# Jailbreaking

Area: [LLM safety and security](https://mlsanity.com/safety/index.md). HTML: https://mlsanity.com/safety/jailbreaking/

## Key facts

- Jailbreaking: 911 papers on arXiv since 2023 (data through 14 Oct 2026).
- 620 of its 911 mapped papers (68%) cite “Universal and Transferable Adversarial Attacks on Aligned Language Models” (2023, arXiv 2307.15043).
- 540 of its 911 mapped papers (59%) cite “Jailbreaking Black Box Large Language Models in Twenty Queries” (2023, arXiv 2310.08419).
- 24 new papers 24 Sep–14 Oct.

## Most cited here

- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023), cited by 620 papers here
- [Jailbreaking Black Box Large Language Models in Twenty Queries](https://mlsanity.com/paper/2310.08419/) (2023), cited by 540 papers here
- [Jailbroken: How Does LLM Safety Training Fail?](https://mlsanity.com/paper/2307.02483/) (2023), cited by 441 papers here
- [AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models](https://mlsanity.com/paper/2310.04451/) (2023), cited by 296 papers here
- [Tree of Attacks: Jailbreaking Black-Box LLMs Automatically](https://mlsanity.com/paper/2312.02119/) (2023), cited by 290 papers here
- [GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts](https://mlsanity.com/paper/2309.10253/) (2023), cited by 247 papers here
- [How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs](https://mlsanity.com/paper/2401.06373/) (2024), cited by 236 papers here
- [GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher](https://mlsanity.com/paper/2308.06463/) (2023), cited by 231 papers here
- [SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks](https://mlsanity.com/paper/2310.03684/) (2023), cited by 211 papers here
- [Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations](https://mlsanity.com/paper/2310.06387/) (2023), cited by 196 papers here

## New (24 Sep–14 Oct)

- [Did the LLM Answer the Question? A Semantic Reconstruction Game for Jailbreak Evaluation](https://mlsanity.com/paper/2610.19306/) (2026-10-13)
- [ATTCK-R: Knowledge-Aware Long-Horizon Jailbreaking for Protected LLMs](https://mlsanity.com/paper/2610.16305/) (2026-10-12)
- [Exploring Jailbreak Vulnerability Across Depth-Based Dynamic Inference in Large Language Models](https://mlsanity.com/paper/2610.15207/) (2026-10-10)
- [PatchBench: Measuring Collateral Damage in Activation Patching](https://mlsanity.com/paper/2610.10276/) (2026-10-07)
- [From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents](https://mlsanity.com/paper/2610.09973/) (2026-10-07)
- [Secure Speculative Decoding for Large Language Models](https://mlsanity.com/paper/2610.08678/) (2026-10-06)
- [Jailbreaking Open-Weight LLMs via Random Embedding Perturbations](https://mlsanity.com/paper/2610.07125/) (2026-10-05)
- [Reward Stealing Attack on Large Language Models](https://mlsanity.com/paper/2610.06670/) (2026-10-05)
- [Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks](https://mlsanity.com/paper/2610.07009/) (2026-10-04)
- [Red-TTT: Test-Time Training for Automated Jailbreaking Large Language Models](https://mlsanity.com/paper/2610.05282/) (2026-10-04)
- [Reactivating Alignment: Defending LLMs from Jailbreaks via Intention-Aware Input-Output Matching](https://mlsanity.com/paper/2610.04470/) (2026-10-03)
- [Target-free Latent Safety Alignment](https://mlsanity.com/paper/2610.04467/) (2026-10-03)
- [MLCommons Jailbreak Benchmark v1.0](https://mlsanity.com/paper/2610.02827/) (2026-10-02)
- [Intent-Hiding Jailbreaks: An Information-Theoretic Framework for Compositional Attacks](https://mlsanity.com/paper/2610.02302/) (2026-10-01)
- [MOMAT: Mixture of Multiple Atlases for Low-Power Jailbreak Defense of Quantized LLMs](https://mlsanity.com/paper/2610.01058/) (2026-10-01)
- [CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion](https://mlsanity.com/paper/2609.39902/) (2026-09-30)
- [SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs](https://mlsanity.com/paper/2609.38899/) (2026-09-30)
- [Controlled Decoding Attacks on Black-Box LLMs](https://mlsanity.com/paper/2609.36956/) (2026-09-29)
- [Does the Unsafe Gradient Survive a Conversation? On the Fragility of Gradient-Based Jailbreak Detection in Multi-Turn Dialogue](https://mlsanity.com/paper/2609.36849/) (2026-09-29)
- [Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking](https://mlsanity.com/paper/2609.32116/) (2026-09-26)
- [Monitor Jailbreaking: Evading Chain-of-Thought Monitoring Without Encoded Reasoning](https://mlsanity.com/paper/2609.31121/) (2026-09-25)
- [TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks](https://mlsanity.com/paper/2609.31032/) (2026-09-25)
- [Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis](https://mlsanity.com/paper/2609.30841/) (2026-09-25)
- [Prefilling the Reasoning Channel: Output-Prefix Attacks on Reasoning LLMs](https://mlsanity.com/paper/2609.29775/) (2026-09-24)