---
title: "Silencing the Guardrails — paper by Xing et al. (2026)"
description: "The authors propose Contextual Representation Ablation (CRA), which uses no training and does not modify weights. 38 references."
authors: ["Wenpeng Xing", "Moran Fang", "Guangtai Wang", "Changting Lin", "Meng Han"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.211/"
doi: "10.18653/v1/2026.findings-acl.211"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/xing-2026-silencing-guardrails-inference-time-jailbreaking/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/xing-2026-silencing-guardrails-inference-time-jailbreaking/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/49/) / Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation

# Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation

**Authors:** [Wenpeng Xing](https://md.research.elamur.ai/free/en/authors/wenpeng-xing/), Moran Fang, Guangtai Wang, [Changting Lin](https://md.research.elamur.ai/free/en/authors/changting-lin/) and [Meng Han](https://md.research.elamur.ai/free/en/authors/meng-han/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.211/) · [PDF](https://aclanthology.org/2026.findings-acl.211.pdf) · [DOI 10.18653/v1/2026.findings-acl.211](https://doi.org/10.18653/v1/2026.findings-acl.211) · [OpenAlex](https://openalex.org/W7166883028)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary

This Findings of ACL 2026 paper examines how fragile safety alignment is in open-weight LLMs when an attacker has white-box access at inference time. Existing jailbreaks either need many black-box queries (PAIR, TAP) or slow token-level gradient search (GCG, AutoDAN), and static edits such as LED can permanently damage the model. The authors propose Contextual Representation Ablation (CRA), which uses no training and does not modify weights. During decoding, it traces refusal-related signals back to hidden states and suppresses the small, context-dependent subspace responsible for refusals, recomputing it for each generated token. They test CRA on Llama-2-7B, Vicuna-7B-v1.5 and Mistral-7B-Instruct using AdvBench, PKU-Alignment and ToxicChat, following JailbreakBench-style evaluation practice. CRA beats optimization, black-box and fine-tuning baselines while keeping outputs coherent and running far faster. The authors present this as evidence that current alignment is shallow and geometrically separable from general capability. They argue that defenses must operate in the latent space and not only on prompts.

## Key points

- CRA builds a per-token refusal importance signal from gradients of refusal anchor tokens (e.g., "Sorry", "cannot"). It combines sensitivity- and salience-type attribution views, then masks the selected components.
- On Llama-2-7B with AdvBench, CRA reaches 64.0% ASR-O and 96.3% RRSR at full suppression (λ = 1.0). Random masking at the same density gets only 40.0%, which indicates targeted rather than incidental disruption.
- CRA improves ASR 16.1-fold over PEZ and outperforms DSN. TAP and PAIR stay below 10% ASR on Llama-2-7B.
- Efficiency:
  - CRA generates responses in seconds on a single RTX 4090D.
  - GCG needs about 1.5 hours per prompt.
  - DSN needs about 432 minutes of training.
- Refusal signals concentrate in early-to-middle layers: intervening on the first 5 blocks gives 42.0% ASR versus 38.0% for the last 5. The evaluation covers only dense 7B Transformers, so MoE and state-space models remain untested.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Zhejiang University](https://md.research.elamur.ai/free/en/universities/zhejiang-university/) — University, Hangzhou, China · 224 works · 13,587 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

## Cite

Cite as: Wenpeng Xing, Moran Fang, Guangtai Wang, Changting Lin and Meng Han. 2026. Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{xing2026silencing,
  title = {{Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation}},
  author = {Wenpeng Xing, Moran Fang, Guangtai Wang, Changting Lin and Meng Han},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.211},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.211}
}
```

- [← previous Signals Are Not States: Neuro-Symbolic Safeguards for Culturally Aware Classroom AI](https://md.research.elamur.ai/free/en/papers/nezhad-2026-signals-are-not-states-neuro/)
- [next → SilentDrift: Exploiting Action Chunking for Stealthy Backdoor Attacks on Vision-Language-Action Models](https://md.research.elamur.ai/free/en/papers/xu-2026-silentdrift-exploiting-action-chunking-stealthy/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/49/)

## References

38 references, 22 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. [Refusal in language models is mediated by a single direction](https://md.research.elamur.ai/free/en/papers/arditi-2024-refusal-language-models-mediated-single/). Advances in Neural Information Processing Systems, 37:136037–136083.
2. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. 2024. [Jailbreakbench: An open robustness benchmark for jailbreaking large language models](https://md.research.elamur.ai/free/en/papers/chao-2024-jailbreakbench-open-robustness-benchmark-jailbreaking/). Advances in Neural Informa…
3. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
4. W.-L. Chiang, Z. Li, Z. Lin, Y. Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y. Zhuang, J. E. Gonzalez, et al. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90% chatgpt quality. Accessed 14 April 2023. [find](https://scholar.google.com/scholar?q=W%2E%2DL%2E+Chiang%2C+Z%2E+Li%2C+Z%2E+Lin%2C+Y%2E+Sheng%2C+Z%2E+Wu%2C+H%2E+Zhang%2C+L%2E+Zheng%2C+S%2E+Zhuang%2C+Y%2E+Zhuang%2C+J%2E+E%2E+Gonzalez%2C+et+al%2E+2023%2E+Vicuna%3A+An+open%2Dsource+chatbot+impressing+gpt%2D4+with+90%25+chatgpt+quality%2E+Accessed+)
5. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2024. Masterkey: Automated jailbreaking of large language model chatbots. In Proc. ISOC NDSS. [find](https://scholar.google.com/scholar?q=Gelei+Deng%2C+Yi+Liu%2C+Yuekang+Li%2C+Kailong+Wang%2C+Ying+Zhang%2C+Zefeng+Li%2C+Haoyu+Wang%2C+Tianwei+Zhang%2C+and+Yang+Liu%2E+2024%2E+Masterkey%3A+Automated+jailbreaking+of+large+language+model+chatbots%2E+In+Proc%2E+ISOC+ND)
6. Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. 2024. [Qlora: Efficient finetuning of quantized llms](https://md.research.elamur.ai/free/en/papers/dettmers-2023-qlora-efficient-finetuning-quantized-llms/). Advances in Neural Information Processing Systems, 36.
7. Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. 2023. [Catastrophic jailbreak of open-source llms via exploiting generation](https://md.research.elamur.ai/free/en/papers/huang-2023-catastrophic-jailbreak-open-source-llms/). arXiv preprint arXiv:2310.06987.
8. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). arXiv preprint arXiv:2309.00614.
9. Jiaming Ji, Mickel Liu, Juntao Dai, Xuehai Pan, Chi Zhang, Ce Bian, Chi Zhang, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. [Beavertails: Towards improved safety alignment of llm via a human-preference dataset](https://md.research.elamur.ai/free/en/papers/ji-2023-beavertails-towards-improved-safety-alignment/). arXiv preprint arXiv:2307.04657.
10. Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825. [find](https://scholar.google.com/scholar?q=Albert+Q+Jiang%2C+Alexandre+Sablayrolles%2C+Arthur+Mensch%2C+Chris+Bamford%2C+Devendra+Singh+Chaplot%2C+Diego+de+las+Casas%2C+Florian+Bressand%2C+Gianna+Lengyel%2C+Guillaume+Lample%2C+Lucile+Saulnier%2C+et+al%2E+2023%2E+Mist)
11. Tanqiu Jiang, Zian Wang, Jiacheng Liang, Changjiang Li, Yuhui Wang, and Ting Wang. 2024. Robustkv: Defending large language models against jailbreak attacks via kv eviction. Preprint, arXiv:2410.19937. — [arXiv:2410.19937](https://arxiv.org/abs/2410.19937) [find](https://scholar.google.com/scholar?q=Tanqiu+Jiang%2C+Zian+Wang%2C+Jiacheng+Liang%2C+Changjiang+Li%2C+Yuhui+Wang%2C+and+Ting+Wang%2E+2024%2E+Robustkv%3A+Defending+large+language+models+against+jailbreak+attacks+via+kv+eviction%2E+Preprint%2C+arXiv%3A2410%2E19937)
12. Tianlong Li, Xiaoqing Zheng, and Xuanjing Huang. 2024a. Open the pandora’s box of llms: Jailbreaking llms through representation engineering. arXiv preprint arXiv:2401.06824. — [arXiv:2401.06824](https://arxiv.org/abs/2401.06824) [find](https://scholar.google.com/scholar?q=Tianlong+Li%2C+Xiaoqing+Zheng%2C+and+Xuanjing+Huang%2E+2024a%2E+Open+the+pandora%E2%80%99s+box+of+llms%3A+Jailbreaking+llms+through+representation+engineering%2E+arXiv+preprint+arXiv%3A2401%2E06824%2E+%E2%80%94+%5BarXiv%3A2401%2E06824%5D%28http)
13. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2024b. [Deepinception: Hypnotize large language model to be jailbreaker](https://md.research.elamur.ai/free/en/papers/li-2023-deepinception-hypnotize-large-language-model/). Preprint, arXiv:2311.03191.
14. Jiacheng Liang, Tanqiu Jiang, Yuhui Wang, Rongyi Zhu, Fenglong Ma, and Ting Wang. 2025. Autoran: Weak-to-strong jailbreaking of large reasoning models. arXiv e-prints, pages arXiv–2505. [find](https://scholar.google.com/scholar?q=Jiacheng+Liang%2C+Tanqiu+Jiang%2C+Yuhui+Wang%2C+Rongyi+Zhu%2C+Fenglong+Ma%2C+and+Ting+Wang%2E+2025%2E+Autoran%3A+Weak%2Dto%2Dstrong+jailbreaking+of+large+reasoning+models%2E+arXiv+e%2Dprints%2C+pages+arXiv%E2%80%932505%2E)
15. Zi Lin, Zihan Wang, Yongqi Tong, Yangkun Wang, Yuxin Guo, Yujia Wang, and Jingbo Shang. 2023. [Toxicchat: Unveiling hidden challenges of toxicity detection in real-world user-ai conversation](https://md.research.elamur.ai/free/en/papers/lin-2023-toxicchat-unveiling-hidden-challenges-toxicity/). arXiv preprint arXiv:2310.17389.
16. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. 2024. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). arXiv preprint arXiv:2402.04249. 4329 9
17. Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2024. [Tree of attacks: Jailbreaking black-box llms automatically](https://md.research.elamur.ai/free/en/papers/mehrotra-2023-tree-attacks-jailbreaking-black-box/). Advances in Neural Information Processing Systems, 37:61065–61105.
18. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. [" do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/). In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685.
19. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. [Llama 2: Open foundation and fine-tuned chat models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-2-open-foundation-fine/). arXiv preprint arXiv:2307.09288.
20. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for attacking and analyzing nlp. arXiv preprint arXiv:1908.07125. [find](https://scholar.google.com/scholar?q=Eric+Wallace%2C+Shi+Feng%2C+Nikhil+Kandpal%2C+Matt+Gardner%2C+and+Sameer+Singh%2E+2019%2E+Universal+adversarial+triggers+for+attacking+and+analyzing+nlp%2E+arXiv+preprint+arXiv%3A1908%2E07125%2E)
21. Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc Le, Ed Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. 2022. [Self-consistency improves chain of thought reasoning in language models](https://md.research.elamur.ai/free/en/papers/wang-2022-self-consistency-improves-chain-thought/). arXiv preprint arXiv:2203.11171.
22. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36:80079–80110.
23. Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Goldstein. 2024. [Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery](https://md.research.elamur.ai/free/en/papers/wen-2023-hard-prompts-made-easy-gradient/). Advances in Neural Information Processing Systems, 36.
24. Wenpeng Xing, Minghao Li, Mohan Li, and Meng Han. 2026. Towards robust and secure embodied ai: A survey on vulnerabilities and attacks. ACM Comput. Surv. Just Accepted. [find](https://scholar.google.com/scholar?q=Wenpeng+Xing%2C+Minghao+Li%2C+Mohan+Li%2C+and+Meng+Han%2E+2026%2E+Towards+robust+and+secure+embodied+ai%3A+A+survey+on+vulnerabilities+and+attacks%2E+ACM+Comput%2E+Surv%2E+Just+Accepted%2E)
25. Wenpeng Xing, Mohan Li, Chunqiang Hu, Haitao XuN-ingyu Zhang, Bo Lin, and Meng Han. 2025. Latent fusion jailbreak: Blending harmful and harmless representations to elicit unsafe llm outputs. arXiv preprint arXiv:2508.10029. — [arXiv:2508.10029](https://arxiv.org/abs/2508.10029) [find](https://scholar.google.com/scholar?q=Wenpeng+Xing%2C+Mohan+Li%2C+Chunqiang+Hu%2C+Haitao+XuN%2Dingyu+Zhang%2C+Bo+Lin%2C+and+Meng+Han%2E+2025%2E+Latent+fusion+jailbreak%3A+Blending+harmful+and+harmless+representations+to+elicit+unsafe+llm+outputs%2E+arXiv+pre)
26. Zhao Xu, Fan Liu, and Hao Liu. 2024. Bag of tricks: Benchmarking of jailbreak attacks on llms. Advances in Neural Information Processing Systems, 37:32219– 32250. [find](https://scholar.google.com/scholar?q=Zhao+Xu%2C+Fan+Liu%2C+and+Hao+Liu%2E+2024%2E+Bag+of+tricks%3A+Benchmarking+of+jailbreak+attacks+on+llms%2E+Advances+in+Neural+Information+Processing+Systems%2C+37%3A32219%E2%80%93+32250%2E)
27. Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. [Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts](https://md.research.elamur.ai/free/en/papers/yu-2023-gptfuzzer-red-teaming-large-language/). arXiv preprint arXiv:2309.10253.
28. Zhe Yu, Wenpeng Xing, and Meng Han. 2026a. From retinal evidence to safe decisions: Retina-safe and ecrt for hallucination risk triage in medical llms. Preprint, arXiv:2604.05348. — [arXiv:2604.05348](https://arxiv.org/abs/2604.05348) [find](https://scholar.google.com/scholar?q=Zhe+Yu%2C+Wenpeng+Xing%2C+and+Meng+Han%2E+2026a%2E+From+retinal+evidence+to+safe+decisions%3A+Retina%2Dsafe+and+ecrt+for+hallucination+risk+triage+in+medical+llms%2E+Preprint%2C+arXiv%3A2604%2E05348%2E+%E2%80%94+%5BarXiv%3A2604%2E05348%5D)
29. Zhe Yu, Wenpeng Xing, and Meng Han. 2026b. Laten-taudit: Real-time white-box faithfulness monitoring for retrieval-augmented generation with verifiable deployment. Preprint, arXiv:2604.05358. — [arXiv:2604.05358](https://arxiv.org/abs/2604.05358) [find](https://scholar.google.com/scholar?q=Zhe+Yu%2C+Wenpeng+Xing%2C+and+Meng+Han%2E+2026b%2E+Laten%2Dtaudit%3A+Real%2Dtime+white%2Dbox+faithfulness+monitoring+for+retrieval%2Daugmented+generation+with+verifiable+deployment%2E+Preprint%2C+arXiv%3A2604%2E05358%2E+%E2%80%94+%5BarXiv)
30. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. [How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon…
31. Wei Zhao, Zhe Li, Yige Li, Ye Zhang, and Jun Sun. 2024. Defending large language models against jailbreak attacks via layer-specific editing. arXiv preprint arXiv:2405.18166. [find](https://scholar.google.com/scholar?q=Wei+Zhao%2C+Zhe+Li%2C+Yige+Li%2C+Ye+Zhang%2C+and+Jun+Sun%2E+2024%2E+Defending+large+language+models+against+jailbreak+attacks+via+layer%2Dspecific+editing%2E+arXiv+preprint+arXiv%3A2405%2E18166%2E)
32. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. 2023. [Judging llm-as-a-judge with mt-bench and chatbot arena](https://md.research.elamur.ai/free/en/papers/zheng-2023-judging-llm-judge-mt-bench/). Advances in neural information processing systems, 36:46595–46623.
33. Yi Zhou, Wenpeng Xing, Dezhang Kong, Changting Lin, and Meng Han. 2025. Neurel-attack: Neuron relearning for safety disalignment in large language models. Preprint, arXiv:2504.21053. — [arXiv:2504.21053](https://arxiv.org/abs/2504.21053) [find](https://scholar.google.com/scholar?q=Yi+Zhou%2C+Wenpeng+Xing%2C+Dezhang+Kong%2C+Changting+Lin%2C+and+Meng+Han%2E+2025%2E+Neurel%2Dattack%3A+Neuron+relearning+for+safety+disalignment+in+large+language+models%2E+Preprint%2C+arXiv%3A2504%2E21053%2E+%E2%80%94+%5BarXiv%3A2504%2E210)
34. Yukai Zhou, Zhijie Huang, Feiyang Lu, Zhan Qin, and Wenjie Wang. 2024a. Don’t say no: Jailbreaking llm by suppressing refusal. arXiv preprint arXiv:2404.16369. [find](https://scholar.google.com/scholar?q=Yukai+Zhou%2C+Zhijie+Huang%2C+Feiyang+Lu%2C+Zhan+Qin%2C+and+Wenjie+Wang%2E+2024a%2E+Don%E2%80%99t+say+no%3A+Jailbreaking+llm+by+suppressing+refusal%2E+arXiv+preprint+arXiv%3A2404%2E16369%2E)
35. Zhanhui Zhou, Jie Liu, Zhichen Dong, Jiaheng Liu, Chao Yang, Wanli Ouyang, and Yu Qiao. 2024b. Emulated disalignment: Safety alignment for large language models may backfire! arXiv preprint arXiv:2402.12343. [find](https://scholar.google.com/scholar?q=Zhanhui+Zhou%2C+Jie+Liu%2C+Zhichen+Dong%2C+Jiaheng+Liu%2C+Chao+Yang%2C+Wanli+Ouyang%2C+and+Yu+Qiao%2E+2024b%2E+Emulated+disalignment%3A+Safety+alignment+for+large+language+models+may+backfire%21+arXiv+preprint+arXiv%3A2402)
36. Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang, Furong Huang, Ani Nenkova, and Tong Sun. 2023. [Autodan: Automatic and interpretable adversarial attacks on large language models](https://md.research.elamur.ai/free/en/papers/zhu-2023-autodan-interpretable-gradient-based-adversarial/). arXiv preprint arXiv:2310.15140.
37. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. 2023a. [Representation engineering: A top-down approach to ai transparency](https://md.research.elamur.ai/free/en/papers/zou-2023-representation-engineering-top-down-approach/). arXiv preprint arXiv:2310.01405.
38. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023b. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.

*Updated 2 November 2026*