---
title: "RST-Guarder — paper by Zhang and Wan (2026)"
description: "Guardrail classifiers such as LlamaGuard and Qwen3Guard decide whether an LLM response is harmful, but they become… 65 references."
authors: ["Xu Zhang", "Xiaojun Wan"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.1025/"
doi: "10.18653/v1/2026.acl-long.1025"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhang-2026-rst-guarder-enhancing-long-context/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhang-2026-rst-guarder-enhancing-long-context/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/48/) / RST-Guarder: Enhancing Long-Context Robustness for Safeguards via RST Parsing and Probabilistic Inference

# RST-Guarder: Enhancing Long-Context Robustness for Safeguards via RST Parsing and Probabilistic Inference

**Authors:** [Xu Zhang](https://md.research.elamur.ai/free/en/authors/xu-zhang/) and [Xiaojun Wan](https://md.research.elamur.ai/free/en/authors/xiaojun-wan/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.1025/) · [PDF](https://aclanthology.org/2026.acl-long.1025.pdf) · [DOI 10.18653/v1/2026.acl-long.1025](https://doi.org/10.18653/v1/2026.acl-long.1025) · [OpenAlex](https://openalex.org/W7166887176)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary

Guardrail classifiers such as LlamaGuard and Qwen3Guard decide whether an LLM response is harmful, but they become unreliable as responses get longer. Harmful passages surrounded by innocuous text slip through, and nuanced safe answers that touch on sensitive opinions get flagged. The authors call this long-context blindness. They show that wrapping unsafe responses in benign material makes mainstream guardrails label more than 30% of them as safe.

Their fix, RST-Guarder, works at inference time and needs no new data or fine-tuning. It parses a response into a Rhetorical Structure Theory discourse tree and asks an existing guardrail to score each node. It then merges these scores bottom-up with hand-written rules that account for rhetorical relations and nucleus/satellite roles, producing an overall unsafe probability.

The authors tested it with both open-source and closed-source guardrails on adversarially perturbed and benign long-form data. RST-Guarder improves harmful-content detection on long outputs and also reduces false alarms on benign text. This matters because it is a model-agnostic, plug-in way to make content moderation more robust for long generations.

## Key points

- **Perturbations used to expose the weakness:**
  - Benign Instruction Injection (BII) appends a misleading suffix.
  - Benign Context Augmentation (BCA) embeds the harmful answer inside long, harmless, on-topic text.
  - Combining both yields the new evaluation sets AdvBench-Adv and HarmBench-Adv, built on AdvBench and HarmBench.
- **Guardrails analysed:** Qwen3Guard-4B, Llama3Guard, HarmBench-cls, WildGuard-7B and GPT-4o all lose accuracy consistently under both perturbations.
- **Pipeline:** the discourse tree comes from an existing RST parser (Chistova, 2024). Segment-level guardrail probabilities are combined by rule-based hierarchical probabilistic inference rather than flat, blockwise aggregation. Benign long-form behaviour is also checked, with XSTest referenced as a source.
- **Effect of response length:** gains are small for responses under 200 tokens and grow steadily with length, while vanilla guardrails degrade. A compared baseline raised detection only at the cost of many more false positives; RST-Guarder avoided this trade-off.
- **Limitations and code:** results depend on RST parser quality, and the method adds parsing and inference latency. Code is available at github.com/pkulcwmzx/RSTGuarder.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Peking University](https://md.research.elamur.ai/free/en/universities/peking-university/) — University, Beijing, China · 315 works · 43,267 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (1): [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Xu Zhang and Xiaojun Wan. 2026. RST-Guarder: Enhancing Long-Context Robustness for Safeguards via RST Parsing and Probabilistic Inference. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhang2026rst,
  title = {{RST-Guarder: Enhancing Long-Context Robustness for Safeguards via RST Parsing and Probabilistic Inference}},
  author = {Xu Zhang and Xiaojun Wan},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1025},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1025}
}
```

- [← previous RSMeM: Knowledge-Enhanced Memory Evolution for Remote Sensing Agents with Systematic Evaluation](https://md.research.elamur.ai/free/en/papers/wu-2026-rsmem-knowledge-enhanced-memory-evolution/)
- [next → RTCFake: Speech Deepfake Detection in Real-Time Communication](https://md.research.elamur.ai/free/en/papers/xue-2026-rtcfake-speech-deepfake-detection-real/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/48/)

## References

65 references, 30 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Anthropic. 2025. Claude sonnet 4.5 system card. System card page. Published October 10, 2025. [find](https://scholar.google.com/scholar?q=Anthropic%2E+2025%2E+Claude+sonnet+4%2E5+system+card%2E+System+card+page%2E+Published+October+10%2C+2025%2E)
2. Elias Bassani and Ignacio Sanchez. 2024. Guardbench: A large-scale benchmark for guardrail models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 18393–18409. [find](https://scholar.google.com/scholar?q=Elias+Bassani+and+Ignacio+Sanchez%2E+2024%2E+Guardbench%3A+A+large%2Dscale+benchmark+for+guardrail+models%2E+In+Proceedings+of+the+2024+Conference+on+Empirical+Methods+in+Natural+Language+Processing%2C+pages+1839)
3. Guiming Hardy Chen, Shunian Chen, Ziche Liu, Feng Jiang, and Benyou Wang. 2024. [Humans or llms as the judge? a study on judgement biases](https://md.research.elamur.ai/free/en/papers/chen-2024-humans-llms-judge-study-judgement/). arXiv preprint arXiv:2402.10669.
4. Elena Chistova. 2024. [Bilingual rhetorical structure parsing with large parallel annotations](https://md.research.elamur.ai/free/en/papers/chistova-2024-bilingual-rhetorical-structure-parsing-large/). In Findings of the Association for Computational Linguistics ACL 2024, pages 9689–9706, Bangkok, Thailand and virtual meeting. Association for Computational Linguistics.
5. Elena Chistova. 2025. Bridging discourse treebanks with a unified rhetorical structure parser. In Proceedings of the 6th Workshop on Computational Approaches to Discourse, Context and Document-Level Inferences (CODI 2025), pages 197–208, Suzhou, China. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Elena+Chistova%2E+2025%2E+Bridging+discourse+treebanks+with+a+unified+rhetorical+structure+parser%2E+In+Proceedings+of+the+6th+Workshop+on+Computational+Approaches+to+Discourse%2C+Context+and+Document%2DLevel+I)
6. Hyeong Kyu Choi, Xuefeng Du, and Yixuan Li. 2024. Safety-aware fine-tuning of large language models. Preprint, arXiv:2410.10014. — [arXiv:2410.10014](https://arxiv.org/abs/2410.10014) [find](https://scholar.google.com/scholar?q=Hyeong+Kyu+Choi%2C+Xuefeng+Du%2C+and+Yixuan+Li%2E+2024%2E+Safety%2Daware+fine%2Dtuning+of+large+language+models%2E+Preprint%2C+arXiv%3A2410%2E10014%2E+%E2%80%94+%5BarXiv%3A2410%2E10014%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2410%2E10014%29)
7. Antonia Creswell, Tom White, Vincent Dumoulin, Kai Arulkumaran, Biswa Sengupta, and Anil A Bharath. 2018. Generative adversarial networks: An overview. IEEE signal processing magazine, 35(1):53–65. [find](https://scholar.google.com/scholar?q=Antonia+Creswell%2C+Tom+White%2C+Vincent+Dumoulin%2C+Kai+Arulkumaran%2C+Biswa+Sengupta%2C+and+Anil+A+Bharath%2E+2018%2E+Generative+adversarial+networks%3A+An+overview%2E+IEEE+signal+processing+magazine%2C+35%281%29%3A53%E2%80%9365%2E)
8. Yihe Deng, Yu Yang, Junkai Zhang, Wei Wang, and Bo Li. 2025. Duoguard: A two-player rl-driven framework for multilingual llm guardrails. arXiv preprint arXiv:2502.05163. — [arXiv:2502.05163](https://arxiv.org/abs/2502.05163) [find](https://scholar.google.com/scholar?q=Yihe+Deng%2C+Yu+Yang%2C+Junkai+Zhang%2C+Wei+Wang%2C+and+Bo+Li%2E+2025%2E+Duoguard%3A+A+two%2Dplayer+rl%2Ddriven+framework+for+multilingual+llm+guardrails%2E+arXiv+preprint+arXiv%3A2502%2E05163%2E+%E2%80%94+%5BarXiv%3A2502%2E05163%5D%28https%3A%2F%2Fa)
9. Ameet Deshpande, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, and Karthik Narasimhan. 2023. [Toxicity in chatgpt: Analyzing persona-assigned language models](https://md.research.elamur.ai/free/en/papers/deshpande-2023-toxicity-chatgpt-analyzing-persona-assigned/). In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 1236–1270, Singapore. Association for Computational Ling…
10. Yi Dong, Ronghui Mu, Yanghao Zhang, Siqi Sun, Tianle Zhang, Changshun Wu, Gaojie Jin, Yi Qi, Jinwei Hu, Jie Meng, Saddek Bensalem, and Xiaowei Huang. 2024a. Safeguarding [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). Preprint, arXiv:2406.02622. — [arXiv:2406.02622](https://arxiv.org/abs/2406.02622)
11. Zhichen Dong, Zhanhui Zhou, Chao Yang, Jing Shao, and Yu Qiao. 2024b. Attacks, defenses and evaluations for llm conversation safety: A survey. Preprint, arXiv:2402.09283. [find](https://scholar.google.com/scholar?q=Zhichen+Dong%2C+Zhanhui+Zhou%2C+Chao+Yang%2C+Jing+Shao%2C+and+Yu+Qiao%2E+2024b%2E+Attacks%2C+defenses+and+evaluations+for+llm+conversation+safety%3A+A+survey%2E+Preprint%2C+arXiv%3A2402%2E09283%2E)
12. Yann Dubois, Balázs Galambosi, Percy Liang, and Tatsunori B Hashimoto. 2024. Length-controlled alpacaeval: A simple way to debias automatic evaluators. arXiv preprint arXiv:2404.04475. [find](https://scholar.google.com/scholar?q=Yann+Dubois%2C+Bal%C3%A1zs+Galambosi%2C+Percy+Liang%2C+and+Tatsunori+B+Hashimoto%2E+2024%2E+Length%2Dcontrolled+alpacaeval%3A+A+simple+way+to+debias+automatic+evaluators%2E+arXiv+preprint+arXiv%3A2404%2E04475%2E)
13. Francisco Eiras, Eliott Zemour, Eric Lin, and Vaikkunth Mugunthan. 2025. Know thy judge: On the robustness meta-evaluation of llm safety judges. arXiv preprint arXiv:2503.04474. — [arXiv:2503.04474](https://arxiv.org/abs/2503.04474) [find](https://scholar.google.com/scholar?q=Francisco+Eiras%2C+Eliott+Zemour%2C+Eric+Lin%2C+and+Vaikkunth+Mugunthan%2E+2025%2E+Know+thy+judge%3A+On+the+robustness+meta%2Devaluation+of+llm+safety+judges%2E+arXiv+preprint+arXiv%3A2503%2E04474%2E+%E2%80%94+%5BarXiv%3A2503%2E04474%5D%28h)
14. Shaona Ghosh, Prasoon Varshney, Makesh Narsimhan Sreedhar, Aishwarya Padmakumar, Traian Rebedea, Jibin Rajan Varghese, and Christopher Parisien. 2025. [Aegis2.0: A diverse ai safety dataset and risks taxonomy for alignment of llm guardrails](https://md.research.elamur.ai/free/en/papers/ghosh-2025-aegis2-0-diverse-ai-safety/). Preprint, arXiv:2501.09004.
15. Tianle Gu, Zeyang Zhou, Kexin Huang, Liang Dandan, Yixu Wang, Haiquan Zhao, Yuanqi Yao, Yujiu Yang, Yan Teng, Yu Qiao, and 1 others. 2024. Mllmguard: A multi-dimensional safety evaluation suite for multimodal large language models. Advances in Neural Information Processing Systems, 37:7256–7295. [find](https://scholar.google.com/scholar?q=Tianle+Gu%2C+Zeyang+Zhou%2C+Kexin+Huang%2C+Liang+Dandan%2C+Yixu+Wang%2C+Haiquan+Zhao%2C+Yuanqi+Yao%2C+Yujiu+Yang%2C+Yan+Teng%2C+Yu+Qiao%2C+and+1+others%2E+2024%2E+Mllmguard%3A+A+multi%2Ddimensional+safety+evaluation+suite+for+mu)
16. Weiyang Guo, Zesheng Shi, Zhuo Li, Yequan Wang, Xuebo Liu, Wenya Wang, Fangming Liu, Min Zhang, and Jing Li. 2025. Jailbreak-r1: Exploring the jailbreak capabilities of llms via reinforcement learning. arXiv preprint arXiv:2506.00782. — [arXiv:2506.00782](https://arxiv.org/abs/2506.00782) [find](https://scholar.google.com/scholar?q=Weiyang+Guo%2C+Zesheng+Shi%2C+Zhuo+Li%2C+Yequan+Wang%2C+Xuebo+Liu%2C+Wenya+Wang%2C+Fangming+Liu%2C+Min+Zhang%2C+and+Jing+Li%2E+2025%2E+Jailbreak%2Dr1%3A+Exploring+the+jailbreak+capabilities+of+llms+via+reinforcement+learning)
17. Grigorii Guz, Peyman Bateni, Darius Muglich, and Giuseppe Carenini. 2020. Neural rst-based evaluation of discourse coherence. arXiv preprint arXiv:2009.14463. [find](https://scholar.google.com/scholar?q=Grigorii+Guz%2C+Peyman+Bateni%2C+Darius+Muglich%2C+and+Giuseppe+Carenini%2E+2020%2E+Neural+rst%2Dbased+evaluation+of+discourse+coherence%2E+arXiv+preprint+arXiv%3A2009%2E14463%2E)
18. Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. 2024. [Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms](https://md.research.elamur.ai/free/en/papers/han-2024-wildguard-open-one-stop-moderation/). Preprint, arXiv:2406.18495.
19. Xinyu Hu and Xiaojun Wan. 2023. Exploring discourse structure in document-level machine translation. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 13889–13902. [find](https://scholar.google.com/scholar?q=Xinyu+Hu+and+Xiaojun+Wan%2E+2023%2E+Exploring+discourse+structure+in+document%2Dlevel+machine+translation%2E+In+Proceedings+of+the+2023+Conference+on+Empirical+Methods+in+Natural+Language+Processing%2C+pages+13)
20. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. 2023. [Llama guard: Llm-based input-output safeguard for human-ai conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/). Preprint, arXiv:2312.06674.
21. Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Josef Dai, Boren Zheng, Tianyi Alex Qiu, Jiayi Zhou, Kaile Wang, Boxun Li, and 1 others. 2025. [Pku-saferlhf: Towards multi-level safety alignment for llms with human preference](https://md.research.elamur.ai/free/en/papers/ji-2025-pku-saferlhf-multi-level-safety/). In Proceedings of the 63rd Annual Meeting of the Association for Comp…
22. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. [Beavertails: Towards improved safety alignment of llm via a human-preference dataset](https://md.research.elamur.ai/free/en/papers/ji-2023-beavertails-towards-improved-safety-alignment/). Advances in Neural Information Processing Systems, 36:24678–24704.
23. Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, and Nouha Dziri. 2024. [Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models](https://md.research.elamur.ai/free/en/papers/jiang-2024-wildteaming-scale-wild-jailbreaks-adversarially/). Preprint, arXiv:2406.18510.
24. Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023. [Automatically auditing large language models via discrete optimization](https://md.research.elamur.ai/free/en/papers/jones-2023-automatically-auditing-large-language-models/). In International Conference on Machine Learning, pages 15307–15329. PMLR.
25. Mintong Kang and Bo Li. 2024. r 2 -guard: Robust reasoning enabled llm guardrail via knowledge-enhanced logical reasoning. arXiv preprint arXiv:2407.05557. — [arXiv:2407.05557](https://arxiv.org/abs/2407.05557) [find](https://scholar.google.com/scholar?q=Mintong+Kang+and+Bo+Li%2E+2024%2E+r+2+%2Dguard%3A+Robust+reasoning+enabled+llm+guardrail+via+knowledge%2Denhanced+logical+reasoning%2E+arXiv+preprint+arXiv%3A2407%2E05557%2E+%E2%80%94+%5BarXiv%3A2407%2E05557%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2)
26. Priyanshu Kumar, Devansh Jain, Akhila Yerukola, Liwei Jiang, Himanshu Beniwal, Thomas Hartvigsen, and Maarten Sap. 2025. Polyguard: A multilingual safety moderation tool for 17 languages. Preprint, arXiv:2504.04377. — [arXiv:2504.04377](https://arxiv.org/abs/2504.04377) [find](https://scholar.google.com/scholar?q=Priyanshu+Kumar%2C+Devansh+Jain%2C+Akhila+Yerukola%2C+Liwei+Jiang%2C+Himanshu+Beniwal%2C+Thomas+Hartvigsen%2C+and+Maarten+Sap%2E+2025%2E+Polyguard%3A+A+multilingual+safety+moderation+tool+for+17+languages%2E+Preprint%2C+ar)
27. Hao Li, Xiaogeng Liu, Ning Zhang, and Chaowei Xiao. 2025a. [Piguard: Prompt injection guardrail via mitigating overdefense for free](https://md.research.elamur.ai/free/en/papers/li-2025-piguard-prompt-injection-guardrail-mitigating/). In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 30420–30437.
28. William C Mann and Sandra A Thompson. 1988. [Rhetorical structure theory: Toward a functional theory of text organization](https://md.research.elamur.ai/free/en/papers/mann-1988-rhetorical-structure-theory-functional/). Text-interdisciplinary Journal for the Study of Discourse, 8(3):243–281.
29. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). arXiv preprint arXiv:2402.04249.
30. Haoran Li, Yulin Chen, Jingru Zeng, Hao Peng, Hui-hao Jing, Wenbin Hu, Xi Yang, Ziqian Zeng, Sirui Han, and Yangqiu Song. 2025b. Gspr: Aligning llm safeguards as generalizable safety policy reasoners. arXiv preprint arXiv:2509.24418. — [arXiv:2509.24418](https://arxiv.org/abs/2509.24418) [find](https://scholar.google.com/scholar?q=Haoran+Li%2C+Yulin+Chen%2C+Jingru+Zeng%2C+Hao+Peng%2C+Hui%2Dhao+Jing%2C+Wenbin+Hu%2C+Xi+Yang%2C+Ziqian+Zeng%2C+Sirui+Han%2C+and+Yangqiu+Song%2E+2025b%2E+Gspr%3A+Aligning+llm+safeguards+as+generalizable+safety+policy+reasoners%2E)
31. Thanh-Tung Nguyen, Xuan-Phi Nguyen, Shafiq Joty, and Xiaoli Li. 2021. [RST parsing from scratch](https://md.research.elamur.ai/free/en/papers/nguyen-2021-rst-parsing-scratch/). In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 1613–1625, Online. Association for Computational Li…
32. Tianle Li, Wei-Lin Chiang, Evan Frick, Lisa Dunlap, Banghua Zhu, Joseph E Gonzalez, and Ion Stoica. 2024. From live data to high-quality benchmarks: The arena-hard pipeline. Blog post.[Accessed 07-02-2025]. [find](https://scholar.google.com/scholar?q=Tianle+Li%2C+Wei%2DLin+Chiang%2C+Evan+Frick%2C+Lisa+Dunlap%2C+Banghua+Zhu%2C+Joseph+E+Gonzalez%2C+and+Ion+Stoica%2E+2024%2E+From+live+data+to+high%2Dquality+benchmarks%3A+The+arena%2Dhard+pipeline%2E+Blog+post%2E%5BAccessed+07%2D02%2D)
33. Jinjie Ni, Fuzhao Xue, Xiang Yue, Yuntian Deng, Mahir Shah, Kabir Jain, Graham Neubig, and Yang You. 2024. [Mixeval: Deriving wisdom of the crowd from llm benchmark mixtures](https://md.research.elamur.ai/free/en/papers/ni-2024-mixeval-deriving-wisdom-crowd-llm/). Advances in Neural Information Processing Systems, 37:98180–98212.
34. Yucheng Li, Surin Ahn, Huiqiang Jiang, Amir H. Abdi, Yuqing Yang, and Lili Qiu. 2025c. Secu-ritylingua: Efficient defense of llm jailbreak attacks via security-aware prompt compression. Preprint, arXiv:2506.12707. — [arXiv:2506.12707](https://arxiv.org/abs/2506.12707) [find](https://scholar.google.com/scholar?q=Yucheng+Li%2C+Surin+Ahn%2C+Huiqiang+Jiang%2C+Amir+H%2E+Abdi%2C+Yuqing+Yang%2C+and+Lili+Qiu%2E+2025c%2E+Secu%2Dritylingua%3A+Efficient+defense+of+llm+jailbreak+attacks+via+security%2Daware+prompt+compression%2E+Preprint%2C+arXi)
35. OpenAI. 2025. Gpt-5 system card. System card. [find](https://scholar.google.com/scholar?q=OpenAI%2E+2025%2E+Gpt%2D5+system+card%2E+System+card%2E)
36. Published August 2025. [find](https://scholar.google.com/scholar?q=Published+August+2025%2E)
37. Aixin Liu, Aoxue Mei, Bangcai Lin, Bing Xue, Bingxuan Wang, Bingzheng Xu, Bochao Wu, Bowei Zhang, Chaofan Lin, Chen Dong, and 1 others. 2025a. [Deepseek-v3](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-v3-2-pushing/). 2: Pushing the frontier of open large language models. arXiv preprint arXiv:2512.02556.
38. Dongqi Liu, Yifan Wang, and Vera Demberg. 2023. Incorporating distributions of discourse structure for long document abstractive summarization. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 5574–5590, Toronto, Canada. Associ… [find](https://scholar.google.com/scholar?q=Dongqi+Liu%2C+Yifan+Wang%2C+and+Vera+Demberg%2E+2023%2E+Incorporating+distributions+of+discourse+structure+for+long+document+abstractive+summarization%2E+In+Proceedings+of+the+61st+Annual+Meeting+of+the+Associa)
39. Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao. 2024a. Autodan-turbo: A lifelong agent for strategy self-exploration to jailbreak llms. arXiv preprint arXiv:2410.05295. — [arXiv:2410.05295](https://arxiv.org/abs/2410.05295) [find](https://scholar.google.com/scholar?q=Xiaogeng+Liu%2C+Peiran+Li%2C+Edward+Suh%2C+Yevgeniy+Vorobeychik%2C+Zhuoqing+Mao%2C+Somesh+Jha%2C+Patrick+McDaniel%2C+Huan+Sun%2C+Bo+Li%2C+and+Chaowei+Xiao%2E+2024a%2E+Autodan%2Dturbo%3A+A+lifelong+agent+for+strategy+self%2Dexplo)
40. Yinhong Liu, Han Zhou, Zhijiang Guo, Ehsan Shareghi, Ivan Vulić, Anna Korhonen, and Nigel Collier. 2024b. [Aligning with human judgement: The role of pairwise preference in large language model evaluators](https://md.research.elamur.ai/free/en/papers/liu-2024-aligning-human-judgement-role-pairwise/). arXiv preprint arXiv:2403.16950.
41. Yue Liu, Hongcheng Gao, Shengfang Zhai, Jun Xia, Tianyi Wu, Zhiwei Xue, Yulin Chen, Kenji Kawaguchi, Jiaheng Zhang, and Bryan Hooi. 2025b. Guardreasoner: Towards reasoning-based llm safeguards. arXiv preprint arXiv:2501.18492. — [arXiv:2501.18492](https://arxiv.org/abs/2501.18492) [find](https://scholar.google.com/scholar?q=Yue+Liu%2C+Hongcheng+Gao%2C+Shengfang+Zhai%2C+Jun+Xia%2C+Tianyi+Wu%2C+Zhiwei+Xue%2C+Yulin+Chen%2C+Kenji+Kawaguchi%2C+Jiaheng+Zhang%2C+and+Bryan+Hooi%2E+2025b%2E+Guardreasoner%3A+Towards+reasoning%2Dbased+llm+safeguards%2E+arXiv+)
42. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F Christiano, Jan Leike, and Ryan Lowe. 2022. Tra… — [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/)
43. Martial Pastor, Nelleke Oostdijk, Patricia Martin-Rodilla, and Javier Parapar. 2025. Enhancing discourse parsing for local structures from social media with llm-generated data. In Proceedings of the 31st International Conference on Computational Linguistics, pages 8739–8748. [find](https://scholar.google.com/scholar?q=Martial+Pastor%2C+Nelleke+Oostdijk%2C+Patricia+Martin%2DRodilla%2C+and+Javier+Parapar%2E+2025%2E+Enhancing+discourse+parsing+for+local+structures+from+social+media+with+llm%2Dgenerated+data%2E+In+Proceedings+of+the+3)
44. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. [Fine-tuning aligned language models compromises safety, even when users do not intend to!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/) arXiv preprint arXiv:2310.03693.
45. Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2025. [LLMs know their vulnerabilities: Uncover safety gaps through natural distribution shifts](https://md.research.elamur.ai/free/en/papers/ren-2025-llms-know-their-vulnerabilities-uncover/). In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics…
46. Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. [Xstest: A test suite for identifying exaggerated safety behaviours in large language models](https://md.research.elamur.ai/free/en/papers/rottger-2023-xstest-test-suite-identifying-exaggerated/). In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational L…
47. Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, and 1 others. 2025a. [Qwen3guard technical report](https://md.research.elamur.ai/free/en/papers/zhao-2025-qwen3guard-technical-report/). arXiv preprint arXiv:2510.14276.
48. Yuanzhe Shen, Zisu Huang, Zhengkang Guo, Yide Liu, Guanxu Chen, Ruicheng Yin, Xiaoqing Zheng, and Xuanjing Huang. 2025. Intentionreasoner: Facilitating adaptive llm safeguards through intent reasoning and selective query refinement. arXiv preprint arXiv:2508.20151. — [arXiv:2508.20151](https://arxiv.org/abs/2508.20151) [find](https://scholar.google.com/scholar?q=Yuanzhe+Shen%2C+Zisu+Huang%2C+Zhengkang+Guo%2C+Yide+Liu%2C+Guanxu+Chen%2C+Ruicheng+Yin%2C+Xiaoqing+Zheng%2C+and+Xuanjing+Huang%2E+2025%2E+Intentionreasoner%3A+Facilitating+adaptive+llm+safeguards+through+intent+reasoning)
49. Hao Zhao, Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. 2024. Long is more for alignment: A simple but tough-to-beat baseline for instruction fine-tuning. arXiv preprint arXiv:2402.04833. — [arXiv:2402.04833](https://arxiv.org/abs/2402.04833) [find](https://scholar.google.com/scholar?q=Hao+Zhao%2C+Maksym+Andriushchenko%2C+Francesco+Croce%2C+and+Nicolas+Flammarion%2E+2024%2E+Long+is+more+for+alignment%3A+A+simple+but+tough%2Dto%2Dbeat+baseline+for+instruction+fine%2Dtuning%2E+arXiv+preprint+arXiv%3A2402%2E0)
50. Freda Shi, Xinyun Chen, Kanishka Misra, Nathan Scales, David Dohan, Ed H Chi, Nathanael Schärli, and Denny Zhou. 2023. [Large language models can be easily distracted by irrelevant context](https://md.research.elamur.ai/free/en/papers/shi-2023-large-language-models-easily-distracted/). In International Conference on Machine Learning, pages 31210–31227. PMLR.
51. Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, Yifan Du, Chen Yang, Yushuo Chen, Zhipeng Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, and 3 others. 2025b. [A survey of large language models](https://md.research.elamur.ai/free/en/papers/zhao-2023-survey-large-language-models/). Prepr…
52. Xiongtao Sun, Deyue Zhang, Dongdong Yang, Quanchen Zou, and Hui Li. 2024. Multi-turn context jailbreak attack on large language models from first principles. arXiv preprint arXiv:2408.04686. — [arXiv:2408.04686](https://arxiv.org/abs/2408.04686) [find](https://scholar.google.com/scholar?q=Xiongtao+Sun%2C+Deyue+Zhang%2C+Dongdong+Yang%2C+Quanchen+Zou%2C+and+Hui+Li%2E+2024%2E+Multi%2Dturn+context+jailbreak+attack+on+large+language+models+from+first+principles%2E+arXiv+preprint+arXiv%3A2408%2E04686%2E+%E2%80%94+%5BarXiv%3A)
53. Yi Zhao and Youzhi Zhang. 2025. Siren: A learning-based multi-turn attack framework for simulating real-world human jailbreak behaviors. Preprint, arXiv:2501.14250. — [arXiv:2501.14250](https://arxiv.org/abs/2501.14250) [find](https://scholar.google.com/scholar?q=Yi+Zhao+and+Youzhi+Zhang%2E+2025%2E+Siren%3A+A+learning%2Dbased+multi%2Dturn+attack+framework+for+simulating+real%2Dworld+human+jailbreak+behaviors%2E+Preprint%2C+arXiv%3A2501%2E14250%2E+%E2%80%94+%5BarXiv%3A2501%2E14250%5D%28https%3A%2F%2Farxiv%2E)
54. Bibek Upadhayay, Vahid Behzadan, and Ph. D. 2025. X-guard: Multilingual guard agent for content moderation. Preprint, arXiv:2504.08848. [find](https://scholar.google.com/scholar?q=Bibek+Upadhayay%2C+Vahid+Behzadan%2C+and+Ph%2E+D%2E+2025%2E+X%2Dguard%3A+Multilingual+guard+agent+for+content+moderation%2E+Preprint%2C+arXiv%3A2504%2E08848%2E)
55. Jingnan Zheng, Xiangtian Ji, Yijun Lu, Chenhang Cui, Weixiang Zhao, Gelei Deng, Zhenkai Liang, An Zhang, and Tat-Seng Chua. 2025. Rsafe: Incentivizing proactive reasoning to build robust and adaptive llm safeguards. arXiv preprint arXiv:2506.07736. [find](https://scholar.google.com/scholar?q=Jingnan+Zheng%2C+Xiangtian+Ji%2C+Yijun+Lu%2C+Chenhang+Cui%2C+Weixiang+Zhao%2C+Gelei+Deng%2C+Zhenkai+Liang%2C+An+Zhang%2C+and+Tat%2DSeng+Chua%2E+2025%2E+Rsafe%3A+Incentivizing+proactive+reasoning+to+build+robust+and+adaptive+)
56. Sahil Verma, Keegan Hines, Jeff Bilmes, Charlotte Siska, Luke Zettlemoyer, Hila Gonen, and Chandan Singh. 2025. Omniguard: An efficient approach for ai safety moderation across languages and modalities. Preprint, arXiv:2505.23856. [find](https://scholar.google.com/scholar?q=Sahil+Verma%2C+Keegan+Hines%2C+Jeff+Bilmes%2C+Charlotte+Siska%2C+Luke+Zettlemoyer%2C+Hila+Gonen%2C+and+Chandan+Singh%2E+2025%2E+Omniguard%3A+An+efficient+approach+for+ai+safety+moderation+across+languages+and+modalitie)
57. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for attacking and analyzing nlp. arXiv preprint arXiv:1908.07125. [find](https://scholar.google.com/scholar?q=Eric+Wallace%2C+Shi+Feng%2C+Nikhil+Kandpal%2C+Matt+Gardner%2C+and+Sameer+Singh%2E+2019%2E+Universal+adversarial+triggers+for+attacking+and+analyzing+nlp%2E+arXiv+preprint+arXiv%3A1908%2E07125%2E)
58. Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, Sang T. Truong, Simran Arora, Mantas Mazeika, Dan Hendrycks, Zinan Lin, Yu Cheng, Sanmi Koyejo, Dawn Song, and Bo Li. 2024. [Decodingtrust: A comprehensive assessment o…](https://md.research.elamur.ai/free/en/papers/wang-2023-decodingtrust-comprehensive-assessment-trustworthiness-gpt/)
59. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. [Qwen3 technical report](https://md.research.elamur.ai/free/en/papers/yang-2025-qwen3-technical-report/). arXiv preprint arXiv:2505.09388.
60. Richard J Young. 2025. Evaluating the robustness of large language model safety guardrails against adversarial attacks. arXiv preprint arXiv:2511.22047. — [arXiv:2511.22047](https://arxiv.org/abs/2511.22047) [find](https://scholar.google.com/scholar?q=Richard+J+Young%2E+2025%2E+Evaluating+the+robustness+of+large+language+model+safety+guardrails+against+adversarial+attacks%2E+arXiv+preprint+arXiv%3A2511%2E22047%2E+%E2%80%94+%5BarXiv%3A2511%2E22047%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2511)
61. Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. 2024. Shieldgemma: Generative ai content moderation based on gemma. Preprint, arXiv:2407.21772. — [arXiv:2407.21772](https://arxiv.org/abs/2407.21772) [find](https://scholar.google.com/scholar?q=Wenjun+Zeng%2C+Yuchi+Liu%2C+Ryan+Mullins%2C+Ludovic+Peran%2C+Joe+Fernandez%2C+Hamza+Harkous%2C+Karthik+Narasimhan%2C+Drew+Proud%2C+Piyush+Kumar%2C+Bhaktipriya+Radharapu%2C+Olivia+Sturman%2C+and+Oscar+Wahltinez%2E+2024%2E+Shiel)
62. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, and 1 others. 2023. [Judging llm-as-a-judge with mt-bench and chatbot arena](https://md.research.elamur.ai/free/en/papers/zheng-2023-judging-llm-judge-mt-bench/). Advances in neural information processing systems, 36:46595–46623.
63. Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Jing Jiang, and Min Lin. 2024. Cheating automatic llm benchmarks: Null models achieve high win rates. arXiv preprint arXiv:2410.07137. — [arXiv:2410.07137](https://arxiv.org/abs/2410.07137) [find](https://scholar.google.com/scholar?q=Xiaosen+Zheng%2C+Tianyu+Pang%2C+Chao+Du%2C+Qian+Liu%2C+Jing+Jiang%2C+and+Min+Lin%2E+2024%2E+Cheating+automatic+llm+benchmarks%3A+Null+models+achieve+high+win+rates%2E+arXiv+preprint+arXiv%3A2410%2E07137%2E+%E2%80%94+%5BarXiv%3A2410%2E0713)
64. Junda Zhu, Lingyong Yan, Shuaiqiang Wang, Dawei Yin, and Lei Sha. 2025. [Reasoning-to-defend: Safety-aware reasoning can defend large language models from jailbreaking](https://md.research.elamur.ai/free/en/papers/zhu-2025-reasoning-defend-safety-aware-reasoning/). Preprint, arXiv:2502.12970.
65. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). Preprint, arXiv:2307.15043.

*Updated 2 November 2026*