Pith. sign in

REVIEW 4 major objections 4 minor 27 references

Treating jailbreak as open-ended evolution lets an adversary crack frontier LLMs near-perfectly while co-training a guardrail that blocks 91.6% of unsafe prompts without hurting benign utility.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 11:34 UTC pith:K6ONQ2HK

load-bearing objection Genuinely new coupling of evolving jailbreak strategies with online guardrail training, but the evidence is under-specified: no code, no error bars, and the guardrail training set is never shown to be disjoint from the evaluation benchmarks. the 4 major comments →

arxiv 2607.19829 v1 pith:K6ONQ2HK submitted 2026-07-22 cs.CR

DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection

Weiwei Qi , Zefeng Wu , Zhilin Guo , Tianhang Zheng , Chaochao Lu , Liang He , Zhan Qin , Kui Ren This is my paper
classification cs.CR
keywords jailbreak attacksLLM safetyevolutionary algorithmadversarial trainingguardrailsattack-defense loopstrategy poolonline learning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that static jailbreak attacks and fixed guardrail training are fundamentally mismatched to real-world adversaries that continuously expand their attack space. To fix this, it proposes an evolving attack-defense loop: an attacker that discovers, mutates, and composes new jailbreak strategies from an ever-growing pool, and a guardrail that is retrained online on the very attacks the adversary generates. The paper reports that this co-evolution drives attack success rates to near-100% on several frontier models and guardrails (over 90% on GPT-5.5), while the guardrail reaches an average unsafe recall of 91.6% across twelve safety benchmarks and a near-100% pass rate on benign inputs. The central insight is that safety evaluation and protection must be open-ended, not one-time, and that adversarial and defensive capabilities can improve together.

Core claim

DARWIN's core discovery is that representing the jailbreak attacker as an evolving state—composed of a growing strategy pool S_t and a Markov transition matrix T_t that learns which strategy sequences work against a given target—transforms red-teaming from a fixed search into an open-ended process. By admitting only strategies that beat a sandbox aligned LLM (ASR_sb above threshold τ_sb), generating new variants through genetic crossover and self-reflection, and composing strategies adaptively after failures, DARWIN-Attack lifts attack success rates on difficult targets like Claude Sonnet 4.6 from ~30% (the best baseline) to 76.7% on HarmBench, and reaches 99.7% on DeepSeek-V4-Pro. Symmetric

What carries the argument

The load-bearing machinery is the coupled evolution loop defined by the update equations: the attacker state (A_{t+1} = S_t ∪ ΔS_t, Update(T_t, F_t)) and the guardrail update (θ_{t+1} = argmin_θ L_Guard(θ; Attack(A_{t+1}, G_{θ_t}))). The strategy pool S_t is the evolving attack space; the transition matrix T_t is a Q-learning-inspired controller that reweights strategy sequences based on failure feedback; and the sandbox gate τ_sb filters new strategies by their success against a local aligned LLM. On the defense side, the training objective combines cross-entropy on disguised adversarial samples (to correct misclassifications) with a weighted raw-prompt anchor (to preserve baseline performa

Load-bearing premise

The load-bearing premise is that strategies admitted by the local sandbox LLM (using ASR_sb with threshold τ_sb) are representative of the closed-source targets and guardrails, and that the evolving strategy pool does not overlap with the evaluation benchmarks (e.g., JailbreakHub appears both as a strategy source and as an evaluation set); if either assumption fails, the reported attack success rates could reflect sandbox overfitting or benchmark contamination rather than gen

What would settle it

A concrete test would be to run DARWIN-Attack with a strategy pool built exclusively from sources disjoint from the evaluation benchmarks, and to evaluate against a target model family never used in the sandbox filter (e.g., a new closed-source model not in the training loop). If the attack success rate drops dramatically under either condition, the evolutionary advantage would be an artifact of data overlap or sandbox overfitting. Similarly, training a static guardrail on the same raw malicious dataset without the online loop and measuring its recall on the held-out attack set would isolate w

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the loop works as claimed, static safety benchmarks substantially underestimate real-world jailbreak risk, and red-teaming should move to evolving adversaries that expand their own strategy space.
  • Guardrails trained with online adversarial updates can maintain robustness to historical attacks (no catastrophic forgetting) while improving against held-out, never-seen attack families—the paper reports ASR on a held-out set dropping from 54% to 26% as the loop progresses.
  • The very low average query counts (e.g., 2.2 on DeepSeek-V4-Pro for HarmBench) imply that an evolving strategy pool makes jailbreaking cheap enough for large-scale automated safety auditing.
  • The near-perfect benign pass rate suggests that adversarial training that includes disguised benign anchors can avoid the over-refusal trap, offering a template for future safety-alignment methods.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • This framework implies that LLM safety certification should be a continuous, deployment-time process rather than a one-time evaluation, because the attack space is open-ended and new strategies can always emerge.
  • The sandbox admission filter (τ_sb) anchored on a single aligned LLM could be the weakest transfer point; a natural testable extension is to measure how well strategies admitted by one sandbox transfer to a diverse set of targets, and to make the filter multi-model.
  • The explicit inclusion of benign disguised queries in training suggests a general design principle for robust classifiers: adversarial training should perturb both positive and negative examples to prevent spurious correlations between superficial patterns and labels.
  • The Markov-visualized composition of strategies could be adapted to other safety domains, such as detecting model-generated disinformation or adversarial multi-turn dialogue, where an evolving pool of attack patterns would similarly outpace static defenses.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes DARWIN, an evolutionary attack-defense framework for jailbreaking LLMs and training guardrails. DARWIN-Attack maintains an evolving strategy pool fed by external sources, genetic mutation, and feedback-driven composition, and selects/composes strategies using a Q-learning-inspired transition update. DARWIN-Guard performs online adversarial training on the adversarial rewrites produced by DARWIN-Attack, jointly on harmful and benign disguised queries. The paper claims state-of-the-art attack success rates on HarmBench and AdvBench against four frontier LLMs and two guardrails, and an average unsafe recall of 91.6% across 12 safety benchmarks while maintaining 100% pass rates on benign benchmarks. The core contribution is replacing static attack/defense evaluation with a closed-loop evolution process.

Significance. If the claims are substantiated, DARWIN would be a meaningful step toward dynamic safety evaluation: the idea of continuously expanding an attack-strategy pool and using the resulting adversarial samples to iteratively retrain a guardrail is timely and potentially impactful. The symmetric treatment of harmful and benign disguised queries to preserve utility is a sensible design. The paper also attempts a cross-stage evaluation with a held-out attack set, which is the right kind of evidence for generalization. However, the manuscript currently lacks the reproducibility artifacts and verification details needed to assess these contributions. The attack results are reported without variance or code, and the guardrail training/evaluation split is not shown to be disjoint. The benign pass-rate metric is saturated at ~100% for all baselines, so it does not discriminate over-refusal behavior. These gaps are material because the headline numbers cannot be independently checked and may reflect contamination or metric insensitivity rather than genuine capability.

major comments (4)
  1. [§3.3, §4.1.2, Table 2] The training set D for DARWIN-Guard is described only as 'a dataset containing harmful and benign queries' with no source or composition, and the evaluation benchmarks in Table 2 are never stated to be disjoint from D. Since several of those benchmarks (e.g., JailbreakHub, HarmBench, XSTest) are commonly used harmful-prompt collections, the 91.6% average unsafe recall could be inflated by overlap or near-duplicates between training and evaluation. This is load-bearing for the guardrail's generalization claim. The held-out attack set in §4.4 concerns strategy families, not benchmark separation. Please specify D, perform a retraining experiment excluding the 12 evaluation benchmarks, or otherwise demonstrate disjointness.
  2. [§4.3, Table 3] The benign pass-rate results are non-discriminative: every model, including all baselines, scores 100% or near-100% on all eleven benign benchmarks. This ceiling effect means the claim that DARWIN-Guard 'avoids over-refusal' is not supported by the data. The experiment needs a harder benign distribution, e.g., benign prompts that resemble jailbreak syntax, difficult safe/unsafe boundary cases, or disguised benign queries, to show meaningful differences. As written, the reported 100.0% pass rate is indistinguishable from the trivial behavior of 'always safe' on this set.
  3. [§3.2, §4.1.1] Several components of DARWIN-Attack are underspecified, preventing reproduction and verification. The sandbox filter ASR_sb uses an unspecified 'local aligned LLM' and threshold τ_sb; the external strategy sources are not identified beyond 'public platforms' and 'broad external sources'; and the genetic operations (crossover, mutation) are not defined. Without these details, a reader cannot assess whether the reported ASR improvements come from the evolutionary process or from ingesting already-successful strategies, nor whether strategies from JailbreakHub (also an evaluation benchmark) leaked into the attack pool. Please disclose the sandbox model and τ_sb, list the external source categories, and describe the genetic operators.
  4. [§4.2, Table 1, Figure 4] All quantitative results are reported as point estimates with no variance. Given the stochastic nature of LLM generation and the small number of baseline repetitions, single-run numbers are not sufficient to support claims of state-of-the-art performance, especially where margins are 10–20 points. The cross-stage cross-play matrix in Figure 4 is described qualitatively in §4.4; a full numeric matrix and the exact held-out strategy families should be reported. Please provide multiple seeds with confidence intervals or at least run-to-run ranges, and specify the query budget for each method.
minor comments (4)
  1. [Abstract] The phrase 'nearly 100%' is used repeatedly; precise numbers would be more appropriate. Also, 'an 91.6%' in §1 should be 'a 91.6%'.
  2. [§3.2] Equation (5) is called 'Q-learning inspired' but no connection to a value function or policy is given. Clarify how the transition matrix update relates to the reward and whether the normalization preserves a valid probability distribution.
  3. [§4.1.1] The query budget for each baseline is not stated in the text or table. AQC comparisons are only meaningful if all methods are given the same budget; please state the budget explicitly.
  4. [References] Several references are dated 2026, which is consistent with the arXiv stamp but may be worth checking for consistency with the actual publication timeline. No further issue.

Circularity Check

0 steps flagged

No demonstrated circularity; DARWIN-Guard's train/eval disjointness is unspecified, but that is an evidence gap, not a proven reduction.

full rationale

Walking the derivation chain, DARWIN-Attack's reported ASRs are measured on HarmBench/AdvBench against target models and guardrails; the strategy-pool evolution, sandbox ASR_sb threshold, and online feedback adaptation are the method itself, and the paper does not state that the evaluation prompts or target feedback are used to fit the reported numbers by construction. The only substantial concern is DARWIN-Guard: §3.3 says 'Let D represent a dataset containing harmful and benign queries' and then trains on disguised variants of D with Eq. (7), while §4.1.2 evaluates on twelve named harmful benchmarks (XSTest, Aegis2.0, JBB-Behaviors, HarmBench, ToxicChat, JailbreakV-RT2K, Semantic Router, BeaverTails, OpenAI Moderation, WildGuardTest, StrongREJECT, JailbreakHub). The paper never states that D is disjoint from these benchmarks, so the headline 91.6% recall could be in-sample if D overlaps them. That is a genuine omitted-disjointness/verifiability gap, but the manuscript provides no quote or equation exhibiting such overlap, so it does not meet the bar for a demonstrated circular reduction. Similarly, the §4.4 'held-out attack set ... completely excluded from the evolving training process' is claimed but not described, leaving generalization evidence incomplete without being circular. Self-citations (MAJIC, safety-critical parameters) appear only as baselines/related work and are not load-bearing. On the evidence presented, the central attack/defense derivation is not shown to be equivalent to its inputs.

Axiom & Free-Parameter Ledger

6 free parameters · 4 axioms · 0 invented entities

The primary free parameters are the hyperparameters of the evolutionary and Q-learning processes (all unspecified). The key domain assumptions are that external attack sources exist, that sandbox filtering transfers to frontier targets, and that the held-out set is genuinely disjoint. No new physical or conceptual entities are introduced; DARWIN is an algorithmic framework.

free parameters (6)
  • alpha (α)
    Q-learning update rate in Eq. (5); value unspecified.
  • gamma (γ)
    Discount factor in Eq. (5); value unspecified.
  • tau_sb (τ_sb)
    Sandbox admission threshold for strategy pool; value unspecified.
  • lambda_raw (λ_raw)
    Weight for raw-prompt loss term in Eq. (7); value unspecified.
  • N_max
    Maximum disguise attempts per sample in DARWIN-Guard training; value unspecified.
  • Strategy pool size = 50-200
    Evolutionary progress is evaluated by growing the pool from 50 to 200; final size used for reported results not explicit.
axioms (4)
  • domain assumption External sources of jailbreak strategies are available and can be automatically mined.
    The strategy pool expansion depends on collecting strategies from public platforms; if such sources are limited or not representative, the open-ended evolution claim collapses (Section 3.2).
  • domain assumption Sandbox aligned LLM is representative of target models for strategy filtering.
    Strategies are admitted only if ASR_sb(s) ≥ τ_sb on a local aligned model; transfer to closed-source targets is assumed (Section 3.2).
  • domain assumption The held-out attack set in Section 4.4 is disjoint from the training strategy distribution and captures unseen strategy families.
    Generalization of DARWIN-Guard to unseen attacks is evidenced only via this set; its construction is not described.
  • ad hoc to paper The Q-learning inspired update (Eq. 5) improves attack selection over time.
    No convergence or optimality justification is provided; it is a heuristic assumed to work.

pith-pipeline@v1.3.0-alltime-deepseek · 142 in / 11237 out tokens · 143559 ms · 2026-08-01T11:34:18.288540+00:00 · methodology

0 comments
read the original abstract

Most existing LLM safety evaluation and defense methods follow a static formulation: jailbreak vulnerabilities are evaluated with fixed attack methods, and guardrails are trained on fixed malicious prompt datasets. However, real-world adversaries continuously evolve their capabilities and expand the attack space. To address this challenge, we propose DARWIN, an evolutionary attack-defense framework that formulates jailbreaking as an open-ended evolution process and continuously updates guardrails through an evolving attack-defense loop. DARWIN-Attack is an evolutionary adversary that expands its capabilities through strategy discovery, mutation, selection, and feedback-driven composition. It collects strategies from broad external sources, generates new variants through self-reflection and genetic evolution, and retains effective strategies based on their performance against aligned LLMs. During attack execution, DARWIN-Attack adaptively selects and combines evolved strategies according to feedback from target LLMs and guardrails. Across frontier models and guardrails, it achieves state-of-the-art attack success rates, including nearly 100% on DeepSeek-V4-Pro and YuFeng-XGuard and over 90% on GPT-5.5. On the defense side, we introduce DARWIN-Guard, an online adversarial training paradigm that iteratively learns from emerging adversarial samples generated by DARWIN-Attack. To improve robustness without sacrificing utility, DARWIN-Guard jointly trains on malicious and benign disguised queries, encouraging the model to identify underlying intent rather than superficial attack patterns. DARWIN-Guard achieves an average unsafe recall of 91.6% across 12 safety benchmarks, outperforming strong guardrails such as YuFeng-XGuard and Nemotron Guard, while maintaining a nearly 100% pass rate on standard benign datasets.

Figures

Figures reproduced from arXiv: 2607.19829 by Chaochao Lu, Kui Ren, Liang He, Tianhang Zheng, Weiwei Qi, Zefeng Wu, Zhan Qin, Zhilin Guo.

Figure 1
Figure 1. Figure 1: Overview of the DARWIN framework. DARWIN-Attack evolves jailbreak adver [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Harmful Score (HS) of different jailbreak methods on HarmBench and AdvBench. As [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Unsafe recall of intermediate DARWIN-Guard checkpoints across representative safety [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Cross-stage evaluation and forward robustness. [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

27 extracted references · 12 linked inside Pith

  1. [1]

    Jailbreakbench: An open robustness benchmark for jailbreaking large language models.Advances in Neural Information Processing Systems, 37:55005–55029, 2024a

    Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. Jailbreakbench: An open robustness benchmark for jailbreaking large language models.Advances in Neural Information Processing Systems, 37:55005–55029, 2024a. Patrick Chao, Al...

    Pith/arXiv arXiv 2019

  2. [6]

    Dynaguard: A dynamic guardian model with user-defined policies.arXiv preprint arXiv:2509.02563,

    Monte Hoover, Vatsal Baherwani, Neel Jain, Khalid Saifullah, Joseph Vincent, Chirag Jain, Melissa Kazemi Rad, C Bayan Bruss, Ashwinee Panda, and Tom Goldstein. Dynaguard: A dynamic guardian model with user-defined policies.arXiv preprint arXiv:2509.02563,

    arXiv

  3. [11]

    Toxicchat: Unveiling hidden challenges of toxicity detection in real-world user-ai conversation

    Zi Lin, Zihan Wang, Yongqi Tong, Yangkun Wang, Yuxin Guo, Yujia Wang, and Jingbo Shang. Toxicchat: Unveiling hidden challenges of toxicity detection in real-world user-ai conversation. InFindings of the Association for Computational Linguistics: EMNLP 2023, pp. 4694–4702,

    2023

  4. [13]

    Autodan-turbo: A lifelong agent for strategy self-exploration to jailbreak llms

    Xiaogeng Liu, Peiran Li, G Edward Suh, Yevgeniy V orobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao. Autodan-turbo: A lifelong agent for strategy self-exploration to jailbreak llms. InInternational Conference on Learning Representa- tions, volume 2025, pp. 10313–10360, 2025a. Yue Liu, Hongcheng Gao, Shengfang Zhai, ...

    arXiv 2025

  5. [14]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249,

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249,

    Pith/arXiv arXiv

  6. [15]

    Can a suit of armor conduct elec- tricity? a new dataset for open book question answering

    Todor Mihaylov, Peter Clark, Tushar Khot, and Ashish Sabharwal. Can a suit of armor conduct elec- tricity? a new dataset for open book question answering. InProceedings of the 2018 conference on empirical methods in natural language processing, pp. 2381–2391,

    2018

  7. [16]

    Granite guardian.arXiv preprint arXiv:2412.07724,

    Inkit Padhi, Manish Nagireddy, Giandomenico Cornacchia, Subhajit Chaudhury, Tejaswini Peda- pati, Pierre Dognin, Keerthiram Murugesan, Erik Miehling, Mart ´ın Santill ´an Cooper, Kieran Fraser, et al. Granite guardian.arXiv preprint arXiv:2412.07724,

    Pith/arXiv arXiv

  8. [17]

    Majic: Markovian adaptive jailbreaking via iterative composition of diverse innovative strategies

    Weiwei Qi, Shuo Shao, Wei Gu, Tianhang Zheng, Puning Zhao, Zhan Qin, and Kui Ren. Majic: Markovian adaptive jailbreaking via iterative composition of diverse innovative strategies. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pp. 32755–32763, 2026a. Weiwei Qi, Zefeng Wu, Tianhang Zheng, Zikang Zhang, Xiaojun Jia, Zhan Qin, ...

    2026

  9. [18]

    Xstest: A test suite for identifying exaggerated safety behaviours in large language models

    Paul R¨ottger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technologies (Volume 1: Long Pape...

    2024

  10. [19]

    ” do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. ” do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models. InPro- ceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 1671–1685,

    2024

  11. [20]

    Datashield: Uncovering risky fine-tuning data across llms through consensus subspace alignment.arXiv preprint arXiv:2607.15081,

    Zefeng Wu, Weiwei Qi, Jielong Chen, Tianhang Zheng, Di Hong, Chaochao Lu, Liang He, Zhan Qin, and Kui Ren. Datashield: Uncovering risky fine-tuning data across llms through consensus subspace alignment.arXiv preprint arXiv:2607.15081,

    Pith/arXiv arXiv

  12. [21]

    Dynamic target attack.arXiv preprint arXiv:2510.02422,

    Kedong Xiu, Churui Zeng, Tianhang Zheng, Xinzhe Huang, Xiaojun Jia, Di Wang, Puning Zhao, Zhan Qin, and Kui Ren. Dynamic target attack.arXiv preprint arXiv:2510.02422,

    arXiv

  13. [22]

    Harmmetric eval: Benchmarking metrics and judges for llm harmfulness assessment.arXiv preprint arXiv:2509.24384,

    Langqi Yang, Tianhang Zheng, Yixuan Chen, Kedong Xiu, Hao Zhou, Di Wang, Puning Zhao, Zhan Qin, and Kui Ren. Harmmetric eval: Benchmarking metrics and judges for llm harmfulness assessment.arXiv preprint arXiv:2509.24384,

    arXiv

  14. [23]

    Hotpotqa: A dataset for diverse, explainable multi-hop question answering

    Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William Cohen, Ruslan Salakhutdinov, and Christopher D Manning. Hotpotqa: A dataset for diverse, explainable multi-hop question answering. InProceedings of the 2018 conference on empirical methods in natural language processing, pp. 2369–2380,

    2018

  15. [24]

    Shieldgemma: Genera- tive ai content moderation based on gemma.arXiv preprint arXiv:2407.21772,

    Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, et al. Shieldgemma: Genera- tive ai content moderation based on gemma.arXiv preprint arXiv:2407.21772,

    Pith/arXiv arXiv

  16. [25]

    org/abs/2605.29237

    URLhttps://arxiv. org/abs/2605.29237. Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text clas- sification.Advances in neural information processing systems, 28,

    Pith/arXiv arXiv

  17. [27]

    Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    13 Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    Pith/arXiv arXiv

  18. [2015]

    Qwen3guard technical report.arXiv preprint arXiv:2510.14276,

    Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, et al. Qwen3guard technical report.arXiv preprint arXiv:2510.14276,

    Pith/arXiv arXiv

  19. [2017]

    Yufeng-xguard: A reasoning-centric, interpretable, and flexible guardrail model for large language models.arXiv preprint arXiv:2601.15588,

    Junyu Lin, Meizhen Liu, Xiufeng Huang, Jinfeng Li, Haiwen Hong, Xiaohan Yuan, Yuefeng Chen, Longtao Huang, Hui Xue, Ranjie Duan, et al. Yufeng-xguard: A reasoning-centric, interpretable, and flexible guardrail model for large language models.arXiv preprint arXiv:2601.15588,

    Pith/arXiv arXiv

  20. [2018]

    Training verifiers to solve math word problems.arXiv preprint arXiv:2110.14168,

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. Training verifiers to solve math word problems.arXiv preprint arXiv:2110.14168,

    Pith/arXiv arXiv

  21. [2019]

    Think you have solved question answering? try arc, the ai2 reasoning challenge

    Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv preprint arXiv:1803.05457,

    Pith/arXiv arXiv

  22. [2020]

    Race: Large-scale reading comprehension dataset from examinations

    11 Guokun Lai, Qizhe Xie, Hanxiao Liu, Yiming Yang, and Eduard Hovy. Race: Large-scale reading comprehension dataset from examinations. InProceedings of the 2017 conference on empirical methods in natural language processing, pp. 785–794,

    2017

  23. [2021]

    A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily

    Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily. InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Paper...

    2024

  24. [2023]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. InInternational Conference on Learning Representa- tions, volume 2024, pp. 56174–56194,

    2024

  25. [2024]

    Shaona Ghosh, Prasoon Varshney, Makesh Narsimhan Sreedhar, Aishwarya Padmakumar, Traian Rebedea, Jibin Rajan Varghese, and Christopher Parisien. Aegis2. 0: A diverse ai safety dataset and risks taxonomy for alignment of llm guardrails. InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguist...

    2025

  26. [2025]

    Dualbreach: Efficient dual-jailbreaking via target-driven initialization and multi- target optimization.arXiv preprint arXiv:2504.18564,

    Xinzhe Huang, Kedong Xiu, Tianhang Zheng, Churui Zeng, Wangze Ni, Zhan Qin, Kui Ren, and Chun Chen. Dualbreach: Efficient dual-jailbreaking via target-driven initialization and multi- target optimization.arXiv preprint arXiv:2504.18564,

    arXiv

  27. [2026]

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al

    URLhttps://arxiv.org/abs/ 2510.02999. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations.arXiv preprint arXiv:2312.06674,

    Pith/arXiv arXiv