Jailbreak Attacks

Follow this topic Ask about this topic

Momentum

5 papers in the last four weeks, against 1 the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 48

All topics

PatchBench: Measuring Collateral Damage in Activation Patching
Oct 7, 2026Alexi Canesse, Mathis Le Bail, Maël Jenny +3Language Model Safety Evaluation Jailbreak Defense
LIX (École Polytechnique, IP Paris, CNRS), France · AMIAD (Agence Ministérielle pour l’IA de Défense), France
From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents
Oct 7, 2026Juanyang Xu, Zheng Wang, Xingyu Zhao +2Jailbreak Attacks LLM Jailbreak Attacks
University of Macau · WMG, University of Warwick · Wuhan University
CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion
Sep 30, 2026Zhen Liang, Hai Huang, Wentao ChenAdversarial Attacks on LLMs Jailbreak Attacks
School of Computer Science and Technology, Zhejiang Sci-Tech University · Zhejiang Key Laboratory of Digital Fashion and Data Governance, Zhejiang Sci-Tech University · China Academy of Information and Communications Technology
SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs
Sep 30, 2026Wenyu Chen, Li Wang, Chuanchao Zang +5VLM Robustness Jailbreak Attacks
Shandong University
Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning
Sep 9, 2026Thomas RivasseauAdversarial Attacks on LLMs Jailbreak Attacks
School of Information Studies McGill University
DuplexJail: Spoken Interruption Attacks on Full-Duplex Speech Models
Sep 8, 2026Jaechul Roh, Deepak Chandran, Amir Houmansadr +1Language Model Safety Evaluation Jailbreak Attacks
University of Massachusetts Amherst · Dolby Laboratories
Does Deeper Reasoning Compromise Alignment? Revealing and Mitigating of Alignment Collapse in Large Reasoning Models
Sep 8, 2026Yu-Hang Wu, Yu-Jie Xiong, Henghua Zhang +3Adversarial Attacks on LLMs Jailbreak Attacks
Shanghai University of Engineering Science · The Hong Kong University of Science and Technology · A * STAR
The Safety Relay in Roleplay Jailbreaks: A Component-Resolved Causal Analysis of Harm Recognition and Refusal
Aug 31, 2026Md Mokarram Chowdhury, Ernie Chang, Yang LiJailbreak Attacks LLM Jailbreak Attacks
Department of Computer Science, Iowa State University, United States · Meta, United States
ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization
Aug 4, 2026Hujian Zhu, Yihao Huang, Felix Juefei-Xu +5Adversarial Attacks on LLMs Jailbreak Attacks
East China Normal University, Shanghai, China · New York University, New York, USA · The Hong Kong Polytechnic University, Hong Kong, China +2
Borrowed Strength: Best-of-N Search over a Code EncodingBreaks Self-Check Jailbreak Defenses
Jul 29, 2026Haoyu Zhang, Shibo Zheng, Xiangchen Guan +4Adversarial Attacks Jailbreak Attacks
1Northeastern University
Geometric Configurations of Perturbed Jailbreak Prompts
Jul 22, 2026Lynn Delcon, Andres Algaba, Vincent GinisJailbreak Attacks LLM Jailbreak Attacks
Department of Business Technology and Operations, Data Analytics Laboratory, Vrije Universiteit Brussel, Pleinlaan 2, 1050 Brussels, Belgium · imec-SMIT, Vrije Universiteit Brussel, Pleinlaan 9, 1050 Brussels, Belgium · School of Engineering and Applied Sciences, Harvard University, Cambridge, Massachusetts 02138, USA
Adversarial Prompting Framework for AI Safety Assessment
Jul 15, 2026Yash Bhatnagar, Kunal Banerjee, Anirban ChatterjeeAdversarial Prompt Generation Adversarial Attacks on LLMs
Microsoft · Bengaluru, Karnataka, India · Walmart Global Tech
Minionese: Comprehensive Benchmark and Mechanistic Study of Multilingual LLM Safety
Jul 11, 2026Chigozirim Ifebi, Brent Kong, Ayushi MehrotraLLM Safety Benchmarks Multilingual Language Model Evaluation
California Institute of Technology.
Refused in Chat, Written in Code: Workflow-Level Jailbreak Construction in IDE Coding Agents
Jul 4, 2026Abhishek Kumar, Carsten MapleLanguage Model Safety Evaluation AI Coding Agents
The Alan Turing Institute, London, United Kingdom
Safety Targeted Embedding Exploit via Refinement
Jul 2, 2026Joshua Adrian CahyonoMultilingual Language Model Evaluation Adversarial Attacks on LLMs
Nanyang Technological University, Singapore.
Resolution Thresholds in VLM Detection of Harmful ASCII Art Across Construction Modes and Languages
Jun 28, 2026Yikai Hua, Peter WestVLM Evaluation VLM Robustness
Department of Computer Science The University of British Columbia
Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models
Jun 26, 2026Yanchen Yin, Dongqi Han, Linghui LiAttention Head Analysis Jailbreak Attacks
Beijing University of Posts and Telecommunications, Beijing, China.
Analyzing Defensive Misdirection Against Model-Guided Automated Attacks on Agentic AI Systems
Jun 18, 2026Reza Soosahabi, Vivek NamsaniAdversarial Robustness Jailbreak Attacks
Application & Threat Intelligence Research Center Keysight Technologies Inc., USA
Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps
Jun 8, 2026Xiaofeng Lin, Yukai Yang, Daniel Guo +3Jailbreak Attacks LLM Agent Security
University of California, Los Angeles, USA · 2Computer Science and Engineering Department, Texas A&M University, USA · 3Cisco, USA +1
SpeechJBB: Probing Safety Alignment and Comprehension in Large Audio Language Models under Code-Switched Speech
Jun 4, 2026Virginia Ceccatelli, Yejin Jeon, David Ifeoluwa AdelaniAudio-Language Model Evaluation Language Model Safety Evaluation
Mila - Quebec AI Institute · McGill University, Canada · Canada CIFAR AI Chair
SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks
Jun 4, 2026Seungwon Jeong, Jiwoo Jeong, Hyeonjin Kim +2Adversarial Attacks on LLMs Jailbreak Attacks
Dongguk University-Seoul
Voices Across Registers: Corpus-Conditioned Vernacular Jailbreaks against Aligned LLMs via Fanfiction Subgenres
Jun 3, 2026Zhongze Luo, Ruihe Shi, Zhenshuai Yin +3Adversarial Prompt Generation Language Model Safety Evaluation
School of Science and Engineering, The Chinese University of Hong Kong (Shenzhen) · School of Microelectronics, Xi’an Jiaotong University · 2The Shenzhen Future Network of Intelligence Institute (FNii-Shenzhen) +1
BAIT: Boundary-Guided Disclosure Escalation LLM Jailbreaking via Self-Conditioned Reasoning
May 26, 2026Xuan Luo, Yue Wang, Geng Tu +2Jailbreak Attacks LLM Safety
The Harbin Institute of Technology, Shenzhen, China · The Hong Kong Polytechnic University, Hong Kong, China · Shenzhen University, Shenzhen, China +1
Test-Time Training Undermines Safety Guardrails
May 21, 2026Simone Antonelli, Sadegh Akhondzadeh, Aleksandar BojchevskiLanguage Model Safety Evaluation Adversarial Attacks on LLMs
CISPA Helmholtz Center for Information Security · University of Cologne
RoboJailBench: Benchmarking Adversarial Attacks and Defenses in Embodied Robotic Agents
May 19, 2026Doguhuan Yeke, Yanming Zhou, Leo Y. Lin +3Jailbreak Attacks AI Agent Security Benchmarks
Purdue University
Why Do Safety Guardrails Degrade Across Languages?
May 16, 2026Max Zhang, Ameen Patel, Sang T. Truong +1Multilingual Language Model Evaluation Language Model Safety Evaluation
Stanford University
New Wide-Net-Casting Jailbreak Attacks Risk Large Models
May 16, 2026Qiuchi Xiang, Haoxuan Qu, Hossein Rahmani +1Language Model Safety Evaluation Jailbreak Attacks
1Lancaster University.
Metaphor Is Not All Attention Needs
May 12, 2026Olga Sorokoletova, Francesco Giarrusso, Giacomo De Luca +6Adversarial Attacks on LLMs Jailbreak Attacks
Sapienza University of Rome Department of Computer, Control and Management Engineering Sapienza University of Rome Via Ariosto 25, Rome 00185, Italy · DEXAI – Icaro Lab · University of Rome Tor Vergata +1
MT-JailBench: A Modular Benchmark for Understanding Multi-Turn Jailbreak Attacks
May 10, 2026Xinkai Zhang, Zhipeng Wei, Huanli Gong +4Language Model Safety Evaluation Jailbreak Attacks
1UC Berkeley · 3International Computer Science Institute · 2UC Riverside +1
Single-Configuration Attack Success Rate Is Not Enough: Jailbreak Evaluations Should Report Distributional Attack Success
May 9, 2026Carsten Maple, Abhishek Kumar, Riya TapwalLanguage Model Safety Evaluation Jailbreak Attacks
University of Warwick · The Alan Turing Institute · IIT Mandi

Oct 7, 2026, cs.LGJ/K move · Enter open · S save

PatchBench: Measuring Collateral Damage in Activation Patching

Alexi Canesse, Mathis Le Bail, Maël Jenny, Clément Elliker+2

LIX (École Polytechnique, IP Paris, CNRS), France · AMIAD (Agence Ministérielle pour l’IA de Défense), France

Language Model Safety Evaluation Jailbreak Defense Jailbreak Attacks LLM Jailbreak Attacks Activation Steering

Open paper AskPDF arXiv

An LLM safety patch can pass a benchmark while still being a poor repair. This risk is especially acute for jailbreak repairs, where the goal is to correct a specific unsafe behaviour without changing unrelated behaviours. A patch may block exact evaluation prompts yet fail on close harmful variants, or suppress harmful behaviour by over-refusing benign prompts that share its wording or structure. Existing protocols primarily test whether models can be broken, while aggregate metrics (attack success, refusal rates, global capability) cannot distinguish selective repairs from broader local suppression. To address this gap, we introduce PatchBench, a benchmark of empirically observed model-specific jailbreak failures inducing actionable harmful answers. Starting from 27,870 prompts from 37 public datasets, we curate 15,314 English prompts and query 8 open-source instruction-tuned models. Combining WildGuard filtering, pairwise Elo ranking, and manual verification, we retain a curated bank of 400 high-confidence jailbreak failures. We further introduce PatchBench-Local, an evaluation protocol testing whether a patch is behaviourally precise. For each harmful source prompt, PatchBench-Local generates three families of local neighbours: harmful variants preserving malicious intent, benign prompts with matched structure, and benign prompts reusing key harmful terms. It evaluates harmful-neighbour correction and benign-neighbour preservation, distinguishing selective repair from broader local suppression. Evaluating four activation steering methods with PatchBench-Local and MMLU shows that global capability can remain nearly unchanged while local benign regressions are severe, confirming aggregate metrics miss important collateral damage. PatchBench-Local provides a more precise basis for developing and comparing jailbreak repair methods.

Momentum

Related topics

Latest papers 48