LLM Jailbreak Attacks

LLM: Large Language Model

Follow this topic Ask about this topic

Momentum

7 papers in the last four weeks, down 12% on the four weeks before. 0.1% of all new papers.

Jul 13Week of Sep 28

Latest papers 137

All topics

How Narrative Wrapping Affects LLM Refusal: A Cross-Language Benchmark and Defense
Oct 7, 2026Zhankai Ye, Yanning Wang, Yukai Jin +5Refusal Behavior in Language Models LLM Safety Alignment
Florida State University · Texas Christian University · University of Pennsylvania +1
PatchBench: Measuring Collateral Damage in Activation Patching
Oct 7, 2026Alexi Canesse, Mathis Le Bail, Maël Jenny +3Language Model Safety Evaluation Jailbreak Defense
LIX (École Polytechnique, IP Paris, CNRS), France · AMIAD (Agence Ministérielle pour l’IA de Défense), France
From Expected Harmfulness to Likelihood: A Probabilistic Reformulation of Jailbreaking LLM Agents
Oct 7, 2026Juanyang Xu, Zheng Wang, Xingyu Zhao +2Jailbreak Attacks LLM Jailbreak Attacks
University of Macau · WMG, University of Warwick · Wuhan University
Secure Speculative Decoding for Large Language Models
Oct 6, 2026Yichi Zhang, Zhiqi Wang, Neil Gong +1Adversarial Attacks on LLMs Speculative Decoding
The Pennsylvania State University · Duke University
Jailbreaking Open-Weight LLMs via Random Embedding Perturbations
Oct 5, 2026Abhinav Sudhakar Dubey, Scott Sirri, Vaggos Chatziafratis +1Adversarial Attacks Adversarial Attacks on LLMs
University of California Santa Cruz
Benchmarking Jailbreak Guardrails for Embodied Agents
Oct 5, 2026Xunguang Wang, Qingyue Wang, Yuguang Zhou +3LLM Guardrails AI Agent Safety
Department of Computer Science and Engineering The Hong Kong University of Science and Technology Clear Water Bay, Kowloon, Hong Kong · School of Information Renmin University of China Beijing, China
Red-TTT: Test-Time Training for Automated Jailbreaking Large Language Models
Oct 4, 2026Tongyan Hu, Hao Li, Xiaogeng Liu +8Test-Time Training LLM Jailbreak Attacks
Johns Hopkins University · National University of Singapore · Washington University in St. Louis +2
CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion
Sep 30, 2026Zhen Liang, Hai Huang, Wentao ChenAdversarial Attacks on LLMs Jailbreak Attacks
School of Computer Science and Technology, Zhejiang Sci-Tech University · Zhejiang Key Laboratory of Digital Fashion and Data Governance, Zhejiang Sci-Tech University · China Academy of Information and Communications Technology
Controlled Decoding Attacks on Black-Box LLMs
Sep 29, 2026Jesson Wang, Shawn Li, Wei Yang +4Constrained Decoding Adversarial Attacks on LLMs
University of Southern California · Adobe · Amazon
Constitutional adapters: Inference-time interventions for misalignment and misuse
Sep 29, 2026Adam S. Lowet, Mark KurzejaLLM Safety Alignment LLM Jailbreak Attacks
Anthropic Fellows Program · Independent
On the Efficiency-Safety Dilemma in Large Reasoning Models
Sep 20, 2026Yifei Yang, Zouying Cao, Xingrui Wang +4LLM Inference Acceleration LLM Jailbreak Attacks
AGI Institute, School of Computer Science, Shanghai Jiao Tong University, Shanghai, China · Key Laboratory of Shanghai Education Commission for Intelligent Interaction and Cognitive Engineering, Shanghai Jiao Tong University · Ant Group +2
SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration
Sep 14, 2026Md Jueal Mia, Yanzhao Wu, Selcuk Uluagac +1Language Model Safety Evaluation Jailbreak Robustness
Knight Foundation School of Computing and Information Sciences, Florida International University, USA · Security, Optimization, and Learning for InterDependent Networks (solid) Laboratory, Miami, Florida, USA
Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning
Sep 10, 2026Thomas RivasseauAdversarial Attacks on LLMs Jailbreak Attacks
School of Information Studies McGill University
IndicSafeEval: Safety Robustness of Large Language Models under Multilingual Persuasive Jailbreak Attacks
Sep 3, 2026Saikat Mondal, Mamta, Deeksha Varshney +2LLM Safety Benchmarks Multilingual Language Model Evaluation
Indian Institute of Technology Jodhpur, Jodhpur, India · King’s College London, London, UK · Indian Institute of Technology Patna, Patna, India
ASCII Attack: Recontextualising Harmful Requests as Artistic Critique in Large Language Models
Sep 2, 2026Da Cheng Gu, Yifei Dong, Xinghao Yang +2LLM Jailbreak Attacks LLM Safety Evaluation
Faculty of Engineering and Information Technology, University of Technology Sydney, Ultimo, NSW, 2007, Australia · China University of Petroleum, China · Shandong University, China
Breadth Beats Depth: Improving GCG-Based Jailbreak Optimization with Breadth-Oriented Suffix Search
Sep 2, 2026Shiliang Xiao, Jingsong Wei, Yuzhi Liang +3LLM Jailbreak Attacks Adversarial Prompt Generation
School of Information Science and Technology Guangdong University of Foreign Studies
The Fragility of Jailbreak Robustness Across Operational States
Aug 31, 2026Yuna Park, Hwang Youn Kim, Yujin Kim +3Prompt Sensitivity Language Model Safety Evaluation
Yonsei University · Korea Institute of Science and Technology (KIST) · Korea University +1
The Safety Relay in Roleplay Jailbreaks: A Component-Resolved Causal Analysis of Harm Recognition and Refusal
Aug 31, 2026Md Mokarram Chowdhury, Ernie Chang, Yang LiJailbreak Attacks LLM Jailbreak Attacks
Department of Computer Science, Iowa State University, United States · Meta, United States
TACS: Trajectory-Aware Candidate Selection for LLM Jailbreak Suffix Optimization
Aug 30, 2026Shiliang XiaoReward Hacking LLM Jailbreak Attacks
TRACE: Trajectory Aware Reasoning for Multi-Turn Adversarial Conversation Evaluation
Aug 16, 2026Md Messal Monem Miah, Adrita Anika, Zhiyuan Yu +1Adversarial Training LLM Jailbreak Attacks
Texas A&M University · Amazon
Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks
Aug 10, 2026Mingyu Luo, Ming Deng, Zilang Qiu +8Safety Filtering LLM Jailbreak Attacks
College of Computer Science and Artificial Intelligence, Fudan University · School of Computer Engineering and Science, Shanghai University · Beijing Normal University +5
Yesterday's Shield, Today's Spear: A Self-Evolving Safety Guardrail in Production
Aug 9, 2026Cong Ming, Jingyi Chen, Bin Liu +4Continual Learning for LLMs LLM Guardrails
University of Science and Technology of China · Shenzhen University · Sangfor Technologies
ICO: Enhancing Semantic-Shift Jailbreaks via Iterative Context Optimization
Aug 4, 2026Hujian Zhu, Yihao Huang, Felix Juefei-Xu +5Adversarial Attacks on LLMs Jailbreak Attacks
East China Normal University, Shanghai, China · New York University, New York, USA · The Hong Kong Polytechnic University, Hong Kong, China +2
AI Security Leaderboard: Methodology, Results and Minimal Standard
Aug 4, 2026Jasper Timm, Lukas Struppek, Ziwei Xu +12LLM Safety Benchmarks Cybersecurity
RoguePrompt: Dual-Layer Encoding for Self-Reconstruction to Circumvent LLM Moderation
Jul 29, 2026Benyamin Tafreshian, Prathamesh DhakeAdversarial Attacks Adversarial Attacks on LLMs
Department of Computer Science · Boston University · Boston, MA, USA
Do LLMs Know Their Vulnerable Scenarios?
Jul 26, 2026Ziheng Peng, Huiqi Deng, Haoran Jing +5LLM Interpretability Adversarial Scenario Generation
Xi’an Jiaotong University Shanghai, China · Shanghai Artificial Intelligence Laboratory Shanghai, China
Geometric Configurations of Perturbed Jailbreak Prompts
Jul 22, 2026Lynn Delcon, Andres Algaba, Vincent GinisJailbreak Attacks LLM Jailbreak Attacks
Department of Business Technology and Operations, Data Analytics Laboratory, Vrije Universiteit Brussel, Pleinlaan 2, 1050 Brussels, Belgium · imec-SMIT, Vrije Universiteit Brussel, Pleinlaan 9, 1050 Brussels, Belgium · School of Engineering and Applied Sciences, Harvard University, Cambridge, Massachusetts 02138, USA
An Early Warning of Emerging Biosecurity Risks in Frontier LLMs
Jul 20, 2026Zhida He, Xia Hu, Baichen Le +20Language Model Safety Evaluation LLM Security
Shanghai Artificial Intelligence Laboratory
JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models
Jul 20, 2026Qingjia Huang, Jingyu Zhang, Jianguo Wu +6LLM Safety Benchmarks LLM Jailbreak Attacks
Institute of Information Engineering, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Renmin University of China +2
How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions
Jul 19, 2026Yukai Zhou, Feiyang Lu, Xiaokai Mao +2LLM Safety Alignment Training Data Selection
ShanghaiTech University · Zhejiang University

Oct 7, 2026, cs.AIJ/K move · Enter open · S save

How Narrative Wrapping Affects LLM Refusal: A Cross-Language Benchmark and Defense

Zhankai Ye, Yanning Wang, Yukai Jin, Bo Mei+4

Florida State University · Texas Christian University · University of Pennsylvania+1

Refusal Behavior in Language Models LLM Safety Alignment LLM Jailbreak Attacks Language Model Safety Evaluation LLM Safety Benchmarks

Open paper AskPDF arXiv

Safety-aligned language models often refuse a harmful request stated directly but answer the same request inside a role-play or narrative wrapper. We measure this vulnerability across languages and registers: attack success on Qwen3-1.7B is already 89.4% in English and 93.0% in modern Chinese, and reaches 95.7% in Classical Chinese. We build GUISE, a benchmark for systematically studying this vulnerability. It includes parallel requests in English, modern Chinese, and Classical Chinese, matched harmful and benign pairs, wrapper types held out for evaluation, and a stricter criterion that counts warn-then-answer responses as attack successes. Representation analysis shows that language and register move harmful-request representations only slightly away from the model's refusal direction, whereas narrative wrappers move them much farther away. We propose AXIS, which combines preference optimisation with a rotation objective that aligns harmful-request representations with the refusal direction and a commitment objective that trains the model to refuse completely rather than produce a warn-then-answer response. Across Qwen3-1.7B, Qwen3-4B and GLM-4-9B, AXIS achieves the highest combined safety and usability score among the compared methods.

Momentum

Related topics

Latest papers 137