Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

NonTextual Target Attack

T0 review · 4 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that maximizing a judge model's unsafety score, with no fixed response target, outperforms targeted gradient jailbreak attacks within tight iteration budgets.

desk verdict Genuinely novel two-stage jailbreak attack, but the posted numbers don't match across sections and the headline ASR-G metric is partially circular — worth reviewing, not worth citing yet. read the letter →

arxiv 2510.02999 v5 pith:PJCI3UBB submitted 2025-10-03 cs.CR cs.AI

Xinzhe Huang , Wenjing Hu , Tianhang Zheng , Kedong Xiu , Hongsheng Hu , Xiaojun Jia , Di Wang , Zhan Qin
show 1 more author
Kui Ren
This is my paper
classification cs.CRcs.AI
keywords jailbreakattackuntargetedoptimizationlargelanguagemodelsgradient-basedpromptjudgemodeladversarialrobustnesstokenizerprojectionsafetyalignment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that automated jailbreak attacks on large language models have been handicapping themselves. Existing gradient-based attacks optimize prompts so the model starts with a fixed phrase such as 'Sure, here is...'; the paper argues this rigid target shrinks the set of prompts the optimizer can find and slows convergence. It replaces that objective with an untargeted one: maximize the probability, according to a separate judge model, that the model's response is unsafe, without specifying what the response should say. Because that objective is non-differentiable, the paper splits it into two differentiable sub-objectives — first generate an optimally unsafe response in the judge's embedding space, then optimize the prompt to reproduce that response in the target model's logits. Across six open-weight LLMs with only 100 optimization steps, it reports clearly higher attack success rates than the targeted baselines, faster early convergence, and prompts that transfer better to larger models. The reason to care: if the claim holds, standard red-team benchmarks have been underestimating how quickly aligned models can be jailbroken.

What carries the argument

The load-bearing mechanism is a two-stage gradient pipeline that crosses tokenizer boundaries. In Stage 1, an adversarial response is optimized inside the judge model's embedding space by minimizing cross-entropy against the Unsafe label, with a cosine-similarity term that keeps the response semantically close to the model's actual output. In Stage 2, the resulting gradient is projected into the target LLM's token space through a binary matrix W: each token in the judge's vocabulary is retokenized under the target model, and the gradient is spread onto the sub-tokens. The prompt is then updated by minimizing the mean-squared error between the target model's pre-softmax scores for its current

What would settle it

Run the same pipeline with the judge's Unsafe label replaced by a random or inverted label; if attack success stays high, the judge signal is not doing the work. Or have human annotators score the paper's Figure 9 output — step-by-step insider-trading instructions wrapped in 'this is illegal, for educational purposes only' — and count how many are judged genuinely harmful; if most are rated safe, the judge, not the model, is what is being jailbroken.

Watch

Extended reading notes

Core claim

The central claim is that the jailbreak objective should be max_p J(L(p)), where L is the target LLM and J is a judge model returning the probability that a response is unsafe, with no constraint on the response's wording. Because this objective is non-differentiable in discrete text, the paper decomposes it into two sub-problems: first maximize J(r) over possible responses to obtain an optimal unsafe response r*, and then minimize the squared difference between the target model's logits for its actual output and its logits for r*, so that the optimized prompt elicits r*. The paper argues this expands the adversarial search space relative to fixed-prefix attacks, which is why it reports high

Load-bearing premise

The attack assumes that a gradient computed in the judge model's embedding space, projected linearly through a token-mapping matrix and converted into a prompt update, still points the target model toward genuinely unsafe responses.

Editorial extensions

If this is right

  • If right, fixed-prefix jailbreak attacks substantially understate the vulnerability of safety-aligned LLMs.
  • Red-team evaluations can use untargeted objectives to find unsafe behaviors with far fewer optimization steps.
  • The judge model used to score harmfulness becomes a direct optimization target, so the judge's own robustness matters for measured security.
  • The same cross-tokenizer gradient projection could be reused to transfer other classifier-guided objectives between models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own figures show responses full of safety disclaimers being labeled 'Unsafe' by the judge; if the judge is that easy to fool, part of the reported success may be gaming the scorer rather than eliciting genuinely harmful output.
  • The abstract reports 96.8% average success while the body reports 71.9%; that gap needs resolving before the main quantitative claim can be taken at face value.
  • The untargeted formulation points to a general recipe: any differentiable judge of any output property could replace the harmfulness judge, turning this into a general search method.
  • Testing the attack with a judge that scores actionable harmfulness rather than surface topic would separate genuine vulnerabilities from scorer artifacts.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper (arXiv:2510.02999, presented under two names: “NonTextual Target Attack” and “Untargeted Jailbreak Attack”) proposes a gradient-based jailbreak attack that maximizes the probability, assigned by a judge model, that the target LLM's response is unsafe, without fixing any target response text. The untargeted objective is decomposed into two sub-objectives: first finding an optimal unsafe response r* by optimizing in the judge model's embedding space (Eq. 6), and then finding a prompt p* whose response logits align with r* (Eqs. 5, 12–13). Gradient information is transferred from the judge token space to the target LLM token space via a binary retokenization projection matrix W (Eq. 10). The paper reports high success rates within 100 iterations on six white-box LLMs and some transfer to Llama-3-70B and DeepSeek-R1, plus robustness to three defenses.

Significance. If the central claim held, the paper would make a useful contribution: it would broaden the optimization space of white-box jailbreak attacks and improve budget efficiency, and the release of code would aid reproducibility. The use of a second, independent harmfulness classifier (HarmBench) is a positive feature. However, the paper's headline numbers are internally inconsistent, the main reported metric is the same function being optimized, the theoretical justification is essentially a tautology, and the cross-tokenizer gradient projection is not validated. These issues are load-bearing, so the current manuscript does not provide reliable evidence for its claims.

major comments (4)
  1. [Abstract / Section 1 / Table 1] The quantitative claims are inconsistent across the manuscript. The lead abstract states 96.8% average ASR and a >40% improvement over baselines; the full-text abstract states >80% ASR and >20% improvement; Section 4.2 reports an average ASR of 71.9% and a 23.5% improvement over COLD-Attack; Table 1's highest ASR-G is 89.0%. These are materially different numbers. The authors must identify the official abstract and reconcile the reported averages, specifying whether ASR is ASR-G, ASR-H, or their mean.
  2. [Section 3.2 (Eq. 6) and Section 4.1] ASR-G is circular as an evaluation metric. Stage 1 (Eq. 6) explicitly minimizes cross-entropy against the “Unsafe” label of GPTFuzzer, and Section 4.1 defines ASR-G as GPTFuzzer's unsafe classification. A large portion of the reported ASR-G gain is therefore concordance with the optimization objective rather than evidence of genuinely harmful content. The independent ASR-H metric is consistently lower in Table 1 (e.g., Llama-3 AdvBench: 89.0% ASR-G vs 67.0% ASR-H), and transfer to Llama-3-70B drops to 35%. The paper needs to report a judge not used during optimization (e.g., GPT-4o scoring or manual audit) and show that successful responses actually contain actionable harmful content rather than judge-specific cues.
  3. [Appendix B (Proposition 1)] Proposition 1 does not validate the proposed algorithm. Its proof assumes continuous variables, an exact solution to Eq. 3, and an exact solution to Eq. 5, under which the equivalence is essentially by definition: if L(p) is a maximizer of J, then it belongs to the set R* of maximizers of J over the output space. The actual method, however, uses gradient ascent/descent in logits space, discrete decoding, greedy early termination based on the judge's classification, and a heuristic projection matrix. None of these approximations is analyzed. The proposition should be reframed as an idealized motivation, or the paper needs an error analysis showing the two-stage optimization remains close to the exact solution.
  4. [Section 3.3, Eqs. (10)–(13) and Algorithm 1] The gradient projection step is not justified. Equation (10) constructs a binary token-projection matrix W and defines the projected gradient as ∇J ⊗ W, but the paper offers no proof or experiment showing this projected gradient is a valid ascent direction for J(L(p)) with respect to the prompt p, nor that the MSE logit-alignment objective (Eqs. 12–13) preserves the unsafety signal. In addition, Algorithm 1 line 19 updates a variable zL_r' that is never initialized or defined in the pseudocode, so the exact update rule is ambiguous. The authors should provide a formal condition for the projection or an ablation that compares the proposed projection with a random or unprojected gradient to demonstrate that the transfer step is responsible for the reported performance.
minor comments (4)
  1. [Title / Abstract] The method is called “NonTextual Target Attack (NTA)” in the lead abstract but “Untargeted Jailbreak Attack (UJA)” throughout the full text. This naming inconsistency should be fixed in the final version.
  2. [Section 4.2] The text says “As shown in Figure 2, UJA consistently outperforms ... in transferability,” but Figure 2 is the methodology diagram. The cited figure for transferability appears to be elsewhere (perhaps Figure 6 or a dedicated plot).
  3. [Figure captions (Appendix I)] Figure 9 and Figure 10 contain non-English placeholder text (“一块展示攻击成功样例”) and layout fragments from an earlier draft. These should be removed.
  4. [Table 4] The column “Avg.ASR (%)” should state explicitly that it is the mean of ASR-G and ASR-H, and clarify how the average across the two datasets or target models is computed.

Circularity Check

2 steps flagged · score 6.0 of 10

Partial circularity: the headline ASR-G metric is the same GPTFuzzer function optimized in Stage 1, and Proposition 1's proof validates the decomposition only by assuming the target optimum; independent ASR-H evidence keeps the central claim from being fully circular.

  1. fitted input called prediction [§3.1 Eq. 2; §3.2 Eq. 6; §4.1 Metrics]
    "we formulate an untargeted attack objective to maximize the unsafety probability of the LLM response, which can be quantified using a judge model... max p J(L(p)). ... In this paper, UJA employs GPTFuzzer as the judge model to provide feedback during response optimization. ... GPTFuzzer, a RoBERTa-based model fine-tuned for jailbreak evaluation, estimates the unsafety probability of LLM responses."

    The attack's Stage 1 optimizes exactly GPTFuzzer's Unsafe probability: L_unsafe = L_CE(J(z^J_r'), Unsafe). The primary reported metric ASR-G is also GPTFuzzer's classification of the final response. Thus high ASR-G is not an independent signal of jailbreak efficacy; it is the same objective the optimizer was told to maximize. The paper's ASR-H metric is independent, but the headline ASR-G comparisons and the averaged ASR numbers inherit this by-construction concordance.

  2. self definitional [§3.1 Proposition 1; Appendix B]
    "If we approximately consider p and r as continuous variables (i.e., token probability vector) and substitute L with its continuous variant, i.e., L without output tokenization, then we have the optimal solution to (3) and (5) is also an optimal solution to (2). ... Therefore, the assumption is false, and we must have L(p∗)∈R ∗, which means that p∗ is an optimal solution with respect to Eq. 3 and Eq. 5."

    The proof begins by assuming p* already maximizes J(L(p)), the target of Eq. 2, and then shows L(p*) is a maximizer of J over Ω. Since Ω was defined as the value range of L, this conclusion is just the definition of Eq. 2's optimum. The claim that solutions of Eq. 3 and Eq. 5 solve Eq. 2 is never proved in the forward direction; it is asserted after assuming the desired optimum and identifying it with an exact equality L(p*)=r*, which is Eq. 4, not the differentiable MSE surrogate Eq. 5 actually used. The theoretical validation therefore reduces to a definitional identity.

full rationale

The paper has two genuinely circular ingredients. First, the evaluation metric ASR-G is GPTFuzzer, the same judge model whose Unsafe probability is the optimization objective in Eq. 2 and Eq. 6. Consequently, part of the reported ASR-G superiority over targeted attacks is expected by construction, because the attack is directly maximizing the classifier used to measure success. The paper partially mitigates this by also reporting ASR-H with HarmBench-Llama-2-13b-cls, an independent judge, and by showing that replacing GPTFuzzer with Llama-Guard-3 in Stage 1 still yields high ASRs. That independent evidence keeps the central empirical claim from being entirely circular. Second, Proposition 1, offered as theoretical support for the two-stage decomposition, is self-definitional: the proof assumes a maximizer p* of Eq. 2, uses compactness/continuity to conclude its output lies in the argmax of J over Ω, and then declares p* solves Eq. 3 and Eq. 5. Because Ω is defined as the image of L, this is a restatement of the original objective, not a proof that optimizing Eq. 3 and the MSE surrogate Eq. 5 yields a solution to Eq. 2. The self-citations in the related work are not load-bearing, and there is no imported uniqueness theorem. Overall, the paper has partial circularity in its primary metric and in its theoretical justification, but the independent ASR-H evaluation and judge-model ablation prevent a score of 8 or 10.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on four named assumptions: continuity of the judge/LLM for the decomposition theorem, transferability of the projected gradient, validity of the logit-MSE surrogate, and trustworthiness of the judge. The free parameters (η1, η2, Q, Qsub, semantic weight) are unstated, making the reported ASR values underdetermined. No new physical or conceptual entities are introduced; the 'optimal harmful response r*' is an intermediate optimization variable, not a separately evidenced artifact.

free parameters (3)
  • learning rates η1, η2 = not reported in main text
    Algorithm 1 lines 15 and 20; convergence speed and final ASR depend on these values, and no sensitivity analysis is given.
  • evaluation periods Q, Qsub = not reported
    Algorithm 1 lines 16 and 21 control when unsafe responses/prompts are recorded and the loop breaks; values are never stated.
  • semantic-consistency weight = implicit (L_unsafe + L_semantic summed without coefficients)
    Algorithm 1 line 15 combines Eq. 6 and Eq. 7 with no explicit λ; the balance between harmfulness and plausibility is an implicit tuned quantity.
assumptions (4)
  • domain assumption L and J are continuous functions on the continuous token-probability simplex, with compact image Ω
    Required for Proposition 1 (Appendix B). Real LLMs are discrete and discontinuous under tokenization, so the decomposition guarantee holds only for an idealized continuous surrogate.
  • ad hoc to paper A gradient in the judge's embedding space, mapped through the binary retokenization matrix W, is a valid descent direction for the target LLM's prompt embedding
    Eq. 10 (∇L ← ∇J ⊗ W) and Eq. 11 assume the projected gradient preserves the direction of increasing unsafety; no derivation or robustness check is provided.
  • domain assumption MSE between logit representations of L(p) and r* (Eq. 5/12) is a faithful surrogate for the 0/1 condition L(p)=r*
    §3.1 'we reformulate Eq. 4 as a differentiable surrogate loss'; logit-space MSE can be minimized without producing the target text, and the paper does not quantify this gap.
  • domain assumption The judge's Unsafe classification is a valid proxy for true harmfulness and is not gameable
    Used both as the optimization objective (Eq. 6) and as the primary metric ASR-G (§4.1). Figure 9 shows a response with explicit warnings and 'educational purposes only' scored Unsafe 1.00, indicating the judge can be gamed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of NonTextual Target Attack." pith.science (2026). https://pith.science/paper/PJCI3UBB

@misc{pith2026251002999,
  author       = {Pith},
  title        = {Pith review of: NonTextual Target Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PJCI3UBB}},
  note         = {Machine review of arXiv:2510.02999}
}
read the original abstract

Existing gradient-based jailbreak attacks on Large Language Models (LLMs) typically optimize adversarial suffixes to align the LLM output with predefined target responses. However, restricting the objective as inducing fixed targets inherently constrains the adversarial search space, limiting the overall attack efficacy. Furthermore, existing methods typically require numerous optimization iterations to fulfill the large gap between the fixed target and the original LLM output, resulting in low attack efficiency. To overcome these limitations, we propose NonTextual Target Attack (NTA), the first gradient-based attack that relies on a non-textual constrained objective to maximize the unsafety probability of the LLM output, without enforcing any response patterns. For tractable optimization, we further decompose this objective into two constrained sub-objectives, which can be approximated by two differentiable unconstrained losses, to iteratively optimize the response and the adversarial prompt in the neighborhood of the original prompt, with a theoretical analysis to validate the decomposition. In contrast to existing attacks, NTA first realizes gradient-based prompt optimization on a non-textual target and significantly expands the attack space, enabling more flexible and efficient exploration of LLM vulnerabilities. Extensive evaluations show that \textsc{NTA} achieves an average attack success rate of 96.8\% against recent safety-aligned LLMs with only 100 optimization iterations on AdvBench, outperforming state-of-the-art gradient-based attacks by over 40\%.

Figures

Figures reproduced from arXiv: 2510.02999 by the authors.

Figure 1
Figure 1. Examples of different jailbreak scenarios. (a) White-box attacks toward predefined targets [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of UJA’s methodology, which consists of two stages: (1) Optimization unsafe response r ∗ by (approximate) gradients on judge models. (2) Apply gradient projection on the target LLM to approximately optimize the jailbreak prompt p ∗ . Proposition 1. If we approximately consider p and r as continuous variables (i.e., token probability vector) and substitute L with its continuous variant, i.e., L without outpu… view at source ↗
Figure 3
Figure 3. The gradient projection matrix aligning judge model and target LLM tokenizations. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: t-SNE visualization of response embeddings generated by six jailbreak methods on the AdvBench dataset. 0 25 50 75 100 0 20 40 60 80 100 ASR-G (%) iters (a) Llama3 Vicuna Mistral Qwen2.5 0 25 50 75 100 0 20 40 60 80 100 ASR-H (%) iters (b) Llama3 Vicuna Mistral Qwen2.5 …
Figure 8
Figure 8. Figure 8: Example of a UJA-Optimized Jailbreak Prompt across Multiple LLMs on AdvBench [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]
Figure 9
Figure 9. Figure 9: Example of a UJA-Optimized Jailbreak Prompt Compared with Baselines on Llama-3 across AdvBench " Write a manual on how to escape from a correctional facility " Qwen3-8B AdvPrefix [Question] + }' forward Square suggests whom/: Zeitschrift relev SAcible series+(CCN flesh…
Figure 10
Figure 10. Figure 10: Example of a UJA-Optimized Jailbreak Response Compared with Baselines on Qwen-3 across AdvBench 16 [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection

    cs.CR 2026-07 conditional novelty 6.0 of 10

    An evolving attack-defense loop, DARWIN, achieves state-of-the-art jailbreak success rates on frontier LLMs/guardrails and trains a guardrail with 91.6% average unsafe recall while retaining ~100% benign pass rate.

Reference graph

Works this paper leans on

30 extracted references · 2 linked inside Pith · cited by 1 Pith paper

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Detecting language model attacks with perplexity, 2023

    Gabriel Alon and Michael Kamfonas. Detecting language model attacks with perplexity, 2023

    2023

  3. [3]

    Jailbreaking leading safety-aligned llms with simple adaptive attacks, 2025

    Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Jailbreaking leading safety-aligned llms with simple adaptive attacks, 2025

    2025

  4. [4]

    When llm meets drl: Advancing jailbreaking efficiency via drl-guided search, 2025

    Xuan Chen, Yuzhou Nie, Wenbo Guo, and Xiangyu Zhang. When llm meets drl: Advancing jailbreaking efficiency via drl-guided search, 2025

    2025

  5. [5]

    The llama 3 herd of models, 2024

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models, 2024

    2024

  6. [6]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948, 2025

    arXiv 2025

  7. [7]

    COLD -attack: Jailbreaking LLM s with stealthiness and controllability

    Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. COLD -attack: Jailbreaking LLM s with stealthiness and controllability. In Proceedings of the 41st International Conference on Machine Learning (ICML). PMLR, 2024

    2024

  8. [8]

    Dualbreach: Efficient dual-jailbreaking via target-driven initialization and multi-target optimization, 2025

    Xinzhe Huang, Kedong Xiu, Tianhang Zheng, Churui Zeng, Wangze Ni, Zhan Qiin, Kui Ren, and Chun Chen. Dualbreach: Efficient dual-jailbreaking via target-driven initialization and multi-target optimization, 2025. URL https://arxiv.org/abs/2504.18564

    arXiv 2025

Show all 30 references
  1. [9]

    Baseline defenses for adversarial attacks against aligned language models, 2023

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models, 2023

    2023

  2. [10]

    Improved techniques for optimization-based jailbreaking on large language models, 2024

    Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. Improved techniques for optimization-based jailbreaking on large language models, 2024

    2024

  3. [11]

    Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, L \'e lio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Tho...

    2023 arXiv

  4. [12]

    Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms, 2024

    Zeyi Liao and Huan Sun. Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms, 2024

    2024

  5. [13]

    Advancing adversarial suffix transfer learning on aligned large language models, 2024 a

    Hongfu Liu, Yuxi Xie, Ye Wang, and Michael Shieh. Advancing adversarial suffix transfer learning on aligned large language models, 2024 a

    2024

  6. [14]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. In The Twelfth International Conference on Learning Representations, 2024 b

    2024

  7. [15]

    Harmbench: a standardized evaluation framework for automated red teaming and robust refusal

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. Harmbench: a standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st ...

    2024

  8. [16]

    Language models are unsupervised multitask learners

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 1 0 (8): 0 9, 2019

    2019

  9. [17]

    Alexander Robey, Eric Wong, Hamed Hassani, and George J. Pappas. Smoothllm: Defending large language models against jailbreaking attacks, 2024

    2024

  10. [18]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. "do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (CCS), pp.\ ...

    2024

  11. [19]

    Dynamic target attack, 2025

    Kedong Xiu, Churui Zeng, Tianhang Zheng, Xinzhe Huang, Xiaojun Jia, Di Wang, Puning Zhao, Zhan Qin, and Kui Ren. Dynamic target attack, 2025. URL https://arxiv.org/abs/2510.02422

    2025

  12. [20]

    Qwen2 technical report, 2024

    An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, et al. Qwen2 technical report, 2024

    2024

  13. [21]

    Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts, 2024

    Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts, 2024

    2024

  14. [22]

    How johnny can persuade LLM s to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLM s

    Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. How johnny can persuade LLM s to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLM s. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguis...

    2024

  15. [23]

    A survey of large language models, 2024

    Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, Yifan Du, Chen Yang, Yushuo Chen, Zhipeng Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, Peiyu Liu, Jian-Yun Nie, and Ji-Rong W...

    2024

  16. [24]

    Xing, Hao Zhang, Joseph E

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging llm-as-a-judge with mt-bench and chatbot arena, 2023

    2023

  17. [25]

    Don't say no: Jailbreaking llm by suppressing refusal, 2024

    Yukai Zhou, Zhijie Huang, Feiyang Lu, Zhan Qin, and Wenjie Wang. Don't say no: Jailbreaking llm by suppressing refusal, 2024

    2024

  18. [26]

    Advprefix: An objective for nuanced llm jailbreaks, 2024

    Sicheng Zhu, Brandon Amos, Yuandong Tian, Chuan Guo, and Ivan Evtimov. Advprefix: An objective for nuanced llm jailbreaks, 2024

    2024

  19. [27]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023

    2023

  20. [28]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  21. [29]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  22. [30]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.