{"total":94,"rows":[{"id":"2404.01318","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","created":"2024-03-28","cited_by_count":536,"area":"safety"},{"id":"2404.02151","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","created":"2024-04-02","cited_by_count":486,"area":"safety"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2407.15549","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","created":"2024-07-22","cited_by_count":173,"area":"safety"},{"id":"2408.15221","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","created":"2024-08-27","cited_by_count":151,"area":"safety"},{"id":"2502.17420","title":"The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence","created":"2025-02-24","cited_by_count":115,"area":"alignment"},{"id":"2405.15589","title":"Efficient Adversarial Training in LLMs with Continuous Attacks","created":"2024-05-24","cited_by_count":113,"area":"safety"},{"id":"2403.05030","title":"Defending Against Unforeseen Failure Modes with Latent Adversarial Training","created":"2024-03-08","cited_by_count":88,"area":"safety"},{"id":"2410.02832","title":"FlipAttack: Jailbreak LLMs via Flipping","created":"2024-10-02","cited_by_count":80,"area":"safety"},{"id":"2406.02622","title":"Safeguarding Large Language Models: A Survey","created":"2024-06-03","cited_by_count":78,"area":"safety"},{"id":"2412.17686","title":"Large Language Model Safety: A Holistic Survey","created":"2024-12-23","cited_by_count":59,"area":"safety"},{"id":"2406.09324","title":"Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs","created":"2024-06-13","cited_by_count":51,"area":"safety"},{"id":"2410.12855","title":"JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework","created":"2024-10-11","cited_by_count":47,"area":"agents"},{"id":"2410.01606","title":"Automated Red Teaming with GOAT: the Generative Offensive Agent Tester","created":"2024-10-02","cited_by_count":45,"area":"agents"},{"id":"2411.18688","title":"Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment","created":"2024-11-27","cited_by_count":44,"area":"lr"},{"id":"2503.05021","title":"Safety is Not Only About Refusal: Reasoning-Enhanced Fine-tuning for Interpretable LLM Safety","created":"2025-03-06","cited_by_count":39,"area":"lr"},{"id":"2403.01251","title":"Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Sampling","created":"2024-03-02","cited_by_count":37,"area":"safety"},{"id":"2409.00598","title":"Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Models","created":"2024-09-01","cited_by_count":35,"area":"alignment"},{"id":"2410.09040","title":"AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation","created":"2024-10-11","cited_by_count":33,"area":"safety"},{"id":"2405.20653","title":"Mind the Inconspicuous: Revealing the Hidden Weakness in Aligned LLMs' Refusal Boundaries","created":"2024-05-31","cited_by_count":28,"area":"alignment"},{"id":"2406.06622","title":"Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs","created":"2024-06-07","cited_by_count":26,"area":"safety"},{"id":"2405.13077","title":"GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation","created":"2024-05-21","cited_by_count":25,"area":"safety"},{"id":"2412.10321","title":"AdvPrefix: An Objective for Nuanced LLM Jailbreaks","created":"2024-12-13","cited_by_count":25,"area":"safety"},{"id":"2506.14922","title":"FORTRESS: Frontier Risk Evaluation for National Security and Public Safety","created":"2025-06-17","cited_by_count":24,"area":"safety"},{"id":"2411.01077","title":"Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection","created":"2024-11-01","cited_by_count":23,"area":"safety"},{"id":"2601.01592","title":"OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs","created":"2026-01-04","cited_by_count":21,"area":"mllm"},{"id":"2503.00187","title":"Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attacks","created":"2025-02-28","cited_by_count":20,"area":"safety"},{"id":"2410.01294","title":"Endless Jailbreaks with Bijection Learning","created":"2024-10-02","cited_by_count":19,"area":"safety"},{"id":"2505.19616","title":"Diagnosing and Mitigating Modality Interference in Multimodal Large Language Models","created":"2025-05-26","cited_by_count":19,"area":"mllm"},{"id":"2503.02574","title":"LLM-Safety Evaluations Lack Robustness","created":"2025-03-04","cited_by_count":18,"area":"alignment"},{"id":"2502.04040","title":"Safety Reasoning with Guidelines","created":"2025-02-06","cited_by_count":15,"area":"lr"},{"id":"2502.17254","title":"REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective","created":"2025-02-24","cited_by_count":15,"area":"alignment"},{"id":"2505.20259","title":"Lifelong Safety Alignment for Language Models","created":"2025-05-26","cited_by_count":15,"area":"alignment"},{"id":"2506.12707","title":"SecurityLingua: Efficient Defense of LLM Jailbreak Attacks via Security-Aware Prompt Compression","created":"2025-06-15","cited_by_count":13,"area":"inference"},{"id":"2602.22983","title":"Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search","created":"2026-02-26","cited_by_count":13,"area":"safety"},{"id":"2410.19160","title":"Adversarial Attacks on Large Language Models Using Regularized Relaxation","created":"2024-10-24","cited_by_count":12,"area":null},{"id":"2501.18638","title":"Graph of Attacks with Pruning: Optimizing Stealthy Jailbreak Prompt Generation for Enhanced LLM Content Moderation","created":"2025-01-28","cited_by_count":11,"area":"safety"},{"id":"2503.01742","title":"Building Safe GenAI Applications: An End-to-End Overview of Red Teaming for Large Language Models","created":"2025-03-03","cited_by_count":11,"area":"safety"},{"id":"2604.08499","title":"PIArena: A Platform for Prompt Injection Evaluation","created":"2026-04-09","cited_by_count":11,"area":"safety"},{"id":"2501.12210","title":"You Can't Eat Your Cake and Have It Too: The Performance Degradation of LLMs with Jailbreak Defense","created":"2025-01-21","cited_by_count":10,"area":"safety"},{"id":"2412.17522","title":"DiffusionAttacker: Diffusion-Driven Prompt Manipulation for LLM Jailbreak","created":"2024-12-23","cited_by_count":9,"area":"diffusion"},{"id":"2403.14725","title":"Testing the Limits of Jailbreaking Defenses with the Purple Problem","created":"2024-03-20","cited_by_count":8,"area":"safety"},{"id":"2506.09353","title":"DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Prompt","created":"2025-06-11","cited_by_count":8,"area":"mllm"},{"id":"2506.11938","title":"Improving Large Language Model Safety with Contrastive Representation Learning","created":"2025-06-13","cited_by_count":8,"area":"mechinterp"},{"id":"2511.12710","title":"Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs","created":"2025-11-16","cited_by_count":8,"area":"safety"},{"id":"2510.01529","title":"Bypassing Prompt Guards in Production with Controlled-Release Prompting","created":"2025-10-02","cited_by_count":7,"area":null},{"id":"2511.00203","title":"Diffusion LLMs are Natural Adversaries for any LLM","created":"2025-10-31","cited_by_count":7,"area":"safety"},{"id":"2410.13691","title":"Jailbreaking LLM-Controlled Robots","created":"2024-10-17","cited_by_count":6,"area":"safety"},{"id":"2511.04316","title":"AdversariaLLM: A Unified and Modular Toolbox for LLM Robustness Research","created":"2025-11-06","cited_by_count":6,"area":"safety"},{"id":"2412.07192","title":"PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips","created":"2024-12-10","cited_by_count":5,"area":"alignment"},{"id":"2503.01345","title":"Same Question, Different Words: A Latent Adversarial Framework for Prompt Robustness","created":"2025-03-03","cited_by_count":5,"area":null},{"id":"2510.09871","title":"CoBia: Constructed Conversations Can Trigger Otherwise Concealed Societal Biases in LLMs","created":"2025-10-10","cited_by_count":5,"area":"safety"},{"id":"2510.15476","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","created":"2025-10-17","cited_by_count":5,"area":"safety"},{"id":"2602.09987","title":"Infusion: Shaping Model Behavior by Editing Training Data via Influence Functions","created":"2026-02-10","cited_by_count":5,"area":null},{"id":"2411.01084","title":"Plentiful Jailbreaks with String Compositions","created":"2024-11-01","cited_by_count":4,"area":"safety"},{"id":"2412.05232","title":"LIAR: Leveraging Inference Time Alignment (Best-of-N) to Jailbreak LLMs in Seconds","created":"2024-12-06","cited_by_count":4,"area":"safety"},{"id":"2505.09820","title":"Adversarial Attack on Large Language Models using Exponentiated Gradient Descent","created":"2025-05-14","cited_by_count":4,"area":"safety"},{"id":"2508.19445","title":"On Surjectivity of Neural Networks: Can you elicit any behavior from your model?","created":"2025-08-26","cited_by_count":4,"area":null},{"id":"2510.04257","title":"AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents","created":"2025-10-05","cited_by_count":4,"area":"mllm"},{"id":"2603.11331","title":"Jailbreak Scaling Laws for Large Language Models: Polynomial-Exponential Crossover","created":"2026-03-11","cited_by_count":4,"area":"alignment"},{"id":"2506.18325","title":"NSFW-Classifier Guided Prompt Sanitization for Safe Text-to-Image Generation","created":"2025-06-23","cited_by_count":3,"area":"safety"},{"id":"2509.19360","title":"Semantic Representation Attack against Aligned Large Language Models","created":"2025-09-18","cited_by_count":3,"area":"alignment"},{"id":"2510.03567","title":"Machine Unlearning Meets Adversarial Robustness via Constrained Interventions on LLMs","created":"2025-10-03","cited_by_count":3,"area":"safety"},{"id":"2602.11096","title":"Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away","created":"2026-02-11","cited_by_count":3,"area":"lr"},{"id":"2408.00895","title":"Discrete Randomized Smoothing Meets Quantum Computing","created":"2024-08-01","cited_by_count":2,"area":null},{"id":"2411.15222","title":"Rethinking the Intermediate Features in Adversarial Attacks: Misleading Robotic Models via Adversarial Distillation","created":"2024-11-21","cited_by_count":2,"area":null},{"id":"2502.19883","title":"Beyond the Tip of Efficiency: Uncovering the Submerged Threats of Jailbreak Attacks in Small Language Models","created":"2025-02-27","cited_by_count":2,"area":"safety"},{"id":"2507.07146","title":"Attention-Aware GNN-based Input Defense against Multi-Turn LLM Jailbreak","created":"2025-07-09","cited_by_count":2,"area":"safety"},{"id":"2508.14853","title":"Universal and Transferable Adversarial Attack on Large Language Models Using Exponentiated Gradient Descent","created":"2025-08-20","cited_by_count":2,"area":"alignment"},{"id":"2511.01375","title":"Align to Misalign: Automatic LLM Jailbreak with Meta-Optimized LLM Judges","created":"2025-11-03","cited_by_count":2,"area":"safety"},{"id":"2505.00843","title":"OET: Optimization-based prompt injection Evaluation Toolkit","created":"2025-05-01","cited_by_count":1,"area":"safety"},{"id":"2505.21556","title":"Benign-to-Toxic Jailbreaking: Inducing Harmful Responses from Harmless Prompts","created":"2025-05-26","cited_by_count":1,"area":"mllm"},{"id":"2506.09067","title":"Enhancing the Safety of Medical Vision-Language Models by Synthetic Demonstrations","created":"2025-06-08","cited_by_count":1,"area":"mllm"},{"id":"2506.18543","title":"SoK: A Comprehensive Security Analysis of Jailbreak Resilience in GPT and DeepSeek Models","created":"2025-06-23","cited_by_count":1,"area":"safety"},{"id":"2508.10404","title":"Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generation","created":"2025-08-14","cited_by_count":1,"area":"safety"},{"id":"2510.22014","title":"Toward Understanding the Transferability of Adversarial Suffixes in Large Language Models","created":"2025-10-24","cited_by_count":1,"area":"safety"},{"id":"2601.16231","title":"SoundBreak: A Systematic Study of Audio-Only Adversarial Attacks on Trimodal Models","created":"2026-01-20","cited_by_count":1,"area":null},{"id":"2603.24857","title":"AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspective","created":"2026-03-25","cited_by_count":1,"area":"safety"},{"id":"2608.05188","title":"Position: It's Time to Optimize LLMs for Self-Consistency","created":"2026-07-31","cited_by_count":1,"area":"lr"},{"id":"2504.20077","title":"Edge-Based Learning for Improved Classification Under Adversarial Noise","created":"2025-04-25","cited_by_count":0,"area":null},{"id":"2505.18672","title":"Concept Concentration for Faithful Representation Intervention","created":"2025-05-24","cited_by_count":0,"area":"safety"},{"id":"2511.18324","title":"Gradient Masters at BLP-2025 Task 1: Advancing Low-Resource NLP for Bengali using Ensemble-Based Adversarial Training for Hate Speech Detection","created":"2025-11-23","cited_by_count":0,"area":null},{"id":"2511.18581","title":"TASO: Jailbreak LLMs via Alternative Template and Suffix Optimization","created":"2025-11-23","cited_by_count":0,"area":"safety"},{"id":"2602.04893","title":"A Causal Perspective for Enhancing Jailbreak Attack and Defense","created":"2026-01-31","cited_by_count":0,"area":"safety"},{"id":"2602.15238","title":"Closing the Distribution Gap in Adversarial Training for LLMs","created":"2026-02-16","cited_by_count":0,"area":null},{"id":"2604.19274","title":"HarDBench: A Benchmark for Draft-Based Co-Authoring Jailbreak Attacks for Safe Human-LLM Collaborative Writing","created":"2026-04-21","cited_by_count":0,"area":"safety"},{"id":"2605.05116","title":"On the Hardness of Junking LLMs","created":"2026-05-06","cited_by_count":0,"area":"safety"},{"id":"2605.08898","title":"LLM-Agnostic Semantic Representation Attack","created":"2026-05-09","cited_by_count":0,"area":"safety"},{"id":"2605.21780","title":"Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy","created":"2026-05-20","cited_by_count":0,"area":null},{"id":"2606.03647","title":"All you need to break LLMs are Black-Box, Adapting, Efficient, Transferable, Harmful, Applicable ... Attacks","created":"2026-06-02","cited_by_count":0,"area":"safety"},{"id":"2607.00481","title":"Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces","created":"2026-07-01","cited_by_count":0,"area":"agents"},{"id":"2608.00134","title":"Stateful Cooperative Agents Safeguarding LLMs Against Evolving Multi-Turn Attacks","created":"2026-07-31","cited_by_count":0,"area":"agents"},{"id":"2608.27502","title":"Image Augmentation as Test Generation for Deep Learning-Based Image Retrieval Systems","created":"2026-08-27","cited_by_count":0,"area":null},{"id":"2609.32116","title":"Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking","created":"2026-09-26","cited_by_count":0,"area":"safety"}],"next_cursor":null}