Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出闭环激活引导，在扩散语言模型去噪过程中注入定向偏见
Published Oct 5
Evaluated models LLaDA-8B-Instruct , Dream-v0-Instruct-7B , LLaDA-MoE-7B-A1B-Instruct Abstract 通过去噪中间概率反馈动态调节残差流转向，证明扩散语言模型在推理服务栈中存在闭环偏见注入脆弱性。
提出 ALIBI，向恶意二进制注入不执行掩护叙事使分析器误判为良性
Published Sep 17
Evaluated models Gemini 2.5 Pro , GPT-5.5 Pro , Claude Opus 4.7 Abstract ALIBI 用二进制内的掩护叙事重释可疑静态证据，Gemini 上翻转多，另两模型主要为降级。ALIBI 是针对 LLM 恶意软件分诊的语义掩护叙事攻击：不覆盖系统指令，而把仍可见的可疑静态证据重释成良性安全产品的预期行为。
提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令
Published Jun 11
Evaluated models Claude-sonnet-4.5 , GPT-4o , GPT-4.1 and others11 Abstract PaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。PaperGuard 同时评测并检测多模态 AI 审稿中的评分操纵。
提出日志基底提示注入，操纵 SOC 分析员的分类、摘要与处置建议
Published May 23
Evaluated models gpt-4o-mini Abstract 在 gpt-4o-mini 上，人格劫持与上下文操纵可改写 SOC 分析输出，直接覆盖在分类上无效。
提出 TFL 定向比特翻转，使选定提示输出虚假答案且无关查询保持正确
Published Feb 20
Evaluated models Qwen3-8B , DeepSeek-R1-Distill-Qwen-14B , LLaMA-3.1-8B-INSTRUCT Abstract TFL 在三个 LLM 上搜索权重比特，使指定提示出现目标关键词，并约束无关任务下降。TFL 是对 LLM 主存权重的目标比特翻转框架：攻击者要让选定提示输出指定虚假答案关键词，同时限制无关查询上的降质。
提出查询无关黑盒攻击 DQ-A，用可迁移文末后缀降低文档检索排名
Published Jan 31
Evaluated models Qwen-1.5-7B-Instruct , SFR-Embedding-Mistral , E5-Mistral-7B-Instruct and others10 Abstract DQ-A 以无查询黑盒后缀压低 LLM 检索排名，并在 BRIGHT 上比较三种基线。DQ-A 是一种 query-agnostic、complete black-box 的文档隐藏攻击，对象是用最后隐层相似度匹配的 LLM 检索。
提出 AST-ASIP ，把对抗指令植入编译器忽略区域以劫持代码评分
Published Jan 29
Evaluated models DeepSeek-V3.2 , Qwen3-235B , GPT-OSS-120B and others9 Abstract 作者称 RLHF 的服从性使评分脱离代码。这篇工作把自动代码评分中的失败称为 Compliance Paradox：评分模型可以离开提交逻辑，转而执行嵌在可编译代码里的隐藏指令。
Attacks arXiv 2512.10449 · Dec 11, 2025 提出 DSAAP，以不可见文本对科学审稿 PDF 做间接提示注入
Published Dec 11, 2025
Evaluated models gpt-oss-20B , tulu3-8B , Llama 3.1-8B and others13 You have reached the end