---
title: "FineSteer — paper by Weng et al. (2026) — summary and ideas"
description: "FineSteer targets a familiar tension in inference-time steering of LLMs, which is used to reduce problems like jailbreak… 47 references."
authors: ["Zixuan Weng", "Jinghuai Zhang", "Kunlin Cai", "Ying Li", "Peiran Wang", "Yuan Tian"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.852/"
doi: "10.18653/v1/2026.acl-long.852"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/weng-2026-finesteer-unified-framework-fine-grained/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/weng-2026-finesteer-unified-framework-fine-grained/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/33/) / FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models

# FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models

**Authors:** Zixuan Weng, Jinghuai Zhang, Kunlin Cai, [Ying Li](https://md.research.elamur.ai/free/en/authors/ying-li/), Peiran Wang and [Yuan Tian](https://md.research.elamur.ai/free/en/authors/yuan-tian/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.852/) · [PDF](https://aclanthology.org/2026.acl-long.852.pdf) · [DOI 10.18653/v1/2026.acl-long.852](https://doi.org/10.18653/v1/2026.acl-long.852) · [OpenAlex](https://openalex.org/W7166827879)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
FineSteer targets a familiar tension in inference-time steering of LLMs, which is used to reduce problems like jailbreak susceptibility and hallucination. Existing approaches usually push every input in the same direction. This either hurts performance on harmless requests or requires heavy training to decide when to intervene. The authors split steering into two stages. First, Subspace-guided Conditional Steering (SCS) builds a compact subspace from a small labeled set of intervention-required queries. It uses an energy-based score and a learned threshold to decide whether a given input should be steered at all. Second, Mixture-of-Steering-Experts (MoSE) builds a tailored steering vector for each query. It combines prototype "expert" vectors through training-free attention and adds a small learned correction within a Steering Basis Space. On safety and truthfulness benchmarks, FineSteer beats prior steering methods overall while keeping general-task ability nearly intact. It also needs little data, memory, or extra decoding time. This makes it a practical, low-cost alternative to fine-tuning for aligning deployed models.

## Key points
- On TruthfulQA, FineSteer outperforms prior methods by 7.6% when applied to Llama-3. Baselines include CAA, ITI, RV, BiPO, TruthFlow, and AlphaSteer.
- In the Qwen2.5-7B-Instruct ablation, removing SCS causes GSM8K accuracy to fall to 34%, whereas the full FineSteer retains 95%. Removing MoSE weakens steering, with TruthfulQA dropping to 50.86 versus 54.28 for the full method (base model: 48.41).
- Full-time steering baselines can break the model entirely. For example, TruthFlow drives Qwen2.5-7B to 0% on MATH and GSM8K.
- Data efficiency: AlphaSteer's gate is trained on 12,000 general queries. FineSteer trained on only 2,000 matches AlphaSteer, using one-sixth of the data.
- Efficiency on Llama 3-8B: FineSteer has the lowest training memory among the compared methods. On a single NVIDIA A800, its decoding cost is 40.43 ms/token versus 40.38 for AlphaSteer, an increase of about 0.12%. Code is available at github.com/YukinoAsuna/FineSteer.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [University of California, Los Angeles](https://md.research.elamur.ai/free/en/universities/university-of-california-los-angeles/) — University, Los Angeles, United States · 99 works · 56,333 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works

## Cite

Cite as: Zixuan Weng, Jinghuai Zhang, Kunlin Cai, Ying Li, Peiran Wang and Yuan Tian. 2026. FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{weng2026finesteer,
  title = {{FineSteer: A Unified Framework for Fine-Grained Inference-Time Steering in Large Language Models}},
  author = {Zixuan Weng, Jinghuai Zhang, Kunlin Cai, Ying Li, Peiran Wang and Yuan Tian},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.852},
  url = {https://doi.org/10.18653/v1/2026.acl-long.852}
}
```

- [← previous FINEST: Improving LLM Responses to Sensitive Topics Through Fine-Grained Evaluation](https://md.research.elamur.ai/free/en/papers/oh-2026-finest-improving-llm-responses-sensitive/)
- [next → FinMRAGBench: A Realistic and Complex Benchmark for Multi-Modal RAG in Financial Document Analysis](https://md.research.elamur.ai/free/en/papers/yang-2026-finmragbench-realistic-complex-benchmark-multi/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/33/)

## References

47 references, 24 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Anthropic. 2025. Claude code. [https://www.anthropic.com/claude-code](https://www.anthropic.com/claude-code). Accessed: 2026-04-12. [↗](https://www.anthropic.com/claude-code)
2. Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. [Refusal in language models is mediated by a single direction](https://md.research.elamur.ai/free/en/papers/arditi-2024-refusal-language-models-mediated-single/). Advances in Neural Information Processing Systems, 37:136037–136083.
3. Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, and 1 others. 2023. [Qwen technical report](https://md.research.elamur.ai/free/en/papers/bai-2023-qwen-technical-report/). arXiv preprint arXiv:2309.16609.
4. Yejin Bang, Ziwei Ji, Alan Schelten, Anthony Hartshorn, Tara Fowler, Cheng Zhang, Nicola Cancedda, and Pascale Fung. 2025. [Hallulens: Llm hallucination benchmark](https://md.research.elamur.ai/free/en/papers/bang-2025-hallulens-llm-hallucination-benchmark/). arXiv preprint arXiv:2504.17550.
5. Yuanpu Cao, Tianrong Zhang, Bochuan Cao, Ziyi Yin, Lu Lin, Fenglong Ma, and Jinghui Chen. 2024. Personalized steering of large language models: Versatile steering vectors through bi-directional preference optimization. Advances in Neural Information Processing Systems, 37:49519–49551. [find](https://scholar.google.com/scholar?q=Yuanpu+Cao%2C+Tianrong+Zhang%2C+Bochuan+Cao%2C+Ziyi+Yin%2C+Lu+Lin%2C+Fenglong+Ma%2C+and+Jinghui+Chen%2E+2024%2E+Personalized+steering+of+large+language+models%3A+Versatile+steering+vectors+through+bi%2Ddirectional+prefer)
6. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2025. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23–42. IEEE.
7. Xuan Chen, Yuzhou Nie, Wenbo Guo, and Xiangyu Zhang. 2024. When llm meets drl: Advancing jailbreaking efficiency via drl-guided search. Advances in Neural Information Processing Systems, 37:26814– 26845. [find](https://scholar.google.com/scholar?q=Xuan+Chen%2C+Yuzhou+Nie%2C+Wenbo+Guo%2C+and+Xiangyu+Zhang%2E+2024%2E+When+llm+meets+drl%3A+Advancing+jailbreaking+efficiency+via+drl%2Dguided+search%2E+Advances+in+Neural+Information+Processing+Systems%2C+37%3A26814%E2%80%93+268)
8. Yung-Sung Chuang, Yujia Xie, Hongyin Luo, Yoon Kim, James R Glass, and Pengcheng He. 2023. [Dola: Decoding by contrasting layers improves factuality in large language models](https://md.research.elamur.ai/free/en/papers/chuang-2023-dola-decoding-contrasting-layers-improves/). In The Twelfth International Conference on Learning Representations.
9. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, and 1 others. 2021. [Training verifiers to solve math word problems](https://md.research.elamur.ai/free/en/papers/cobbe-2021-training-verifiers-solve-math-word/). arXiv preprint arXiv:2110.14168.
10. Shehzaad Dhuliawala, Mojtaba Komeili, Jing Xu, Roberta Raileanu, Xian Li, Asli Celikyilmaz, and Jason Weston. 2023. [Chain-of-verification reduces hallucination in large language models](https://md.research.elamur.ai/free/en/papers/dhuliawala-2023-chain-verification-reduces-hallucination-large/). arXiv preprint arXiv:2309.11495.
11. Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. 2024. [A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily](https://md.research.elamur.ai/free/en/papers/ding-2023-wolf-sheep-s-clothing-generalized/).
12. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 2136–2153. [find](https://scholar.google.com/scholar?q=In+Proceedings+of+the+2024+Conference+of+the+North+American+Chapter+of+the+Association+for+Computational+Linguistics%3A+Human+Language+Technologies+%28Volume+1%3A+Long+Papers%29%2C+pages+2136%E2%80%932153%2E)
13. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, and 1 others. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). arXiv preprint arXiv:2407.21783.
14. Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yixin Dai, Jiawei Sun, Haofen Wang, and Haofen Wang. 2023. [Retrieval-augmented generation for large language models: A survey](https://md.research.elamur.ai/free/en/papers/gao-2023-retrieval-augmented-generation-large-language/). arXiv preprint arXiv:2312.10997, 2(1).
15. Yuzhe Gu, Wenwei Zhang, Chengqi Lyu, Dahua Lin, and Kai Chen. 2025. Mask-dpo: Generalizable fine-grained factuality alignment of llms. arXiv preprint arXiv:2503.02846. — [arXiv:2503.02846](https://arxiv.org/abs/2503.02846) [find](https://scholar.google.com/scholar?q=Yuzhe+Gu%2C+Wenwei+Zhang%2C+Chengqi+Lyu%2C+Dahua+Lin%2C+and+Kai+Chen%2E+2025%2E+Mask%2Ddpo%3A+Generalizable+fine%2Dgrained+factuality+alignment+of+llms%2E+arXiv+preprint+arXiv%3A2503%2E02846%2E+%E2%80%94+%5BarXiv%3A2503%2E02846%5D%28https%3A%2F%2Farx)
16. Haoqi He, Xiaokai Lin, Jiancai Chen, and Yan Xiao. 2025. Q-detection: A quantum-classical hybrid poisoning attack detection method. arXiv preprint arXiv:2507.06262. — [arXiv:2507.06262](https://arxiv.org/abs/2507.06262) [find](https://scholar.google.com/scholar?q=Haoqi+He%2C+Xiaokai+Lin%2C+Jiancai+Chen%2C+and+Yan+Xiao%2E+2025%2E+Q%2Ddetection%3A+A+quantum%2Dclassical+hybrid+poisoning+attack+detection+method%2E+arXiv+preprint+arXiv%3A2507%2E06262%2E+%E2%80%94+%5BarXiv%3A2507%2E06262%5D%28https%3A%2F%2Farxiv%2E)
17. Dan Hendrycks, Collin Burns, Saurav Kadavath, Akul Arora, Steven Basart, Eric Tang, Dawn Song, and Jacob Steinhardt. Measuring mathematical problem solving with the math dataset. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2). Lei Huang, W… — [A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questions](https://md.research.elamur.ai/free/en/papers/huang-2023-survey-hallucination-large-language-models/)
18. Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. 2024. Improved techniques for optimization-based jailbreaking on large language models. arXiv preprint arXiv:2405.21018. — [arXiv:2405.21018](https://arxiv.org/abs/2405.21018) [find](https://scholar.google.com/scholar?q=Xiaojun+Jia%2C+Tianyu+Pang%2C+Chao+Du%2C+Yihao+Huang%2C+Jindong+Gu%2C+Yang+Liu%2C+Xiaochun+Cao%2C+and+Min+Lin%2E+2024%2E+Improved+techniques+for+optimization%2Dbased+jailbreaking+on+large+language+models%2E+arXiv+preprint+)
19. Stephanie Lin, Jacob Hilton, and Owain Evans. 2021. [Truthfulqa: Measuring how models mimic human falsehoods](https://md.research.elamur.ai/free/en/papers/lin-2022-truthfulqa-measuring-how-models-mimic/). arXiv preprint arXiv:2109.07958.
20. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). arXiv preprint arXiv:2310.04451.
21. OpenAI. 2026. Chatgpt. [https://chat.openai.com/](https://chat.openai.com/). Accessed: 2026-04-12. [↗](https://chat.openai.com/)
22. OpenClaw. 2026. Openclaw: The ai that actually does things. [https://openclaw.ai/](https://openclaw.ai/). Accessed: 2026-04-12. [↗](https://openclaw.ai/)
23. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022. [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/). Advances in neural information processing systems, 35:27730–27744.
24. Oxtia. 2025. Chatgpt jailbreak prompts: Aim prompt. [https://oxtia.com/](https://oxtia.com/) chatgpt-jailbreak-prompts/aim-prompt/. [↗](https://oxtia.com/)
25. Nina Panickssery, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner. 2023. Steering llama 2 via contrastive activation addition. arXiv preprint arXiv:2312.06681. [find](https://scholar.google.com/scholar?q=Nina+Panickssery%2C+Nick+Gabrieli%2C+Julian+Schulz%2C+Meg+Tong%2C+Evan+Hubinger%2C+and+Alexander+Matt+Turner%2E+2023%2E+Steering+llama+2+via+contrastive+activation+addition%2E+arXiv+preprint+arXiv%3A2312%2E06681%2E)
26. Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. 2024. Ad-vprompter: Fast adaptive adversarial prompting for llms. arXiv preprint arXiv:2404.16873. — [arXiv:2404.16873](https://arxiv.org/abs/2404.16873) [find](https://scholar.google.com/scholar?q=Anselm+Paulus%2C+Arman+Zharmagambetov%2C+Chuan+Guo%2C+Brandon+Amos%2C+and+Yuandong+Tian%2E+2024%2E+Ad%2Dvprompter%3A+Fast+adaptive+adversarial+prompting+for+llms%2E+arXiv+preprint+arXiv%3A2404%2E16873%2E+%E2%80%94+%5BarXiv%3A2404%2E16873%5D)
27. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. [Direct preference optimization: Your language model is secretly a reward model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). Advances in neural information processing systems, 36:53728–53741.
28. Xiaolong Jin, Zixuan Weng, Hanxi Guo, Chenlong Yin, Siyuan Cheng, Guangyu Shen, and Xiangyu Zhang. 2025. Jailbreakdiffbench: A comprehensive benchmark for jailbreaking diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16461–16471. [find](https://scholar.google.com/scholar?q=Xiaolong+Jin%2C+Zixuan+Weng%2C+Hanxi+Guo%2C+Chenlong+Yin%2C+Siyuan+Cheng%2C+Guangyu+Shen%2C+and+Xiangyu+Zhang%2E+2025%2E+Jailbreakdiffbench%3A+A+comprehensive+benchmark+for+jailbreaking+diffusion+models%2E+In+Proceedings)
29. Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. [XSTest: A test suite for identifying exaggerated safety behaviours in large language models](https://md.research.elamur.ai/free/en/papers/rottger-2023-xstest-test-suite-identifying-exaggerated/). In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational L…
30. Bruce W Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar. 2024. Programming refusal with conditional activation steering. arXiv preprint arXiv:2409.05907. [find](https://scholar.google.com/scholar?q=Bruce+W+Lee%2C+Inkit+Padhi%2C+Karthikeyan+Natesan+Ramamurthy%2C+Erik+Miehling%2C+Pierre+Dognin%2C+Manish+Nagireddy%2C+and+Amit+Dhurandhar%2E+2024%2E+Programming+refusal+with+conditional+activation+steering%2E+arXiv+pre)
31. Guobin Shen, Dongcheng Zhao, Yiting Dong, Xiang He, and Yi Zeng. 2024. Jailbreak antidote: Runtime safety-utility balance via sparse representation adjustment in large language models. arXiv preprint arXiv:2410.02298. — [arXiv:2410.02298](https://arxiv.org/abs/2410.02298) [find](https://scholar.google.com/scholar?q=Guobin+Shen%2C+Dongcheng+Zhao%2C+Yiting+Dong%2C+Xiang+He%2C+and+Yi+Zeng%2E+2024%2E+Jailbreak+antidote%3A+Runtime+safety%2Dutility+balance+via+sparse+representation+adjustment+in+large+language+models%2E+arXiv+preprint+)
32. Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. 2023. [Inference-time intervention: Eliciting truthful answers from a language model](https://md.research.elamur.ai/free/en/papers/li-2023-inference-time-intervention-eliciting-truthful/). Advances in Neural Information Processing Systems, 36:41451–41530.
33. Leheng Sheng, Changshuo Shen, Weixiang Zhao, Junfeng Fang, Xiaohao Liu, Zhenkai Liang, Xiang Wang, An Zhang, and Tat-Seng Chua. 2025. Alphasteer: Learning refusal steering with principled null-space constraint. arXiv preprint arXiv:2506.07022. — [arXiv:2506.07022](https://arxiv.org/abs/2506.07022) [find](https://scholar.google.com/scholar?q=Leheng+Sheng%2C+Changshuo+Shen%2C+Weixiang+Zhao%2C+Junfeng+Fang%2C+Xiaohao+Liu%2C+Zhenkai+Liang%2C+Xiang+Wang%2C+An+Zhang%2C+and+Tat%2DSeng+Chua%2E+2025%2E+Alphasteer%3A+Learning+refusal+steering+with+principled+null%2Dspace+c)
34. Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, and 1 others. 2024. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118. [find](https://scholar.google.com/scholar?q=Gemma+Team%2C+Morgane+Riviere%2C+Shreya+Pathak%2C+Pier+Giuseppe+Sessa%2C+Cassidy+Hardin%2C+Surya+Bhupatiraju%2C+L%C3%A9onard+Hussenot%2C+Thomas+Mesnard%2C+Bobak+Shahriari%2C+Alexandre+Ram%C3%A9%2C+and+1+others%2E+2024%2E+Gemma+2%3A+Impr)
35. Hanyu Wang, Bochuan Cao, Yuanpu Cao, and Jinghui Chen. 2025. Truthflow: Truthful llm generation via representation flow correction. arXiv preprint arXiv:2502.04556. — [arXiv:2502.04556](https://arxiv.org/abs/2502.04556) [find](https://scholar.google.com/scholar?q=Hanyu+Wang%2C+Bochuan+Cao%2C+Yuanpu+Cao%2C+and+Jinghui+Chen%2E+2025%2E+Truthflow%3A+Truthful+llm+generation+via+representation+flow+correction%2E+arXiv+preprint+arXiv%3A2502%2E04556%2E+%E2%80%94+%5BarXiv%3A2502%2E04556%5D%28https%3A%2F%2Farxiv%2E)
36. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023b. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.
37. Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. [{PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models](https://md.research.elamur.ai/free/en/papers/zou-2024-poisonedrag-knowledge-corruption-attacks-retrieval/). In 34th USENIX Security Symposium (USENIX Security 25), pages 3827–3844.
38. Xinpeng Wang, Chengzhi Hu, Paul Röttger, and Barbara Plank. 2024. Surgical, cheap, and flexible: Mitigating false refusal in language models via single vector ablation. arXiv preprint arXiv:2410.03415. — [arXiv:2410.03415](https://arxiv.org/abs/2410.03415) [find](https://scholar.google.com/scholar?q=Xinpeng+Wang%2C+Chengzhi+Hu%2C+Paul+R%C3%B6ttger%2C+and+Barbara+Plank%2E+2024%2E+Surgical%2C+cheap%2C+and+flexible%3A+Mitigating+false+refusal+in+language+models+via+single+vector+ablation%2E+arXiv+preprint+arXiv%3A2410%2E03415)
39. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36:80079–80110.
40. Zixuan Weng, Xiaolong Jin, Jinyuan Jia, and Xiangyu Zhang. 2025. Foot-in-the-door: A multi-turn jailbreak for llms. arXiv preprint arXiv:2502.19820. [find](https://scholar.google.com/scholar?q=Zixuan+Weng%2C+Xiaolong+Jin%2C+Jinyuan+Jia%2C+and+Xiangyu+Zhang%2E+2025%2E+Foot%2Din%2Dthe%2Ddoor%3A+A+multi%2Dturn+jailbreak+for+llms%2E+arXiv+preprint+arXiv%3A2502%2E19820%2E)
41. Ziwei Xu, Sanjay Jain, and Mohan Kankanhalli. 2024. [Hallucination is inevitable: An innate limitation of large language models](https://md.research.elamur.ai/free/en/papers/xu-2024-hallucination-inevitable-innate-limitation-large/). arXiv preprint arXiv:2401.11817.
42. Fan Yang, Jiacen Xu, Chunlin Xiong, Zhou Li, and Ke-huan Zhang. 2023. {PROGRAPHER}: An anomaly detection system based on provenance graph embedding. In 32nd USENIX Security Symposium (USENIX Security 23), pages 4355–4372. [find](https://scholar.google.com/scholar?q=Fan+Yang%2C+Jiacen+Xu%2C+Chunlin+Xiong%2C+Zhou+Li%2C+and+Ke%2Dhuan+Zhang%2E+2023%2E+%7BPROGRAPHER%7D%3A+An+anomaly+detection+system+based+on+provenance+graph+embedding%2E+In+32nd+USENIX+Security+Symposium+%28USENIX+Security+)
43. Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2023. [Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher](https://md.research.elamur.ai/free/en/papers/yuan-2023-gpt-4-too-smart-safe/). arXiv preprint arXiv:2308.06463.
44. Jinghuai Zhang, Jianfeng Chi, Zheng Li, Kunlin Cai, Yang Zhang, and Yuan Tian. 2024. Badmerging: Backdoor attacks against model merging. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 4450–4464. [find](https://scholar.google.com/scholar?q=Jinghuai+Zhang%2C+Jianfeng+Chi%2C+Zheng+Li%2C+Kunlin+Cai%2C+Yang+Zhang%2C+and+Yuan+Tian%2E+2024%2E+Badmerging%3A+Backdoor+attacks+against+model+merging%2E+In+Proceedings+of+the+2024+on+ACM+SIGSAC+Conference+on+Computer)
45. Yaowei Zheng, Richong Zhang, Junhao Zhang, Yanhan Ye, Zheyan Luo, Zhangchi Feng, and Yongqiang Ma. 2024. [Llamafactory: Unified efficient fine-tuning of 100+ language models](https://md.research.elamur.ai/free/en/papers/zheng-2024-llamafactory-unified-efficient-fine-tuning/). arXiv preprint arXiv:2403.13372.
46. Yuxuan Zhou, Yang Bai, Kuofeng Gao, Tao Dai, and Shu-Tao Xia. 2025. Jpro: Automated multimodal jailbreaking via multi-agent collaboration framework. arXiv preprint arXiv:2511.07315. — [arXiv:2511.07315](https://arxiv.org/abs/2511.07315) [find](https://scholar.google.com/scholar?q=Yuxuan+Zhou%2C+Yang+Bai%2C+Kuofeng+Gao%2C+Tao+Dai%2C+and+Shu%2DTao+Xia%2E+2025%2E+Jpro%3A+Automated+multimodal+jailbreaking+via+multi%2Dagent+collaboration+framework%2E+arXiv+preprint+arXiv%3A2511%2E07315%2E+%E2%80%94+%5BarXiv%3A2511%2E0731)
47. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, and 1 others. 2023a. [Representation engineering: A top-down approach to ai transparency](https://md.research.elamur.ai/free/en/papers/zou-2023-representation-engineering-top-down-approach/). arXiv preprint arXiv:2310.01405.

*Updated 2 November 2026*