Current state of LLM Risks and AI Guardrails
On the map: LLM safety and security → Safety alignment, refusal and guardrails
Abstract (arXiv)
Large language models (LLMs) have become increasingly sophisticated, leading to widespread deployment in sensitive applications where safety and reliability are paramount. However, LLMs have inherent risks accompanying them, including bias, potential for unsafe actions, dataset poisoning, lack of explainability, hallucinations, and non-reproducibility. These risks necessitate the development of "guardrails" to align LLMs with desired behaviors and mitigate potential harm. This work explores the risks associated with deploying LLMs and evaluates current approaches to implementing guardrails and model alignment techniques. We examine intrinsic and extrinsic bias evaluation methods and discuss the importance of fairness metrics for responsible AI development. The safety and reliability of agentic LLMs (those capable of real-world actions) are explored, emphasizing the need for testability, fail-safes, and situational awareness. Technical strategies for securing LLMs are presented, including a layered protection model operating at external, secondary, and internal levels. System prompts, Retrieval-Augmented Generation (RAG) architectures, and techniques to minimize bias and protect privacy are highlighted. Effective guardrail design requires a deep understanding of the LLM's intended use case, relevant regulations, and ethical considerations. Striking a balance between competing requirements, such as accuracy and privacy, remains an ongoing challenge. This work underscores the importance of continuous research and development to ensure the safe and responsible use of LLMs in real-world applications.
Key facts. Cited by 44 papers in the map (data through 7 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 24 of its 44 references that are in the map. First posted on arXiv 16 Jun 2024.
Builds on
24 of 44 references.
References · 24
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2022Rethinking the Role of Demonstrations: What Makes In-Context Learning Work?cited by 1,413
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2020StereoSet: Measuring stereotypical bias in pretrained language modelscited by 911
- 2018Gender Bias in Coreference Resolutioncited by 438
- 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 347
- 2023ToolQA: A Dataset for LLM Question Answering with External Toolscited by 273
- 2023Universal Self-Consistency for Large Language Model Generationcited by 198
- 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 152
- 2023Harms from Increasingly Agentic Algorithmic Systemscited by 134
- 2021DECAF: Generating Fair Synthetic Data Using Causally-Aware Generative Networkscited by 109
12 more
- 2024Systematic Biases in LLM Simulations of Debatescited by 98
- 2024MatPlotAgent: Method and Evaluation for LLM-Based Agentic Scientific Data Visualizationcited by 98
- 2024Unfamiliar Finetuning Examples Control How Language Models Hallucinatecited by 85
- 2024Reliable, Adaptable, and Attributable Language Models with Retrievalcited by 73
- 2023When "A Helpful Assistant" Is Not Really Helpful: Personas in System Prompts Do Not Improve Performances of Large Language Modelscited by 50
- 2022Prompt Injection: Parameterization of Fixed Inputscited by 35
- 2024FairRAG: Fair Human Generation via Fair Retrieval Augmentationcited by 34
- 2018Domain Adaptive Transfer Learning with Specialist Modelscited by 31
- 2024Knowledge Graphs as Context Sources for LLM-Based Explanations of Learning Recommendationscited by 31
- 2020A Simple Fine-tuning Is All You Need: Towards Robust Deep Learning Via Adversarial Fine-tuningcited by 30
- 2024In-context learning agents are asymmetric belief updaterscited by 13
- 2024StablePT: Towards Stable Prompting for Few-shot Learning via Input Separationcited by 3
Built on by
Citing papers per year: 2024: 10; 2025: 22; 2026: 12.
44 papers.
Sort:
By area:
- 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 86
- 2024LLMs are Also Effective Embedding Models: An In-depth Overviewcited by 32
- 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 26
- 2025Octopus: Alleviating Hallucination via Dynamic Contrastive Decodingcited by 23
- 2026A Framework for Formalizing LLM Agent Securitycited by 16
- 2024Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAIcited by 14
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agentscited by 13
- 2025Agentic AI Systems Applied to tasks in Financial Services: Modeling and model risk management crewscited by 12
- 2025No Free Lunch with Guardrailscited by 10
- 2025Interpretation Meets Safety: A Survey on Interpretation Methods and Tools for Improving LLM Safetycited by 10
- 2024From Vulnerabilities to Remediation: A Systematic Literature Review of LLMs in Code Securitycited by 9
- 2025DualBreach: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimizationcited by 9
32 more
- 2025Language Models Can Predict Their Own Behaviorcited by 8
- 2024Building a Domain-specific Guardrail Model in Productioncited by 6
- 2025Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Iscited by 6
- 2025Accidental Vulnerability: Factors in Fine-Tuning that Shift Model Safeguardscited by 5
- 2025MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?cited by 5
- 2025OpenRAG: Optimizing RAG End-to-End via In-Context Retrieval Learningcited by 4
- 2025Bridging Industrial Expertise and XR with LLM-Powered Conversational Agentscited by 4
- 2025Uncovering the Fragility of Trustworthy LLMs through Chinese Textual Ambiguitycited by 4
- 2025Pet-Bench: Benchmarking the Abilities of Large Language Models as E-Pets in Social Network Servicescited by 3
- 2025H2HTalk: Evaluating Large Language Models as Emotional Companioncited by 3
- 2026TopoPilot: Reliable Conversational Workflow Automation for Topological Data Analysis and Visualizationcited by 3
- 2024From Cool Demos to Production-Ready FMware: Core Challenges and a Technology Roadmapcited by 2
- 2024Libra-Leaderboard: Towards Responsible AI through a Balanced Leaderboard of Safety and Capabilitycited by 2
- 2025Scam2Prompt: A Scalable Framework for Auditing Malicious Scam Endpoints in Production LLMscited by 2
- 2026Bielik Guard: Efficient Polish Language Safety Classifiers for LLM Content Moderationcited by 2
- 2024Bridging Today and the Future of Humanity: AI Safety in 2024 and Beyondcited by 1
- 2025From Refusal to Recovery: A Control-Theoretic Approach to Generative AI Guardrailscited by 1
- 2025A Criminology of Machinescited by 1
- 2025Prioritize Economy or Climate Action? Investigating ChatGPT Response Differences Based on Inferred Political Orientationcited by 1
- 2026To Defend Against Cyber Attacks, We Must Teach AI Agents to Hackcited by 1
- 2026The Curse of Helpfulness: Inverse Scaling Law in Robustness to Distractor Instructions via DistractionIFcited by 1
- 2024"Moralized" Multi-Step Jailbreak Prompts: Black-Box Testing of Guardrails in Large Language Models for Verbal Attackscited by 0
- 2025The Hitchhikers Guide to Production-ready Trustworthy Foundation Model powered Software (FMware)cited by 0
- 2025AI-guided digital intervention with physiological monitoring reduces intrusive memories after experimental traumacited by 0
- 2025Do Androids Dream of Unseen Puppeteers? Probing for a Conspiracy Tendencies in Large Language Modelscited by 0
- 2026Responsible AI for General-Purpose Systems: Overview, Challenges, and A Path Forwardcited by 0
- 2026Introducing the Generative Application Firewall (GAF)cited by 0
- 2026Counting Worlds Branching Time Semantics for post-hoc Bias Mitigation in generative AIcited by 0
- 2026U-Define: Designing User Workflows for Hard and Soft Constraints in LLM-Based Planningcited by 0
- 2026From Intent to AI Pipelines: A Controlled Agentic Framework for Non-AI Expert Scientistscited by 0
- 2026LLM-Driven Autonomous Vehicles Inherit Human Driver Biases in Pedestrian Yielding: Results and Implications From A New Benchmarkcited by 0
- 2026BRANCH: Bypassing Multi-Scanner AI Guardrailscited by 0
- 2026BRANCH: Bypassing Multi-Scanner AI Guardrails7 Oct 2026
- 2026LLM-Driven Autonomous Vehicles Inherit Human Driver Biases in Pedestrian Yielding: Results and Implications From A New Benchmark31 Aug 2026
- 2026The Curse of Helpfulness: Inverse Scaling Law in Robustness to Distractor Instructions via DistractionIF28 May 2026
- 2026U-Define: Designing User Workflows for Hard and Soft Constraints in LLM-Based Planning4 May 2026
- 2026Counting Worlds Branching Time Semantics for post-hoc Bias Mitigation in generative AI21 Apr 2026
- 2026From Intent to AI Pipelines: A Controlled Agentic Framework for Non-AI Expert Scientists10 Apr 2026
- 2026TopoPilot: Reliable Conversational Workflow Automation for Topological Data Analysis and Visualization26 Mar 2026
- 2026A Framework for Formalizing LLM Agent Security19 Mar 2026
- 2026Bielik Guard: Efficient Polish Language Safety Classifiers for LLM Content Moderation8 Feb 2026
- 2026To Defend Against Cyber Attacks, We Must Teach AI Agents to Hack1 Feb 2026
- 2026Introducing the Generative Application Firewall (GAF)22 Jan 2026
- 2026Responsible AI for General-Purpose Systems: Overview, Challenges, and A Path Forward19 Jan 2026
32 more
- 2025Do Androids Dream of Unseen Puppeteers? Probing for a Conspiracy Tendencies in Large Language Models5 Nov 2025
- 2025Prioritize Economy or Climate Action? Investigating ChatGPT Response Differences Based on Inferred Political Orientation4 Nov 2025
- 2025A Criminology of Machines4 Nov 2025
- 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges27 Oct 2025
- 2025From Refusal to Recovery: A Control-Theoretic Approach to Generative AI Guardrails15 Oct 2025
- 2025Scam2Prompt: A Scalable Framework for Auditing Malicious Scam Endpoints in Production LLMs2 Sep 2025
- 2025Uncovering the Fragility of Trustworthy LLMs through Chinese Textual Ambiguity30 Jul 2025
- 2025Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Is29 Jul 2025
- 2025MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?25 Jul 2025
- 2025H2HTalk: Evaluating Large Language Models as Emotional Companion4 Jul 2025
- 2025AI-guided digital intervention with physiological monitoring reduces intrusive memories after experimental trauma1 Jul 2025
- 2025Interpretation Meets Safety: A Survey on Interpretation Methods and Tools for Improving LLM Safety5 Jun 2025
- 2025Pet-Bench: Benchmarking the Abilities of Large Language Models as E-Pets in Social Network Services4 Jun 2025
- 2025Accidental Vulnerability: Factors in Fine-Tuning that Shift Model Safeguards22 May 2025
- 2025The Hitchhikers Guide to Production-ready Trustworthy Foundation Model powered Software (FMware)15 May 2025
- 2025DualBreach: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimization21 Apr 2025
- 2025Bridging Industrial Expertise and XR with LLM-Powered Conversational Agents7 Apr 2025
- 2025No Free Lunch with Guardrails1 Apr 2025
- 2025OpenRAG: Optimizing RAG End-to-End via In-Context Retrieval Learning11 Mar 2025
- 2025Octopus: Alleviating Hallucination via Dynamic Contrastive Decoding1 Mar 2025
- 2025Language Models Can Predict Their Own Behavior18 Feb 2025
- 2025Agentic AI Systems Applied to tasks in Financial Services: Modeling and model risk management crews8 Feb 2025
- 2024Libra-Leaderboard: Towards Responsible AI through a Balanced Leaderboard of Safety and Capability24 Dec 2024
- 2024From Vulnerabilities to Remediation: A Systematic Literature Review of LLMs in Code Security19 Dec 2024
- 2024LLMs are Also Effective Embedding Models: An In-depth Overview17 Dec 2024
- 2024"Moralized" Multi-Step Jailbreak Prompts: Black-Box Testing of Guardrails in Large Language Models for Verbal Attacks23 Nov 2024
- 2024From Cool Demos to Production-Ready FMware: Core Challenges and a Technology Roadmap28 Oct 2024
- 2024Bridging Today and the Future of Humanity: AI Safety in 2024 and Beyond9 Oct 2024
- 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Survey26 Sep 2024
- 2024Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI23 Sep 2024
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agents5 Aug 2024
- 2024Building a Domain-specific Guardrail Model in Production24 Jul 2024
- 2024Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAIcited by 14
- 2025No Free Lunch with Guardrailscited by 10
- 2025Interpretation Meets Safety: A Survey on Interpretation Methods and Tools for Improving LLM Safetycited by 10
- 2025DualBreach: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimizationcited by 9
- 2024Building a Domain-specific Guardrail Model in Productioncited by 6
- 2025Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Iscited by 6
- 2025From Refusal to Recovery: A Control-Theoretic Approach to Generative AI Guardrailscited by 1
- 2026To Defend Against Cyber Attacks, We Must Teach AI Agents to Hackcited by 1
- 2024"Moralized" Multi-Step Jailbreak Prompts: Black-Box Testing of Guardrails in Large Language Models for Verbal Attackscited by 0
- 2026To Defend Against Cyber Attacks, We Must Teach AI Agents to Hack1 Feb 2026
- 2025From Refusal to Recovery: A Control-Theoretic Approach to Generative AI Guardrails15 Oct 2025
- 2025Anyone Can Jailbreak: Prompt-Based Attacks on LLMs and T2Is29 Jul 2025
- 2025Interpretation Meets Safety: A Survey on Interpretation Methods and Tools for Improving LLM Safety5 Jun 2025
- 2025DualBreach: Efficient Dual-Jailbreaking via Target-Driven Initialization and Multi-Target Optimization21 Apr 2025
- 2025No Free Lunch with Guardrails1 Apr 2025
- 2024"Moralized" Multi-Step Jailbreak Prompts: Black-Box Testing of Guardrails in Large Language Models for Verbal Attacks23 Nov 2024
- 2024Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI23 Sep 2024
- 2024Building a Domain-specific Guardrail Model in Production24 Jul 2024
- 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 26
- 2026A Framework for Formalizing LLM Agent Securitycited by 16
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agentscited by 13
- 2025Agentic AI Systems Applied to tasks in Financial Services: Modeling and model risk management crewscited by 12
- 2026TopoPilot: Reliable Conversational Workflow Automation for Topological Data Analysis and Visualizationcited by 3
- 2026From Intent to AI Pipelines: A Controlled Agentic Framework for Non-AI Expert Scientistscited by 0
- 2026From Intent to AI Pipelines: A Controlled Agentic Framework for Non-AI Expert Scientists10 Apr 2026
- 2026TopoPilot: Reliable Conversational Workflow Automation for Topological Data Analysis and Visualization26 Mar 2026
- 2026A Framework for Formalizing LLM Agent Security19 Mar 2026
- 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges27 Oct 2025
- 2025Agentic AI Systems Applied to tasks in Financial Services: Modeling and model risk management crews8 Feb 2025
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agents5 Aug 2024
- 2025Language Models Can Predict Their Own Behaviorcited by 8
- 2026BRANCH: Bypassing Multi-Scanner AI Guardrailscited by 0
- 2026BRANCH: Bypassing Multi-Scanner AI Guardrails7 Oct 2026
- 2025Language Models Can Predict Their Own Behavior18 Feb 2025
- 2024LLMs are Also Effective Embedding Models: An In-depth Overviewcited by 32
- 2024From Vulnerabilities to Remediation: A Systematic Literature Review of LLMs in Code Securitycited by 9
- 2025Accidental Vulnerability: Factors in Fine-Tuning that Shift Model Safeguardscited by 5
- 2025MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?cited by 5
- 2025Uncovering the Fragility of Trustworthy LLMs through Chinese Textual Ambiguitycited by 4
- 2025Pet-Bench: Benchmarking the Abilities of Large Language Models as E-Pets in Social Network Servicescited by 3
- 2025H2HTalk: Evaluating Large Language Models as Emotional Companioncited by 3
- 2024From Cool Demos to Production-Ready FMware: Core Challenges and a Technology Roadmapcited by 2
- 2024Libra-Leaderboard: Towards Responsible AI through a Balanced Leaderboard of Safety and Capabilitycited by 2
- 2025Scam2Prompt: A Scalable Framework for Auditing Malicious Scam Endpoints in Production LLMscited by 2
- 2026Bielik Guard: Efficient Polish Language Safety Classifiers for LLM Content Moderationcited by 2
- 2024Bridging Today and the Future of Humanity: AI Safety in 2024 and Beyondcited by 1
12 most cited of 21 All 21 (JSON)
- 2026U-Define: Designing User Workflows for Hard and Soft Constraints in LLM-Based Planning4 May 2026
- 2026Counting Worlds Branching Time Semantics for post-hoc Bias Mitigation in generative AI21 Apr 2026
- 2026Bielik Guard: Efficient Polish Language Safety Classifiers for LLM Content Moderation8 Feb 2026
- 2026Introducing the Generative Application Firewall (GAF)22 Jan 2026
- 2026Responsible AI for General-Purpose Systems: Overview, Challenges, and A Path Forward19 Jan 2026
- 2025Do Androids Dream of Unseen Puppeteers? Probing for a Conspiracy Tendencies in Large Language Models5 Nov 2025
- 2025Prioritize Economy or Climate Action? Investigating ChatGPT Response Differences Based on Inferred Political Orientation4 Nov 2025
- 2025A Criminology of Machines4 Nov 2025
- 2025Scam2Prompt: A Scalable Framework for Auditing Malicious Scam Endpoints in Production LLMs2 Sep 2025
- 2025Uncovering the Fragility of Trustworthy LLMs through Chinese Textual Ambiguity30 Jul 2025
- 2025MOCHA: Are Code Language Models Robust Against Multi-Turn Malicious Coding Prompts?25 Jul 2025
- 2025H2HTalk: Evaluating Large Language Models as Emotional Companion4 Jul 2025
12 newest of 21 All 21 (JSON)
Similar, not cited
Close in wording, no citation either way
- 2024Large Language Model Safety: A Holistic Survey
- 2025LLM-Safety Evaluations Lack Robustness
- 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment
- 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents
- 2024Unique Security and Privacy Threats of Large Language Models: A Comprehensive Survey
- 2025aiXamine: Simplified LLM Safety and Security
- 2026TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories
- 2025Data Security in Large Language Models: Risks, Defense, and Directions