Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Concealment of Intent: A Game-Theoretic Analysis

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Hiding intent in skill mixtures beats LLM filters

desk verdict Novel attack idea with real empirical support, but the main equilibrium theorem is mathematically wrong for non-uniform intent priors. read the letter →

arxiv 2505.20841 v2 pith:4NWPG35K submitted 2025-05-27 cs.CL

Xinbo Wu , Abhishek Umrawal , Lav R. Varshney This is my paper
classification cs.CL
keywords adversarialpromptingintenthidingskillmixinggametheoryLLMsafetypromptandresponsefilteringjailbreakequilibriumanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper studies a class of attacks that hide a malicious request by mixing it with ordinary language skills—metaphor, technical jargon, poem, cooking instructions—so that neither the prompt nor the model's response reveals the intent. It models the attacker-defender standoff as a game in which a filter of total capacity $c$ detects intent–skill combinations, and derives the equilibrium payoff $J^* = 1 - \frac{c}{|S|}\sum_i p(i)^2$: the attacker's gain falls only with filter capacity and rises as the skill space grows. It then proves that a defender who deliberately misleads the attacker's probing can cap the attacker's gain at $J^*_M \le J^*$ whenever $|S|\ge c$. In experiments on GPT-3.5 and GPT-4, the skill-mixing attack achieves the highest intent-helpfulness scores among compared baselines, and the misleading defense lowers those scores by 40–71%.

What carries the argument

The central object is a zero-sum game between an attacker and a capacity-limited filter. The attacker picks a distribution $p(s|i)$ over skills for each intent $i$; the defender allocates a total budget $c$ of classification accuracy across intent–skill cells, summarized by $a_{i,s}\in[0,1]$, and the payoff is the probability that a request slips through and yields a helpful response. The carrying result is Theorem 3.1, which gives the equilibrium payoff $J^* = 1 - \frac{c}{|S|}\sum_i p(i)^2$ with the uniform-mixing and capacity-proportional accuracy strategies. The second piece of machinery is the misleading-defense mechanism of Theorem 3.3: the defender shows a fake accuracy profile, the attacker's best reply is to concentrate on the fake weakest cell, and the defender then allocates capacity greedily by intent probability, producing the upper-bounded equilibrium $J^*_M \le J^*$ under $|S|\ge c$.

What would settle it

Run the skill-mixing attack on the same target LLM with skill spaces of size 2, 5, and 10 and with 1-skill versus 2-skill mixing: if the Bin-JR score does not increase with the skill-space size and the number of mixed skills, the structural attacker advantage and the scaling implications of Eqs. (6)–(7) are falsified. Separately, implement the misleading defense on a target with $|S| \ge c$ and check whether the observed attack score stays at or below the undistorted equilibrium value; a score above $J^*$ would contradict Theorem 3.4.

Watch

Extended reading notes

Core claim

The paper's central claim is that concealing a malicious intent inside a composition of benign skills is a structurally favored attack against LLM systems that filter both prompts and responses. In the game where the attacker chooses a conditional skill distribution $p(s|i)$ and the defender allocates a total classification capacity $c$ with per-cell accuracy $a_{i,s}$, the equilibrium value is $J^* = 1 - \frac{c}{|S|}\sum_i p(i)^2$, attained when the defender spreads accuracy as $a_{i,s} = p(i)c/|S|$ and the attacker mixes skills uniformly. The paper reads this as a structural attacker advantage: the equilibrium gain grows with the size of the skill space, and mixing $n$ skills replaces $|S|$ with $\binom{|S|}{n}$, making the attacker's job progressively easier. To counter this, the paper designs a defense that feeds the attacker misleading probe results; when the attacker concentrates on the fake weakest point, the defender can greedily allocate capacity across the most probable intents, yielding equilibrium $J^*_M \le J^*$ under $|S|\ge c$. The empirical section confirms the attack's edge on GPT-3.5 and GPT-4 and shows the defense cuts measured attack performance by roughly 40–71%.

Load-bearing premise

The theory assumes the defender can freely reallocate a single additive capacity budget across independent intent–skill cells with no correlations and per-cell accuracies in [0,1]; the paper's own Limitations section says real classifiers exhibit correlated strengths and a more constrained strategic space, so the quantitative equilibrium and scaling predictions need not transfer to real systems.

Editorial extensions

If this is right

  • Larger skill spaces and mixing more skills per intent strictly increase the attacker's equilibrium gain, so defense quality must scale with the combinatorial size of the skill space to hold the line.
  • A defender that misleads the attacker's probing can hold the attacker's gain at or below the undistorted equilibrium value when the skill space is at least as large as the defense capacity, and the attacker's asymptotic gain vanishes as capacity grows.
  • The framework encompasses earlier jailbreak methods as special cases: an iterative method that wraps an intent in a hypothetical scenario is itself an intent mixed with a skill, so the equilibrium analysis extends to that family of attacks.
  • In the paper's experiments on GPT-3.5, expanding the skill space from 2 to 10 skills and moving from 1-skill to 2-skill mixing raised the Bin-JR score from 0.20 to 0.50, empirically confirming the predicted scaling advantage.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extension: if the skill space is genuinely large, the same uniform-mixing equilibrium suggests that an attacker could automate skill discovery (e.g., by generating new compositional skills) to outrun any fixed-capacity filter, a scaling dynamic the paper does not model.
  • Extension: the misleading defense assumes the attacker trusts its probe measurements; a hardened attacker that cross-checks probe statistics across repeated trials or maintains a prior over defender strategies might detect the misdirection, which is untested here.
  • Extension: the Bin-JR metric redefines red-teaming success at the intent level rather than the content level; adopting it could make jailbreak evaluations more sensitive to indirect and partial helpfulness, but also more subjective, since intent is not directly observable.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes an intent-hiding adversarial prompting strategy for LLMs, in which a malicious intent is concealed by mixing it with innocuous skills. It models the attacker–defender interaction as a minimax game where the defender has a fixed capacity budget of per-combination classification accuracy and the attacker chooses skill distributions. Theorem 3.1 claims the equilibrium payoff is J* = 1 - (c/|S|) sum_i p(i)^2, from which the paper derives scaling implications for the skill space and for the number of mixed skills. The paper then introduces a defense that misleads the attacker's probing and claims it reduces the equilibrium payoff (Theorems 3.3 and 3.4). Empirically, the paper defines a Bin-JR metric and reports that the proposed attack outperforms PAIR, GCG, JBC, and PRS on GPT-3.5 and GPT-4 under a LLaMA-3-70B prompt/response filter, and that the misleading defense reduces attack performance by 35–71% across targets.

Significance. The conceptual framework is timely and addresses a realistic threat model: defenses that use both prompt and response filtering, with attack success measured by helpfulness toward a hidden intent rather than overt harmfulness. The attack idea of probing weak skill–intent combinations and then concentrating attacks is practical, scalable, and does not require expensive iterative optimization, and the reported Bin-JR gains over baselines are suggestive. If the theory were correct, the paper would provide a formal explanation for why larger skill spaces favor the attacker and would give a principled defense against probing. However, the central equilibrium theorem contains a mathematical error, so the main formula and the comparison theorem built on it are not established as written. The empirical defense validation also tests a protocol different from the proposed misleading mechanism. The paper is not ready for publication in its current form, but the topic and the attack methodology are worth pursuing after the theoretical and experimental issues are addressed.

major comments (4)
  1. [Appendix A, Theorem A.1; Section 3.1, Eq. (6)] The proof of Theorem 3.1 is wrong in the defender's maximization step. After reducing the problem to V = max_a sum_i p(i) min_s a_{i,s}, the proof sets a_{i,s}=q(i)c/|S| and then asserts that sum_i p(i)q(i) is maximized at q(i)=p(i). For a linear objective over a probability simplex, the maximizer is an extreme point, not the proportional point, so the claimed equilibrium strategy is not optimal. Concretely, take I={1,2}, p(1)=0.9, p(2)=0.1, |S|=2, c=1. The claimed solution gives V=0.5(0.9^2+0.1^2)=0.41, whereas the feasible allocation a_{1,1}=a_{1,2}=0.5, a_{2,1}=a_{2,2}=0 yields V=0.45. Hence Eq. (6) is not the equilibrium value for general p(i). In the regime c≤|S| (the regime later assumed in Theorem 3.4), the correct value is J* = 1 - (c/|S|) max_i p(i), with greedy filling for larger capacities, not 1 - (c/|S|) sum_i p(i)^2. The qualitative scaling with |S| survives, but the theorem and its proof must be revised.
  2. [Theorem 3.4 and Appendix A, Theorem A.4] Because Theorem 3.1's baseline is incorrect, the proof of Theorem 3.4 compares J*_M with B=(c/|S|) sum_i p(i)^2, which is not the true equilibrium value of the original game. The inequality J*_M ≤ J* may remain true once J* is corrected (for c≤|S|, the corrected J* = 1 - (c/|S|) max_i p(i), and the greedy allocation in Theorem 3.3 achieves at least (c/|S|) max_i p(i)), but the proof as written does not establish the claimed comparison against the correct baseline. The authors should re-derive the result and state the conditions under which the defense advantage holds.
  3. [Section 4.2, Table 4 and the paragraph 'Defense by misleading the attacker'] The defense experiment does not test the proposed deceptive mechanism. The text states that 'we force the attacker to focus on the skill–intent combinations that exhibit the highest defense performance during the first stage of the attack,' and Appendix C says the defender 'leverage[s] statistics gathered during the attack's first stage to identify misleading points.' This protocol removes the attacker's chosen weak points and directs it to combinations the defender has already identified as strong; it does not present a fabricated performance distribution \hat{a} and test whether the attacker is actually deceived by it. The reported 35–71% drops are therefore largely by construction and do not validate the Theorem 3.3 mechanism. The authors should either implement the misleading channel (for example, by returning harmless responses to selected probes) or explicitly reframe the experiment as an upper bound on a defender who can directly observe and patch probed combinations.
  4. [Tables 1–4] The empirical comparisons are reported as single point estimates with no variance information. Tables 2–4 give one number per condition, with no standard errors, confidence intervals, or significance tests, and the primary evaluation uses a single rater (GPT-4.1) whose judgments are not checked for inter-rater reliability in the main experiments. Because the central empirical claim is comparative ('our method achieves the highest performance'), the absence of variance is a substantive gap; observed differences such as 0.45 versus 0.31 for GPT-3.5 in Table 2 could be within run-to-run variability. Please provide multiple independent runs and error bars, or at least per-intent score distributions, and report agreement on a subset of ratings.
minor comments (6)
  1. [Section 4.1, Dataset paragraph] 'partly souced from multiple benchmarks' contains a typo; it should read 'partly sourced.'
  2. [Section 4.2, scaling paragraph] The sentence 'Figure 1 demonstrates a real attack example by our method' appears to reference the wrong figure; the actual attack examples are in Figures 4 and 5.
  3. [Section 4.1, Eq. (12)] Equation (12) correctly defines the rater score as R(i, y_j), but the following sentence writes R(i, x_i); this should be R(i, y_j).
  4. [Section 3.2, discussion after Theorem 3.3] 'the attacker recieves no gain' should be 'receives no gain.'
  5. [Appendix C.4] 'W followed Chao et al. (2024) to set the temperature' should be 'We followed.'
  6. [References] There are typos in the references: 'an Maddie Simens' in the OpenAI et al. entry and 'V olume' in the Röttger et al. entry.

Circularity Check

1 steps flagged · score 6.0 of 10

Defense validation reduces by construction: the attacker is forced to target the defender's strongest cells, so the measured performance drop is an artifact of the experimental protocol rather than evidence of deception.

  1. self definitional [Section 4.2, 'Defense by misleading the attacker', Table 4; cf. Section 3.2, Theorem 3.3]
    "Specifically, we force the attacker to focus on the skill–intent combinations that exhibit the highest defense performance during the first stage of the attack. Table 4 presents the percentage of attack performance drop relative to the original performance after implementing our defense mechanism... indicating strong empirical effectiveness of our defense strategy against the attack by hiding intent."

    The measured drop is generated by the experimental selection rule, not by the defense's misleading mechanism. In the theory (Theorem 3.3), the defender's advantage arises because a probing attacker is deceived into choosing the skill with the lowest fabricated performance, after which the defender allocates capacity to that chosen point. In the experiment, the authors instead force the attacker to focus on the skill–intent combinations with the highest actual defense performance. Thus the attacker is aimed at exactly the cells where the defender is already strongest, so the reported attack-performance drop is an artifact of the setup rather than evidence that a real probing attacker would be misled. The experiment does not test deception; it enforces the deception's outcome as an input.

full rationale

The game-theoretic core (Sections 2, 3, and Appendix A) is self-contained: the equilibrium value J* is derived from the stated minimax program (5) under the model's assumptions, and no parameter is fitted to data or imported from the authors' prior work. The self-citation to Varshney (2019) is illustrative and not load-bearing. The circular content is in the empirical validation of the misleading defense (Section 4.2, Table 4). The paper's own protocol states that the attacker is forced to focus on skill–intent combinations with the highest defense performance, after which a large attack-performance drop is reported as evidence of the defense. Under the theoretical mechanism, the defender's advantage comes from deceiving a probing attacker into selecting the defender's strong (fake-weak) cells; forcing the attacker to select those cells gives the same outcome by construction, so the experiment does not test deception. Consequently, one of the paper's central empirical claims—the effectiveness of the proposed defense—is partially circular because the result is built into the experimental setup. No other reduction of a prediction to its input was found. Whether Theorem 3.1's equilibrium computation is mathematically correct is a separate correctness question, not a circularity issue.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The framework rests on modeling abstractions: discrete skills and intents, arbitrary attacker skill distributions, additive and independently allocable defender capacity, simplified payoff, and a fully trusting misled attacker for the defense. None of these are fitted to data; they are assumptions whose realism is partially acknowledged in the Limitations section. The empirical section introduces hand-chosen hyperparameters such as skill list size, rater threshold, and probe counts, but these do not enter the equilibrium proof.

free parameters (4)
  • Defense capacity c = abstract, not estimated
    The equilibrium value and all scaling claims depend on c, but no operational definition or measurement is given for the capacity of a real prompt/response filter; in experiments, c is never set or measured.
  • Number of skills |S| in experiments = 10, with variations 2, 5, and 10
    The skill list in Table 5 is hand-selected by the authors; scaling results compare sizes 2, 5, 10, and 2-skill mixing, so the empirical test of the scaling prediction is tied to this arbitrary choice.
  • Rater positive threshold = scores > 1 treated as positive
    The LLM-as-rater outputs 1-5; the paper binarizes at >1, which changes all reported Bin-JR scores and is a hand-chosen decision.
  • Probe and attack prompt counts = 5 probes per combination; 20 prompts per intent in stage 2
    Attack performance depends on these counts; they are chosen by the authors and not varied systematically except in the single ablation.
assumptions (6)
  • domain assumption The attacker can choose p(s|i) arbitrarily over a fixed finite skill set S, and intent and skill mix independently through generator E.
    This defines the attack model in Section 2; real prompt crafting may be more constrained, but the model assumes full flexibility.
  • ad hoc to paper Defender accuracy a_{i,s} is an independent, additively constrained resource with 0 <= a_{i,s} <= 1 and sum = c.
    The equilibrium proof in Theorem A.1 relies on free reallocation of a across cells; the paper's Limitations admits real defenses have correlation constraints.
  • ad hoc to paper Payoff simplifies to ^J = 1 - D(x,y) with uniform utility and intent weights merged into pI.
    Section 2 states this simplification for analytical convenience; it strips out w(i) and u(i,y), so the equilibrium is about bypass probability, not actual fulfillment of harmful goals.
  • domain assumption For n-skill mixing, the combination space has size binomial(|S|,n) and the single-skill equilibrium formula applies verbatim.
    Eq. (7) in Section 3.1 is asserted without a proof or a model of how skills interact semantically.
  • domain assumption |S| >= c for Theorem 3.4.
    Explicitly stated; practically relevant when skill space is large and capacity is small, but not guaranteed.
  • ad hoc to paper The defender can fabricate the performance distribution \hat{a} presented to the attacker at no cost, and the attacker fully trusts the fabricated weak points.
    Theorem 3.3 and the defense experiments rely on the attacker being perfectly misled; real probing attackers might discover deception.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Concealment of Intent: A Game-Theoretic Analysis." pith.science (2026). https://pith.science/paper/4NWPG35K

@misc{pith2026250520841,
  author       = {Pith},
  title        = {Pith review of: Concealment of Intent: A Game-Theoretic Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4NWPG35K}},
  note         = {Machine review of arXiv:2505.20841}
}
read the original abstract

As large language models (LLMs) grow more capable, concerns about their safe deployment have also grown. Although alignment mechanisms have been introduced to deter misuse, they remain vulnerable to carefully designed adversarial prompts. In this work, we present a scalable attack strategy: intent-hiding adversarial prompting, which conceals malicious intent through the composition of skills. We develop a game-theoretic framework to model the interaction between such attacks and defense systems that apply both prompt and response filtering. Our analysis identifies equilibrium points and reveals structural advantages for the attacker. To counter these threats, we propose and analyze a defense mechanism tailored to intent-hiding attacks. Empirically, we validate the attack's effectiveness on multiple real-world LLMs across a range of malicious behaviors, demonstrating clear advantages over existing adversarial prompting techniques.

Figures

Figures reproduced from arXiv: 2505.20841 by the authors.

Figure 1
Figure 1. Illustration of a real attack procedure. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Custom prompt for our LLM-as-raters. intent and response are replace by the user intent and a [PITH_FULL_IMAGE:figures/full_fig_p016_2.png] view at source ↗
Figure 3
Figure 3. Prompt for our re-writer. intent and skills should be replace by the user intent and a set of skills to [PITH_FULL_IMAGE:figures/full_fig_p016_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Real examples for attacking gpt-3.5-turbo-1106 by mixing 1 skill. We highlight useful information [PITH_FULL_IMAGE:figures/full_fig_p019_4.png]
Figure 5
Figure 5. Figure 5: Real example for attacking gpt-3.5-turbo-1106 by mixing 2 skills. [PITH_FULL_IMAGE:figures/full_fig_p020_5.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

    cs.CR 2026-07 conditional novelty 7.0 of 10

    With copyable pre-release evidence, any dual-use release rule that keeps legitimate utility q must leave worst-case attacker assistance at least Γ(q)>0, so useful capability, reliable safety, and open access cannot coexist.

Reference graph

Works this paper leans on

30 extracted references · 21 canonical work pages · cited by 1 Pith paper

  1. [1]

    Llama 3 model card

    AI@Meta (2024). Llama 3 model card. https://github.com/meta-llama/llama3/blob/ main/MODEL_CARD.md

    work page 2024

  2. [2]

    Albert, A. (2024). Jailbreak chat. https://www.jailbreakchat.com, 2023. Accessed: 2025-05-14

    work page 2024

  3. [3]

    Andriushchenko, M., Croce, F., and Flammarion, N. (2024). Jailbreaking leading safety-aligned llms with simple adaptive attacks. arXiv preprint arXiv:2404.02151

    arXiv 2024

  4. [4]

    and Goyal, A

    Arora, S. and Goyal, A. (2023). A theory for emergence of complex skills in language models. arXiv:2307.15936 [cs.LG]

    arXiv 2023

  5. [5]

    and Mé, L

    Borello, J.-M. and Mé, L. (2008). Code obfuscation techniques for metamorphic viruses. Journal in Computer Virology , 4:211--220

    work page 2008

  6. [6]

    J., Tram \`e r, F., et al

    Chao, P., Debenedetti, E., Robey, A., Andriushchenko, M., Croce, F., Sehwag, V., Dobriban, E., Flammarion, N., Pappas, G. J., Tram \`e r, F., et al. (2024). Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In Conference on Neural Information Processing Systems (NeurIPS)

    work page 2024

  7. [7]

    J., and Wong, E

    Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G. J., and Wong, E. (2023). Jailbreaking black box large language models in twenty queries. arXiv:2310.08419 [cs.LG]

    arXiv 2023

  8. [8]

    Hayase, J., Borevkovi \'c , E., Carlini, N., Tram \`e r, F., and Nasr, M. (2024). Query-based adversarial prompt generation. Advances in Neural Information Processing Systems , 37:128260--128279

    work page 2024

Show all 30 references
  1. [9]

    Jaszccolt, K. M. (2023). Semantics, Pragmatics, Philosophy: A Journey Through Meaning . Cambridge University Press

    2023

  2. [10]

    Lanigan, R. L. (2012). Familiar frustration: The J apanese encounter with N avajo ( D iné) ``code talkers'' in W orld W ar II . In Wąsik, Z., editor, Languages in Contact 2011 , pages 143--164. Philologica Wratislaviensia: Acta et Studia

    2012

  3. [11]

    Liu, F., Feng, Y., Xu, Z., Su, L., Ma, X., Yin, D., and Liu, H. (2024). JAILJUDGE : A comprehensive jailbreak judge benchmark with multi-agent enhanced explanation evaluation framework. arXiv:2410.12855 [cs.CL]

    2024 arXiv

  4. [12]

    Mazeika, M., Phan, L., Yin, X., Zou, A., Wang, Z., Mu, N., Sakhaee, E., Li, N., Basart, S., Li, B., et al. (2024). Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. Proceedings of Machine Learning Research , 235:35181--35224

    2024

  5. [13]

    Noveck, I. (2018). Experimental Pragmatics: The Making of a Cognitive Science . Cambridge University Press

    2018

  6. [14]

    GPT-4 technical report

    OpenAI (2023). GPT-4 technical report. arXiv:2304.01852

    2023 arXiv

  7. [15]

    Introducing gpt-4.1 in the api

    OpenAI (2025). Introducing gpt-4.1 in the api. https://openai.com/index/gpt-4-1/. Accessed: 2025-05-14

    2025

  8. [16]

    Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al. (2022). Training language models to follow instructions with human feedback. In Advances in Neural Information Processing Systems , volume 35, pages 27730--27744

    2022

  9. [17]

    S., Fraser, K., Zizzo, G., Hameed, M

    Padhi, I., Nagireddy, M., Cornacchia, G., Chaudhury, S., Pedapati, T., Dognin, P., Murugesan, K., Miehling, E., Cooper, M. S., Fraser, K., Zizzo, G., Hameed, M. Z., Purcell, M., Desmond, M., Pan, Q., Ashktorab, Z., Vejsbjerg, I., Daly, E. M., Hind, M., Geyer, W., Rawat, A., Va...

    2024 arXiv

  10. [18]

    Preda, M. D. and Giacobazzi, R. (2009). Semantics-based code obfuscation by abstract interpretation. Journal of Computer Security , 17(6):855--908

    2009

  11. [19]

    R \"o ttger, P., Kirk, H., Vidgen, B., Attanasio, G., Bianchi, F., and Hovy, D. (2024). Xstest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Compu...

    2024

  12. [20]

    Shen, M., Wang, J., Du, H., Niyato, D., Tang, X., Kang, J., Ding, Y., and Zhu, L. (2024). Secure semantic communications: Challenges, approaches, and opportunities. IEEE Network , 38(4):197--206

    2024

  13. [21]

    Su, J., Kempe, J., and Ullrich, K. (2024). Mission impossible: A statistical perspective on jailbreaking LLMs . In Advances in Neural Information Processing Systems , volume 37, pages 38267--38306

    2024

  14. [22]

    Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al. (2023). Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288

    2023 arXiv

  15. [23]

    Varshney, L. R. (2019). Mathematical limit theorems for computational creativity. IBM Journal of Research and Development , 63(1):2:1--2:12

    2019

  16. [24]

    Wei, A., Haghtalab, N., and Steinhardt, J. (2023). Jailbroken: How does LLM safety training fail? In Advances in Neural Information Processing Systems , volume 36, pages 80079--80110

    2023

  17. [25]

    Yang, Z., Chen, M., Li, G., Yang, Y., and Zhang, Z. (2024). Secure semantic communications: Fundamentals and challenges. IEEE Network , 38(6):513--520

    2024

  18. [26]

    Yong, Z.-X., Menghini, C., and Bach, S. H. (2023). Low-resource languages jailbreak GPT-4 . arXiv:2310.02446 [cs.CL]

    2023 arXiv

  19. [27]

    Yu, D., Kaur, S., Gupta, A., Brown-Cohen, J., Goyal, A., and Arora, S. (2024). Skill-mix: A flexible and expandable family of evaluations for AI models. In International Conference on Learning Representations (ICLR)

    2024

  20. [28]

    Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E., et al. (2023). Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems , 36:46595--46623

    2023

  21. [29]

    Zhou, A., Li, B., and Wang, H. (2024). Robust prompt optimization for defending language models against jailbreaking attacks. In Advances in Neural Information Processing Systems , volume 37, pages 40184--40211

    2024

  22. [30]

    Z., and Fredrikson, M

    Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., and Fredrikson, M. (2023). Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.