Pith. sign in

REVIEW 3 major objections 5 minor 42 references

CCFC: Core & Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A two-track defense that strips queries to their semantic core and double-checks both answers cuts jailbreak success rates to near zero while preserving response quality.

desk verdict An interesting but under-specified prompt-level defense whose near-zero attack success rates are not attributable to the proposed mechanism until the hidden safety classifier S is disclosed and ablated. read the letter →

arxiv 2508.14128 v1 pith:WJ7SSW46 submitted 2025-08-19 cs.CR cs.AI

Jiaming Hu , Haoyu Wang , Debarghya Mukherjee , Ioannis Ch. Paschalidis This is my paper · ORCID
classification cs.CRcs.AI
keywords LLMjailbreakdefenseprompt-levelcoreextractiondual-trackarchitecturesafetyconsistencycheckfew-shotpromptingadversarialsuffixattacksroleplay
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CCFC is a prompt-level defense that tries to make large language models refuse harmful requests by transforming the input rather than retraining the model. It first extracts the semantic core of each user query using a small set of demonstration examples, then runs the query through two parallel tracks: the core alone, and the core wrapped around the full original prompt. A two-stage check rejects the output if either track refuses or produces harmful content, and otherwise keeps the richer core-full-core answer. The paper reports that on Vicuna and Llama 2 this reduces attack success rates by 50–75% compared with state-of-the-art prompt-level defenses, bringing GCG, AutoDAN, PAIR, and DeepInception to 0–6% while keeping Just-Eval quality scores close to the undefended baseline. The claim is that semantic distillation plus structural disruption plus consensus checking is enough to block both gradient-suffix and roleplay jailbreaks without white-box access or fine-tuning.

What carries the argument

The load-bearing mechanism is the dual-track prompt construction together with the double safety check. A few-shot prompt, built from adversarial-to-benign demonstration pairs, distills the user's full prompt $P$ into a core question $Q_c$; that extraction runs on the target model itself. Track A queries $M(Q_c)$, and Track B queries $M([Q_c \parallel P \parallel Q_c])$, sandwiching the full prompt between two copies of the core to break structural attack patterns while preserving context. The selection rule in Eq. (5) then refuses if either track's response contains an explicit refusal, refuses if a binary safety classifier $S$ labels either response unsafe, and otherwise returns the Track B answer. The core track is the fallback against obfuscation, the core-full-core track is the fidelity-preserving structural disruptor, and the double check is what makes the conservative choice safe.

What would settle it

Re-run CCFC against the same four attacks with the internal safety classifier replaced by an independent judge whose labels are never used to compute attack success, and add an adaptive attacker who has access to the core-extraction prompt; if attack success stays near zero, the dual-track mechanism is responsible, and if it rises toward the undefended baseline, the reported gains came from the classifier or from non-adaptive attack templates.

Watch

Extended reading notes

Core claim

The central discovery, on the paper's own terms, is that a jailbreak succeeds only when an adversarial wrapper can hide a prohibited instruction inside a context the model is willing to follow, and CCFC attacks that condition from two complementary directions. The core track answers only the extracted question $Q_c$, so adversarial suffixes, roleplay frames, and injected instructions are simply gone. The core-full-core track answers $[Q_c \parallel P \parallel Q_c]$, which keeps the original context for fidelity while sandwiching it between two copies of the distilled intent, a pattern the paper says disrupts structure-dependent attacks such as gradient-optimized suffixes. The final answer is selected by refusal detection followed by a harmful-content check on both responses, and only when both are safe is the full-context answer returned. In the reported experiments this brings GCG, AutoDAN, PAIR, and DeepInception to 0–6% attack success on Vicuna and to 0–2% on Llama 2, with Just-Eval averages within a few hundredths of the undefended models.

Load-bearing premise

The result rests on an unspecified automated safety check that labels each track's answer safe or unsafe; if that check is the same keyword-based judge used to measure attack success, the near-zero attack rates could be circular rather than caused by the dual-track structure.

Editorial extensions

If this is right

  • If CCFC works as reported, prompt-level defenses can reach near-zero jailbreak success without gradient access, fine-tuning, or an external safety model, which matters for closed-source APIs.
  • The same two-forward-pass structure would give any instruction-following LLM a drop-in safety layer: extract the core, answer twice, compare, and reject if either side refuses.
  • Because the full prompt is preserved in the CFC track, benign queries should keep their original informativeness, so the defense does not force a trade-off between safety and helpfulness.
  • The reported robustness across four very different attack families suggests core distillation targets a common vulnerability—the wrapper that hides the intent—rather than each attack's specific surface pattern.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not specify the binary safety classifier $S$ used in Eq. (5); we infer that the reported near-zero attack-success rates are only interpretable if $S$ is chosen independently of the keyword-based judge used to measure attack success.
  • We infer that an adaptive attacker who knows the core-extraction prompt and can obfuscate the distilled core itself is the natural next stress test; the current experiments use fixed attack templates rather than attacks designed against CCFC.
  • The consistency-check logic generalizes to more than two tracks, so a natural extension is to specialize each track to one attack family such as roleplay, injection, or suffix; the paper lists this direction as future work, and our inference is that the double-check would still decide among any number of parallel answers.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces CCFC, a prompt-level defense for LLM jailbreak attacks. The method first extracts a "core question" from the user prompt using few-shot prompting, then runs two parallel tracks: a core-only track (C) and a core-full-core track (CFC) that concatenates core, full prompt, and core again. A double safety check (refusal detection plus a binary harmful-content classifier S) decides the final output, refusing if either track refuses or is flagged unsafe, and otherwise returning the CFC response. The authors evaluate on Vicuna-7B and LLaMA2-7B-chat against GCG, AutoDAN, PAIR, DeepInception, and AdvBench, reporting near-zero attack success rates and claiming 50-75% ASR reduction over state-of-the-art defenses while preserving benign utility as measured by Just-Eval.

Significance. If the dual-track mechanism itself were responsible for the reported robustness, CCFC would be a practically attractive, model-agnostic, prompt-level defense with low overhead. The paper's core claim, however, is not established in the current manuscript: the harmful-content classifier S in Eq. (5) is never specified, no ablation isolates the contribution of the dual-track logic from the contribution of S, and the headline numbers are inconsistent between the main text and Table 1. These are load-bearing issues because the reported near-zero ASR could be entirely attributable to an undisclosed safety filter rather than to the proposed architecture. The utility results are useful but secondary; without a credible causal attribution, the paper's central contribution is unverified.

major comments (3)
  1. [Section 4, Eq. (5)] The binary safety classifier S that implements the second stage of the double safety check is never specified. The paper does not state what model or algorithm S is, how it is trained, what features it uses, or how the fields core_harmful and aug_harmful in the Appendix examples (Tables 3 and 4) are computed. Because Eq. (5) lets S unilaterally force a refusal if either track's output is labeled unsafe, the reported 0-6% ASR in Table 1 could in principle be produced by S alone, with the dual-track architecture contributing nothing. The authors must disclose the exact implementation of S and, critically, provide an ablation in which S is removed (or fixed to 'safe') so that the reader can see what the dual-track logic alone achieves.
  2. [Section 5, Evaluation Metrics; Section 4, Eq. (5)] There is a potential circularity between the defense and the evaluation. ASR is computed with Dic-Judge, a keyword-based refusal detector that classifies an output as safe if it contains refusal phrases such as 'Sorry, I cannot...'. The defense's own decision rule (Eq. 5) triggers on refusal-like patterns RD and, in the Appendix examples, the final output is the literal string 'Sorry, I cannot answer that question.' If S uses the same or overlapping keyword logic as Dic-Judge, then the defense is effectively applying the evaluation metric to its own outputs, making the near-zero ASR partly circular by construction. The authors should disclose whether S shares vocabulary or rules with Dic-Judge and re-evaluate with an independent judge (e.g., Llama Guard, GPT-4-based judge, or human annotation).
  3. [Section 5, Experimental Results; Table 1] The main text and Table 1 disagree on the Vicuna results. The text states that CCFC achieves 2% ASR for GCG and 4% for both AutoDAN and PAIR, whereas Table 1 reports 6% for GCG, 0% for AutoDAN, and 2% for PAIR. This discrepancy undermines confidence in the reported numbers. In addition, the abstract's claim of 'cuts attack success rates by 50-75% versus state-of-the-art defenses' is not clearly supported by Table 1: for example, on Vicuna PAIR, CCFC (2%) does not improve over DATDP (2%), and on Llama2 PAIR, CCFC (2%) is worse than DATDP (0%). The authors should fix the inconsistency and specify exactly which baseline-attack pairs the 50-75% figure refers to.
minor comments (5)
  1. [Section 4, Eq. (2)] The few-shot demonstration set D_examples is a key component but is not described in the main text besides two examples in the Appendix. The number of demonstrations, their selection, and their diversity should be documented, and ideally a sensitivity analysis should be provided.
  2. [Section 5, Table 2] Just-Eval scores are reported as averages without variance, confidence intervals, or significance tests. With 500 instructions, the differences between CCFC and the undefended baseline (e.g., Vicuna average 4.353 vs. 4.339) are likely within noise; the authors should report standard deviations or statistical tests.
  3. [Appendix 8] The appendix is titled 'Detailed configurations' but only contains two defense examples. It does not provide the configurations for the attack baselines (GCG, AutoDAN, PAIR, DeepInception), the defense baselines, or the unspecified classifier S. These should be added or referenced to a public repository.
  4. [Section 4, Eq. (5)] The notation 'S(R_C) or S(R_CFC) = 0' is ambiguous because it mixes a logical 'or' over binary outputs with a numeric equality. Rewrite to make clear that a refusal is triggered if S(R_C)=0 or S(R_CFC)=0.
  5. [Section 1, Abstract] The abstract and introduction claim CCFC 'cuts attack success rates by 50-75%' but no precise derivation of this figure is given in the experimental section. Please specify the comparison baseline and the subset of attacks for which this holds.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the CCFC pipeline is self-contained and no reported result reduces to its inputs by construction; the undisclosed safety classifier S is a reproducibility gap, not demonstrated circularity.

full rationale

CCFC's derivation chain (Eqs. 2-5) is self-contained: the core is extracted from the prompt, two responses are generated from the target model, and Eq. (5) selects an output using refusal detection and a safety classifier. No parameter is fitted to the evaluation data and no reported number is a renamed fit. The only self-citation is Masterkey (Deng et al., 2023), a background reference co-authored by Haoyu Wang; it is not load-bearing. The strongest potential circularity concern is that Eq. (5)'s RD/S checks and the Dic-Judge ASR metric both key on refusal phrases, so a refused output is counted as safe. The paper never states that S uses Dic-Judge, and evaluating a refusal-based defense with a refusal-detection judge is standard practice; without evidence that S is the judge, this is not an established reduction. The missing specification of S and the absence of an ablation with S removed are experimental-support gaps, and the Vicuna numbers in the text (2/4/4) disagree with Table 1 (6/0/2), but these are correctness concerns, not circularity.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim rests on three load-bearing assumptions: that few-shot core extraction works as intended, that an unspecified safety classifier S can reliably judge output harmfulness, and that static attack benchmarks represent the threat model. The free parameters are all hand-chosen design elements (demonstration set, refusal patterns, classifier S) whose values are not documented. No new physical or theoretical entities are introduced.

free parameters (3)
  • Few-shot core-extraction demonstration set
    The curated D_examples in Eq. (2) is hand-picked and only partially shown in Appendix A (ending with '...'). The choice of examples directly determines extraction behavior and therefore the defense's performance.
  • Refusal-detection patterns
    RD(·) in Eq. (5) is described as detecting phrases like 'I'm sorry...' or 'I cannot provide...', but the exact pattern list is not given. These hand-chosen patterns affect the refusal branch of the selection logic.
  • Harmful-content classifier S
    The binary safety classifier S in Eq. (5) is unspecified in implementation. It is the component most responsible for the final refusal decision when neither track explicitly refuses, and its thresholds or model are not disclosed.
assumptions (3)
  • domain assumption Few-shot prompting can extract the semantic core of a query, including from adversarial prompts, without corrupting benign queries.
    Section 4, Eq. (2) and Appendix A. The paper's own Limitations paragraph concedes that extraction 'may struggle with highly sophisticated attacks that seamlessly integrate malicious intent within semantically coherent contexts.'
  • domain assumption A reliable binary safety classifier S exists and can label model outputs as safe or unsafe.
    Section 4, Eq. (5). S is introduced without specification, and the paper's results depend on its accuracy and on how it is calibrated against the evaluation metric.
  • domain assumption The evaluation attack prompts are representative, and attackers do not adapt to the CCFC defense.
    Section 5. All attacks are static off-the-shelf prompts (GCG, AutoDAN, PAIR, DeepInception); no adaptive attack aware of CCFC is considered, so robustness under an aware adversary is untested.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CCFC: Core & Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection." pith.science (2026). https://pith.science/paper/WJ7SSW46

@misc{pith2026250814128,
  author       = {Pith},
  title        = {Pith review of: CCFC: Core & Core-Full-Core Dual-Track Defense for LLM Jailbreak Protection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WJ7SSW46}},
  note         = {Machine review of arXiv:2508.14128}
}
read the original abstract

Jailbreak attacks pose a serious challenge to the safe deployment of large language models (LLMs). We introduce CCFC (Core & Core-Full-Core), a dual-track, prompt-level defense framework designed to mitigate LLMs' vulnerabilities from prompt injection and structure-aware jailbreak attacks. CCFC operates by first isolating the semantic core of a user query via few-shot prompting, and then evaluating the query using two complementary tracks: a core-only track to ignore adversarial distractions (e.g., toxic suffixes or prefix injections), and a core-full-core (CFC) track to disrupt the structural patterns exploited by gradient-based or edit-based attacks. The final response is selected based on a safety consistency check across both tracks, ensuring robustness without compromising on response quality. We demonstrate that CCFC cuts attack success rates by 50-75% versus state-of-the-art defenses against strong adversaries (e.g., DeepInception, GCG), without sacrificing fidelity on benign queries. Our method consistently outperforms state-of-the-art prompt-level defenses, offering a practical and effective solution for safer LLM deployment.

Figures

Figures reproduced from arXiv: 2508.14128 by the authors.

Figure 1
Figure 1. This figure illustrates the operational workflow of CCFC . Initially, few-shot core extraction distills the [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 6 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Stuart Armstrong, Matija Franklin, Connor Stevens, and Rebecca Gorman. 2025. Defense against the dark prompts: Mitigating best-of-n jailbreaking with prompt evaluation. arXiv preprint arXiv:2502.00580

    arXiv 2025

  4. [4]

    Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, and 1 others. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862

    arXiv 2022

  5. [5]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877--1901

    2020

  6. [6]

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2025. Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23--42. IEEE

    work page 2025

  7. [7]

    Wei-Lin Chiang, Zhuohan Li, Ziqing Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, and 1 others. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90\ See https://vicuna. lmsys. org (accessed 14 April 2023), 2(3):6

    2023

  8. [8]

    Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Masterkey: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715

    arXiv 2023

Show all 42 references
  1. [9]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human...

    2019

  2. [10]

    Yu Fu, Erfan Shayegan, Md Mamun Al Abdullah, Pedram Zaree, Nael Abu-Ghazaleh, and Yue Dong. 2024. Vulnerabilities of large language models to adversarial attacks. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 5: Tutorial Abs...

    2024

  3. [11]

    Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho. 2024. Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes. Advances in Neural Information Processing Systems, 37:126265--126296

    2024

  4. [12]

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and 1 others. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674

    2023 arXiv

  5. [13]

    Juyong Jiang, Fan Wang, Jiasi Shen, Sungju Kim, and Sunghun Kim. 2024. A survey on large language models for code generation. arXiv preprint arXiv:2406.00515

    2024 arXiv

  6. [14]

    Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Aaron Jiaxun Li, Soheil Feizi, and Himabindu Lakkaraju. 2023. Certifying llm safety against adversarial prompting. arXiv preprint arXiv:2309.02705

    2023 arXiv

  7. [15]

    Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2023. Deepinception: Hypnotize large language model to be jailbreaker. arXiv preprint arXiv:2311.03191

    2023 arXiv

  8. [16]

    Stephanie Lin, Jacob Hilton, and Owain Evans. 2021. Truthfulqa: Measuring how models mimic human falsehoods. arXiv preprint arXiv:2109.07958

    2021 arXiv

  9. [17]

    Fenglin Liu, Hongjian Zhou, Boyang Gu, Xinyu Zou, Jinfa Huang, Jinge Wu, Yiru Li, Sam S Chen, Yining Hua, Peilin Zhou, and 1 others. 2025. Application of large language models in medicine. Nature Reviews Bioengineering, pages 1--20

    2025

  10. [18]

    Xiaodong Liu, Hao Cheng, Pengcheng He, Weizhu Chen, Yu Wang, Hoifung Poon, and Jianfeng Gao. 2020. Adversarial training for large neural language models. arXiv preprint arXiv:2004.08994

    2020 arXiv

  11. [19]

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023 a . Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451

    2023 arXiv

  12. [20]

    Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2023 b . Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305.13860

    2023 arXiv

  13. [21]

    Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. Tree of attacks: Jailbreaking black-box llms automatically. Advances in Neural Information Processing Systems, 37:61065--61105

    2024

  14. [22]

    Takeru Miyato, Andrew M Dai, and Ian Goodfellow. 2016. Adversarial training methods for semi-supervised text classification. arXiv preprint arXiv:1605.07725

    2016 arXiv

  15. [23]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022 a . Training language models to follow instructions with human feedback. Advances in neural information processing ...

    2022

  16. [24]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022 b . Training language models to follow instructions with human feedback. Advances in neural information processing ...

    2022

  17. [25]

    Mansi Phute, Alec Helbling, Matthew Hull, ShengYun Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chau. 2023. Llm self defense: By self examination, llms know they are being tricked. arXiv preprint arXiv:2308.07308

    2023 arXiv

  18. [26]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, and 1 others. 2021. Learning transferable visual models from natural language supervision. In International conference on machine...

    2021

  19. [27]

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, and 1 others. 2019. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9

    2019

  20. [28]

    Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684

    2023 arXiv

  21. [29]

    Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. 2019. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108

    2019 arXiv

  22. [30]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, page...

    2024

  23. [31]

    Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, and 1 others. 2023. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805

    2023 arXiv

  24. [32]

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, and 1 others. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971

    2023 arXiv

  25. [33]

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems, 30

    2017

  26. [34]

    Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. 2023. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387

    2023 arXiv

  27. [35]

    Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, and 1 others. 2021. Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359

    2021 arXiv

  28. [36]

    Yueqi Xie, Minghong Fang, Renjie Pi, and Neil Gong. 2024. Gradsafe: Detecting jailbreak prompts for llms via safety-critical gradient analysis. arXiv preprint arXiv:2402.13494

    2024 arXiv

  29. [37]

    Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. 2023. Defending chatgpt against jailbreak attack via self-reminders. Nature Machine Intelligence, 5(12):1486--1496

    2023

  30. [38]

    Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. arXiv preprint arXiv:2402.08983

    2024 arXiv

  31. [39]

    Xuandong Zhao, Xianjun Yang, Tianyu Pang, Chao Du, Lei Li, Yu-Xiang Wang, and William Yang Wang. 2024. Weak-to-strong jailbreaking on large language models. arXiv preprint arXiv:2401.17256

    2024 arXiv

  32. [40]

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, and 1 others. 2023. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in neural information processing systems, 36:46595--46623

    2023

  33. [41]

    Andy Zhou, Bo Li, and Haohan Wang. 2024. Robust prompt optimization for defending language models against jailbreaking attacks. Advances in Neural Information Processing Systems, 37:40184--40211

    2024

  34. [42]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.