---
title: "Universal Jailbreak Suffixes Are Strong Attention Hijackers (2026)"
description: "Optimized adversarial suffixes, such as those produced by GCG, can make safety-aligned LLMs… 51 references, cited by 2 papers here."
authors: ["Matan Ben-Tov", "Mor Geva", "Mahmood Sharif"]
year: 2026
venue: "Transactions of the Association for Computational Linguistics"
source: "https://aclanthology.org/2026.tacl-1.46/"
doi: "10.1162/tacl.a.695"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/tov-2026-universal-jailbreak-suffixes-are-strong/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/tov-2026-universal-jailbreak-suffixes-are-strong/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/6/) / Universal Jailbreak Suffixes Are Strong Attention Hijackers

# Universal Jailbreak Suffixes Are Strong Attention Hijackers

**Authors:** Matan Ben-Tov, [Mor Geva](https://md.research.elamur.ai/free/en/authors/mor-geva/) and Mahmood Sharif · **Year:** 2026 · **Venue:** [Transactions of the Association for Computational Linguistics](https://md.research.elamur.ai/free/en/venues/tacl/) ([Transactions of the Association for Computational Linguistics (TACL) 2026](https://md.research.elamur.ai/free/en/venues/tacl/2026/)) · **Publisher:** [The MIT Press](https://md.research.elamur.ai/free/en/publishers/the-mit-press/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.tacl-1.46/) · [PDF](https://aclanthology.org/2026.tacl-1.46.pdf) · [DOI 10.1162/tacl.a.695](https://doi.org/10.1162/tacl.a.695) · [OpenAlex](https://openalex.org/W4415114276)

**Citations:** 1 citations (OpenAlex, 2026-10-14) · 2 in our library, of the 149,439 papers whose bibliographies we read

## Summary

Optimized adversarial suffixes, such as those produced by GCG, can make safety-aligned LLMs answer harmful requests. Some of them also work on many requests they were never tuned for. The authors ask which internal mechanism makes these suffixes succeed and why certain ones transfer so widely.

Working mainly with Gemma2-2B-it, they generated a large pool of single-behavior GCG suffixes and paired them with harmful instructions from AdvBench and StrongReject. They then applied two interpretability tools:
- attention knockout, to localize the critical information flow;
- a dominance score, which measures how much each input segment contributes to the chat template tokens just before the answer.

The attack proves shallow. The flow from suffix to chat tokens is required and largely sufficient. GCG suffixes take over the attention output there while nearly erasing the instruction's contribution. Stronger takeover ("hijacking") goes with greater universality.

This insight is actionable. Rewarding hijacking during optimization yields more universal attacks at no extra cost, and suppressing it gives a cheap defense.

## Key points

- **Setup:** 1200 GCG suffixes were crafted on Gemma2-2B-it and combined with 741 harmful instructions, giving roughly 900K jailbreak prompts.
  - Checks were repeated on Qwen2.5-{0.5B,1.5B,32B}-Instruct and Llama-3.1-8B-Instruct, plus 30 BEAST suffixes.
- **Scoring:** success is graded by StrongReject's fine-tuned classifier.
  - Scores ≥0.65 count as success and ≤0.35 as failure.
  - A suffix's universality is its success rate over all instructions.
- **Mechanism:** cutting the suffix-to-chat information flow fully disables GCG. This supports earlier work that focused on the final token position (chat[-1]).
- **Offense:** the hijacking-encouraging variant (GCG-Hij) raises universality up to about ×5 in some cases, without added compute.
- **Defense:** suppressing hijacking cuts attack success by at least half with minimal utility loss, and monitoring hijacking strength is a strong detection baseline.
  - Code and data are released at github.com/matanbt/interp-jailbreak.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Tel Aviv University](https://md.research.elamur.ai/free/en/universities/tel-aviv-university/) — University, Tel Aviv, Israel · 89 works · 11,326 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Matan Ben-Tov, Mor Geva and Mahmood Sharif. 2026. Universal Jailbreak Suffixes Are Strong Attention Hijackers. Transactions of the Association for Computational Linguistics.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@article{bentov2026universal,
  title = {{Universal Jailbreak Suffixes Are Strong Attention Hijackers}},
  author = {Matan Ben-Tov, Mor Geva and Mahmood Sharif},
  journal = {Transactions of the Association for Computational Linguistics},
  year = {2026},
  doi = {10.1162/tacl.a.695},
  url = {https://doi.org/10.1162/tacl.a.695}
}
```

- [← previous Unified Thinker: A General Reasoning Core for Image Generation](https://md.research.elamur.ai/free/en/papers/zhou-2026-unified-thinker-general-reasoning-core/)
- [next → Unraveling LLM Jailbreaks Through Safety Knowledge Neurons](https://md.research.elamur.ai/free/en/papers/zhao-2026-unraveling-llm-jailbreaks-through-safety/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/6/)

## References

51 references, 24 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. 2025. [Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks](https://md.research.elamur.ai/free/en/papers/andriushchenko-2024-jailbreaking-leading-safety-aligned-llms/). In ICLR.
2. Andy Arditi, Oscar Balcells Obeso, Aaquib Syed, Daniel Paleka, Nina Rimsky, Wes Gurnee, and Neel Nanda. 2024. [Refusal in Language Models Is Mediated by a Single Direction](https://md.research.elamur.ai/free/en/papers/arditi-2024-refusal-language-models-mediated-single/). In NeurIPS.
3. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, Nicholas Joseph, Saurav Kadavath, Jackson Kernion, Tom Conerly, Sheer El-Showk, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Tristan Hume, Scott Johnston, Sh… [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+Nicholas+Joseph%2C+Saurav+Kadavath%2C+Jackson+Kernion%2C+Tom+Conerly%2C+)
4. Sarah Ball, Frauke Kreuter, and Nina Panickssery. 2024. [Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models](https://md.research.elamur.ai/free/en/papers/ball-2026-understanding-jailbreak-success-study-latent/). arXiv.
5. Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, Wei Ye, Yue Zhang, Yi Chang, Philip S. Yu, Qiang Yang, and Xing Xie. 2024. [A Survey on Evaluation of Large Language Models](https://md.research.elamur.ai/free/en/papers/chang-2023-survey-evaluation-large-language-models/). ACM TIST.
6. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramer, Hamed Hassani, and Eric Wong. 2024a. [JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models](https://md.research.elamur.ai/free/en/papers/chao-2024-jailbreakbench-open-robustness-benchmark-jailbreaking/). I…
7. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2024b. [Jailbreaking Black Box Large Language Models in Twenty Queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). In SaTML.
8. Tri Dao, Daniel Y. Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. 2022. FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awareness. In NeurIPS. [find](https://scholar.google.com/scholar?q=Tri+Dao%2C+Daniel+Y%2E+Fu%2C+Stefano+Ermon%2C+Atri+Rudra%2C+and+Christopher+R%C3%A9%2E+2022%2E+FlashAttention%3A+Fast+and+Memory%2DEfficient+Exact+Attention+with+IO%2DAwareness%2E+In+NeurIPS%2E)
9. Nelson Elhage, Tristan Hume, Catherine Olsson, Neel Nanda, Tom Henighan, Scott Johnston, Sheer ElShowk, Nicholas Joseph, Nova Das-Sarma, Ben Mann, Danny Hernandez, Amanda Askell, Kamal Ndousse, Andy Jones, Dawn Drain, Anna Chen, Yuntao Bai, Deep Ganguli, Liane Lovitt, Zac Hatfield-Dodds, Jackson Ker… [find](https://scholar.google.com/scholar?q=Nelson+Elhage%2C+Tristan+Hume%2C+Catherine+Olsson%2C+Neel+Nanda%2C+Tom+Henighan%2C+Scott+Johnston%2C+Sheer+ElShowk%2C+Nicholas+Joseph%2C+Nova+Das%2DSarma%2C+Ben+Mann%2C+Danny+Hernandez%2C+Amanda+Askell%2C+Kamal+Ndousse%2C+Andy+J)
10. Javier Ferrando, Gabriele Sarti, Arianna Bisazza, and Marta R. Costa-jussà. 2024. [A Primer on the Inner Workings of Transformer-based Language Models](https://md.research.elamur.ai/free/en/papers/ferrando-2024-primer-inner-workings-transformer-based/). arXiv.
11. Edgar C Fieller, Herman O Hartley, and Egon S Pearson. 1957. Tests for Rank Correlation Coefficients. I. Biometrika. [find](https://scholar.google.com/scholar?q=Edgar+C+Fieller%2C+Herman+O+Hartley%2C+and+Egon+S+Pearson%2E+1957%2E+Tests+for+Rank+Correlation+Coefficients%2E+I%2E+Biometrika%2E)
12. Mor Geva, Jasmijn Bastings, Katja Filippova, and Amir Globerson. 2023. Dissecting Recall of Factual Associations in Auto-Regressive Language Models. In EMNLP. [find](https://scholar.google.com/scholar?q=Mor+Geva%2C+Jasmijn+Bastings%2C+Katja+Filippova%2C+and+Amir+Globerson%2E+2023%2E+Dissecting+Recall+of+Factual+Associations+in+Auto%2DRegressive+Language+Models%2E+In+EMNLP%2E)
13. Google. 2024. Gemma 2: Improving Open Language Models at a Practical Size. arXiv. [find](https://scholar.google.com/scholar?q=Google%2E+2024%2E+Gemma+2%3A+Improving+Open+Language+Models+at+a+Practical+Size%2E+arXiv%2E)
14. Jonathan Hayase, Ema Borevkovic, Nicholas Carlini, Florian Tramèr, and Milad Nasr. 2024. Query-Based Adversarial Prompt Generation. In NeurIPS. [find](https://scholar.google.com/scholar?q=Jonathan+Hayase%2C+Ema+Borevkovic%2C+Nicholas+Carlini%2C+Florian+Tram%C3%A8r%2C+and+Milad+Nasr%2E+2024%2E+Query%2DBased+Adversarial+Prompt+Generation%2E+In+NeurIPS%2E)
15. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. [Measuring Massive Multitask Language Understanding](https://md.research.elamur.ai/free/en/papers/hendrycks-2020-measuring-massive-multitask-language-understanding/). In ICLR.
16. David Huang, Avidan Shah, Alexandre Araujo, David Wagner, and Chawin Sitawarin. 2025. Stronger Universal and Transferable Attacks by Suppressing Refusals. In NAACL. [find](https://scholar.google.com/scholar?q=David+Huang%2C+Avidan+Shah%2C+Alexandre+Araujo%2C+David+Wagner%2C+and+Chawin+Sitawarin%2E+2025%2E+Stronger+Universal+and+Transferable+Attacks+by+Suppressing+Refusals%2E+In+NAACL%2E)
17. Kuo-Han Hung, Ching-Yun Ko, Ambrish Rawat, I-Hsin Chung, Winston H. Hsu, and Pin-Yu Chen. 2025. Attention Tracker: Detecting Prompt Injection Attacks in LLMs. In Findings of NAACL. [find](https://scholar.google.com/scholar?q=Kuo%2DHan+Hung%2C+Ching%2DYun+Ko%2C+Ambrish+Rawat%2C+I%2DHsin+Chung%2C+Winston+H%2E+Hsu%2C+and+Pin%2DYu+Chen%2E+2025%2E+Attention+Tracker%3A+Detecting+Prompt+Injection+Attacks+in+LLMs%2E+In+Findings+of+NAACL%2E)
18. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline Defenses for Adversarial Attacks Against Aligned Language Models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). arXiv.
19. Samyak Jain, Ekdeep Singh Lubana, Kemal Ok-suz, Tom Joy, Philip Torr, Amartya Sanyal, and Puneet K. Dokania. 2024. What Makes and Breaks Safety Fine-tuning? A Mechanistic Study. In NeurIPS. [find](https://scholar.google.com/scholar?q=Samyak+Jain%2C+Ekdeep+Singh+Lubana%2C+Kemal+Ok%2Dsuz%2C+Tom+Joy%2C+Philip+Torr%2C+Amartya+Sanyal%2C+and+Puneet+K%2E+Dokania%2E+2024%2E+What+Makes+and+Breaks+Safety+Fine%2Dtuning%3F+A+Mechanistic+Study%2E+In+NeurIPS%2E)
20. Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. 2025. Improved Techniques for Optimization-Based Jailbreaking on Large Language Models. In ICLR. [find](https://scholar.google.com/scholar?q=Xiaojun+Jia%2C+Tianyu+Pang%2C+Chao+Du%2C+Yihao+Huang%2C+Jindong+Gu%2C+Yang+Liu%2C+Xiaochun+Cao%2C+and+Min+Lin%2E+2025%2E+Improved+Techniques+for+Optimization%2DBased+Jailbreaking+on+Large+Language+Models%2E+In+ICLR%2E)
21. Nathalie Maria Kirch, Severin Field, and Stephen Casper. 2024. What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attacks. In BlackboxNLP Workshop. [find](https://scholar.google.com/scholar?q=Nathalie+Maria+Kirch%2C+Severin+Field%2C+and+Stephen+Casper%2E+2024%2E+What+Features+in+Prompts+Jailbreak+LLMs%3F+Investigating+the+Mechanisms+Behind+Attacks%2E+In+BlackboxNLP+Workshop%2E)
22. Goro Kobayashi, Tatsuki Kuribayashi, Sho Yokoi, and Kentaro Inui. 2020. [Attention is Not Only a Weight: Analyzing Transformers with Vector Norms](https://md.research.elamur.ai/free/en/papers/kobayashi-2020-attention-is-not-only-weight/). In EMNLP.
23. Goro Kobayashi, Tatsuki Kuribayashi, Sho Yokoi, and Kentaro Inui. 2021. Incorporating Residual and Normalization Layers into Analysis of Masked Language Models. In EMNLP. [find](https://scholar.google.com/scholar?q=Goro+Kobayashi%2C+Tatsuki+Kuribayashi%2C+Sho+Yokoi%2C+and+Kentaro+Inui%2E+2021%2E+Incorporating+Residual+and+Normalization+Layers+into+Analysis+of+Masked+Language+Models%2E+In+EMNLP%2E)
24. Andrew Lee, Xiaoyan Bai, Itamar Pres, Martin Wattenberg, Jonathan K Kummerfeld, and Rada Mihalcea. 2024. [A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicity](https://md.research.elamur.ai/free/en/papers/lee-2024-mechanistic-understanding-alignment-algorithms-case/). In ICML.
25. Chak Tou Leong, Qingyu Yin, Jian Wang, and Wenjie Li. 2025. Why Safeguarded Ships Run Aground? Aligned Large Language Models’ Safety Mechanisms Tend to Be Anchored in The Template Region. In ACL. [find](https://scholar.google.com/scholar?q=Chak+Tou+Leong%2C+Qingyu+Yin%2C+Jian+Wang%2C+and+Wenjie+Li%2E+2025%2E+Why+Safeguarded+Ships+Run+Aground%3F+Aligned+Large+Language+Models%E2%80%99+Safety+Mechanisms+Tend+to+Be+Anchored+in+The+Template+Region%2E+In+ACL%2E)
26. Tianlong Li, Zhenghua Wang, Wenhao Liu, Muling Wu, Shihan Dou, Changze Lv, Xiaohua Wang, Xiaoqing Zheng, and Xuanjing Huang. 2025. [Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspective](https://md.research.elamur.ai/free/en/papers/li-2025-revisiting-jailbreaking-large-language-models/). In COLING.
27. Xuechen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, Ishaan Gulrajani, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. AlpacaEval: An Automatic Evaluator of Instruction-following Models. [https://github.com/tatsu-lab/alpaca_eval](https://github.com/tatsu-lab/alpaca_eval). [↗](https://github.com/tatsu-lab/alpaca_eval)
28. Zeyi Liao and Huan Sun. 2024. AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs. In COLM. [find](https://scholar.google.com/scholar?q=Zeyi+Liao+and+Huan+Sun%2E+2024%2E+AmpleGCG%3A+Learning+a+Universal+and+Transferable+Generative+Model+of+Adversarial+Suffixes+for+Jailbreaking+Both+Open+and+Closed+LLMs%2E+In+COLM%2E)
29. Chin-Yew Lin. 2004. [ROUGE: A Package for Automatic Evaluation of Summaries](https://md.research.elamur.ai/free/en/papers/lin-2004-rouge-package-automatic-evaluation-summaries/). In ACL.
30. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024. [AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). In ICLR.
31. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harm-Bench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. In ICML. [find](https://scholar.google.com/scholar?q=Mantas+Mazeika%2C+Long+Phan%2C+Xuwang+Yin%2C+Andy+Zou%2C+Zifan+Wang%2C+Norman+Mu%2C+Elham+Sakhaee%2C+Nathaniel+Li%2C+Steven+Basart%2C+Bo+Li%2C+David+Forsyth%2C+and+Dan+Hendrycks%2E+2024%2E+Harm%2DBench%3A+A+Standardized+Evaluation)
32. Nicholas Meade, Arkil Patel, and Siva Reddy. 2025. Investigating adversarial trigger transfer in large language models. TACL. [find](https://scholar.google.com/scholar?q=Nicholas+Meade%2C+Arkil+Patel%2C+and+Siva+Reddy%2E+2025%2E+Investigating+adversarial+trigger+transfer+in+large+language+models%2E+TACL%2E)
33. Meta. 2024. [The Llama 3 Herd of Models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). arXiv.
34. Timothee Mickus, Denis Paperno, and Mathieu Constant. 2022. [How to Dissect a Muppet: The Structure of Transformer Embedding Spaces](https://md.research.elamur.ai/free/en/papers/mickus-2022-how-dissect-muppet-structure-transformer/). TACL.
35. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2025. [Safety Alignment Should Be Made More Than Just a Few Tokens Deep](https://md.research.elamur.ai/free/en/papers/qi-2024-safety-alignment-should-made-more/). In ICLR.
36. Qwen. 2025. Qwen2.5 Technical Report. arXiv. [find](https://scholar.google.com/scholar?q=Qwen%2E+2025%2E+Qwen2%2E5+Technical+Report%2E+arXiv%2E)
37. Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. 2024. [Direct Preference Optimization: Your Language Model is Secretly a Reward Model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). In NeurIPS.
38. Vinu Sankar Sadasivan, Shoumik Saha, Gau-rang Sriramanan, Priyatham Kattakinda, Atoosa Chegini, and Soheil Feizi. 2024. Fast Adversarial Attacks on Language Models In One GPU Minute. In ICML. [find](https://scholar.google.com/scholar?q=Vinu+Sankar+Sadasivan%2C+Shoumik+Saha%2C+Gau%2Drang+Sriramanan%2C+Priyatham+Kattakinda%2C+Atoosa+Chegini%2C+and+Soheil+Feizi%2E+2024%2E+Fast+Adversarial+Attacks+on+Language+Models+In+One+GPU+Minute%2E+In+ICML%2E)
39. Patrick Schober, Christa Boer, and Lothar A Schwarte. 2018. Correlation Coefficients: Appropriate Use and Interpretation. Anesthesia & Analgesia. [find](https://scholar.google.com/scholar?q=Patrick+Schober%2C+Christa+Boer%2C+and+Lothar+A+Schwarte%2E+2018%2E+Correlation+Coefficients%3A+Appropriate+Use+and+Interpretation%2E+Anesthesia+%26+Analgesia%2E)
40. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. [“Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/). In CCS.
41. Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. 2024. A StrongRE-JECT for Empty Jailbreaks. In NeurIPS. [find](https://scholar.google.com/scholar?q=Alexandra+Souly%2C+Qingyuan+Lu%2C+Dillon+Bowen%2C+Tu+Trinh%2C+Elvis+Hsieh%2C+Sana+Pandey%2C+Pieter+Abbeel%2C+Justin+Svegliato%2C+Scott+Emmons%2C+Olivia+Watkins%2C+and+Sam+Toyer%2E+2024%2E+A+StrongRE%2DJECT+for+Empty+Jailbreaks)
42. Leonard Tang. 2024. A Trivial Jailbreak Against Llama 3. [https://github.com/haizelabs/](https://github.com/haizelabs/) llama3-jailbreak. [↗](https://github.com/haizelabs/)
43. T. Ben Thompson and Michael Sklar. 2024. FLRT: Fluent Student-Teacher Redteaming. arXiv. [find](https://scholar.google.com/scholar?q=T%2E+Ben+Thompson+and+Michael+Sklar%2E+2024%2E+FLRT%3A+Fluent+Student%2DTeacher+Redteaming%2E+arXiv%2E)
44. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. [Attention Is All You Need](https://md.research.elamur.ai/free/en/papers/vaswani-2017-attention-all-need/). In NeurIPS.
45. Jesse Vig, Sebastian Gehrmann, Yonatan Belinkov, Sharon Qian, Daniel Nevo, Simas Sakenis, Jason Huang, Yaron Singer, and Stuart Shieber. 2020. Causal Mediation Analysis for Interpreting Neural NLP: The Case of Gender Bias. In NeurIPS. [find](https://scholar.google.com/scholar?q=Jesse+Vig%2C+Sebastian+Gehrmann%2C+Yonatan+Belinkov%2C+Sharon+Qian%2C+Daniel+Nevo%2C+Simas+Sakenis%2C+Jason+Huang%2C+Yaron+Singer%2C+and+Stuart+Shieber%2E+2020%2E+Causal+Mediation+Analysis+for+Interpreting+Neural+NLP%3A+Th)
46. Kevin Ro Wang, Alexandre Variengien, Arthur Conmy, Buck Shlegeris, and Jacob Steinhardt. 2023. Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 Small. In ICLR. [find](https://scholar.google.com/scholar?q=Kevin+Ro+Wang%2C+Alexandre+Variengien%2C+Arthur+Conmy%2C+Buck+Shlegeris%2C+and+Jacob+Steinhardt%2E+2023%2E+Interpretability+in+the+Wild%3A+a+Circuit+for+Indirect+Object+Identification+in+GPT%2D2+Small%2E+In+ICLR%2E)
47. Zijun Wang, Haoqin Tu, Jieru Mei, Bingchen Zhao, Yisen Wang, and Cihang Xie. 2024. AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation. arXiv. [find](https://scholar.google.com/scholar?q=Zijun+Wang%2C+Haoqin+Tu%2C+Jieru+Mei%2C+Bingchen+Zhao%2C+Yisen+Wang%2C+and+Cihang+Xie%2E+2024%2E+AttnGCG%3A+Enhancing+Jailbreaking+Attacks+on+LLMs+with+Attention+Manipulation%2E+arXiv%2E)
48. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How Does LLM Safety Training Fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) In NeurIPS.
49. Fred Zhang and Neel Nanda. 2024. [Towards Best Practices of Activation Patching in Language Models: Metrics and Methods](https://md.research.elamur.ai/free/en/papers/zhang-2023-towards-best-practices-activation-patching/). In ICLR.
50. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J. Zico Kolter, and Dan Hendry… — [Representation Engineering: A Top-Down Approach to AI Transparency](https://md.research.elamur.ai/free/en/papers/zou-2023-representation-engineering-top-down-approach/)
51. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023b. [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv.

*Updated 2 November 2026*