Pith. sign in

REVIEW 4 major objections 3 minor 159 references

Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoning

T0 review · 4 major / 3 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that jailbreak defenses can be built by reasoning over meta-operations—the basic manipulations that conceal harmful intent—and that this yields state-of-the-art defense with strong generalization to attack types never…

desk verdict Plausible new defense framework, but the 'unseen attack' claim can't be verified from this corrupted copy and the taxonomy-circularity risk needs referee scrutiny. read the letter →

arxiv 2508.03054 v1 pith:4HZJP76Y submitted 2025-08-05 cs.AI

Rui Pu , Chaozhuo Li , Rui Ha , Litian Zhang , Lirong Qiu , Xi Zhang This is my paper
classification cs.AI
keywords jailbreakdefenselargelanguagemodelsmeta-operationsLLMsafetyreasoningchainreinforcementlearninggeneralizationEG-GRPO
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to establish that a jailbreak defense can be built on reasoning rather than surface matching. It defines meta-operations as the basic manipulations that conceal harmful intent, and trains a model to walk through a structured chain: first perceive the whole prompt, then analyze localized regions for hidden manipulations. The claim is that this cognitive-style chain, after supervised fine-tuning on known manipulations and then reinforcement learning that explores new manipulation types, gives state-of-the-art detection and transfers to jailbreak attacks never seen in training. If true, defenders would no longer need an ever-growing list of attack signatures; they could block attacks by recognizing the underlying concealment structure.

What carries the argument

The load-bearing object is the meta-operation, defined in the paper as a basic manipulation that conceals harmful intent. The paper's bet is that these operations, not exact attack strings, are what a defender should classify. The reasoning chain carries the argument: CDD first forms a global perception of the prompt, then performs localized analysis to expose the manipulation, so detection is tied to an interpretable structural judgment. EG-GRPO, an entropy-guided reinforcement learning method whose entropy term pushes the policy to explore novel meta-operation types, supplies the claimed generalization to unseen threats by exploring variants the supervised data did not cover.

What would settle it

Train CDD with one or more meta-operation types completely withheld from both supervised fine-tuning and the reinforcement learning exploration, then test on jailbreaks that rely primarily on those withheld types. If detection on that held-out set falls to the level of pattern-matching baselines, the claim of generalization to unseen meta-operations is refuted.

Watch

Extended reading notes

Core claim

At the center of the paper is the claim that every jailbreak prompt conceals its harmful intent through a small set of basic manipulations, called meta-operations, and that a model which reasons about these manipulations can defend where pattern matching cannot. CDD operationalizes this as a two-stage reasoning chain: global perception of the prompt followed by localized analysis that uncovers hidden manipulations. The model is first supervised fine-tuned on this chain so it learns to recognize and articulate known manipulation patterns, then trained with entropy-guided GRPO, a reinforcement learning scheme that rewards exploring new types and variants of meta-operations. The authors report that the resulting defense achieves state-of-the-art performance on existing jailbreak benchmarks and generalizes to unseen attacks.

Load-bearing premise

The argument depends on real jailbreak prompts decomposing into a small, stable set of basic intent-concealing manipulations, so that exploring new variants of those manipulations is enough to cover future attacks that were never seen in training.

Editorial extensions

If this is right

  • A defender using CDD can flag a prompt by naming the concealment operation at work, giving an auditable reason rather than an opaque score.
  • Because the unit of generalization is the manipulation rather than the wording, one trained meta-operation class should cover many concrete sentences that implement it.
  • Defense training can shift from collecting exhaustive attack lists to exploring the space of meta-operation types and variants.
  • The structured reasoning chain means the defense can be applied at inference time as a guard, inspecting the prompt before the model answers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If meta-operations compose, a natural next step the paper does not spell out is detecting multi-operation attacks by checking whether the localized analysis finds more than one manipulation stacked in the same prompt.
  • A testable extension is to turn CDD's reasoning trace into a feedback signal: rejected prompts whose traces are wrong could be routed back through the reinforcement learning step, closing new attack types without manual labeling.
  • The same meta-operation reasoning could transfer to adjacent safety tasks such as prompt injection or disallowed-content filtering, since those also rely on concealment rather than exact wording.
  • If attackers adapt, the strongest pressure point may be prompts that do not decompose along the taxonomy; this predicts that automated attack search engines will erode CDD's generalization advantage faster than human-written jailbreaks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper proposes Cognitive-Driven Defense (CDD), a jailbreak defense that classifies prompts by reasoning about 'meta-operations,' defined as basic manipulations that conceal harmful intent. The claimed architecture uses a global-perception-then-localized-analysis reasoning chain, trains the model with supervised fine-tuning on structured reasoning chains, and then applies an entropy-guided reinforcement learning algorithm (EG-GRPO) to encourage exploration of new meta-operation types and variants. The abstract asserts state-of-the-art defense performance and strong generalization to unseen jailbreak attacks. The reproduced manuscript, however, is almost entirely unreadable: the main text, method section, and experimental tables consist of replacement characters and corrupted text, so the evaluation protocol, the exact definition of the meta-operation taxonomy, the EG-GRPO objective, and the numerical results cannot be inspected.

Significance. If the claims are correct, the paper would introduce a genuinely structural approach to jailbreak defense, moving beyond surface pattern matching to a taxonomy-driven reasoning process, and would provide evidence that such a defense generalizes to attack types not encountered during training. That would be a valuable contribution to the safety and alignment literature, and the idea of combining SFT with an entropy-guided RL exploration phase is conceptually interesting. The paper also deserves credit for framing the problem in terms of falsifiable generalization: the central claim is that held-out attacks are unseen at the structural level, not merely at the surface-text level. However, as submitted, the manuscript provides no verifiable evidence for these claims because the experimental and methodological content is unreadable, and the few readable statements raise a concrete circularity risk that the 'unseen' attacks may still decompose into the very same meta-operations used to build the training data.

major comments (4)
  1. [Abstract and Experiments (reproduced text)] The central empirical claim—'state-of-the-art defense performance' and 'strong generalization to unseen jailbreak attacks'—is not supported by the reproduced manuscript. The experimental section is unreadable: table entries appear as replacement characters, column headers cannot be matched to rows, and no evaluation protocol is described. There is no statement of which attacks were held out, how 'unseen' was defined, whether adaptive attacks were considered, or what variance or confidence intervals were observed. The authors must provide a complete, readable experimental section before the claim can be assessed.
  2. [Method: meta-operation taxonomy and 'unseen' definition] The paper defines meta-operations, uses them to construct SFT reasoning chains, and then has EG-GRPO explore 'new types and variants of meta-operations.' This creates a circularity risk: if the held-out 'unseen' attacks are generated from, or labeled with, the same meta-operation taxonomy, then the reported generalization is interpolation over known manipulation types, not extrapolation to structurally new attack categories. The manuscript must demonstrate that the held-out attacks are unseen at the meta-operation level, not merely at the surface-text level, by reporting the taxonomy decomposition of each held-out attack and showing that at least one held-out meta-operation was absent from training.
  3. [Method: EG-GRPO objective and free parameters] The description of EG-GRPO is not inspectable in the reproduced text, and the abstract alone does not specify the entropy guidance objective, the reward function, or the coefficients for KL and reward shaping. The reader's report lists these as free parameters, and without a bounded specification it is impossible to tell whether the exploration mechanism drives robust structural reasoning or overfits to a particular prompt distribution. Please provide the full EG-GRPO objective, including the entropy coefficient and any reward shaping terms, and describe how 'new types and variants of meta-operations' are generated or rewarded.
  4. [Experiments: adaptive attacks] No adaptive attack evaluation is reported. Since CDD is itself a learned model, an adversary who knows the meta-operation taxonomy and the defense's reasoning chain could craft prompts designed to evade the defense. The 'state-of-the-art' claim requires testing against adaptive adversaries, or at least an explicit statement that such attacks are out of scope and why. Without this, the practical significance of the defense remains unclear.
minor comments (3)
  1. [Full text (reproduced)] The submitted PDF text is corrupted on essentially every page; the methods, equations, and tables are unreadable. Please ensure that the final manuscript is a cleanly readable PDF so that the technical content can be reviewed.
  2. [Abstract] The abstract states 'state-of-the-art' and 'strong generalization' without reporting any quantitative result, baseline name, or dataset. Even a brief numeric summary in the abstract would help calibrate the claims.
  3. [Experiments (reproduced)] Several tables in the reproduced text show rows and columns that cannot be aligned because the characters are lost. When the readable version is provided, please ensure that every table has clear row labels, column headers, and error bars or variance statistics.

Circularity Check

0 steps flagged · score 0.0 of 10

No demonstrated circularity; the generalization claim is empirical, not a definitional reduction, and no self-citation chain is visible in the available text.

full rationale

The available readable portion of the manuscript states an empirical pipeline: define meta-operations as basic manipulations that conceal harmful intent, supervise fine-tuning on a structured reasoning chain, then use entropy-guided reinforcement learning to explore new types and variants of meta-operations, and finally measure defense performance on unseen jailbreak attacks. The claim that CDD generalizes to unseen attacks would be circular only if the held-out attacks were generated from the same meta-operation taxonomy that was used to train or explore, so that ‘unseen’ means unseen only at the surface level. Nothing in the supplied text establishes that held-out attacks were constructed that way; the method and experiment sections are not readable in this copy. The reader's concern is a plausible empirical threat to the generalization claim, but it cannot be exhibited as a specific reduction from the paper's own equations or data description. There are no visible load-bearing self-citations, no imported uniqueness theorems, and no fitted parameter that is later renamed as a prediction. Under the hard rule that circularity must be demonstrated by quotation and explicit reduction rather than suspected from experiment design, the appropriate finding is no significant circularity with score 0.

Assumptions & free parameters 2 free parameters · 4 assumptions · 1 invented entities

The ledger is short because the paper is empirical rather than formal. The known ingredients (GRPO, SFT) are carried from prior work. What the paper itself supplies is a hand-authored taxonomy of meta-operations (treated both as a domain assumption about attacks and as an invented entity without independent evidence), a stated assumption that prompts decompose along that taxonomy, an unstated assumption that RL exploration over variants of known operations transfers to genuinely new attacks, and the design assumption that a global-then-local reasoning chain is how hidden manipulations are uncovered. None of these is validated outside the paper's own pipeline, which is why the taxonomy's independent evidence is marked false. The numeric hyperparameters of EG-GRPO are also unspecified at the level I could read.

free parameters (2)
  • entropy guidance coefficient in EG-GRPO
    The entropy bonus meant to 'encourage exploration' is a hand-tuned scalar balancing exploration against the reward; no value or sensitivity analysis is given in the abstract.
  • KL divergence and reward shaping coefficients in the GRPO objective
    GRPO-style updates constrain deviation from the reference policy; the relative weights of the reward and the policy constraint are training hyperparameters not stated in the abstract.
assumptions (4)
  • domain assumption Jailbreak prompts are composed of identifiable meta-operations, and this decomposition is learnable from supervised examples.
    The abstract defines meta-operations as 'basic manipulations that conceal harmful intent' and builds SFT data from them; the completeness of the taxonomy determines whether the reasoning chain can cover future attacks.
  • domain assumption Entropy-guided exploration over variants of known meta-operations transfers to genuinely unseen attack strategies.
    The generalization claim rests on EG-GRPO encouraging 'new types and variants of meta-operations'; the abstract provides no evidence that exploring the neighborhood of known operations covers attacks outside that neighborhood.
  • ad hoc to paper A global-perception-then-localized-analysis reasoning chain is a faithful way to uncover hidden manipulations.
    The 'cognitive reasoning' emulation is introduced by this paper as a design choice; there is no argument in the abstract that this ordering is necessary or optimal.
  • standard math GRPO group-relative advantage estimation with policy constraints is a valid objective for this safety-training task.
    EG-GRPO is built on the established GRPO framework from prior work, treated as background rather than derived here.
invented entities (1)
  • Meta-operation (formal category of prompt manipulation)
    purpose: The unit over which the reasoning chain and the RL exploration are defined; the framework's central abstraction.
    There is no external ground truth for what counts as a meta-operation. The taxonomy is defined by the authors and validated only through the defense's own test-time performance, so the category cannot be falsified independently of the framework.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoning." pith.science (2026). https://pith.science/paper/4HZJP76Y

@misc{pith2026250803054,
  author       = {Pith},
  title        = {Pith review of: Beyond Surface-Level Detection: Towards Cognitive-Driven Defense Against Jailbreak Attacks via Meta-Operations Reasoning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4HZJP76Y}},
  note         = {Machine review of arXiv:2508.03054}
}
read the original abstract

Defending large language models (LLMs) against jailbreak attacks is essential for their safe and reliable deployment. Existing defenses often rely on shallow pattern matching, which struggles to generalize to novel and unseen attack strategies. To address this challenge, we propose the Cognitive-Driven Defense (CDD) framework, which targets the underlying structure of jailbreak prompts by applying meta-operations, defined as basic manipulations that conceal harmful intent.CDD emulates human cognitive reasoning through a structured reasoning chain. It begins with a global perception of the prompt and follows with a localized analysis to uncover hidden manipulations. By applying supervised fine-tuning on this structured chain, the model learns to identify and reason about known manipulation patterns. To enhance generalization to unseen threats, an entropy-guided reinforcement learning algorithm (EG-GRPO) is introduced to encourage exploration of new types and variants of meta-operations. Experiments demonstrate that CDD can achieve state-of-the-art defense performance and exhibit strong generalization to unseen jailbreak attacks.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

159 extracted references · 14 canonical work pages

  1. [1]

    Scalable training of

    Andrew, Galen and Gao, Jianfeng , booktitle =. Scalable training of

  2. [2]

    Tetreault , title =

    Mohammad Sadegh Rasooli and Joel R. Tetreault , title =. Computing Research Repository , volume =. 2015 , url =

    2015

  3. [3]

    A Framework for Learning Predictive Structures from Multiple Tasks and Unlabeled Data , volume =

    Ando, Rie Kubota and Zhang, Tong , issn =. A Framework for Learning Predictive Structures from Multiple Tasks and Unlabeled Data , volume =. Journal of Machine Learning Research , month = dec, numpages =

  4. [4]

    Zico Kolter and Matt Fredrikson , title =

    Andy Zou and Zifan Wang and J. Zico Kolter and Matt Fredrikson , title =. CoRR , volume =. 2023 , url =. doi:10.48550/ARXIV.2307.15043 , eprinttype =. 2307.15043 , timestamp =

    arXiv doi:10.48550/arxiv.2307.15043 2023

  5. [6]

    Xiaogeng Liu and Nan Xu and Muhao Chen and Chaowei Xiao , booktitle =. Auto. 2024 , url =

    2024

  6. [7]

    Llama 2: Open Foundation and Fine-Tuned Chat Models , journal =

    Hugo Touvron and Louis Martin and Kevin Stone and Peter Albert and Amjad Almahairi and Yasmine Babaei and Nikolay Bashlykov and Soumya Batra and Prajjwal Bhargava and Shruti Bhosale and Dan Bikel and Lukas Blecher and Cristian Canton. Llama 2: Open Foundation and Fine-Tuned Chat Models , journal =. 2023 , url =. doi:10.48550/ARXIV.2307.09288 , eprinttype ...

    arXiv doi:10.48550/arxiv.2307.09288 2023

  7. [9]

    2024 , url =

    Zhaorun Chen and Zhuokai Zhao and Wenjie Qu and Zichen Wen and Zhiguang Han and Zhihong Zhu and Jiaheng Zhang and Huaxiu Yao , booktitle =. 2024 , url =

    2024

  8. [10]

    Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images , booktitle =

    Kuofeng Gao and Yang Bai and Jindong Gu and Shu. Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images , booktitle =. 2024 , url =

    2024

Show all 159 references
  1. [11]

    Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models , booktitle =

    Shuai Zhao and Jinming Wen and Anh Tuan Luu and Junbo Zhao and Jie Fu , editor =. Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models , booktitle =. 2023 , url =. doi:10.18653/V1/2023.EMNLP-MAIN.757 , timestamp =

    2023 doi

  2. [12]

    Jailbroken: How Does

    Alexander Wei and Nika Haghtalab and Jacob Steinhardt , editor =. Jailbroken: How Does. Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16, 2023 , year =

    2023

  3. [13]

    CoRR , volume =

    OpenAI , title =. CoRR , volume =. 2023 , url =. doi:10.48550/ARXIV.2303.08774 , eprinttype =. 2303.08774 , timestamp =

    2023 doi arXiv

  4. [15]

    CoRR , volume =

    Sibo Yi and Yule Liu and Zhen Sun and Tianshuo Cong and Xinlei He and Jiaxing Song and Ke Xu and Qi Li , title =. CoRR , volume =. 2024 , url =. doi:10.48550/ARXIV.2407.04295 , eprinttype =. 2407.04295 , timestamp =

    2024 doi arXiv

  5. [19]

    arXiv preprint arXiv:2308.07308 , year =

    Llm self defense: By self examination, llms know they are being tricked , author =. arXiv preprint arXiv:2308.07308 , year =

    arXiv

  6. [21]

    First Conference on Language Modeling , year =

    AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models , author =. First Conference on Language Modeling , year =

  7. [24]

    arXiv preprint arXiv:2311.11855 , year =

    Evil geniuses: Delving into the safety of llm-based agents , author =. arXiv preprint arXiv:2311.11855 , year =

    arXiv

  8. [26]

    Attention Can Reflect Syntactic Structure (If You Let It) , booktitle =

    Vinit Ravishankar and Artur Kulmizev and Mostafa Abdou and Anders S. Attention Can Reflect Syntactic Structure (If You Let It) , booktitle =. 2021 , url =. doi:10.18653/V1/2021.EACL-MAIN.264 , timestamp =

    2021 doi

  9. [27]

    CoRR , volume =

    Xinyi Zeng and Yuying Shang and Yutao Zhu and Jiawei Chen and Yu Tian , title =. CoRR , volume =. 2024 , url =. doi:10.48550/ARXIV.2410.06809 , eprinttype =. 2410.06809 , timestamp =

    2024 doi arXiv

  10. [28]

    On Homophony and R

    Tiago Pimentel and Clara Meister and Simone Teufel and Ryan Cotterell , editor =. On Homophony and R. Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing,. 2021 , url =. doi:10.18653/V1/2021.EMNLP-MAIN.653 , timestamp =

    2021 doi

  11. [29]

    Shterionov and Matthew Gwilliam , editor =

    Eva Vanmassenhove and Dimitar Sht. Shterionov and Matthew Gwilliam , editor =. Machine Translationese: Effects of Algorithmic Bias on Linguistic Complexity in Machine Translation , booktitle =. 2021 , url =. doi:10.18653/V1/2021.EACL-MAIN.188 , timestamp =

    2021 doi

  12. [30]

    Entropy Rate Estimation for Markov Chains with Large State Space , booktitle =

    Yanjun Han and Jiantao Jiao and Chuan. Entropy Rate Estimation for Markov Chains with Large State Space , booktitle =. 2018 , url =

    2018

  13. [31]

    Generalized Entropy Regularization or: There's Nothing Special about Label Smoothing , booktitle =

    Clara Meister and Elizabeth Salesky and Ryan Cotterell , editor =. Generalized Entropy Regularization or: There's Nothing Special about Label Smoothing , booktitle =. 2020 , url =. doi:10.18653/V1/2020.ACL-MAIN.615 , timestamp =

    2020 doi

  14. [32]

    Shannon , title =

    Claude E. Shannon , title =. Bell Syst. Tech. J. , volume =. 1948 , url =. doi:10.1002/J.1538-7305.1948.TB01338.X , timestamp =

    1948

  15. [33]

    What does Attention in Neural Machine Translation Pay Attention to? , booktitle =

    Hamidreza Ghader and Christof Monz , editor =. What does Attention in Neural Machine Translation Pay Attention to? , booktitle =. 2017 , url =

    2017

  16. [34]

    Entropy-based Attention Regularization Frees Unintended Bias Mitigation from Lists , booktitle =

    Giuseppe Attanasio and Debora Nozza and Dirk Hovy and Elena Baralis , editor =. Entropy-based Attention Regularization Frees Unintended Bias Mitigation from Lists , booktitle =. 2022 , url =. doi:10.18653/V1/2022.FINDINGS-ACL.88 , timestamp =

    2022 doi

  17. [35]

    BaitAttack: Alleviating Intention Shift in Jailbreak Attacks via Adaptive Bait Crafting , booktitle =

    Rui Pu and Chaozhuo Li and Rui Ha and Litian Zhang and Lirong Qiu and Xi Zhang , editor =. BaitAttack: Alleviating Intention Shift in Jailbreak Attacks via Adaptive Bait Crafting , booktitle =. 2024 , url =

    2024

  18. [36]

    Controlled Text Generation with Natural Language Instructions , booktitle =

    Wangchunshu Zhou and Yuchen Eleanor Jiang and Ethan Wilcox and Ryan Cotterell and Mrinmaya Sachan , editor =. Controlled Text Generation with Natural Language Instructions , booktitle =. 2023 , url =

    2023

  19. [37]

    CoRR , volume =

    Yuhong Li and Yingbing Huang and Bowen Yang and Bharat Venkitesh and Acyr Locatelli and Hanchen Ye and Tianle Cai and Patrick Lewis and Deming Chen , title =. CoRR , volume =. 2024 , url =. doi:10.48550/ARXIV.2404.14469 , eprinttype =. 2404.14469 , timestamp =

    2024 doi arXiv

  20. [38]

    Pappas , title =

    Alexander Robey and Eric Wong and Hamed Hassani and George J. Pappas , title =. CoRR , volume =. 2023 , url =. doi:10.48550/ARXIV.2310.03684 , eprinttype =. 2310.03684 , timestamp =

    2023 doi arXiv

  21. [39]

    Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization , booktitle =

    Zhexin Zhang and Junxiao Yang and Pei Ke and Fei Mi and Hongning Wang and Minlie Huang , editor =. Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization , booktitle =. 2024 , url =. doi:10.18653/V1/2024.ACL-LONG.481 , timestamp =

    2024 doi

  22. [40]

    and Stoica, Ion and Xing, Eric P

    Chiang, Wei-Lin and Li, Zhuohan and Lin, Zi and Sheng, Ying and Wu, Zhanghao and Zhang, Hao and Zheng, Lianmin and Zhuang, Siyuan and Zhuang, Yonghao and Gonzalez, Joseph E. and Stoica, Ion and Xing, Eric P. , year =. Vicuna: An Open-Source Chatbot Impressing GPT-4 with 90\ Ch...

  23. [41]

    Albert Q. Jiang and Alexandre Sablayrolles and Arthur Mensch and Chris Bamford and Devendra Singh Chaplot and Diego de Las Casas and Florian Bressand and Gianna Lengyel and Guillaume Lample and Lucile Saulnier and L. Mistral 7B , journal =. 2023 , url =. doi:10.48550/ARXIV.231...

    2023 doi arXiv

  24. [42]

    LongBench:

    Yushi Bai and Xin Lv and Jiajie Zhang and Hongchang Lyu and Jiankai Tang and Zhidian Huang and Zhengxiao Du and Xiao Liu and Aohan Zeng and Lei Hou and Yuxiao Dong and Jie Tang and Juanzi Li , editor =. LongBench:. Proceedings of the 62nd Annual Meeting of the Association for ...

    2024 doi

  25. [43]

    Hashimoto , editor =

    Yann Dubois and Chen Xuechen Li and Rohan Taori and Tianyi Zhang and Ishaan Gulrajani and Jimmy Ba and Carlos Guestrin and Percy Liang and Tatsunori B. Hashimoto , editor =. AlpacaFarm:. Advances in Neural Information Processing Systems 36: Annual Conference on Neural Informat...

    2023

  26. [44]

    ROUGE : A Package for Automatic Evaluation of Summaries

    Lin, Chin-Yew. ROUGE : A Package for Automatic Evaluation of Summaries. 2004

    2004

  27. [45]

    CoRR , volume =

    Anselm Paulus and Arman Zharmagambetov and Chuan Guo and Brandon Amos and Yuandong Tian , title =. CoRR , volume =. 2024 , url =. doi:10.48550/ARXIV.2404.16873 , eprinttype =. 2404.16873 , timestamp =

    2024 doi arXiv

  28. [46]

    CoRR , volume =

    Zeyi Liao and Huan Sun , title =. CoRR , volume =. 2024 , url =. doi:10.48550/ARXIV.2404.07921 , eprinttype =. 2404.07921 , timestamp =

    2024 doi arXiv

  29. [47]

    CoRR , volume =

    Tanqiu Jiang and Zian Wang and Jiacheng Liang and Changjiang Li and Yuhui Wang and Ting Wang , title =. CoRR , volume =. 2024 , url =. doi:10.48550/ARXIV.2410.19937 , eprinttype =. 2410.19937 , timestamp =

    2024 doi arXiv

  30. [48]

    Forty-first International Conference on Machine Learning,

    Xingang Guo and Fangxu Yu and Huan Zhang and Lianhui Qin and Bin Hu , title =. Forty-first International Conference on Machine Learning,. 2024 , url =

    2024

  31. [49]

    Cambridge (Mass.) , year=

    Atheory of justice , author=. Cambridge (Mass.) , year=

  32. [50]

    CoRR , volume =

    Yi Liu and Gelei Deng and Zhengzi Xu and Yuekang Li and Yaowen Zheng and Ying Zhang and Lida Zhao and Tianwei Zhang and Yang Liu , title =. CoRR , volume =. 2023 , url =. doi:10.48550/ARXIV.2305.13860 , eprinttype =. 2305.13860 , timestamp =

    2023 doi arXiv

  33. [51]

    The Twelfth International Conference on Learning Representations,

    Suyu Ge and Yunan Zhang and Liyuan Liu and Minjia Zhang and Jiawei Han and Jianfeng Gao , title =. The Twelfth International Conference on Learning Representations,. 2024 , url =

    2024

  34. [52]

    Uncertainty of Thoughts: Uncertainty-Aware Planning Enhances Information Seeking in Large Language Models , journal =

    Zhiyuan Hu and Chumin Liu and Xidong Feng and Yilun Zhao and See. Uncertainty of Thoughts: Uncertainty-Aware Planning Enhances Information Seeking in Large Language Models , journal =. 2024 , url =. doi:10.48550/ARXIV.2402.03271 , eprinttype =. 2402.03271 , timestamp =

    2024 doi arXiv

  35. [53]

    CoRR , volume =

    Anay Mehrotra and Manolis Zampetakis and Paul Kassianik and Blaine Nelson and Hyrum Anderson and Yaron Singer and Amin Karbasi , title =. CoRR , volume =. 2023 , url =. doi:10.48550/ARXIV.2312.02119 , eprinttype =. 2312.02119 , timestamp =

    2023 doi arXiv

  36. [54]

    Constituency Parsing with a Self-Attentive Encoder , booktitle =

    Nikita Kitaev and Dan Klein , editor =. Constituency Parsing with a Self-Attentive Encoder , booktitle =. 2018 , url =. doi:10.18653/V1/P18-1249 , timestamp =

    2018 doi

  37. [55]

    Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer , author=. J. Mach. Learn. Res. , year=

  38. [56]

    Moses: Open Source Toolkit for Statistical Machine Translation , booktitle =

    Philipp Koehn and Hieu Hoang and Alexandra Birch and Chris Callison. Moses: Open Source Toolkit for Statistical Machine Translation , booktitle =. 2007 , url =

    2007

  39. [57]

    The Second Tiny Papers Track at

    Mansi Phute and Alec Helbling and Matthew Hull and Shengyun Peng and Sebastian Szyller and Cory Cornelius and Duen Horng Chau , title =. The Second Tiny Papers Track at. 2024 , url =

    2024

  40. [58]

    CoRR , volume =

    Peiran Wang and Xiaogeng Liu and Chaowei Xiao , title =. CoRR , volume =. 2024 , url =. doi:10.48550/ARXIV.2410.08660 , eprinttype =. 2410.08660 , timestamp =

    2024 doi arXiv

  41. [59]

    Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers),

    Zezhong Wang and Fangkai Yang and Lu Wang and Pu Zhao and Hongru Wang and Liang Chen and Qingwei Lin and Kam. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers),...

    2024 doi

  42. [61]

    Linguistic Obfuscation Attacks and Large Language Model Uncertainty

    Steindl, Sebastian and Sch. Linguistic Obfuscation Attacks and Large Language Model Uncertainty. Proceedings of the 1st Workshop on Uncertainty-Aware NLP (UncertaiNLP 2024). 2024

    2024

  43. [62]

    Baseline defenses for adversarial attacks against aligned language models , url =

    Jain, Neel and Schwarzschild, Avi and Wen, Yuxin and Somepalli, Gowthami and Kirchenbauer, John and Chiang, Ping-yeh and Goldblum, Micah and Saha, Aniruddha and Geiping, Jonas and Goldstein, Tom , journal =. Baseline defenses for adversarial attacks against aligned language mo...

  44. [63]

    Jailbreak and guard aligned language models with only few in-context demonstrations , url =

    Wei, Zeming and Wang, Yifei and Wang, Yisen , journal =. Jailbreak and guard aligned language models with only few in-context demonstrations , url =

  45. [66]

    Entropy- and Distance-Regularized Attention Improves Low-Resource Neural Machine Translation , booktitle =

    Ali Araabi and Vlad Niculae and Christof Monz , editor =. Entropy- and Distance-Regularized Attention Improves Low-Resource Neural Machine Translation , booktitle =. 2024 , url =

    2024

  46. [67]

    CoRR , volume =

    Caishuang Huang and Wanxu Zhao and Rui Zheng and Huijie Lv and Shihan Dou and Sixian Li and Xiao Wang and Enyu Zhou and Junjie Ye and Yuming Yang and Tao Gui and Qi Zhang and Xuanjing Huang , title =. CoRR , volume =. 2024 , url =. doi:10.48550/ARXIV.2406.18118 , eprinttype =....

    2024 doi arXiv

  47. [68]

    Pre-Trained Language Models for Text Generation:

    Junyi Li and Tianyi Tang and Wayne Xin Zhao and Jian. Pre-Trained Language Models for Text Generation:. 2024 , url =. doi:10.1145/3649449 , timestamp =

    2024 doi

  48. [69]

    Zhao and Kelvin Guu and Adams Wei Yu and Brian Lester and Nan Du and Andrew M

    Jason Wei and Maarten Bosma and Vincent Y. Zhao and Kelvin Guu and Adams Wei Yu and Brian Lester and Nan Du and Andrew M. Dai and Quoc V. Le , title =. The Tenth International Conference on Learning Representations,. 2022 , url =

    2022

  49. [70]

    MetaICL: Learning to Learn In Context , booktitle =

    Sewon Min and Mike Lewis and Luke Zettlemoyer and Hannaneh Hajishirzi , editor =. MetaICL: Learning to Learn In Context , booktitle =. 2022 , url =. doi:10.18653/V1/2022.NAACL-MAIN.201 , timestamp =

    2022 doi

  50. [72]

    Intention Analysis Makes LLMs

    Yuqi Zhang and Liang Ding and Lefei Zhang and Dacheng Tao , editor =. Intention Analysis Makes LLMs. Proceedings of the 31st International Conference on Computational Linguistics,. 2025 , url =

    2025

  51. [73]

    How Alignment and Jailbreak Work: Explain

    Zhenhong Zhou and Haiyang Yu and Xinghua Zhang and Rongwu Xu and Fei Huang and Yongbin Li , editor =. How Alignment and Jailbreak Work: Explain. Findings of the Association for Computational Linguistics:. 2024 , url =

    2024

  52. [74]

    PeerJ Comput

    Bhagyajit Pingua and Deepak Murmu and Meenakshi Kandpal and Jyotirmayee Rautaray and Pranati Mishra and Rabindra Kumar Barik and Manob Jyoti Saikia , title =. PeerJ Comput. Sci. , volume =. 2024 , url =. doi:10.7717/PEERJ-CS.2374 , timestamp =

    2024 doi

  53. [75]

    Attack Prompt Generation for Red Teaming and Defending Large Language Models , booktitle =

    Boyi Deng and Wenjie Wang and Fuli Feng and Yang Deng and Qifan Wang and Xiangnan He , editor =. Attack Prompt Generation for Red Teaming and Defending Large Language Models , booktitle =. 2023 , url =. doi:10.18653/V1/2023.FINDINGS-EMNLP.143 , timestamp =

    2023 doi

  54. [76]

    CoRR , volume =

    Xuan Li and Zhanke Zhou and Jianing Zhu and Jiangchao Yao and Tongliang Liu and Bo Han , title =. CoRR , volume =. 2023 , url =. doi:10.48550/ARXIV.2311.03191 , eprinttype =. 2311.03191 , timestamp =

    2023 doi arXiv

  55. [78]

    Baratz , title =

    Stephen S. Baratz , title =. J. Am. Soc. Inf. Sci. , volume =. 1978 , url =. doi:10.1002/ASI.4630290313 , timestamp =

    1978 doi

  56. [79]

    Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction , booktitle =

    Tong Liu and Yingjie Zhang and Zhe Zhao and Yinpeng Dong and Guozhu Meng and Kai Chen , editor =. Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction , booktitle =. 2024 , url =

    2024

  57. [80]

    Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense

    Ouyang, Yang and Gu, Hengrui and Lin, Shuhang and Hua, Wenyue and Peng, Jie and Kailkhura, Bhavya and Gao, Meijun and Chen, Tianlong and Zhou, Kaixiong. Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense. Proceedings of the 2025 Conf...

    2025

  58. [82]

    The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models , booktitle =

    Zihui Wu and Haichang Gao and Jianping He and Ping Wang , editor =. The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models , booktitle =. 2025 , url =

    2025

  59. [84]

    arXiv preprint arXiv:2502.11084 , year=

    Rewrite to Jailbreak: Discover Learnable and Transferable Implicit Harmfulness Instruction , author=. arXiv preprint arXiv:2502.11084 , year=

    arXiv

  60. [86]

    Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks , pages =

    Measuring Mathematical Problem Solving With the MATH Dataset , author=. Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks , pages =

  61. [87]

    Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    Beyond one-preference-fits-all alignment: Multi-objective direct preference optimization , author=. Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    2024

  62. [88]

    arXiv preprint arXiv:2411.04368 , year=

    Measuring short-form factuality in large language models , author=. arXiv preprint arXiv:2411.04368 , year=

    arXiv

  63. [89]

    The Twelfth International Conference on Learning Representations , year=

    Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theory , author=. The Twelfth International Conference on Learning Representations , year=

  64. [90]

    Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks , year=

    Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Models , author=. Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks , year=

  65. [97]

    The Thirteenth International Conference on Learning Representations , year=

    Safety Alignment Should Be Made More Than Just a Few Tokens Deep , author=. The Thirteenth International Conference on Learning Representations , year=

  66. [99]

    Communication theory , volume=

    Interpersonal deception theory , author=. Communication theory , volume=. 1996 , publisher=

    1996

  67. [100]

    1995 , publisher=

    Cognitive psychology and its implications , author=. 1995 , publisher=

    1995

  68. [101]

    Trends in cognitive sciences , volume=

    In two minds: dual-process accounts of reasoning , author=. Trends in cognitive sciences , volume=. 2003 , publisher=

    2003

  69. [108]

    2024 , month=

    Skywork-o1 Open Series , author=. 2024 , month=

    2024

  70. [110]

    QwQ: Reflect Deeply on the Boundaries of the Unknown , url =

    Qwen Team , month =. QwQ: Reflect Deeply on the Boundaries of the Unknown , url =

  71. [115]

    Advances in Neural Information Processing Systems , volume =

    Paul F Christiano and Jan Leike and Tom Brown and Miljan Martic and Shane Legg and Dario Amodei , title =. Advances in Neural Information Processing Systems , volume =

  72. [116]

    , title =

    Long Ouyang and Jeffrey Wu and Xu Jiang and Diogo Almeida and Carroll Wainwright and Pamela Mishkin and Chong Zhang and Sandhini Agarwal and Katarina Slama and Alex Ray and et al. , title =. Advances in Neural Information Processing Systems , volume =

  73. [117]

    Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

    Steering away from harm: An adaptive approach to defending vision language model against jailbreaks , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

  74. [118]

    , title =

    Chunting Zhou and Pengfei Liu and Puxin Xu and Srinivasan Iyer and Jiao Sun and Yuning Mao and Xuezhe Ma and Avia Efrat and Ping Yu and Lili Yu and et al. , title =. Advances in Neural Information Processing Systems , volume =

  75. [119]

    , title =

    Wenxuan Zhang and Hou Pong Chan and Yiran Zhao and Mahani Aljunied and Jianyu Wang and Chaoqun Liu and Yue Deng and Zhiqiang Hu and Weiwen Xu and Yew Ken Chia and et al. , title =. arXiv preprint arXiv:2407.19672 , year =

    arXiv

  76. [120]

    arXiv preprint arXiv:2109.10862 , year =

    Jeff Wu and Long Ouyang and Daniel M Ziegler and Nisan Stiennon and Ryan Lowe and Jan Leike and Paul Christiano , title =. arXiv preprint arXiv:2109.10862 , year =

    arXiv

  77. [121]

    , title =

    Yuntao Bai and Andy Jones and Kamal Ndousse and Amanda Askell and Anna Chen and Nova DasSarma and Dawn Drain and Stanislav Fort and Deep Ganguli and Tom Henighan and et al. , title =. arXiv preprint arXiv:2204.05862 , year =

    arXiv

  78. [122]

    arXiv preprint arXiv:2304.05302 , year =

    Zheng Yuan and Hongyi Yuan and Chuanqi Tan and Wei Wang and Songfang Huang and Fei Huang , title =. arXiv preprint arXiv:2304.05302 , year =

    arXiv

  79. [123]

    arXiv preprint arXiv:2311.08045 , year =

    Pengyu Cheng and Yifan Yang and Jian Li and Yong Dai and Nan Du , title =. arXiv preprint arXiv:2311.08045 , year =

    arXiv

  80. [124]

    arXiv preprint arXiv:2312.06674 , year=

    Llama guard: Llm-based input-output safeguard for human-ai conversations , author=. arXiv preprint arXiv:2312.06674 , year=

    arXiv

  81. [125]

    WildGuard: Open One-stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs , booktitle =

    Seungju Han and Kavel Rao and Allyson Ettinger and Liwei Jiang and Bill Yuchen Lin and Nathan Lambert and Yejin Choi and Nouha Dziri , editor =. WildGuard: Open One-stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs , booktitle =. 2024 , url =

    2024

  82. [126]

    Advances in Neural Information Processing Systems , volume =

    Alexander Wei and Nika Haghtalab and Jacob Steinhardt , title =. Advances in Neural Information Processing Systems , volume =

  83. [127]

    Advances in Neural Information Processing Systems , editor=

    Chain of Thought Prompting Elicits Reasoning in Large Language Models , author=. Advances in Neural Information Processing Systems , editor=. 2022 , url=

    2022

  84. [128]

    Nature Machine Intelligence , volume=

    Defending chatgpt against jailbreak attack via self-reminders , author=. Nature Machine Intelligence , volume=. 2023 , url=

    2023

  85. [129]

    R ^2 -Guard: Robust Reasoning Enabled

    Mintong Kang and Bo Li , booktitle=. R ^2 -Guard: Robust Reasoning Enabled. 2025 , url=

    2025

  86. [131]

    Intention Analysis Makes LLM s A Good Jailbreak Defender

    Zhang, Yuqi and Ding, Liang and Zhang, Lefei and Tao, Dacheng. Intention Analysis Makes LLM s A Good Jailbreak Defender. Proceedings of the 31st International Conference on Computational Linguistics. 2025

    2025

  87. [132]

    ICLR 2025 Workshop on Bidirectional Human-AI Alignment , year=

    SafeChain: Safety of Language Models with Long Chain-of-Thought Reasoning Capabilities , author=. ICLR 2025 Workshop on Bidirectional Human-AI Alignment , year=

    2025

  88. [135]

    The Twelfth International Conference on Learning Representations,

    Youliang Yuan and Wenxiang Jiao and Wenxuan Wang and Jen. The Twelfth International Conference on Learning Representations,. 2024 , url =

    2024

  89. [137]

    The Thirteenth International Conference on Learning Representations,

    Maksym Andriushchenko and Francesco Croce and Nicolas Flammarion , title =. The Thirteenth International Conference on Learning Representations,. 2025 , url =

    2025

  90. [139]

    Stanford alpaca: an instruction-following llama model (2023) , author=

    2023

  91. [141]

    Gabriel Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132

    2023 arXiv

  92. [142]

    John Robert Anderson and Jane Crawford. 1995. Cognitive psychology and its implications

    1995

  93. [143]

    Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. 2025. https://openreview.net/forum?id=hXA8wqRdyV Jailbreaking leading safety-aligned llms with simple adaptive attacks . In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore...

    2025

  94. [144]

    David B Buller and Judee K Burgoon. 1996. Interpersonal deception theory. Communication theory, 6(3):203--242

    1996

  95. [145]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2023. https://doi.org/10.48550/ARXIV.2310.08419 Jailbreaking black box large language models in twenty queries . CoRR, abs/2310.08419

    2023 doi arXiv

  96. [146]

    Zhaorun Chen, Zhuokai Zhao, Wenjie Qu, Zichen Wen, Zhiguang Han, Zhihong Zhu, Jiaheng Zhang, and Huaxiu Yao. 2024. https://openreview.net/forum?id=9o06ugFxIj PANDORA : Detailed LLM jailbreaking via collaborated phishing agents with decomposed reasoning . In ICLR 2024 Workshop ...

    2024

  97. [147]

    Daixuan Cheng, Shaohan Huang, Xuekai Zhu, Bo Dai, Wayne Xin Zhao, Zhenliang Zhang, and Furu Wei. 2025. Reasoning with exploration: An entropy perspective. arXiv preprint arXiv:2506.14758

    2025 arXiv

  98. [148]

    Tianzhe Chu, Yuexiang Zhai, Jihan Yang, Shengbang Tong, Saining Xie, Dale Schuurmans, Quoc V Le, Sergey Levine, and Yi Ma. 2025. Sft memorizes, rl generalizes: A comparative study of foundation model post-training. arXiv preprint arXiv:2501.17161

    2025 arXiv

  99. [149]

    Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2024. Or-bench: An over-refusal benchmark for large language models. arXiv preprint arXiv:2405.20947

    2024 arXiv

  100. [150]

    Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. 2023. https://doi.org/10.48550/ARXIV.2311.08268 A wolf in sheep's clothing: Generalized nested jailbreak prompts can fool large language models easily . CoRR, abs/2311.08268

    2023 doi arXiv

  101. [151]

    Zhichen Dong, Zhanhui Zhou, Chao Yang, Jing Shao, and Yu Qiao. 2024. https://doi.org/10.18653/V1/2024.NAACL-LONG.375 Attacks, defenses and evaluations for LLM conversation safety: A survey . In Proceedings of the 2024 Conference of the North American Chapter of the Association...

    2024 doi

  102. [152]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    2024 arXiv

  103. [153]

    Hashimoto

    Yann Dubois, Chen Xuechen Li, Rohan Taori, Tianyi Zhang, Ishaan Gulrajani, Jimmy Ba, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. http://papers.nips.cc/paper\_files/paper/2023/hash/5fc47800ee5b30b8777fdd30abcaaf3b-Abstract-Conference.html Alpacafarm: A simul...

    2023

  104. [154]

    Jonathan St BT Evans. 2003. In two minds: dual-process accounts of reasoning. Trends in cognitive sciences, 7(10):454--459

    2003

  105. [155]

    Melody Y Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Heylar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, et al. 2024. Deliberative alignment: Reasoning enables safer language models. arXiv preprint arXiv:2412.16339

    2024 arXiv

  106. [157]

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025 b . Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948

    2025 arXiv

  107. [158]

    Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al. 2024. Openai o1 system card. arXiv preprint arXiv:2412.16720

    2024 arXiv

  108. [159]

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. https://arxiv.org/abs/2309.00614 Baseline defenses for adversarial attacks against aligned language models ....

    2023 arXiv

  109. [160]

    Fengqing Jiang, Zhangchen Xu, Yuetai Li, Luyao Niu, Zhen Xiang, Bo Li, Bill Yuchen Lin, and Radha Poovendran. 2025. https://openreview.net/forum?id=pytJdAOA0X Safechain: Safety of language models with long chain-of-thought reasoning capabilities . In ICLR 2025 Workshop on Bidi...

    2025

  110. [161]

    Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. 2024. https://doi.org/10.18653/V1/2024.ACL-LONG.809 Artprompt: ASCII art-based jailbreak attacks against aligned llms . In Proceedings of the 62nd Annual Meeting of the A...

    2024 doi

  111. [162]

    Mintong Kang and Bo Li. 2025. https://openreview.net/forum?id=CkgKSqZbuC R ^2 -guard: Robust reasoning enabled LLM guardrail via knowledge-enhanced logical reasoning . In The Thirteenth International Conference on Learning Representations

    2025

  112. [163]

    Xirui Li, Ruochen Wang, Minhao Cheng, Tianyi Zhou, and Cho - Jui Hsieh. 2024. https://doi.org/10.48550/ARXIV.2402.16914 Drattack: Prompt decomposition and reconstruction makes powerful LLM jailbreakers . CoRR, abs/2402.16914

    2024 doi arXiv

  113. [164]

    Shi Lin, Hongming Yang, Rongchang Li, Xun Wang, Changting Lin, Wenpeng Xing, and Meng Han. 2024. Llms can be dangerous reasoners: Analyzing-based jailbreak attack on large language models. arXiv preprint arXiv:2407.16205

    2024 arXiv

  114. [165]

    Tong Liu, Yingjie Zhang, Zhe Zhao, Yinpeng Dong, Guozhu Meng, and Kai Chen. 2024 a . https://www.usenix.org/conference/usenixsecurity24/presentation/liu-tong Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction . In 33rd...

    2024

  115. [166]

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024 b . https://openreview.net/forum?id=7Jwpw4qKkb Auto DAN : Generating stealthy jailbreak prompts on aligned large language models . In The Twelfth International Conference on Learning Representations

    2024

  116. [167]

    Yue Liu, Hongcheng Gao, Shengfang Zhai, Jun Xia, Tianyi Wu, Zhiwei Xue, Yulin Chen, Kenji Kawaguchi, Jiaheng Zhang, and Bryan Hooi. 2025. Guardreasoner: Towards reasoning-based llm safeguards. arXiv preprint arXiv:2501.18492

    2025

  117. [168]

    Yue Liu, Xiaoxin He, Miao Xiong, Jinlan Fu, Shumin Deng, and Bryan Hooi. 2024 c . Flipattack: Jailbreak llms via flipping. arXiv preprint arXiv:2410.02832

    2024 arXiv

  118. [169]

    Huijie Lv, Xiao Wang, Yuansen Zhang, Caishuang Huang, Shihan Dou, Junjie Ye, Tao Gui, Qi Zhang, and Xuanjing Huang. 2024. Codechameleon: Personalized encryption framework for jailbreaking large language models. arXiv preprint arXiv:2402.16717

    2024 arXiv

  119. [170]

    Skywork o1 Team. 2024. https://huggingface.co/Skywork Skywork-o1 open series . https://huggingface.co/Skywork

    2024

  120. [171]

    Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2025. Safety alignment should be made more than just a few tokens deep. In The Thirteenth International Conference on Learning Representations

    2025

  121. [172]

    Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin - Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. https://doi.org/10.48550/ARXIV.2310.03693 Fine-tuning aligned language models compromises safety, even when users do not intend to! CoRR, abs/2310.03693

    2023 doi arXiv

  122. [173]

    Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, et al. 2025. Qwen2.5 technical report. arXiv preprint arXiv:2412.15115

    2025 arXiv

  123. [174]

    Venkat K. Raman. 1997. https://doi.org/10.1021/CI9703922 Atomic and ion collisions in solids and at surfaces. theory, simulation, and applications. roger smith, mario jakas, dave ashworth, bob oven, mark bowyer, ivan chakarov, and roger webb. cambridge university press, 309 pp...

    1997 doi

  124. [175]

    Qibing Ren, Chang Gao, Jing Shao, Junchi Yan, Xin Tan, Wai Lam, and Lizhuang Ma. 2024. https://doi.org/10.18653/V1/2024.FINDINGS-ACL.679 Codeattack: Revealing safety generalization challenges of large language models via code completion . In Findings of the Association for Com...

    2024 doi

  125. [176]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. https://doi.org/10.1145/3658644.3670388 "do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models . In Proceedings of the 2024 on ACM SIGSAC Conference on Co...

    2024

  126. [177]

    Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. 2023. Stanford alpaca: an instruction-following llama model (2023)

    2023

  127. [178]

    Qwen Team. 2024. https://qwenlm.github.io/blog/qwq-32b-preview/ Qwq: Reflect deeply on the boundaries of the unknown

    2024

  128. [179]

    Xunguang Wang, Wenxuan Wang, Zhenlan Ji, Zongjie Li, Pingchuan Ma, Daoyuan Wu, and Shuai Wang. 2025. https://doi.org/10.48550/ARXIV.2503.17932 Stshield: Single-token sentinel for real-time jailbreak detection in large language models . CoRR, abs/2503.17932

    2025 doi arXiv

  129. [180]

    Chi, Quoc V Le, and Denny Zhou

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, brian ichter, Fei Xia, Ed H. Chi, Quoc V Le, and Denny Zhou. 2022. https://openreview.net/forum?id=_VjQlMeSB_J Chain of thought prompting elicits reasoning in large language models . In Advances in Neural Information Proc...

    2022

  130. [181]

    Tianyu Wu, Lingrui Mei, Ruibin Yuan, Lujun Li, Wei Xue, and Yike Guo. 2024. You know what i'm saying: Jailbreak attack via implicit reference. arXiv preprint arXiv:2410.03857

    2024 arXiv

  131. [182]

    Zihui Wu, Haichang Gao, Jianping He, and Ping Wang. 2025. https://aclanthology.org/2025.coling-main.39/ The dark side of function calling: Pathways to jailbreaking large language models . In Proceedings of the 31st International Conference on Computational Linguistics, COLING ...

    2025

  132. [183]

    Shijie Xia, Yiwei Qin, Xuefeng Li, Yan Ma, Run-Ze Fan, Steffi Chern, Haoyang Zou, Fan Zhou, Xiangkun Hu, Jiahe Jin, et al. 2025. Generative ai act ii: Test time scaling drives cognition engineering. arXiv preprint arXiv:2504.13828

    2025 arXiv

  133. [184]

    Zeguan Xiao, Yan Yang, Guanhua Chen, and Yun Chen. 2024. Distract large language models for automatic jailbreak attack. arXiv preprint arXiv:2403.08424

    2024 arXiv

  134. [185]

    Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. 2023 a . https://doi.org/10.1038/S42256-023-00765-8 Defending chatgpt against jailbreak attack via self-reminders . Nat. Mac. Intell., 5(12):1486--1496

    2023 doi

  135. [186]

    Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. 2023 b . https://www.nature.com/articles/s42256-023-00765-8/ Defending chatgpt against jailbreak attack via self-reminders . Nature Machine Intelligence, 5(12):1486--1496

    2023

  136. [187]

    Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. arXiv preprint arXiv:2402.08983

    2024 arXiv

  137. [188]

    Yan Yang, Zeguan Xiao, Xin Lu, Hongru Wang, Xuetao Wei, Hailiang Huang, Guanhua Chen, and Yun Chen. 2025. https://doi.org/10.18653/V1/2025.NAACL-LONG.42 Seqar: Jailbreak llms with sequential auto-generated characters . In Proceedings of the 2025 Conference of the Nations of th...

    2025 doi

  138. [189]

    Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. https://doi.org/10.48550/ARXIV.2309.10253 GPTFUZZER: red teaming large language models with auto-generated jailbreak prompts . CoRR, abs/2309.10253

    2023 doi arXiv

  139. [190]

    Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen - tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2024. https://openreview.net/forum?id=MbfAK4s61A GPT-4 is too smart to be safe: Stealthy chat with llms via cipher . In The Twelfth International Conference on Learning Repres...

    2024

  140. [191]

    Di Zhang, Xiaoshui Huang, Dongzhan Zhou, Yuqiang Li, and Wanli Ouyang. 2024 a . Accessing gpt-4 level mathematical olympiad solutions via monte carlo tree self-refine with llama-3 8b. arXiv preprint arXiv:2406.07394

    2024 arXiv

  141. [192]

    Yichi Zhang, Siyuan Zhang, Yao Huang, Zeyu Xia, Zhengwei Fang, Xiao Yang, Ranjie Duan, Dong Yan, Yinpeng Dong, and Jun Zhu. 2025 a . Stair: Improving safety alignment with introspective reasoning. arXiv preprint arXiv:2502.02384

    2025 arXiv

  142. [193]

    Yingjie Zhang, Tong Liu, Zhe Zhao, Guozhu Meng, and Kai Chen. 2025 b . Align in depth: Defending jailbreak attacks via progressive answer detoxification. arXiv preprint arXiv:2503.11185

    2025

  143. [194]

    Yuqi Zhang, Liang Ding, Lefei Zhang, and Dacheng Tao. 2024 b . Intention analysis prompting makes large language models a good jailbreak defender. arXiv preprint arXiv:2401.06561

    2024 arXiv

  144. [195]

    Yuqi Zhang, Liang Ding, Lefei Zhang, and Dacheng Tao. 2025 c . https://aclanthology.org/2025.coling-main.199/ Intention analysis makes LLM s a good jailbreak defender . In Proceedings of the 31st International Conference on Computational Linguistics, pages 2947--2968, Abu Dhab...

    2025

  145. [196]

    Xuandong Zhao, Xianjun Yang, Tianyu Pang, Chao Du, Lei Li, Yu-Xiang Wang, and William Yang Wang. 2024. Weak-to-strong jailbreaking on large language models. arXiv preprint arXiv:2401.17256

    2024 arXiv

  146. [197]

    Chujie Zheng, Fan Yin, Hao Zhou, Fandong Meng, Jie Zhou, Kai-Wei Chang, Minlie Huang, and Nanyun Peng. 2024. Prompt-driven llm safeguarding via directed representation optimization. arXiv preprint arXiv:2401.18018

    2024 arXiv

  147. [198]

    Jingnan Zheng, Xiangtian Ji, Yijun Lu, Chenhang Cui, Weixiang Zhao, Gelei Deng, Zhenkai Liang, An Zhang, and Tat-Seng Chua. 2025. Rsafe: Incentivizing proactive reasoning to build robust and adaptive llm safeguards. arXiv preprint arXiv:2506.07736

    2025

  148. [199]

    Andy Zhou, Bo Li, and Haohan Wang. 2024. Robust prompt optimization for defending language models against jailbreaking attacks. arXiv preprint arXiv:2401.17263

    2024 arXiv

  149. [200]

    Junda Zhu, Lingyong Yan, Shuaiqiang Wang, Dawei Yin, and Lei Sha. 2025. Reasoning-to-defend: Safety-aware reasoning can defend large language models from jailbreaking. arXiv preprint arXiv:2502.12970

    2025

  150. [201]

    Wenhao Zhu, Hongyi Liu, Qingxiu Dong, Jingjing Xu, Shujian Huang, Lingpeng Kong, Jiajun Chen, and Lei Li. 2024. https://doi.org/10.18653/V1/2024.FINDINGS-NAACL.176 Multilingual machine translation with large language models: Empirical results and analysis . In Findings of the ...

    2024 doi

  151. [202]

    Qingsong Zou, Jingyu Xiao, Qing Li, Zhi Yan, Yuhang Wang, Li Xu, Wenxuan Wang, Kuofeng Gao, Ruoyu Li, and Yong Jiang. 2025. Queryattack: Jailbreaking aligned large language models using structured non-natural query language. arXiv preprint arXiv:2502.09723

    2025 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.