Pith. sign in

REVIEW 4 major objections 4 minor 38 references

Turning benign text into jokes can inject hidden toxicity that safety filters call safe.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 21:43 UTC pith:A437OQXI

load-bearing objection A useful attack demonstration with an overstated 'intrinsic risk' claim — the ICL induction confound needs a no-exemplar baseline before the title holds. the 4 major comments →

arxiv 2607.15977 v1 pith:A437OQXI submitted 2026-07-17 cs.CR

Refusal is Not Safety! Benchmarking Latent Safety Risks of LLM-Driven Content Humorization

Yu Cui , Ruiqing Yue , Tingyu Li , Sicheng Pan , Zhuoyu Sun , Xufeng Zhang , Baohan Huang , Haibin Zhang
show 1 more author
Cong Zuo
This is my paper
classification cs.CR
keywords LLM safetyhumorizationlatent safety risksprompt injectionrefusal-based defensesin-context learningtoxicitystereotypicality
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that LLM-based humorization — rewriting ordinary text into jokes — can itself introduce latent safety risks that standard refusal-based defenses miss. Using only 16 hand-picked harmful humorous exemplars in the prompt, the authors show that frontier LLMs produce humorized content with roughly 3.14x more toxicity while still reading as safe, with an apparent safety rate of 97.8% even under a humor-based defense. The point matters because comedy-writing tools and humor-based refusal mechanisms are being deployed on the assumption that humorous output is safe; this work claims that assumption is false and that existing detectors, including state-of-the-art ones, fail to catch the hidden risk.

Core claim

The paper's central claim is that humorization is not a safe operation: when an LLM is shown pairs of harmful jokes and their de-humorized benign versions, and is then asked to humorize benign text, it learns and generalizes the harmful patterns — reintroducing toxicity and stereotypicality that a straightforward 'humorize this text' instruction would not produce. The claim is demonstrated by the HumorSafe framework, which measures risk across original, de-humorized, and re-humorized content, and by the HumorPIA attack, which combines jailbreak prompts with humor-conditioned generation to preserve a safe refusal while embedding harmful jokes. The paper further shows that the resulting output

What carries the argument

The load-bearing mechanism is the Unfun→Refun pair: a harmful joke (x) is stripped of humor to give a benign-looking non-humorous version (y), and the pair is reversed so the model sees P(y,x) as a one-shot in-context exemplar. The model is then asked to humorize a new benign query q; when q=y the setting is 'homogeneous', and when q is unseen it is 'heterogeneous'. HumorPIA builds on this by concatenating jailbreak prompts with the injected funny-harmful pairs, letting the model answer the jailbreak with a humorous refusal while the humorization itself carries the hidden toxicity.

Load-bearing premise

The paper's claim that humorization itself creates risk rests on assuming the Unfun→Refun reversal is a neutral measurement instrument, when in fact every test shows the model a harmful humorous exemplar right before asking it to humorize — so the observed toxicity could be a copy of the exemplar, not something the model discovers on its own.

What would settle it

Run the same humorization instruction with zero harmful exemplars (or with only safe exemplars) on the same benign inputs; if toxicity does not rise above baseline, the central claim that humorization is intrinsically risky is not supported.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Safety metrics that measure only refusal and surface-level safety will under-report risk in humorized outputs.
  • Humor-based refusal defenses designed to bypass over-refusal and prefix injection can be repurposed as attack channels.
  • LLM agents that load untrusted data at session start inherit the same latent risk through the agent data injection variant.
  • Detectors that judge an output 'safe' because it refuses the jailbreak can be fooled by humor that is simultaneously a refusal and a vehicle for harmful content.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because every experiment shows harmful exemplars before the humorization step, the measured 'intrinsic' risk may actually be in-context learning of the shown patterns; a plain 'humorize this' baseline with no harmful exemplars would separate the two.
  • The Unfun/Refun pairing could be reused as a synthetic data recipe for safety alignment: label the funny version unsafe and the de-humorized version safe, and train the model to resist the transformation.
  • The same evaluation design transfers to other rewriting tasks (paraphrase, summarization) that are assumed safe, suggesting a general test for latent risk in style-transfer settings.
  • LLM-as-a-judge toxicity/stereotype labels may not match human evaluation on humorized content; a simple extension is to measure agreement and flag judge disagreement as part of the benchmark.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies safety risks of LLM-based content humorization. Based on an analysis of 30k agent interactions and a 45-respondent survey of stand-up comedians, it proposes HumorSafe, a benchmark in which high-risk humorous inputs x are de-humorized into low-risk non-humorous counterparts y, then the reversed pair (y, x) is used as a one-shot in-context learning (ICL) exemplar. The model is prompted to transform y into humorous x-like output, either homogeneously (q = y) or heterogeneously (q ≠ y). The authors report that this humorization process introduces latent toxicity and stereotypicality across five frontier LLMs. They also propose HumorPIA, a prompt-injection attack that concatenates jailbreak prompts with the harmful humorization exemplars, and report that it increases mild toxicity by 3.14× while keeping refusal-based safety metrics high (97.8% safe) and evading GPT-5.5 and Claude Opus 4.6 output filters. The paper concludes that refusal-based safety metrics are insufficient for humorized settings.

Significance. If the central claim held, the paper would identify a genuinely under-explored safety gap: commercial humorization platforms and humor-based refusal defenses could embed harmful content while appearing safe, and standard refusal metrics would miss it. The study has real strengths: it uses publicly available datasets (Unfun, Chumor 2.0, HarmBench/AdvBench), includes the largest comedian survey among related work, and extends the attack to agentic scenarios (HumorADI). However, the paper's central claim that 'humorization introduces latent safety risks' is currently confounded with an ICL-based prompt-injection attack, because every HumorSafe condition teaches the model an explicit y→x mapping from hand-picked harmful exemplars and there is no no-exemplar humorization control. The quantitative claims also rest on LLM-as-a-judge labels without inter-annotator agreement statistics. The HumorPIA attack itself is a plausible and narrower contribution, but the broader title/abstract claim is not yet supported.

major comments (4)
  1. [§Methodology, HumorSafe Benchmark; §Experiments, Table 1] The central claim that humorization 'introduces' safety risk is not isolated from the ICL induction. In the Homogeneous setting, q is exactly the de-humorized counterpart y of the high-risk exemplar x shown in the one-shot prompt, so the elevated M-Tox/S-Tox in Table 1 (e.g., DeepSeek-V4: 14.67%/3.53%) can be explained by exemplar restoration rather than an intrinsic property of humorization. The Heterogeneous setting still exposes the model to harmful y→x exemplars before the query. The baseline is traditional humor continuation, not 'humorize this benign text with no harmful exemplars.' The paper therefore needs two additional conditions: (1) a no-exemplar 'rewrite this text humorously' control and (2) an ICL control using safe humorization exemplars. Without these, the title and conclusion reduce to a demonstration that 16 hand-picked harmful exemplars can be injected to drive toxic o
  2. [§Experiments, Evaluation Protocol; Appendix, Undetected Latent Risks] All quantitative claims—toxicity increments, 97.8% apparent safety, detector failure—rely on LLM-as-a-judge labels (GPT-5.1, DeepSeek-V4-Pro, GPT-5.5, Claude Opus 4.6). The paper mentions human expert review with majority voting but reports no inter-annotator agreement, no validation-set size, and no confusion matrix. The two appendix detector examples are anecdotal and cherry-picked, and no aggregate detection rate is reported. Without a human-calibrated evaluation on a representative sample, the 3.14× figure and the claim that 'SOTA detectors fail' are unestablished. Please report kappa/agreement, a human-labeled test subset, and aggregate detector pass rates.
  3. [§Experiments, Ablation Study, Table 2] The headline '3.14×' increase is not clearly supported by Table 2. The AVG row shows M-Tox growing from 1.26% (HumorReject) to 5.22% (HumorPIA w/ Def.), a ratio of about 4.1×; the 3.14× figure may refer to a different comparison, but none is specified. More generally, no confidence intervals or significance tests are reported for any comparison, and the n=300 jailbreak set is shared across models. Also, the attack is compared only against HumorReject; the 'even under defense settings' claim would be stronger if a standard refusal-defense condition were included.
  4. [§Limitations] The Limitations section acknowledges only the 45-participant sample size. It does not mention the ICL-exemplar confound, the LLM-as-a-judge validation issue, or the absence of a no-exemplar baseline. Since these are the load-bearing limitations, they should be addressed directly rather than omitted.
minor comments (4)
  1. [§Results, Cross-model comparison] The sentence 'For LLMs with stronger safety alignment, our method produces more unsafe outputs' followed by the GPT-OSS example is confusing: GPT-OSS is not identified as a stronger-aligned model, and its baseline toxicity is lower than DeepSeek-V4's. Please clarify which models are considered 'stronger safety alignment' and justify the claim with the table.
  2. [Table 2, Table 3] The boldface rule is stated as 'lowest for Reject and highest for all other metrics,' but for Reject lower is safer, while for safety metrics higher is safer; this is inherently contradictory. Please separate safety-oriented metrics from attack-success-oriented metrics and format accordingly.
  3. [Appendix, Undetected Latent Risks] The two detector evaluation excerpts are formatted as text with broken characters (e.g., curly quotes). Also, the response shown has toxicity=3 yet is labeled safe; this is interesting but is a single example. Please present a quantitative summary of detector behavior over the full evaluation set.
  4. [References] Several references are duplicated (e.g., Yi et al. 2025a and 2025b are identical entries) and several future-dated citations may need verification. There are also typos such as 'harmful humorization patterns through ICL' appearing without spaces in the introduction.

Circularity Check

2 steps flagged

HumorSafe's 'humorization introduces risk' finding is partially constructed: in the homogeneous setting the query q is the de-humorized half of the harmful exemplar just shown as the one-shot target, so the measured toxicity is ICL reproduction rather than an independent property of humorization.

specific steps
  1. self definitional [Methodology — HumorSafe Benchmark, definition of Homogeneous Humorization (q=y)]
    "We first transform high-risk humorous content into a de-humorized version, yielding a low-humor counterpart (Unfun)... This process produces paired samples denoted as P(x, y). We then reverse each pair to obtain P(y, x)... For each inverted pair, we construct a one-shot ICL example... After this learning step, we evaluate the model on a non-humorous and low-risk query q. We consider two settings. When q=y, we define this case as Homogeneous Humorization."

    The homogeneous 'prediction' is defined by construction: q is exactly the safe y belonging to the harmful humorous x that was just shown to the model as the target of the one-shot P(y,x) exemplar. Measuring toxicity/stereotypicality in the model's output for this q is largely measuring the model's reproduction of the injected harmful exemplar, not an emergent safety property of humorization. The paper's later claim that homogeneous humorization 'introduces' ~7x Severe Toxic risk is therefore forced by the benchmark input; no no-exemplar humorization condition exists to separate ICL attack induction from intrinsic humorization risk.

  2. fitted input called prediction [Results — 'Refun not only restores humor but also reintroduces the original toxicity and stereotypicality']
    "We observe that outputs generated from non-humorous content exhibit increased toxicity and stereotypicality compared with Unfun samples, revealing hidden safety risks introduced during humorization. This suggests that under ICL, the LLM learns unsafe humorization patterns and is induced to perform such transformations."

    This conclusion is drawn exclusively from conditions in which the model was first shown 16 hand-picked harmful humorization exemplars (P(y,x)) and prompted to learn the y→x transformation. The observed increase in toxicity/stereotypicality is the induced ICL effect—the input already contains the harmful humorization pattern. Calling this 'safety risks introduced during humorization' conflates the attack/injection input with an intrinsic property of humorization. The paper does not run a condition where benign content is humorized without harmful in-context exemplars, so the causal claim is not independently tested; the Limitations section only notes the small participant sample and does not acknowledge this missing control.

full rationale

The paper's core operational result is an in-context-learning attack: HumorSafe constructs P(x,y) from harmful humorous x and safe de-humorized y, reverses it to P(y,x), injects it as a one-shot exemplar, and then measures how much toxic/stereotypical content the model produces. The homogeneous setting is especially revealing: q=y is literally the safe half of the shown harmful exemplar, so a high toxicity measurement there is the model following the just-taught mapping back to x. That is a constructed reproduction, not an independent prediction about humorization. The heterogeneous setting and the real-world Moltbook/comedian studies provide some independent grounding, and HumorPIA is honestly an attack (so its 3.14x/97.8% numbers are meaningful as an attack measurement). But the title-level claim that 'humorization itself introduces latent safety risks' is partially circular because the benchmark's definition of humorization includes teaching harmful humorization patterns before the measured transformation. The paper lacks an exemplar-free 'humorize this benign text' control, and the Limitations section does not flag this confound. I therefore score 6: the central 'introduces' claim partially reduces to the injected ICL input, while the attack demonstration and real-world correlation retain independent content. No self-citation chain or uniqueness import is involved, so the score is not higher.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The central attack is an ICL amplifier: it assumes that showing a model (safe text → harmful humorous text) pairs is a valid way to measure or induce humorization risk, and it assumes the judge labels used for toxicity/stereotypicality are trustworthy. The 16 curated examples and one-shot setting are hand-chosen degrees of freedom that directly control the measured effect size.

free parameters (3)
  • Curated harmful injection set = 16 manually selected pairs
    The attack and HumorSafe benchmark use a hand-picked subset of the most high-risk Unfun/Chumor pairs; no selection criteria are given, so the measured toxicity/stereotypicality is tied to this choice.
  • ICL shot count = 1 (one-shot)
    The number of exemplars per inversion pair is fixed at one; generalization and effect size may vary with shot count, but no sweep is reported.
  • Sampling temperature = 1.0 for targets, 0 for judges
    Temperature is a chosen experimental setting; judge temperature 0 aids reproducibility but target diversity depends on 1.0.
axioms (4)
  • domain assumption LLM-as-a-judge outputs and human majority voting are valid ground truth for toxicity, stereotypicality, and safety
    All percentages in Tables 1-3 come from judge-based labels (GPT-5.1 with human review); no inter-annotator agreement or validation set is reported, and the paper's own example shows GPT-5.5 mislabels unsafe humor as safe.
  • ad hoc to paper The inverted pair P(y,x), safe de-humorized text y to harmful humorous x, is a representative model of real humorization risk
    This reversal is the core instrument of HumorSafe; the paper assumes it reproduces the transformation a comedy-rewriting service performs, but offers no independent evidence.
  • domain assumption Prior Moltbook toxicity labels and the authors' humor annotation are accurate
    Real-world correlation evidence in Figure 2/8 depends on inherited labels and a new binary humor classification with no validation metrics.
  • domain assumption Attacker can place injected content in model context or agent-loaded data
    Standard indirect prompt-injection threat model (Yi et al. 2025); reasonable for an attack claim but limits scope to systems that ingest untrusted content.

pith-pipeline@v1.3.0-alltime-deepseek · 16565 in / 14945 out tokens · 155603 ms · 2026-08-01T21:43:09.856903+00:00 · methodology

0 comments
read the original abstract

Safety defenses for large language models (LLMs) have been extensively studied, with existing approaches focusing on attack detection and refusal mechanisms. Such fixed-form direct refusal strategies may introduce the risk of prefix injection attacks. Recent work has explored a new direction that leverages humor as an indirect refusal mechanism to mitigate over-refusal in jailbreak scenarios and reduce prefix injection risks. However, this approach implicitly assumes that humorous responses are safe. Whether humorization itself introduces safety risks remains unexplored. To address this issue, we conduct an exploratory study involving over 30,000 real-world agent interaction records and 45 stand-up comedians, revealing practical safety concerns in LLM-based content humorization. Motivated by these findings, we propose \textsc{HumorSafe}, a novel framework for evaluating latent safety risk propagation during humorization. \textsc{HumorSafe} enables LLMs to learn harmful humorization patterns and use them to transform benign content into humorous content with safety risks. Across five frontier LLMs, we find that LLMs can introduce stereotypes and toxicity during humorization. We further propose \textsc{HumorPIA}, a prompt injection attack that exploits latent risks in humor-based defenses. \textsc{HumorPIA} preserves the appearance of safe humorous refusal while covertly injecting harmful content, allowing latent risks to evade existing detection mechanisms. Experiments show that it increases toxicity by 3.14$\times$ while maintaining an apparent safety rate of 97.8\% even under defense settings. Our findings highlight a gap in existing LLM safety evaluations under humorized settings.

Figures

Figures reproduced from arXiv: 2607.15977 by Baohan Huang, Cong Zuo, Haibin Zhang, Ruiqing Yue, Sicheng Pan, Tingyu Li, Xufeng Zhang, Yu Cui, Zhuoyu Sun.

Figure 1
Figure 1. Figure 1: Overview of our evaluation framework and key [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 3
Figure 3. Figure 3: Distribution of LLM usage among stand-up come [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Comparison of LLM inference under HumorPIA, conventional over-defense, and humor-based defense mechanisms. suggests that safety refusals do not reduce willingness to adopt LLM-integrated applications. From a content safety perspective, this phenomenon reveals a potential risk. Hu￾man performers may have difficulty identifying content that poses safety concerns during stand-up comedy creation. Con￾sequently… view at source ↗
Figure 5
Figure 5. Figure 5: Comparison among heterogeneous humorization, [PITH_FULL_IMAGE:figures/full_fig_p005_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Comparison of safety risks among original, Unfun, and Refun contents. [PITH_FULL_IMAGE:figures/full_fig_p006_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Safety comparison of defense strategies against [PITH_FULL_IMAGE:figures/full_fig_p008_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Distribution of humor across LLM-generated content domains. [PITH_FULL_IMAGE:figures/full_fig_p012_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

38 extracted references · 8 canonical work pages

  1. [1]

    2026 , isbn =

    Huang, Xuehan and Wang, Canwen and Hao, Yifei and Yang, Daijin and LC, RAY , title =. 2026 , isbn =. doi:10.1145/3772318.3791678 , booktitle =

    arXiv 2026

  2. [2]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Assessing the capabilities of llms in humor: a multi-dimensional analysis of oogiri generation and evaluation , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  3. [3]

    and Jain, Lalit K and Nowak, Robert D and Mankoff, Bob and Zhang, Jifan

    Zhou, Kuan Lok and Chen, Jiayi and Suresh, Siddharth and Narad, Reuben and Rogers, Timothy T. and Jain, Lalit K and Nowak, Robert D and Mankoff, Bob and Zhang, Jifan. Bridging the Creativity Understanding Gap: Small-Scale Human Alignment Enables Expert-Level Humor Ranking in LLM s. Findings of the Association for Computational Linguistics: EMNLP 2025. 202...

    work page doi:10.18653/v1/2025.findings-emnlp.884 2025

  4. [4]

    Small But Funny: A Feedback-Driven Approach to Humor Distillation

    Ravi, Sahithya and Huber, Patrick and Shrivastava, Akshat and Shwartz, Vered and Einolghozati, Arash. Small But Funny: A Feedback-Driven Approach to Humor Distillation. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2024. doi:10.18653/v1/2024.acl-long.706

    work page doi:10.18653/v1/2024.acl-long.706 2024

  5. [5]

    Pun Unintended: LLM s and the Illusion of Humor Understanding

    Zangari, Alessandro and Marcuzzo, Matteo and Albarelli, Andrea and Pilehvar, Mohammad Taher and Camacho-Collados, Jose. Pun Unintended: LLM s and the Illusion of Humor Understanding. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 2025. doi:10.18653/v1/2025.emnlp-main.1419

    work page doi:10.18653/v1/2025.emnlp-main.1419 2025

  6. [6]

    2024 , isbn =

    Mirowski, Piotr and Love, Juliette and Mathewson, Kory and Mohamed, Shakir , title =. 2024 , isbn =. doi:10.1145/3630106.3658993 , booktitle =

    arXiv 2024

  7. [7]

    Engagement Undermines Safety: How Stereotypes and Toxicity Shape Humor in Language Models

    Dogra, Atharvan and Ghosal, Soumya Suvra and Deshpande, Ameet and Kalyan, Ashwin and Manocha, Dinesh. Engagement Undermines Safety: How Stereotypes and Toxicity Shape Humor in Language Models. Proceedings of the 19th Conference of the E uropean Chapter of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 2026. doi:10.18653/v1/2026....

    work page doi:10.18653/v1/2026.eacl-long.373 2026

  8. [8]

    arXiv preprint arXiv:2603.17759 , year=

    Harm or Humor: A Multimodal, Multilingual Benchmark for Overt and Covert Harmful Humor , author=. arXiv preprint arXiv:2603.17759 , year=

    arXiv

  9. [9]

    The Thirteenth International Conference on Learning Representations , year=

    Innovative Thinking, Infinite Humor: Humor Research of Large Language Models through Structured Thought Leaps , author=. The Thirteenth International Conference on Learning Representations , year=

  10. [10]

    ICML 2026 , year=

    RedVisor: Reasoning-Aware Prompt Injection Defense via Zero-Copy KV Cache Reuse , author=. ICML 2026 , year=

    2026

  11. [11]

    Getting Serious about Humor: Crafting Humor Datasets with Unfunny Large Language Models

    Horvitz, Zachary and Chen, Jingru and Aditya, Rahul and Srivastava, Harshvardhan and West, Robert and Yu, Zhou and McKeown, Kathleen. Getting Serious about Humor: Crafting Humor Datasets with Unfunny Large Language Models. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers). 2024. doi:10.18653/v...

    doi:10.18653/v1/2024.acl-short.76 2024

  12. [12]

    Chumor 2.0: Towards Better Benchmarking C hinese Humor Understanding from (Ruo Zhi Ba)

    He, Ruiqi and He, Yushu and Bai, Longju and Liu, Jiarui and Sun, Zhenjie and Tang, Zenghao and Wang, He and Xia, Hanchen and Mihalcea, Rada and Deng, Naihao. Chumor 2.0: Towards Better Benchmarking C hinese Humor Understanding from (Ruo Zhi Ba). Findings of the Association for Computational Linguistics: ACL 2025. 2025. doi:10.18653/v1/2025.findings-acl.1122

    work page doi:10.18653/v1/2025.findings-acl.1122 2025

  13. [13]

    arXiv preprint arXiv:2406.12754 , year=

    Chumor 1.0: A truly funny and challenging chinese humor understanding dataset from ruo zhi ba , author=. arXiv preprint arXiv:2406.12754 , year=

    Pith/arXiv arXiv

  14. [14]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Humorreject: Decoupling llm safety from refusal prefix via a little humor , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  15. [15]

    Incomplete Prompt Jailbreaks in Large Language Models

    Kim, Yeonjea and Park, Bumjin and Choi, Jaesik. Incomplete Prompt Jailbreaks in Large Language Models. Findings of the A ssociation for C omputational L inguistics: ACL 2026. 2026

    2026

  16. [16]

    Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency , url =

    Jiang, Yukun and Li, Mingjie and Backes, Michael and Zhang, Yang , booktitle =. Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency , url =

  17. [17]

    2024 , isbn =

    Shen, Xinyue and Chen, Zeyuan and Backes, Michael and Shen, Yun and Zhang, Yang , title =. 2024 , isbn =. doi:10.1145/3658644.3670388 , booktitle =

    arXiv 2024

  18. [18]

    2025 , isbn =

    Yi, Jingwei and Xie, Yueqi and Zhu, Bin and Kiciman, Emre and Sun, Guangzhong and Xie, Xing and Wu, Fangzhao , title =. 2025 , isbn =. doi:10.1145/3690624.3709179 , booktitle =

    arXiv 2025

  19. [19]

    33rd USENIX Security Symposium (USENIX Security 24) , year =

    Yupei Liu and Yuqi Jia and Runpeng Geng and Jinyuan Jia and Neil Zhenqiang Gong , title =. 33rd USENIX Security Symposium (USENIX Security 24) , year =

  20. [20]

    Rothblum , booktitle=

    Sarah Ball and Grzegorz Gluch and Shafi Goldwasser and Frauke Kreuter and Omer Reingold and Guy N. Rothblum , booktitle=. Computational Barriers to Filtering for. 2026 , url=

    2026

  21. [21]

    DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence , author=

  22. [22]

    arXiv preprint arXiv:2508.10925 , year=

    gpt-oss-120b & gpt-oss-20b model card , author=. arXiv preprint arXiv:2508.10925 , year=

    Pith/arXiv arXiv

  23. [23]

    OS -Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows

    Sun, Qiushi and Li, Mukai and Liu, Zhoumianze and Xie, Zhihui and Xu, Fangzhi and Yin, Zhangyue and Cheng, Kanzhi and Li, Zehao and Ding, Zichen and Liu, Qi and Wu, Zhiyong and Zhang, Zhuosheng and Kao, Ben and Kong, Lingpeng. OS -Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows. Proceedings of the 64th Annu...

    work page doi:10.18653/v1/2026.acl-long.431 2026

  24. [24]

    arXiv preprint arXiv:2601.10527 , year=

    A Safety Report on GPT-5.2, Gemini 3 Pro, Qwen3-VL, Doubao 1.8, Grok 4.1 Fast, Nano Banana Pro, and Seedream 4.5 , author=. arXiv preprint arXiv:2601.10527 , year=

    arXiv

  25. [25]

    Proceedings of the 34th USENIX Conference on Security Symposium , articleno =

    Zhan, Xiao and Carrillo, Juan Carlos and Seymour, William and Such, Jose , title =. Proceedings of the 34th USENIX Conference on Security Symposium , articleno =. 2025 , isbn =

    2025

  26. [26]

    34th USENIX Security Symposium (USENIX Security 25) , pages=

    \ HateBench \ : Benchmarking Hate Speech Detectors on \ LLM-Generated \ Content and Hate Campaigns , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=

  27. [27]

    arXiv preprint arXiv:2605.30883 , year=

    TRACE: Task-Aware Adaptive Self-Evolving Agentic Jailbreaking , author=. arXiv preprint arXiv:2605.30883 , year=

    Pith/arXiv arXiv

  28. [28]

    AgentHarm: A Benchmark for Measuring Harmfulness of

    Maksym Andriushchenko and Alexandra Souly and Mateusz Dziemian and Derek Duenas and Maxwell Lin and Justin Wang and Dan Hendrycks and Andy Zou and J Zico Kolter and Matt Fredrikson and Yarin Gal and Xander Davies , booktitle=. AgentHarm: A Benchmark for Measuring Harmfulness of. 2025 , url=

    2025

  29. [29]

    Vulnerability of Large Language Models to Output Prefix Jailbreaks: Impact of Positions on Safety

    Wang, Yiwei and Chen, Muhao and Peng, Nanyun and Chang, Kai-Wei. Vulnerability of Large Language Models to Output Prefix Jailbreaks: Impact of Positions on Safety. Findings of the Association for Computational Linguistics: NAACL 2025. 2025. doi:10.18653/v1/2025.findings-naacl.219

    work page doi:10.18653/v1/2025.findings-naacl.219 2025

  30. [30]

    Humans welcome to observe

    "Humans welcome to observe": A First Look at the Agent Social Network Moltbook , author=. arXiv preprint arXiv:2602.10127 , year=

    arXiv

  31. [31]

    and Chu, Eric and Behbahani, Feryal and Faust, Aleksandra and Larochelle, Hugo , booktitle =

    Agarwal, Rishabh and Singh, Avi and Zhang, Lei and Bohnet, Bernd and Rosias, Luis and Chan, Stephanie and Zhang, Biao and Anand, Ankesh and Abbas, Zaheer and Nova, Azade and Co-Reyes, John D. and Chu, Eric and Behbahani, Feryal and Faust, Aleksandra and Larochelle, Hugo , booktitle =. Many-Shot In-Context Learning , url =. doi:10.52202/079017-2447 , editor =

    doi:10.52202/079017-2447

  32. [32]

    ``What do you call a dog that is incontrovertibly true? Dogma'': Testing LLM Generalization through Humor

    Cocchieri, Alessio and Ragazzi, Luca and Italiani, Paolo and Tagliavini, Giuseppe and Moro, Gianluca. ``What do you call a dog that is incontrovertibly true? Dogma'': Testing LLM Generalization through Humor. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2025. doi:10.18653/v1/2025.acl-long.1117

    work page doi:10.18653/v1/2025.acl-long.1117 2025

  33. [33]

    and Lee, Lillian and Da, Jeff and Zellers, Rowan and Mankoff, Robert and Choi, Yejin

    Hessel, Jack and Marasovic, Ana and Hwang, Jena D. and Lee, Lillian and Da, Jeff and Zellers, Rowan and Mankoff, Robert and Choi, Yejin. Do Androids Laugh at Electric Sheep? Humor ``Understanding'' Benchmarks from The New Yorker Caption Contest. Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)...

    doi:10.18653/v1/2023.acl-long.41 2023

  34. [34]

    PIG uard: Prompt Injection Guardrail via Mitigating Overdefense for Free

    Li, Hao and Liu, Xiaogeng and Zhang, Ning and Xiao, Chaowei. PIG uard: Prompt Injection Guardrail via Mitigating Overdefense for Free. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2025. doi:10.18653/v1/2025.acl-long.1468

    doi:10.18653/v1/2025.acl-long.1468 2025

  35. [35]

    Justice or Prejudice? Quantifying Biases in LLM-as-a-Judge , url =

    Ye, Jiayi and Wang, Yanbo and Huang, Yue and Chen, Dongping and Zhang, Qihui and Moniz, Nuno and Gao, Tian and Geyer, Werner and Huang, Chao and Chen, Pin-Yu and Chawla, Nitesh and Zhang, Xiangliang , booktitle =. Justice or Prejudice? Quantifying Biases in LLM-as-a-Judge , url =

  36. [36]

    arXiv preprint arXiv:2607.05120 , year=

    Agent Data Injection Attacks are Realistic Threats to AI Agents , author=. arXiv preprint arXiv:2607.05120 , year=

    Pith/arXiv arXiv

  37. [37]

    Proceedings of the 41st International Conference on Machine Learning , articleno =

    Mazeika, Mantas and Phan, Long and Yin, Xuwang and Zou, Andy and Wang, Zifan and Mu, Norman and Sakhaee, Elham and Li, Nathaniel and Basart, Steven and Li, Bo and Forsyth, David and Hendrycks, Dan , title =. Proceedings of the 41st International Conference on Machine Learning , articleno =. 2024 , publisher =

    2024

  38. [38]

    arXiv preprint arXiv:2307.15043 , year=

    Universal and transferable adversarial attacks on aligned language models , author=. arXiv preprint arXiv:2307.15043 , year=

    Pith/arXiv arXiv