Pith. sign in

REVIEW 4 major objections 5 minor 26 references

Graph of Attacks: Improved Black-Box and Interpretable Jailbreaks for LLMs

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A graph of attack attempts, instead of a chain or tree, lifts black-box jailbreak success on Llama2-7B from 4% to 20% and beats prior attacks on GPT-4 and Claude-3.

desk verdict The graph-based jailbreak idea is worth a look, but the paper's own tables contradict each other on the key Claude-3 result, so the central empirical claim is unsupported as written. read the letter →

arxiv 2504.19019 v1 pith:6CM4TPSW submitted 2025-04-26 cs.CL cs.AIcs.CR

Mohammad Akbar-Tajari , Mohammad Taher Pilehvar , Mohammad Mahmoody This is my paper · ORCID
classification cs.CLcs.AIcs.CR
keywords jailbreakattackslargelanguagemodelsblack-boxattackgraphofthoughtsadversarialpromptsLLMsafetyredteaminghuman-readable
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes Graph of Attacks (GoAT), a black-box method for jailbreaking large language models that arranges the attacker's reasoning as a graph instead of a single chain or tree. The central claim is that letting separate attack paths see and merge each other's partial progress finds successful human-readable prompts more often and with fewer queries to the victim model than the leading black-box baselines PAIR and TAP. On a 50-goal subset of AdvBench, GoAT reportedly lifts success on Llama2-7B from 4% to 20% and on Claude-3 from 60% to 68%, while generating prompts a human reader can follow. A sympathetic reader should care because the result suggests black-box red teaming does not have to choose between interpretability, query efficiency, and effectiveness against strongly aligned models. The reported gains depend on an automated evaluator's judgement of success, so the exact margins are only as solid as that judge.

What carries the argument

The load-bearing object is the GoAT reasoning graph: a directed graph whose nodes are prompt-response exchanges between the prompt generator and the target model, with edges recording which earlier exchanges informed each later candidate. The iterative loop has four roles—prompt generator, filter, evaluator, and adversary—and each iteration expands the graph by generating B candidate prompts per node from a local subgraph of depth h, keeping only candidates whose filter score clears a relevance threshold, taking the top d leaves as new nodes, and having the target respond to them. The innovation is aggregation: because the conversational history passed to the prompt generator is a subgraph rather than a single path, the next candidate can combine reasoning from multiple branches at once. The paper illustrates this with a node that merges a hypothetical-future framing, a roleplay framing, and an emotional-appeal framing into the prompt that finally makes Llama2-7B comply.

What would settle it

Take the exact 50-goal AdvBench subset used in the paper, rerun GoAT, PAIR, and TAP against Llama2-7B and Claude-3, and have independent human annotators label every response as harmful or not without seeing which method produced it. If the human-verified success rates do not reproduce GoAT's margins over PAIR and TAP on both models, the central claim of superiority fails; a second, cheaper check is to verify whether every prompt GoAT labels successful actually starts with harmful content rather than a refusal followed by safe information.

Watch

Extended reading notes

Core claim

The paper's central discovery is that graph-structured reasoning materially improves black-box jailbreaking. In GoAT, an attacker team maintains a directed graph of prompt-response interactions; each new candidate prompt is generated from a recent subgraph of that history, filtered for relevance to the attack goal, sent to the target model, and scored by an evaluator. Only the most promising branches become new nodes, and later candidates draw on the combined history of several nodes at once, so a tactic that failed in one branch can still contribute wording or framing that succeeds when merged with insights from other branches. The authors' own worked example shows nodes 4, 5, and 7, each insufficient on its own, converging into node 9's winning prompt. This cross-path synthesis, rather than any single prompt template, is what the paper claims delivers the improved success rates and lower query counts.

Load-bearing premise

The reported success rates depend on the GPT-4-based Evaluator correctly judging when a response actually satisfies the harmful goal; if that judge is too lenient, the headline margins (20% vs. 4% on Llama and 68% vs. 60% on Claude) could shrink or disappear, and the paper's description of the human-check procedure differs between Section 3.2 and Appendix A.2 without resolving the doubt.

Editorial extensions

If this is right

  • GoAT increases jailbreak success on Llama2-7B from 4% (TAP) and 0% (PAIR) to 20%, using fewer average queries to the victim model.
  • GoAT reaches 94% on GPT-4 and 68% on Claude-3, beating TAP (90%, 60%) and PAIR (60%, 24%) in the same black-box setting.
  • All generated prompts remain human-readable, in contrast to token-level attacks like GCG, so defenders can inspect exactly which phrasing bypassed safety.
  • With a stronger prompt generator (Mixtral in place of Vicuna), GoAT raises Llama2-7B success to 62%, showing generator capability is a major performance lever.
  • The graph structure prevents redundant exploration: separate attack branches that fail can still contribute partial insights to a later merged prompt.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not pursue this, but the same graph-of-attempts mechanism could be turned into an interpretable red-teaming audit for other safety properties, such as bias, privacy leakage, or tool misuse, where each branch records which tactic failed and why.
  • If the advantage comes from cross-path aggregation rather than from the specific LLM components, then the attack should be reproducible with cheaper evaluator and filter models; a direct ablation of the aggregation step versus the evaluator choice would separate these effects.
  • The Mixtral-vs-Vicuna jump (20% to 62% on Llama2-7B) suggests that scaling the attacker's prompt generator is a cheap lever, and one testable extension is whether a stronger open generator closes the remaining gap on Claude-3 without query growth.
  • The paper's graph also makes a natural defense target: a defender could monitor graph convergence, many branches converging on one obfuscation pattern, as a signature of this attack, something tree-based attacks would not expose.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Graph of ATtacks (GoAT), a black-box jailbreak method that adapts the Graph of Thoughts framework to adversarial prompt generation. GoAT maintains a graph of reasoning paths over the conversation between a Prompt Generator and a target LLM; a Filter prunes candidate prompts, an Evaluator judges whether the target's response satisfies the harmful goal, and the Adversary decides which conversational information to retain. The method is evaluated on Vicuna-7B, Llama2-7B, GPT-4, and Claude-3, and compared with PAIR, TAP, and GCG. The authors report that GoAT achieves up to five times the success rate of TAP on Llama2-7B, higher success on GPT-4 and Claude-3, and lower query counts, while generating human-readable prompts. The paper also includes a code repository link and a responsible disclosure statement.

Significance. If the empirical claims held, GoAT would be a useful contribution to LLM red-teaming: it is fully black-box, produces interpretable prompts, and attempts to reduce redundant queries by aggregating information across reasoning paths. The paper is also transparent about its computational costs and limitations, and it ships a code link, which supports reproducibility. However, the central performance claims are not currently substantiated because the main results table contains a direct internal contradiction, the hyperparameters were tuned on the evaluation set, and the evaluation protocol for the success-rate metric is described inconsistently. These issues affect the headline comparisons with TAP and PAIR, so the significance of the contribution cannot be assessed from the reported data.

major comments (4)
  1. [Table 2a vs Table 2b] The reported Claude-3 results for the same GoAT configuration are irreconcilable. Table 2a lists GoAT (with Vicuna as Prompt Generator) at 68% success with 109.3 average queries on Claude-3, while Table 2b's Vicuna row, which the caption describes as the same setup ('We used a simpler Prompt Generator in Table 2a'), lists 12% success with 35.9 average queries. These numbers cannot both be correct for the identical configuration, and the discrepancy also affects the query counts, which differ by roughly a factor of three. Because the paper's claim of outperforming TAP on Claude-3 depends entirely on the 68% figure (TAP is reported at 60%), the central empirical claim is unsupported until the authors explain which number is correct and why the two tables disagree.
  2. [Appendix A.4] Hyperparameters were tuned on the evaluation set. Appendix A.4 states that B, h, and d were optimized on 'a randomly selected subset of 20 examples from our dataset' and that the resulting configuration (B=3, h=3, d=10) 'was used in all our experiments.' The final reported success rates are computed on the 50-goal AdvBench subset from which this tuning subset is drawn, so the reported numbers are not obtained on a held-out test set. This selection on the evaluation data inflates the reported attack success rates and gives GoAT an unfair advantage over baselines that did not receive the same tuning. The authors should tune on a separate development set or report a model-selection procedure that is independent of the test goals.
  3. [Section 3.2 and Appendix A.2] The human-check protocol is described inconsistently. Section 3.2 states that three humans are consulted only 'whenever the Evaluator LLM's judgment is not with high confidence,' whereas Appendix A.2 states that 'we ultimately assessed the harmfulness of all other responses using three human annotators, with the final results determined by majority voting.' These two procedures will in general yield different success rates, and because the success rate is the paper's central metric, the authors must specify exactly which protocol was used and report human-annotation results or agreement statistics. Without this, the validity of the Evaluator, and hence of every reported success rate, is not firmly established.
  4. [Table 4 vs Table 2a] The parameter-tuning experiments in Table 4, run with GPT-3.5-Turbo as Filter and Evaluator and Vicuna-7B as Target, report a success rate of 35% for the configuration B=3, h=3, d=10, yet Table 2a reports a 98% success rate for the same target model with the same graph configuration. The only apparent difference is the switch to GPT-4 for Filter and Evaluator. This extreme sensitivity to the attacker-side evaluation model should be quantified and discussed; otherwise the reported gains may be driven by the choice of Evaluator rather than by the graph-based reasoning that is the paper's claimed contribution.
minor comments (5)
  1. [Appendix A.1] The phrase 'apple for apple' should be 'apples to apples'.
  2. [Table 2b caption] The sentence 'We used a simpler Prompt Generator in Table 2a, and that makes our attacks stronger, as more advanced models are more expensive to run' is confusing and appears to contradict the comparison intended by the table; please clarify which Prompt Generator was used for each row and why a simpler generator is said to make attacks stronger.
  3. [Section 3.2] The sentence 'The weaker LLMs we use in these roles the stronger an attack is' is grammatically incomplete and logically unclear; please rephrase it.
  4. [Algorithm 1] The parameter d is described both as a 'maximum graph diameter' in the algorithm's Require list and as the number of top leaves kept on line 14; the relation between these two notions should be clarified.
  5. [Table 2a] The GCG row reports '256K' for query counts, but the text in Appendix A.2 notes that this number reflects optimization steps rather than direct LLM queries; this distinction should be indicated in the table itself.

Circularity Check

1 steps flagged · score 4.0 of 10

Partial circularity: hyperparameters were tuned on 20 goals drawn from the same 50-goal evaluation subset later used for the headline success rates; no self-citation chain or construction-level collapse.

  1. fitted input called prediction [Appendix A.4 'Parameter Tuning for Attack Configuration'; reported results in Section 4.2, Table 2a]
    "We ran evaluations on a randomly selected subset of 20 examples from our dataset. After testing different combinations, we found that the best results came from using: B = 3, h = 3, d = 10. This setting gave the best trade-off between performance and efficiency. We used this configuration in all our experiments."

    Appendix A.3 defines the evaluation dataset as a 50-sample subset of AdvBench, and Appendix A.4 tunes B, h, and d on 'a randomly selected subset of 20 examples from our dataset'—that is, 20 of the very 50 goals on which Table 2a reports the headline success rates (Llama2-7B 20%, GPT-4 94%, Claude-3 68%). The reported numbers are therefore not a clean test of a pre-specified configuration: the configuration was selected precisely to maximize success on 40% of the evaluation goals. The 'prediction' that GoAT outperforms PAIR and TAP is partly an artifact of fitting to the test set, since the comparison on the tuning goals is not independent.

full rationale

The paper's contribution is an empirical attack method rather than a formal derivation, so the circularity analysis focuses on whether the reported measurements are produced by the paper's own inputs. The main circular element is the hyperparameter tuning in Appendix A.4: B, h, and d were selected by maximizing jailbreak success on a random 20-goal sample drawn from the same 50-goal AdvBench subset used for the headline results in Table 2a, making the Llama 20%, GPT-4 94%, and Claude-3 68% figures partly fitted to the evaluation set. This is a genuine fitted-input problem, but it does not reduce the central claim by construction: the attack must still generate prompts at test time, the comparison to PAIR/TAP uses the same shared subset, and 30 of the 50 goals were not used in tuning. No load-bearing self-citation chain is present, and the Graph-of-Thoughts framework is cited from external prior work (Besta et al.), so there is no imported uniqueness or ansatz-by-self-citation. The internal contradiction between Table 2a (68% Claude-3, 109.3 queries) and Table 2b (12% Claude-3, 35.9 queries for the Vicuna generator) and the inconsistent human-check descriptions (Section 3.2 vs Appendix A.2) are serious correctness and validity risks, but they are consistency problems rather than circular reductions. Similarly, using a GPT-4 Evaluator for a GPT-4 target raises evaluation-independence concerns without making the success rate equal to the evaluator's design by construction. The score reflects the single fitted-input step while acknowledging the independent content in the method and the non-tuning portion of the evaluation.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The paper's results rest on several unverified premises: LLM judges reliably measure jailbreak success, the GoT framework transfers to adversarial prompt generation, the AdvBench 50-goal subset is representative, and the baseline results (PAIR, TAP, GCG) are faithfully reproduced. The disclosed hyperparameters were fit to the same benchmark, which adds dependence on these premises.

free parameters (6)
  • B (branching factor) = 3
    Selected by tuning on a 20-goal subset (Appendix A.4).
  • h (conversational history depth) = 3
    Selected by tuning on a 20-goal subset (Appendix A.4).
  • d (max graph diameter / top leaves) = 10
    Selected by tuning on a 20-goal subset (Appendix A.4).
  • N (max iterations) = 10
    Set in Section 4.1 without tuning rationale.
  • r (filter relevance threshold) = not reported
    Used in Algorithm 1 line 8; the actual value is not given.
  • s (evaluator success threshold) = not reported
    Used in Algorithm 1 line 19; the actual value is not given.
assumptions (4)
  • domain assumption The Graph of Thoughts framework can be instantiated for adversarial prompt generation using conversational history as graph nodes.
    Section 3.2 assumes this transfer works; no proof or prior evidence beyond GoT's general problem-solving.
  • domain assumption GPT-4-based Filter and Evaluator with the described human-check protocol provide accurate relevance and harmfulness judgments.
    Section 3.2 and Appendix A.2 rely on these judgments to compute success rates; the human-check protocol is described inconsistently.
  • domain assumption The 50-goal AdvBench subset is a representative benchmark for comparing jailbreak attacks.
    Appendix A.3 justifies the subset based on prior work, but it is the same subset used for tuning and evaluation.
  • domain assumption The baseline implementations of PAIR, TAP, and GCG are reproduced faithfully and compared under equal conditions.
    Section 4.1 and Appendix A.4 state this assumption; the paper reproduces GCG itself but does not provide implementation details for PAIR/TAP.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Graph of Attacks: Improved Black-Box and Interpretable Jailbreaks for LLMs." pith.science (2026). https://pith.science/paper/6CM4TPSW

@misc{pith2026250419019,
  author       = {Pith},
  title        = {Pith review of: Graph of Attacks: Improved Black-Box and Interpretable Jailbreaks for LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6CM4TPSW}},
  note         = {Machine review of arXiv:2504.19019}
}
read the original abstract

The challenge of ensuring Large Language Models (LLMs) align with societal standards is of increasing interest, as these models are still prone to adversarial jailbreaks that bypass their safety mechanisms. Identifying these vulnerabilities is crucial for enhancing the robustness of LLMs against such exploits. We propose Graph of ATtacks (GoAT), a method for generating adversarial prompts to test the robustness of LLM alignment using the Graph of Thoughts framework [Besta et al., 2024]. GoAT excels at generating highly effective jailbreak prompts with fewer queries to the victim model than state-of-the-art attacks, achieving up to five times better jailbreak success rate against robust models like Llama. Notably, GoAT creates high-quality, human-readable prompts without requiring access to the targeted model's parameters, making it a black-box attack. Unlike approaches constrained by tree-based reasoning, GoAT's reasoning is based on a more intricate graph structure. By making simultaneous attack paths aware of each other's progress, this dynamic framework allows a deeper integration and refinement of reasoning paths, significantly enhancing the collaborative exploration of adversarial vulnerabilities in LLMs. At a technical level, GoAT starts with a graph structure and iteratively refines it by combining and improving thoughts, enabling synergy between different thought paths. The code for our implementation can be found at: https://github.com/GoAT-pydev/Graph_of_Attacks.

Figures

Figures reproduced from arXiv: 2504.19019 by the authors.

Figure 1
Figure 1. Overview of our black-box attack method. The right side presents the overall structure of GOAT, consist￾ing of the Adversary component, which oversees the conversational history to ensure structured reasoning. The left side depicts the expansion of reasoning paths and the construction of new nodes. Each iteration follows a four-step process: (I) Prompt Generator produces new candidate prompts, (II) Filter evaluates … view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

26 extracted references · 10 canonical work pages

  1. [3]

    URL https://link.springer.com/article/10.1007/s11948-022-00364-7

    doi: 10.1007/ s11948-022-00364-7. URL https://link.springer.com/article/10.1007/s11948-022-00364-7 . Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting program- matic behavior of llms: Dual-use through standard security attacks,

    work page doi:10.1007/s11948-022-00364-7

  2. [5]

    doi: 10.18653/v1/2023.findings-emnlp.932

    Association for Computational Linguistics. doi: 10.18653/v1/2023.findings-emnlp.932. URL https://aclanthology.org/ 2023.findings-emnlp.932. Miles Brundage, Shahar Avin, Jack Clark, Helen Toner, Peter Eckersley, Ben Garfinkel, Allan Dafoe, Paul Scharre, Thomas Zeitzoff, Bobby Filar, Hyrum Anderson, Heather Roff, Gregory C. Allen, Jacob Steinhardt, Carrick ...

    doi:10.18653/v1/2023.findings-emnlp.932 2023

  3. [6]

    URL https://lmsys.org/blog/2023-03-30-vicuna/ . Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia ...

    work page 2023

  4. [7]

    doi: 10.18653/v1/2023.acl-long.754

    Association for Computa- tional Linguistics. doi: 10.18653/v1/2023.acl-long.754. URL https://aclanthology.org/2023.acl-long

    doi:10.18653/v1/2023.acl-long.754 2023

  5. [8]

    Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh

    URL https://proceedings.neurips.cc/paper_files/paper/2022/file/ b1efde53be364a73914f58805a001731-Paper-Conference.pdf. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. Universal adversarial triggers for attacking and analyzing nlp. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors, Proceedings of the 2019 Conference ...

    work page 2022

  6. [11]

    doi: 10.18653/v1/D19-1461

    Association for Computational Linguistics. doi: 10.18653/v1/D19-1461. URL https://aclanthology.org/D19-1461. Marco Tulio Ribeiro, Tongshuang Wu, Carlos Guestrin, and Sameer Singh. Beyond accuracy: Behavioral testing of nlp models with checklist. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault, editors, Proceedings of the 58th Annual Meet...

    doi:10.18653/v1/d19-1461

  7. [13]

    doi: 10.18653/v1/2021.naacl-main.235

    Association for Computational Linguistics. doi: 10.18653/v1/2021.naacl-main.235. URL https://aclanthology.org/2021.naacl-main.235. Chuan Guo, Alexandre Sablayrolles, Herv ´e J´egou, and Douwe Kiela. Gradient-based adversarial attacks against text transformers,

    doi:10.18653/v1/2021.naacl-main.235 2021

  8. [14]

    Reid Pryzant, Dan Iter, Jerry Li, Yin Lee, Chenguang Zhu, and Michael Zeng

    URL https: //proceedings.mlr.press/v202/jones23a.html. Reid Pryzant, Dan Iter, Jerry Li, Yin Lee, Chenguang Zhu, and Michael Zeng. Automatic prompt optimization with ”gradient descent” and beam search. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing , pages 7957–...

    work page 2023

Show all 26 references
  1. [15]

    doi: 10.18653/v1/2023.emnlp-main.494

    Association for Computational Linguistics. doi: 10.18653/v1/2023.emnlp-main.494. URL https: //aclanthology.org/2023.emnlp-main.494. Taylor Shin, Yasaman Razeghi, Robert L. Logan IV , Eric Wallace, and Sameer Singh. Autoprompt: Eliciting knowledge from language models with auto...

    2023 doi

  2. [16]

    doi: 10.18653/v1/2020.emnlp-main.346

    Association for Computational Linguistics. doi: 10.18653/v1/2020.emnlp-main.346. URL https://aclanthology.org/2020.emnlp-main.346. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned...

    2020 doi

  3. [17]

    Chain-of-thought prompting elicits reasoning in large language models

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, brian ichter, Fei Xia, Ed Chi, Quoc V Le, and Denny Zhou. Chain-of-thought prompting elicits reasoning in large language models. In S. Koyejo, S. Mohamed, A. Agar- wal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in...

    2022

  4. [18]

    Sean Wu, Michael Koo, Lesley Blum, Andy Black, Liyo Kao, Fabien Scalzo, and Ira Kurtz

    URL https://proceedings.neurips.cc/paper_files/paper/2023/ file/271db9922b8d1f4dd7aaef84ed5ac703-Paper-Conference.pdf. Sean Wu, Michael Koo, Lesley Blum, Andy Black, Liyo Kao, Fabien Scalzo, and Ira Kurtz. A comparative study of open-source large language models, gpt-4 and cla...

    2023

  5. [20]

    Walker Spider

    URL https://arxiv.org/abs/2502.12893. Walker Spider. Dan is my new friend. https://www.reddit.com/r/ChatGPT/comments/zlcyr9/dan_is_my_ new_friend/,

    arXiv

  6. [21]

    cc/paper_files/paper/2023/file/fd6613131889a4b656206c50a8bd7790-Paper-Conference.pdf

    URL https://proceedings.neurips. cc/paper_files/paper/2023/file/fd6613131889a4b656206c50a8bd7790-Paper-Conference.pdf. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. How johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge...

    2023

  7. [22]

    doi: 10.18653/v1/2024.acl-long.773

    Association for Computational Linguistics. doi: 10.18653/v1/2024.acl-long.773. URL https://aclanthology.org/2024.acl-long.773/. Murray Shanahan, Kyle McDonell, and Laria Reynolds. Role-play with large language models,

    2024 doi

  8. [23]

    Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving

    URL https: //doi.org/10.1038/s41586-023-06647-8 . Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models. In Yoav Goldberg, Zornitsa Kozareva, and Yue ...

    doi

  9. [24]

    doi: 10.18653/v1/2022.emnlp-main.225

    Association for Computational Linguistics. doi: 10.18653/v1/2022.emnlp-main.225. URL https://aclanthology.org/2022.emnlp-main.225/. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models. In The Twelf...

    2022 doi

  10. [26]

    15 Graph of Attacks A PREPRINT Appendices A Detailed Overview of Models and Metrics In this appendix, we provide a comprehensive description of the models and evaluation metrics utilized in our study. A.1 Models Our primary goal in this work is to show that the Graph of Though...

    2023

  11. [2018]

    doi: 10.18653/v1/P18-2006

    Association for Computational Linguistics. doi: 10.18653/v1/P18-2006. URL https://aclanthology.org/P18-2006/. OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, R...

    2006 doi

  12. [2019]

    doi: 10.18653/v1/D19-1221

    Association for Computational Linguistics. doi: 10.18653/v1/D19-1221. URL https://aclanthology.org/D19-1221. Klas Leino, Zifan Wang, and Matt Fredrikson. Globally-robust neural networks. In Marina Meila and Tong Zhang, editors, Proceedings of the 38th International Conference ...

    doi

  13. [2020]

    doi: 10.18653/v1/2020.acl-main.442

    Association for Computational Linguistics. doi: 10.18653/v1/2020.acl-main.442. URL https://aclanthology. org/2020.acl-main.442. Jing Xu, Da Ju, Margaret Li, Y-Lan Boureau, Jason Weston, and Emily Dinan. Bot-adversarial dialogue for safe conversational agents. In Kristina Touta...

    2020 doi

  14. [2021]

    press/v139/leino21a.html

    URL https://proceedings.mlr. press/v139/leino21a.html. Emily Dinan, Samuel Humeau, Bharath Chintagunta, and Jason Weston. Build it break it fix it for dialogue safety: Robustness from adversarial human attack. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors, ...

    2019

  15. [2022]

    doi: 10.18653/v1/ 2022.acl-short.94

    Association for Computational Linguistics. doi: 10.18653/v1/ 2022.acl-short.94. URL https://aclanthology.org/2022.acl-short.94. Christian Reuter, Thea Riebe, and Stefka Schmid. Dual-use and trustworthy? a mixed methods analysis of ai dif- fusion between civilian and defense r&...

    2022 doi

  16. [2023]

    Thorny roses: Investigating the dual use dilemma in natural language processing

    Lucie-Aimee Kaffee, Arnav Arora, Zeerak Talat, and Isabelle Augenstein. Thorny roses: Investigating the dual use dilemma in natural language processing. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Findings of the Association for Computational Linguistics: EMNLP 2023...

    2023

  17. [2024]

    URL https://ojs.aaai.org/index.php/AAAI/ article/view/29720

    doi: 10.1609/aaai.v38i16.29720. URL https://ojs.aaai.org/index.php/AAAI/ article/view/29720. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Kaplan, Harri Ed- wards, Yuri Burda, Nicholas Joseph, Greg Brockman, Alex Ray, Raul Puri, Gret...

    doi

  18. [2025]

    Martin Kuo, Jianyi Zhang, Aolin Ding, Qinsi Wang, Louis DiValentin, Yujia Bao, Wei Wei, Hai Li, and Yiran Chen

    URL https:// arxiv.org/abs/2501.18638. Martin Kuo, Jianyi Zhang, Aolin Ding, Qinsi Wang, Louis DiValentin, Yujia Bao, Wei Wei, Hai Li, and Yiran Chen. H-cot: Hijacking the chain-of-thought safety reasoning mechanism to jailbreak large reasoning models, including openai o1/o3, ...

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.