REVIEW 2 major objections 6 minor 40 references
Jailbreaking? One Step Is Enough!
T0 review · 2 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash
Pith's one-line read A prompt disguised as a defensive write-up can jailbreak a large language model on the first try.
desk verdict REDA is a clever reverse-framing jailbreak with a real one-shot/transfer story, but the headline numbers rest on an asymmetric truncation that strips REDA's own countermeasures section while scoring baselines on full outputs. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the reverse prompt template, which the paper calls the Reverse Attack Perspective (RAP). The template uses role and task tokens such as "##Role##" and "##Task##" and asks for three sections—explanation, concrete examples, countermeasures—so harmful content is embedded in the middle of a defensive answer rather than requested directly. Example-Guided Enhancement (EGE) selects the four most similar question-answer pairs from the paper's 260-pair, 13-category dataset using Jaccard similarity and places them in the prompt as in-context examples that reinforce the defensive frame. Request Intent Mitigation (RIM) rewrites the request from interrogative to declarative form; the paper's derivation approximates the resulting probability gain by the ratio $(\lambda/\mu)^L$, where $\lambda$ and $\mu$ are the frequencies of interrogative and declarative sentences in pretraining data. The paper's success measure is a two-step judge: a response must avoid rejection keywords and then pass a fine-tuned referee classifier, and REDA outputs are truncated before the countermeasures section before being judged.
What would settle it
Run the paper's two-step evaluation on the full, untruncated REDA responses and compare refusal rates with those of the baselines under the same scoring; if most full responses contain a refusal or safety disclaimer after the countermeasures marker, the one-step jailbreak claim as measured would not hold.
Extended reading notes
Core claim
On the paper's own terms, the discovery is that safety alignment can be redirected by starting from the output side. Rather than asking "how to rob a bank," REDA instructs the model to produce a structured defensive write-up with special tokens such as <DANGEROUS_KNOWLEDGE_PROCEDURAL_STEPS>, <EXAMPLE_OF_DANGEROUS_KNOWLEDGE>, and <COUNTERMEASURES>. The harmful procedure appears as the example that the defense is meant to counter, so the model perceives itself as performing a legitimate defensive task and cooperates on the first query. The paper reports state-of-the-art attack success rates on all seven models tested, including the most refusal-prone ones, with an average query count of one, and reports that its generated prompts transfer to other models at an average success rate of 96.20%. It also claims declarative prompts outperform interrogative prompts, supporting this with a corpus-frequency argument: if pretraining data contains $\lambda$ interrogative and $\mu$ declarative sentences, the ratio of response probabilities for a length-$L$ continuation is approximately $(\lambda/\mu)^L$, so declarative phrasing is more likely to produce text.
Load-bearing premise
The result rests on the assumption that scoring REDA responses after cutting off everything after the 'countermeasures' section is a fair, apples-to-apples comparison; if that section usually contains disclaimers or refusals, the reported success rates could be inflated.
Editorial extensions
If this is right
- If REDA works as reported, attack cost falls to one query and roughly three seconds per successful jailbreak on the tested models, making large-scale red-teaming feasible.
- Attack prompts no longer need to be regenerated per model; prompts produced on one model transfer to the other tested models at 96.20% average success.
- Defenses that look for rejection phrases or token-level anomalies are insufficient, because REDA prompts are readable, semantically coherent, and framed as defensive tasks.
- Both the declarative rewrite and the in-context defensive examples carry part of the attack: ablations show removing either one lowers success, with the largest drop on the most refusal-prone model.
- Closed API models can be probed without gradient access or repeated querying, since one generated prompt family works across targets.
Reading between the lines
- A natural extension is to test whether the reverse template also bypasses safety filters in retrieval-augmented or tool-using systems, where final answers are assembled from multiple sources and a defensive preamble may not be inspected.
- Because the paper truncates REDA outputs at the countermeasures marker, a defender could neutralize the attack by scoring full responses; if that section usually contains a refusal or disclaimer, the reported advantage may overstate clean jailbreaks.
- The corpus-frequency argument predicts that attack success should vary with pretraining language mix, so the method's transferability in non-English or safety-tuned corpora is a testable consequence the paper leaves open.
- REDA could serve as a universal probe: generate one prompt per harmful category and reuse it across models to compare alignment without per-model tuning.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes REDA (Reverse Embedded Defense Attack), a black-box jailbreak method that constructs prompts through a template asking the target model to explain harmful content, give examples, and provide countermeasures, thereby framing generation as a defensive task. It adds in-context learning examples from a new 260-pair dataset across 13 categories, selected by Jaccard similarity, and converts interrogative test queries to declarative form (Request Intent Mitigation). The authors evaluate on four open-source and three closed-source models, reporting ASR, AQC, and AQT against GCG, AutoDAN, GPTFuzzer, and DRA. Their central claims are that REDA achieves the highest ASR and lowest AQC (one step) across all seven models, that its prompts transfer across models with an average success rate of 96.20%, and that declarative prompts are more likely to be answered than interrogative prompts, with a derivation in Appendix B.
Significance. If the results hold under a symmetric evaluation, the contribution is practically significant: REDA would be a one-shot, readable, model-transferable jailbreak that outperforms both gradient-based and black-box baselines on open- and closed-source models. The paper also contributes a jailbreak QA dataset and an ablation suggesting each component matters. The two-step judge is a reasonable attempt to reduce false positives. However, the headline ASR and transfer numbers currently rest on an asymmetric evaluation protocol that truncates REDA outputs only, and the Appendix B derivation assumes its conclusion; until these are addressed, the SOTA and 'one step is enough' claims are not established. The strengths of the paper include a clear method description, tests on seven models, and an explicit limitations section.
major comments (2)
- [Section 5.5] The evaluation protocol is asymmetric and the headline numbers depend on it. The paper states that for REDA, 'we additionally post-process the baseline model's output by removing "<COUNTERMEASURES>" and any subsequent content to prevent countermeasures from affecting the evaluation result,' while GCG, AutoDAN, GPTFuzzer, and DRA are judged on their full outputs by the two-step judge (rejection keywords plus the Llama2-13b referee). Because REDA's prompt template explicitly asks the model to end with countermeasures, that is precisely where refusal-like or disclaiming language would occur. Truncating only REDA outputs before the rejection-keyword check and referee therefore measures a pre-countermeasure fragment, not the same response property measured for baselines. This asymmetry affects the ASR/AQC values in Tables 1, 4, and 5 and the transferability numbers in Figure 4, including the 96.20% average transfer claim. The comparison should be rerun under a symmetric protocol, ideally reporting both full outputs for all methods and outputs truncated at the first structural delimiter for all methods; the 'same evaluation criteria' statement in Section 5.1 is contradicted by this post-processing.
- [Appendix B, Eq. (11)] The derivation of PInt < PDec is circular. Equation (11) simply assumes that the per-token conditional probability ratio equals the corpus-frequency ratio lambda/mu, and since lambda < mu by the earlier assumption, Eq. (12) and Eq. (7) follow immediately. The appendix therefore does not derive the claim that declarative prompts are more likely to be answered; it assumes the conclusion in the form of Eq. (11). Moreover, lambda and mu are defined as joint probabilities of full sequences P(X,x1:n) and P(x1:n), not as per-token conditional probabilities, so the proportionality in Eq. (11) is not a consequence of the preceding definitions. The authors should either supply an independent argument for Eq. (11) or explicitly reframe the RIM claim as an empirical hypothesis whose only evidence is the ablation in Table 2.
minor comments (6)
- [Section 5.5] The phrase 'we additionally post-process the baseline model's output' is misleading: the truncation applies to REDA's target-model output, not to the baseline methods' outputs. Please reword to describe the actual protocol.
- [Table 2] The Glm-4 ASR for 'Ours' is 97.50% in Table 2 but 96.67% in Table 1 for the same condition; the SPARK-API AQC entry reads '11' instead of '1'. Please reconcile these values.
- [Table 4] The text says the average ASR for the keyword-detection step is 98%, but the mean of the seven listed values is approximately 97.86%; correct the number or explain the averaging procedure.
- [Appendix C] The statement that no overlap occurred between the constructed dataset and the test datasets is not supported by any procedure; reporting an exact or near-duplicate matching check would strengthen the independence claim.
- [Section 4.3 and Appendix B] The claim that pre-training data contains more declarative than interrogative sentences is intuitive but unsupported by a corpus statistic; a citation or a small corpus count would make the premise concrete.
- [Section 6.3] The 'origin' condition in the ablation differs from 'w/o RIM+EGE' in several ways beyond the absence of RIM and EGE, so the specific contribution of the Reverse Attack Perspective is not cleanly isolated; please clarify the exact prompt used in each condition.
Circularity Check
RIM's analytic proof assumes its own conclusion; headline ASR is measured on REDA's pre-countermeasure prefix, so the SOTA claim reduces to the evaluation rule.
-
self definitional
[Section 4.3, Eqs. (4)-(7); Appendix B, Eq. (11)-(12)]
"Next, we assume that: P (xi|X , x1:i−1)/P (xi|x1:i−1) ≈ λ/µ. ... Thus, the ratio of the two conditional probabilities becomes: P (R|X , x1:n)/P (R|x1:n) ≈ (λ/µ)^L. ... PInt < PDec."
Eq. (11) is the entire content of the claimed derivation: it assumes the per-token conditional probability ratio equals the corpus frequency ratio λ/µ. Combined with the paper's prior assertion that web pretraining data contain more declarative than interrogative sentences (λ < µ), Eq. (12) yields PInt/PDec ≈ (λ/µ)^L < 1, i.e., PInt < PDec. The conclusion is the assumption restated; no independent derivation of the superiority of declarative prompts is given. The claimed 'discovery' in Contribution 3 therefore reduces by construction to the input assumption.
-
other
[Section 5.5 (Evaluation)]
"For each method, we first generate a successful attack prompt and reinput it into the baseline model to produce the jailbreak result, which we then evaluate with our two-step method. In our approach, we additionally post-process the baseline model’s output by removing “ <COUNTERMEASURES>” and any subsequent content to prevent countermeasures from affecting the evaluation result."
REDA's own template (Figure 3) instructs the target model to produce '<COUNTERMEASURES>' after the harmful examples, i.e., exactly the section where safety disclaimers and refusal-like text are most likely to appear. The evaluation removes everything from '<COUNTERMEASURES>' onward for REDA outputs before the rejection-keyword check and the HarmBench referee, while judging GCG, AutoDAN, GPTFuzzer, and DRA on complete outputs. The reported ASR/AQC values in Tables 1, 4, 5 and the 96.20% transferability in Figure 4 are therefore computed on a prefix selected by the method's own delimiter; the 'success' is a consequence of the post-processing rule, not of a symmetric comparison. The headline SOTA claim reduces by construction to this evaluation choice.
full rationale
The core REDA mechanism (RAP, EGE, the 260-pair dataset, and the transfer experiments) is an empirical engineering contribution, not a circular derivation: the test set is from Liu et al. (2024), the HarmBench referee is an external classifier, the paper avoids testing on its own constructed questions, and no load-bearing self-citation is present. However, two load-bearing reductions exist. First, the RIM 'derivation' in Sec. 4.3 and Appendix B assumes at Eq. (11) that per-token probability ratios equal the corpus declarative/interrogative frequency ratio; Eqs. (6)-(7) then simply restate that assumption, so the claimed first-principles result PInt < PDec is circular. Second, Sec. 5.5 truncates REDA outputs at '<COUNTERMEASURES>' before judging, removing the section where REDA's own template places defensive/safety content, while baselines are judged in full; the headline ASR, AQC, and 96.20% transferability numbers are therefore constructed by the evaluation protocol rather than by like-for-like comparison. These are distinct: the first is a circular analytic justification, the second is a metric-level construction. Together they justify a partial-circularity score of 6. A symmetric evaluation could still show REDA is effective, but the paper does not currently establish that.
Assumptions & free parameters
free parameters (2)
- top-k (number of ICL examples) =
4
- example selection method =
Jaccard
assumptions (5)
- ad hoc to paper The per-token probability ratio in Eq. (11) equals the corpus frequency ratio lambda/mu.
- domain assumption Declarative sentences are more frequent than interrogative sentences in pretraining data (lambda < mu).
- domain assumption The judge (refusal keyword + fine-tuned Llama-2) applied to truncated REDA outputs is a valid measure of jailbreak success.
- domain assumption Jaccard similarity between the user query and dataset questions selects useful in-context examples.
- domain assumption The model's generation follows the prompt template's structure with special tokens, so harmful content appears only before <COUNTERMEASURES>.
Cite this review
Pith. "Pith review of Jailbreaking? One Step Is Enough!." pith.science (2026). https://pith.science/paper/Y2HMAYVS
@misc{pith2026241212621,
author = {Pith},
title = {Pith review of: Jailbreaking? One Step Is Enough!},
year = {2026},
howpublished = {\url{https://pith.science/paper/Y2HMAYVS}},
note = {Machine review of arXiv:2412.12621}
}
read the original abstract
Large language models (LLMs) excel in various tasks but remain vulnerable to jailbreak attacks, where adversaries manipulate prompts to generate harmful outputs. Examining jailbreak prompts helps uncover the shortcomings of LLMs. However, current jailbreak methods and the target model's defenses are engaged in an independent and adversarial process, resulting in the need for frequent attack iterations and redesigning attacks for different models. To address these gaps, we propose a Reverse Embedded Defense Attack (REDA) mechanism that disguises the attack intention as the "defense". intention against harmful content. Specifically, REDA starts from the target response, guiding the model to embed harmful content within its defensive measures, thereby relegating harmful content to a secondary role and making the model believe it is performing a defensive task. The attacking model considers that it is guiding the target model to deal with harmful content, while the target model thinks it is performing a defensive task, creating an illusion of cooperation between the two. Additionally, to enhance the model's confidence and guidance in "defensive" intentions, we adopt in-context learning (ICL) with a small number of attack examples and construct a corresponding dataset of attack examples. Extensive evaluations demonstrate that the REDA method enables cross-model attacks without the need to redesign attack strategies for different models, enables successful jailbreak in one iteration, and outperforms existing methods on both open-source and closed-source models.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[1]
Meta AI. 2023. Introducing meta llama 3: The most capable openly available llm to date. https://ai.meta.com/blog/meta-llama-3/. Accessed: 2023-10-31
work page 2023
-
[2]
Tom B Brown. 2020. Language models are few-shot learners. arXiv preprint arXiv:2005.14165
arXiv 2020
-
[3]
Jailbreaking black box large language models in twenty queries
Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. In R0-FoMo: Robustness of Few-shot and Zero-shot Learning in Large Foundation Models
-
[4]
Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Jailbreaker: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715
arXiv 2023
-
[5]
Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2024. Masterkey: Automated jailbreaking of large language model chatbots. In Proc. ISOC NDSS
2024
-
[6]
Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. 2023. A wolf in sheep's clothing: Generalized nested jailbreak prompts can fool large language models easily. arXiv preprint arXiv:2311.08268
arXiv 2023
-
[7]
Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A Smith. 2020. Realtoxicityprompts: Evaluating neural toxic degeneration in language models. arXiv preprint arXiv:2009.11462
arXiv 2020
-
[8]
Team GLM, Aohan Zeng, Bin Xu, Bowen Wang, Chenhui Zhang, Da Yin, Diego Rojas, Guanyu Feng, Hanlin Zhao, Hanyu Lai, Hao Yu, Hongning Wang, Jiadai Sun, Jiajie Zhang, Jiale Cheng, Jiayi Gui, Jie Tang, Jing Zhang, Juanzi Li, Lei Zhao, Lindong Wu, Lucen Zhong, Mingdao Liu, Minlie Huang, Peng Zhang, Qinkai Zheng, Rui Lu, Shuaiqi Duan, Shudan Zhang, Shulin Cao, ...
arXiv 2024
Show all 40 references
-
[9]
Paul Jaccard. 1901. \'E tude comparative de la distribution florale dans une portion des alpes et des jura. Bull Soc Vaudoise Sci Nat, 37:547--579
1901
-
[10]
Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023. Automatically auditing large language models via discrete optimization. In International Conference on Machine Learning, pages 15307--15329. PMLR
2023
-
[11]
Nikhil Kandpal, Matthew Jagielski, Florian Tram \`e r, and Nicholas Carlini. 2023. Backdoor attacks for in-context learning with language models. arXiv preprint arXiv:2307.14692
2023 arXiv
-
[12]
Xiaonan Li, Kai Lv, Hang Yan, Tianyang Lin, Wei Zhu, Yuan Ni, GUOTONG XIE, Xiaoling Wang, and Xipeng Qiu. 2023 a . Unified demonstration retriever for in-context learning. In The 61st Annual Meeting Of The Association For Computational Linguistics
2023
-
[13]
Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2023 b . Deepinception: Hypnotize large language model to be jailbreaker. arXiv preprint arXiv:2311.03191
2023 arXiv
-
[14]
Tong Liu, Yingjie Zhang, Zhe Zhao, Yinpeng Dong, Guozhu Meng, and Kai Chen. 2024. Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4711--4728
2024
-
[15]
Yao Lu, Max Bartolo, Alastair Moore, Sebastian Riedel, and Pontus Stenetorp. 2022. Fantastically ordered prompts and where to find them: Overcoming few-shot prompt order sensitivity. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Vo...
2022
-
[16]
Renqian Luo, Liai Sun, Yingce Xia, Tao Qin, Sheng Zhang, Hoifung Poon, and Tie-Yan Liu. 2022. Biogpt: generative pre-trained transformer for biomedical text generation and mining. Briefings in bioinformatics, 23(6):bbac409
2022
-
[17]
Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. In Forty-first International Conference on Machi...
2024
-
[18]
Mowshowitz. 2022. Jailbreaking chatgpt on release day. https://www.lesswrong.com/posts/RYcoJdvmoBbi5Nax7/jailbreaking-chatgpt-on-release-day. Accessed: 2024-04-15
2022
-
[19]
Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Florian Tram \`e r, and Katherine Lee. 2023. Scalable extraction of training data from (production) language models. arXiv preprint ar...
2023 arXiv
-
[20]
OpenAI. 2022. https://openai.com/blog/chatgpt Introducing chatgpt [sic] . Accessed: 08/08/2023
2022
-
[21]
Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red teaming language models with language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing...
2022
-
[22]
F \'a bio Perez and Ian Ribeiro. 2022. Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.09527
2022 arXiv
-
[23]
Nils Reimers and Iryna Gurevych. 2019. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing, pages 3982--3992. Association for Computational Linguistics
2019
-
[24]
Stephen Robertson, Hugo Zaragoza, et al. 2009. The probabilistic relevance framework: Bm25 and beyond. Foundations and Trends in Information Retrieval , 3(4):333--389
2009
-
[25]
Robertson and Steve Walker
Stephen E. Robertson and Steve Walker. 1994. https://doi.org/10.1145/188490.188561 Some simple effective approximations to the 2-poisson model for probabilistic weighted retrieval . In Proceedings of the 17th Annual International ACM SIGIR Conference on Research and Developmen...
1994
-
[26]
do anything now
Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, page...
2024
-
[27]
Robert Tinn, Hao Cheng, Yu Gu, Naoto Usuyama, Xiaodong Liu, Tristan Naumann, Jianfeng Gao, and Hoifung Poon. 2023. Fine-tuning large neural language models for biomedical natural language processing. Patterns, 4(4)
2023
-
[28]
Hao Wang, Hao Li, Minlie Huang, and Lei Sha. 2024. From noise to clarity: Unraveling the adversarial suffix of large language model attacks via translation of text embeddings. arXiv preprint arXiv:2402.16006
2024 arXiv
-
[29]
Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36
2024
-
[30]
Zhenyu Wu, Yaoxiang Wang, Jiacheng Ye, Zhiyong Wu, Jiangtao Feng, Jingjing Xu, and Yu Qiao. 2023. Openicl: An open-source framework for in-context learning. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 3: System Demonstrati...
2023
-
[31]
Safedecoding: Defending against jailbreak attacks via safety-aware decoding
Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models
2024
-
[32]
An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jin Xu, Jingren Zhou, Jinze Bai, Jinzheng...
2024 arXiv
-
[33]
Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253
2023 arXiv
-
[34]
Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms. arXiv preprint arXiv:2401.06373
2024 arXiv
-
[35]
Yue Zhang, Yafu Li, Leyang Cui, Deng Cai, Lemao Liu, Tingchen Fu, Xinting Huang, Enbo Zhao, Yu Zhang, Yulong Chen, et al. 2023. Siren's song in the ai ocean: a survey on hallucination in large language models. arXiv preprint arXiv:2309.01219
2023 arXiv
-
[36]
Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. 2023. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 36:46595--46623
2023
-
[37]
Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang, Furong Huang, Ani Nenkova, and Tong Sun. 2024. Autodan: interpretable gradient-based adversarial attacks on large language models. In First Conference on Language Modeling
2024
-
[38]
Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043
2023 arXiv
-
[39]
online" 'onlinestring :=
ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...
-
[40]
write newline
" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...
Reviewed August 11, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.