Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.

Attack surface / entry point：Memory writes Attack surface / entry point：Inter-agent messages Attack surface / entry point：Weights and gradients Layer：Training and data layer Clear all

Another 213papers do not have category tags yet and are not included in filtered results.

DefensesarXiv 2610.09941Oct 7
OrthoPurify 用一步正交投影净化被后门污染的视觉语言模型
提出 OrthoPurify，用正交投影清除视觉语言模型适配器中的劫持方向
arXiv
2610.09941
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Qwen3-VL-8B, LLaVA-1.5-13B and others5
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Abstract一次投影去掉劫持方向。
OrthoPurify 是部署前的 LVLM 后门净化方法，用一次正交投影去掉被劫持的权重更新方向。
Paper analysisRead analysis
AttacksarXiv 2610.09819Oct 7
FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
arXiv
2610.09819
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
HuBERT-base, WavLM-base
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentAudio
Abstract论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
Paper analysisRead analysis
Analysis and theoryarXiv 2610.09004Oct 7
研究：去除有害信息不足以证明开源权重模型的抗篡改能力
论证发布时互信息不能认证开源权重抗微调恢复
arXiv
2610.09004
Published
Oct 7
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
EleutherAI/deep-ignorance-e2e-strong-filter, EleutherAI/deep-ignorance-unfiltered, Google BERT-Tiny and others6
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称零信息仍可一步恢复，表观抗微调可来自参数化。
作者研究开源权重模型的篡改抵抗：发布时的互信息是否足以保证微调恢复很慢。
Paper analysisRead analysis
AttacksarXiv 2610.07654Oct 6
研究揭示策略蒸馏的安全后门风险
测量带后门教师经 OPD 向干净学生迁移潜伏后门
arXiv
2610.07654
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Qwen2.5-1.5B-Instruct, Qwen2.5-3B-Instruct, Qwen2.5-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract作者称 OPD 可在压低无触发词有害率时迁入后门。
带后门的外部教师经 OPD，可在压低无触发词有害率的同时，把触发条件下的有害行为传给初始干净学生。。
Paper analysisRead analysis
InterpretabilityarXiv 2610.07518Oct 6
TRACE：仅凭 checkpoint 更新审计大语言模型有害目标
提出 TRACE，仅凭检查点更新审计有害合规微调目标
arXiv
2610.07518
Published
Oct 6
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Llama-3.1-8B-Instruct, Mistral-7B-Instruct-v0.3, Qwen3-8B and others6
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract作者称有害合规 SFT 在检查点更新中留下可排序坐标，并据此做只读权重审计。
作者在检查点更新里寻找有害合规 SFT 的目标组成，并把读数做成不查询模型、不看未知训练数据的审计分 TRACE。
Paper analysisRead analysis
AttacksarXiv 2610.05793Oct 5
研究者训练出按多智能体拓扑触发的代码后门模型
提出拓扑条件后门，使代码模型在推断多智能体部署时植入漏洞
arXiv
2610.05793
Published
Oct 5
Layer
Training and data layer
Setting
coding agent
Evaluated models
Qwen2.5-7B-Instruct, Qwen2.5-Coder-7B-Instruct
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Abstract论文证实了拓扑条件后门的可训练性与泛化性，展示了常规评测盲区，并提出差异化拓扑审计作为检测防御方向。
Paper analysisRead analysis
AttacksarXiv 2610.05453Oct 5
研究者提出 Privacy-Leaking Watermarks，可在本地多模态模型中泄露对话隐私
提出 PLW，用微调把先前对话敏感触发编码进后续生成图像
arXiv
2610.05453
Published
Oct 5
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
OmniGen2, BAGEL-7B
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
AbstractPLW 把先前对话线索写成后续图像中的隐水印，检出随触发、模型和间隔变化。
Paper analysisRead analysis
AttacksarXiv 2610.04128Oct 3
研究显示拆分学习中的梯度可提升客户端文本重建率
衡量分裂学习中梯度相对激活对客户文本重建的额外贡献
arXiv
2610.04128
Published
Oct 3
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
GPT-2 (openai-community/gpt2, 124M), Qwen3-0.6B
- AttacksExtraction and theft
Abstract激活已恢复大部分 token。
这篇工作测量 split learning 分裂点上的文本泄漏：激活单独能恢复多少，训练回传的梯度再增加多少，以及按 token 还是按整篇计分会不会改写结论。
Paper analysisRead analysis
AttacksarXiv 2610.01365Oct 1
ReGap：无需真实隐私数据即可通过微调重新提取模型隐私关联
提出 ReGap，用自生成伪监督微调恢复模型中的隐私关联
arXiv
2610.01365
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box, Gray-box
Evaluated models
GPT-2 Small, GPT-2 Medium, GPT-2 Large and others6
- AttacksExtraction and theft
- ComponentFine-tuning and open weights
Abstract提出无真实私有监督的恢复攻击 ReGap，实验显示微调可通过自生成数据唤醒模型潜在隐私关联，突显后适应隐私风险。
Paper analysisRead analysis
DefensesarXiv 2610.00685Oct 1
研究者提出用零空间投影净化 LoRA 微调 LLM 的后门
用零空间投影净化 LoRA 微调模型后门并保留基座与下游能力
arXiv
2610.00685
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaMA2-7B-Chat, LLaMA2-13B-Chat, Qwen2-7B-Instruct and others6
- DefensesModel hardening
- AttacksPoisoning and backdoors
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2610.02418Oct 1
Whiteout：用混淆样本阻止 LLM 泄露个人敏感信息
提出 Whiteout，用伪装样本微调覆盖个人敏感信息关联
arXiv
2610.02418
Published
Oct 1
Layer
Training and data layer
Setting
Models and APIs
Attacker
Black-box, White-box
Evaluated models
Llama 3.2, Phi-3-mini, Gemma 3 and others7
- DefensesModel hardening
- AttacksExtraction and theft
Paper analysisRead analysis
DefensesarXiv 2609.39866Sep 30
研究者提出梯度封堵实现 LLM 发布前的预防性遗忘
提出 GSU 在发布前封堵敏感门梯度，抵抗下游微调获取禁止能力
arXiv
2609.39866
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-3.2-1B, Llama-3.2-3B, Llama-3.1-8B and others7
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
AbstractGSU 在发布前封堵 SiLU 门的获取梯度，并在 TOFU 与 WMDP 上降低下游微调得分。
Gradient-Sealed Unlearning（GSU）是一种发布前的 preemptive unlearning：不删除模型里已经有的能力，而是让指定禁止域能力更难被发布后的微调获取。
Paper analysisRead analysis
AttacksarXiv 2609.39047Sep 30
BadAction：通过动作引导触发器对交互式视频生成模型实施后门攻击
提出 BadAction，通过动作触发器给交互式视频生成植入后门
arXiv
2609.39047
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
Astra (Wan2.1-T2V-1.3B)
- AttacksPoisoning and backdoors
- TechniqueDormant triggers
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2609.38909Sep 30
Purdue 提出 Pact：将欺骗作为行为遗忘
提出 PACT，遗忘推理模型在压力下的欺骗行为并保留上下文理解
arXiv
2609.38909
Published
Sep 30
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
DeepSeek-R1-Distill-Qwen-32B, QwQ-32B
- DefensesModel hardening
- AttacksModel tampering
- RiskDeception and scheming
- ComponentFine-tuning and open weights
Abstract论文将大模型欺骗形式化为上下文条件行为，提出 PACT 框架在消除欺骗的同时保留了上下文遵循能力。
Paper analysisRead analysis
DefensesarXiv 2610.00320Sep 29
研究显示少样本微调可绕过安全层局部冻结与修复防御
检验层冻结与奇异方向截断能否挡住少样本有害微调
arXiv
2610.00320
Published
Sep 29
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Llama-3.1-8B-Instruct, Llama-3.1-Tulu-3-8B-DPO, OLMo-2-1124-7B-Instruct and others10
- DefensesModel hardening
- AttacksModel tampering
- ComponentFine-tuning and open weights
Abstract定位与恢复可以复现，但知情攻击能把损伤移出冻结带，并打败跨检查点的截断修复。
这篇工作检验：把拒答定位到某些层或更新方向之后，能不能在攻击者知情时还守住拒答。。
Paper analysisRead analysis
AttacksarXiv 2609.33445Sep 27
CSR：跨架构统一攻击概念擦除
提出跨架构攻击 CSR，用概念分数参数重学习恢复文生图被擦除概念
arXiv
2609.33445
Published
Sep 27
Layer
Training and data layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
FLUX.1-dev, Stable Diffusion-v1.4
- AttacksModel tampering
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2609.27124Sep 23
Fed-ADR：用恶意编排服务器协同客户端梯度操纵攻击联邦学习
提出 Fed-ADR，用编排服务器协同操纵梯度攻破联邦学习并检测恢复
arXiv
2609.27124
Published
Sep 23
Layer
Training and data layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
CNN（MNIST：2 Conv + 3 FC）, CNN（Fashion-MNIST：6 Conv + 1 FC）, ResNet18（CIFAR-10）
- DefensesDetection and filtering
- AttacksPoisoning and backdoors
- TechniqueDefense-targeted
AbstractFed-ADR 用 gray-box 编排攻击绕过多种聚合防御，再用 Hessian 一致性检测和窗口内恢复把准确率拉回。
Fed-ADR 是一套面向联邦学习的攻击、检测与恢复框架：编排服务器改写合谋客户端的梯度，使参数服务器的现有防御把投毒更新当成良性，同时在发现后用历史梯度把全局模型原地修回来。
Paper analysisRead analysis
AttacksarXiv 2609.31726Sep 22
研究者提出通过替换神经网络权重高容量外泄医学影像的攻击
提出连续潜码隐写，把医学影像写入模型权重以绕过导出限制
arXiv
2609.31726
Published
Sep 22
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
U-Net, DenseNet121
- TechniqueDefense-targeted
- ComponentFine-tuning and open weights
Paper analysisRead analysis
DefensesarXiv 2609.20532Sep 17
面向旧款 GPU 的可验证差分隐私训练框架：用 CPU 侧 TEE 校验 GPU 梯度
AI summary论文提出一种在旧款 GPU 上实现可验证差分隐私（DP）训练的框架，用 CPU 侧 TEE 配合不受信任的 GPU 完成校验。
arXiv
2609.20532
Published
Sep 17
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
5-layer MLP, WideResNet, GPT-2-medium and others4
AbstractCPU TEE 概率抽查不可信 GPU 上的 DP-SGD，以小开销约束频繁偏离。
TEE-Certified DP 用已部署的 CPU TEE 监视不可信旧 GPU 上的 DP-SGD，使监管方能在不看训练数据的情况下检查声明的隐私机制是否被执行。
Paper analysisRead analysis
DefensesarXiv 2609.15671Sep 14
QPriv-VL：面向视觉语言模型的问题引导 token 裁剪隐私防御
提出 QPriv-VL，用问题引导剪枝降低分布式视觉问答的隐私泄露
arXiv
2609.15671
Published
Sep 14
Layer
Training and data layer
Setting
Models and APIs
Evaluated models
LLaVA-1.5-7B, Llama-2
- AttacksExtraction and theft
- ComponentVision
AbstractQPriv-VL 在切层前按问题相关度与 DINOv2 敏感度剪视觉 token，作者称能在约四成 token 下兼顾准确率与四类攻击。
QPriv-VL 把问题引导的视觉 token 剪枝做成分布式 VQA 的客户端隐私防御，而不是只做集中式推理加速。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop