{"total":29,"rows":[{"id":"2509.09708","title":"Beyond I'm Sorry, I Can't: Dissecting Large Language Model Refusal","created":"2025-09-07","cited_by_count":19,"area":"safety"},{"id":"2509.21947","title":"Active Attacks: Red-teaming LLMs via Adaptive Environments","created":"2025-09-26","cited_by_count":7,"area":"safety"},{"id":"2511.14423","title":"Unified Defense for Large Language Models against Jailbreak and Fine-Tuning Attacks in Education","created":"2025-11-18","cited_by_count":5,"area":"safety"},{"id":"2604.09544","title":"Large Language Models Generate Harmful Responses Using a Distinct Mechanism, Shared Across Harm Types","created":"2026-04-10","cited_by_count":3,"area":"safety"},{"id":"2606.08044","title":"When Behavioral Safety Evaluation Fails: A Representation-Level Perspective","created":"2026-06-06","cited_by_count":2,"area":"safety"},{"id":"2607.12792","title":"Silent Alarm: A J-Space Protocol for Comparing Danger Recognition Across Models and Quantization Levels","created":"2026-07-14","cited_by_count":2,"area":"safety"},{"id":"2607.13075","title":"The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators","created":"2026-07-12","cited_by_count":2,"area":"safety"},{"id":"2608.08029","title":"Do All LLMs Know When They're Being Harmful? A Reproducibility Study of Latent-Space Safety Probes Across Model Families","created":"2026-08-08","cited_by_count":2,"area":"safety"},{"id":"2509.25843","title":"ASGuard: Activation-Scaling Guard to Mitigate Targeted Jailbreaking Attack","created":"2025-09-30","cited_by_count":1,"area":"safety"},{"id":"2511.08367","title":"Why Does Weak-OOD Help? A Further Step Towards Understanding Jailbreaking VLMs","created":"2025-11-11","cited_by_count":1,"area":"safety"},{"id":"2603.08234","title":"The Struggle Between Continuation and Refusal: A Mechanistic Analysis of the Continuation-Triggered Jailbreak in LLMs","created":"2026-03-09","cited_by_count":1,"area":"safety"},{"id":"2605.26526","title":"Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks","created":"2026-05-26","cited_by_count":1,"area":"safety"},{"id":"2608.03201","title":"When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models","created":"2026-08-04","cited_by_count":1,"area":"safety"},{"id":"2609.16204","title":"Decoy Direction Optimization: A Post-Hoc Defense Against LLM Abliteration","created":"2026-09-14","cited_by_count":1,"area":"safety"},{"id":"2609.29287","title":"AEGIS: Audio Endogenous Guarding via Internal Signals Against Large Audio-Language Model Jailbreaks","created":"2026-09-24","cited_by_count":1,"area":"safety"},{"id":"2605.00123","title":"Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Models","created":"2026-04-30","cited_by_count":0,"area":"safety"},{"id":"2605.14347","title":"Exemplar Partitioning for Mechanistic Interpretability","created":"2026-05-14","cited_by_count":0,"area":"safety"},{"id":"2605.24550","title":"Jailbreak to Protect: Buffering and Reinforcing via Temporary Jailbreaking for Safe Fine-Tuning in Large Language Models","created":"2026-05-23","cited_by_count":0,"area":"safety"},{"id":"2607.20581","title":"Geometric Configurations of Perturbed Jailbreak Prompts","created":"2026-07-22","cited_by_count":0,"area":"safety"},{"id":"2608.30585","title":"The Safety Relay in Roleplay Jailbreaks: A Component-Resolved Causal Analysis of Harm Recognition and Refusal","created":"2026-08-31","cited_by_count":0,"area":"safety"},{"id":"2609.00790","title":"RISA: Response Inspection and Selective Actions for Refusal Calibration in Large Language Models","created":"2026-09-01","cited_by_count":0,"area":"safety"},{"id":"2609.05797","title":"Safety Monitors Mostly Catch What the Model Already Refuses","created":"2026-09-05","cited_by_count":0,"area":"safety"},{"id":"2609.13737","title":"ForeSight: Enhancing Risk Monitoring via Early Safety Signal Distillation","created":"2026-09-12","cited_by_count":0,"area":"safety"},{"id":"2609.19366","title":"The Role of Fine-grained Harm Signals in LLM Safety","created":"2026-09-16","cited_by_count":0,"area":"safety"},{"id":"2609.26178","title":"Unread or Unenforced? Separating Representation from Enforcement Failure in Content Guards","created":"2026-08-12","cited_by_count":0,"area":"safety"},{"id":"2609.32434","title":"From Latents to Wires: Surgical Post-Editing on Large Language Models","created":"2026-09-26","cited_by_count":0,"area":"safety"},{"id":"2610.00348","title":"Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation","created":"2026-09-29","cited_by_count":0,"area":"safety"},{"id":"2610.04245","title":"On the Steering Dimensionality of Refusal in Language Models","created":"2026-10-03","cited_by_count":0,"area":"safety"},{"id":"2610.05541","title":"Don't Judge an LLM Only by Its Activations: Discovering Suppressed Safety Features via Counterfactual Activation Potential","created":"2026-10-04","cited_by_count":0,"area":"safety"}],"next_cursor":null}