---
title: "Deactivating Refusal Triggers — paper by Xue et al. (2026)"
description: "The authors argue that harmful training queries contain non-harmful parts, such as ordinary events (\"create a video\") or polite… 40 references."
authors: ["Zhiyu Xue", "Zimo Qi", "Guangliang Liu", "Bocheng Chen", "Ramtin Pedarsani"]
year: 2026
venue: "Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)"
source: "https://aclanthology.org/2026.trustnlp-main.26/"
doi: "10.18653/v1/2026.trustnlp-main.26"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/xue-2026-deactivating-refusal-triggers-understanding-mitigating/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/xue-2026-deactivating-refusal-triggers-understanding-mitigating/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/29/) / Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment

# Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment

**Authors:** [Zhiyu Xue](https://md.research.elamur.ai/free/en/authors/zhiyu-xue/), Zimo Qi, Guangliang Liu, Bocheng Chen and [Ramtin Pedarsani](https://md.research.elamur.ai/free/en/authors/ramtin-pedarsani/) · **Year:** 2026 · **Venue:** [Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)](https://md.research.elamur.ai/free/en/venues/trustnlp/) ([Workshop on Trustworthy NLP 2026](https://md.research.elamur.ai/free/en/venues/trustnlp/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.trustnlp-main.26/) · [PDF](https://aclanthology.org/2026.trustnlp-main.26.pdf) · [DOI 10.18653/v1/2026.trustnlp-main.26](https://doi.org/10.18653/v1/2026.trustnlp-main.26) · [OpenAlex](https://openalex.org/W7166832686)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Safety-aligned LLMs often refuse harmless requests, a failure known as overrefusal. This paper asks why safety fine-tuning causes it. The authors argue that harmful training queries contain non-harmful parts, such as ordinary events ("create a video") or polite help-seeking phrases ("Can you help me"). During alignment, these parts become associated with refusal. The paper calls such cues **refusal triggers**.

To isolate them, the authors use GPT-4o to rewrite harmful samples from Llama2 Safety Data. The rewrite strips the harmful intent but keeps the benign wording. Hidden-state analysis then shows that benign queries a model rejects lie closer to these triggers than benign queries it answers. Based on this, the authors build trigger-matched benign fine-tuning data, which replaces generic corpora like Alpaca as the regularization set.

They test the approach with three alignment methods: SFT, P-SFT and RLVR. The models are Llama2, Llama3-Uncensored and Qwen2.5-Uncensored. Across these, the trigger-matched data lowers refusal rates on benign benchmarks while keeping most of the jailbreak defense. The result points to a practical way of improving the safety–usability balance of aligned models.

## Key points
- Evaluation measures safety with rule-based ASR on Sorry-Bench, JBench-H and HEx-PHI. It measures overrefusal with keyword-based refusal rate (RR) on Koala, JBench-B, GSM-8K, SQL-1K and OrBench-H.
- **RLVR on Llama3-U:**
  - Using Alpaca as benign data pushes OrBench-H refusals from 16.83 to 98.48. The trigger-matched data keeps this at 57.09.
  - HEx-PHI ASR still drops from 84.55 to 9.70.
  - The overall Avg score falls from 70.72 (baseline) and 45.69 (Alpaca) to 30.22.
- **P-SFT on Llama2:** the Avg score is 36.71 with trigger-matched data, compared with 53.80 for the baseline and 77.03 with Alpaca.
- **Code and math benchmarks** (SQL-1K, GSM-8K) show the largest gains. The authors explain this by words like "inject" or "execute", which look risky in safety contexts but are routine in technical use.
- **Similarity ablation:** using benign data that is less similar to the triggers raises Koala RR from 21.11 to about 55–60, while slightly lowering ASR. This illustrates the trade-off between safety and responsiveness.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Johns Hopkins University](https://md.research.elamur.ai/free/en/universities/johns-hopkins-university/) — University, Baltimore, United States · 248 works · 106,397 citations
- [University of California, Santa Barbara](https://md.research.elamur.ai/free/en/universities/university-of-california-santa-barbara/) — University, Santa Barbara, United States · 67 works · 10,550 citations
- [Michigan State University](https://md.research.elamur.ai/free/en/universities/michigan-state-university/) — University, East Lansing, United States · 30 works · 1,375 citations
- [University of Mississippi](https://md.research.elamur.ai/free/en/universities/university-of-mississippi/) — University, Oxford, United States · 2 works

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,954 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 626 works

🧭 Topics (1): [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Zhiyu Xue, Zimo Qi, Guangliang Liu, Bocheng Chen and Ramtin Pedarsani. 2026. Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment. Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{xue2026deactivating,
  title = {{Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment}},
  author = {Zhiyu Xue, Zimo Qi, Guangliang Liu, Bocheng Chen and Ramtin Pedarsani},
  booktitle = {Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)},
  year = {2026},
  doi = {10.18653/v1/2026.trustnlp-main.26},
  url = {https://doi.org/10.18653/v1/2026.trustnlp-main.26}
}
```

- [← previous DE-CLIP: Few-Shot Anomaly Detection via Difference-Guided Embedding Editing](https://md.research.elamur.ai/free/en/papers/zhang-2026-de-clip-few-shot-anomaly/)
- [next → DEBAR: Mitigating Contextual Bias in Cross-Document Relation Extraction via Dual-Stream Decoupling](https://md.research.elamur.ai/free/en/papers/yang-2026-debar-mitigating-contextual-bias-cross/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/29/)

## References

40 references, 17 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. ONeal AJ. 2023. Chat gpt "dan". [find](https://scholar.google.com/scholar?q=ONeal+AJ%2E+2023%2E+Chat+gpt+%22dan%22%2E)
2. Alex Albert. 2023. Jailbreak Chat. [find](https://scholar.google.com/scholar?q=Alex+Albert%2E+2023%2E+Jailbreak+Chat%2E)
3. Usman Anwar, Abulhair Saparov, Javier Rando, Daniel Paleka, Miles Turpin, Peter Hase, Ekdeep Singh Lubana, Erik Jenner, Stephen Casper, Oliver Sourbut, et al. 2024. [Foundational challenges in assuring alignment and safety of large language models](https://md.research.elamur.ai/free/en/papers/anwar-2024-foundational-challenges-assuring-alignment-safety/). arXiv preprint arXiv:2404.09932.
4. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+et+al%2E+2022%2E+Training+a+helpful+and+harmless+assistant+with+rein)
5. Shai Ben-David, John Blitzer, Koby Crammer, and Fernando Pereira. 2006. Analysis of representations for domain adaptation. Advances in neural information processing systems, 19. [find](https://scholar.google.com/scholar?q=Shai+Ben%2DDavid%2C+John+Blitzer%2C+Koby+Crammer%2C+and+Fernando+Pereira%2E+2006%2E+Analysis+of+representations+for+domain+adaptation%2E+Advances+in+neural+information+processing+systems%2C+19%2E)
6. Gemma Boleda. 2020. Distributional semantics and linguistic theory. Annual Review of Linguistics, 6(1):213–234. [find](https://scholar.google.com/scholar?q=Gemma+Boleda%2E+2020%2E+Distributional+semantics+and+linguistic+theory%2E+Annual+Review+of+Linguistics%2C+6%281%29%3A213%E2%80%93234%2E)
7. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. 2024. [Jailbreakbench: An open robustness benchmark for jailbreaking large language models](https://md.research.elamur.ai/free/en/papers/chao-2024-jailbreakbench-open-robustness-benchmark-jailbreaking/). arXiv preprint arXiv:2404.…
8. Melody Y Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Helyar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, et al. 2024. [Deliberative alignment: Reasoning enables safer language models](https://md.research.elamur.ai/free/en/papers/guan-2024-deliberative-alignment-reasoning-enables-safer/). arXiv preprint arXiv:2412.16339.
9. Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. 2021. [Gradient-based adversarial attacks against text transformers](https://md.research.elamur.ai/free/en/papers/guo-2021-gradient-based-adversarial-attacks-against/). In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5747–5757.
10. Irene Heim. 2002. File change semantics and the familiarity theory of definiteness. Formal semantics: The essential readings, pages 223–248. [find](https://scholar.google.com/scholar?q=Irene+Heim%2E+2002%2E+File+change+semantics+and+the+familiarity+theory+of+definiteness%2E+Formal+semantics%3A+The+essential+readings%2C+pages+223%E2%80%93248%2E)
11. Piyush Jha, Arnav Arora, and Vijay Ganesh. 2024. Llmstinger: Jailbreaking llms using rl fine-tuned llms. arXiv preprint arXiv:2411.08862. — [arXiv:2411.08862](https://arxiv.org/abs/2411.08862) [find](https://scholar.google.com/scholar?q=Piyush+Jha%2C+Arnav+Arora%2C+and+Vijay+Ganesh%2E+2024%2E+Llmstinger%3A+Jailbreaking+llms+using+rl+fine%2Dtuned+llms%2E+arXiv+preprint+arXiv%3A2411%2E08862%2E+%E2%80%94+%5BarXiv%3A2411%2E08862%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2411%2E08862%29)
12. Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023. [Automatically auditing large language models via discrete optimization](https://md.research.elamur.ai/free/en/papers/jones-2023-automatically-auditing-large-language-models/). In International Conference on Machine Learning, pages 15307–15329. PMLR.
13. Belinda Z Li, Maxwell Nye, and Jacob Andreas. 2021. Implicit representations of meaning in neural language models. In Proceedings of the 59th annual meeting of the Association for Computational Linguistics and the 11th international joint conference on natural language processing (Volume 1: Long pap… [find](https://scholar.google.com/scholar?q=Belinda+Z+Li%2C+Maxwell+Nye%2C+and+Jacob+Andreas%2E+2021%2E+Implicit+representations+of+meaning+in+neural+language+models%2E+In+Proceedings+of+the+59th+annual+meeting+of+the+Association+for+Computational+Lingui)
14. Jianwei Li and Jung-Eun Kim. Safety alignment can be not superficial with explicit safety signals. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Jianwei+Li+and+Jung%2DEun+Kim%2E+Safety+alignment+can+be+not+superficial+with+explicit+safety+signals%2E+In+Forty%2Dsecond+International+Conference+on+Machine+Learning%2E)
15. Guangliang Liu, Lei Jiang, Xitong Zhang, and Kristen Marie Johnson. 2025. Diagnosing moral reasoning acquisition in language models: Pragmatics and generalization. arXiv preprint arXiv:2502.16600. [find](https://scholar.google.com/scholar?q=Guangliang+Liu%2C+Lei+Jiang%2C+Xitong+Zhang%2C+and+Kristen+Marie+Johnson%2E+2025%2E+Diagnosing+moral+reasoning+acquisition+in+language+models%3A+Pragmatics+and+generalization%2E+arXiv+preprint+arXiv%3A2502%2E16600%2E)
16. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). In R0-FoMo: Robustness of Few-shot and Zero-shot Learning in Large Foundation Models.
17. Guangliang Liu, Haitao Mao, Jiliang Tang, and Kristen Johnson. 2024. Intrinsic self-correction for enhanced morality: An analysis of internal mechanisms and the superficial hypothesis. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 16439–16455. [find](https://scholar.google.com/scholar?q=Guangliang+Liu%2C+Haitao+Mao%2C+Jiliang+Tang%2C+and+Kristen+Johnson%2E+2024%2E+Intrinsic+self%2Dcorrection+for+enhanced+morality%3A+An+analysis+of+internal+mechanisms+and+the+superficial+hypothesis%2E+In+Proceedings+)
18. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. 2021. [Training verifiers to solve math word problems](https://md.research.elamur.ai/free/en/papers/cobbe-2021-training-verifiers-solve-math-word/). arXiv preprint arXiv:2110.14168.
19. Xiaodong Liu, Hao Cheng, Pengcheng He, Weizhu Chen, Yu Wang, Hoifung Poon, and Jianfeng Gao. 2020. Adversarial training for large neural language models. arXiv preprint arXiv:2004.08994. [find](https://scholar.google.com/scholar?q=Xiaodong+Liu%2C+Hao+Cheng%2C+Pengcheng+He%2C+Weizhu+Chen%2C+Yu+Wang%2C+Hoifung+Poon%2C+and+Jianfeng+Gao%2E+2020%2E+Adversarial+training+for+large+neural+language+models%2E+arXiv+preprint+arXiv%3A2004%2E08994%2E)
20. Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2025. [Or-bench: An over-refusal benchmark for large language models](https://md.research.elamur.ai/free/en/papers/cui-2024-bench-over-refusal-benchmark-large/). In Forty-second International Conference on Machine Learning.
21. Xinyang Geng, Arnav Gudibande, Hao Liu, Eric Wallace, Pieter Abbeel, Sergey Levine, and Dawn Song. 2023. Koala: A dialogue model for academic research. Blog post. [find](https://scholar.google.com/scholar?q=Xinyang+Geng%2C+Arnav+Gudibande%2C+Hao+Liu%2C+Eric+Wallace%2C+Pieter+Abbeel%2C+Sergey+Levine%2C+and+Dawn+Song%2E+2023%2E+Koala%3A+A+dialogue+model+for+academic+research%2E+Blog+post%2E)
22. Tong Mu, Alec Helyar, Johannes Heidecke, Joshua Achiam, Andrea Vallone, Ian Kivlichan, Molly Lin, Alex Beutel, John Schulman, and Lilian Weng. 2024. Rule based rewards for language model safety. Advances in Neural Information Processing Systems, 37:108877–108901. [find](https://scholar.google.com/scholar?q=Tong+Mu%2C+Alec+Helyar%2C+Johannes+Heidecke%2C+Joshua+Achiam%2C+Andrea+Vallone%2C+Ian+Kivlichan%2C+Molly+Lin%2C+Alex+Beutel%2C+John+Schulman%2C+and+Lilian+Weng%2E+2024%2E+Rule+based+rewards+for+language+model+safety%2E+Advan)
23. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/). Advances in neural information processing systems, 35:27730–27744.
24. Swetasudha Panda, Naveen Jafer Nizar, and Michael L Wick. 2024. Llm improvement for jailbreak defense: Analysis through the lens of over-refusal. In Neurips Safe Generative AI Workshop 2024. [find](https://scholar.google.com/scholar?q=Swetasudha+Panda%2C+Naveen+Jafer+Nizar%2C+and+Michael+L+Wick%2E+2024%2E+Llm+improvement+for+jailbreak+defense%3A+Analysis+through+the+lens+of+over%2Drefusal%2E+In+Neurips+Safe+Generative+AI+Workshop+2024%2E)
25. Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2024. [Safety alignment should be made more than just a few tokens deep](https://md.research.elamur.ai/free/en/papers/qi-2024-safety-alignment-should-made-more/). arXiv preprint arXiv:2406.05946.
26. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. Hex-phi: Human-extended policy-oriented harmful instruction benchmark. [find](https://scholar.google.com/scholar?q=Xiangyu+Qi%2C+Yi+Zeng%2C+Tinghao+Xie%2C+Pin%2DYu+Chen%2C+Ruoxi+Jia%2C+Prateek+Mittal%2C+and+Peter+Henderson%2E+2023%2E+Hex%2Dphi%3A+Human%2Dextended+policy%2Doriented+harmful+instruction+benchmark%2E)
27. Deng Qiyuan, Xuefeng Bai, Kehai Chen, Yaowei Wang, Liqiang Nie, and Min Zhang. 2025. Efficient safety alignment of large language models via preference re-ranking and representation-based reward modeling. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Vol… [find](https://scholar.google.com/scholar?q=Deng+Qiyuan%2C+Xuefeng+Bai%2C+Kehai+Chen%2C+Yaowei+Wang%2C+Liqiang+Nie%2C+and+Min+Zhang%2E+2025%2E+Efficient+safety+alignment+of+large+language+models+via+preference+re%2Dranking+and+representation%2Dbased+reward+model)
28. Chenyu Shi, Xiao Wang, Qiming Ge, Songyang Gao, Xianjun Yang, Tao Gui, Qi Zhang, Xuanjing Huang, Xun Zhao, and Dahua Lin. 2024. Navigating the overkill in large language models. arXiv preprint arXiv:2401.17633. [find](https://scholar.google.com/scholar?q=Chenyu+Shi%2C+Xiao+Wang%2C+Qiming+Ge%2C+Songyang+Gao%2C+Xianjun+Yang%2C+Tao+Gui%2C+Qi+Zhang%2C+Xuanjing+Huang%2C+Xun+Zhao%2C+and+Dahua+Lin%2E+2024%2E+Navigating+the+overkill+in+large+language+models%2E+arXiv+preprint+arXiv%3A2)
29. Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. 2023. Stanford alpaca: an instruction-following llama model (2023). URL [https://github.com/tatsu-lab/stanford_alpaca](https://github.com/tatsu-lab/stanford_alpaca), 1(9). [↗](https://github.com/tatsu-lab/stanford_alpaca)
30. Jiahao Yu, Xingwei Lin, and Xinyu Xing. 2023. [Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts](https://md.research.elamur.ai/free/en/papers/yu-2023-gptfuzzer-red-teaming-large-language/). arXiv preprint arXiv:2309.10253.
31. Weixiang Zhao, Yulin Hu, Zhuojun Li, Yang Deng, Jiahe Guo, Xingyu Sui, Yanyan Zhao, Bing Qin, Tat-Seng Chua, and Ting Liu. 2024. Towards comprehensive post safety alignment of large language models via safety patching. arXiv preprint arXiv:2405.13820. — [arXiv:2405.13820](https://arxiv.org/abs/2405.13820) [find](https://scholar.google.com/scholar?q=Weixiang+Zhao%2C+Yulin+Hu%2C+Zhuojun+Li%2C+Yang+Deng%2C+Jiahe+Guo%2C+Xingyu+Sui%2C+Yanyan+Zhao%2C+Bing+Qin%2C+Tat%2DSeng+Chua%2C+and+Ting+Liu%2E+2024%2E+Towards+comprehensive+post+safety+alignment+of+large+language+models+vi)
32. Chujie Zheng, Fan Yin, Hao Zhou, Fandong Meng, Jie Zhou, Kai-Wei Chang, Minlie Huang, and Nanyun Peng. 2024. [On prompt-driven safeguarding for large language models](https://md.research.elamur.ai/free/en/papers/zheng-2024-prompt-driven-safeguarding-large-language/). arXiv preprint arXiv:2401.18018.
33. Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang, Furong Huang, Ani Nenkova, and Tong Sun. 2023. [Autodan: Automatic and interpretable adversarial attacks on large language models](https://md.research.elamur.ai/free/en/papers/zhu-2023-autodan-interpretable-gradient-based-adversarial/). arXiv preprint arXiv:2310.15140.
34. Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, J Zico Kolter, Matt Fredrikson, and Dan Hendrycks. 2024. [Improving alignment and robustness with circuit breakers](https://md.research.elamur.ai/free/en/papers/zou-2024-improving-alignment-robustness-circuit-breakers/). In The Thirty-eighth Annual Conference on Neural Information Processing Systems.
35. Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.
36. Neeraj Varshney, Pavel Dolin, Agastya Seth, and Chitta Baral. 2023. The art of defending: A systematic evaluation and analysis of llm defense strategies on safety and over-defensiveness. arXiv preprint arXiv:2401.00287. [find](https://scholar.google.com/scholar?q=Neeraj+Varshney%2C+Pavel+Dolin%2C+Agastya+Seth%2C+and+Chitta+Baral%2E+2023%2E+The+art+of+defending%3A+A+systematic+evaluation+and+analysis+of+llm+defense+strategies+on+safety+and+over%2Ddefensiveness%2E+arXiv+preprin)
37. Tomi Visakko and Heini Lehtonen. 2024. Indexicality. In Handbook of Pragmatics, pages 129–154. John Benjamins Publishing Company. [find](https://scholar.google.com/scholar?q=Tomi+Visakko+and+Heini+Lehtonen%2E+2024%2E+Indexicality%2E+In+Handbook+of+Pragmatics%2C+pages+129%E2%80%93154%2E+John+Benjamins+Publishing+Company%2E)
38. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36.
39. Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, et al. 2024. [Sorry-bench: Systematically evaluating large language model safety refusal](https://md.research.elamur.ai/free/en/papers/xie-2024-sorry-bench-systematically-evaluating-large/) behaviors. arXiv preprint arXiv:2406.14598.
40. Xilie Xu, Keyi Kong, Ning Liu, Lizhen Cui, Di Wang, Jingfeng Zhang, and Mohan Kankanhalli. An llm can fool itself: A prompt-based adversarial attack. In The Twelfth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Xilie+Xu%2C+Keyi+Kong%2C+Ning+Liu%2C+Lizhen+Cui%2C+Di+Wang%2C+Jingfeng+Zhang%2C+and+Mohan+Kankanhalli%2E+An+llm+can+fool+itself%3A+A+prompt%2Dbased+adversarial+attack%2E+In+The+Twelfth+International+Conference+on+Learnin)

*Updated 2 November 2026*