{"total":95,"rows":[{"id":"2406.11717","title":"Refusal in Language Models Is Mediated by a Single Direction","created":"2024-06-17","cited_by_count":1032,"area":"safety"},{"id":"2410.05295","title":"AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs","created":"2024-10-03","cited_by_count":199,"area":"safety"},{"id":"2404.16873","title":"AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs","created":"2024-04-21","cited_by_count":156,"area":"safety"},{"id":"2406.07933","title":"Large Language Model Unlearning via Embedding-Corrupted Prompts","created":"2024-06-12","cited_by_count":116,"area":"safety"},{"id":"2405.21018","title":"Improved Techniques for Optimization-Based Jailbreaking on Large Language Models","created":"2024-05-31","cited_by_count":110,"area":"safety"},{"id":"2410.02832","title":"FlipAttack: Jailbreak LLMs via Flipping","created":"2024-10-02","cited_by_count":80,"area":"safety"},{"id":"2410.13708","title":"On the Role of Attention Heads in Large Language Model Safety","created":"2024-10-17","cited_by_count":72,"area":"safety"},{"id":"2406.01288","title":"Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses","created":"2024-06-03","cited_by_count":70,"area":"safety"},{"id":"2410.09102","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","created":"2024-10-09","cited_by_count":67,"area":"safety"},{"id":"2412.17686","title":"Large Language Model Safety: A Holistic Survey","created":"2024-12-23","cited_by_count":59,"area":"safety"},{"id":"2406.09324","title":"Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs","created":"2024-06-13","cited_by_count":51,"area":"safety"},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2405.20099","title":"Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attacks","created":"2024-05-30","cited_by_count":37,"area":"safety"},{"id":"2410.09040","title":"AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation","created":"2024-10-11","cited_by_count":33,"area":"safety"},{"id":"2412.10321","title":"AdvPrefix: An Objective for Nuanced LLM Jailbreaks","created":"2024-12-13","cited_by_count":25,"area":"safety"},{"id":"2411.01077","title":"Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection","created":"2024-11-01","cited_by_count":23,"area":"safety"},{"id":"2502.03052","title":"Understanding and Enhancing the Transferability of Jailbreaking Attacks","created":"2025-02-05","cited_by_count":22,"area":"safety"},{"id":"2410.19937","title":"RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Eviction","created":"2024-10-25","cited_by_count":21,"area":"safety"},{"id":"2406.19845","title":"Virtual Context: Enhancing Jailbreak Attacks with Special Token Injection","created":"2024-06-28","cited_by_count":17,"area":"safety"},{"id":"2405.14189","title":"Efficient Universal Goal Hijacking with Semantics-guided Prompt Organization","created":"2024-05-23","cited_by_count":16,"area":"safety"},{"id":"2412.08615","title":"Exploiting the Index Gradients for Optimization-Based Jailbreaking on Large Language Models","created":"2024-12-11","cited_by_count":15,"area":"safety"},{"id":"2507.07417","title":"May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attacks","created":"2025-07-10","cited_by_count":15,"area":"safety"},{"id":"2406.03805","title":"AutoJailbreak: Exploring Jailbreak Attacks and Defenses through a Dependency Lens","created":"2024-06-06","cited_by_count":14,"area":"safety"},{"id":"2502.04204","title":"Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidence","created":"2025-02-06","cited_by_count":14,"area":"safety"},{"id":"2410.21083","title":"Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring","created":"2024-10-28","cited_by_count":12,"area":"safety"},{"id":"2411.14133","title":"GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs","created":"2024-11-21","cited_by_count":12,"area":"safety"},{"id":"2502.16903","title":"GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods","created":"2025-02-24","cited_by_count":12,"area":"safety"},{"id":"2408.11313","title":"An Optimizable Suffix Is Worth A Thousand Templates: Efficient Black-box Jailbreaking without Affirmative Phrases via LLM as Optimizer","created":"2024-08-21","cited_by_count":11,"area":"safety"},{"id":"2409.14177","title":"PathSeeker: Exploring LLM Security Vulnerabilities with a Reinforcement Learning-Based Jailbreak Approach","created":"2024-09-21","cited_by_count":11,"area":"safety"},{"id":"2503.01865","title":"Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints","created":"2025-02-25","cited_by_count":11,"area":"safety"},{"id":"2508.12398","title":"Where to Start Alignment? Diffusion Large Language Model May Demand a Distinct Position","created":"2025-08-17","cited_by_count":11,"area":"safety"},{"id":"2410.22143","title":"AmpleGCG-Plus: A Strong Generative Model of Adversarial Suffixes to Jailbreak LLMs with Higher Success Rates in Fewer Attempts","created":"2024-10-29","cited_by_count":10,"area":"safety"},{"id":"2506.12880","title":"Universal Jailbreak Suffixes Are Strong Attention Hijackers","created":"2025-06-15","cited_by_count":10,"area":"safety"},{"id":"2407.17447","title":"FLRT: Fluent Student-Teacher Redteaming","created":"2024-07-24","cited_by_count":9,"area":"safety"},{"id":"2409.07503","title":"AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMs","created":"2024-09-11","cited_by_count":8,"area":"safety"},{"id":"2510.16794","title":"Black-box Optimization of LLM Outputs by Asking for Directions","created":"2025-10-19","cited_by_count":7,"area":"safety"},{"id":"2601.05445","title":"Knowledge-Driven Multi-Turn Jailbreaking on Large Language Models","created":"2026-01-09","cited_by_count":7,"area":"safety"},{"id":"2407.01902","title":"SeqAR: Jailbreak LLMs with Sequential Auto-Generated Characters","created":"2024-07-02","cited_by_count":6,"area":"safety"},{"id":"2407.14644","title":"Human-Interpretable Adversarial Prompt Attack on Large Language Models with Situational Context","created":"2024-07-19","cited_by_count":6,"area":"safety"},{"id":"2410.11317","title":"Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation","created":"2024-10-15","cited_by_count":6,"area":"safety"},{"id":"2410.13691","title":"Jailbreaking LLM-Controlled Robots","created":"2024-10-17","cited_by_count":6,"area":"safety"},{"id":"2502.18504","title":"TurboFuzzLLM: Turbocharging Mutation-based Fuzzing for Effectively Jailbreaking Large Language Models in Practice","created":"2025-02-21","cited_by_count":6,"area":"safety"},{"id":"2509.06350","title":"Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?","created":"2025-09-08","cited_by_count":6,"area":"safety"},{"id":"2511.04316","title":"AdversariaLLM: A Unified and Modular Toolbox for LLM Robustness Research","created":"2025-11-06","cited_by_count":6,"area":"safety"},{"id":"2405.19668","title":"AutoBreach: Universal and Adaptive Jailbreaking with Efficient Wordplay-Guided Optimization","created":"2024-05-30","cited_by_count":5,"area":"safety"},{"id":"2501.18280","title":"Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models","created":"2025-01-30","cited_by_count":5,"area":"safety"},{"id":"2502.05223","title":"KDA: A Knowledge-Distilled Attacker for Generating Diverse Prompts to Jailbreak LLMs","created":"2025-02-05","cited_by_count":5,"area":"safety"},{"id":"2505.09602","title":"Adversarial Suffix Filtering: a Defense Pipeline for LLMs","created":"2025-05-14","cited_by_count":5,"area":"safety"},{"id":"2505.17519","title":"Chain-of-Lure: A Universal Jailbreak Attack Framework using Unconstrained Synthetic Narratives","created":"2025-05-23","cited_by_count":5,"area":"safety"},{"id":"2510.15476","title":"SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses","created":"2025-10-17","cited_by_count":5,"area":"safety"},{"id":"2410.04190","title":"Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models","created":"2024-10-05","cited_by_count":4,"area":"safety"},{"id":"2410.04234","title":"Functional Homotopy: Smoothing Discrete Optimization via Continuous Parameters for LLM Jailbreak Attacks","created":"2024-10-05","cited_by_count":4,"area":"safety"},{"id":"2412.05232","title":"LIAR: Leveraging Inference Time Alignment (Best-of-N) to Jailbreak LLMs in Seconds","created":"2024-12-06","cited_by_count":4,"area":"safety"},{"id":"2505.09820","title":"Adversarial Attack on Large Language Models using Exponentiated Gradient Descent","created":"2025-05-14","cited_by_count":4,"area":"safety"},{"id":"2506.17299","title":"Toward Principled LLM Safety Testing: Solving the Jailbreak Oracle Problem","created":"2025-06-17","cited_by_count":4,"area":"safety"},{"id":"2508.03365","title":"When Good Sounds Go Adversarial: Jailbreaking Audio-Language Models with Benign Inputs","created":"2025-08-05","cited_by_count":4,"area":"safety"},{"id":"2508.15182","title":"SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks","created":"2025-08-21","cited_by_count":4,"area":"safety"},{"id":"2510.26096","title":"ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models","created":"2025-10-30","cited_by_count":4,"area":"safety"},{"id":"2412.16359","title":"Human-Readable Adversarial Prompts: An Investigation into LLM Vulnerabilities Using Situational Context","created":"2024-12-20","cited_by_count":3,"area":"safety"},{"id":"2501.16534","title":"Targeting Alignment: Extracting Safety Classifiers of Aligned LLMs","created":"2025-01-27","cited_by_count":3,"area":"safety"},{"id":"2502.10487","title":"Fast Proxies for LLM Robustness Evaluation","created":"2025-02-14","cited_by_count":3,"area":"safety"},{"id":"2503.17932","title":"STShield: Single-Token Sentinel for Real-Time Jailbreak Detection in Large Language Models","created":"2025-03-23","cited_by_count":3,"area":"safety"},{"id":"2509.00391","title":"The Resurgence of GCG Adversarial Attacks on Large Language Models","created":"2025-08-30","cited_by_count":3,"area":"safety"},{"id":"2510.02999","title":"NonTextual Target Attack","created":"2025-10-03","cited_by_count":3,"area":"safety"},{"id":"2601.03594","title":"Jailbreaking LLMs & VLMs: Mechanisms, Evaluation, and Unified Defense","created":"2026-01-07","cited_by_count":3,"area":"safety"},{"id":"2605.05058","title":"SoK: Robustness in Large Language Models against Jailbreak Attacks","created":"2026-05-06","cited_by_count":3,"area":"safety"},{"id":"2503.08990","title":"Effective and Efficient Jailbreaks of Black-Box LLMs with Cross-Behavior Attacks","created":"2025-03-12","cited_by_count":2,"area":"safety"},{"id":"2507.07146","title":"Attention-Aware GNN-based Input Defense against Multi-Turn LLM Jailbreak","created":"2025-07-09","cited_by_count":2,"area":"safety"},{"id":"2512.23173","title":"EquaCode: A Multi-Strategy Jailbreak Approach for Large Language Models via Equation Solving and Code Completion","created":"2025-12-29","cited_by_count":2,"area":"safety"},{"id":"2604.18976","title":"STAR-Teaming: A Strategy-Response Multiplex Network Approach to Automated LLM Red Teaming","created":"2026-04-21","cited_by_count":2,"area":"safety"},{"id":"2503.03502","title":"Geometry-Guided Adversarial Prompt Detection via Curvature and Local Intrinsic Dimension","created":"2025-03-05","cited_by_count":1,"area":"safety"},{"id":"2504.01533","title":"LightDefense: A Lightweight Uncertainty-Driven Defense against Jailbreaks via Shifted Token Distribution","created":"2025-04-02","cited_by_count":1,"area":"safety"},{"id":"2508.00555","title":"Activation-Guided Local Editing for Jailbreaking Attacks","created":"2025-08-01","cited_by_count":1,"area":"safety"},{"id":"2512.14751","title":"One Leak Away: How Pretrained Model Exposure Amplifies Jailbreak Risks in Finetuned LLMs","created":"2025-12-14","cited_by_count":1,"area":"safety"},{"id":"2603.23269","title":"Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMs","created":"2026-03-24","cited_by_count":1,"area":"safety"},{"id":"2604.12817","title":"Understanding and Improving Continuous Adversarial Training for LLMs via In-context Learning Theory","created":"2026-04-14","cited_by_count":1,"area":"safety"},{"id":"2606.16527","title":"DoubtProbe: Black-Box Jailbreak Defense via Structural Verification and Semantic Auditing","created":"2026-06-15","cited_by_count":1,"area":"safety"},{"id":"2608.23028","title":"PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policies","created":"2026-08-24","cited_by_count":1,"area":"safety"},{"id":"2609.21793","title":"CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation","created":"2026-09-18","cited_by_count":1,"area":"safety"},{"id":"2511.18581","title":"TASO: Jailbreak LLMs via Alternative Template and Suffix Optimization","created":"2025-11-23","cited_by_count":0,"area":"safety"},{"id":"2511.23174","title":"Are LLMs Good Safety Agents or a Propaganda Engine?","created":"2025-11-28","cited_by_count":0,"area":"safety"},{"id":"2512.04841","title":"SoK: a Comprehensive Causality Analysis Framework for Large Language Model Security","created":"2025-12-04","cited_by_count":0,"area":"safety"},{"id":"2512.13703","title":"Safe2Harm: Semantic Isomorphism Attacks for Jailbreaking Large Language Models","created":"2025-12-05","cited_by_count":0,"area":"safety"},{"id":"2602.06630","title":"TrapSuffix: Proactive Defense Against Adversarial Suffixes in Jailbreaking","created":"2026-02-06","cited_by_count":0,"area":"safety"},{"id":"2603.10080","title":"Amnesia: Adversarial Semantic Layer Specific Activation Steering in Large Language Models","created":"2026-03-10","cited_by_count":0,"area":"safety"},{"id":"2604.10326","title":"Jailbreaking the Matrix: Nullspace Steering for Controlled Model Subversion","created":"2026-04-11","cited_by_count":0,"area":"safety"},{"id":"2605.17128","title":"New Wide-Net-Casting Jailbreak Attacks Risk Large Models","created":"2026-05-16","cited_by_count":0,"area":"safety"},{"id":"2605.20286","title":"Adaptive Probe-based Steering for Robust LLM Jailbreaking","created":"2026-05-19","cited_by_count":0,"area":"safety"},{"id":"2606.03647","title":"All you need to break LLMs are Black-Box, Adapting, Efficient, Transferable, Harmful, Applicable ... Attacks","created":"2026-06-02","cited_by_count":0,"area":"safety"},{"id":"2607.17152","title":"How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions","created":"2026-07-19","cited_by_count":0,"area":"safety"},{"id":"2608.14392","title":"Tripwire: Triggering Aligned Refusal via Statistically Certified Safety Neurons","created":"2026-08-14","cited_by_count":0,"area":"safety"},{"id":"2608.26506","title":"A Single Suffix to Break Them All: Basin-Aware Jailbreaks for Merged Model Families","created":"2026-08-27","cited_by_count":0,"area":"safety"},{"id":"2608.30748","title":"The Fragility of Jailbreak Robustness Across Operational States","created":"2026-08-31","cited_by_count":0,"area":"safety"},{"id":"2609.02172","title":"Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search","created":"2026-09-02","cited_by_count":0,"area":"safety"},{"id":"2609.29948","title":"ENDOPROMPT: Victim-Side Pseudo-References for Utility Degradation","created":"2026-09-24","cited_by_count":0,"area":"safety"}],"next_cursor":null}