---
title: "Activation-Guided Local Editing for Jailbreaking Attacks (2026)"
description: "The authors present AGILE (Activation-GuIded Local Editing), a two-stage framework that merges both… 50 references, cited by 1 paper here."
authors: ["Jiecong Wang", "Haoran Li", "Hao Peng", "Ziqian Zeng", "Zihao Wang", "Haohua Du", "Zhengtao Yu"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.801/"
doi: "10.18653/v1/2026.acl-long.801"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/wang-2026-activation-guided-local-editing-jailbreaking/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/wang-2026-activation-guided-local-editing-jailbreaking/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/9/) / Activation-Guided Local Editing for Jailbreaking Attacks

# Activation-Guided Local Editing for Jailbreaking Attacks

**Authors:** Jiecong Wang, [Haoran Li](https://md.research.elamur.ai/free/en/authors/haoran-li/), [Hao Peng](https://md.research.elamur.ai/free/en/authors/hao-peng/), [Ziqian Zeng](https://md.research.elamur.ai/free/en/authors/ziqian-zeng/), [Zihao Wang](https://md.research.elamur.ai/free/en/authors/zihao-wang/), Haohua Du and Zhengtao Yu · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.801/) · [PDF](https://aclanthology.org/2026.acl-long.801.pdf) · [DOI 10.18653/v1/2026.acl-long.801](https://doi.org/10.18653/v1/2026.acl-long.801) · [OpenAlex](https://openalex.org/W4416551507)

**Citations:** 0 citations (OpenAlex, 2026-10-14) · [1](https://md.research.elamur.ai/free/en/papers/wang-2026-activation-guided-local-editing-jailbreaking/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
The paper addresses the weaknesses of current jailbreak techniques used to red-team aligned LLMs. Token-level attacks tend to yield gibberish suffixes that filters catch easily and that rarely transfer to other models. Prompt-level attacks depend on manual crafting or costly iterative search. The authors present AGILE (Activation-GuIded Local Editing), a two-stage framework that merges both families.

1. **Generation stage.** A generator LLM, given a theme and style instructions, writes a fictional multi-turn context in a single pass. Only the user turns are generated; the target model supplies the replies. The same LLM also rewords the harmful request into a milder-sounding equivalent.
2. **Editing stage.** The target model's internals guide small text edits. Attention scores pick out influential tokens, which are swapped for neutral synonyms under the guidance of a classifier on hidden states that estimates refusal propensity. Low-attention positions receive injected filler tokens.

Because the output is plain text, it transfers to black-box and larger models. On HarmBench, AGILE achieves state-of-the-art attack success. The work exposes alignment gaps that defenses such as activation-based monitoring could target.

## Key points
- AGILE raises Attack Success Rate (ASR) by as much as 37.74% compared with the best-performing baseline, and its attacks carry over effectively to black-box and large-scale models. Code is available at github.com/SELGroup/AGILE.
- Across HarmBench's six harm categories, cybercrime/intrusion queries were the most successful: 97.5% ASR on Llama-3-8B-Instruct and 100% on the other five models. Misinformation and harassment stayed below 45% on all models except Qwen-2.5-7B-Instruct, which the authors attribute to vague phrasing of those queries.
- ASR passes 50% with 10 candidates and largely saturates around 15. Editing 5–7 positions works best, while 1 or 9 positions reduce performance.
- The ablation study shows that success depends mainly on the rephrased query rather than the preceding dialogue context.
- Limitations:
  - No direct white-box attacks were run on models above 70B parameters.
  - Computational cost is higher than for pure black-box methods.
  - Edits occasionally cause semantic drift.
  - Inference-time defenses such as SafeDecoding remain effective against the method.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Hong Kong University of Science and Technology](https://md.research.elamur.ai/free/en/universities/hong-kong-university-of-science-and-technology/) — University, Hong Kong, China · 142 works · 25,136 citations
- [Nanyang Technological University](https://md.research.elamur.ai/free/en/universities/nanyang-technological-university/) — University, Singapore, Singapore · 156 works · 25,644 citations
- [Beihang University](https://md.research.elamur.ai/free/en/universities/beihang-university/) — University, Beijing, China · 65 works · 8,452 citations
- [The Hong Kong University of Science and Technology (Guangzhou)](https://md.research.elamur.ai/free/en/universities/the-hong-kong-university-of-science-and-technology-guangzhou/) — University, Guangzhou, China · 53 works · 1,367 citations
- [South China University of Technology](https://md.research.elamur.ai/free/en/universities/south-china-university-of-technology/) — University, Guangzhou, China · 22 works · 1,554 citations

Also on the byline: [Kunming University of Science and Technology](https://ror.org/00xyeez13).

📚 Shelves (3): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [💻 Software](https://md.research.elamur.ai/free/en/shelves/computer-science/software/) · 92 works

## Cite

Cite as: Jiecong Wang, Haoran Li, Hao Peng, Ziqian Zeng, Zihao Wang, Haohua Du and Zhengtao Yu. 2026. Activation-Guided Local Editing for Jailbreaking Attacks. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{wang2026activation,
  title = {{Activation-Guided Local Editing for Jailbreaking Attacks}},
  author = {Jiecong Wang, Haoran Li, Hao Peng, Ziqian Zeng, Zihao Wang, Haohua Du and Zhengtao Yu},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.801},
  url = {https://doi.org/10.18653/v1/2026.acl-long.801}
}
```

- [← previous AC/DG at Cruciverb-IT: Retrieval-Based Approaches for Italian Crossword Clue Answering](https://md.research.elamur.ai/free/en/papers/yassine-2026-ac-dg-cruciverb-it-retrieval/)
- [next → Active Generalized Category Discovery with Diverse LLM Feedback](https://md.research.elamur.ai/free/en/papers/zou-2026-active-generalized-category-discovery-diverse/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/9/)

## References

50 references, 26 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Marah Abdin, Jyoti Aneja, Harkirat Behl, Sébastien Bubeck, Ronen Eldan, Suriya Gunasekar, Michael Harrison, Russell J Hewett, Mojan Javaheripi, Piero Kauffmann, and 1 others. 2024. [Phi-4 technical report](https://md.research.elamur.ai/free/en/papers/abdin-2024-phi-4-technical-report/). arXiv preprint arXiv:2412.08905.
2. AI@Meta. 2024. Llama 3 model card. [find](https://scholar.google.com/scholar?q=AI%40Meta%2E+2024%2E+Llama+3+model+card%2E)
3. Gabriel Alon and Michael Kamfonas. 2023. [Detecting language model attacks with perplexity](https://md.research.elamur.ai/free/en/papers/alon-2023-detecting-language-model-attacks-perplexity/). Preprint, arXiv:2308.14132.
4. Anthropic. 2024. Claude 3.5 sonnet model card addendum. [find](https://scholar.google.com/scholar?q=Anthropic%2E+2024%2E+Claude+3%2E5+sonnet+model+card+addendum%2E)
5. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, and 1 others. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+and+1+others%2E+2022%2E+Training+a+helpful+and+harmless+assistant+wi)
6. Michiel Bakker, Martin Chadwick, Hannah Sheahan, Michael Tessler, Lucy Campbell-Gillingham, Jan Balaguer, Nat McAleese, Amelia Glaese, John Aslanides, Matt Botvinick, and 1 others. 2022. Fine-tuning language models to find agreement among humans with diverse preferences. Advances in Neural Informati… [find](https://scholar.google.com/scholar?q=Michiel+Bakker%2C+Martin+Chadwick%2C+Hannah+Sheahan%2C+Michael+Tessler%2C+Lucy+Campbell%2DGillingham%2C+Jan+Balaguer%2C+Nat+McAleese%2C+Amelia+Glaese%2C+John+Aslanides%2C+Matt+Botvinick%2C+and+1+others%2E+2022%2E+Fine%2Dtuning+l)
7. Rishabh Bhardwaj and Soujanya Poria. 2023. Red-teaming large language models using chain of utterances for safety-alignment. Preprint, arXiv:2308.09662. [find](https://scholar.google.com/scholar?q=Rishabh+Bhardwaj+and+Soujanya+Poria%2E+2023%2E+Red%2Dteaming+large+language+models+using+chain+of+utterances+for+safety%2Dalignment%2E+Preprint%2C+arXiv%3A2308%2E09662%2E)
8. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, and 1 others. 2024. [Jailbreakbench: An open robustness benchmark for jailbreaking large language models](https://md.research.elamur.ai/free/en/papers/chao-2024-jailbreakbench-open-robustness-benchmark-jailbreaking/). Advances in Neural…
9. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
10. Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. 2024. A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computationa… [find](https://scholar.google.com/scholar?q=Peng+Ding%2C+Jun+Kuang%2C+Dan+Ma%2C+Xuezhi+Cao%2C+Yunsen+Xian%2C+Jiajun+Chen%2C+and+Shujian+Huang%2E+2024%2E+A+wolf+in+sheep%E2%80%99s+clothing%3A+Generalized+nested+jailbreak+prompts+can+fool+large+language+models+easily%2E+In+)
11. Xiaohu Du, Fan Mo, Ming Wen, Tu Gu, Huadi Zheng, Hai Jin, and Jie Shi. 2025. Multi-turn jailbreaking large language models via attention shifting. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23814–23822. [find](https://scholar.google.com/scholar?q=Xiaohu+Du%2C+Fan+Mo%2C+Ming+Wen%2C+Tu+Gu%2C+Huadi+Zheng%2C+Hai+Jin%2C+and+Jie+Shi%2E+2025%2E+Multi%2Dturn+jailbreaking+large+language+models+via+attention+shifting%2E+In+Proceedings+of+the+AAAI+Conference+on+Artificial+I)
12. Team Gemini. 2025. Gemini 2.0 flash model card. [find](https://scholar.google.com/scholar?q=Team+Gemini%2E+2025%2E+Gemini+2%2E0+flash+model+card%2E)
13. Team GLM, Aohan Zeng, Bin Xu, Bowen Wang, Chenhui Zhang, Da Yin, Diego Rojas, Guanyu Feng, Hanlin Zhao, Hanyu Lai, Hao Yu, Hongning Wang, Jiadai Sun, Jiajie Zhang, Jiale Cheng, Jiayi Gui, Jie Tang, Jing Zhang, Juanzi Li, and 37 others. 2024. [Chatglm: A family of large language models from glm-130b t…](https://md.research.elamur.ai/free/en/papers/glm-2024-chatglm-family-large-language-models/)
14. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and 1 others. 2023. [Llama guard: Llm-based input-output safeguard for human-ai conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/). arXiv preprint arXiv:2312.06674.
15. Muhammad Faaiz Taufiq, and Hang Li. 2023b. [Trustworthy LLMs: a survey and guideline for evaluating large language models’ alignment](https://md.research.elamur.ai/free/en/papers/liu-2023-trustworthy-llms-survey-guideline-evaluating/). In Socially Responsible Language Modelling Research.
16. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. [Beavertails: Towards improved safety alignment of llm via a human-preference dataset](https://md.research.elamur.ai/free/en/papers/ji-2023-beavertails-towards-improved-safety-alignment/). Advances in Neural Information Processing Systems, 36:24678–24704.
17. AI @ Meta Llama Team. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). Preprint, arXiv:2407.21783.
18. Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. 2025. Improved techniques for optimization-based jailbreaking on large language models. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Xiaojun+Jia%2C+Tianyu+Pang%2C+Chao+Du%2C+Yihao+Huang%2C+Jindong+Gu%2C+Yang+Liu%2C+Xiaochun+Cao%2C+and+Min+Lin%2E+2025%2E+Improved+techniques+for+optimization%2Dbased+jailbreaking+on+large+language+models%2E+In+The+Thirteen)
19. Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming-Wei Chang, Andrew M. Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov. 2019a. [Natural…](https://md.research.elamur.ai/free/en/papers/kwiatkowski-2019-natural-questions-benchmark-question-answering/)
20. Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, and 1 others. 2019b. [Natural questions: a benchmark for question answering research](https://md.research.elamur.ai/free/en/papers/kwiatkowski-2019-natural-questions-benchmark-question-answering/). Transactions of the Association for Computational Li…
21. Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song. 2023. [Multi-step jailbreaking privacy attacks on chatgpt](https://md.research.elamur.ai/free/en/papers/li-2023-multi-step-jailbreaking-privacy-attacks/). arXiv preprint arXiv:2304.05197.
22. Zeyi Liao and Huan Sun. 2024. AmpleGCG: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed LLMs. In First Conference on Language Modeling. [find](https://scholar.google.com/scholar?q=Zeyi+Liao+and+Huan+Sun%2E+2024%2E+AmpleGCG%3A+Learning+a+universal+and+transferable+generative+model+of+adversarial+suffixes+for+jailbreaking+both+open+and+closed+LLMs%2E+In+First+Conference+on+Language+Model)
23. Runqi Lin, Bo Han, Fengwang Li, and Tongliang Liu. 2025. Understanding and enhancing the transferability of jailbreaking attacks. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Runqi+Lin%2C+Bo+Han%2C+Fengwang+Li%2C+and+Tongliang+Liu%2E+2025%2E+Understanding+and+enhancing+the+transferability+of+jailbreaking+attacks%2E+In+The+Thirteenth+International+Conference+on+Learning+Representations)
24. Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, and 1 others. 2024. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437. [find](https://scholar.google.com/scholar?q=Aixin+Liu%2C+Bei+Feng%2C+Bing+Xue%2C+Bingxuan+Wang%2C+Bochao+Wu%2C+Chengda+Lu%2C+Chenggang+Zhao%2C+Chengqi+Deng%2C+Chenyu+Zhang%2C+Chong+Ruan%2C+and+1+others%2E+2024%2E+Deepseek%2Dv3+technical+report%2E+arXiv+preprint+arXiv%3A2412)
25. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023a. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). arXiv preprint arXiv:2310.04451.
26. Yang Liu, Yuanshun Yao, Jean-Francois Ton, Xiaoying Zhang, Ruocheng Guo, Hao Cheng, Yegor Klochkov, Mantas Mazeika, Dan Hendrycks, Huichen Li, Xiaojun Xu, Sidney Hough, Andy Zou, Arezoo Rajabi, Qi Yao, Zihao Wang, Jian Tian, and 1 others. 2023. The trojan detection challenge. In NeurIPS 2022 Competi… [find](https://scholar.google.com/scholar?q=Yang+Liu%2C+Yuanshun+Yao%2C+Jean%2DFrancois+Ton%2C+Xiaoying+Zhang%2C+Ruocheng+Guo%2C+Hao+Cheng%2C+Yegor+Klochkov%2C+Mantas+Mazeika%2C+Dan+Hendrycks%2C+Huichen+Li%2C+Xiaojun+Xu%2C+Sidney+Hough%2C+Andy+Zou%2C+Arezoo+Rajabi%2C+Qi+Yao)
27. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. [Harmbench: a standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). In Proceedings of the 41st International Con…
28. OpenAI. 2024a. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). Preprint, arXiv:2303.08774.
29. OpenAI. 2024b. [Gpt-4o system card](https://md.research.elamur.ai/free/en/papers/openai-2024-gpt-4o-system-card/). arXiv:2410.21276.
30. Preprint, Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022. [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/). Advances in neural information processing systems, 35:2773…
31. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2025. Safety alignment should be made more than just a few tokens deep. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Xiangyu+Qi%2C+Ashwinee+Panda%2C+Kaifeng+Lyu%2C+Xiao+Ma%2C+Subhrajit+Roy%2C+Ahmad+Beirami%2C+Prateek+Mittal%2C+and+Peter+Henderson%2E+2025%2E+Safety+alignment+should+be+made+more+than+just+a+few+tokens+deep%2E+In+The+Thir)
32. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2024. [Fine-tuning aligned language models compromises safety, even when users do not intend to!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/) In The Twelfth International Conference on Learning Representations.
33. Team Qwen. 2024. Qwen2.5: A party of foundation models. [find](https://scholar.google.com/scholar?q=Team+Qwen%2E+2024%2E+Qwen2%2E5%3A+A+party+of+foundation+models%2E)
34. Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, and 1 others. 2019. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9. [find](https://scholar.google.com/scholar?q=Alec+Radford%2C+Jeffrey+Wu%2C+Rewon+Child%2C+David+Luan%2C+Dario+Amodei%2C+Ilya+Sutskever%2C+and+1+others%2E+2019%2E+Language+models+are+unsupervised+multitask+learners%2E+OpenAI+blog%2C+1%288%29%3A9%2E)
35. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. [Direct preference optimization: Your language model is secretly a reward model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). Advances in Neural Information Processing Systems, 36:53728– 53741.
36. Nils Reimers and Iryna Gurevych. 2019. [Sentence-bert: Sentence embeddings using siamese bert-networks](https://md.research.elamur.ai/free/en/papers/reimers-2019-sentence-bert-sentence-embeddings-siamese/). In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 3982–3992.
37. Qibing Ren, Chang Gao, Jing Shao, Junchi Yan, Xin Tan, Wai Lam, and Lizhuang Ma. 2024. CodeAttack: Revealing safety generalization challenges of large language models via code completion. In Findings of the Association for Computational Linguistics: ACL 2024, pages 11437–11452, Bangkok, Thailand. As… [find](https://scholar.google.com/scholar?q=Qibing+Ren%2C+Chang+Gao%2C+Jing+Shao%2C+Junchi+Yan%2C+Xin+Tan%2C+Wai+Lam%2C+and+Lizhuang+Ma%2E+2024%2E+CodeAttack%3A+Revealing+safety+generalization+challenges+of+large+language+models+via+code+completion%2E+In+Findings+)
38. Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2025. [Llms know their vulnerabilities: Uncover safety gaps through natural distribution shifts](https://md.research.elamur.ai/free/en/papers/ren-2025-llms-know-their-vulnerabilities-uncover/). Preprint, arXiv:2410.10700.
39. Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2024. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack. arXiv preprint arXiv:2404.01833. [find](https://scholar.google.com/scholar?q=Mark+Russinovich%2C+Ahmed+Salem%2C+and+Ronen+Eldan%2E+2024%2E+Great%2C+now+write+an+article+about+that%3A+The+crescendo+multi%2Dturn+llm+jailbreak+attack%2E+arXiv+preprint+arXiv%3A2404%2E01833%2E)
40. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. [“do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/). In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS ’24, page 1671–1685, New…
41. Zhihao Xu, Ruixuan Huang, Changyu Chen, and Xiting Wang. 2024b. Uncovering safety risks of large language models through concept activation vector. Advances in Neural Information Processing Systems, 37:116743–116782. [find](https://scholar.google.com/scholar?q=Zhihao+Xu%2C+Ruixuan+Huang%2C+Changyu+Chen%2C+and+Xiting+Wang%2E+2024b%2E+Uncovering+safety+risks+of+large+language+models+through+concept+activation+vector%2E+Advances+in+Neural+Information+Processing+Systems%2C+3)
42. Xikang Yang, Xuehai Tang, Songlin Hu, and Jizhong Han. 2024. Chain of attack: a semantic-driven contextual multi-turn attacker for llm. arXiv preprint arXiv:2405.05610. — [arXiv:2405.05610](https://arxiv.org/abs/2405.05610) [find](https://scholar.google.com/scholar?q=Xikang+Yang%2C+Xuehai+Tang%2C+Songlin+Hu%2C+and+Jizhong+Han%2E+2024%2E+Chain+of+attack%3A+a+semantic%2Ddriven+contextual+multi%2Dturn+attacker+for+llm%2E+arXiv+preprint+arXiv%3A2405%2E05610%2E+%E2%80%94+%5BarXiv%3A2405%2E05610%5D%28https%3A%2F%2Far)
43. Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. [Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts](https://md.research.elamur.ai/free/en/papers/yu-2023-gptfuzzer-red-teaming-large-language/). arXiv preprint arXiv:2309.10253.
44. Zhenhong Zhou, Haiyang Yu, Xinghua Zhang, Rongwu Xu, Fei Huang, and Yongbin Li. 2024. How alignment and jailbreak work: Explain LLM safety through intermediate hidden states. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 2461–2488, Miami, Florida, USA. Association f… [find](https://scholar.google.com/scholar?q=Zhenhong+Zhou%2C+Haiyang+Yu%2C+Xinghua+Zhang%2C+Rongwu+Xu%2C+Fei+Huang%2C+and+Yongbin+Li%2E+2024%2E+How+alignment+and+jailbreak+work%3A+Explain+LLM+safety+through+intermediate+hidden+states%2E+In+Findings+of+the+Associ)
45. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.
46. Ruizhe Shi, Yifang Chen, Yushi Hu, Alisa Liu, Hanna Hajishirzi, Noah A Smith, and Simon S Du. 2024. Decoding-time language model alignment with multiple objectives. Advances in Neural Information Processing Systems, 37:48875–48920. [find](https://scholar.google.com/scholar?q=Ruizhe+Shi%2C+Yifang+Chen%2C+Yushi+Hu%2C+Alisa+Liu%2C+Hanna+Hajishirzi%2C+Noah+A+Smith%2C+and+Simon+S+Du%2E+2024%2E+Decoding%2Dtime+language+model+alignment+with+multiple+objectives%2E+Advances+in+Neural+Information+Proc)
47. Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and 1 others. 2024. A strongreject for empty jailbreaks. Advances in Neural Information Processing Systems, 37:125416–125440. [find](https://scholar.google.com/scholar?q=Alexandra+Souly%2C+Qingyuan+Lu%2C+Dillon+Bowen%2C+Tu+Trinh%2C+Elvis+Hsieh%2C+Sana+Pandey%2C+Pieter+Abbeel%2C+Justin+Svegliato%2C+Scott+Emmons%2C+Olivia+Watkins%2C+and+1+others%2E+2024%2E+A+strongreject+for+empty+jailbreaks%2E+)
48. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36:80079–80110.
49. Thomas Winninger, Boussad Addad, and Katarzyna Kapusta. 2025. Using mechanistic interpretability to craft adversarial attacks against large language models. Preprint, arXiv:2503.06269. — [arXiv:2503.06269](https://arxiv.org/abs/2503.06269) [find](https://scholar.google.com/scholar?q=Thomas+Winninger%2C+Boussad+Addad%2C+and+Katarzyna+Kapusta%2E+2025%2E+Using+mechanistic+interpretability+to+craft+adversarial+attacks+against+large+language+models%2E+Preprint%2C+arXiv%3A2503%2E06269%2E+%E2%80%94+%5BarXiv%3A2503%2E0)
50. Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024a. [Safedecoding: Defending against jailbreak attacks via safety-aware decoding](https://md.research.elamur.ai/free/en/papers/xu-2024-safedecoding-defending-against-jailbreak-attacks/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 5…

*Updated 1 November 2026*