Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

Adversarial Suffix Filtering: a Defense Pipeline for LLMs

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adversarial suffixes can be detected and removed before they reach an LLM.

desk verdict A genuinely useful lightweight suffix-filtering defense, undermined by an abstract claim its own Table 1 contradicts and an in-distribution evaluation; still worth refereeing with major revisions. read the letter →

arxiv 2505.09602 v1 pith:7LV22XA5 submitted 2025-05-14 cs.LG cs.CR

David Khachaturov , Robert Mullins This is my paper · ORCID
classification cs.LGcs.CR
keywords adversarialsuffixesjailbreakdefensepromptsanitizationtextsegmentationBERTclassifierattacksuccessratemodel-agnosticLLMsafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that the leading suffix-style jailbreak family can be neutralized at the prompt boundary, before the LLM ever sees the attack. The proposed ASF pipeline splits each prompt into sentence-like segments, uses a fine-tuned BERT classifier to flag segments that look like adversarial suffix material, and then deletes those segments or raises a warning. The headline claim is that this cuts the attack success rate of state-of-the-art suffix generators to below 4 percent while barely affecting normal-task accuracy. The paper's own per-model numbers show the effect is not uniform: Llama-2 drops to 1.8-4.0 percent and GPT-4 to 3.9 percent, but GPT-3.5-0125 remains at 16.9 percent. If the general approach holds, any aligned model could be cheaply guarded against current suffix attacks without retraining or internal access.

What carries the argument

The load-bearing machinery is the two-stage ASF pipeline: Segment-any-Text with the 12l-SM variant splits the input into sentence-like segments even without reliable punctuation, and a fine-tuned bert-base-uncased classifier labels each segment as benign or part of an adversarial suffix. Two post-processing heuristics carry the rest: a gap-bridging rule flips isolated single-segment anomalies to match their neighbors, and a small keyword-exclusion list (default 'question', 'answer') overrides false positives. Finally, flagged segments are deleted before reconstruction, or an exception is raised in warn mode. What makes the argument run is the assumption that suffix material has a learnable signature distinct from natural prompts, so classification after segmentation is sufficient to locate the attack boundary.

What would settle it

Hold out a suffix-generation method that was not part of training, for example a fresh transformer-based suffix generator or GCG-style suffixes optimized against the filter itself, and measure the post-filter attack success rate on AdvBench and MaliciousInstruct; if that rate stays near the attack's original success rather than dropping to a few percent, the central claim fails. The paper's reported GPT-3.5-0125 result of 16.9% after filtering is a concrete reproducible datum that any re-run can check first.

Watch

Extended reading notes

Core claim

The central discovery is that adversarially crafted suffixes form a detectable textual class: despite looking like gibberish, they are separable from benign prompt text by a lightweight segment-level classifier. The paper trains a BERT model on 419,429 suffixes from the GCG, AmpleGCG, and AmpleGCG-plus attack families paired with ordinary Alpaca instructions, then applies it after a robust punctuation-independent segmentation step. In the paper's end-to-end evaluation, post-sanitization attack-success rates fall from 81.1% to 1.8% and from 93.1% to 4.0% on Llama-2-7b-chat, from 92.1% to 16.9% on GPT-3.5-0125, and from 18.4% to 3.9% on GPT-4-0613; the AIR and AID repeat-suffix bypass variants fall to 18% and 16% on GPT-3.5 and to 0% on GPT-4. The classifier reaches 98.4% F1 on the held-out synthetic segments, and benign-task accuracy shifts are mostly within a few points. The paper's own conclusion is that suffix attacks can be defeated as a class by input sanitization rather than by hardening the model.

Load-bearing premise

The defense only works if the suffix arriving at runtime looks like the suffixes used to train the detector; a different attack family or a natural-language suffix such as the reported 'involves grammar' example may not be recognized, and the paper does not measure how much performance would drop.

Editorial extensions

If this is right

  • Any aligned model, including closed API models, can be protected from suffix jailbreaks without access to weights or architecture.
  • The target model's inference budget is unchanged: the same forward passes, token consumption, and memory, with only a single lightweight pass over the input.
  • ASF can act as a cheap front-stage trigger that escalates suspicious prompts to heavier certified defenses, matching a layered defense model.
  • It covers the AIR and AID repeat-suffix tricks that evade perplexity-based detectors, because those tricks still leave a segment-level signature.
  • Because the defense works by deletion, imperfect segmentation can over-remove text or reject benign prompts, which is why the configurable warn mode and heuristics exist.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The reported reductions should be read as non-adaptive: an adversary who can query or approximate the BERT filter could tailor suffixes to look benign, an evaluation the paper does not run.
  • The 'involves grammar' failure marks the likely boundary of the current method: grammatical natural-language continuations are not gibberish, so a classifier built on gibberish signatures may miss them; a semantic or instruction-consistency signal would be the natural supplement.
  • Since training and test suffixes come from the same generator family, the numbers quantify in-distribution robustness; the open question is how quickly performance decays as the suffix distribution drifts, which could be tested by retraining on a new generator family and re-measuring attack success rate.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Adversarial Suffix Filtering (ASF), a preprocessing defense for LLMs that splits incoming prompts into sentence-like segments using Segment-any-Text, classifies each segment with a fine-tuned BERT model, applies post-processing heuristics, and removes segments identified as part of an adversarial suffix before the prompt reaches the target LLM. The authors claim that ASF reduces the attack success rate of state-of-the-art suffix attacks to below 4% across black-box and white-box settings while minimally affecting non-adversarial performance. They evaluate ASF on MaliciousInstruct and AdvBench against suffixes generated by AmpleGCG and AmpleGCG-plus models, and they measure utility on TruthfulQA, GSM8k, ARC-c, HellaSwag, and WinoGrande using Mistral-7B, Llama-3.1-8B, and GPT-4.1-mini.

Significance. If the central claim held, ASF would be a practical, lightweight, model-agnostic defense against one of the most prominent jailbreak families, requiring only about 387M parameters and 1.7GB GPU memory and no access to the target model's internals. The pipeline design is simple and the reported results show large ASR reductions on several models (e.g., Llama-2-7b-chat ASR from 81.1% to 1.8%; GPT-4-0613 from 18.4% to 3.9%). However, the headline 'below 4%' claim is directly contradicted by the paper's own GPT-3.5 measurements, the evaluation is in-distribution relative to the training data, no adaptive or out-of-distribution attacks are tested, and the claimed white-box coverage is not actually evaluated. The contribution is therefore plausible but substantially narrower than advertised; the significance will depend on re-scoping the claims and adding supporting evidence.

major comments (4)
  1. [Abstract and Table 1] The abstract states that ASF reduces the attack efficacy of state-of-the-art suffix generation methods to below 4%, but Table 1a reports GPT3.5-0125 ASR' = 16.9% and Table 1b reports AIR ASR' = 18.0% and AID ASR' = 16.0% for GPT-3.5; additionally, Llama-2-7b-chat (+) in Table 1a has ASR' = 4.0%, which is not below 4%. The headline quantitative claim is therefore contradicted by the paper's own reported measurements. The abstract should be revised to present per-model results or the experiments should be extended to support the aggregate claim.
  2. [Sections 2 and 3.1] The classifier is trained on suffixes from the Liao and Sun dataset [3] and AmpleGCG-plus [22], and the adversarial evaluation uses two AmpleGCG and two AmpleGCG-plus variants from the same generator family. The measured ASR reduction is therefore an in-distribution result for that suffix family. Section 4.1 acknowledges that ASF is specialized to suffix-style attacks, and the 'involves grammar' GPT-3.5 example in Section 3.1 shows a short natural-language suffix bypassing the filter. To support any generalization claim, the paper needs either held-out attack families, adaptive attacks, or an explicit scope restriction in the abstract and conclusions.
  3. [Section 3.1 and threat model] The paper claims ASF is effective 'across both black-box and white-box attack settings,' but no white-box attack against the target models is actually run. All suffixes are generated by AmpleGCG/AmpleGCG-plus models and then tested on targets; this does not constitute a white-box attack that optimizes suffixes with access to the target model's gradients. Please either add such an experiment or remove the white-box coverage claim from the abstract and Section 1.
  4. [Table 2 and Section 3.2] The non-adversarial evaluation reports no confidence intervals, standard deviations, or repeated runs. Some accuracy deltas are nontrivial (e.g., WinoGrande -5.1% for Llama-8B, HellaSwag -3.4% for Llama-8B and -3.0% for Mistral-7B), and the text asserts these are within generation stochasticity without providing variance estimates. Please report error bars or repeated-run statistics, or explicitly frame Table 2 as a single-run exploratory check rather than evidence of no degradation.
minor comments (5)
  1. [Algorithm 1 and Section 2] The parameter names 'Bridge isolated 0s between 1s' and 'Bridge isolated 1s between 0s' are confusing relative to the text: the default-on rule flips a 1 surrounded by 0s to 0, which is described as bridging isolated 1s. Please rename the parameters to match the described behavior or clarify the wording.
  2. [Section 2, Datasets] The sentence 'making use that we include all of the data in the pair generation process' is grammatically unclear; please rephrase it to explain how the prompt-suffix pairs are generated.
  3. [Section 3.1, 'involves grammar' example] The reported adversarial prompt contains garbled text ('Rem requested AleksomeWebView]. Write starting Colse ...') that appears to be an OCR artifact; please provide the exact suffix and quote it cleanly so the failure mode is reproducible.
  4. [Table 2 captions] The subcaptions 'generate_untiltasks' and 'loglikelihoodtasks' are missing spaces; they should read 'generate_until tasks' and 'log-likelihood tasks'.
  5. [Section 3.1 ASR definition] The paper credits the ASR success criterion to Kumar et al. [22] but evaluates with HarmBench-cls [25]; please clarify the relationship between the AmpleGCG-plus beam-based definition and the HarmBench classifier, and state the exact threshold and classifier used.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity; the defense is an empirical supervised classifier evaluated on held-out suffixes and unseen harmful prompts, with no self-citation chain or construction-level equivalence.

full rationale

ASF is an empirical defense, not a derived result: a BERT segment classifier is fine-tuned on synthetic prompt-suffix pairs (benign Alpaca prompts combined with GCG/AmpleGCG/AmpleGCG-plus suffixes), and the reported ASR reduction is measured by generating fresh suffixes with the same attack family on held-out MaliciousInstruct and AdvBench prompts and passing them through the pipeline to target LLMs. There is no equation in the paper that defines the predicted quantity in terms of the fitted parameters: the classifier is trained on segment labels, while the headline 'below 4%' is a summary of Table 1 measurements on downstream jailbreak success. The paper reserves MaliciousInstruct and AdvBench from training and evaluates on unseen prompts and target models, giving the central claim independent empirical content. References [3] and [22] are external works, not self-citations by the present authors, and no uniqueness theorem or ansatz is imported from the authors' prior work. The genuine weaknesses are (a) the evaluation suffixes come from the same generator family as the training suffixes, so generalization to novel attack families is untested, and (b) the abstract's 'below 4%' is internally contradicted by Table 1, which reports GPT-3.5 ASR' values of 16.9% (full dataset), 18.0% (AIR), and 16.0% (AID). Those are correctness and scoping problems, not circularity: the measurements are not equal to the training objective by construction, and no claim reduces to its own input. Under the stated evidence bar, no circular step can be exhibited.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The defense rests on the in-distribution assumption that the BERT classifier is trained on the same attack family used for evaluation, plus three hand-tuned post-processing parameters. The pipeline itself adds no new entities or formal axioms.

free parameters (3)
  • bridge_isolated_1_between_0 = true (default)
    Hand-set post-processing rule that flips an isolated malicious label between benign labels to benign, reducing false positives. Set in Algorithm 1.
  • bridge_isolated_0_between_1 = false (default)
    Hand-set post-processing rule, default off, that would bridge benign segments between malicious ones. Set in Algorithm 1.
  • keyword_exclusion_list = ['question', 'answer']
    Hard-coded list that overrides classifier labels from malicious to benign for exact case-agnostic matches. Reduces false positives.
assumptions (4)
  • domain assumption The user's original prompt is benign; the only adversarial content is the appended suffix.
    Threat model in Section 2 and Figure 1; justifies deleting flagged segments rather than rejecting the whole prompt.
  • domain assumption Adversarial suffixes share learnable statistical patterns with suffixes from GCG, AmpleGCG, and AmpleGCG-plus.
    Introduction states that if an LLM can be trained to produce effective suffixes, they must follow a detectable pattern; Section 2 trains BERT on these suffix families.
  • domain assumption The protected LLM is safety-aligned and will refuse harmful prompts once the suffix is removed.
    Section 2: 'The defense relies on having an aligned LLM'; Vicuna models excluded because their benign ASR is 53.5%.
  • domain assumption The segmentation model cleanly separates prompt from suffix in most cases.
    Section 2 labels mixed segments wholly malicious; Section 4.1 acknowledges imperfect segmentation can remove extra text.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Suffix Filtering: a Defense Pipeline for LLMs." pith.science (2026). https://pith.science/paper/7LV22XA5

@misc{pith2026250509602,
  author       = {Pith},
  title        = {Pith review of: Adversarial Suffix Filtering: a Defense Pipeline for LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7LV22XA5}},
  note         = {Machine review of arXiv:2505.09602}
}
abstract

Large Language Models (LLMs) are increasingly embedded in autonomous systems and public-facing environments, yet they remain susceptible to jailbreak vulnerabilities that may undermine their security and trustworthiness. Adversarial suffixes are considered to be the current state-of-the-art jailbreak, consistently outperforming simpler methods and frequently succeeding even in black-box settings. Existing defenses rely on access to the internal architecture of models limiting diverse deployment, increase memory and computation footprints dramatically, or can be bypassed with simple prompt engineering methods. We introduce $\textbf{Adversarial Suffix Filtering}$ (ASF), a lightweight novel model-agnostic defensive pipeline designed to protect LLMs against adversarial suffix attacks. ASF functions as an input preprocessor and sanitizer that detects and filters adversarially crafted suffixes in prompts, effectively neutralizing malicious injections. We demonstrate that ASF provides comprehensive defense capabilities across both black-box and white-box attack settings, reducing the attack efficacy of state-of-the-art adversarial suffix generation methods to below 4%, while only minimally affecting the target model's capabilities in non-adversarial scenarios.

Figures

Figures reproduced from arXiv: 2505.09602 by the authors.

Figure 1
Figure 1. An overview of the Adversarial Suffix Filtering pipeline. For the segmentation model, we employ Segment Any Text [5], and use bert-base-uncased [6] as the BERT classifica￾tion model. The unsanitized prompt features a GCG [4] generated adversarial suffix parish sentenceochasticamplesAAona>llesStation... that jailbreaks the aligned LLM and allows it to causes harmful content. After sanitization, the adversarial suffix… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Robust Critics: Defending LLMs Against Multi-Turn Attacks

    cs.AI 2026-05 conditional novelty 6.0 of 10

    Critic-weighted sampling over inferred user intents improves multi-turn LLM defense success while preserving helpfulness, with an expected-Q improvement guarantee and transfer to frontier models.

Reference graph

Works this paper leans on

29 extracted references · 4 canonical work pages · cited by 1 Pith paper

  1. [3]

    Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms, 2024

    Zeyi Liao and Huan Sun. Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms, 2024. URL https://arxiv. org/abs/2404.07921

    arXiv 2024

  2. [22]

    Amplegcg-plus: A strong generative model of adversarial suffixes to jailbreak llms with higher success rates in fewer attempts, 2024

    Vishal Kumar, Zeyi Liao, Jaylen Jones, and Huan Sun. Amplegcg-plus: A strong generative model of adversarial suffixes to jailbreak llms with higher success rates in fewer attempts, 2024. URLhttps://arxiv.org/abs/2410.22143

    arXiv 2024

  3. [1]

    A comprehensive study of jailbreak attack versus defense for large language models, 2024

    Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. A comprehensive study of jailbreak attack versus defense for large language models, 2024. URLhttps://arxiv.org/ abs/2402.13457

    arXiv 2024

  4. [2]

    Llm01:2025 prompt injection, Apr 2025

    OWASP. Llm01:2025 prompt injection, Apr 2025. URL https://genai.owasp.org/ llmrisk/llm01-prompt-injection/

    work page 2025

  5. [4]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023. URL https: //arxiv.org/abs/2307.15043

    arXiv 2023

  6. [5]

    Segment any text: A universal approach for robust, efficient and adaptable sentence segmentation

    Markus Frohmann, Igor Sterner, Ivan Vuli´c, Benjamin Minixhofer, and Markus Schedl. Segment any text: A universal approach for robust, efficient and adaptable sentence segmentation. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors,Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 11908–11941, Miami,...

    work page 2024

  7. [6]

    BERT: pre-training of deep bidirectional transformers for language understanding.CoRR, abs/1810.04805, 2018

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: pre-training of deep bidirectional transformers for language understanding.CoRR, abs/1810.04805, 2018. URL http://arxiv.org/abs/1810.04805

    arXiv 2018

  8. [7]

    Certifying llm safety against adversarial prompting, 2025

    Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Aaron Jiaxun Li, Soheil Feizi, and Himabindu Lakkaraju. Certifying llm safety against adversarial prompting, 2025. URL https://arxiv. org/abs/2309.02705

    arXiv 2025

Show all 29 references
  1. [8]

    Towards deep learning models resistant to adversarial attacks, 2019

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019. URL https://arxiv. org/abs/1706.06083

    2019 arXiv

  2. [9]

    Adversarial training: A survey, 2024

    Mengnan Zhao, Lihe Zhang, Jingwen Ye, Huchuan Lu, Baocai Yin, and Xinchao Wang. Adversarial training: A survey, 2024. URLhttps://arxiv.org/abs/2410.15042

    2024 arXiv

  3. [10]

    Efficient adversarial training in llms with continuous attacks, 2024

    Sophie Xhonneux, Alessandro Sordoni, Stephan Günnemann, Gauthier Gidel, and Leo Schwinn. Efficient adversarial training in llms with continuous attacks, 2024. URL https://arxiv. org/abs/2405.15589

    2024 arXiv

  4. [11]

    Robust llm safeguarding via refusal feature adversarial training, 2025

    Lei Yu, Virginie Do, Karen Hambardzumyan, and Nicola Cancedda. Robust llm safeguarding via refusal feature adversarial training, 2025. URLhttps://arxiv.org/abs/2409.20089

    2025 arXiv

  5. [12]

    Fine-tuning language models with generative adversarial reward modelling, 2024

    Zhang Ze Yu, Lau Jia Jaw, Zhang Hui, and Bryan Kian Hsiang Low. Fine-tuning language models with generative adversarial reward modelling, 2024. URL https://arxiv.org/abs/ 2305.06176

    2024 arXiv

  6. [13]

    Struq: Defending against prompt injection with structured queries, 2024

    Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. Struq: Defending against prompt injection with structured queries, 2024. URLhttps://arxiv.org/abs/2402.06363

    2024 arXiv

  7. [14]

    Safedecoding: Defending against jailbreak attacks via safety-aware decoding, 2024

    Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Pooven- dran. Safedecoding: Defending against jailbreak attacks via safety-aware decoding, 2024. URL https://arxiv.org/abs/2402.08983. 10

    2024 arXiv

  8. [15]

    Enhancing chat language models by scaling high-quality instructional conversations, 2023

    Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Zhi Zheng, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. Enhancing chat language models by scaling high-quality instructional conversations, 2023. URLhttps://arxiv.org/abs/2305.14233

    2023 arXiv

  9. [16]

    Alexander Robey, Eric Wong, Hamed Hassani, and George J. Pappas. Smoothllm: Defending large language models against jailbreaking attacks, 2024. URL https://arxiv.org/abs/ 2310.03684

    2024 arXiv

  10. [17]

    Bergeron: Combating adversarial attacks through a conscience-based alignment framework, 2024

    Matthew Pisano, Peter Ly, Abraham Sanders, Bingsheng Yao, Dakuo Wang, Tomek Strza- lkowski, and Mei Si. Bergeron: Combating adversarial attacks through a conscience-based alignment framework, 2024. URLhttps://arxiv.org/abs/2312.00029

    2024 arXiv

  11. [18]

    Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023. URL https: //arxiv.org/abs/2312.06674

    2023 arXiv

  12. [19]

    Detecting language model attacks with perplexity, 2023

    Gabriel Alon and Michael Kamfonas. Detecting language model attacks with perplexity, 2023. URLhttps://arxiv.org/abs/2308.14132

    2023 arXiv

  13. [20]

    Baseline defenses for adversarial attacks against aligned language models, 2023

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models, 2023. URL https://arxiv. org/abs/2309.00614

    2023 arXiv

  14. [21]

    Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mari...

    2020

  15. [23]

    Hashimoto

    Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford_alpaca, 2023

    2023

  16. [24]

    Catastrophic jailbreak of open-source llms via exploiting generation.arXiv preprint arXiv:2310.06987, 2023

    Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. Catastrophic jailbreak of open-source llms via exploiting generation.arXiv preprint arXiv:2310.06987, 2023

    2023 arXiv

  17. [25]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249, 2024

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249, 2024

    2024 arXiv

  18. [26]

    The language model evaluation harness, 07 2024

    Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac’h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang S...

    2024

  19. [27]

    The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness

    Neeraj Varshney, Pavel Dolin, Agastya Seth, and Chitta Baral. The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Findings of the Association for Comput...

    2024 doi

  20. [28]

    Limitations

    J. Reason. The contribution of latent human failures to the breakdown of complex systems. Philosophical Transactions of the Royal Society of London. Series B, Biological Sciences, 327 (1241):475–484, 1990. ISSN 00804622. URLhttp://www.jstor.org/stable/55319. 12 NeurIPS Paper C...

    1990

  21. [29]

    Guidelines: • The answer NA means that the paper does not involve crowdsourcing nor research with human subjects

    Institutional review board (IRB) approvals or equivalent for research with human subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals...

    2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.