{"total":97,"rows":[{"id":"2402.04249","title":"HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal","created":"2024-02-06","cited_by_count":1429,"area":"safety"},{"id":"2406.11717","title":"Refusal in Language Models Is Mediated by a Single Direction","created":"2024-06-17","cited_by_count":1032,"area":"safety"},{"id":"2312.02119","title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","created":"2023-12-04","cited_by_count":672,"area":"safety"},{"id":"2404.01318","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","created":"2024-03-28","cited_by_count":536,"area":"safety"},{"id":"2404.02151","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","created":"2024-04-02","cited_by_count":486,"area":"safety"},{"id":"2402.10260","title":"A StrongREJECT for Empty Jailbreaks","created":"2024-02-15","cited_by_count":385,"area":"safety"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2402.16822","title":"Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Prompts","created":"2024-02-26","cited_by_count":205,"area":"safety"},{"id":"2402.08679","title":"COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability","created":"2024-02-13","cited_by_count":175,"area":"safety"},{"id":"2407.15549","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","created":"2024-07-22","cited_by_count":173,"area":"safety"},{"id":"2404.07921","title":"AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs","created":"2024-04-11","cited_by_count":172,"area":"safety"},{"id":"2402.16835","title":"Eight Methods to Evaluate Robust Unlearning in LLMs","created":"2024-02-26","cited_by_count":163,"area":"safety"},{"id":"2409.18025","title":"An Adversarial Perspective on Machine Unlearning for AI Safety","created":"2024-09-26","cited_by_count":123,"area":"safety"},{"id":"2401.17256","title":"Weak-to-Strong Jailbreaking on Large Language Models","created":"2024-01-30","cited_by_count":107,"area":"safety"},{"id":"2403.05030","title":"Defending Against Unforeseen Failure Modes with Latent Adversarial Training","created":"2024-03-08","cited_by_count":88,"area":"safety"},{"id":"2401.15897","title":"Red-Teaming for Generative AI: Silver Bullet or Security Theater?","created":"2024-01-29","cited_by_count":83,"area":"safety"},{"id":"2403.07865","title":"CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion","created":"2024-03-12","cited_by_count":76,"area":"safety"},{"id":"2412.03556","title":"Best-of-N Jailbreaking","created":"2024-12-04","cited_by_count":76,"area":"safety"},{"id":"2412.17686","title":"Large Language Model Safety: A Holistic Survey","created":"2024-12-23","cited_by_count":59,"area":"safety"},{"id":"2402.03299","title":"GUARD: Role-playing to Generate Natural-language Jailbreakings to Test Guideline Adherence of Large Language Models","created":"2024-02-05","cited_by_count":48,"area":"safety"},{"id":"2403.04893","title":"A Safe Harbor for AI Evaluation and Red Teaming","created":"2024-03-07","cited_by_count":47,"area":"safety"},{"id":"2406.08705","title":"When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search","created":"2024-06-13","cited_by_count":47,"area":"safety"},{"id":"2405.19103","title":"Voice Jailbreak Attacks Against GPT-4o","created":"2024-05-29","cited_by_count":42,"area":"safety"},{"id":"2410.15236","title":"Jailbreaking and Mitigation of Vulnerabilities in Large Language Models","created":"2024-10-20","cited_by_count":34,"area":"safety"},{"id":"2410.09040","title":"AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation","created":"2024-10-11","cited_by_count":33,"area":"safety"},{"id":"2408.06223","title":"On Effects of Steering Latent Representation for Large Language Model Unlearning","created":"2024-08-12","cited_by_count":32,"area":"safety"},{"id":"2406.09321","title":"JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Models","created":"2024-06-13","cited_by_count":31,"area":"safety"},{"id":"2409.07985","title":"Games for AI Control: Models of Safety Evaluations of AI Deployment Protocols","created":"2024-09-12","cited_by_count":31,"area":"safety"},{"id":"2402.13148","title":"Defending Jailbreak Prompts via In-Context Adversarial Game","created":"2024-02-20","cited_by_count":29,"area":"safety"},{"id":"2404.13968","title":"Protecting Your LLMs with Information Bottleneck","created":"2024-04-22","cited_by_count":29,"area":"safety"},{"id":"2401.09002","title":"AttackEval: How to Evaluate the Effectiveness of Jailbreak Attacking on Large Language Models","created":"2024-01-17","cited_by_count":28,"area":"safety"},{"id":"2402.15302","title":"How (un)ethical are instruction-centric responses of LLMs? Unveiling the vulnerabilities of safety guardrails to harmful queries","created":"2024-02-23","cited_by_count":27,"area":"safety"},{"id":"2406.11668","title":"\"Not Aligned\" is Not \"Malicious\": Being Careful about Hallucinations of Large Language Models' Jailbreak","created":"2024-06-17","cited_by_count":25,"area":"safety"},{"id":"2409.16783","title":"Holistic Automated Red Teaming for Large Language Models through Top-Down Test Case Generation and Multi-turn Interaction","created":"2024-09-25","cited_by_count":25,"area":"safety"},{"id":"2405.20778","title":"Improved Generation of Adversarial Examples Against Safety-aligned LLMs","created":"2024-05-28","cited_by_count":18,"area":"safety"},{"id":"2503.10619","title":"Tempest: Autonomous Multi-Turn Jailbreaking of Large Language Models with Tree Search","created":"2025-03-13","cited_by_count":17,"area":"safety"},{"id":"2412.03235","title":"Does Safety Training of LLMs Generalize to Semantically Related Natural Prompts?","created":"2024-12-04","cited_by_count":15,"area":"safety"},{"id":"2412.08615","title":"Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models","created":"2024-12-11","cited_by_count":15,"area":"safety"},{"id":"2509.24384","title":"HarmMetric Eval: Benchmarking Metrics and Judges for LLM Harmfulness Assessment","created":"2025-09-29","cited_by_count":15,"area":"safety"},{"id":"2406.03805","title":"AutoJailbreak: Exploring Jailbreak Attacks and Defenses through a Dependency Lens","created":"2024-06-06","cited_by_count":14,"area":"safety"},{"id":"2410.03489","title":"Gradient-based Jailbreak Images for Multimodal Fusion Models","created":"2024-10-04","cited_by_count":14,"area":"safety"},{"id":"2410.11272","title":"Cognitive Overload Attack:Prompt Injection for Long Context","created":"2024-10-15","cited_by_count":13,"area":"safety"},{"id":"2509.14558","title":"LLM Jailbreak Detection for (Almost) Free!","created":"2025-09-18","cited_by_count":13,"area":"safety"},{"id":"2410.21083","title":"Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring","created":"2024-10-28","cited_by_count":12,"area":"safety"},{"id":"2502.16903","title":"GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods","created":"2025-02-24","cited_by_count":12,"area":"safety"},{"id":"2503.01742","title":"Building Safe GenAI Applications: An End-to-End Overview of Red Teaming for Large Language Models","created":"2025-03-03","cited_by_count":11,"area":"safety"},{"id":"2503.01865","title":"Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints","created":"2025-02-25","cited_by_count":11,"area":"safety"},{"id":"2504.15047","title":"RainbowPlus: Enhancing Adversarial Prompt Generation via Evolutionary Quality-Diversity Search","created":"2025-04-21","cited_by_count":11,"area":"safety"},{"id":"2507.22171","title":"Enhancing Jailbreak Attacks on LLMs via Persona Prompts","created":"2025-07-28","cited_by_count":11,"area":"safety"},{"id":"2508.12398","title":"Where to Start Alignment? Diffusion Large Language Model May Demand a Distinct Position","created":"2025-08-17","cited_by_count":11,"area":"safety"},{"id":"2410.22143","title":"AmpleGCG-Plus: A Strong Generative Model of Adversarial Suffixes to Jailbreak LLMs with Higher Success Rates in Fewer Attempts","created":"2024-10-29","cited_by_count":10,"area":"safety"},{"id":"2504.21038","title":"Prefill-level Jailbreak: A Black-Box Risk Analysis of Large Language Models","created":"2025-04-28","cited_by_count":10,"area":"safety"},{"id":"2407.17447","title":"FLRT: Fluent Student-Teacher Redteaming","created":"2024-07-24","cited_by_count":9,"area":"safety"},{"id":"2510.07835","title":"MetaDefense: Defending Finetuning-based Jailbreak Attack Before and During Generation","created":"2025-10-09","cited_by_count":8,"area":"safety"},{"id":"2505.10838","title":"LARGO: Latent Adversarial Reflection through Gradient Optimization for Jailbreaking LLMs","created":"2025-05-16","cited_by_count":7,"area":"safety"},{"id":"2507.21820","title":"Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Is","created":"2025-07-29","cited_by_count":7,"area":"safety"},{"id":"2410.11317","title":"Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation","created":"2024-10-15","cited_by_count":6,"area":"safety"},{"id":"2405.19668","title":"AutoBreach: Universal and Adaptive Jailbreaking with Efficient Wordplay-Guided Optimization","created":"2024-05-30","cited_by_count":5,"area":"safety"},{"id":"2501.18280","title":"Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models","created":"2025-01-30","cited_by_count":5,"area":"safety"},{"id":"2503.17953","title":"Smoke and Mirrors: Jailbreaking LLM-based Code Generation via Implicit Malicious Prompts","created":"2025-03-23","cited_by_count":5,"area":"safety"},{"id":"2505.22037","title":"Jailbreak Distillation: Renewable Safety Benchmarking","created":"2025-05-28","cited_by_count":5,"area":"safety"},{"id":"2508.04451","title":"Automatic LLM Red Teaming","created":"2025-08-06","cited_by_count":5,"area":"safety"},{"id":"2601.23081","title":"Character as a Latent Variable in Large Language Models: A Mechanistic Account of Emergent Misalignment and Conditional Safety Failures","created":"2026-01-30","cited_by_count":5,"area":"safety"},{"id":"2506.22666","title":"VERA: Variational Inference Framework for Jailbreaking Large Language Models","created":"2025-06-27","cited_by_count":4,"area":"safety"},{"id":"2509.08000","title":"AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs","created":"2025-09-06","cited_by_count":4,"area":"safety"},{"id":"2510.25117","title":"A Survey on Unlearning in Large Language Models","created":"2025-10-29","cited_by_count":4,"area":"safety"},{"id":"2507.23453","title":"Counterfactual Evaluation for Blind Attack Detection in LLM-based Evaluation Systems","created":"2025-07-31","cited_by_count":3,"area":"safety"},{"id":"2601.03594","title":"Jailbreaking LLMs & VLMs: Mechanisms, Evaluation, and Unified Defense","created":"2026-01-07","cited_by_count":3,"area":"safety"},{"id":"2601.03600","title":"ALERT: Zero-shot LLM Jailbreak Detection via Internal Discrepancy Amplification","created":"2026-01-07","cited_by_count":3,"area":"safety"},{"id":"2411.09125","title":"DROJ: A Prompt-Driven Attack against Large Language Models","created":"2024-11-14","cited_by_count":2,"area":"safety"},{"id":"2502.01154","title":"Jailbreaking with Universal Multi-Prompts","created":"2025-02-03","cited_by_count":2,"area":"safety"},{"id":"2503.20320","title":"Iterative Prompting with Persuasion Skills in Jailbreaking Large Language Models","created":"2025-03-26","cited_by_count":2,"area":"safety"},{"id":"2602.02824","title":"CALIBURN: Self-Calibrated LLM Unlearning Alignment","created":"2026-02-02","cited_by_count":2,"area":"safety"},{"id":"2606.05609","title":"SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks","created":"2026-06-04","cited_by_count":2,"area":"safety"},{"id":"2503.03502","title":"Geometry-Guided Adversarial Prompt Detection via Curvature and Local Intrinsic Dimension","created":"2025-03-05","cited_by_count":1,"area":"safety"},{"id":"2504.01533","title":"LightDefense: A Lightweight Uncertainty-Driven Defense against Jailbreaks via Shifted Token Distribution","created":"2025-04-02","cited_by_count":1,"area":"safety"},{"id":"2506.18543","title":"SoK: A Comprehensive Security Analysis of Jailbreak Resilience in GPT and DeepSeek Models","created":"2025-06-23","cited_by_count":1,"area":"safety"},{"id":"2508.10404","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","created":"2025-08-14","cited_by_count":1,"area":"safety"},{"id":"2509.08729","title":"X-Teaming Evolutionary M2S: Automated Discovery of Multi-turn to Single-turn Jailbreak Templates","created":"2025-09-10","cited_by_count":1,"area":"safety"},{"id":"2511.03271","title":"Let the Bees Find the Weak Spots: A Path Planning Perspective on Multi-Turn Jailbreak Attacks against LLMs","created":"2025-11-05","cited_by_count":1,"area":"safety"},{"id":"2603.10068","title":"ADVERSA: Measuring Multi-Turn Guardrail Degradation and Judge Reliability in Large Language Models","created":"2026-03-10","cited_by_count":1,"area":"safety"},{"id":"2606.25476","title":"A Red Teaming Framework for Large Language Models: A Case Study on Faithfulness Evaluation","created":"2026-06-24","cited_by_count":1,"area":"safety"},{"id":"2607.01277","title":"Cognitive Firewall: A Proactive, Zero-Trust, Multi-Gate Framework for LLM Safety","created":"2026-07-01","cited_by_count":1,"area":"safety"},{"id":"2608.22335","title":"Register Shifts Break LLM Safety: A Bengali Benchmark with Culturally Grounded Harms","created":"2026-08-23","cited_by_count":1,"area":"safety"},{"id":"2507.17922","title":"From Seed to Harvest: Augmenting Human Creativity with AI for Red-teaming Text-to-Image Models","created":"2025-07-23","cited_by_count":0,"area":"safety"},{"id":"2510.01259","title":"In AI Sweet Harmony: Sociopragmatic Guardrail Bypasses and Evaluation-Awareness in OpenAI gpt-oss-20b","created":"2025-09-25","cited_by_count":0,"area":"safety"},{"id":"2510.12672","title":"Keep Calm and Avoid Harmful Content: Concept Alignment and Latent Manipulation Towards Safer Answers","created":"2025-10-14","cited_by_count":0,"area":"safety"},{"id":"2511.18581","title":"TASO: Jailbreak LLMs via Alternative Template and Suffix Optimization","created":"2025-11-23","cited_by_count":0,"area":"safety"},{"id":"2511.23174","title":"Are LLMs Good Safety Agents or a Propaganda Engine?","created":"2025-11-28","cited_by_count":0,"area":"safety"},{"id":"2604.19274","title":"HarDBench: A Benchmark for Draft-Based Co-Authoring Jailbreak Attacks for Safe Human-LLM Collaborative Writing","created":"2026-04-21","cited_by_count":0,"area":"safety"},{"id":"2605.05116","title":"On the Hardness of Junking LLMs","created":"2026-05-06","cited_by_count":0,"area":"safety"},{"id":"2606.00801","title":"Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety","created":"2026-05-30","cited_by_count":0,"area":"safety"},{"id":"2608.30585","title":"The Safety Relay in Roleplay Jailbreaks: A Component-Resolved Causal Analysis of Harm Recognition and Refusal","created":"2026-08-31","cited_by_count":0,"area":"safety"},{"id":"2608.30748","title":"The Fragility of Jailbreak Robustness Across Operational States","created":"2026-08-31","cited_by_count":0,"area":"safety"},{"id":"2609.38357","title":"Evaluating Language Model Safety Across Long Adversarial Conversations","created":"2026-09-29","cited_by_count":0,"area":"safety"},{"id":"2609.39882","title":"LLM Persona Unlearning","created":"2026-09-30","cited_by_count":0,"area":"safety"},{"id":"2610.19587","title":"Moral Combat: Exploiting Moral Foundations Theory to Jailbreak LLMs","created":"2026-10-14","cited_by_count":0,"area":"safety"}],"next_cursor":null}