{"total":329,"rows":[{"id":"2402.04249","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","created":"2024-02-06","cited_by_count":1429,"area":"safety"},{"id":"2406.11717","title":"Refusal in Language Models Is Mediated by a Single Direction","created":"2024-06-17","cited_by_count":1032,"area":"safety"},{"id":"2312.02119","title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","created":"2023-12-04","cited_by_count":672,"area":"safety"},{"id":"2404.01318","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","created":"2024-03-28","cited_by_count":536,"area":"safety"},{"id":"2404.02151","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","created":"2024-04-02","cited_by_count":486,"area":"safety"},{"id":"2310.03684","title":"SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks","created":"2023-10-05","cited_by_count":469,"area":"safety"},{"id":"2404.01833","title":"Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack","created":"2024-04-02","cited_by_count":390,"area":"safety"},{"id":"2402.06363","title":"StruQ: Defending Against Prompt Injection with Structured Queries","created":"2024-02-09","cited_by_count":375,"area":"safety"},{"id":"2311.03191","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","created":"2023-11-06","cited_by_count":367,"area":"safety"},{"id":"2406.04313","title":"Improving Alignment and Robustness with Circuit Breakers","created":"2024-06-06","cited_by_count":322,"area":"safety"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2311.03348","title":"Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation","created":"2023-11-06","cited_by_count":214,"area":"safety"},{"id":"2402.16822","title":"Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Prompts","created":"2024-02-26","cited_by_count":205,"area":"safety"},{"id":"2410.05295","title":"AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs","created":"2024-10-03","cited_by_count":199,"area":"safety"},{"id":"2402.08679","title":"COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability","created":"2024-02-13","cited_by_count":175,"area":"safety"},{"id":"2407.15549","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","created":"2024-07-22","cited_by_count":173,"area":"safety"},{"id":"2404.07921","title":"AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs","created":"2024-04-11","cited_by_count":172,"area":"safety"},{"id":"2401.17263","title":"Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks","created":"2024-01-30","cited_by_count":156,"area":"safety"},{"id":"2408.00761","title":"Tamper-Resistant Safeguards for Open-Weight LLMs","created":"2024-08-01","cited_by_count":138,"area":"safety"},{"id":"2403.04957","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","created":"2024-03-07","cited_by_count":119,"area":"safety"},{"id":"2401.18018","title":"On Prompt-Driven Safeguarding for Large Language Models","created":"2024-01-31","cited_by_count":116,"area":"safety"},{"id":"2405.15589","title":"Efficient Adversarial Training in LLMs with Continuous Attacks","created":"2024-05-24","cited_by_count":113,"area":"safety"},{"id":"2405.21018","title":"Improved Techniques for Optimization-Based Jailbreaking on Large Language Models","created":"2024-05-31","cited_by_count":110,"area":"safety"},{"id":"2401.17256","title":"Weak-to-Strong Jailbreaking on Large Language Models","created":"2024-01-30","cited_by_count":107,"area":"safety"},{"id":"2312.17673","title":"Jatmo: Prompt Injection Defense by Task-Specific Finetuning","created":"2023-12-29","cited_by_count":106,"area":"safety"},{"id":"2402.14020","title":"Coercing LLMs to do and reveal (almost) anything","created":"2024-02-21","cited_by_count":89,"area":"safety"},{"id":"2402.15570","title":"Fast Adversarial Attacks on Language Models In One GPU Minute","created":"2024-02-23","cited_by_count":88,"area":"safety"},{"id":"2410.02832","title":"FlipAttack: Jailbreak LLMs via Flipping","created":"2024-10-02","cited_by_count":80,"area":"safety"},{"id":"2407.11969","title":"Does Refusal Training in LLMs Generalize to the Past Tense?","created":"2024-07-16","cited_by_count":79,"area":"safety"},{"id":"2406.02622","title":"Safeguarding Large Language Models: A Survey","created":"2024-06-03","cited_by_count":78,"area":"safety"},{"id":"2412.03556","title":"Best-of-N Jailbreaking","created":"2024-12-04","cited_by_count":76,"area":"safety"},{"id":"2403.00867","title":"Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes","created":"2024-03-01","cited_by_count":74,"area":"safety"},{"id":"2410.13708","title":"On the Role of Attention Heads in Large Language Model Safety","created":"2024-10-17","cited_by_count":72,"area":"safety"},{"id":"2406.01288","title":"Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses","created":"2024-06-03","cited_by_count":70,"area":"safety"},{"id":"2410.18927","title":"SafeBench: A Safety Evaluation Framework for Multimodal Large Language Models","created":"2024-10-24","cited_by_count":69,"area":"safety"},{"id":"2403.13031","title":"RigorLLM: Resilient Guardrails for Large Language Models against Undesired Content","created":"2024-03-19","cited_by_count":68,"area":"safety"},{"id":"2405.20773","title":"Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character","created":"2024-05-25","cited_by_count":68,"area":"safety"},{"id":"2406.05498","title":"SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Manner","created":"2024-06-08","cited_by_count":63,"area":"safety"},{"id":"2405.18540","title":"Learning diverse attacks on large language models for robust red-teaming and safety tuning","created":"2024-05-28","cited_by_count":54,"area":"safety"},{"id":"2402.14872","title":"Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs","created":"2024-02-21","cited_by_count":53,"area":"safety"},{"id":"2404.05880","title":"Eraser: Jailbreaking Defense in Large Language Models via Unlearning Harmful Knowledge","created":"2024-04-08","cited_by_count":51,"area":"safety"},{"id":"2406.09324","title":"Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs","created":"2024-06-13","cited_by_count":51,"area":"safety"},{"id":"2312.12321","title":"Bypassing the Safety Training of Open-Source LLMs with Priming Attacks","created":"2023-12-19","cited_by_count":50,"area":"safety"},{"id":"2402.09674","title":"PAL: Proxy-Guided Black-Box Attack on Large Language Models","created":"2024-02-15","cited_by_count":50,"area":"safety"},{"id":"2506.07022","title":"AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraint","created":"2025-06-08","cited_by_count":49,"area":"safety"},{"id":"2406.08705","title":"When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search","created":"2024-06-13","cited_by_count":47,"area":"safety"},{"id":"2501.01765","title":"SaLoRA: Safety-Alignment Preserved Low-Rank Adaptation","created":"2025-01-03","cited_by_count":42,"area":"safety"},{"id":"2502.07218","title":"LLM Unlearning via Neural Activation Redirection","created":"2025-02-11","cited_by_count":41,"area":"safety"},{"id":"2405.01229","title":"Boosting Jailbreak Attack with Momentum","created":"2024-05-02","cited_by_count":40,"area":"safety"},{"id":"2406.06302","title":"Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attacks","created":"2024-06-10","cited_by_count":38,"area":"safety"},{"id":"2412.08608","title":"AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models","created":"2024-12-11","cited_by_count":38,"area":"safety"},{"id":"2405.20099","title":"Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attacks","created":"2024-05-30","cited_by_count":37,"area":"safety"},{"id":"2506.09443","title":"LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge","created":"2025-06-11","cited_by_count":37,"area":"safety"},{"id":"2402.09177","title":"Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks","created":"2024-02-14","cited_by_count":36,"area":"safety"},{"id":"2405.19360","title":"ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Users","created":"2024-05-24","cited_by_count":35,"area":"safety"},{"id":"2503.07885","title":"Safety Guardrails for LLM-Enabled Robots","created":"2025-03-10","cited_by_count":35,"area":"safety"},{"id":"2410.15236","title":"Jailbreaking and Mitigation of Vulnerabilities in Large Language Models","created":"2024-10-20","cited_by_count":34,"area":"safety"},{"id":"2410.09040","title":"AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation","created":"2024-10-11","cited_by_count":33,"area":"safety"},{"id":"2411.09259","title":"Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey","created":"2024-11-14","cited_by_count":32,"area":"safety"},{"id":"2406.09321","title":"JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Models","created":"2024-06-13","cited_by_count":31,"area":"safety"},{"id":"2409.08045","title":"Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking","created":"2024-09-12","cited_by_count":30,"area":"safety"},{"id":"2404.13968","title":"Protecting Your LLMs with Information Bottleneck","created":"2024-04-22","cited_by_count":29,"area":"safety"},{"id":"2407.02855","title":"From Theft to Bomb-Making: The Ripple Effect of Unlearning in Defending Against Jailbreak Attacks","created":"2024-07-03","cited_by_count":29,"area":"safety"},{"id":"2411.03343","title":"What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks","created":"2024-11-02","cited_by_count":29,"area":"safety"},{"id":"2504.10694","title":"The Jailbreak Tax: How Useful are Your Jailbreak Outputs?","created":"2025-04-14","cited_by_count":28,"area":"safety"},{"id":"2406.06622","title":"Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs","created":"2024-06-07","cited_by_count":26,"area":"safety"},{"id":"2412.10321","title":"AdvPrefix: An Objective for Nuanced LLM Jailbreaks","created":"2024-12-13","cited_by_count":25,"area":"safety"},{"id":"2410.02298","title":"Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models","created":"2024-10-03","cited_by_count":23,"area":"safety"},{"id":"2410.10414","title":"On Calibration of LLM-based Guard Models for Reliable Content Moderation","created":"2024-10-14","cited_by_count":23,"area":"safety"},{"id":"2411.01077","title":"Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection","created":"2024-11-01","cited_by_count":23,"area":"safety"},{"id":"2504.07887","title":"Benchmarking Adversarial Robustness to Bias Elicitation in Large Language Models: Scalable Automated Assessment with LLM-as-a-Judge","created":"2025-04-10","cited_by_count":23,"area":"safety"},{"id":"2407.20224","title":"Can Editing LLMs Inject Harm?","created":"2024-07-29","cited_by_count":22,"area":"safety"},{"id":"2411.11114","title":"JailbreakLens: Interpreting Jailbreak Mechanism in the Lens of Representation and Circuit","created":"2024-11-17","cited_by_count":22,"area":"safety"},{"id":"2502.03052","title":"Understanding and Enhancing the Transferability of Jailbreaking Attacks","created":"2025-02-05","cited_by_count":22,"area":"safety"},{"id":"2311.06237","title":"Summon a Demon and Bind it: A Grounded Theory of LLM Red Teaming","created":"2023-11-10","cited_by_count":21,"area":"safety"},{"id":"2409.14866","title":"PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMs","created":"2024-09-23","cited_by_count":21,"area":"safety"},{"id":"2410.19937","title":"RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Eviction","created":"2024-10-25","cited_by_count":21,"area":"safety"},{"id":"2503.00187","title":"Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attacks","created":"2025-02-28","cited_by_count":20,"area":"safety"},{"id":"2410.01294","title":"Endless Jailbreaks with Bijection Learning","created":"2024-10-02","cited_by_count":19,"area":"safety"},{"id":"2506.07596","title":"TwinBreak: Jailbreaking LLM Security Alignments based on Twin Prompts","created":"2025-06-09","cited_by_count":19,"area":"safety"},{"id":"2405.09113","title":"Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization","created":"2024-05-15","cited_by_count":18,"area":"safety"},{"id":"2405.20778","title":"Improved Generation of Adversarial Examples Against Safety-aligned LLMs","created":"2024-05-28","cited_by_count":18,"area":"safety"},{"id":"2503.00596","title":"BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judge","created":"2025-03-01","cited_by_count":18,"area":"safety"},{"id":"2505.14103","title":"AudioJailbreak: Jailbreak Attacks against End-to-End Large Audio-Language Models","created":"2025-05-20","cited_by_count":18,"area":"safety"},{"id":"2409.14729","title":"PROMPTFUZZ: Harnessing Fuzzing Techniques for Robust Testing of Prompt Injection in LLMs","created":"2024-09-23","cited_by_count":17,"area":"safety"},{"id":"2501.09798","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","created":"2025-01-16","cited_by_count":17,"area":"safety"},{"id":"2510.21189","title":"Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency","created":"2025-10-24","cited_by_count":17,"area":"safety"},{"id":"2405.14189","title":"Efficient Universal Goal Hijacking with Semantics-guided Prompt Organization","created":"2024-05-23","cited_by_count":16,"area":"safety"},{"id":"2409.15398","title":"Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI","created":"2024-09-23","cited_by_count":16,"area":"safety"},{"id":"2601.07072","title":"Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems","created":"2026-01-11","cited_by_count":16,"area":"safety"},{"id":"2412.03235","title":"Does Safety Training of LLMs Generalize to Semantically Related Natural Prompts?","created":"2024-12-04","cited_by_count":15,"area":"safety"},{"id":"2509.24384","title":"HarmMetric Eval: Benchmarking Metrics and Judges for LLM Harmfulness Assessment","created":"2025-09-29","cited_by_count":15,"area":"safety"},{"id":"2601.18076","title":"Comparison requires valid measurement: Rethinking attack success rate comparisons in AI red teaming","created":"2026-01-26","cited_by_count":15,"area":"safety"},{"id":"2406.03805","title":"AutoJailbreak: Exploring Jailbreak Attacks and Defenses through a Dependency Lens","created":"2024-06-06","cited_by_count":14,"area":"safety"},{"id":"2410.03489","title":"Gradient-based Jailbreak Images for Multimodal Fusion Models","created":"2024-10-04","cited_by_count":14,"area":"safety"},{"id":"2410.03857","title":"You Know What I'm Saying: Jailbreak Attack via Implicit Reference","created":"2024-10-04","cited_by_count":14,"area":"safety"},{"id":"2502.04204","title":"Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidence","created":"2025-02-06","cited_by_count":14,"area":"safety"},{"id":"2410.11272","title":"Cognitive Overload Attack:Prompt Injection for Long Context","created":"2024-10-15","cited_by_count":13,"area":"safety"},{"id":"2501.14250","title":"Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors","created":"2025-01-24","cited_by_count":13,"area":"safety"},{"id":"2505.24445","title":"Learning Safety Constraints for Large Language Models","created":"2025-05-30","cited_by_count":13,"area":"safety"}],"next_cursor":"100"}