{"total":269,"rows":[{"id":"2402.04249","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","created":"2024-02-06","cited_by_count":1429,"area":"safety"},{"id":"2310.08419","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","created":"2023-10-12","cited_by_count":1420,"area":"safety"},{"id":"2404.02151","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","created":"2024-04-02","cited_by_count":486,"area":"safety"},{"id":"2310.03684","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","created":"2023-10-05","cited_by_count":469,"area":"safety"},{"id":"2308.14132","title":"Detecting Language Model Attacks with Perplexity","created":"2023-08-27","cited_by_count":431,"area":"safety"},{"id":"2402.06363","title":"StruQ: Defending Against Prompt Injection with Structured Queries","created":"2024-02-09","cited_by_count":375,"area":"safety"},{"id":"2406.04313","title":"Improving Alignment and Robustness with Circuit Breakers","created":"2024-06-06","cited_by_count":322,"area":"safety"},{"id":"2103.07853","title":"Membership Inference Attacks on Machine Learning: A Survey","created":"2021-03-14","cited_by_count":321,"area":"safety"},{"id":"2309.02705","title":"Certifying LLM Safety against Adversarial Prompting","created":"2023-09-06","cited_by_count":266,"area":"safety"},{"id":"2308.07308","title":"LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked","created":"2023-08-14","cited_by_count":244,"area":"safety"},{"id":"2111.08947","title":"Fast Yet Effective Machine Unlearning","created":"2021-11-17","cited_by_count":217,"area":"safety"},{"id":"2407.15549","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","created":"2024-07-22","cited_by_count":173,"area":"safety"},{"id":"2401.17263","title":"Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks","created":"2024-01-30","cited_by_count":156,"area":"safety"},{"id":"2408.15221","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","created":"2024-08-27","cited_by_count":151,"area":"safety"},{"id":"2308.10741","title":"On the Adversarial Robustness of Multi-Modal Foundation Models","created":"2023-08-21","cited_by_count":145,"area":"safety"},{"id":"2402.02309","title":"Jailbreaking Attack against Multimodal Large Language Model","created":"2024-02-04","cited_by_count":135,"area":"safety"},{"id":"2309.01446","title":"Open Sesame! Universal Black Box Jailbreaking of Large Language Models","created":"2023-09-04","cited_by_count":134,"area":"safety"},{"id":"2510.09023","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","created":"2025-10-10","cited_by_count":129,"area":"safety"},{"id":"2405.15589","title":"Efficient Adversarial Training in LLMs with Continuous Attacks","created":"2024-05-24","cited_by_count":113,"area":"safety"},{"id":"2401.17256","title":"Weak-to-Strong Jailbreaking on Large Language Models","created":"2024-01-30","cited_by_count":107,"area":"safety"},{"id":"2207.05521","title":"Federated Unlearning: How to Efficiently Erase a Client in FL?","created":"2022-07-12","cited_by_count":95,"area":"safety"},{"id":"2403.05030","title":"Defending Against Unforeseen Failure Modes with Latent Adversarial Training","created":"2024-03-08","cited_by_count":88,"area":"safety"},{"id":"2201.06640","title":"Towards Adversarial Evaluations for Inexact Machine Unlearning","created":"2022-01-17","cited_by_count":84,"area":"safety"},{"id":"2310.00076","title":"Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks","created":"2023-09-29","cited_by_count":81,"area":"safety"},{"id":"2410.02832","title":"FlipAttack: Jailbreak LLMs via Flipping","created":"2024-10-02","cited_by_count":80,"area":"safety"},{"id":"2407.11969","title":"Does Refusal Training in LLMs Generalize to the Past Tense?","created":"2024-07-16","cited_by_count":79,"area":"safety"},{"id":"2502.05374","title":"Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond","created":"2025-02-07","cited_by_count":79,"area":"safety"},{"id":"2101.01341","title":"Practical Blind Membership Inference Attack via Differential Comparisons","created":"2021-01-05","cited_by_count":78,"area":"safety"},{"id":"2305.03807","title":"Evading Watermark based Detection of AI-Generated Content","created":"2023-05-05","cited_by_count":78,"area":"safety"},{"id":"2104.09667","title":"Manipulating SGD with Data Ordering Attacks","created":"2021-04-19","cited_by_count":74,"area":"safety"},{"id":"2108.11023","title":"EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning","created":"2021-08-25","cited_by_count":73,"area":"safety"},{"id":"2301.11578","title":"Learning to Unlearn: Instance-wise Unlearning for Pre-trained Classifiers","created":"2023-01-27","cited_by_count":67,"area":"safety"},{"id":"2402.06255","title":"Fight Back Against Jailbreaking via Prompt Adversarial Tuning","created":"2024-02-09","cited_by_count":67,"area":"safety"},{"id":"2103.04264","title":"T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification","created":"2021-03-07","cited_by_count":60,"area":"safety"},{"id":"2105.10872","title":"CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes","created":"2021-05-23","cited_by_count":56,"area":"safety"},{"id":"2109.08266","title":"Hard to Forget: Poisoning Attacks on Certified Machine Unlearning","created":"2021-09-17","cited_by_count":52,"area":"safety"},{"id":"2402.15911","title":"PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails","created":"2024-02-24","cited_by_count":52,"area":"safety"},{"id":"2502.16580","title":"Can Indirect Prompt Injection Attacks Be Detected and Removed?","created":"2025-02-23","cited_by_count":52,"area":"safety"},{"id":"2305.06360","title":"Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomy","created":"2023-05-10","cited_by_count":51,"area":"safety"},{"id":"2406.09324","title":"Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs","created":"2024-06-13","cited_by_count":51,"area":"safety"},{"id":"2411.18479","title":"SoK: Watermarking for AI-Generated Content","created":"2024-11-27","cited_by_count":51,"area":"safety"},{"id":"2301.02496","title":"Stealthy Backdoor Attack for Code Models","created":"2023-01-06","cited_by_count":49,"area":"safety"},{"id":"2112.05588","title":"Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models","created":"2021-12-10","cited_by_count":46,"area":"safety"},{"id":"2205.12709","title":"VeriFi: Towards Verifiable Federated Unlearning","created":"2022-05-25","cited_by_count":46,"area":"safety"},{"id":"2206.03693","title":"Autoregressive Perturbations for Data Poisoning","created":"2022-06-08","cited_by_count":46,"area":"safety"},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2106.14851","title":"Data Poisoning Won't Save You From Facial Recognition","created":"2021-06-28","cited_by_count":45,"area":"safety"},{"id":"2110.06904","title":"Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networks","created":"2021-10-13","cited_by_count":40,"area":"safety"},{"id":"2408.10848","title":"Perception-guided Jailbreak against Text-to-Image Models","created":"2024-08-20","cited_by_count":40,"area":"safety"},{"id":"2412.08608","title":"AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models","created":"2024-12-11","cited_by_count":38,"area":"safety"},{"id":"2305.17826","title":"NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Models","created":"2023-05-28","cited_by_count":37,"area":"safety"},{"id":"2109.13236","title":"FedIPR: Ownership Verification for Federated Deep Neural Network Models","created":"2021-09-27","cited_by_count":36,"area":"safety"},{"id":"2402.09177","title":"Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks","created":"2024-02-14","cited_by_count":36,"area":"safety"},{"id":"2202.11202","title":"Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning","created":"2022-02-22","cited_by_count":34,"area":"safety"},{"id":"2311.11509","title":"Token-Level Adversarial Prompt Detection Based on Perplexity Measures and Contextual Information","created":"2023-11-20","cited_by_count":33,"area":"safety"},{"id":"2411.12768","title":"CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization","created":"2024-11-18","cited_by_count":33,"area":"safety"},{"id":"2210.09671","title":"Not All Poisons are Created Equal: Robust Training against Data Poisoning","created":"2022-10-18","cited_by_count":30,"area":"safety"},{"id":"2303.15127","title":"Learning the Unlearnable: Adversarial Augmentations Suppress Unlearnable Example Attacks","created":"2023-03-27","cited_by_count":30,"area":"safety"},{"id":"2312.10336","title":"Certified Minimax Unlearning with Generalization Rates and Deletion Capacity","created":"2023-12-16","cited_by_count":29,"area":"safety"},{"id":"2402.13148","title":"Defending Jailbreak Prompts via In-Context Adversarial Game","created":"2024-02-20","cited_by_count":29,"area":"safety"},{"id":"2404.13968","title":"Protecting Your LLMs with Information Bottleneck","created":"2024-04-22","cited_by_count":29,"area":"safety"},{"id":"2406.06622","title":"Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs","created":"2024-06-07","cited_by_count":26,"area":"safety"},{"id":"2311.00172","title":"Robust Safety Classifier for Large Language Models: Adversarial Prompt Shield","created":"2023-10-31","cited_by_count":25,"area":"safety"},{"id":"2412.18693","title":"Diverse and Effective Red Teaming with Auto-generated Rewards and Multi-step Reinforcement Learning","created":"2024-12-24","cited_by_count":25,"area":"safety"},{"id":"2102.13624","title":"What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoning","created":"2021-02-26","cited_by_count":22,"area":"safety"},{"id":"2403.10553","title":"Learning to Watermark LLM-generated Text via Reinforcement Learning","created":"2024-03-13","cited_by_count":22,"area":"safety"},{"id":"2208.10224","title":"Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attacks","created":"2022-08-14","cited_by_count":21,"area":"safety"},{"id":"2410.19937","title":"RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Eviction","created":"2024-10-25","cited_by_count":21,"area":"safety"},{"id":"2411.08410","title":"The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense","created":"2024-11-13","cited_by_count":21,"area":"safety"},{"id":"2203.04160","title":"Robustly-reliable learners under poisoning attacks","created":"2022-03-08","cited_by_count":20,"area":"safety"},{"id":"2603.06594","title":"A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness","created":"2026-02-04","cited_by_count":20,"area":"safety"},{"id":"2405.20539","title":"SleeperNets: Universal Backdoor Poisoning Attacks Against Reinforcement Learning Agents","created":"2024-05-30","cited_by_count":19,"area":"safety"},{"id":"2407.07735","title":"Protecting NeRFs' Copyright via Plug-And-Play Watermarking Base Model","created":"2024-07-10","cited_by_count":18,"area":"safety"},{"id":"2505.05190","title":"Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks","created":"2025-05-08","cited_by_count":18,"area":"safety"},{"id":"2505.14103","title":"AudioJailbreak: Jailbreak Attacks against End-to-End Large Audio-Language Models","created":"2025-05-20","cited_by_count":18,"area":"safety"},{"id":"2410.09591","title":"Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy","created":"2024-10-12","cited_by_count":17,"area":"safety"},{"id":"2507.13686","title":"TopicAttack: An Indirect Prompt Injection Attack via Topic Transition","created":"2025-07-18","cited_by_count":17,"area":"safety"},{"id":"2303.05699","title":"Feature Unlearning for Pre-trained GANs and VAEs","created":"2023-03-10","cited_by_count":16,"area":"safety"},{"id":"2404.12274","title":"Advancing the Robustness of Large Language Models through Self-Denoised Smoothing","created":"2024-04-18","cited_by_count":16,"area":"safety"},{"id":"2409.15398","title":"Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI","created":"2024-09-23","cited_by_count":16,"area":"safety"},{"id":"2410.02684","title":"HiddenGuard: Fine-Grained Safe Generation with Specialized Representation Router","created":"2024-10-03","cited_by_count":16,"area":"safety"},{"id":"2504.20472","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","created":"2025-04-29","cited_by_count":16,"area":"safety"},{"id":"2603.10521","title":"IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMs","created":"2026-03-11","cited_by_count":15,"area":"safety"},{"id":"2206.01367","title":"Adversarial Unlearning: Reducing Confidence Along Adversarial Directions","created":"2022-06-03","cited_by_count":14,"area":"safety"},{"id":"2402.05467","title":"Rapid Optimization for Jailbreaking LLMs via Subconscious Exploitation and Echopraxia","created":"2024-02-08","cited_by_count":14,"area":"safety"},{"id":"2410.03489","title":"Gradient-based Jailbreak Images for Multimodal Fusion Models","created":"2024-10-04","cited_by_count":14,"area":"safety"},{"id":"2502.04204","title":"Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidence","created":"2025-02-06","cited_by_count":14,"area":"safety"},{"id":"2207.12405","title":"Versatile Weight Attack via Flipping Limited Bits","created":"2022-07-25","cited_by_count":13,"area":"safety"},{"id":"2405.16978","title":"OSLO: One-Shot Label-Only Membership Inference Attacks","created":"2024-05-27","cited_by_count":13,"area":"safety"},{"id":"2409.01193","title":"CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Models","created":"2024-09-02","cited_by_count":13,"area":"safety"},{"id":"2401.17523","title":"Game-Theoretic Unlearnable Example Generator","created":"2024-01-31","cited_by_count":12,"area":"safety"},{"id":"2406.08288","title":"Decoupling the Class Label and the Target Concept in Machine Unlearning","created":"2024-06-12","cited_by_count":12,"area":"safety"},{"id":"2411.14133","title":"GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs","created":"2024-11-21","cited_by_count":12,"area":"safety"},{"id":"2412.20392","title":"Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuning","created":"2024-12-29","cited_by_count":12,"area":"safety"},{"id":"2510.20468","title":"Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models","created":"2025-10-23","cited_by_count":12,"area":"safety"},{"id":"2312.16823","title":"Layer Attack Unlearning: Fast and Accurate Machine Unlearning via Layer Level Attack and Knowledge Distillation","created":"2023-12-28","cited_by_count":11,"area":"safety"},{"id":"2503.08704","title":"Life-Cycle Routing Vulnerabilities of LLM Router","created":"2025-03-09","cited_by_count":11,"area":"safety"},{"id":"2505.16947","title":"MixAT: Combining Continuous and Discrete Adversarial Training for LLMs","created":"2025-05-22","cited_by_count":11,"area":"safety"},{"id":"2512.06589","title":"OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluation","created":"2025-12-06","cited_by_count":11,"area":"safety"},{"id":"2305.14851","title":"Sharpness-Aware Data Poisoning Attack","created":"2023-05-24","cited_by_count":10,"area":"safety"}],"next_cursor":"100"}