{"total":431,"rows":[{"id":"2401.06373","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","created":"2024-01-12","cited_by_count":573,"area":"lr"},{"id":"2404.02151","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","created":"2024-04-02","cited_by_count":486,"area":"safety"},{"id":"2312.02003","title":"A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly","created":"2023-12-04","cited_by_count":387,"area":null},{"id":"2402.06363","title":"StruQ: Defending Against Prompt Injection with Structured Queries","created":"2024-02-09","cited_by_count":375,"area":"safety"},{"id":"2311.03191","title":"DeepInception: Hypnotize Large Language Model to Be Jailbreaker","created":"2023-11-06","cited_by_count":367,"area":"safety"},{"id":"2311.17600","title":"MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models","created":"2023-11-29","cited_by_count":274,"area":"mllm"},{"id":"2402.08983","title":"SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding","created":"2024-02-14","cited_by_count":247,"area":"safety"},{"id":"2405.20947","title":"OR-Bench: An Over-Refusal Benchmark for Large Language Models","created":"2024-05-31","cited_by_count":244,"area":"alignment"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2402.11753","title":"ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs","created":"2024-02-19","cited_by_count":216,"area":"safety"},{"id":"2410.05451","title":"SecAlign: Defending Against Prompt Injection with Preference Optimization","created":"2024-10-07","cited_by_count":210,"area":"alignment"},{"id":"2410.05295","title":"AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs","created":"2024-10-03","cited_by_count":199,"area":"safety"},{"id":"2402.08679","title":"COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability","created":"2024-02-13","cited_by_count":175,"area":"safety"},{"id":"2407.15549","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","created":"2024-07-22","cited_by_count":173,"area":"safety"},{"id":"2504.18575","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","created":"2025-04-22","cited_by_count":157,"area":"agents"},{"id":"2401.17263","title":"Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks","created":"2024-01-30","cited_by_count":156,"area":"safety"},{"id":"2404.16873","title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","created":"2024-04-21","cited_by_count":156,"area":"safety"},{"id":"2402.08567","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","created":"2024-02-13","cited_by_count":153,"area":"mllm"},{"id":"2403.04783","title":"AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks","created":"2024-03-02","cited_by_count":145,"area":"agents"},{"id":"2403.09792","title":"Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models","created":"2024-03-14","cited_by_count":136,"area":"mllm"},{"id":"2402.09283","title":"Attacks, Defenses and Evaluations for LLM Conversation Safety: A Survey","created":"2024-02-14","cited_by_count":130,"area":null},{"id":"2510.09023","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","created":"2025-10-10","cited_by_count":129,"area":"safety"},{"id":"2406.02630","title":"AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathways","created":"2024-06-04","cited_by_count":127,"area":null},{"id":"2407.18418","title":"Know Your Limits: A Survey of Abstention in Large Language Models","created":"2024-07-25","cited_by_count":121,"area":null},{"id":"2401.02906","title":"MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance","created":"2024-01-05","cited_by_count":117,"area":"mllm"},{"id":"2504.15585","title":"A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment","created":"2025-04-22","cited_by_count":116,"area":"lr"},{"id":"2310.15140","title":"AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models","created":"2023-10-23","cited_by_count":111,"area":"alignment"},{"id":"2406.04031","title":"Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt","created":"2024-06-06","cited_by_count":109,"area":"mllm"},{"id":"2311.16101","title":"How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMs","created":"2023-11-27","cited_by_count":108,"area":"lr"},{"id":"2401.17256","title":"Weak-to-Strong Jailbreaking on Large Language Models","created":"2024-01-30","cited_by_count":107,"area":"safety"},{"id":"2312.17673","title":"Jatmo: Prompt Injection Defense by Task-Specific Finetuning","created":"2023-12-29","cited_by_count":106,"area":"safety"},{"id":"2406.05870","title":"Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents","created":"2024-06-09","cited_by_count":102,"area":"rag"},{"id":"2402.16914","title":"DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers","created":"2024-02-25","cited_by_count":101,"area":"alignment"},{"id":"2502.12893","title":"H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking","created":"2025-02-18","cited_by_count":99,"area":"lr"},{"id":"2406.05644","title":"How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden States","created":"2024-06-09","cited_by_count":98,"area":"alignment"},{"id":"2402.18540","title":"Keeping LLMs Aligned After Fine-tuning: The Crucial Role of Prompt Templates","created":"2024-02-28","cited_by_count":96,"area":null},{"id":"2403.01038","title":"AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks","created":"2024-03-02","cited_by_count":96,"area":null},{"id":"2403.03329","title":"Guardrail Baselines for Unlearning in LLMs","created":"2024-03-05","cited_by_count":96,"area":"safety"},{"id":"2403.14472","title":"Detoxifying Large Language Models via Knowledge Editing","created":"2024-03-21","cited_by_count":87,"area":null},{"id":"2503.15547","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","created":"2025-03-17","cited_by_count":87,"area":"agents"},{"id":"2406.12030","title":"SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Model","created":"2024-06-17","cited_by_count":85,"area":"mllm"},{"id":"2401.15897","title":"Red-Teaming for Generative AI: Silver Bullet or Security Theater?","created":"2024-01-29","cited_by_count":83,"area":"safety"},{"id":"2311.09827","title":"Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking","created":"2023-11-16","cited_by_count":81,"area":"lr"},{"id":"2405.18166","title":"Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editing","created":"2024-05-28","cited_by_count":79,"area":"safety"},{"id":"2407.11969","title":"Does Refusal Training in LLMs Generalize to the Past Tense?","created":"2024-07-16","cited_by_count":79,"area":"safety"},{"id":"2406.02622","title":"Safeguarding Large Language Models: A Survey","created":"2024-06-03","cited_by_count":78,"area":"safety"},{"id":"2402.18649","title":"A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systems","created":"2024-02-28","cited_by_count":77,"area":null},{"id":"2403.07865","title":"CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion","created":"2024-03-12","cited_by_count":76,"area":"safety"},{"id":"2412.03556","title":"Best-of-N Jailbreaking","created":"2024-12-04","cited_by_count":76,"area":"safety"},{"id":"2401.06561","title":"Intention Analysis Makes LLMs A Good Jailbreak Defender","created":"2024-01-12","cited_by_count":74,"area":"alignment"},{"id":"2402.16192","title":"Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing","created":"2024-02-25","cited_by_count":74,"area":"alignment"},{"id":"2403.00867","title":"Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes","created":"2024-03-01","cited_by_count":74,"area":"safety"},{"id":"2402.16459","title":"Defending LLMs against Jailbreaking Attacks via Backtranslation","created":"2024-02-26","cited_by_count":70,"area":"safety"},{"id":"2406.01288","title":"Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses","created":"2024-06-03","cited_by_count":70,"area":"safety"},{"id":"2407.01599","title":"JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Models","created":"2024-06-26","cited_by_count":70,"area":"mllm"},{"id":"2407.09121","title":"Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Training","created":"2024-07-12","cited_by_count":69,"area":null},{"id":"2410.23771","title":"What is Wrong with Perplexity for Long-context Language Modeling?","created":"2024-10-31","cited_by_count":69,"area":null},{"id":"2403.13031","title":"RigorLLM: Resilient Guardrails for Large Language Models against Undesired Content","created":"2024-03-19","cited_by_count":68,"area":"safety"},{"id":"2401.00287","title":"The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensiveness","created":"2023-12-30","cited_by_count":67,"area":null},{"id":"2402.06255","title":"Fight Back Against Jailbreaking via Prompt Adversarial Tuning","created":"2024-02-09","cited_by_count":67,"area":"safety"},{"id":"2404.12038","title":"Uncovering Safety Risks of Large Language Models through Concept Activation Vector","created":"2024-04-18","cited_by_count":67,"area":"alignment"},{"id":"2410.09102","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","created":"2024-10-09","cited_by_count":67,"area":"safety"},{"id":"2402.17262","title":"Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue","created":"2024-02-27","cited_by_count":66,"area":"safety"},{"id":"2406.15968","title":"ReCaLL: Membership Inference via Relative Conditional Log-Likelihoods","created":"2024-06-23","cited_by_count":64,"area":"safety"},{"id":"2502.11054","title":"Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Models","created":"2025-02-16","cited_by_count":64,"area":"lr"},{"id":"2406.05498","title":"SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Manner","created":"2024-06-08","cited_by_count":63,"area":"safety"},{"id":"2412.00473","title":"Jailbreak Large Vision-Language Models Through Multi-Modal Linkage","created":"2024-11-30","cited_by_count":62,"area":"safety"},{"id":"2403.12171","title":"EasyJailbreak: A Unified Framework for Jailbreaking Large Language Models","created":"2024-03-18","cited_by_count":60,"area":"safety"},{"id":"2412.17686","title":"Large Language Model Safety: A Holistic Survey","created":"2024-12-23","cited_by_count":59,"area":"safety"},{"id":"2509.02208","title":"Baichuan-M2: Scaling Medical Capability with Large Verifier System","created":"2025-09-02","cited_by_count":59,"area":"lr"},{"id":"2506.23260","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows","created":"2025-06-29","cited_by_count":58,"area":"agents"},{"id":"2502.07557","title":"JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation","created":"2025-02-11","cited_by_count":54,"area":"safety"},{"id":"2502.19820","title":"Foot-In-The-Door: A Multi-turn Jailbreak for LLMs","created":"2025-02-27","cited_by_count":54,"area":"safety"},{"id":"2401.05949","title":"Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning","created":"2024-01-11","cited_by_count":53,"area":"safety"},{"id":"2402.15911","title":"PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails","created":"2024-02-24","cited_by_count":52,"area":"safety"},{"id":"2310.10383","title":"Privacy in Large Language Models: Attacks, Defenses and Future Directions","created":"2023-10-16","cited_by_count":51,"area":null},{"id":"2501.15145","title":"PromptShield: Deployable Detection for Prompt Injection Attacks","created":"2025-01-25","cited_by_count":50,"area":"safety"},{"id":"2402.03299","title":"GUARD: Role-playing to Generate Natural-language Jailbreakings to Test Guideline Adherence of Large Language Models","created":"2024-02-05","cited_by_count":48,"area":"safety"},{"id":"2405.14125","title":"ALI-Agent: Assessing LLMs' Alignment with Human Values via Agent-based Evaluation","created":"2024-05-23","cited_by_count":47,"area":"agents"},{"id":"2406.08705","title":"When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search","created":"2024-06-13","cited_by_count":47,"area":"safety"},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2403.08424","title":"Distract Large Language Models for Automatic Jailbreak Attack","created":"2024-03-13","cited_by_count":45,"area":"safety"},{"id":"2410.07137","title":"Cheating Automatic LLM Benchmarks: Null Models Achieve High Win Rates","created":"2024-10-09","cited_by_count":45,"area":null},{"id":"2405.18634","title":"A Theoretical Understanding of Self-Correction through In-context Alignment","created":"2024-05-28","cited_by_count":44,"area":"lr"},{"id":"2503.20823","title":"Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy","created":"2025-03-26","cited_by_count":44,"area":"alignment"},{"id":"2502.15806","title":"A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos","created":"2025-02-19","cited_by_count":43,"area":"lr"},{"id":"2503.15754","title":"AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integration","created":"2025-03-20","cited_by_count":43,"area":"safety"},{"id":"2405.20413","title":"Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters","created":"2024-05-30","cited_by_count":42,"area":"safety"},{"id":"2407.15050","title":"Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Prompts","created":"2024-07-21","cited_by_count":42,"area":"mllm"},{"id":"2501.01765","title":"SaLoRA: Safety-Alignment Preserved Low-Rank Adaptation","created":"2025-01-03","cited_by_count":42,"area":"safety"},{"id":"2405.01229","title":"Boosting Jailbreak Attack with Momentum","created":"2024-05-02","cited_by_count":40,"area":"safety"},{"id":"2411.00459","title":"Defense Against Prompt Injection Attack by Leveraging Attack Techniques","created":"2024-11-01","cited_by_count":40,"area":"safety"},{"id":"2311.05915","title":"Fake Alignment: Are LLMs Really Aligned Well?","created":"2023-11-10","cited_by_count":39,"area":null},{"id":"2312.00027","title":"Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections","created":"2023-11-15","cited_by_count":39,"area":"safety"},{"id":"2503.05021","title":"Safety is Not Only About Refusal: Reasoning-Enhanced Fine-tuning for Interpretable LLM Safety","created":"2025-03-06","cited_by_count":39,"area":"lr"},{"id":"2504.09466","title":"AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender","created":"2025-04-13","cited_by_count":38,"area":"alignment"},{"id":"2405.20099","title":"Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attacks","created":"2024-05-30","cited_by_count":37,"area":"safety"},{"id":"2402.09177","title":"Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks","created":"2024-02-14","cited_by_count":36,"area":"safety"},{"id":"2405.19334","title":"LLMs Meet Multimodal Generation and Editing: A Survey","created":"2024-05-29","cited_by_count":35,"area":null},{"id":"2510.19207","title":"Defending Against Prompt Injection with DataFilter","created":"2025-10-22","cited_by_count":35,"area":"safety"}],"next_cursor":"100"}