{"total":89,"rows":[{"id":"2404.13208","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","created":"2024-04-19","cited_by_count":493,"area":"safety"},{"id":"2407.04295","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","created":"2024-07-05","cited_by_count":230,"area":"safety"},{"id":"2407.15549","title":"Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs","created":"2024-07-22","cited_by_count":173,"area":"safety"},{"id":"2406.13352","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","created":"2024-06-19","cited_by_count":145,"area":"agents"},{"id":"2406.02630","title":"AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathways","created":"2024-06-04","cited_by_count":127,"area":null},{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2406.07933","title":"Large Language Model Unlearning via Embedding-Corrupted Prompts","created":"2024-06-12","cited_by_count":116,"area":"safety"},{"id":"2502.02542","title":"OverThink: Slowdown Attacks on Reasoning LLMs","created":"2025-02-04","cited_by_count":96,"area":"lr"},{"id":"2411.11296","title":"Steering Language Model Refusal with Sparse Autoencoders","created":"2024-11-18","cited_by_count":95,"area":"mechinterp"},{"id":"2404.15146","title":"Rethinking LLM Memorization through the Lens of Adversarial Compression","created":"2024-04-23","cited_by_count":94,"area":"lr"},{"id":"2407.01599","title":"JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Models","created":"2024-06-26","cited_by_count":70,"area":"mllm"},{"id":"2505.24832","title":"How much do language models memorize?","created":"2025-05-30","cited_by_count":61,"area":null},{"id":"2405.05417","title":"Fishing for Magikarp: Automatically Detecting Under-trained Tokens in Large Language Models","created":"2024-05-08","cited_by_count":46,"area":null},{"id":"2406.15518","title":"Steering Without Side Effects: Improving Post-Deployment Control of Language Models","created":"2024-06-21","cited_by_count":46,"area":"safety"},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2410.01606","title":"Automated Red Teaming with GOAT: the Generative Offensive Agent Tester","created":"2024-10-02","cited_by_count":45,"area":"agents"},{"id":"2507.02856","title":"Answer Matching Outperforms Multiple Choice for Language Model Evaluation","created":"2025-07-03","cited_by_count":41,"area":null},{"id":"2404.03647","title":"Capabilities of Large Language Models in Control Engineering: A Benchmark Study on GPT-4, Claude 3 Opus, and Gemini 1.0 Ultra","created":"2024-04-04","cited_by_count":37,"area":null},{"id":"2410.10760","title":"Denial-of-Service Poisoning Attacks against Large Language Models","created":"2024-10-14","cited_by_count":35,"area":null},{"id":"2412.13879","title":"Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settings","created":"2024-12-18","cited_by_count":35,"area":null},{"id":"2403.04801","title":"Alpaca against Vicuna: Using LLMs to Uncover Memorization of LLMs","created":"2024-03-05","cited_by_count":33,"area":"agents"},{"id":"2406.09321","title":"JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Models","created":"2024-06-13","cited_by_count":31,"area":"safety"},{"id":"2408.02882","title":"Compromising Embodied Agents with Contextual Backdoor Attacks","created":"2024-08-06","cited_by_count":31,"area":"agents"},{"id":"2409.04599","title":"BPE Gets Picky: Efficient Vocabulary Refinement During Tokenizer Training","created":"2024-09-06","cited_by_count":31,"area":null},{"id":"2412.10321","title":"AdvPrefix: An Objective for Nuanced LLM Jailbreaks","created":"2024-12-13","cited_by_count":25,"area":"safety"},{"id":"2408.01420","title":"Mission Impossible: A Statistical Perspective on Jailbreaking LLMs","created":"2024-08-02","cited_by_count":24,"area":"alignment"},{"id":"2404.16251","title":"Prompt Leakage effect and defense strategies for multi-turn LLM interactions","created":"2024-04-24","cited_by_count":23,"area":null},{"id":"2501.07238","title":"Lessons From Red Teaming 100 Generative AI Products","created":"2025-01-13","cited_by_count":23,"area":"safety"},{"id":"2512.07086","title":"ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinking","created":"2025-12-08","cited_by_count":23,"area":"lr"},{"id":"2410.16950","title":"Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In","created":"2024-10-22","cited_by_count":22,"area":"agents"},{"id":"2508.12538","title":"MCPXKIT: The Unified Toolkit for Analyzing Model Context Protocol Security","created":"2025-08-18","cited_by_count":21,"area":"agents"},{"id":"2502.14529","title":"CORBA: Contagious Recursive Blocking Attacks on Multi-Agent Systems Based on Large Language Models","created":"2025-02-20","cited_by_count":20,"area":"agents"},{"id":"2410.16531","title":"Bayesian scaling laws for in-context learning","created":"2024-10-21","cited_by_count":19,"area":"safety"},{"id":"2408.02509","title":"Black-Box Adversarial Attacks on LLM-Based Code Completion","created":"2024-08-05","cited_by_count":14,"area":null},{"id":"2601.10955","title":"Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents","created":"2026-01-16","cited_by_count":14,"area":"agents"},{"id":"2603.00902","title":"Clawdrain: Exploiting Tool-Calling Chains for Stealthy Token Exhaustion in OpenClaw Agents","created":"2026-03-01","cited_by_count":14,"area":"agents"},{"id":"2407.16607","title":"Data Mixture Inference: What do BPE Tokenizers Reveal about their Training Data?","created":"2024-07-23","cited_by_count":13,"area":null},{"id":"2506.15170","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2503.01742","title":"Building Safe GenAI Applications: An End-to-End Overview of Red Teaming for Large Language Models","created":"2025-03-03","cited_by_count":11,"area":"safety"},{"id":"2506.03101","title":"Beyond Text Compression: Evaluating Tokenizers Across Scales","created":"2025-06-03","cited_by_count":11,"area":null},{"id":"2506.14493","title":"LingoLoop Attack: Trapping MLLMs via Linguistic Context and State Entrapment into Endless Loops","created":"2025-06-17","cited_by_count":9,"area":"mllm"},{"id":"2511.11346","title":"Fast and Expressive Multi-Byte Prediction with Probabilistic Circuits","created":"2025-11-14","cited_by_count":9,"area":null},{"id":"2406.11214","title":"Problematic Tokens: Tokenizer Bias in Large Language Models","created":"2024-06-17","cited_by_count":8,"area":null},{"id":"2502.06470","title":"A Survey of Theory of Mind in Large Language Models: Evaluations, Representations, and Safety Risks","created":"2025-02-10","cited_by_count":8,"area":null},{"id":"2506.11938","title":"Improving Large Language Model Safety with Contrastive Representation Learning","created":"2025-06-13","cited_by_count":8,"area":"mechinterp"},{"id":"2507.12720","title":"FLEXITOKENS: Flexible Tokenization for Evolving Language Models","created":"2025-07-17","cited_by_count":8,"area":null},{"id":"2511.07876","title":"LoopLLM: Transferable Energy-Latency Attacks in LLMs via Repetitive Generation","created":"2025-11-11","cited_by_count":8,"area":null},{"id":"2410.23684","title":"Improbable Bigrams Expose Vulnerabilities of Incomplete Tokens in Byte-Level Tokenizers","created":"2024-10-31","cited_by_count":7,"area":null},{"id":"2507.18305","title":"BadReasoner: Planting Tunable Overthinking Backdoors into Large Reasoning Models for Fun or Profit","created":"2025-07-24","cited_by_count":7,"area":"lr"},{"id":"2601.07853","title":"FinVault: Benchmarking Financial Agent Safety in Execution-Grounded Environments","created":"2026-01-09","cited_by_count":7,"area":"agents"},{"id":"2505.00626","title":"The Illusion of Role Separation: Hidden Shortcuts in LLM Role Learning (and How to Fix Them)","created":"2025-05-01","cited_by_count":6,"area":null},{"id":"2512.00520","title":"Toward a Safe Internet of Agents","created":"2025-11-29","cited_by_count":6,"area":"agents"},{"id":"2411.08862","title":"LLMStinger: Jailbreaking LLMs using RL fine-tuned LLMs","created":"2024-11-13","cited_by_count":5,"area":"safety"},{"id":"2412.08127","title":"Evil twins are not that evil: Qualitative insights into machine-generated prompts","created":"2024-12-11","cited_by_count":5,"area":null},{"id":"2508.17771","title":"Speculating LLMs' Chinese Training Data Pollution from Their Tokens","created":"2025-08-25","cited_by_count":5,"area":null},{"id":"2510.13893","title":"Guarding the Guardrails: A Taxonomy-Driven Approach to Jailbreak Detection","created":"2025-10-14","cited_by_count":5,"area":"safety"},{"id":"2510.15476","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","created":"2025-10-17","cited_by_count":5,"area":"safety"},{"id":"2602.00154","title":"ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models","created":"2026-01-29","cited_by_count":5,"area":"lr"},{"id":"2404.15166","title":"Pixels and Predictions: Potential of GPT-4V in Meteorological Imagery Analysis and Forecast Communication","created":"2024-04-22","cited_by_count":4,"area":null},{"id":"2407.03232","title":"Single Character Perturbations Break LLM Alignment","created":"2024-07-03","cited_by_count":4,"area":"alignment"},{"id":"2410.15052","title":"GlitchMiner: Mining Glitch Tokens in Large Language Models via Gradient-based Discrete Optimization","created":"2024-10-19","cited_by_count":4,"area":null},{"id":"2412.10807","title":"Towards Action Hijacking of Large Language Model-based Agent","created":"2024-12-14","cited_by_count":4,"area":"agents"},{"id":"2508.20718","title":"Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models","created":"2025-08-28","cited_by_count":4,"area":"safety"},{"id":"2511.03237","title":"MUTANT: A Recipe for Multilingual Tokenizer Design","created":"2025-11-05","cited_by_count":4,"area":null},{"id":"2602.08214","title":"RECUR: Resource Exhaustion Attack via Recursive-Entropy Guided Counterfactual Utilization and Reflection","created":"2026-02-09","cited_by_count":4,"area":"lr"},{"id":"2410.05306","title":"Towards Assuring EU AI Act Compliance and Adversarial Robustness of LLMs","created":"2024-10-04","cited_by_count":3,"area":null},{"id":"2502.09974","title":"Has My System Prompt Been Used? Large Language Model Prompt Membership Inference","created":"2025-02-14","cited_by_count":3,"area":"safety"},{"id":"2511.05578","title":"UTF-8 Plumbing: Byte-level Tokenizers Unavoidably Enable LLMs to Generate Ill-formed UTF-8","created":"2025-11-05","cited_by_count":3,"area":null},{"id":"2512.23779","title":"Prompt-Induced Over-Generation as Denial-of-Service: A Black-Box Attack-Side Benchmark","created":"2025-12-29","cited_by_count":3,"area":null},{"id":"2604.08519","title":"Cram Less to Fit More: Training Data Pruning Improves Memorization of Facts","created":"2026-04-09","cited_by_count":3,"area":null},{"id":"2505.16670","title":"BitHydra: Towards Bit-flip Inference Cost Attack against Large Language Models","created":"2025-05-22","cited_by_count":2,"area":null},{"id":"2507.18053","title":"Resource Consumption Red-Teaming for Large Vision-Language Models","created":"2025-07-24","cited_by_count":2,"area":"mllm"},{"id":"2509.18575","title":"The Ranking Blind Spot: Decision Hijacking in LLM-based Text Ranking","created":"2025-09-23","cited_by_count":2,"area":null},{"id":"2512.07665","title":"Reliable agent engineering should integrate machine-compatible organizational principles","created":"2025-12-08","cited_by_count":2,"area":"agents"},{"id":"2604.09066","title":"Anchored Sliding Window: Toward Robust and Imperceptible Linguistic Steganography","created":"2026-04-10","cited_by_count":2,"area":null},{"id":"2404.19432","title":"Can Large Language Models put 2 and 2 together? Probing for Entailed Arithmetical Relationships","created":"2024-04-30","cited_by_count":1,"area":null},{"id":"2410.05304","title":"Developing Assurance Cases for Adversarial Robustness and Regulatory Compliance in LLMs","created":"2024-10-04","cited_by_count":1,"area":"safety"},{"id":"2410.07962","title":"Towards Assurance of LLM Adversarial Robustness using Ontology-Driven Argumentation","created":"2024-10-10","cited_by_count":1,"area":null},{"id":"2505.18680","title":"$PD^3F$: A Pluggable and Dynamic DoS-Defense Framework Against Resource Consumption Attacks Targeting Large Language Models","created":"2025-05-24","cited_by_count":1,"area":null},{"id":"2508.06621","title":"Train It and Forget It: Merge Lists are Unnecessary for BPE Inference in Language Models","created":"2025-08-08","cited_by_count":1,"area":null},{"id":"2410.09078","title":"Knowledge-Augmented Reasoning for EUAIA Compliance and Adversarial Robustness of LLMs","created":"2024-10-04","cited_by_count":0,"area":"lr"},{"id":"2503.12339","title":"A Closer Look at Adversarial Suffix Learning for Jailbreaking LLMs: Augmented Adversarial Trigger Learning","created":"2025-03-16","cited_by_count":0,"area":"safety"},{"id":"2602.17778","title":"Asking Forever: Universal Activations Behind Turn Amplification in Conversational LLMs","created":"2026-02-19","cited_by_count":0,"area":null},{"id":"2603.04820","title":"Autoscoring Anticlimax: A Meta-analytic Understanding of AI's Short-answer Shortcomings and Wording Weaknesses","created":"2026-03-05","cited_by_count":0,"area":null},{"id":"2604.00324","title":"The Persistent Vulnerability of Aligned AI Systems","created":"2026-03-31","cited_by_count":0,"area":null},{"id":"2604.10427","title":"A Queueing-Theoretic Framework for Dynamic Attack Surfaces: Data-Integrated Risk Analysis and Adaptive Defense","created":"2026-04-12","cited_by_count":0,"area":"deeprl"},{"id":"2605.00236","title":"Attention Is Where You Attack","created":"2026-04-30","cited_by_count":0,"area":"alignment"},{"id":"2605.05116","title":"On the Hardness of Junking LLMs","created":"2026-05-06","cited_by_count":0,"area":"safety"},{"id":"2606.07968","title":"RecurGuard: Runtime Monitoring for Reasoning-Token Consumption Attacks","created":"2026-06-06","cited_by_count":0,"area":"lr"}],"next_cursor":null}