{"total":113,"rows":[{"id":"2309.10253","title":"GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts","created":"2023-09-19","cited_by_count":560,"area":"safety"},{"id":"2404.01318","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","created":"2024-03-28","cited_by_count":536,"area":"safety"},{"id":"2406.18495","title":"WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs","created":"2024-06-26","cited_by_count":496,"area":"safety"},{"id":"2406.04313","title":"Improving Alignment and Robustness with Circuit Breakers","created":"2024-06-06","cited_by_count":322,"area":"safety"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2402.02207","title":"Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models","created":"2024-02-03","cited_by_count":167,"area":"safety"},{"id":"2510.14276","title":"Qwen3Guard Technical Report","created":"2025-10-16","cited_by_count":155,"area":"safety"},{"id":"2401.17256","title":"Weak-to-Strong Jailbreaking on Large Language Models","created":"2024-01-30","cited_by_count":107,"area":"safety"},{"id":"2405.14577","title":"Representation Noising: A Defence Mechanism Against Harmful Finetuning","created":"2024-05-23","cited_by_count":96,"area":"safety"},{"id":"2507.11878","title":"LLMs Encode Harmfulness and Refusal Separately","created":"2025-07-16","cited_by_count":88,"area":"safety"},{"id":"2401.15897","title":"Red-Teaming for Generative AI: Silver Bullet or Security Theater?","created":"2024-01-29","cited_by_count":83,"area":"safety"},{"id":"2406.02622","title":"Safeguarding Large Language Models: A Survey","created":"2024-06-03","cited_by_count":78,"area":"safety"},{"id":"2404.05399","title":"SafetyPrompts: a Systematic Review of Open Datasets for Evaluating and Improving Large Language Model Safety","created":"2024-04-08","cited_by_count":77,"area":"safety"},{"id":"2510.07192","title":"Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples","created":"2025-10-08","cited_by_count":72,"area":"safety"},{"id":"2402.01822","title":"Building Guardrails for Large Language Models","created":"2024-02-02","cited_by_count":65,"area":"safety"},{"id":"2506.07022","title":"AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraint","created":"2025-06-08","cited_by_count":49,"area":"safety"},{"id":"2406.09321","title":"JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Models","created":"2024-06-13","cited_by_count":31,"area":"safety"},{"id":"2407.02855","title":"From Theft to Bomb-Making: The Ripple Effect of Unlearning in Defending Against Jailbreak Attacks","created":"2024-07-03","cited_by_count":29,"area":"safety"},{"id":"2310.14303","title":"Language Model Unalignment: Parametric Red-Teaming to Expose Hidden Harms and Biases","created":"2023-10-22","cited_by_count":24,"area":"safety"},{"id":"2408.04811","title":"h4rm3l: A language for Composable Jailbreak Attack Synthesis","created":"2024-08-09","cited_by_count":24,"area":"safety"},{"id":"2506.14922","title":"FORTRESS: Frontier Risk Evaluation for National Security and Public Safety","created":"2025-06-17","cited_by_count":24,"area":"safety"},{"id":"2410.10414","title":"On Calibration of LLM-based Guard Models for Reliable Content Moderation","created":"2024-10-14","cited_by_count":23,"area":"safety"},{"id":"2503.00187","title":"Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attacks","created":"2025-02-28","cited_by_count":20,"area":"safety"},{"id":"2502.05163","title":"Enhancing LLM Safety Through a Theoretical Minimax Game Lens","created":"2025-02-07","cited_by_count":19,"area":"safety"},{"id":"2509.02563","title":"DynaGuard: A Dynamic Guardian Model With User-Defined Policies","created":"2025-09-02","cited_by_count":19,"area":"safety"},{"id":"2409.15398","title":"Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI","created":"2024-09-23","cited_by_count":16,"area":"safety"},{"id":"2510.27062","title":"Consistency Training Helps Stop Sycophancy and Jailbreaks","created":"2025-10-31","cited_by_count":16,"area":"safety"},{"id":"2410.06809","title":"Root Defence Strategies: Ensuring Safety of LLM at the Decoding Level","created":"2024-10-09","cited_by_count":11,"area":"safety"},{"id":"2505.16947","title":"MixAT: Combining Continuous and Discrete Adversarial Training for LLMs","created":"2025-05-22","cited_by_count":11,"area":"safety"},{"id":"2509.01444","title":"Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructions","created":"2025-09-01","cited_by_count":11,"area":"safety"},{"id":"2407.16318","title":"PrimeGuard: Safe and Helpful LLMs through Tuning-Free Routing","created":"2024-07-23","cited_by_count":10,"area":"safety"},{"id":"2505.12186","title":"Self-Destructive Language Model","created":"2025-05-18","cited_by_count":10,"area":"safety"},{"id":"2402.13926","title":"Large Language Models are Vulnerable to Bait-and-Switch Attacks for Generating Harmful Content","created":"2024-02-21","cited_by_count":9,"area":"safety"},{"id":"2502.15427","title":"Adversarial Prompt Evaluation: Systematic Benchmarking of Guardrails Against Prompt Input Attacks on LLMs","created":"2025-02-21","cited_by_count":9,"area":"safety"},{"id":"2408.09326","title":"Characterizing and Evaluating the Reliability of LLMs against Jailbreak Attacks","created":"2024-08-18","cited_by_count":8,"area":"safety"},{"id":"2505.10838","title":"LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs","created":"2025-05-16","cited_by_count":7,"area":"safety"},{"id":"2509.21947","title":"Active Attacks: Red-teaming LLMs via Adaptive Environments","created":"2025-09-26","cited_by_count":7,"area":"safety"},{"id":"2510.21910","title":"Adversarial D\\'ej\\`a Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attacks","created":"2025-10-24","cited_by_count":7,"area":"safety"},{"id":"2501.13677","title":"HumorReject: Decoupling LLM Safety from Refusal Prefix via A Little Humor","created":"2025-01-23","cited_by_count":6,"area":"safety"},{"id":"2506.07452","title":"When Style Breaks Safety: Defending LLMs Against Superficial Style Alignment","created":"2025-06-09","cited_by_count":6,"area":"safety"},{"id":"2508.11222","title":"ORFuzz: Fuzzing the \"Other Side\" of LLM Safety -- Testing Over-Refusal","created":"2025-08-15","cited_by_count":6,"area":"safety"},{"id":"2511.04316","title":"AdversariaLLM: A Unified and Modular Toolbox for LLM Robustness Research","created":"2025-11-06","cited_by_count":6,"area":"safety"},{"id":"2607.19829","title":"DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection","created":"2026-07-22","cited_by_count":6,"area":"safety"},{"id":"2505.21347","title":"OVERT: A Benchmark for Over-Refusal Evaluation on Text-to-Image Models","created":"2025-05-27","cited_by_count":5,"area":"safety"},{"id":"2511.14423","title":"Unified Defense for Large Language Models against Jailbreak and Fine-Tuning Attacks in Education","created":"2025-11-18","cited_by_count":5,"area":"safety"},{"id":"2511.22047","title":"Evaluating the Robustness of Large Language Model Safety Guardrails Against Adversarial Attacks","created":"2025-11-27","cited_by_count":5,"area":"safety"},{"id":"2502.16174","title":"Efficient LLM Moderation with Multi-Layer Latent Prototypes","created":"2025-02-22","cited_by_count":4,"area":"safety"},{"id":"2504.14985","title":"aiXamine: Simplified LLM Safety and Security","created":"2025-04-21","cited_by_count":4,"area":"safety"},{"id":"2508.12072","title":"Mitigating Jailbreaks with Intent-Aware LLMs","created":"2025-08-16","cited_by_count":4,"area":"safety"},{"id":"2604.21152","title":"Dialect vs Demographics: Quantifying LLM Bias from Implicit Linguistic Signals vs. Explicit User Profiles","created":"2026-04-22","cited_by_count":4,"area":"safety"},{"id":"2605.07982","title":"GLiGuard: Schema-Conditioned Classification for LLM Safeguard","created":"2026-05-08","cited_by_count":4,"area":"safety"},{"id":"2510.02999","title":"NonTextual Target Attack","created":"2025-10-03","cited_by_count":3,"area":"safety"},{"id":"2510.05310","title":"RAG Makes Guardrails Unsafe? Investigating Robustness of Guardrails under RAG-style Contexts","created":"2025-10-06","cited_by_count":3,"area":"safety"},{"id":"2601.03699","title":"RedBench: A Universal Dataset for Comprehensive Red Teaming of Large Language Models","created":"2026-01-07","cited_by_count":3,"area":"safety"},{"id":"2603.03323","title":"Discern Truth from Falsehood: Reducing Over-Refusal via Contrastive Refinement","created":"2026-02-10","cited_by_count":3,"area":"safety"},{"id":"2603.27412","title":"The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams","created":"2026-03-28","cited_by_count":3,"area":"safety"},{"id":"2604.17093","title":"HarmChip: Evaluating Hardware Security Centric LLM Safety via Jailbreak Benchmarking","created":"2026-04-18","cited_by_count":3,"area":"safety"},{"id":"2604.18487","title":"Adversarial Humanities Benchmark: Results on Stylistic Robustness in Frontier Model Safety","created":"2026-04-20","cited_by_count":3,"area":"safety"},{"id":"2605.12726","title":"Before the Last Token: Diagnosing Final-Token Safety Probe Failures","created":"2026-05-12","cited_by_count":3,"area":"safety"},{"id":"2507.05980","title":"Lost in Localization: Building RabakBench with Human-in-the-Loop Validation to Measure Multilingual Safety Gaps","created":"2025-07-08","cited_by_count":2,"area":"safety"},{"id":"2510.05169","title":"From Poisoned to Aware: Fostering Backdoor Self-Awareness in LLMs","created":"2025-10-05","cited_by_count":2,"area":"safety"},{"id":"2602.06911","title":"TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering","created":"2026-02-06","cited_by_count":2,"area":"safety"},{"id":"2603.02588","title":"ExpGuard: LLM Content Moderation in Specialized Domains","created":"2026-03-03","cited_by_count":2,"area":"safety"},{"id":"2606.02630","title":"MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety","created":"2026-05-30","cited_by_count":2,"area":"safety"},{"id":"2606.08044","title":"When Behavioral Safety Evaluation Fails: A Representation-Level Perspective","created":"2026-06-06","cited_by_count":2,"area":"safety"},{"id":"2607.12792","title":"Silent Alarm: A J-Space Protocol for Comparing Danger Recognition Across Models and Quantization Levels","created":"2026-07-14","cited_by_count":2,"area":"safety"},{"id":"2607.13075","title":"The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators","created":"2026-07-12","cited_by_count":2,"area":"safety"},{"id":"2607.18639","title":"Mark, Don't Erase: Token Inoculation for Dual-Use Knowledge in LLMs","created":"2026-07-21","cited_by_count":2,"area":"safety"},{"id":"2607.19806","title":"OPIUM: Mitigating Steering Externalities and Over-Refusal via Dual Objective Latent Optimization","created":"2026-07-22","cited_by_count":2,"area":"safety"},{"id":"2503.03502","title":"Geometry-Guided Adversarial Prompt Detection via Curvature and Local Intrinsic Dimension","created":"2025-03-05","cited_by_count":1,"area":"safety"},{"id":"2504.01533","title":"LightDefense: A Lightweight Uncertainty-Driven Defense against Jailbreaks via Shifted Token Distribution","created":"2025-04-02","cited_by_count":1,"area":"safety"},{"id":"2509.25843","title":"ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attack","created":"2025-09-30","cited_by_count":1,"area":"safety"},{"id":"2511.19009","title":"Understanding and Mitigating Over-refusal for Large Language Models via Representation Intervention","created":"2025-11-24","cited_by_count":1,"area":"safety"},{"id":"2605.01034","title":"A Theoretical Game of Attacks via Compositional Skills","created":"2026-05-01","cited_by_count":1,"area":"safety"},{"id":"2606.12342","title":"ALIGNBEAM : Inference-Time Alignment Transfer via Cross-Vocabulary Logit Mixing","created":"2026-06-10","cited_by_count":1,"area":"safety"},{"id":"2606.16527","title":"DoubtProbe: Black-Box Jailbreak Defense via Structural Verification and Semantic Auditing","created":"2026-06-15","cited_by_count":1,"area":"safety"},{"id":"2606.29887","title":"SafePyramid: A Hierarchical Benchmark for In-context Policy Guardrailing","created":"2026-06-29","cited_by_count":1,"area":"safety"},{"id":"2607.01277","title":"Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety","created":"2026-07-01","cited_by_count":1,"area":"safety"},{"id":"2608.03201","title":"When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models","created":"2026-08-04","cited_by_count":1,"area":"safety"},{"id":"2609.16204","title":"Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration","created":"2026-09-14","cited_by_count":1,"area":"safety"},{"id":"2609.25049","title":"Mitigating LLM Over-Refusal via Dynamic Semantic Routing Calibration","created":"2026-09-06","cited_by_count":1,"area":"safety"},{"id":"2609.29287","title":"AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks","created":"2026-09-24","cited_by_count":1,"area":"safety"},{"id":"2505.20841","title":"Concealment of Intent: A Game-Theoretic Analysis","created":"2025-05-27","cited_by_count":0,"area":"safety"},{"id":"2509.23381","title":"Guard Vector: Beyond English LLM Guardrails with Task-Vector Composition and Streaming-Aware Prefix SFT","created":"2025-09-27","cited_by_count":0,"area":"safety"},{"id":"2511.18933","title":"Defending Large Language Models Against Jailbreak Exploits with Responsible AI Considerations","created":"2025-11-24","cited_by_count":0,"area":"safety"},{"id":"2602.02027","title":"Light Alignment Improves LLM Safety via Model Self-Reflection with a Single Neuron","created":"2026-02-02","cited_by_count":0,"area":"safety"},{"id":"2602.02536","title":"From Sparse Decisions to Dense Reasoning: A Multi-attribute Trajectory Paradigm for Multimodal Moderation","created":"2026-01-28","cited_by_count":0,"area":"safety"},{"id":"2602.20102","title":"BarrierSteer: LLM Safety via Learning Barrier Steering","created":"2026-02-23","cited_by_count":0,"area":"safety"},{"id":"2605.02958","title":"Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detection","created":"2026-05-02","cited_by_count":0,"area":"safety"},{"id":"2605.06213","title":"Beyond Fixed Benchmarks and Worst-Case Attacks: Dynamic Boundary Evaluation for Language Models","created":"2026-05-07","cited_by_count":0,"area":"safety"},{"id":"2605.21539","title":"DualOptim+: Bridging Shared and Decoupled Optimizer States for Better Machine Unlearning in Large Language Models","created":"2026-05-20","cited_by_count":0,"area":"safety"},{"id":"2605.29659","title":"Opir: Efficient Multi-Task Safety Classification for Toxicity, Jailbreaks, Hate Speech, and Harmful Content","created":"2026-05-28","cited_by_count":0,"area":"safety"},{"id":"2606.16242","title":"Rapid Poison: Practical Poisoning Attacks Against the Rapid Response Framework","created":"2026-06-15","cited_by_count":0,"area":"safety"},{"id":"2606.26377","title":"Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats","created":"2026-06-24","cited_by_count":0,"area":"safety"},{"id":"2606.31748","title":"Addressing Over-Refusal in LLMs with Competing Rewards","created":"2026-06-30","cited_by_count":0,"area":"safety"},{"id":"2607.20472","title":"Robust Critics: Defending LLMs Against Multi-Turn Attacks","created":"2026-05-24","cited_by_count":0,"area":"safety"},{"id":"2607.21735","title":"What AI Red-Team Evaluations Can and Cannot Prove","created":"2026-07-23","cited_by_count":0,"area":"safety"},{"id":"2607.22926","title":"SAGE: Safety-First Defense-in-Depth Guardrails for Verified Lifecycle Control of High-Impact Generative AI","created":"2026-07-24","cited_by_count":0,"area":"safety"},{"id":"2607.24392","title":"When LLM Defenses Backfire: Characterizing Safety, Performance, and Cost Trade-offs","created":"2026-07-27","cited_by_count":0,"area":"safety"},{"id":"2608.08485","title":"HoloAegis: Frozen Representation, Topological Inference --- Minimally Parametric Safety Manifolds and Their Capability Boundaries for LLM Guardrails","created":"2026-08-09","cited_by_count":0,"area":"safety"}],"next_cursor":"100"}