{"total":451,"rows":[{"id":"2402.04249","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","created":"2024-02-06","cited_by_count":1429,"area":"safety"},{"id":"2310.08419","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","created":"2023-10-12","cited_by_count":1420,"area":"safety"},{"id":"2406.11717","title":"Refusal in Language Models Is Mediated by a Single Direction","created":"2024-06-17","cited_by_count":1032,"area":"safety"},{"id":"2401.06373","title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","created":"2024-01-12","cited_by_count":573,"area":"lr"},{"id":"2404.01318","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","created":"2024-03-28","cited_by_count":536,"area":"safety"},{"id":"2406.05946","title":"Safety Alignment Should Be Made More Than Just a Few Tokens Deep","created":"2024-06-10","cited_by_count":472,"area":"alignment"},{"id":"2311.05608","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","created":"2023-11-09","cited_by_count":398,"area":"mllm"},{"id":"2404.01833","title":"Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack","created":"2024-04-02","cited_by_count":390,"area":"safety"},{"id":"2402.10260","title":"A StrongREJECT for Empty Jailbreaks","created":"2024-02-15","cited_by_count":385,"area":"safety"},{"id":"2311.17600","title":"MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models","created":"2023-11-29","cited_by_count":274,"area":"mllm"},{"id":"2402.07867","title":"PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models","created":"2024-02-12","cited_by_count":267,"area":"rag"},{"id":"2312.01552","title":"The Unlocking Spell on Base LLMs: Rethinking Alignment via In-Context Learning","created":"2023-12-04","cited_by_count":257,"area":"lr"},{"id":"2402.08787","title":"Rethinking Machine Unlearning for Large Language Models","created":"2024-02-13","cited_by_count":257,"area":"lr"},{"id":"2402.08983","title":"SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decoding","created":"2024-02-14","cited_by_count":247,"area":"safety"},{"id":"2406.14598","title":"SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal","created":"2024-06-20","cited_by_count":240,"area":"alignment"},{"id":"2402.05162","title":"Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications","created":"2024-02-07","cited_by_count":231,"area":"alignment"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2402.05044","title":"SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models","created":"2024-02-07","cited_by_count":228,"area":null},{"id":"2402.08679","title":"COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability","created":"2024-02-13","cited_by_count":175,"area":"safety"},{"id":"2404.07921","title":"AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs","created":"2024-04-11","cited_by_count":172,"area":"safety"},{"id":"2401.01286","title":"A Comprehensive Study of Knowledge Editing for Large Language Models","created":"2024-01-02","cited_by_count":163,"area":null},{"id":"2401.17263","title":"Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attacks","created":"2024-01-30","cited_by_count":156,"area":"safety"},{"id":"2404.16873","title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","created":"2024-04-21","cited_by_count":156,"area":"safety"},{"id":"2402.08567","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","created":"2024-02-13","cited_by_count":153,"area":"mllm"},{"id":"2402.14016","title":"Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessment","created":"2024-02-21","cited_by_count":126,"area":null},{"id":"2405.16833","title":"Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Models","created":"2024-05-27","cited_by_count":125,"area":null},{"id":"2409.18025","title":"An Adversarial Perspective on Machine Unlearning for AI Safety","created":"2024-09-26","cited_by_count":123,"area":"safety"},{"id":"2407.18418","title":"Know Your Limits: A Survey of Abstention in Large Language Models","created":"2024-07-25","cited_by_count":121,"area":null},{"id":"2403.04957","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","created":"2024-03-07","cited_by_count":119,"area":"safety"},{"id":"2404.01099","title":"What is in Your Safe Data? Identifying Benign Data that Breaks Safety","created":"2024-04-01","cited_by_count":118,"area":"safety"},{"id":"2401.18018","title":"On Prompt-Driven Safeguarding for Large Language Models","created":"2024-01-31","cited_by_count":116,"area":"safety"},{"id":"2405.15589","title":"Efficient Adversarial Training in LLMs with Continuous Attacks","created":"2024-05-24","cited_by_count":113,"area":"safety"},{"id":"2310.15140","title":"AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models","created":"2023-10-23","cited_by_count":111,"area":"alignment"},{"id":"2401.17256","title":"Weak-to-Strong Jailbreaking on Large Language Models","created":"2024-01-30","cited_by_count":107,"area":"safety"},{"id":"2402.19085","title":"Controllable Preference Optimization: Toward Controllable Multi-Objective Alignment","created":"2024-02-29","cited_by_count":107,"area":"alignment"},{"id":"2311.11855","title":"Evil Geniuses: Delving into the Safety of LLM-based Agents","created":"2023-11-20","cited_by_count":106,"area":"agents"},{"id":"2402.13457","title":"A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models","created":"2024-02-21","cited_by_count":106,"area":"safety"},{"id":"2402.18540","title":"Keeping LLMs Aligned After Fine-tuning: The Crucial Role of Prompt Templates","created":"2024-02-28","cited_by_count":96,"area":null},{"id":"2402.05668","title":"JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs","created":"2024-02-08","cited_by_count":95,"area":"safety"},{"id":"2402.09063","title":"Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space","created":"2024-02-14","cited_by_count":91,"area":"alignment"},{"id":"2402.14020","title":"Coercing LLMs to do and reveal (almost) anything","created":"2024-02-21","cited_by_count":89,"area":"safety"},{"id":"2402.15570","title":"Fast Adversarial Attacks on Language Models In One GPU Minute","created":"2024-02-23","cited_by_count":88,"area":"safety"},{"id":"2403.14472","title":"Detoxifying Large Language Models via Knowledge Editing","created":"2024-03-21","cited_by_count":87,"area":null},{"id":"2401.11206","title":"InferAligner: Inference-Time Alignment for Harmlessness through Cross-Model Guidance","created":"2024-01-20","cited_by_count":83,"area":"alignment"},{"id":"2401.15897","title":"Red-Teaming for Generative AI: Silver Bullet or Security Theater?","created":"2024-01-29","cited_by_count":83,"area":"safety"},{"id":"2402.10753","title":"ToolSword: Unveiling Safety Issues of Large Language Models in Tool Learning Across Three Stages","created":"2024-02-16","cited_by_count":82,"area":"agents"},{"id":"2311.09827","title":"Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking","created":"2023-11-16","cited_by_count":81,"area":"lr"},{"id":"2407.20859","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","created":"2024-07-30","cited_by_count":81,"area":"agents"},{"id":"2410.02832","title":"FlipAttack: Jailbreak LLMs via Flipping","created":"2024-10-02","cited_by_count":80,"area":"safety"},{"id":"2402.05119","title":"A Closer Look at the Limitations of Instruction Tuning","created":"2024-02-03","cited_by_count":77,"area":null},{"id":"2404.05399","title":"SafetyPrompts: a Systematic Review of Open Datasets for Evaluating and Improving Large Language Model Safety","created":"2024-04-08","cited_by_count":77,"area":"safety"},{"id":"2402.16717","title":"CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models","created":"2024-02-26","cited_by_count":76,"area":"safety"},{"id":"2412.03556","title":"Best-of-N Jailbreaking","created":"2024-12-04","cited_by_count":76,"area":"safety"},{"id":"2410.13708","title":"On the Role of Attention Heads in Large Language Model Safety","created":"2024-10-17","cited_by_count":72,"area":"safety"},{"id":"2406.01288","title":"Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses","created":"2024-06-03","cited_by_count":70,"area":"safety"},{"id":"2407.01599","title":"JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Models","created":"2024-06-26","cited_by_count":70,"area":"mllm"},{"id":"2403.13031","title":"RigorLLM: Resilient Guardrails for Large Language Models against Undesired Content","created":"2024-03-19","cited_by_count":68,"area":"safety"},{"id":"2504.01903","title":"STAR-1: Safer Alignment of Reasoning LLMs with 1K Data","created":"2025-04-02","cited_by_count":68,"area":"lr"},{"id":"2402.17262","title":"Speak Out of Turn: Safety Vulnerability of Large Language Models in Multi-turn Dialogue","created":"2024-02-27","cited_by_count":66,"area":"safety"},{"id":"2410.13886","title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents","created":"2024-10-11","cited_by_count":65,"area":"agents"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2406.06007","title":"CARES: A Comprehensive Benchmark of Trustworthiness in Medical Vision Language Models","created":"2024-06-10","cited_by_count":64,"area":"mllm"},{"id":"2402.12329","title":"Query-Based Adversarial Prompt Generation","created":"2024-02-19","cited_by_count":62,"area":"alignment"},{"id":"2410.17401","title":"AdvAgent: Controllable Blackbox Red-teaming on Web Agents","created":"2024-10-22","cited_by_count":59,"area":"agents"},{"id":"2404.16369","title":"Don't Say No: Jailbreaking LLM by Suppressing Refusal","created":"2024-04-25","cited_by_count":56,"area":"alignment"},{"id":"2408.02544","title":"Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractions","created":"2024-08-05","cited_by_count":56,"area":"mllm"},{"id":"2408.04686","title":"Multi-Turn Context Jailbreak Attack on Large Language Models From First Principles","created":"2024-08-08","cited_by_count":56,"area":"safety"},{"id":"2504.20984","title":"ACE: A Security Architecture for LLM-Integrated App Systems","created":"2025-04-29","cited_by_count":55,"area":null},{"id":"2502.19820","title":"Foot-In-The-Door: A Multi-turn Jailbreak for LLMs","created":"2025-02-27","cited_by_count":54,"area":"safety"},{"id":"2402.14872","title":"Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs","created":"2024-02-21","cited_by_count":53,"area":"safety"},{"id":"2406.14144","title":"Towards Understanding Safety Alignment: A Mechanistic Perspective from Safety Neurons","created":"2024-06-20","cited_by_count":53,"area":"alignment"},{"id":"2510.26243","title":"Angular Steering: Behavior Control via Rotation in Activation Space","created":"2025-10-30","cited_by_count":53,"area":null},{"id":"2412.07097","title":"On Evaluating the Durability of Safeguards for Open-Weight LLMs","created":"2024-12-10","cited_by_count":52,"area":null},{"id":"2310.10383","title":"Privacy in Large Language Models: Attacks, Defenses and Future Directions","created":"2023-10-16","cited_by_count":51,"area":null},{"id":"2402.16965","title":"WIPI: A New Web Threat for LLM-Driven Web Agents","created":"2024-02-26","cited_by_count":51,"area":"agents"},{"id":"2406.09324","title":"Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs","created":"2024-06-13","cited_by_count":51,"area":"safety"},{"id":"2408.11491","title":"SCANS: Mitigating the Exaggerated Safety for LLMs via Safety-Conscious Activation Steering","created":"2024-08-21","cited_by_count":50,"area":"alignment"},{"id":"2405.20485","title":"Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation","created":"2024-05-30","cited_by_count":49,"area":"rag"},{"id":"2407.20516","title":"Machine Unlearning in Generative AI: A Survey","created":"2024-07-30","cited_by_count":49,"area":"safety"},{"id":"2502.08586","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","created":"2025-02-12","cited_by_count":49,"area":"agents"},{"id":"2506.07022","title":"AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraint","created":"2025-06-08","cited_by_count":49,"area":"safety"},{"id":"2410.03415","title":"Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablation","created":"2024-10-04","cited_by_count":48,"area":null},{"id":"2403.04893","title":"A Safe Harbor for AI Evaluation and Red Teaming","created":"2024-03-07","cited_by_count":47,"area":"safety"},{"id":"2406.08705","title":"When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search","created":"2024-06-13","cited_by_count":47,"area":"safety"},{"id":"2410.12855","title":"JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework","created":"2024-10-11","cited_by_count":47,"area":"agents"},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2403.08424","title":"Distract Large Language Models for Automatic Jailbreak Attack","created":"2024-03-13","cited_by_count":45,"area":"safety"},{"id":"2410.07137","title":"Cheating Automatic LLM Benchmarks: Null Models Achieve High Win Rates","created":"2024-10-09","cited_by_count":45,"area":null},{"id":"2403.04786","title":"Breaking Down the Defenses: A Comparative Survey of Attacks on Large Language Models","created":"2024-03-03","cited_by_count":44,"area":null},{"id":"2405.18634","title":"A Theoretical Understanding of Self-Correction through In-context Alignment","created":"2024-05-28","cited_by_count":44,"area":"lr"},{"id":"2411.18688","title":"Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment","created":"2024-11-27","cited_by_count":44,"area":"lr"},{"id":"2502.15806","title":"A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos","created":"2025-02-19","cited_by_count":43,"area":"lr"},{"id":"2405.19103","title":"Voice Jailbreak Attacks Against GPT-4o","created":"2024-05-29","cited_by_count":42,"area":"safety"},{"id":"2502.07218","title":"LLM Unlearning via Neural Activation Redirection","created":"2025-02-11","cited_by_count":41,"area":"safety"},{"id":"2403.07230","title":"Curry-DPO: Enhancing Alignment using Curriculum Learning & Ranked Preferences","created":"2024-03-12","cited_by_count":39,"area":"alignment"},{"id":"2412.08608","title":"AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models","created":"2024-12-11","cited_by_count":38,"area":"safety"},{"id":"2504.09466","title":"AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender","created":"2025-04-13","cited_by_count":38,"area":"alignment"},{"id":"2505.17306","title":"Refusal Direction is Universal Across Safety-Aligned Languages","created":"2025-05-22","cited_by_count":38,"area":null},{"id":"2405.20099","title":"Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attacks","created":"2024-05-30","cited_by_count":37,"area":"safety"},{"id":"2402.09177","title":"Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks","created":"2024-02-14","cited_by_count":36,"area":"safety"}],"next_cursor":"100"}