{"total":102,"rows":[{"id":"2402.10260","title":"A StrongREJECT for Empty Jailbreaks","created":"2024-02-15","cited_by_count":385,"area":"safety"},{"id":"2309.02705","title":"Certifying LLM Safety against Adversarial Prompting","created":"2023-09-06","cited_by_count":266,"area":"safety"},{"id":"2405.15589","title":"Efficient Adversarial Training in LLMs with Continuous Attacks","created":"2024-05-24","cited_by_count":113,"area":"safety"},{"id":"2306.04618","title":"Revisiting Out-of-distribution Robustness in NLP: Benchmark, Analysis, and LLMs Evaluations","created":"2023-06-07","cited_by_count":97,"area":null},{"id":"2412.03556","title":"Best-of-N Jailbreaking","created":"2024-12-04","cited_by_count":76,"area":"safety"},{"id":"2404.12038","title":"Uncovering Safety Risks of Large Language Models through Concept Activation Vector","created":"2024-04-18","cited_by_count":67,"area":"alignment"},{"id":"2211.00151","title":"A Close Look into the Calibration of Pre-trained Language Models","created":"2022-10-31","cited_by_count":57,"area":null},{"id":"2504.01550","title":"Representation Bending for Large Language Model Safety","created":"2025-04-02","cited_by_count":30,"area":"safety"},{"id":"2306.13103","title":"Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attacks","created":"2023-06-16","cited_by_count":24,"area":"diffusion"},{"id":"2305.15587","title":"How do humans perceive adversarial text? A reality check on the validity and naturalness of word-based adversarial attacks","created":"2023-05-24","cited_by_count":18,"area":null},{"id":"2505.18325","title":"Understanding and Mitigating Overrefusal in LLMs from an Unveiling Perspective of Safety Decision Boundary","created":"2025-05-23","cited_by_count":18,"area":"safety"},{"id":"2402.01806","title":"HQA-Attack: Toward High Quality Black-Box Hard-Label Adversarial Attack on Text","created":"2024-02-02","cited_by_count":16,"area":null},{"id":"2406.02378","title":"On the Intrinsic Self-Correction Capability of LLMs: Uncertainty and Latent Concept","created":"2024-06-04","cited_by_count":16,"area":null},{"id":"2409.15398","title":"Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI","created":"2024-09-23","cited_by_count":16,"area":"safety"},{"id":"2507.11316","title":"Internal Value Alignment in Large Language Models through Controlled Value Vector Activation","created":"2025-07-15","cited_by_count":16,"area":"alignment"},{"id":"2402.05467","title":"Rapid Optimization for Jailbreaking LLMs via Subconscious Exploitation and Echopraxia","created":"2024-02-08","cited_by_count":14,"area":"safety"},{"id":"2507.21182","title":"SDD: Self-Degraded Defense against Malicious Fine-tuning","created":"2025-07-27","cited_by_count":13,"area":"alignment"},{"id":"2606.18829","title":"GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents","created":"2026-06-17","cited_by_count":13,"area":"agents"},{"id":"2310.09624","title":"ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models","created":"2023-10-14","cited_by_count":12,"area":"safety"},{"id":"2311.11861","title":"Generating Valid and Natural Adversarial Examples with Large Language Models","created":"2023-11-20","cited_by_count":12,"area":null},{"id":"2502.16903","title":"GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods","created":"2025-02-24","cited_by_count":12,"area":"safety"},{"id":"2505.16004","title":"Evaluating Adversarial Robustness of Concept Representations in Sparse Autoencoders","created":"2025-05-21","cited_by_count":12,"area":"mechinterp"},{"id":"2505.19598","title":"Evaluating Robustness of Large Audio Language Models to Audio Injection: An Empirical Study","created":"2025-05-26","cited_by_count":12,"area":null},{"id":"2412.19512","title":"Safeguard Fine-Tuned LLMs Through Pre- and Post-Tuning Model Merging","created":"2024-12-27","cited_by_count":11,"area":null},{"id":"2504.17884","title":"Unsupervised Corpus Poisoning Attacks in Continuous Space for Dense Retrieval","created":"2025-04-24","cited_by_count":11,"area":null},{"id":"2507.22171","title":"Enhancing Jailbreak Attacks on LLMs via Persona Prompts","created":"2025-07-28","cited_by_count":11,"area":"safety"},{"id":"2512.11391","title":"Mitigating the Safety Alignment Tax with Null-Space Constrained Policy Optimization","created":"2025-12-12","cited_by_count":11,"area":"alignment"},{"id":"2512.12069","title":"Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring","created":"2025-12-12","cited_by_count":11,"area":"lr"},{"id":"2310.18360","title":"Guiding LLM to Fool Itself: Automatically Manipulating Machine Reading Comprehension Shortcut Triggers","created":"2023-10-24","cited_by_count":10,"area":null},{"id":"2506.10022","title":"LLMs Caught in the Crossfire: Malware Requests and Jailbreak Challenges","created":"2025-06-09","cited_by_count":9,"area":"safety"},{"id":"2303.08032","title":"Verifying the Robustness of Automatic Credibility Assessment","created":"2023-03-14","cited_by_count":8,"area":null},{"id":"2405.20192","title":"TAIA: Large Language Models are Out-of-Distribution Data Learners","created":"2024-05-30","cited_by_count":8,"area":null},{"id":"2507.21134","title":"TRIDENT: Benchmarking LLM Safety in Finance, Medicine, and Law","created":"2025-07-22","cited_by_count":8,"area":"safety"},{"id":"2601.06884","title":"Paraphrasing Adversarial Attack on LLM-as-a-Reviewer","created":"2026-01-11","cited_by_count":8,"area":null},{"id":"2507.21820","title":"Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Is","created":"2025-07-29","cited_by_count":7,"area":"safety"},{"id":"2310.14265","title":"CT-GAT: Cross-Task Generative Adversarial Attack based on Transferability","created":"2023-10-22","cited_by_count":6,"area":null},{"id":"2407.14644","title":"Human-Interpretable Adversarial Prompt Attack on Large Language Models with Situational Context","created":"2024-07-19","cited_by_count":6,"area":"safety"},{"id":"2505.23473","title":"EVOREFUSE: Evolutionary Prompt Optimization for Evaluation and Mitigation of LLM Over-Refusal to Pseudo-Malicious Instructions","created":"2025-05-29","cited_by_count":6,"area":"alignment"},{"id":"2510.10265","title":"Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models","created":"2025-10-11","cited_by_count":6,"area":"safety"},{"id":"2402.05723","title":"In-Context Learning Can Re-learn Forbidden Tasks","created":"2024-02-08","cited_by_count":5,"area":"safety"},{"id":"2502.04602","title":"Extracting and Understanding the Superficial Knowledge in Alignment","created":"2025-02-07","cited_by_count":5,"area":"alignment"},{"id":"2507.06043","title":"CAVGAN: Unifying Jailbreak and Defense of LLMs via Generative Adversarial Attacks on their Internal Representations","created":"2025-07-08","cited_by_count":5,"area":"safety"},{"id":"2509.10931","title":"Harmful Prompt Laundering: Jailbreaking LLMs with Abductive Styles and Symbolic Encoding","created":"2025-09-13","cited_by_count":5,"area":"safety"},{"id":"2510.04891","title":"SocialHarmBench: Revealing LLM Vulnerabilities to Socially Harmful Requests","created":"2025-10-06","cited_by_count":5,"area":"safety"},{"id":"2601.13518","title":"AgenticRed: Evolving Agentic Systems for Red-Teaming","created":"2026-01-20","cited_by_count":5,"area":"agents"},{"id":"2410.08776","title":"FATS: A Prompt Injection Attack Utilizing Feign Security Agents with Deceptive Few-shots Learning","created":"2024-10-11","cited_by_count":4,"area":"agents"},{"id":"2503.24191","title":"When Grammar Guides the Attack: Uncovering Control-Plane Vulnerabilities in LLMs with Structured Output","created":"2025-03-31","cited_by_count":4,"area":"safety"},{"id":"2504.02725","title":"SAFER: Advancing Safety Alignment via Efficient Ex-Ante Reasoning","created":"2025-04-03","cited_by_count":4,"area":"lr"},{"id":"2505.24672","title":"TRIDENT: Enhancing Large Language Model Safety with Tri-Dimensional Diversified Red-Teaming Data Synthesis","created":"2025-05-30","cited_by_count":4,"area":"synth"},{"id":"2508.15182","title":"SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks","created":"2025-08-21","cited_by_count":4,"area":"safety"},{"id":"2510.16893","title":"Investigating Safety Vulnerabilities of Large Audio-Language Models Under Speaker Emotional Variations","created":"2025-10-19","cited_by_count":4,"area":null},{"id":"2602.01600","title":"Expected Harm: Rethinking Safety Evaluation of (Mis)Aligned LLMs","created":"2026-02-02","cited_by_count":4,"area":"lr"},{"id":"2211.15363","title":"On the Security Vulnerabilities of Text-to-SQL Models","created":"2022-11-28","cited_by_count":3,"area":null},{"id":"2305.18503","title":"From Adversarial Arms Race to Model-centric Evaluation: Motivating a Unified Automatic Robustness Evaluation Framework","created":"2023-05-29","cited_by_count":3,"area":null},{"id":"2306.05659","title":"COVER: A Heuristic Greedy Adversarial Attack on Prompt-based Learning in Language Models","created":"2023-06-09","cited_by_count":3,"area":null},{"id":"2311.17429","title":"TARGET: Template-Transferable Backdoor Attack Against Prompt-based NLP Models via GPT4","created":"2023-11-29","cited_by_count":3,"area":"safety"},{"id":"2412.16359","title":"Human-Readable Adversarial Prompts: An Investigation into LLM Vulnerabilities Using Situational Context","created":"2024-12-20","cited_by_count":3,"area":"safety"},{"id":"2512.24044","title":"Jailbreaking Attacks vs. Content Safety Filters: How Far Are We in the LLM Safety Arms Race?","created":"2025-12-30","cited_by_count":3,"area":"safety"},{"id":"2602.07652","title":"Agent-Fence: Mapping Security Vulnerabilities Across Deep Research Agents","created":"2026-02-07","cited_by_count":3,"area":"agents"},{"id":"2606.29604","title":"Mechanistically Eliciting Latent Behaviors in Language Models","created":"2026-06-28","cited_by_count":3,"area":null},{"id":"2303.10974","title":"Translate your gibberish: black-box adversarial attack on machine translation systems","created":"2023-03-20","cited_by_count":2,"area":null},{"id":"2408.00728","title":"CERT-ED: Certifiably Robust Text Classification for Edit Distance","created":"2024-08-01","cited_by_count":2,"area":null},{"id":"2412.02371","title":"TSCheater: Generating High-Quality Tibetan Adversarial Texts via Visual Similarity","created":"2024-12-03","cited_by_count":2,"area":null},{"id":"2412.12478","title":"Human-in-the-Loop Generation of Adversarial Texts: A Case Study on Tibetan Script","created":"2024-12-17","cited_by_count":2,"area":null},{"id":"2501.01741","title":"How Toxic Can You Get? Search-based Toxicity Testing for Large Language Models","created":"2025-01-03","cited_by_count":2,"area":null},{"id":"2503.11619","title":"Tit-for-Tat: Safeguarding Large Vision-Language Models Against Jailbreak Attacks via Adversarial Defense","created":"2025-03-14","cited_by_count":2,"area":"safety"},{"id":"2506.20251","title":"Q-resafe: Assessing Safety Risks and Quantization-aware Safety Patching for Quantized Large Language Models","created":"2025-06-25","cited_by_count":2,"area":null},{"id":"2507.21750","title":"Adversarial Defence without Adversarial Defence: Enhancing Language Model Robustness via Instance-level Principal Component Removal","created":"2025-07-29","cited_by_count":2,"area":null},{"id":"2509.23783","title":"Falcon: A Cross-Modal Evaluation Dataset for Comprehensive Safety Perception","created":"2025-09-28","cited_by_count":2,"area":null},{"id":"2604.12616","title":"Every Picture Tells a Dangerous Story: Memory-Augmented Multi-Agent Jailbreak Attacks on VLMs","created":"2026-04-14","cited_by_count":2,"area":"mllm"},{"id":"2504.13551","title":"Q-FAKER: Query-free Hard Black-box Attack via Controlled Generation","created":"2025-04-18","cited_by_count":1,"area":null},{"id":"2509.23882","title":"Quant Fever, Reasoning Blackholes, Schrodinger's Compliance, and More: Probing GPT-OSS-20B","created":"2025-09-28","cited_by_count":1,"area":"lr"},{"id":"2510.07290","title":"On the Convergence of Moral Self-Correction in Large Language Models","created":"2025-10-08","cited_by_count":1,"area":null},{"id":"2510.15430","title":"Learning to Detect Unknown Jailbreak Attacks in Large Vision-Language Models","created":"2025-10-17","cited_by_count":1,"area":"mllm"},{"id":"2603.19127","title":"On Optimizing Multimodal Jailbreaks for Spoken Language Models","created":"2026-03-19","cited_by_count":1,"area":"safety"},{"id":"2604.25921","title":"One Word at a Time: Incremental Completion Decomposition Breaks LLM Safety","created":"2026-04-01","cited_by_count":1,"area":"safety"},{"id":"2606.02640","title":"D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting","created":"2026-05-31","cited_by_count":1,"area":"safety"},{"id":"2606.19887","title":"FinRED: An Expert-Guided Benchmark Generation and Evaluation Framework for Financial LLM Red-Teaming","created":"2026-06-18","cited_by_count":1,"area":"safety"},{"id":"2607.26849","title":"ToxScreen: Detecting Whether an LLM Has Been Poisoned","created":"2026-07-29","cited_by_count":1,"area":"safety"},{"id":"2608.06202","title":"What Current AI Benchmarks Leave Unmeasured: Modality, Search, Citations, and Implications (for Safety Evaluations)","created":"2026-08-06","cited_by_count":1,"area":null},{"id":"2608.16553","title":"STAGE: Controlled Objective Admission for Multi-Preference LLM Alignment","created":"2026-08-17","cited_by_count":1,"area":"alignment"},{"id":"2307.11316","title":"Making Pre-trained Language Models both Task-solvers and Self-calibrators","created":"2023-07-21","cited_by_count":0,"area":null},{"id":"2406.11682","title":"Knowledge-to-Jailbreak: Investigating Knowledge-driven Jailbreaking Attacks for Large Language Models","created":"2024-06-17","cited_by_count":0,"area":"safety"},{"id":"2505.16888","title":"PARASITE: Conditional System Prompt Poisoning to Hijack LLMs","created":"2025-05-22","cited_by_count":0,"area":null},{"id":"2506.13955","title":"Bridging Unsupervised and Semi-Supervised Anomaly Detection: A Theoretically-Grounded and Practical Framework with Synthetic Anomalies","created":"2025-06-16","cited_by_count":0,"area":null},{"id":"2508.12897","title":"RAJ-PGA: Reasoning-Activated Jailbreak and Principle-Guided Alignment Framework for Large Reasoning Models","created":"2025-08-18","cited_by_count":0,"area":"lr"},{"id":"2511.09316","title":"AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness","created":"2025-11-12","cited_by_count":0,"area":null},{"id":"2601.01747","title":"Crafting Adversarial Inputs for Large Vision-Language Models Using Black-Box Optimization","created":"2026-01-05","cited_by_count":0,"area":"mllm"},{"id":"2601.22169","title":"In Vino Veritas and Vulnerabilities: Examining LLM Safety via Drunk Language Inducement","created":"2026-01-19","cited_by_count":0,"area":"safety"},{"id":"2602.17546","title":"Learning to Stay Safe: Adaptive Regularization Against Safety Degradation during Fine-Tuning","created":"2026-02-19","cited_by_count":0,"area":null},{"id":"2603.02675","title":"From Shallow to Deep: Pinning Semantic Intent via Causal GRPO","created":"2026-03-03","cited_by_count":0,"area":"lr"},{"id":"2603.04992","title":"ThaiSafetyBench: Assessing Language Model Safety in Thai Cultural Contexts","created":"2026-03-05","cited_by_count":0,"area":"safety"},{"id":"2604.00324","title":"The Persistent Vulnerability of Aligned AI Systems","created":"2026-03-31","cited_by_count":0,"area":null},{"id":"2605.13411","title":"Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution","created":"2026-05-13","cited_by_count":0,"area":"safety"},{"id":"2605.24958","title":"SEP-Attack: A Simple and Effective Paradigm for Transfer-Based Textual Adversarial Attack","created":"2026-05-24","cited_by_count":0,"area":null},{"id":"2606.00686","title":"Dialectics of Alignment: Harnessing Unsafe Knowledge for Dynamic Safety Routing","created":"2026-05-30","cited_by_count":0,"area":"moe"},{"id":"2606.16808","title":"Adaptive and Explicit safe: Triggering Latent Safety Awareness in Large Reasoning Models","created":"2026-06-15","cited_by_count":0,"area":"lr"},{"id":"2606.29602","title":"An Empirical Evaluation of Prompt Injection Vulnerabilities in Large Language Models Across Multilingual and Obfuscated Attack Scenarios","created":"2026-06-28","cited_by_count":0,"area":"safety"},{"id":"2607.03456","title":"SentAttack: A Sentence-Level Black-Box Adversarial Attack Method for Dense Retrieval Models","created":"2026-07-03","cited_by_count":0,"area":"rag"},{"id":"2608.22312","title":"Text-Anchored Semantic Perturbations for Transferable Jailbreak Attacks on Multimodal Large Language Models","created":"2026-08-23","cited_by_count":0,"area":"mllm"}],"next_cursor":"100"}