{"total":548,"rows":[{"id":"2408.15221","title":"LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet","created":"2024-08-27","cited_by_count":151,"area":"safety"},{"id":"2411.00348","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","created":"2024-11-01","cited_by_count":95,"area":"safety"},{"id":"2506.12618","title":"OpenUnlearning: Accelerating LLM Unlearning via Unified Benchmarking of Methods and Metrics","created":"2025-06-14","cited_by_count":83,"area":"safety"},{"id":"2410.16454","title":"Catastrophic Failure of LLM Unlearning via Quantization","created":"2024-10-21","cited_by_count":81,"area":"safety"},{"id":"2410.02832","title":"FlipAttack: Jailbreak LLMs via Flipping","created":"2024-10-02","cited_by_count":80,"area":"safety"},{"id":"2412.03556","title":"Best-of-N Jailbreaking","created":"2024-12-04","cited_by_count":76,"area":"safety"},{"id":"2410.11143","title":"LLM Unlearning via Loss Adjustment with Only Forget Data","created":"2024-10-14","cited_by_count":75,"area":"safety"},{"id":"2410.13708","title":"On the Role of Attention Heads in Large Language Model Safety","created":"2024-10-17","cited_by_count":72,"area":"safety"},{"id":"2510.07192","title":"Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples","created":"2025-10-08","cited_by_count":72,"area":"safety"},{"id":"2412.17686","title":"Large Language Model Safety: A Holistic Survey","created":"2024-12-23","cited_by_count":59,"area":"safety"},{"id":"2502.07557","title":"JBShield: Defending Large Language Models from Jailbreak Attacks through Activated Concept Analysis and Manipulation","created":"2025-02-11","cited_by_count":54,"area":"safety"},{"id":"2502.19820","title":"Foot-In-The-Door: A Multi-turn Jailbreak for LLMs","created":"2025-02-27","cited_by_count":54,"area":"safety"},{"id":"2408.12798","title":"BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models","created":"2024-08-23","cited_by_count":50,"area":"safety"},{"id":"2501.15145","title":"PromptShield: Deployable Detection for Prompt Injection Attacks","created":"2025-01-25","cited_by_count":50,"area":"safety"},{"id":"2506.07022","title":"AlphaSteer: Learning Refusal Steering with Principled Null-Space Constraint","created":"2025-06-08","cited_by_count":49,"area":"safety"},{"id":"2505.24119","title":"The State of Multilingual LLM Safety Research: From Measuring the Language Gap to Mitigating It","created":"2025-05-30","cited_by_count":45,"area":"safety"},{"id":"2411.00459","title":"Defense Against Prompt Injection Attack by Leveraging Attack Techniques","created":"2024-11-01","cited_by_count":40,"area":"safety"},{"id":"2506.09443","title":"LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge","created":"2025-06-11","cited_by_count":37,"area":"safety"},{"id":"2410.02760","title":"Erasing Conceptual Knowledge from Language Models","created":"2024-10-03","cited_by_count":34,"area":"safety"},{"id":"2410.08811","title":"PoisonBench: Assessing Large Language Model Vulnerability to Data Poisoning","created":"2024-10-11","cited_by_count":33,"area":"safety"},{"id":"2410.09040","title":"AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation","created":"2024-10-11","cited_by_count":33,"area":"safety"},{"id":"2410.18210","title":"Towards Understanding the Fragility of Multilingual LLMs against Fine-Tuning Attacks","created":"2024-10-23","cited_by_count":33,"area":"safety"},{"id":"2502.12197","title":"A Closer Look at System Prompt Robustness","created":"2025-02-15","cited_by_count":32,"area":"safety"},{"id":"2411.12103","title":"Does Unlearning Truly Unlearn? A Black Box Evaluation of LLM Unlearning Methods","created":"2024-11-18","cited_by_count":26,"area":"safety"},{"id":"2504.11168","title":"Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systems","created":"2025-04-15","cited_by_count":26,"area":"safety"},{"id":"2412.10321","title":"AdvPrefix: An Objective for Nuanced LLM Jailbreaks","created":"2024-12-13","cited_by_count":25,"area":"safety"},{"id":"2503.16248","title":"Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents","created":"2025-03-20","cited_by_count":24,"area":"safety"},{"id":"2410.10414","title":"On Calibration of LLM-based Guard Models for Reliable Content Moderation","created":"2024-10-14","cited_by_count":23,"area":"safety"},{"id":"2503.06808","title":"Privacy Auditing of Large Language Models","created":"2025-03-09","cited_by_count":23,"area":"safety"},{"id":"2504.07887","title":"Benchmarking Adversarial Robustness to Bias Elicitation in Large Language Models: Scalable Automated Assessment with LLM-as-a-Judge","created":"2025-04-10","cited_by_count":23,"area":"safety"},{"id":"2504.18530","title":"Scaling Laws For Scalable Oversight","created":"2025-04-25","cited_by_count":23,"area":"safety"},{"id":"2410.14827","title":"Enhancing Prompt Injection Attacks to LLMs via Poisoning Alignment","created":"2024-10-18","cited_by_count":21,"area":"safety"},{"id":"2509.22067","title":"The Rogue Scalpel: Activation Steering Compromises LLM Safety","created":"2025-09-26","cited_by_count":21,"area":"safety"},{"id":"2503.00187","title":"Steering Dialogue Dynamics for Robustness against Multi-turn Jailbreaking Attacks","created":"2025-02-28","cited_by_count":20,"area":"safety"},{"id":"2603.06594","title":"A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness","created":"2026-02-04","cited_by_count":20,"area":"safety"},{"id":"2411.11203","title":"Debiasing Watermarks for Large Language Models via Maximal Coupling","created":"2024-11-17","cited_by_count":19,"area":"safety"},{"id":"2502.05163","title":"Enhancing LLM Safety Through a Theoretical Minimax Game Lens","created":"2025-02-07","cited_by_count":19,"area":"safety"},{"id":"2502.11598","title":"Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation?","created":"2025-02-17","cited_by_count":19,"area":"safety"},{"id":"2503.04636","title":"Mark Your LLM: Detecting the Misuse of Open-Source Large Language Models via Watermarking","created":"2025-03-06","cited_by_count":19,"area":"safety"},{"id":"2506.07596","title":"TwinBreak: Jailbreaking LLM Security Alignments based on Twin Prompts","created":"2025-06-09","cited_by_count":19,"area":"safety"},{"id":"2505.05190","title":"Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks","created":"2025-05-08","cited_by_count":18,"area":"safety"},{"id":"2505.14103","title":"AudioJailbreak: Jailbreak Attacks against End-to-End Large Audio-Language Models","created":"2025-05-20","cited_by_count":18,"area":"safety"},{"id":"2502.11268","title":"Improved Unbiased Watermark for Large Language Models","created":"2025-02-16","cited_by_count":17,"area":"safety"},{"id":"2505.13312","title":"GUARD: Generation-time LLM Unlearning via Adaptive Restriction and Detection","created":"2025-05-19","cited_by_count":17,"area":"safety"},{"id":"2505.21277","title":"Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space","created":"2025-05-27","cited_by_count":17,"area":"safety"},{"id":"2507.13686","title":"TopicAttack: An Indirect Prompt Injection Attack via Topic Transition","created":"2025-07-18","cited_by_count":17,"area":"safety"},{"id":"2510.19422","title":"LLM Unlearning with LLM Beliefs","created":"2025-10-22","cited_by_count":17,"area":"safety"},{"id":"2410.02163","title":"Adversarial Decoding: Generating Readable Documents for Adversarial Objectives","created":"2024-10-03","cited_by_count":16,"area":"safety"},{"id":"2410.02440","title":"Optimizing Adaptive Attacks against Watermarks for Language Models","created":"2024-10-03","cited_by_count":16,"area":"safety"},{"id":"2502.11441","title":"Which Retain Set Matters for LLM Unlearning? A Case Study on Entity Unlearning","created":"2025-02-17","cited_by_count":16,"area":"safety"},{"id":"2504.20472","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","created":"2025-04-29","cited_by_count":16,"area":"safety"},{"id":"2508.12733","title":"LinguaSafe: A Comprehensive Multilingual Safety Benchmark for Large Language Models","created":"2025-08-18","cited_by_count":16,"area":"safety"},{"id":"2509.21057","title":"PMark: Towards Robust and Distortion-free Semantic-level Watermarking with Channel Constraints","created":"2025-09-25","cited_by_count":16,"area":"safety"},{"id":"2509.26238","title":"Beyond Linear Probes: Dynamic Safety Monitoring for Language Models","created":"2025-09-30","cited_by_count":16,"area":"safety"},{"id":"2412.16633","title":"Easier Said Than Done: Unpacking Intent-Behavior Gap in Jailbreaking LLM-Based Robots","created":"2024-12-21","cited_by_count":15,"area":"safety"},{"id":"2410.03857","title":"You Know What I'm Saying: Jailbreak Attack via Implicit Reference","created":"2024-10-04","cited_by_count":14,"area":"safety"},{"id":"2410.13808","title":"De-mark: Watermark Removal in Large Language Models","created":"2024-10-17","cited_by_count":14,"area":"safety"},{"id":"2410.15153","title":"Evaluating Deep Unlearning in Large Language Models","created":"2024-10-19","cited_by_count":14,"area":"safety"},{"id":"2502.04204","title":"Short-length Adversarial Training Helps LLMs Defend Long-length Jailbreak Attacks: Theoretical and Empirical Evidence","created":"2025-02-06","cited_by_count":14,"area":"safety"},{"id":"2502.17823","title":"A General Framework to Enhance Fine-tuning-based LLM Unlearning","created":"2025-02-25","cited_by_count":14,"area":"safety"},{"id":"2503.08195","title":"Dialogue Injection Attack: Jailbreaking LLMs through Context Manipulation","created":"2025-03-11","cited_by_count":14,"area":"safety"},{"id":"2504.04626","title":"Exact Unlearning of Finetuning Data via Model Merging at Scale","created":"2025-04-06","cited_by_count":14,"area":"safety"},{"id":"2504.07467","title":"Defense against Prompt Injection Attacks via Mixture of Encodings","created":"2025-04-10","cited_by_count":14,"area":"safety"},{"id":"2410.03168","title":"Can Watermarked LLMs be Identified by Users via Crafted Prompts?","created":"2024-10-04","cited_by_count":13,"area":"safety"},{"id":"2410.07582","title":"Detecting Training Data of Large Language Models via Expectation Maximization","created":"2024-10-10","cited_by_count":13,"area":"safety"},{"id":"2501.14250","title":"Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors","created":"2025-01-24","cited_by_count":13,"area":"safety"},{"id":"2502.10525","title":"Towards Watermarking of Open-Source LLMs","created":"2025-02-14","cited_by_count":13,"area":"safety"},{"id":"2504.03174","title":"Multi-lingual Multi-turn Automated Red Teaming for LLMs","created":"2025-04-04","cited_by_count":13,"area":"safety"},{"id":"2505.14483","title":"MoMoE: Mixture of Moderation Experts Framework for AI-Assisted Online Governance","created":"2025-05-20","cited_by_count":13,"area":"safety"},{"id":"2509.10248","title":"Prompt Injection Attacks on LLM Generated Reviews of Scientific Publications","created":"2025-09-12","cited_by_count":13,"area":"safety"},{"id":"2602.22983","title":"Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Search","created":"2026-02-26","cited_by_count":13,"area":"safety"},{"id":"2410.21083","title":"Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring","created":"2024-10-28","cited_by_count":12,"area":"safety"},{"id":"2502.16903","title":"GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods","created":"2025-02-24","cited_by_count":12,"area":"safety"},{"id":"2503.04036","title":"Robust Data Watermarking in Language Models by Injecting Fictitious Knowledge","created":"2025-03-06","cited_by_count":12,"area":"safety"},{"id":"2504.18564","title":"DualBreach: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimization","created":"2025-04-21","cited_by_count":12,"area":"safety"},{"id":"2505.22310","title":"From Dormant to Deleted: Tamper-Resistant Unlearning Through Weight-Space Regularization","created":"2025-05-28","cited_by_count":12,"area":"safety"},{"id":"2509.09703","title":"CTCC: A Robust and Stealthy Fingerprinting Framework for Large Language Models via Cross-Turn Contextual Correlation Backdoor","created":"2025-09-05","cited_by_count":12,"area":"safety"},{"id":"2410.06809","title":"Root Defence Strategies: Ensuring Safety of LLM at the Decoding Level","created":"2024-10-09","cited_by_count":11,"area":"safety"},{"id":"2410.08660","title":"RePD: Defending Jailbreak Attack through a Retrieval-based Prompt Decomposition Process","created":"2024-10-11","cited_by_count":11,"area":"safety"},{"id":"2411.06899","title":"LongSafety: Enhance Safety for Long-Context LLMs","created":"2024-11-11","cited_by_count":11,"area":"safety"},{"id":"2502.05911","title":"GRAIT: Gradient-Driven Refusal-Aware Instruction Tuning for Effective Hallucination Mitigation","created":"2025-02-09","cited_by_count":11,"area":"safety"},{"id":"2503.01742","title":"Building Safe GenAI Applications: An End-to-End Overview of Red Teaming for Large Language Models","created":"2025-03-03","cited_by_count":11,"area":"safety"},{"id":"2503.01865","title":"Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints","created":"2025-02-25","cited_by_count":11,"area":"safety"},{"id":"2504.07113","title":"How Robust Are Router-LLMs? Analysis of the Fragility of LLM Routing Capabilities","created":"2025-03-20","cited_by_count":11,"area":"safety"},{"id":"2504.17480","title":"Unified attacks to large language model watermarks: spoofing and scrubbing in unauthorized knowledge distillation","created":"2025-04-24","cited_by_count":11,"area":"safety"},{"id":"2505.09921","title":"PIG: Privacy Jailbreak Attack on LLMs via Gradient-based Iterative In-Context Optimization","created":"2025-05-15","cited_by_count":11,"area":"safety"},{"id":"2505.16947","title":"MixAT: Combining Continuous and Discrete Adversarial Training for LLMs","created":"2025-05-22","cited_by_count":11,"area":"safety"},{"id":"2508.12398","title":"Where to Start Alignment? Diffusion Large Language Model May Demand a Distinct Position","created":"2025-08-17","cited_by_count":11,"area":"safety"},{"id":"2509.01444","title":"Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructions","created":"2025-09-01","cited_by_count":11,"area":"safety"},{"id":"2509.02820","title":"Unlearning That Lasts: Utility-Preserving, Robust, and Almost Irreversible Forgetting in LLMs","created":"2025-09-02","cited_by_count":11,"area":"safety"},{"id":"2604.08499","title":"PIArena: A Platform for Prompt Injection Evaluation","created":"2026-04-09","cited_by_count":11,"area":"safety"},{"id":"2409.08846","title":"Fingerprint Vector: Enabling Scalable and Efficient Model Fingerprint Transfer via Vector Addition","created":"2024-09-13","cited_by_count":10,"area":"safety"},{"id":"2410.06913","title":"Utilize the Flow before Stepping into the Same River Twice: Certainty Represented Knowledge Flow for Refusal-Aware Instruction Tuning","created":"2024-10-09","cited_by_count":10,"area":"safety"},{"id":"2411.19876","title":"LUMIA: Linear probing for Unimodal and MultiModal Membership Inference Attacks leveraging internal LLM states","created":"2024-11-29","cited_by_count":10,"area":"safety"},{"id":"2501.18632","title":"Towards Safe AI Clinicians: A Comprehensive Study on Large Language Model Jailbreaking in Healthcare","created":"2025-01-27","cited_by_count":10,"area":"safety"},{"id":"2502.09755","title":"Jailbreak Attack Initializations as Extractors of Compliance Directions","created":"2025-02-13","cited_by_count":10,"area":"safety"},{"id":"2502.11647","title":"DELMAN: Dynamic Defense Against Large Language Model Jailbreaking with Model Editing","created":"2025-02-17","cited_by_count":10,"area":"safety"},{"id":"2505.16934","title":"In-Context Watermarks for Large Language Models","created":"2025-05-22","cited_by_count":10,"area":"safety"},{"id":"2505.17601","title":"Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs","created":"2025-05-23","cited_by_count":10,"area":"safety"},{"id":"2506.05314","title":"Constrained Entropic Unlearning: A Primal-Dual Framework for Large Language Models","created":"2025-06-05","cited_by_count":10,"area":"safety"}],"next_cursor":"100"}