{"total":171,"rows":[{"id":"2406.11717","title":"Refusal in Language Models Is Mediated by a Single Direction","created":"2024-06-17","cited_by_count":1032,"area":"safety"},{"id":"2403.03218","title":"The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning","created":"2024-03-05","cited_by_count":509,"area":"safety"},{"id":"2406.05946","title":"Safety Alignment Should Be Made More Than Just a Few Tokens Deep","created":"2024-06-10","cited_by_count":472,"area":"alignment"},{"id":"2402.10260","title":"A StrongREJECT for Empty Jailbreaks","created":"2024-02-15","cited_by_count":385,"area":"safety"},{"id":"2402.05162","title":"Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications","created":"2024-02-07","cited_by_count":231,"area":"alignment"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2407.15549","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","created":"2024-07-22","cited_by_count":173,"area":"safety"},{"id":"2402.16835","title":"Eight Methods to Evaluate Robust Unlearning in LLMs","created":"2024-02-26","cited_by_count":163,"area":"safety"},{"id":"2404.16873","title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","created":"2024-04-21","cited_by_count":156,"area":"safety"},{"id":"2408.00761","title":"Tamper-Resistant Safeguards for Open-Weight LLMs","created":"2024-08-01","cited_by_count":138,"area":"safety"},{"id":"2404.08144","title":"LLM Agents can Autonomously Exploit One-day Vulnerabilities","created":"2024-04-11","cited_by_count":128,"area":"agents"},{"id":"2401.14446","title":"Black-Box Access is Insufficient for Rigorous AI Audits","created":"2024-01-25","cited_by_count":126,"area":null},{"id":"2405.16833","title":"Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Models","created":"2024-05-27","cited_by_count":125,"area":null},{"id":"2404.01099","title":"What is in Your Safe Data? Identifying Benign Data that Breaks Safety","created":"2024-04-01","cited_by_count":118,"area":"safety"},{"id":"2504.15585","title":"A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment","created":"2025-04-22","cited_by_count":116,"area":"lr"},{"id":"2402.01109","title":"Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attack","created":"2024-02-02","cited_by_count":115,"area":"alignment"},{"id":"2402.06664","title":"LLM Agents can Autonomously Hack Websites","created":"2024-02-06","cited_by_count":109,"area":"agents"},{"id":"2401.17256","title":"Weak-to-Strong Jailbreaking on Large Language Models","created":"2024-01-30","cited_by_count":107,"area":"safety"},{"id":"2402.18540","title":"Keeping LLMs Aligned After Fine-tuning: The Crucial Role of Prompt Templates","created":"2024-02-28","cited_by_count":96,"area":null},{"id":"2403.03329","title":"Guardrail Baselines for Unlearning in LLMs","created":"2024-03-05","cited_by_count":96,"area":"safety"},{"id":"2406.01637","title":"Teams of LLM Agents can Exploit Zero-Day Vulnerabilities","created":"2024-06-02","cited_by_count":95,"area":"agents"},{"id":"2405.18641","title":"Lisa: Lazy Safety Alignment for Large Language Models against Harmful Fine-tuning Attack","created":"2024-05-28","cited_by_count":92,"area":"alignment"},{"id":"2409.01586","title":"Booster: Tackling Harmful Fine-tuning for Large Language Models via Attenuating Harmful Perturbation","created":"2024-09-03","cited_by_count":92,"area":null},{"id":"2409.18169","title":"Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Survey","created":"2024-09-26","cited_by_count":90,"area":"alignment"},{"id":"2403.05030","title":"Defending Against Unforeseen Failure Modes with Latent Adversarial Training","created":"2024-03-08","cited_by_count":88,"area":"safety"},{"id":"2406.20053","title":"Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptation","created":"2024-06-28","cited_by_count":80,"area":null},{"id":"2406.02622","title":"Safeguarding Large Language Models: A Survey","created":"2024-06-03","cited_by_count":78,"area":"safety"},{"id":"2408.09600","title":"Antidote: Post-fine-tuning Safety Alignment for Large Language Models against Harmful Fine-tuning","created":"2024-08-18","cited_by_count":72,"area":"alignment"},{"id":"2407.01599","title":"JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Models","created":"2024-06-26","cited_by_count":70,"area":"mllm"},{"id":"2410.08847","title":"Unintentional Unalignment: Likelihood Displacement in Direct Preference Optimization","created":"2024-10-11","cited_by_count":67,"area":"alignment"},{"id":"2406.06391","title":"Towards Lifelong Learning of Large Language Models: A Survey","created":"2024-06-10","cited_by_count":64,"area":null},{"id":"2412.07097","title":"On Evaluating the Durability of Safeguards for Open-Weight LLMs","created":"2024-12-10","cited_by_count":52,"area":null},{"id":"2403.04893","title":"A Safe Harbor for AI Evaluation and Red Teaming","created":"2024-03-07","cited_by_count":47,"area":"safety"},{"id":"2405.17374","title":"Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models","created":"2024-05-27","cited_by_count":46,"area":"alignment"},{"id":"2405.19550","title":"Stress-Testing Capability Elicitation With Password-Locked Models","created":"2024-05-29","cited_by_count":46,"area":null},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2502.05209","title":"Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities","created":"2025-02-03","cited_by_count":39,"area":null},{"id":"2505.17306","title":"Refusal Direction is Universal Across Safety-Aligned Languages","created":"2025-05-22","cited_by_count":38,"area":null},{"id":"2410.09760","title":"Targeted Vaccine: Safety Alignment for Large Language Models against Harmful Fine-Tuning via Layer-wise Perturbation","created":"2024-10-13","cited_by_count":37,"area":"alignment"},{"id":"2410.08968","title":"Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirements","created":"2024-10-11","cited_by_count":36,"area":"alignment"},{"id":"2402.16382","title":"Immunization against harmful fine-tuning attacks","created":"2024-02-26","cited_by_count":35,"area":null},{"id":"2405.13967","title":"Model Editing as a Robust and Denoised variant of DPO: A Case Study on Toxicity","created":"2024-05-22","cited_by_count":35,"area":"alignment"},{"id":"2410.10760","title":"Denial-of-Service Poisoning Attacks against Large Language Models","created":"2024-10-14","cited_by_count":35,"area":null},{"id":"2410.10014","title":"Safety-Aware Fine-Tuning of Large Language Models","created":"2024-10-13","cited_by_count":34,"area":null},{"id":"2402.14968","title":"Mitigating Fine-tuning based Jailbreak Attack with Backdoor Enhanced Safety Alignment","created":"2024-02-22","cited_by_count":31,"area":null},{"id":"2406.16797","title":"Lottery Ticket Adaptation: Mitigating Destructive Interference in LLMs","created":"2024-06-24","cited_by_count":31,"area":null},{"id":"2312.14302","title":"Exploiting Novel GPT-4 APIs","created":"2023-12-21","cited_by_count":28,"area":"agents"},{"id":"2408.00523","title":"Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Models","created":"2024-08-01","cited_by_count":27,"area":"agents"},{"id":"2503.17239","title":"SafeMERGE: Preserving Safety Alignment in Fine-Tuned Large Language Models via Selective Layer-Wise Model Merging","created":"2025-03-21","cited_by_count":25,"area":"alignment"},{"id":"2312.12736","title":"Learning and Forgetting Unsafe Examples in Large Language Models","created":"2023-12-20","cited_by_count":24,"area":null},{"id":"2408.01420","title":"Mission Impossible: A Statistical Perspective on Jailbreaking LLMs","created":"2024-08-02","cited_by_count":24,"area":"alignment"},{"id":"2410.10343","title":"Locking Down the Finetuned LLMs Safety","created":"2024-10-14","cited_by_count":22,"area":null},{"id":"2505.06843","title":"Benign Samples Matter! Fine-tuning On Outlier Benign Samples Severely Breaks Safety","created":"2025-05-11","cited_by_count":22,"area":"safety"},{"id":"2411.08410","title":"The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense","created":"2024-11-13","cited_by_count":21,"area":"safety"},{"id":"2407.17915","title":"The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models","created":"2024-07-25","cited_by_count":20,"area":"agents"},{"id":"2501.18100","title":"Panacea: Mitigating Harmful Fine-tuning for Large Language Models via Post-fine-tuning Perturbation","created":"2025-01-30","cited_by_count":20,"area":null},{"id":"2505.12038","title":"Safe Delta: Consistently Preserving Safety when Fine-Tuning LLMs on Diverse Datasets","created":"2025-05-17","cited_by_count":18,"area":null},{"id":"2405.19524","title":"AI Risk Management Should Incorporate Both Safety and Security","created":"2024-05-29","cited_by_count":17,"area":null},{"id":"2406.10288","title":"Do as I do (Safely): Mitigating Task-Specific Fine-tuning Risks in Large Language Models","created":"2024-06-12","cited_by_count":17,"area":"alignment"},{"id":"2501.09798","title":"Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface","created":"2025-01-16","cited_by_count":17,"area":"safety"},{"id":"2506.03850","title":"Vulnerability-Aware Alignment: Mitigating Uneven Forgetting in Harmful Fine-Tuning","created":"2025-06-04","cited_by_count":17,"area":"alignment"},{"id":"2410.15821","title":"The effect of fine-tuning on language model toxicity","created":"2024-10-21","cited_by_count":16,"area":null},{"id":"2508.06249","title":"In-Training Defenses against Emergent Misalignment in Language Models","created":"2025-08-08","cited_by_count":15,"area":"alignment"},{"id":"2601.21571","title":"Shaping capabilities with token-level data filtering","created":"2026-01-29","cited_by_count":13,"area":null},{"id":"2603.20953","title":"Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents","created":"2026-03-21","cited_by_count":13,"area":null},{"id":"2409.09041","title":"Acceptable Use Policies for Foundation Models","created":"2024-08-29","cited_by_count":12,"area":null},{"id":"2411.05059","title":"FineTuneBench: How well do commercial fine-tuning APIs infuse knowledge into LLMs?","created":"2024-11-07","cited_by_count":12,"area":null},{"id":"2505.01456","title":"Unlearning Sensitive Information in Multimodal LLMs: Benchmark and Attack-Defense Evaluation","created":"2025-05-01","cited_by_count":11,"area":"mllm"},{"id":"2505.16559","title":"CTRAP: Embedding Collapse Trap to Safeguard Large Language Models from Harmful Fine-Tuning","created":"2025-05-22","cited_by_count":11,"area":"safety"},{"id":"2505.17196","title":"Shape it Up! Restoring LLM Safety during Finetuning","created":"2025-05-22","cited_by_count":11,"area":"alignment"},{"id":"2508.07172","title":"Gradient Surgery for Safe LLM Fine-Tuning","created":"2025-08-10","cited_by_count":11,"area":"alignment"},{"id":"2508.17158","title":"Towards Safeguarding LLM Fine-tuning APIs against Cipher Attacks","created":"2025-08-23","cited_by_count":11,"area":null},{"id":"2405.11647","title":"Hummer: Towards Limited Competitive Preference Dataset","created":"2024-05-19","cited_by_count":10,"area":"alignment"},{"id":"2409.00787","title":"The Dark Side of Human Feedback: Poisoning Large Language Models via User Inputs","created":"2024-09-01","cited_by_count":10,"area":"alignment"},{"id":"2410.08133","title":"Assessing Episodic Memory in LLMs with Sequence Order Recall Tasks","created":"2024-10-10","cited_by_count":10,"area":null},{"id":"2502.14828","title":"Fundamental Limitations in Pointwise Defences of LLM Finetuning APIs","created":"2025-02-20","cited_by_count":10,"area":null},{"id":"2510.02833","title":"Attack via Overfitting: 10-shot Benign Fine-tuning to Jailbreak LLMs","created":"2025-10-03","cited_by_count":10,"area":"alignment"},{"id":"2407.17447","title":"FLRT: Fluent Student-Teacher Redteaming","created":"2024-07-24","cited_by_count":9,"area":"safety"},{"id":"2510.14301","title":"A Guardrail for Safety Preservation: When Safety-Sensitive Subspace Meets Harmful-Resistant Null-Space","created":"2025-10-16","cited_by_count":9,"area":"alignment"},{"id":"2505.23760","title":"Model Immunization from a Condition Number Perspective","created":"2025-05-29","cited_by_count":8,"area":null},{"id":"2508.20697","title":"Token Buncher: Shielding LLMs from Harmful Reinforcement Learning Fine-Tuning","created":"2025-08-28","cited_by_count":8,"area":null},{"id":"2509.22745","title":"Defending MoE LLMs against Harmful Fine-Tuning via Safety Routing Alignment","created":"2025-09-26","cited_by_count":8,"area":"moe"},{"id":"2510.07835","title":"MetaDefense: Defending Finetuning-based Jailbreak Attack Before and During Generation","created":"2025-10-09","cited_by_count":8,"area":"safety"},{"id":"2510.09714","title":"All Code, No Thought: Current Language Models Struggle to Reason in Ciphered Language","created":"2025-10-10","cited_by_count":8,"area":"lr"},{"id":"2502.13593","title":"Toward Robust Non-Transferable Learning: A Survey and Benchmark","created":"2025-02-19","cited_by_count":7,"area":null},{"id":"2503.19041","title":"LookAhead Tuning: Safer Language Models via Partial Answer Previews","created":"2025-03-24","cited_by_count":7,"area":"alignment"},{"id":"2509.06795","title":"Anchoring Refusal Direction: Mitigating Safety Risks in Tuning via Projection Constraint","created":"2025-09-08","cited_by_count":7,"area":null},{"id":"2510.01529","title":"Bypassing Prompt Guards in Production with Controlled-Release Prompting","created":"2025-10-02","cited_by_count":7,"area":null},{"id":"2409.03274","title":"Recent Advances in Attack and Defense Approaches of Large Language Models","created":"2024-09-05","cited_by_count":6,"area":null},{"id":"2502.19537","title":"No, of Course I Can! Deeper Fine-Tuning Attacks That Bypass Token-Level Safety Mechanisms","created":"2025-02-26","cited_by_count":6,"area":"safety"},{"id":"2505.14185","title":"Safety Subspaces are Not Linearly Distinct: A Fine-Tuning Case Study","created":"2025-05-20","cited_by_count":6,"area":"alignment"},{"id":"2507.17075","title":"LoRA is All You Need for Safety Alignment of Reasoning LLMs","created":"2025-07-22","cited_by_count":6,"area":"lr"},{"id":"2512.00520","title":"Toward a Safe Internet of Agents","created":"2025-11-29","cited_by_count":6,"area":"agents"},{"id":"2404.06750","title":"Frontier AI Ethics: Anticipating and Evaluating the Societal Impacts of Language Model Agents","created":"2024-04-10","cited_by_count":5,"area":"agents"},{"id":"2404.16020","title":"Investigating Adversarial Trigger Transfer in Large Language Models","created":"2024-04-24","cited_by_count":5,"area":"alignment"},{"id":"2410.10150","title":"Jailbreak Instruction-Tuned LLMs via end-of-sentence MLP Re-weighting","created":"2024-10-14","cited_by_count":5,"area":"safety"},{"id":"2410.22944","title":"Focus On This, Not That! Steering LLMs with Adaptive Feature Specification","created":"2024-10-30","cited_by_count":5,"area":null},{"id":"2411.19335","title":"PEFT-as-an-Attack! Jailbreaking Language Models during Federated Parameter-Efficient Fine-Tuning","created":"2024-11-28","cited_by_count":5,"area":"safety"},{"id":"2508.20766","title":"Turning the Spell Around: Lightweight Alignment Amplification via Rank-One Safety Injection","created":"2025-08-28","cited_by_count":5,"area":"alignment"},{"id":"2509.07287","title":"Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigm","created":"2025-09-08","cited_by_count":5,"area":null}],"next_cursor":"100"}