{"total":83,"rows":[{"id":"2408.15221","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","created":"2024-08-27","cited_by_count":151,"area":"safety"},{"id":"2408.00761","title":"Tamper-Resistant Safeguards for Open-Weight LLMs","created":"2024-08-01","cited_by_count":138,"area":"safety"},{"id":"2410.16454","title":"Catastrophic Failure of LLM Unlearning via Quantization","created":"2024-10-21","cited_by_count":81,"area":"safety"},{"id":"2502.05374","title":"Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond","created":"2025-02-07","cited_by_count":79,"area":"safety"},{"id":"2410.09102","title":"Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy","created":"2024-10-09","cited_by_count":67,"area":"safety"},{"id":"2410.02879","title":"Position: LLM Unlearning Benchmarks are Weak Measures of Progress","created":"2024-10-03","cited_by_count":63,"area":"safety"},{"id":"2411.03343","title":"What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks","created":"2024-11-02","cited_by_count":29,"area":"safety"},{"id":"2506.14922","title":"FORTRESS: Frontier Risk Evaluation for National Security and Public Safety","created":"2025-06-17","cited_by_count":24,"area":"safety"},{"id":"2506.01339","title":"Invariance Makes LLM Unlearning Resilient Even to Unanticipated Downstream Fine-Tuning","created":"2025-06-02","cited_by_count":21,"area":"safety"},{"id":"2410.01294","title":"Endless Jailbreaks with Bijection Learning","created":"2024-10-02","cited_by_count":19,"area":"safety"},{"id":"2410.16531","title":"Bayesian scaling laws for in-context learning","created":"2024-10-21","cited_by_count":19,"area":"safety"},{"id":"2508.07646","title":"Multi-Turn Jailbreaks Are Simpler Than They Seem","created":"2025-08-11","cited_by_count":17,"area":"safety"},{"id":"2506.07171","title":"RULE: Reinforcement UnLEarning Achieves Forget-Retain Pareto Optimality","created":"2025-06-08","cited_by_count":16,"area":"safety"},{"id":"2502.04204","title":"Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidence","created":"2025-02-06","cited_by_count":14,"area":"safety"},{"id":"2505.24445","title":"Learning Safety Constraints for Large Language Models","created":"2025-05-30","cited_by_count":13,"area":"safety"},{"id":"2505.16947","title":"MixAT: Combining Continuous and Discrete Adversarial Training for LLMs","created":"2025-05-22","cited_by_count":11,"area":"safety"},{"id":"2506.06278","title":"Distillation Robustifies Unlearning","created":"2025-06-06","cited_by_count":11,"area":"safety"},{"id":"2509.21761","title":"Backdoor Attribution: Elucidating and Controlling Backdoor in Language Models","created":"2025-09-26","cited_by_count":10,"area":"safety"},{"id":"2501.19202","title":"Improving LLM Unlearning Robustness via Random Perturbations","created":"2025-01-31","cited_by_count":9,"area":"safety"},{"id":"2502.09638","title":"Jailbreaking to Jailbreak","created":"2025-02-09","cited_by_count":9,"area":"safety"},{"id":"2505.16723","title":"LLM Fingerprinting via Semantically Conditioned Watermarks","created":"2025-05-22","cited_by_count":9,"area":"safety"},{"id":"2410.09097","title":"Recent advancements in LLM Red-Teaming: Techniques, Defenses, and Ethical Considerations","created":"2024-10-09","cited_by_count":8,"area":"safety"},{"id":"2502.15082","title":"UPCORE: Utility-Preserving Coreset Selection for Balanced Unlearning","created":"2025-02-20","cited_by_count":7,"area":"safety"},{"id":"2510.21910","title":"Adversarial D\\'ej\\`a Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attacks","created":"2025-10-24","cited_by_count":7,"area":"safety"},{"id":"2511.00203","title":"Diffusion LLMs are Natural Adversaries for any LLM","created":"2025-10-31","cited_by_count":7,"area":"safety"},{"id":"2410.13691","title":"Jailbreaking LLM-Controlled Robots","created":"2024-10-17","cited_by_count":6,"area":"safety"},{"id":"2602.12418","title":"Sparse Autoencoders are Capable LLM Jailbreak Mitigators","created":"2026-02-12","cited_by_count":6,"area":"safety"},{"id":"2502.00653","title":"Towards Robust Multimodal Large Language Models Against Jailbreak Attacks","created":"2025-02-02","cited_by_count":5,"area":"safety"},{"id":"2505.16567","title":"Watch your steps: Dormant Adversarial Behaviors that Activate upon LLM Finetuning","created":"2025-05-22","cited_by_count":5,"area":"safety"},{"id":"2506.10236","title":"Prompt Attacks Reveal Superficial Knowledge Removal in Unlearning Methods","created":"2025-06-11","cited_by_count":5,"area":"safety"},{"id":"2508.06595","title":"LLM Unlearning Without an Expert Curated Dataset","created":"2025-08-08","cited_by_count":5,"area":"safety"},{"id":"2510.04891","title":"SocialHarmBench: Revealing LLM Vulnerabilities to Socially Harmful Requests","created":"2025-10-06","cited_by_count":5,"area":"safety"},{"id":"2601.02680","title":"Adversarial Contrastive Learning for LLM Quantization Attacks","created":"2026-01-06","cited_by_count":5,"area":"safety"},{"id":"2504.09604","title":"Mitigating Many-Shot Jailbreaking","created":"2025-04-13","cited_by_count":4,"area":"safety"},{"id":"2506.17299","title":"Toward Principled LLM Safety Testing: Solving the Jailbreak Oracle Problem","created":"2025-06-17","cited_by_count":4,"area":"safety"},{"id":"2509.24675","title":"Understanding the Dilemma of Unlearning for Large Language Models","created":"2025-09-29","cited_by_count":4,"area":"safety"},{"id":"2510.00761","title":"Downgrade to Upgrade: Optimizer Simplification Enhances Robustness in LLM Unlearning","created":"2025-10-01","cited_by_count":4,"area":"safety"},{"id":"2510.02334","title":"Where Did It Go Wrong? Attributing Undesirable LLM Behaviors via Representation Gradient Tracing","created":"2025-09-26","cited_by_count":4,"area":"safety"},{"id":"2604.08169","title":"Activation Steering for Aligned Open-ended Generation without Sacrificing Coherence","created":"2026-04-09","cited_by_count":4,"area":"safety"},{"id":"2502.10487","title":"Fast Proxies for LLM Robustness Evaluation","created":"2025-02-14","cited_by_count":3,"area":"safety"},{"id":"2505.01315","title":"Helping Large Language Models Protect Themselves: An Enhanced Filtering and Summarization System","created":"2025-05-02","cited_by_count":2,"area":"safety"},{"id":"2506.05376","title":"A Red Teaming Roadmap Towards System-Level Safety","created":"2025-05-30","cited_by_count":2,"area":"safety"},{"id":"2506.07356","title":"Safety-Aligned Weights Are Not Enough: Refusal-Teacher-Guided Finetuning Enhances Safety and Downstream Performance under Harmful Finetuning Attacks","created":"2025-06-09","cited_by_count":2,"area":"safety"},{"id":"2509.23362","title":"Dual-Space Smoothness for Robust and Balanced LLM Unlearning","created":"2025-09-27","cited_by_count":2,"area":"safety"},{"id":"2510.07626","title":"LLM Unlearning Under the Microscope: A Full-Stack View on Methods and Metrics","created":"2025-10-08","cited_by_count":2,"area":"safety"},{"id":"2602.06911","title":"TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tampering","created":"2026-02-06","cited_by_count":2,"area":"safety"},{"id":"2604.09235","title":"Unreal Thinking: Chain-of-Thought Hijacking via Two-stage Backdoor","created":"2026-04-10","cited_by_count":2,"area":"safety"},{"id":"2606.08044","title":"When Behavioral Safety Evaluation Fails: A Representation-Level Perspective","created":"2026-06-06","cited_by_count":2,"area":"safety"},{"id":"2503.03502","title":"Geometry-Guided Adversarial Prompt Detection via Curvature and Local Intrinsic Dimension","created":"2025-03-05","cited_by_count":1,"area":"safety"},{"id":"2505.09500","title":"Layered Unlearning for Adversarial Relearning","created":"2025-05-14","cited_by_count":1,"area":"safety"},{"id":"2512.04144","title":"RippleBench: Capturing Ripple Effects Using Existing Knowledge Repositories","created":"2025-12-03","cited_by_count":1,"area":"safety"},{"id":"2601.21702","title":"Beyond Forgetting: Representation Misdirection Elicits Controllable Side Behaviors and Capabilities","created":"2026-01-29","cited_by_count":1,"area":"safety"},{"id":"2604.12817","title":"Understanding and Improving Continuous Adversarial Training for LLMs via In-context Learning Theory","created":"2026-04-14","cited_by_count":1,"area":"safety"},{"id":"2604.22076","title":"PrivUn: Unveiling Latent Ripple Effects and Shallow Forgetting in Privacy Unlearning","created":"2026-04-23","cited_by_count":1,"area":"safety"},{"id":"2605.08496","title":"Latent Personality Alignment: Improving Harmlessness Without Mentioning Harms","created":"2026-05-08","cited_by_count":1,"area":"safety"},{"id":"2605.11685","title":"Robust LLM Unlearning Against Relearning Attacks: The Minor Components in Representations Matter","created":"2026-05-12","cited_by_count":1,"area":"safety"},{"id":"2606.20668","title":"BELLS-O: Evaluating the Operational Trade-offs of LLM Supervision Systems","created":"2026-06-12","cited_by_count":1,"area":"safety"},{"id":"2609.08901","title":"The BatchNorm Illusion: Diagnosing Normalization Artifacts in Machine Unlearning Evaluation","created":"2026-09-08","cited_by_count":1,"area":"safety"},{"id":"2609.16204","title":"Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration","created":"2026-09-14","cited_by_count":1,"area":"safety"},{"id":"2505.18672","title":"Concept Concentration for Faithful Representation Intervention","created":"2025-05-24","cited_by_count":0,"area":"safety"},{"id":"2510.12672","title":"Keep Calm and Avoid Harmful Content: Concept Alignment and Latent Manipulation Towards Safer Answers","created":"2025-10-14","cited_by_count":0,"area":"safety"},{"id":"2512.03089","title":"Password-Activated Shutdown Protocols for Misaligned Frontier Agents","created":"2025-11-29","cited_by_count":0,"area":"safety"},{"id":"2601.13359","title":"Sockpuppetting: Jailbreaking LLMs by Combining Prefilling with Optimization","created":"2026-01-19","cited_by_count":0,"area":"safety"},{"id":"2604.10403","title":"Latent Instruction Representation Alignment: defending against jailbreaks, backdoors and undesired knowledge in LLMs","created":"2026-04-12","cited_by_count":0,"area":"safety"},{"id":"2605.05415","title":"Information Theoretic Adversarial Training of Large Language Models","created":"2026-05-06","cited_by_count":0,"area":"safety"},{"id":"2605.20286","title":"Adaptive Probe-based Steering for Robust LLM Jailbreaking","created":"2026-05-19","cited_by_count":0,"area":"safety"},{"id":"2605.24550","title":"Jailbreak to Protect: Buffering and Reinforcing via Temporary Jailbreaking for Safe Fine-Tuning in Large Language Models","created":"2026-05-23","cited_by_count":0,"area":"safety"},{"id":"2605.24552","title":"Ellipsoid Control: A White-list Jailbreak Defense via Benign Latent Modeling","created":"2026-05-23","cited_by_count":0,"area":"safety"},{"id":"2606.02920","title":"Fast Unlearning at Scale via Margin Self-Correction","created":"2026-06-01","cited_by_count":0,"area":"safety"},{"id":"2606.03647","title":"All you need to break LLMs are Black-Box, Adapting, Efficient, Transferable, Harmful, Applicable ... Attacks","created":"2026-06-02","cited_by_count":0,"area":"safety"},{"id":"2606.09559","title":"Safe-RULE: Safe Reinforcement UnLEarning","created":"2026-06-08","cited_by_count":0,"area":"safety"},{"id":"2606.26936","title":"Jailbreaking for the Average Jane: Choosing Optimal Jailbreaks via Bandit Algorithms for Automatically Enhanced Queries","created":"2026-06-25","cited_by_count":0,"area":"safety"},{"id":"2606.29646","title":"Fuzzing Large Language Models to Elicit Hidden Behaviours","created":"2026-06-28","cited_by_count":0,"area":"safety"},{"id":"2607.20473","title":"Incomplete Prompt Jailbreaks in Large Language Models","created":"2026-05-24","cited_by_count":0,"area":"safety"},{"id":"2607.27836","title":"Crossing the Margin Cliff: Toward Relearn-Robust LLM Unlearning via Margin Calibration","created":"2026-07-30","cited_by_count":0,"area":"safety"},{"id":"2608.25429","title":"Distance Is Not Enough: Forget-Retain Alignment Gap Predicts LLM Relearning Robustness","created":"2026-08-26","cited_by_count":0,"area":"safety"},{"id":"2608.30403","title":"Why Are LLM Backdoor Defenses Fragmented? A Feature-Level Explanation with Sparse Autoencoders","created":"2026-08-31","cited_by_count":0,"area":"safety"},{"id":"2609.00051","title":"From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling","created":"2026-08-30","cited_by_count":0,"area":"safety"},{"id":"2609.36612","title":"Do LLMs Really Forget? Hidden-State Leakage in Model Unlearning and How to Fix it","created":"2026-09-29","cited_by_count":0,"area":"safety"},{"id":"2609.36657","title":"Constitutional adapters: Inference-time interventions for misalignment and misuse","created":"2026-09-29","cited_by_count":0,"area":"safety"},{"id":"2609.39866","title":"Preemptive LLM Unlearning against Forbidden Capability Acquisition via Gradient Sealing","created":"2026-09-30","cited_by_count":0,"area":"safety"},{"id":"2610.04470","title":"Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching","created":"2026-10-03","cited_by_count":0,"area":"safety"},{"id":"2610.19385","title":"RA$^2$: Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearning","created":"2026-10-14","cited_by_count":0,"area":"safety"}],"next_cursor":null}