---
title: "Persona Jailbreaking in Large Language Models — Sandhan 2026"
description: "Current guardrails offer only partial protection, which shows that personas need to be more robust to context. 57 references."
authors: ["Jivnesh Sandhan", "Fei Cheng", "Tushar Sandhan", "Yugo Murawaki"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: EACL 2026"
source: "https://aclanthology.org/2026.findings-eacl.72/"
doi: "10.18653/v1/2026.findings-eacl.72"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/sandhan-2026-persona-jailbreaking-large-language-models/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/sandhan-2026-persona-jailbreaking-large-language-models/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/8/) / Persona Jailbreaking in Large Language Models

# Persona Jailbreaking in Large Language Models

**Authors:** Jivnesh Sandhan, [Fei Cheng](https://md.research.elamur.ai/free/en/authors/fei-cheng/), Tushar Sandhan and [Yugo Murawaki](https://md.research.elamur.ai/free/en/authors/yugo-murawaki/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: EACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-eacl.72/) · [PDF](https://aclanthology.org/2026.findings-eacl.72.pdf) · [DOI 10.18653/v1/2026.findings-eacl.72](https://doi.org/10.18653/v1/2026.findings-eacl.72) · [OpenAlex](https://openalex.org/W7140072463)

**Citations:** 2 citations (OpenAlex, 2026-10-14)

## Summary

LLMs used as tutors, mental-health helpers or support agents are expected to keep the personality their deployer assigns. Earlier persona research focused mostly on storytelling and role-play, and it ignored whether hostile conversation history can rewrite that personality. The authors frame this as *persona editing*: a black-box, inference-only attack in which the adversary controls only user messages, while the system prompt, assistant outputs and weights stay fixed.

Their framework, PHISH, whose name refers to taking over a persona by covertly steering it through the conversation history, inserts psychometric-style question–answer pairs into a user turn. The answers are set opposite to the induced Big Five profile. Attack success is scored with STIR, a new metric of normalized trait movement in the intended direction.

On three personality inventories and eight LLMs, PHISH outperforms adapted jailbreak baselines on most models. Its effect grows over multiple turns, spills into correlated traits, carries over to applied domains, and costs little reasoning ability. Current guardrails offer only partial protection, which shows that personas need to be more robust to context.

## Key points

- **STIR (Successful Trait Influence Rate):** averages the positive shift of each targeted OCEAN trait, normalized by the maximum Likert change of 4. A score of 0% means no change or movement the wrong way; 100% means every targeted trait was shifted maximally.
- **How the attack is built:** questions are drawn from MPI-1k, with N/4 QA pairs per targeted trait, and the answers are deterministically inverted. The cues are placed after the system prompt and before evaluation, and the adversary never sees the evaluation items.
- **Evaluation benchmarks:**
  - BFI (44 items)
  - MPI (120 items, IPIP-based)
  - an 8000-item subset of Anthropic-Eval (ANTHR)
- **Models tested:**
  - general-purpose: GPT-4o, Gemini-2.0-Flash, Claude-3.5-Haiku, o3-mini, DeepSeek-V3, Llama4-Maverick
  - domain-specific: MedGemma-27B, ChatHaruhi
- **Main findings:**
  - Baselines include DAN, CipherChat, DeepInception, FlipAttack and DrAttack; most of them already change personas by over 50%.
  - Human ratings and LLM-as-Judge ratings agree on the manipulation in the mental health, tutoring and customer support scenarios.
  - Three guardrails were tested, and all proved brittle under sustained attack.
  - Code and data are released at github.com/Jivnesh/PHISH.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Kyoto University](https://md.research.elamur.ai/free/en/universities/kyoto-university/) — University, Kyoto, Japan · 40 works · 8,235 citations
- [Indian Institute of Technology Kanpur](https://md.research.elamur.ai/free/en/universities/indian-institute-of-technology-kanpur/) — University, Kanpur, India · 14 works · 619 citations

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,772 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 543 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works

## Cite

Cite as: Jivnesh Sandhan, Fei Cheng, Tushar Sandhan and Yugo Murawaki. 2026. Persona Jailbreaking in Large Language Models. Findings of the Association for Computational Linguistics: EACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{sandhan2026persona,
  title = {{Persona Jailbreaking in Large Language Models}},
  author = {Jivnesh Sandhan, Fei Cheng, Tushar Sandhan and Yugo Murawaki},
  booktitle = {Findings of the Association for Computational Linguistics: EACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-eacl.72},
  url = {https://doi.org/10.18653/v1/2026.findings-eacl.72}
}
```

- [← previous Paragraph Segmentation Revisited: Towards a Standard Task for Structuring Speech](https://md.research.elamur.ai/free/en/papers/retkowski-2026-paragraph-segmentation-revisited-standard-task/)
- [next → Persona Prompting as a Lens on LLM Social Reasoning](https://md.research.elamur.ai/free/en/papers/yang-2026-persona-prompting-as-lens-llm/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/8/)

## References

57 references, 19 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Anthropic. 2024. Claude 3.5 Haiku. [https://www.anthropic.com/claude/haiku](https://www.anthropic.com/claude/haiku). [Large language model]. [↗](https://www.anthropic.com/claude/haiku)
2. DeepSeek-AI. 2025. [Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-r1-incentivizing-reasoning-capability/). Preprint, arXiv:2501.12948.
3. J M Digman. 1997. Higher-order factors of the big five. J. Pers. Soc. Psychol., 73(6):1246–1256. [find](https://scholar.google.com/scholar?q=J+M+Digman%2E+1997%2E+Higher%2Dorder+factors+of+the+big+five%2E+J%2E+Pers%2E+Soc%2E+Psychol%2E%2C+73%286%29%3A1246%E2%80%931256%2E)
4. Danica Dillion, Niket Tandon, Yuling Gu, and Kurt Gray. 2023. Can AI language models replace human participants? Trends Cogn. Sci., 27(7):597–600. [find](https://scholar.google.com/scholar?q=Danica+Dillion%2C+Niket+Tandon%2C+Yuling+Gu%2C+and+Kurt+Gray%2E+2023%2E+Can+AI+language+models+replace+human+participants%3F+Trends+Cogn%2E+Sci%2E%2C+27%287%29%3A597%E2%80%93600%2E)
5. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. [HotFlip: White-box adversarial examples for text classification](https://md.research.elamur.ai/free/en/papers/ebrahimi-2018-hotflip-white-box-adversarial-examples/). In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 31–36, Melbourne, Australia. Association for Comput…
6. Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, et al. 2021. A mathematical framework for transformer circuits. Transformer Circuits Thread, 1(1):12. [find](https://scholar.google.com/scholar?q=Nelson+Elhage%2C+Neel+Nanda%2C+Catherine+Olsson%2C+Tom+Henighan%2C+Nicholas+Joseph%2C+Ben+Mann%2C+Amanda+Askell%2C+Yuntao+Bai%2C+Anna+Chen%2C+Tom+Conerly%2C+et+al%2E+2021%2E+A+mathematical+framework+for+transformer+circuits%2E)
7. Siddhant Garg and Goutham Ramakrishnan. 2020. [BAE: BERT-based adversarial examples for text classification](https://md.research.elamur.ai/free/en/papers/garg-2020-bae-bert-based-adversarial-examples/). In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 6174–6181, Online. Association for Computational Linguistics.
8. Lewis R. Goldberg. 1999. A broad-bandwidth, public domain, personality inventory measuring the lower-level facets of several five-factor models. [find](https://scholar.google.com/scholar?q=Lewis+R%2E+Goldberg%2E+1999%2E+A+broad%2Dbandwidth%2C+public+domain%2C+personality+inventory+measuring+the+lower%2Dlevel+facets+of+several+five%2Dfactor+models%2E)
9. Google. 2025. Gemini 2.0 flash. [https://cloud.google.com/vertex-ai/generative-ai/docs/](https://cloud.google.com/vertex-ai/generative-ai/docs/) models/gemini/2-0-flash. Large language model. Knowledge cutoff: June 2024. Accessed: 2025-05-09. [↗](https://cloud.google.com/vertex-ai/generative-ai/docs/)
10. Jacqueline Harding, William D’Alessandro, N G Laskowski, and Robert Long. 2024. AI language models cannot replace human research participants. AI & SOCIETY, 39(5):2603–2605. [find](https://scholar.google.com/scholar?q=Jacqueline+Harding%2C+William+D%E2%80%99Alessandro%2C+N+G+Laskowski%2C+and+Robert+Long%2E+2024%2E+AI+language+models+cannot+replace+human+research+participants%2E+AI+%26+SOCIETY%2C+39%285%29%3A2603%E2%80%932605%2E)
11. Razan Baltaji, Babak Hemmatian, and Lav Varshney. 2024. Conformity, confabulation, and impersonation: Persona inconstancy in multi-agent LLM collaboration. In Proceedings of the 2nd Workshop on Cross-Cultural Considerations in NLP, pages 17–31, Bangkok, Thailand. Association for Computational Lingui… [find](https://scholar.google.com/scholar?q=Razan+Baltaji%2C+Babak+Hemmatian%2C+and+Lav+Varshney%2E+2024%2E+Conformity%2C+confabulation%2C+and+impersonation%3A+Persona+inconstancy+in+multi%2Dagent+LLM+collaboration%2E+In+Proceedings+of+the+2nd+Workshop+on+Cross%2D)
12. Jen-tse Huang, Wenxiang Jiao, Man Ho Lam, Eric John Li, Wenxuan Wang, and Michael Lyu. 2024. On the reliability of psychological scales on large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 6152–6173, Miami, Florida, USA. Associati… [find](https://scholar.google.com/scholar?q=Jen%2Dtse+Huang%2C+Wenxiang+Jiao%2C+Man+Ho+Lam%2C+Eric+John+Li%2C+Wenxuan+Wang%2C+and+Michael+Lyu%2E+2024%2E+On+the+reliability+of+psychological+scales+on+large+language+models%2E+In+Proceedings+of+the+2024+Conference+)
13. Pranav Bhandari, Nicolas Fay, Michael Wise, Amitava Datta, Stephanie Meek, Usman Naseem, and Mehwish Nasim. 2025. Can llm agents maintain a persona in discourse? Preprint, arXiv:2502.11843. [find](https://scholar.google.com/scholar?q=Pranav+Bhandari%2C+Nicolas+Fay%2C+Michael+Wise%2C+Amitava+Datta%2C+Stephanie+Meek%2C+Usman+Naseem%2C+and+Mehwish+Nasim%2E+2025%2E+Can+llm+agents+maintain+a+persona+in+discourse%3F+Preprint%2C+arXiv%3A2502%2E11843%2E)
14. Yin Jou Huang and Rafik Hadfi. 2024. How personality traits influence negotiation outcomes? a simulation based on large language models. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 10336–10351, Miami, Florida, USA. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Yin+Jou+Huang+and+Rafik+Hadfi%2E+2024%2E+How+personality+traits+influence+negotiation+outcomes%3F+a+simulation+based+on+large+language+models%2E+In+Findings+of+the+Association+for+Computational+Linguistics%3A+E)
15. Arijit Ghosh Chowdhury, Md Mofijul Islam, Vaibhav Kumar, Faysal Hossain Shezan, Vaibhav Kumar, Vinija Jain, and Aman Chadha. 2024. Breaking down the defenses: A comparative survey of attacks on large language models. Preprint, arXiv:2403.04786. — [arXiv:2403.04786](https://arxiv.org/abs/2403.04786) [find](https://scholar.google.com/scholar?q=Arijit+Ghosh+Chowdhury%2C+Md+Mofijul+Islam%2C+Vaibhav+Kumar%2C+Faysal+Hossain+Shezan%2C+Vaibhav+Kumar%2C+Vinija+Jain%2C+and+Aman+Chadha%2E+2024%2E+Breaking+down+the+defenses%3A+A+comparative+survey+of+attacks+on+large+)
16. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). Preprint, arXiv:2309.00614.
17. Guangyuan Jiang, Manjie Xu, Song-Chun Zhu, Wenjuan Han, Chi Zhang, and Yixin Zhu. 2023. Evaluating and inducing personality in pre-trained language models. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS ’23, Red Hook, NY, USA. Curran Associates Inc… [find](https://scholar.google.com/scholar?q=Guangyuan+Jiang%2C+Manjie+Xu%2C+Song%2DChun+Zhu%2C+Wenjuan+Han%2C+Chi+Zhang%2C+and+Yixin+Zhu%2E+2023%2E+Evaluating+and+inducing+personality+in+pre%2Dtrained+language+models%2E+In+Proceedings+of+the+37th+International+Con)
18. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024. [AutoDAN: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). In The Twelfth International Conference on Learning Representations.
19. Yue Liu, Xiaoxin He, Miao Xiong, Jinlan Fu, Shumin Deng, YINGWEI MA, Jiaheng Zhang, and Bryan Hooi. 2025. Flipattack: Jailbreak LLMs via flipping. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Yue+Liu%2C+Xiaoxin+He%2C+Miao+Xiong%2C+Jinlan+Fu%2C+Shumin+Deng%2C+YINGWEI+MA%2C+Jiaheng+Zhang%2C+and+Bryan+Hooi%2E+2025%2E+Flipattack%3A+Jailbreak+LLMs+via+flipping%2E+In+Forty%2Dsecond+International+Conference+on+Machine+L)
20. Hang Jiang, Xiajie Zhang, Xubo Cao, Cynthia Breazeal, Deb Roy, and Jad Kabbara. 2024. PersonaLLM: Investigating the ability of large language models to express personality traits. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3605–3627, Mexico City, Mexico. Associat… [find](https://scholar.google.com/scholar?q=Hang+Jiang%2C+Xiajie+Zhang%2C+Xubo+Cao%2C+Cynthia+Breazeal%2C+Deb+Roy%2C+and+Jad+Kabbara%2E+2024%2E+PersonaLLM%3A+Investigating+the+ability+of+large+language+models+to+express+personality+traits%2E+In+Findings+of+the+A)
21. R R McCrae and P T Costa, Jr. 1997. Personality trait structure as a human universal. Am. Psychol., 52(5):509–516. [find](https://scholar.google.com/scholar?q=R+R+McCrae+and+P+T+Costa%2C+Jr%2E+1997%2E+Personality+trait+structure+as+a+human+universal%2E+Am%2E+Psychol%2E%2C+52%285%29%3A509%E2%80%93516%2E)
22. O. P. John and S. Srivastava. 1999. The Big Five Trait taxonomy: History, measurement, and theoretical perspectives, pages 102–138. [find](https://scholar.google.com/scholar?q=O%2E+P%2E+John+and+S%2E+Srivastava%2E+1999%2E+The+Big+Five+Trait+taxonomy%3A+History%2C+measurement%2C+and+theoretical+perspectives%2C+pages+102%E2%80%93138%2E)
23. Meta. 2025. Llama 4 maverick 17b-128e model card. [https://huggingface.co/meta-llama/](https://huggingface.co/meta-llama/) Llama-4-Maverick-17B-128E-Instruct. Accessed: 2025-05-09. Llama 4 Community License Agreement. [↗](https://huggingface.co/meta-llama/)
24. Oliver P John, Eileen M Donahue, and Robert L Kentle. 1991. Big five inventory. Journal of personality and social psychology. [find](https://scholar.google.com/scholar?q=Oliver+P+John%2C+Eileen+M+Donahue%2C+and+Robert+L+Kentle%2E+1991%2E+Big+five+inventory%2E+Journal+of+personality+and+social+psychology%2E)
25. Cheng Li, Ziang Leng, Chenxi Yan, Junyi Shen, Hao Wang, Weishi MI, Yaying Fei, Xiaoyang Feng, Song Yan, HaoSheng Wang, Linkang Zhan, Yaokai Jia, Pingyu Wu, and Haozhen Sun. 2023. [Chatharuhi: Reviving anime character in reality via large language model](https://md.research.elamur.ai/free/en/papers/li-2023-chatharuhi-reviving-anime-character-reality/). Preprint, arXiv:2308.09597.
26. Dianqi Li, Yizhe Zhang, Hao Peng, Liqun Chen, Chris Brockett, Ming-Ting Sun, and Bill Dolan. 2021. [Contextualized perturbation for textual adversarial attack](https://md.research.elamur.ai/free/en/papers/li-2021-contextualized-perturbation-textual-adversarial-attack/). In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technolo…
27. Wenkai Li, Jiarui Liu, Andy Liu, Xuhui Zhou, Mona Diab, and Maarten Sap. 2025. [Big5-chat: Shaping llm personalities through training on human-grounded data](https://md.research.elamur.ai/free/en/papers/li-2025-big5-chat-shaping-llm-personalities/). Preprint, arXiv:2410.16491.
28. Xirui Li, Ruochen Wang, Minhao Cheng, Tianyi Zhou, and Cho-Jui Hsieh. 2024a. DrAttack: Prompt decomposition and reconstruction makes powerful LLMs jailbreakers. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 13891– 13913, Miami, Florida, USA. Association for Computat… [find](https://scholar.google.com/scholar?q=Xirui+Li%2C+Ruochen+Wang%2C+Minhao+Cheng%2C+Tianyi+Zhou%2C+and+Cho%2DJui+Hsieh%2E+2024a%2E+DrAttack%3A+Prompt+decomposition+and+reconstruction+makes+powerful+LLMs+jailbreakers%2E+In+Findings+of+the+Association+for+Comp)
29. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2024b. [Deepinception: Hypnotize large language model to be jailbreaker](https://md.research.elamur.ai/free/en/papers/li-2023-deepinception-hypnotize-large-language-model/). In Neurips Safe Generative AI Workshop 2024.
30. Dimitri Linden, te, and Jan Nijenhuis. 2010. The general factor of personality: A meta-analysis of big five intercorrelations and a criterion-related validity study. Journal of Research in Personality, 44:315–327. [find](https://scholar.google.com/scholar?q=Dimitri+Linden%2C+te%2C+and+Jan+Nijenhuis%2E+2010%2E+The+general+factor+of+personality%3A+A+meta%2Danalysis+of+big+five+intercorrelations+and+a+criterion%2Drelated+validity+study%2E+Journal+of+Research+in+Personality)
31. R R McCrae and O P John. 1992. An introduction to the five-factor model and its applications. J. Pers., 60(2):175–215. [find](https://scholar.google.com/scholar?q=R+R+McCrae+and+O+P+John%2E+1992%2E+An+introduction+to+the+five%2Dfactor+model+and+its+applications%2E+J%2E+Pers%2E%2C+60%282%29%3A175%E2%80%93215%2E)
32. Janek Musek. 2007. A general factor of personality: Evidence for the big one in the five-factor model. Journal of Research in Personality, 41(6):1213–1233. [find](https://scholar.google.com/scholar?q=Janek+Musek%2E+2007%2E+A+general+factor+of+personality%3A+Evidence+for+the+big+one+in+the+five%2Dfactor+model%2E+Journal+of+Research+in+Personality%2C+41%286%29%3A1213%E2%80%931233%2E)
33. OpenAI. 2024a. Gpt-4o. [https://platform.openai.com/docs/models/gpt-4o](https://platform.openai.com/docs/models/gpt-4o). Flagship multimodal model (text and image input, text output). Accessed: 2025-05-09. [↗](https://platform.openai.com/docs/models/gpt-4o)
34. OpenAI. 2024b. Openai o3-mini system card. [https://cdn.openai.com/](https://cdn.openai.com/) Accessed: o3-mini-system-card-feb10.pdf. 2025-05-09. [↗](https://cdn.openai.com/)
35. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. [Red teaming language models with language models](https://md.research.elamur.ai/free/en/papers/perez-2022-red-teaming-language-models-language/). In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 3419–3448, Abu…
36. Ethan Perez, Sam Ringer, Kamile Lukosiute, Karina Nguyen, Edwin Chen, Scott Heiner, Craig Pettit, Catherine Olsson, Sandipan Kundu, Saurav Kadavath, Andy Jones, Anna Chen, Benjamin Mann, Brian Israel, Bryan Seethor, Cameron McKinnon, Christopher Olah, Da Yan, Daniela Amodei, Dario Amodei, Dawn Drain… — [Discovering Language Model Behaviors with Model-Written Evaluations](https://md.research.elamur.ai/free/en/papers/perez-2022-discovering-language-model-behaviors-model/)
37. Fábio Perez and Ian Ribeiro. 2022. [Ignore previous prompt: Attack techniques for language models](https://md.research.elamur.ai/free/en/papers/perez-2022-ignore-previous-prompt-attack-techniques/). Preprint, arXiv:2211.09527.
38. EMNLP 2024, pages 16612–16631, Miami, Florida, USA. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=EMNLP+2024%2C+pages+16612%E2%80%9316631%2C+Miami%2C+Florida%2C+USA%2E+Association+for+Computational+Linguistics%2E)
39. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for attacking and analyzing NLP. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Proce… [find](https://scholar.google.com/scholar?q=Eric+Wallace%2C+Shi+Feng%2C+Nikhil+Kandpal%2C+Matt+Gardner%2C+and+Sameer+Singh%2E+2019%2E+Universal+adversarial+triggers+for+attacking+and+analyzing+NLP%2E+In+Proceedings+of+the+2019+Conference+on+Empirical+Methods)
40. Leonard Salewski, Stephan Alaniz, Isabel Rio-Torto, Eric Schulz, and Zeynep Akata. 2023. In-context impersonation reveals large language models'strengths and biases. In Advances in Neural Information Processing Systems, volume 36, pages 72044–72057. Curran Associates, Inc. [find](https://scholar.google.com/scholar?q=Leonard+Salewski%2C+Stephan+Alaniz%2C+Isabel+Rio%2DTorto%2C+Eric+Schulz%2C+and+Zeynep+Akata%2E+2023%2E+In%2Dcontext+impersonation+reveals+large+language+models%27strengths+and+biases%2E+In+Advances+in+Neural+Information+)
41. Yixiao Wang, Homa Fashandi, and Kevin Ferreira. 2024. Investigating the personality consistency in quantized role-playing dialogue agents. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: Industry Track, pages 239– 255, Miami, Florida, US. Association for Co… [find](https://scholar.google.com/scholar?q=Yixiao+Wang%2C+Homa+Fashandi%2C+and+Kevin+Ferreira%2E+2024%2E+Investigating+the+personality+consistency+in+quantized+role%2Dplaying+dialogue+agents%2E+In+Proceedings+of+the+2024+Conference+on+Empirical+Methods+in)
42. Jivnesh Sandhan, Fei Cheng, Tushar Sandhan, and Yugo Murawaki. 2025. CAPE: Context-aware personality evaluation framework for large language models. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 10648–10662, Suzhou, China. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Jivnesh+Sandhan%2C+Fei+Cheng%2C+Tushar+Sandhan%2C+and+Yugo+Murawaki%2E+2025%2E+CAPE%3A+Context%2Daware+personality+evaluation+framework+for+large+language+models%2E+In+Findings+of+the+Association+for+Computational+Li)
43. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How does LLM safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) In Thirty-seventh Conference on Neural Information Processing Systems.
44. Andrew Sellergren, Sahar Kazemzadeh, Tiam Jaroensri, Atilla Kiraly, Madeleine Traverse, Timo Kohlberger, Shawn Xu, Fayaz Jamil, Cían Hughes, Charles Lau, et al. 2025. Medgemma technical report. arXiv preprint arXiv:2507.05201. [find](https://scholar.google.com/scholar?q=Andrew+Sellergren%2C+Sahar+Kazemzadeh%2C+Tiam+Jaroensri%2C+Atilla+Kiraly%2C+Madeleine+Traverse%2C+Timo+Kohlberger%2C+Shawn+Xu%2C+Fayaz+Jamil%2C+C%C3%ADan+Hughes%2C+Charles+Lau%2C+et+al%2E+2025%2E+Medgemma+technical+report%2E+arXiv+)
45. Ryan Shea and Zhou Yu. 2023. Building persona consistent dialogue agents with offline reinforcement learning. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 1778–1795, Singapore. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Ryan+Shea+and+Zhou+Yu%2E+2023%2E+Building+persona+consistent+dialogue+agents+with+offline+reinforcement+learning%2E+In+Proceedings+of+the+2023+Conference+on+Empirical+Methods+in+Natural+Language+Processing%2C)
46. Haozhe Shi and Kun Niu. 2024. Enhancing persona consistency with large language models. In Proceedings of the 2024 5th International Conference on Computing, Networks and Internet of Things, CNIOT ’24, page 210–215, New York, NY, USA. Association for Computing Machinery. [find](https://scholar.google.com/scholar?q=Haozhe+Shi+and+Kun+Niu%2E+2024%2E+Enhancing+persona+consistency+with+large+language+models%2E+In+Proceedings+of+the+2024+5th+International+Conference+on+Computing%2C+Networks+and+Internet+of+Things%2C+CNIOT+%E2%80%9924)
47. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. [Intriguing properties of neural networks](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/). Preprint, arXiv:1312.6199.
48. Junya Takayama, Masaya Ohagi, Tomoya Mizumoto, and Katsumasa Yoshikawa. 2025. Persona-consistent dialogue generation via pseudo preference tuning. In Proceedings of the 31st International Conference on Computational Linguistics, pages 5507–5514, Abu Dhabi, UAE. Association for Computational Linguist… [find](https://scholar.google.com/scholar?q=Junya+Takayama%2C+Masaya+Ohagi%2C+Tomoya+Mizumoto%2C+and+Katsumasa+Yoshikawa%2E+2025%2E+Persona%2Dconsistent+dialogue+generation+via+pseudo+preference+tuning%2E+In+Proceedings+of+the+31st+International+Conference+o)
49. Yu-Min Tseng, Yu-Chao Huang, Teng-Yun Hsiao, Wei-Lin Chen, Chao-Wei Huang, Yu Meng, and Yun-Nung Chen. 2024. [Two tales of persona in LLMs: A survey of role-playing and personalization](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbreak-guard-aligned-language-models/). In Findings of the Association for Computational Linguistics: Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen…
50. Diyi Yang, Caleb Ziems, William Held, Omar Shaikh, Michael S. Bernstein, and John Mitchell. 2024. Social skill training with large language models. Preprint, arXiv:2404.04204. [find](https://scholar.google.com/scholar?q=Diyi+Yang%2C+Caleb+Ziems%2C+William+Held%2C+Omar+Shaikh%2C+Michael+S%2E+Bernstein%2C+and+John+Mitchell%2E+2024%2E+Social+skill+training+with+large+language+models%2E+Preprint%2C+arXiv%3A2404%2E04204%2E)
51. Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. 2024. Jailbreak attacks and defenses against [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). Preprint, arXiv:2407.04295.
52. Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2024. [GPT-4 is too smart to be safe: Stealthy chat with LLMs via cipher](https://md.research.elamur.ai/free/en/papers/yuan-2023-gpt-4-too-smart-safe/). In The Twelfth International Conference on Learning Representations.
53. Longyin Zhang, Fang Kong, and Guodong Zhou. 2021. [Adversarial learning for discourse rhetorical structure parsing](https://md.research.elamur.ai/free/en/papers/zhang-2021-adversarial-learning-discourse-rhetorical-structure/). In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Pap…
54. Enyu Zhou, Rui Zheng, Zhiheng Xi, Songyang Gao, Xiaoran Fan, Zichu Fei, Jingting Ye, Tao Gui, Qi Zhang, and Xuanjing Huang. 2023. RealBehavior: A framework for faithfully characterizing foundation models’ human-like behavior mechanisms. In Findings of the Association for Computational Linguistics: E… [find](https://scholar.google.com/scholar?q=Enyu+Zhou%2C+Rui+Zheng%2C+Zhiheng+Xi%2C+Songyang+Gao%2C+Xiaoran+Fan%2C+Zichu+Fei%2C+Jingting+Ye%2C+Tao+Gui%2C+Qi+Zhang%2C+and+Xuanjing+Huang%2E+2023%2E+RealBehavior%3A+A+framework+for+faithfully+characterizing+foundation+mod)
55. Kaijie Zhu, Qinlin Zhao, Hao Chen, Jindong Wang, and Xing Xie. 2024a. Promptbench: A unified library for evaluation of large language models. Journal of Machine Learning Research, 25(254):1–22. [find](https://scholar.google.com/scholar?q=Kaijie+Zhu%2C+Qinlin+Zhao%2C+Hao+Chen%2C+Jindong+Wang%2C+and+Xing+Xie%2E+2024a%2E+Promptbench%3A+A+unified+library+for+evaluation+of+large+language+models%2E+Journal+of+Machine+Learning+Research%2C+25%28254%29%3A1%E2%80%9322%2E)
56. Kaijie Zhu, Qinlin Zhao, Hao Chen, Jindong Wang, and Xing Xie. 2024b. Promptbench: a unified library for evaluation of large language models. J. Mach. Learn. Res., 25(1). [find](https://scholar.google.com/scholar?q=Kaijie+Zhu%2C+Qinlin+Zhao%2C+Hao+Chen%2C+Jindong+Wang%2C+and+Xing+Xie%2E+2024b%2E+Promptbench%3A+a+unified+library+for+evaluation+of+large+language+models%2E+J%2E+Mach%2E+Learn%2E+Res%2E%2C+25%281%29%2E)
57. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). Preprint, arXiv:2307.15043.

*Updated 31 October 2026*