Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?

T0 review · 3 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Mask-GCG shows that most tokens in a GCG adversarial suffix are necessary, but a learnable mask can prune the redundant minority without hurting jailbreak success or loss.

desk verdict A genuinely new masking-based pruning trick for GCG suffixes, but the rollback design means the paper's own experiments can't validate the claim that the learned masks are finding truly redundant tokens. read the letter →

arxiv 2509.06350 v2 pith:MQ35J3WX submitted 2025-09-08 cs.CL cs.AIcs.CR

Junjie Mu , Zonghao Ying , Zhekui Fan , Zonglei Jing , Yaoyuan Zhang , Zhengmin Yu , Wenxin Zhang , Quanchen Zou
show 1 more author
Xiangzheng Zhang
This is my paper · ORCID
classification cs.CLcs.AIcs.CR
keywords jailbreakattacksadversarialsuffixtokenmaskingGreedyCoordinateGradientredundancypromptcompressionLLMsafetyattackefficiency
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to test whether every token in a GCG-generated adversarial suffix is needed for a jailbreak. It claims the answer is no: a learnable per-token mask, trained jointly with the attack loss, assigns low probabilities to a minority of tokens, and removing those tokens leaves both the optimization loss and the attack success rate essentially unchanged. The authors report suffix compression of up to 40% and an average 16.8% reduction in attack time across Llama-2 and Vicuna models, while preserving ASR on GCG and two variants. If correct, this establishes token-level redundancy in adversarial prompts and gives a practical way to make discrete-prompt attacks cheaper and more interpretable.

What carries the argument

The carrying object is the learnable per-token mask. Each suffix position i has a scalar logit m_i, converted by a temperature-annealed sigmoid to probability p_i = σ(m_i/τ); the embedded suffix is multiplied elementwise by these probabilities, so the mask controls how much each token contributes to the forward pass. A joint loss L_total = L_attack + λ_reg * (1/L) * Σ p_i drives high-contribution tokens toward p_i ≈ 1 and weak tokens toward p_i ≈ 0. Attention-derived importance scores from the last K transformer layers—combining target dependency and global influence, weighted toward deeper layers—initialize the logits through a two-layer MLP. Pruning keeps positions with p_i ≥ τ_prune and r

What would settle it

Take a successful GCG suffix, sort its tokens by final mask probability, prune the lowest-probability tokens without applying the rollback safeguard, and remeasure loss and ASR; if the pruned suffix loses attack success or the loss rises, those tokens were load-bearing and the redundancy claim fails. A second check compares random pruning at the same compression rate: if random pruning preserves ASR just as well, the learned mask is not identifying anything token-specific.

Watch

Extended reading notes

Core claim

Most tokens in a GCG-generated adversarial suffix contribute substantially to jailbreak success, but a minority are redundant and can be pruned without changing loss or attack success rate. Mask-GCG learns a continuous mask probability for each suffix token by jointly optimizing the GCG cross-entropy attack loss with an L1 penalty on the mean mask probability. Attention scores from the last model layers are mapped through an MLP to initialize the masks, and a temperature-annealed sigmoid converts mask logits to probabilities. During optimization, tokens whose mask probability falls below a threshold are removed one by one, with a rollback step whenever removal increases loss. Across a 50-ins

Load-bearing premise

The load-bearing premise is that the learned mask probability for each token faithfully measures that token's true contribution to the jailbreak loss, so cutting tokens with low mask probability removes redundant tokens rather than tokens merely pushed to zero by the L1 penalty.

Editorial extensions

If this is right

  • Adversarial suffix length can be reduced during optimization, shrinking the discrete search space and lowering per-iteration cost; the paper reports about 17% average time savings over GCG.
  • Because ASR is preserved after pruning, redundancy appears to be a property of GCG-style suffixes across models, not an artifact of one attack; Mask-GCG was plugged into GCG, I-GCG, and AmpleGCG.
  • Token importance in adversarial suffixes is highly skewed: over 83% of positions matter, while a clear minority are redundant, supporting the idea that LLMs tolerate unnatural filler tokens.
  • Attention-guided initialization and mask evolution give an interpretable view of which tokens—semantically rich tokens versus punctuation and function words—drive a jailbreak.
  • Longer suffixes (30 tokens) compress more than shorter ones, suggesting redundancy grows with suffix length.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the L1 regularization and the rollback safeguard make the pruning result conservative; a token is removed only when loss does not rise, so the measured compression is a lower bound on true redundancy rather than the full prunable set.
  • Editorial inference: the same mask-learning scheme could be applied to benign prompts or other discrete prompt-optimization tasks—such as instruction compression or chain-of-thought simplification—to test whether token redundancy is generic in LLM inputs.
  • Editorial inference: a natural control experiment would compare mask-guided pruning against random pruning at the same compression rate; if random pruning preserves attack success equally well, the benefit is length reduction per se rather than token-level selection.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes Mask-GCG, a plug-and-play extension of GCG jailbreak attacks that learns a per-token mask over a fixed-length adversarial suffix. The mask is initialized from attention scores through an MLP (Eq. 7), trained jointly with the attack loss under an L1 penalty (Eq. 4), and periodically pruned by removing the lowest-probability token if its probability is below a threshold and the removal does not increase the loss (Algorithm 1). The authors report that across GCG, I-GCG, and AmpleGCG on Llama-2-7B/13B and Vicuna-7B, pruning a minority of low-impact tokens preserves ASR while reducing suffix length (average SCR 7.5% for length 30 on GCG; max 40% in one case) and average attack time by roughly 17%. From this they conclude that GCG-generated suffixes contain token redundancy and that learnable masking identifies redundant tokens.

Significance. The paper has a clear plug-and-play design and attempts to provide an interpretable view of token contributions in adversarial suffixes. If the masking mechanism truly identified low-impact tokens, the result would be practically useful for reducing the cost of GCG-style attacks and for understanding prompt redundancy. The authors also evaluate on multiple models and attack variants, which is commendable. However, the central scientific claim—that pruning low-impact tokens 'does not affect the loss values or compromise ASR, thereby revealing token redundancy'—is not established by the evidence as presented. The pruning protocol makes loss preservation nearly tautological, the quantitative support (average SCR 7.5%) is modest, and no uncertainty quantification or randomized baseline is provided. These are correctable with additional experiments, but they are load-bearing for the paper's conclusion.

major comments (3)
  1. [§3.4, Algorithm 1 (lines 16-22)] The pruning step only removes a token when the loss does not increase; if it does, the algorithm rolls back. Consequently, every reported prune is, by construction, a token whose removal did not hurt the attack objective. This guarantees loss/ASR preservation regardless of whether mask probabilities encode true token importance. The claim that masks identify redundant tokens therefore needs a no-rollback control: compare Mask-GCG pruning against random token pruning and against an alternative importance metric under the same rollback condition. Without such a control, the observed ASR preservation cannot be attributed to the learned masks. The same issue affects the interpretation of Eq. (4): the L1 regularization actively drives p_i toward zero, so low mask values may reflect regularization pressure rather than empirically low contribution.
  2. [§4.2, Tables 1 and 2] The empirical support for 'significant redundancy' is weak and internally inconsistent. The average SCR values in Table 1 are at most 7.5%, and several cells are below 2%; yet the abstract and intro describe 'significant' redundancy and Figure 2 presents a 40% SCR as typical. Table 2 shows ASR drops for GCG+Mask-GCG on Llama-13b (74% to 66% at length 20, 80% to 76% at length 30) and for Vicuna-7b length 20 (98% to 96%). No error bars, confidence intervals, or significance tests are reported, and no loss-value tables are provided despite the abstract's claim that loss values are unchanged. The paper also asserts that 'the proportion of high-impact tokens exceeds 83% in most cases,' but no distribution of mask values or threshold analysis is given. This is insufficient to support the paper's central assertion.
  3. [§4.1, 'Ablation Study Considerations'] The manuscript explicitly declines ablation studies, arguing that components work synergistically. However, the paper's central hypothesis—that masks, rather than the rollback procedure or the regularization, identify redundant tokens—requires exactly the ablations that are omitted. In addition, the evaluation uses only 50 randomly sampled AdvBench prompts with no seed, confidence interval, or repeated-sampling analysis, and the hyperparameters lambda_reg and tau_prune are both set to 0.3 'based on preliminary experiments' on the same data. This creates a tuning-on-the-test-set risk. At minimum, the authors should report per-prompt distributions, run repeated subsamples or bootstrap confidence intervals, and evaluate threshold sensitivity.
minor comments (6)
  1. [Eqs. (1)-(2)] The dimensions of p are not defined. In Eq. (2), H is L×V and W_embed is V×d, so H·W_embed is L×d, but p appears as a scalar per position; clarify whether p is broadcast over d and define it explicitly as a vector in R^L.
  2. [Algorithm 1] Line 18 uses threshold θ, while Eq. (8) and the text use τ_prune; also line 17 always selects arg min_j(p_j), but the text says all tokens with p_i < τ_prune are pruned. Harmonize the notation and the pruning rule.
  3. [Introduction and Figure 2 vs. Table 1] The claimed maximum SCR of 40% (Introduction, Figure 2) is inconsistent with Table 1, whose maximum is 10.5%. Clarify whether the 40% is a single-case outlier or measured under a different setting.
  4. [References] Several references are mismatched or incomplete: e.g., 'A Primer in BERTology' is attributed to So et al. 2021, 'Stone needle' (Liu and Zuo 2023) is cited as the source of the attention-importance formula, and some arXiv identifiers are incomplete. A careful proofread is needed.
  5. [§2.1] The opening sentence about SGD in computer vision, with citation [Raffel et al. 2020], is not relevant to optimization-based jailbreaking and reads as filler. Please replace with substantive context.
  6. [Table 3] Time measurements lack hardware details, number of runs, and variance. The 16.8% average time reduction is reported as a point estimate; standard deviations or per-run results should be given.

Circularity Check

1 steps flagged · score 6.0 of 10

Pruning safety is enforced by rollback, making 'loss unchanged' a tautology; the mask-validity claim is not independently tested.

  1. self definitional [Section 3.4 (Pruning), after Eq. (8); Algorithm 1 lines 16–22]
    "If pruning results in an increase in loss, we roll back to the previous state, thereby restoring the removed tokens and ensuring the safety of the pruning process."

    The paper's central empirical claim is that 'pruning a minority of low-impact tokens does not affect the loss values or compromise the attack success rate, thereby revealing token redundancy.' But Algorithm 1 only keeps a prune when L_new ≤ L_old; any prune that increases loss is rolled back. Therefore the set of observed 'successful' prunes is, by construction, exactly the set whose removal did not increase loss. The finding that pruning does not affect loss is thus a logical consequence of the selection rule, not an empirical validation that the learned masks identify truly redundant tokens. The same non-increasing-loss property would hold for any token chosen for deletion and protected by this rollback, including random tokens. The paper provides no control comparing Mask-GCG's pruning

full rationale

The main circularity is in the evidence for the central claim. The paper asserts that pruning low-impact tokens does not affect loss, but Algorithm 1 explicitly rolls back any prune that increases loss (lines 16–22). Consequently, the observed loss preservation is guaranteed by the algorithm rather than discovered from the behavior of the learned masks. This makes the 'prediction' that pruned tokens are low-impact self-definitional: the pruned set is selected to satisfy the non-increasing-loss criterion. The L1 regularization in Eq. (4) further pushes mask probabilities toward zero, so low p_i may reflect the regularizer rather than pre-existing redundancy. The absence of a random-pruning control under the same rollback condition means the masks' specific contribution is not established. However, the non-zero SCR results are not forced—the algorithm could in principle find no removable tokens—so the redundancy finding retains some empirical content. Self-citations to Ying et al. works are contextual and not load-bearing, and no uniqueness theorem or ansatz-smuggling pattern appears. Overall, the paper has a partial circularity in its key validation, giving a score of 6 rather than a higher score.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central claim rests on several unverified premises: attention scores are a valid proxy for token importance, the L1 regularization drives mask values toward sparsity without distorting the task, and the 50-prompt AdvBench subset is representative. These plus the hand-tuned hyperparameters are what the paper contributes beyond the GCG baseline.

free parameters (6)
  • lambda_reg = 0.3
    Regularization weight balancing attack loss and mask sparsity; tuned in preliminary experiments (Section 4.1).
  • tau_prune = 0.3
    Pruning threshold for mask probabilities; tuned in preliminary experiments (Section 4.1).
  • alpha = not reported
    Balancing parameter between target dependency and global influence in Eq. 6; not specified in paper.
  • beta_l = not reported
    Layer weights for attention importance in Eq. 6; assumed to assign higher weights to deeper layers but values not given.
  • K = not reported
    Number of attention layers used in Eq. 6; not specified.
  • Temperature schedule = cosine annealing, exact schedule not reported
    Controls sharpness of the mask distribution (Eq. 1); implementation details missing.
assumptions (4)
  • domain assumption Attention scores from the last K layers (Eq. 6) capture token importance for jailbreak success
    No validation that attention importance maps to causal token contributions in adversarial suffixes.
  • domain assumption Duan et al.'s 'unnatural languages' filtering behavior implies redundancy in GCG suffixes
    Used in Introduction to motivate the hypothesis; the link is speculative.
  • domain assumption The 50-instance random subset of AdvBench is representative for measuring token redundancy
    Section 4.1: small sample, no power analysis.
  • ad hoc to paper Optimizing the joint loss (Eq. 5) yields mask probabilities that identify truly redundant tokens
    The L1 regularization actively pushes mask values toward 0, so low mask values are partly manufactured; the rollback pruning only removes tokens when loss does not increase.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?." pith.science (2026). https://pith.science/paper/MQ35J3WX

@misc{pith2026250906350,
  author       = {Pith},
  title        = {Pith review of: Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MQ35J3WX}},
  note         = {Machine review of arXiv:2509.06350}
}
read the original abstract

Jailbreak attacks on Large Language Models (LLMs) have demonstrated various successful methods whereby attackers manipulate models into generating harmful responses that they are designed to avoid. Among these, Greedy Coordinate Gradient (GCG) has emerged as a general and effective approach that optimizes the tokens in a suffix to generate jailbreakable prompts. While several improved variants of GCG have been proposed, they all rely on fixed-length suffixes. However, the potential redundancy within these suffixes remains unexplored. In this work, we propose Mask-GCG, a plug-and-play method that employs learnable token masking to identify impactful tokens within the suffix. Our approach increases the update probability for tokens at high-impact positions while pruning those at low-impact positions. This pruning not only reduces redundancy but also decreases the size of the gradient space, thereby lowering computational overhead and shortening the time required to achieve successful attacks compared to GCG. We evaluate Mask-GCG by applying it to the original GCG and several improved variants. Experimental results show that most tokens in the suffix contribute significantly to attack success, and pruning a minority of low-impact tokens does not affect the loss values or compromise the attack success rate (ASR), thereby revealing token redundancy in LLM prompts. Our findings provide insights for developing efficient and interpretable LLMs from the perspective of jailbreak attacks.

Figures

Figures reproduced from arXiv: 2509.06350 by the authors.

Figure 1
Figure 1. Comparison between GCG and Mask-GCG. Left: The conventional GCG employs fixed-length suffixes for optimiza￾tion, where all tokens participate in the gradient update process. Right: Mask-GCG introduces learnable masks to identify and prune low-impact tokens, thereby achieving suffix optimization while preserving attack effectiveness. tion method designed to identify the impact strength of in￾dividual tokens in suffix… view at source ↗
Figure 2
Figure 2. adversarial suffix generated for a harmful prompt using GCG and Mask-GCG. The GCG algorithm optimizes all [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Mask Evolution in Harmful Query Attacks. This figure illustrates the initial and final states of mask values for each [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SlotGCG: Exploiting the Positional Vulnerability in LLMs for Jailbreak Attacks

    cs.CR 2026-06 unverdicted novelty 7.0 of 10

    SlotGCG uses Vulnerable Slot Score (VSS) to identify and target the most vulnerable prompt positions for adversarial token insertion, delivering 14% higher ASR than standard GCG and 42% higher against defenses.

Reference graph

Works this paper leans on

36 extracted references · 14 canonical work pages · cited by 1 Pith paper

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Ai, Q.; Bai, T.; Cao, Z.; Chang, Y.; Chen, J.; Chen, Z.; Cheng, Z.; Dong, S.; Dou, Z.; Feng, F.; Gao, S.; Guo, J.; He, X.; Lan, Y.; Li, C.; Liu, Y.; Lyu, Z.; Ma, W.; Ma, J.; Ren, Z.; and Zhu, X. 2023. Information Retrieval meets Large Language Models: A strategic report from Chinese IR community. arXiv:2303.12345

    arXiv 2023

  4. [4]

    Y.; and Furlotte, N

    Belyaeva, A.; Cosentino, J.; Hormozdiari, F.; Eswaran, K.; Shetty, S.; Corrado, G.; Carroll, A.; McLean, C. Y.; and Furlotte, N. A. 2023. Multimodal LLMs for health grounded in individual-specific data

    work page 2023

  5. [5]

    Brown, T. B.; Mann, B.; Ryder, N.; Subbiah, M.; Kaplan, J.; Dhariwal, P.; Neelakantan, A.; Shyam, P.; Sastry, G.; Askell, A.; Agarwal, S.; Herbert-Voss, A.; Krueger, G.; Henighan, T.; Child, R.; Ramesh, A.; Ziegler, D. M.; Wu, J.; Winter, C.; Hesse, C.; Chen, M.; Sigler, E.; Litwin, M.; Gray, S.; Chess, B.; Clark, J.; Berner, C.; McCandlish, S.; Radford, ...

    arXiv 2020

  6. [6]

    S.; Yang, Q.; and Xie, X

    Chang, Y.; Wang, X.; Wang, J.; Wu, Y.; Yang, L.; Zhu, K.; Chen, H.; Yi, X.; Wang, C.; Wang, Y.; Ye, W.; Zhang, Y.; Chang, Y.; Yu, P. S.; Yang, Q.; and Xie, X. 2023. A Survey on Evaluation of Large Language Models. arXiv:2307.03109

    arXiv 2023

  7. [7]

    Chen, W.; Ji, Y.; Liu, Z.; and Yang, Y. 2024 a . LongLLMLingua: Accelerating and Enhancing LLMs in Long Context Scenarios via Prompt Compression. arXiv:2310.06839

    arXiv 2024

  8. [8]

    Chen, Y.; Qian, S.; Tang, H.; Lai, X.; Liu, Z.; Han, S.; and Jia, J. 2024 b . LongLoRA: Efficient Fine-tuning of Long-Context Large Language Models. arXiv:2309.12307

    arXiv 2024

Show all 36 references
  1. [9]

    Chi, T.-C.; Fan, T.-H.; and Rudnicky, A. I. 2023. Attention Alignment and Flexible Positional Embeddings Improve Transformer Length Extrapolation. arXiv:2310.13508

    2023 arXiv

  2. [10]

    Christiano, P.; Leike, J.; Brown, T.; Martic, M.; Legg, S.; and Amodei, D. 2022. Aligning language models to follow instructions

    2022

  3. [11]

    Duan, K.; Zhao, Y.; Feng, Z.; Ni, J.; Pang, T.; Liu, Q.; Cai, T.; Dou, L.; Kawaguchi, K.; Goyal, A.; and J. 2025. Unnatural Languages Are Not Bugs but Features for LLMs. arXiv:2503.01926

    2025 arXiv

  4. [12]

    He, K.; Chen, X.; Xie, S.; Li, Y.; Dollár, P.; and Girshick, R. 2022. Masked Autoencoders Are Scalable Vision Learners. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 15979--15988

    2022

  5. [13]

    Huang, D.; Shah, A.; Araujo, A.; Wagner, D.; and Sitawarin, C. 2025. Stronger Universal and Transferable Attacks by Suppressing Refusals

    2025

  6. [14]

    Jia, X.; Pang, T.; Dai, C.; Huang, Y.; Zhu, J.; Zhang, X.; Liu, Q.; Qiao, Y.; and Hong, M. 2024. Improved techniques for optimization-based jailbreaking on large language models. arXiv:2405.21018

    2024 arXiv

  7. [15]

    Li, X.; Li, Z.; Li, Q.; Lee, B.; Cui, J.; and Hu, X. 2024. Faster-GCG: Efficien t Discrete Optimization Jailbreak Attacks against Aligned Large Language Models. arXiv:2410.15362

    2024 arXiv

  8. [16]

    Liao, Z.; and Sun, H. 2024. AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs. arXiv:2404.08311

    2024 arXiv

  9. [17]

    Liu, W.; and Zuo, Y. 2023. Stone needle: A general multimodal large-scale model framework towards healthcare. arXiv:2306.16034

    2023 arXiv

  10. [18]

    Raffel, C.; Shazeer, N.; Roberts, A.; Lee, K.; Narang, S.; Matena, M.; Zhou, Y.; Li, W.; and Liu, P. J. 2020. Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer. arXiv:1910.10683

    2020 arXiv

  11. [19]

    R.; Mańke, W.; Liu, H.; Dai, Z.; Shazeer, N.; and Le, Q

    So, D. R.; Mańke, W.; Liu, H.; Dai, Z.; Shazeer, N.; and Le, Q. V. 2021. A Primer in BERTology: What we know about how BERT works. arXiv:2002.12327

    2021 arXiv

  12. [20]

    Touvron, H.; Lavril, T.; Izacard, G.; Martinet, X.; Lachaux, M.-A.; Lacroix, T.; Rozière, B.; Goyal, N.; Hambro, E.; Azhar, F.; Rodriguez, A.; Joulin, A.; Grave, E.; and Lample, G. 2023. LLaMA: Open and Efficient Foundation Language Models. arXiv:2302.13971

    2023 arXiv

  13. [21]

    Wang, L.; Ying, Z.; Zhang, T.; Liang, S.; Hu, S.; Zhang, M.; Liu, A.; and Liu, X. 2025. Manipulating Multimodal Agents via Cross-Modal Prompt Injection. arXiv preprint arXiv:2504.14348

    2025 arXiv

  14. [22]

    Yang, J.; Xu, H.; Mirzoyan, S.; Chen, T.; and Liu, Z. 2023 a . Poisoning scientific knowledge using large language models

    2023

  15. [23]

    Yang, Y.; Liu, Y.; Geng, R.; Jia, J.; and Gong, N. Z. 2023 b . Improving transfer ASR by response pattern and token tail constraints. arXiv:2305.14286

    2023 arXiv

  16. [24]

    Ying, Z.; Liu, A.; Liang, S.; Huang, L.; Guo, J.; Zhou, W.; Liu, X.; and Tao, D. 2024. Safebench: A safety evaluation framework for multimodal large language models. arXiv preprint arXiv:2410.18927

    2024 arXiv

  17. [25]

    Ying, Z.; Liu, A.; Zhang, T.; Yu, Z.; Liang, S.; Liu, X.; and Tao, D. 2025 a . Jailbreak vision language models via bi-modal adversarial prompt. IEEE Transactions on Information Forensics and Security

    2025

  18. [26]

    Ying, Z.; and Wu, B. 2023 a . DLP: towards active defense against backdoor attacks with decoupled learning process. Cybersecurity, 6(1): 9

    2023

  19. [27]

    Ying, Z.; and Wu, B. 2023 b . NBA: defensive distillation for backdoor removal via neural behavior alignment. Cybersecurity, 6(1): 20

    2023

  20. [28]

    Ying, Z.; Zhang, D.; Jing, Z.; Xiao, Y.; Zou, Q.; Liu, A.; Liang, S.; Zhang, X.; Liu, X.; and Tao, D. 2025 b . Reasoning-augmented conversation for multi-turn jailbreak attacks on large language models. arXiv preprint arXiv:2502.11054

    2025 arXiv

  21. [29]

    Ying, Z.; Zheng, G.; Huang, Y.; Zhang, D.; Zhang, W.; Zou, Q.; Liu, A.; Liu, X.; and Tao, D. 2025 c . Towards understanding the safety boundaries of deepseek models: Evaluation and findings. arXiv preprint arXiv:2503.15092

    2025 arXiv

  22. [30]

    Zhang, X.; Liu, H.; Xu, K.; Zhang, Q.; Liu, D.; Ahmed, B.; and Epps, J. 2024. When LLMs meets acoustic landmarks: An efficient approach to integrate speech into large language models for depression detection. arXiv:2403.12345

    2024 arXiv

  23. [31]

    Zhang, Y.; and Wei, Z. 2024. Boosting Jailbreak Attack with Momentum. arXiv:2405.01229

    2024 arXiv

  24. [32]

    X.; Zhou, K.; Li, J.; Tang, T.; Zhang, X.; Chen, Y.; Shao, Y.; Dong, Z.; Wu, Y.; Zhang, J.; and Wei, F

    Zhao, W. X.; Zhou, K.; Li, J.; Tang, T.; Zhang, X.; Chen, Y.; Shao, Y.; Dong, Z.; Wu, Y.; Zhang, J.; and Wei, F. 2023. A Survey of Large Language Models. arXiv:2303.18223

    2023 arXiv

  25. [33]

    L.; Kawaguchi, K.; Goyal, A.; and Shieh, M

    Zhao, Y.; Zheng, W.; Cai, T.; Do, X. L.; Kawaguchi, K.; Goyal, A.; and Shieh, M. 2024. Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Sampling. arXiv:2403.01251

    2024 arXiv

  26. [34]

    P.; Zhang, H.; Gonzalez, J

    Zheng, L.; Chiang, W.-L.; Sheng, Y.; Zhuang, S.; Wu, Z.; Zhuang, Y.; Lin, Z.; Li, Z.; Li, D.; Xing, E. P.; Zhang, H.; Gonzalez, J. E.; and Stoica, I. 2023. Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena. arXiv:2306.05685

    2023 arXiv

  27. [35]

    Zhu, D.; Yang, N.; Wang, L.; Song, Y.; Wu, W.; Wei, F.; and Li, S. 2023. PoSE: Efficient Context Window Extension of LLMs via Positional Skip-wise Training. arXiv:2309.10400

    2023 arXiv

  28. [36]

    Z.; and Fredrikson, M

    Zou, A.; Wang, Z.; Carlini, N.; Nasr, M.; Kolter, J. Z.; and Fredrikson, M. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv:2307.15043

    2023 arXiv

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.