒攻击目标，又作为黑盒越狱生成的对抗工具。
提出面向意图的多轮 LLM 越狱分类体系
Published Aug 2
Evaluated models Llama-3 , Llama-3.3-70B , DeepSeek-V3 and others11 Abstract 作者用四维意图分类整理多轮越狱，并称组织方式影响效果与观察范围。这是一篇关于多轮 LLM 越狱的 SoK：按有害意图在交互中的组织位置分类，而不是按单步提示技巧分类。
提出 Concept2Scenario，借助内部概念归因发现可迁移的越狱场景
Published Jul 26
Evaluated models Qwen3.5-9B , Llama-3.1-8B , Ministral-3-8B and others6 Abstract 该研究从表征空间因果归因揭示场景削弱拒绝的机制，发现可复用脆弱场景先验，提升多模型黑盒越狱效能与探索速度。