{"total":125,"rows":[{"id":"2307.02483","title":"Jailbroken: How Does LLM Safety Training Fail?","created":"2023-07-05","cited_by_count":1651,"area":"safety"},{"id":"2302.12173","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","created":"2023-02-23","cited_by_count":1443,"area":"safety"},{"id":"2312.02119","title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","created":"2023-12-04","cited_by_count":672,"area":"safety"},{"id":"2308.03825","title":"\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models","created":"2023-08-07","cited_by_count":489,"area":"safety"},{"id":"2310.06987","title":"Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation","created":"2023-10-10","cited_by_count":451,"area":"safety"},{"id":"2402.10260","title":"A StrongREJECT for Empty Jailbreaks","created":"2024-02-15","cited_by_count":385,"area":"safety"},{"id":"2304.05197","title":"Multi-step Jailbreaking Privacy Attacks on ChatGPT","created":"2023-04-11","cited_by_count":333,"area":"safety"},{"id":"2312.14197","title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models","created":"2023-12-21","cited_by_count":264,"area":"safety"},{"id":"2311.08268","title":"A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily","created":"2023-11-14","cited_by_count":259,"area":"safety"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2402.11753","title":"ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs","created":"2024-02-19","cited_by_count":216,"area":"safety"},{"id":"2310.10844","title":"Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks","created":"2023-10-16","cited_by_count":194,"area":"safety"},{"id":"2402.00888","title":"Security and Privacy Challenges of Large Language Models: A Survey","created":"2024-01-30","cited_by_count":186,"area":"safety"},{"id":"2402.08679","title":"COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability","created":"2024-02-13","cited_by_count":175,"area":"safety"},{"id":"2404.16873","title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","created":"2024-04-21","cited_by_count":156,"area":"safety"},{"id":"2405.21018","title":"Improved Techniques for Optimization-Based Jailbreaking on Large Language Models","created":"2024-05-31","cited_by_count":110,"area":"safety"},{"id":"2402.13457","title":"A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models","created":"2024-02-21","cited_by_count":106,"area":"safety"},{"id":"2402.05668","title":"JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs","created":"2024-02-08","cited_by_count":95,"area":"safety"},{"id":"2402.14020","title":"Coercing LLMs to do and reveal (almost) anything","created":"2024-02-21","cited_by_count":89,"area":"safety"},{"id":"2403.17336","title":"Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Models","created":"2024-03-26","cited_by_count":86,"area":"safety"},{"id":"2410.02832","title":"FlipAttack: Jailbreak LLMs via Flipping","created":"2024-10-02","cited_by_count":80,"area":"safety"},{"id":"2406.02622","title":"Safeguarding Large Language Models: A Survey","created":"2024-06-03","cited_by_count":78,"area":"safety"},{"id":"2310.12505","title":"Attack Prompt Generation for Red Teaming and Defending Large Language Models","created":"2023-10-19","cited_by_count":76,"area":"safety"},{"id":"2403.07865","title":"CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion","created":"2024-03-12","cited_by_count":76,"area":"safety"},{"id":"2311.16119","title":"Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition","created":"2023-10-24","cited_by_count":68,"area":"safety"},{"id":"2402.01822","title":"Building Guardrails for Large Language Models","created":"2024-02-02","cited_by_count":65,"area":"safety"},{"id":"2406.10794","title":"Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysis","created":"2024-06-16","cited_by_count":64,"area":"safety"},{"id":"2307.08487","title":"Latent Jailbreak: A Benchmark for Evaluating Text Safety and Output Robustness of Large Language Models","created":"2023-07-17","cited_by_count":60,"area":"safety"},{"id":"2308.10819","title":"Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injection","created":"2023-08-17","cited_by_count":59,"area":"safety"},{"id":"2308.01990","title":"From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?","created":"2023-08-03","cited_by_count":55,"area":"safety"},{"id":"2502.19820","title":"Foot-In-The-Door: A Multi-turn Jailbreak for LLMs","created":"2025-02-27","cited_by_count":54,"area":"safety"},{"id":"2402.14872","title":"Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs","created":"2024-02-21","cited_by_count":53,"area":"safety"},{"id":"2402.09674","title":"PAL: Proxy-Guided Black-Box Attack on Large Language Models","created":"2024-02-15","cited_by_count":50,"area":"safety"},{"id":"2305.14965","title":"Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreaks","created":"2023-05-24","cited_by_count":49,"area":"safety"},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2311.09948","title":"Hijacking Large Language Models via Adversarial In-Context Learning","created":"2023-11-16","cited_by_count":45,"area":"safety"},{"id":"2405.19103","title":"Voice Jailbreak Attacks Against GPT-4o","created":"2024-05-29","cited_by_count":42,"area":"safety"},{"id":"2312.00027","title":"Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections","created":"2023-11-15","cited_by_count":39,"area":"safety"},{"id":"2406.09289","title":"Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models","created":"2024-06-13","cited_by_count":37,"area":"safety"},{"id":"2402.09177","title":"Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks","created":"2024-02-14","cited_by_count":36,"area":"safety"},{"id":"2310.10077","title":"Prompt Packer: Deceiving LLMs through Compositional Instruction with Hidden Attacks","created":"2023-10-16","cited_by_count":35,"area":"safety"},{"id":"2502.12197","title":"A Closer Look at System Prompt Robustness","created":"2025-02-15","cited_by_count":32,"area":"safety"},{"id":"2402.00898","title":"An Early Categorization of Prompt Injection Attacks on Large Language Models","created":"2024-01-31","cited_by_count":30,"area":"safety"},{"id":"2407.02855","title":"From Theft to Bomb-Making: The Ripple Effect of Unlearning in Defending Against Jailbreak Attacks","created":"2024-07-03","cited_by_count":29,"area":"safety"},{"id":"2410.22284","title":"Embedding-based classifiers can detect prompt injection attacks","created":"2024-10-29","cited_by_count":27,"area":"safety"},{"id":"2408.04811","title":"h4rm3l: A language for Composable Jailbreak Attack Synthesis","created":"2024-08-09","cited_by_count":24,"area":"safety"},{"id":"2312.04127","title":"Analyzing the Inherent Response Tendency of LLMs: Real-World Instructions-Driven Jailbreak","created":"2023-12-07","cited_by_count":23,"area":"safety"},{"id":"2409.14866","title":"PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMs","created":"2024-09-23","cited_by_count":21,"area":"safety"},{"id":"2402.14857","title":"Is the System Message Really Important to Jailbreaks in Large Language Models?","created":"2024-02-20","cited_by_count":20,"area":"safety"},{"id":"2506.07596","title":"TwinBreak: Jailbreaking LLM Security Alignments based on Twin Prompts","created":"2025-06-09","cited_by_count":19,"area":"safety"},{"id":"2405.09113","title":"Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization","created":"2024-05-15","cited_by_count":18,"area":"safety"},{"id":"2407.02551","title":"Breach By A Thousand Leaks: Unsafe Information Leakage in `Safe' AI Responses","created":"2024-07-02","cited_by_count":18,"area":"safety"},{"id":"2505.21277","title":"Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space","created":"2025-05-27","cited_by_count":17,"area":"safety"},{"id":"2408.11006","title":"Security Attacks on LLM-based Code Completion Tools","created":"2024-08-20","cited_by_count":16,"area":"safety"},{"id":"2409.00137","title":"Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks","created":"2024-08-29","cited_by_count":16,"area":"safety"},{"id":"2409.11445","title":"Jailbreaking Large Language Models with Symbolic Mathematics","created":"2024-09-17","cited_by_count":16,"area":"safety"},{"id":"2409.15398","title":"Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI","created":"2024-09-23","cited_by_count":16,"area":"safety"},{"id":"2401.00991","title":"A Novel Evaluation Framework for Assessing Resilience Against Prompt Injection Attacks in Large Language Models","created":"2024-01-02","cited_by_count":15,"area":"safety"},{"id":"2511.15304","title":"Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models","created":"2025-11-19","cited_by_count":15,"area":"safety"},{"id":"2508.20848","title":"JADES: A Universal Framework for Jailbreak Assessment via Decompositional Scoring","created":"2025-08-28","cited_by_count":14,"area":"safety"},{"id":"2407.03876","title":"Automated Progressive Red Teaming","created":"2024-07-04","cited_by_count":13,"area":"safety"},{"id":"2410.11272","title":"Cognitive Overload Attack:Prompt Injection for Long Context","created":"2024-10-15","cited_by_count":13,"area":"safety"},{"id":"2509.01444","title":"Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructions","created":"2025-09-01","cited_by_count":11,"area":"safety"},{"id":"2512.05648","title":"Beyond Data Filtering: Knowledge Localization for Capability Removal in LLMs","created":"2025-12-05","cited_by_count":11,"area":"safety"},{"id":"2410.16527","title":"Insights and Current Gaps in Open-Source LLM Vulnerability Scanners: A Comparative Analysis","created":"2024-10-21","cited_by_count":10,"area":"safety"},{"id":"2504.21038","title":"Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Models","created":"2025-04-28","cited_by_count":10,"area":"safety"},{"id":"2407.17447","title":"FLRT: Fluent Student-Teacher Redteaming","created":"2024-07-24","cited_by_count":9,"area":"safety"},{"id":"2505.14316","title":"Exploring Jailbreak Attacks on LLMs through Intent Concealment and Diversion","created":"2025-05-20","cited_by_count":9,"area":"safety"},{"id":"2506.10022","title":"LLMs Caught in the Crossfire: Malware Requests and Jailbreak Challenges","created":"2025-06-09","cited_by_count":9,"area":"safety"},{"id":"2408.09326","title":"Characterizing and Evaluating the Reliability of LLMs against Jailbreak Attacks","created":"2024-08-18","cited_by_count":8,"area":"safety"},{"id":"2308.07847","title":"Robustness Over Time: Understanding Adversarial Examples' Effectiveness on Longitudinal Versions of Large Language Models","created":"2023-08-15","cited_by_count":7,"area":"safety"},{"id":"2308.11521","title":"Self-Deception: Reverse Penetrating the Semantic Firewall of Large Language Models","created":"2023-08-16","cited_by_count":7,"area":"safety"},{"id":"2404.08793","title":"JailbreakLens: Visual Analysis of Jailbreak Attacks Against Large Language Models","created":"2024-04-12","cited_by_count":7,"area":"safety"},{"id":"2410.15641","title":"SMILES-Prompting: A Novel Approach to LLM Jailbreak Attacks in Chemical Synthesis","created":"2024-10-21","cited_by_count":7,"area":"safety"},{"id":"2510.03417","title":"NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreaks","created":"2025-10-03","cited_by_count":7,"area":"safety"},{"id":"2601.05445","title":"Knowledge-Driven Multi-Turn Jailbreaking on Large Language Models","created":"2026-01-09","cited_by_count":7,"area":"safety"},{"id":"2405.12604","title":"Tiny Refinements Elicit Resilience: Toward Efficient Prefix-Model Against LLM Red-Teaming","created":"2024-05-21","cited_by_count":6,"area":"safety"},{"id":"2602.12418","title":"Sparse Autoencoders are Capable LLM Jailbreak Mitigators","created":"2026-02-12","cited_by_count":6,"area":"safety"},{"id":"2404.02532","title":"Learn to Disguise: Avoid Refusal Responses in LLM's Defense via a Multi-agent Attacker-Disguiser Game","created":"2024-04-03","cited_by_count":5,"area":"safety"},{"id":"2501.18280","title":"Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models","created":"2025-01-30","cited_by_count":5,"area":"safety"},{"id":"2510.13893","title":"Guarding the Guardrails: A Taxonomy-Driven Approach to Jailbreak Detection","created":"2025-10-14","cited_by_count":5,"area":"safety"},{"id":"2510.15476","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","created":"2025-10-17","cited_by_count":5,"area":"safety"},{"id":"2512.03771","title":"In-Context Representation Hijacking","created":"2025-12-03","cited_by_count":5,"area":"safety"},{"id":"2407.15009","title":"RogueGPT: dis-ethical tuning transforms ChatGPT4 into a Rogue AI in 158 Words","created":"2024-06-11","cited_by_count":4,"area":"safety"},{"id":"2411.01084","title":"Plentiful Jailbreaks with String Compositions","created":"2024-11-01","cited_by_count":4,"area":"safety"},{"id":"2510.05025","title":"Imperceptible Jailbreaking against Large Language Models","created":"2025-10-06","cited_by_count":4,"area":"safety"},{"id":"2510.08859","title":"Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models","created":"2025-10-09","cited_by_count":4,"area":"safety"},{"id":"2409.17699","title":"MoJE: Mixture of Jailbreak Experts, Naive Tabular Classifiers as Guard for Prompt Attacks","created":"2024-09-26","cited_by_count":3,"area":"safety"},{"id":"2503.06519","title":"Can Small Language Models Reliably Resist Jailbreak Attacks? A Comprehensive Evaluation","created":"2025-03-09","cited_by_count":3,"area":"safety"},{"id":"2601.03594","title":"Jailbreaking LLMs & VLMs: Mechanisms, Evaluation, and Unified Defense","created":"2026-01-07","cited_by_count":3,"area":"safety"},{"id":"2601.08837","title":"From Adversarial Poetry to Adversarial Tales: An Interpretability Research Agenda","created":"2025-12-16","cited_by_count":3,"area":"safety"},{"id":"2603.11914","title":"Understanding LLM Behavior When Encountering User-Supplied Harmful Content in Harmless Tasks","created":"2026-03-12","cited_by_count":3,"area":"safety"},{"id":"2604.18487","title":"Adversarial Humanities Benchmark: Results on Stylistic Robustness in Frontier Model Safety","created":"2026-04-20","cited_by_count":3,"area":"safety"},{"id":"2407.03045","title":"JailbreakHunter: A Visual Analytics Approach for Jailbreak Prompts Discovery from Large-Scale Human-LLM Conversational Datasets","created":"2024-07-03","cited_by_count":2,"area":"safety"},{"id":"2410.13236","title":"SPIN: Self-Supervised Prompt INjection","created":"2024-10-17","cited_by_count":2,"area":"safety"},{"id":"2502.19883","title":"Beyond the Tip of Efficiency: Uncovering the Submerged Threats of Jailbreak Attacks in Small Language Models","created":"2025-02-27","cited_by_count":2,"area":"safety"},{"id":"2504.09712","title":"The Structural Safety Generalization Problem","created":"2025-04-13","cited_by_count":2,"area":"safety"},{"id":"2504.19019","title":"Graph of Attacks: Improved Black-Box and Interpretable Jailbreaks for LLMs","created":"2025-04-26","cited_by_count":2,"area":"safety"},{"id":"2508.16484","title":"HAMSA: Hijacking Aligned Compact Models via Stealthy Automation","created":"2025-08-22","cited_by_count":2,"area":"safety"},{"id":"2509.16861","title":"AdaptiveGuard: Towards Adaptive Runtime Safety for LLM-Powered Software","created":"2025-09-21","cited_by_count":2,"area":"safety"}],"next_cursor":"100"}