{"total":234,"rows":[{"id":"2307.15043","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","created":"2023-07-27","cited_by_count":3104,"area":"alignment"},{"id":"2402.04249","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","created":"2024-02-06","cited_by_count":1429,"area":"safety"},{"id":"2210.10760","title":"Scaling Laws for Reward Model Overoptimization","created":"2022-10-19","cited_by_count":1095,"area":"alignment"},{"id":"2312.02119","title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","created":"2023-12-04","cited_by_count":672,"area":"safety"},{"id":"2309.00614","title":"Baseline Defenses for Adversarial Attacks Against Aligned Language Models","created":"2023-09-01","cited_by_count":651,"area":"alignment"},{"id":"2401.06373","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","created":"2024-01-12","cited_by_count":573,"area":"lr"},{"id":"2404.01318","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","created":"2024-03-28","cited_by_count":536,"area":"safety"},{"id":"2403.03218","title":"The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning","created":"2024-03-05","cited_by_count":509,"area":"safety"},{"id":"2310.06987","title":"Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation","created":"2023-10-10","cited_by_count":451,"area":"safety"},{"id":"2310.06387","title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","created":"2023-10-10","cited_by_count":431,"area":"alignment"},{"id":"2302.03668","title":"Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discovery","created":"2023-02-07","cited_by_count":336,"area":null},{"id":"2306.15447","title":"Are aligned neural networks adversarially aligned?","created":"2023-06-26","cited_by_count":315,"area":"alignment"},{"id":"2311.06668","title":"In-context Vectors: Making In Context Learning More Effective and Controllable Through Latent Space Steering","created":"2023-11-11","cited_by_count":245,"area":null},{"id":"2303.04381","title":"Automatically Auditing Large Language Models via Discrete Optimization","created":"2023-03-08","cited_by_count":191,"area":null},{"id":"2402.00888","title":"Security and Privacy Challenges of Large Language Models: A Survey","created":"2024-01-30","cited_by_count":186,"area":"safety"},{"id":"2402.08679","title":"COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability","created":"2024-02-13","cited_by_count":175,"area":"safety"},{"id":"2404.16873","title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","created":"2024-04-21","cited_by_count":156,"area":"safety"},{"id":"2309.10105","title":"Understanding Catastrophic Forgetting in Language Models via Implicit Inference","created":"2023-09-18","cited_by_count":144,"area":"alignment"},{"id":"2402.02309","title":"Jailbreaking Attack against Multimodal Large Language Model","created":"2024-02-04","cited_by_count":135,"area":"safety"},{"id":"2309.01446","title":"Open Sesame! Universal Black Box Jailbreaking of Large Language Models","created":"2023-09-04","cited_by_count":134,"area":"safety"},{"id":"2402.09283","title":"Attacks, Defenses and Evaluations for LLM Conversation Safety: A Survey","created":"2024-02-14","cited_by_count":130,"area":null},{"id":"2401.14446","title":"Black-Box Access is Insufficient for Rigorous AI Audits","created":"2024-01-25","cited_by_count":126,"area":null},{"id":"2306.09442","title":"Explore, Establish, Exploit: Red Teaming Language Models from Scratch","created":"2023-06-15","cited_by_count":114,"area":"safety"},{"id":"2310.15140","title":"AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models","created":"2023-10-23","cited_by_count":111,"area":"alignment"},{"id":"2405.21018","title":"Improved Techniques for Optimization-Based Jailbreaking on Large Language Models","created":"2024-05-31","cited_by_count":110,"area":"safety"},{"id":"2402.09154","title":"Attacking Large Language Models with Projected Gradient Descent","created":"2024-02-14","cited_by_count":94,"area":"alignment"},{"id":"2402.09063","title":"Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space","created":"2024-02-14","cited_by_count":91,"area":"alignment"},{"id":"2402.14020","title":"Coercing LLMs to do and reveal (almost) anything","created":"2024-02-21","cited_by_count":89,"area":"safety"},{"id":"2402.15570","title":"Fast Adversarial Attacks on Language Models In One GPU Minute","created":"2024-02-23","cited_by_count":88,"area":"safety"},{"id":"2407.20859","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","created":"2024-07-30","cited_by_count":81,"area":"agents"},{"id":"2406.02622","title":"Safeguarding Large Language Models: A Survey","created":"2024-06-03","cited_by_count":78,"area":"safety"},{"id":"2403.07865","title":"CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion","created":"2024-03-12","cited_by_count":76,"area":"safety"},{"id":"2404.02928","title":"Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Models","created":"2024-04-02","cited_by_count":72,"area":"diffusion"},{"id":"2401.11170","title":"Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images","created":"2024-01-20","cited_by_count":69,"area":"mllm"},{"id":"2112.08348","title":"Prompt Waywardness: The Curious Case of Discretized Interpretation of Continuous Prompts","created":"2021-12-15","cited_by_count":64,"area":null},{"id":"2402.12329","title":"Query-Based Adversarial Prompt Generation","created":"2024-02-19","cited_by_count":62,"area":"alignment"},{"id":"2205.01663","title":"Adversarial Training for High-Stakes Reliability","created":"2022-05-03","cited_by_count":60,"area":null},{"id":"2306.04542","title":"On the Design Fundamentals of Diffusion Models: A Survey","created":"2023-06-07","cited_by_count":60,"area":"diffusion"},{"id":"2406.19417","title":"\"Glue pizza and eat rocks\" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models","created":"2024-06-26","cited_by_count":60,"area":"rag"},{"id":"2110.02797","title":"Adversarial Robustness Comparison of Vision Transformer and MLP-Mixer to CNNs","created":"2021-10-06","cited_by_count":57,"area":null},{"id":"2403.02910","title":"ImgTrojan: Jailbreaking Vision-Language Models with ONE Image","created":"2024-03-05","cited_by_count":57,"area":"mllm"},{"id":"2305.10435","title":"Generative Pre-trained Transformer: A Comprehensive Review on Enabling Technologies, Potential Applications, Emerging Challenges, and Future Directions","created":"2023-05-11","cited_by_count":55,"area":null},{"id":"2202.08827","title":"LAMP: Extracting Text from Gradients with Language Model Priors","created":"2022-02-17","cited_by_count":54,"area":null},{"id":"2310.10383","title":"Privacy in Large Language Models: Attacks, Defenses and Future Directions","created":"2023-10-16","cited_by_count":51,"area":null},{"id":"2406.09324","title":"Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs","created":"2024-06-13","cited_by_count":51,"area":"safety"},{"id":"2410.01606","title":"Automated Red Teaming with GOAT: the Generative Offensive Agent Tester","created":"2024-10-02","cited_by_count":45,"area":"agents"},{"id":"2205.01287","title":"SemAttack: Natural Textual Attacks via Different Semantic Spaces","created":"2022-05-03","cited_by_count":42,"area":null},{"id":"2301.12868","title":"On Robustness of Prompt-based Semantic Parsing with Large Pre-trained Language Model: An Empirical Study on Codex","created":"2023-01-30","cited_by_count":41,"area":null},{"id":"2310.04444","title":"What's the Magic Word? A Control Theory of LLM Prompting","created":"2023-10-02","cited_by_count":41,"area":null},{"id":"2405.01229","title":"Boosting Jailbreak Attack with Momentum","created":"2024-05-02","cited_by_count":40,"area":"safety"},{"id":"2312.00027","title":"Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections","created":"2023-11-15","cited_by_count":39,"area":"safety"},{"id":"2402.11493","title":"Benchmarking Knowledge Boundary for Large Language Models: A Different Perspective on Model Evaluation","created":"2024-02-18","cited_by_count":38,"area":null},{"id":"2403.01251","title":"Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Sampling","created":"2024-03-02","cited_by_count":37,"area":"safety"},{"id":"2510.04885","title":"RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection","created":"2025-10-06","cited_by_count":36,"area":"agents"},{"id":"2405.19360","title":"ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Users","created":"2024-05-24","cited_by_count":35,"area":"safety"},{"id":"2409.00598","title":"Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Models","created":"2024-09-01","cited_by_count":35,"area":"alignment"},{"id":"2401.16656","title":"Gradient-Based Language Model Red Teaming","created":"2024-01-30","cited_by_count":34,"area":"safety"},{"id":"2504.00218","title":"$\\textit{Agents Under Siege}$: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks","created":"2025-03-31","cited_by_count":34,"area":"agents"},{"id":"2407.01606","title":"On Discrete Prompt Optimization for Diffusion Models","created":"2024-06-27","cited_by_count":29,"area":"diffusion"},{"id":"2110.15317","title":"Bridge the Gap Between CV and NLP! A Gradient-based Textual Adversarial Attack Framework","created":"2021-10-28","cited_by_count":28,"area":null},{"id":"2210.17004","title":"Character-level White-Box Adversarial Attacks against Transformers via Attachable Subwords Substitution","created":"2022-10-31","cited_by_count":28,"area":null},{"id":"2506.08123","title":"QA-LIGN: Aligning LLMs through Constitutionally Decomposed QA","created":"2025-06-09","cited_by_count":28,"area":"alignment"},{"id":"2306.02583","title":"Stable Diffusion is Unstable","created":"2023-06-05","cited_by_count":27,"area":"diffusion"},{"id":"2312.04782","title":"Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMs","created":"2023-12-08","cited_by_count":27,"area":null},{"id":"2406.11668","title":"\"Not Aligned\" is Not \"Malicious\": Being Careful about Hallucinations of Large Language Models' Jailbreak","created":"2024-06-17","cited_by_count":25,"area":"safety"},{"id":"2407.19200","title":"On Behalf of the Stakeholders: Trends in NLP Model Interpretability in the Era of LLMs","created":"2024-07-27","cited_by_count":25,"area":"mechinterp"},{"id":"2412.10321","title":"AdvPrefix: An Objective for Nuanced LLM Jailbreaks","created":"2024-12-13","cited_by_count":25,"area":"safety"},{"id":"2412.18693","title":"Diverse and Effective Red Teaming with Auto-generated Rewards and Multi-step Reinforcement Learning","created":"2024-12-24","cited_by_count":25,"area":"safety"},{"id":"2210.02912","title":"CANIFE: Crafting Canaries for Empirical Privacy Measurement in Federated Learning","created":"2022-10-06","cited_by_count":24,"area":null},{"id":"2404.07234","title":"Goal-guided Generative Prompt Injection Attack on Large Language Models","created":"2024-04-06","cited_by_count":24,"area":"safety"},{"id":"2408.01420","title":"Mission Impossible: A Statistical Perspective on Jailbreaking LLMs","created":"2024-08-02","cited_by_count":24,"area":"alignment"},{"id":"2503.01781","title":"Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Models","created":"2025-03-03","cited_by_count":23,"area":"lr"},{"id":"2212.09254","title":"TextGrad: Advancing Robustness Evaluation in NLP by Gradient-Driven Optimization","created":"2022-12-19","cited_by_count":21,"area":null},{"id":"2310.04445","title":"LoFT: Local Proxy Fine-tuning For Improving Transferability Of Adversarial Attacks Against Large Language Model","created":"2023-10-02","cited_by_count":21,"area":null},{"id":"2310.05264","title":"The Emergence of Reproducibility and Generalizability in Diffusion Models","created":"2023-10-08","cited_by_count":21,"area":"diffusion"},{"id":"2402.14859","title":"The Wolf Within: Covert Injection of Malice into MLLM Societies via an MLLM Operative","created":"2024-02-20","cited_by_count":21,"area":"agents"},{"id":"2405.02764","title":"Assessing Adversarial Robustness of Large Language Models: An Empirical Study","created":"2024-05-04","cited_by_count":21,"area":null},{"id":"2410.11459","title":"Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models","created":"2024-10-15","cited_by_count":19,"area":"lr"},{"id":"2506.07596","title":"TwinBreak: Jailbreaking LLM Security Alignments based on Twin Prompts","created":"2025-06-09","cited_by_count":19,"area":"safety"},{"id":"2402.07179","title":"Prompt Perturbation in Retrieval-Augmented Generation based Large Language Models","created":"2024-02-11","cited_by_count":18,"area":"rag"},{"id":"2405.09113","title":"Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization","created":"2024-05-15","cited_by_count":18,"area":"safety"},{"id":"2405.20778","title":"Improved Generation of Adversarial Examples Against Safety-aligned LLMs","created":"2024-05-28","cited_by_count":18,"area":"safety"},{"id":"2401.00529","title":"GraphGPT: Generative Pre-trained Graph Eulerian Transformer","created":"2023-12-31","cited_by_count":17,"area":null},{"id":"2503.10619","title":"Tempest: Autonomous Multi-Turn Jailbreaking of Large Language Models with Tree Search","created":"2025-03-13","cited_by_count":17,"area":"safety"},{"id":"2308.12636","title":"Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learning","created":"2023-08-24","cited_by_count":16,"area":"mllm"},{"id":"2402.01806","title":"HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Text","created":"2024-02-02","cited_by_count":16,"area":null},{"id":"2404.12274","title":"Advancing the Robustness of Large Language Models through Self-Denoised Smoothing","created":"2024-04-18","cited_by_count":16,"area":"safety"},{"id":"2405.02466","title":"ProFLingo: A Fingerprinting-based Intellectual Property Protection Scheme for Large Language Models","created":"2024-05-03","cited_by_count":16,"area":null},{"id":"2502.13141","title":"UniGuardian: A Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Models","created":"2025-02-18","cited_by_count":16,"area":"safety"},{"id":"2205.01094","title":"A Word is Worth A Thousand Dollars: Adversarial Attack on Tweets Fools Stock Predictions","created":"2022-05-01","cited_by_count":15,"area":null},{"id":"2307.16680","title":"On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlook","created":"2023-07-31","cited_by_count":15,"area":"diffusion"},{"id":"2404.17475","title":"CEval: A Benchmark for Evaluating Counterfactual Text Generation","created":"2024-04-26","cited_by_count":15,"area":null},{"id":"2502.17254","title":"REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective","created":"2025-02-24","cited_by_count":15,"area":"alignment"},{"id":"2305.03655","title":"White-Box Multi-Objective Adversarial Attack on Dialogue Generation","created":"2023-05-05","cited_by_count":14,"area":null},{"id":"2402.05467","title":"Rapid Optimization for Jailbreaking LLMs via Subconscious Exploitation and Echopraxia","created":"2024-02-08","cited_by_count":14,"area":"safety"},{"id":"2404.13660","title":"Trojan Detection in Large Language Models: Insights from The Trojan Detection Challenge","created":"2024-04-21","cited_by_count":14,"area":"safety"},{"id":"2502.04204","title":"Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidence","created":"2025-02-06","cited_by_count":14,"area":"safety"},{"id":"2407.11282","title":"Uncertainty is Fragile: Manipulating Uncertainty in Large Language Models","created":"2024-07-15","cited_by_count":13,"area":"safety"},{"id":"2407.19842","title":"Detecting and Understanding Vulnerabilities in Language Models via Mechanistic Interpretability","created":"2024-07-29","cited_by_count":13,"area":"mechinterp"},{"id":"2505.24445","title":"Learning Safety Constraints for Large Language Models","created":"2025-05-30","cited_by_count":13,"area":"safety"}],"next_cursor":"100"}