---
title: "Unleashing the Unseen — paper by Zhao et al. (2026)"
description: "They build benign datasets, each sharing a single sample-agnostic trait such as a numbered, point-by-point answer format. 37 references."
authors: ["Wei Zhao", "Zhe Li", "Yige Li", "Jun Sun"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: EACL 2026"
source: "https://aclanthology.org/2026.findings-eacl.17/"
doi: "10.18653/v1/2026.findings-eacl.17"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhao-2026-unleashing-unseen-harnessing-benign-datasets/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhao-2026-unleashing-unseen-harnessing-benign-datasets/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/19/) / Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models

# Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models

**Authors:** [Wei Zhao](https://md.research.elamur.ai/free/en/authors/wei-zhao/), [Zhe Li](https://md.research.elamur.ai/free/en/authors/zhe-li/), Yige Li and [Jun Sun](https://md.research.elamur.ai/free/en/authors/jun-sun/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: EACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-eacl.17/) · [PDF](https://aclanthology.org/2026.findings-eacl.17.pdf) · [DOI 10.18653/v1/2026.findings-eacl.17](https://doi.org/10.18653/v1/2026.findings-eacl.17) · [OpenAlex](https://openalex.org/W7140123260)

**Citations:** 1 citations (OpenAlex, 2026-10-14)

## Summary
The paper asks why adversarial suffixes can jailbreak safety-aligned LLMs. Following Ilyas et al.'s view that adversarial perturbations act as features, the authors argue that such suffixes are not just glitches but can carry features strong enough to override alignment. They build benign datasets, each sharing a single sample-agnostic trait such as a numbered, point-by-point answer format. A soft-prompt-style universal feature extractor then learns one shared suffix, either as embeddings or as discrete tokens, that reproduces the trait across prompts. Appending these suffixes to harmful requests often bypasses safety and yields harmful output in the same style. Run on harmful prompt–response pairs, the same extractor acts as a universal attack, and some resulting suffixes induce recognizable styles such as storytelling. Most strikingly, ordinary fine-tuning on benign data with a dominant format strips safety from open models and from GPT models through OpenAI's black-box fine-tuning API. The work warns that benign fine-tuning data does not guarantee preserved alignment.

## Key points
- The suffix optimizer minimizes cross-entropy over an entire dataset. It adds an embedding regularizer for token suffixes (λ = 10) and none for embedding suffixes (λ = 0).
- Suffix influence is measured with the Pearson Correlation Coefficient (PCC) on last hidden states, comparing prompt-only, suffix-only and combined inputs. In a baseline of 20 "!" marks, the meaningless suffix had near-zero PCC, while prompt-specific GCG suffixes had high PCC with the combined input.
- Fine-tuning used Llama2, Llama3, GPT-3.5, GPT-4o-mini and GPT-4o. All original models produced 0% harmful responses before fine-tuning.
- On GPT-4o, a poem-style dataset gave only 4.9% ASR, but a structured-format dataset reached 72.7% ASR.
- Benign datasets generated with universal suffixes, such as the Repeat and BASIC sets, caused severe safety loss across all models. ASR approached 99% in several cases.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Singapore Management University](https://md.research.elamur.ai/free/en/universities/singapore-management-university/) — University, Singapore, Singapore · 27 works · 2,382 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 517 works

## Cite

Cite as: Wei Zhao, Zhe Li, Yige Li and Jun Sun. 2026. Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models. Findings of the Association for Computational Linguistics: EACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhao2026unleashing,
  title = {{Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models}},
  author = {Wei Zhao, Zhe Li, Yige Li and Jun Sun},
  booktitle = {Findings of the Association for Computational Linguistics: EACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-eacl.17},
  url = {https://doi.org/10.18653/v1/2026.findings-eacl.17}
}
```

- [← previous Unleashing Low-Bit Inference on Ascend NPUs: A Comprehensive Evaluation of HiFloat Formats](https://md.research.elamur.ai/free/en/papers/zhao-2026-unleashing-low-bit-inference-ascend/)
- [next → Unlocking Large Audio-Language Models for Interactive Language Learning](https://md.research.elamur.ai/free/en/papers/liu-2026-unlocking-large-audio-language-models/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/19/)

## References

37 references, 17 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). arXiv preprint arXiv:2303.08774.
2. TW Anderson. 2003. An introduction to multivariate statistical analysis (wiley series in probability and statistics). [find](https://scholar.google.com/scholar?q=TW+Anderson%2E+2003%2E+An+introduction+to+multivariate+statistical+analysis+%28wiley+series+in+probability+and+statistics%29%2E)
3. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+et+al%2E+2022%2E+Training+a+helpful+and+harmless+assistant+with+rein)
4. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
5. Valeriia Cherepanova and James Zou. 2024. Talking nonsense: Probing large language models’ understanding of adversarial gibberish inputs. arXiv preprint arXiv:2404.17120. — [arXiv:2404.17120](https://arxiv.org/abs/2404.17120) [find](https://scholar.google.com/scholar?q=Valeriia+Cherepanova+and+James+Zou%2E+2024%2E+Talking+nonsense%3A+Probing+large+language+models%E2%80%99+understanding+of+adversarial+gibberish+inputs%2E+arXiv+preprint+arXiv%3A2404%2E17120%2E+%E2%80%94+%5BarXiv%3A2404%2E17120%5D%28https%3A%2F%2F)
6. Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See [https://vicuna.lmsys](https://vicuna.lmsys). org (accessed 14 April 2023). [↗](https://vicuna.lmsys)
7. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2023. Masterkey: Automated jailbreak across multiple large language model chatbots. arXiv preprint arXiv:2307.08715. — [arXiv:2307.08715](https://arxiv.org/abs/2307.08715) [find](https://scholar.google.com/scholar?q=Gelei+Deng%2C+Yi+Liu%2C+Yuekang+Li%2C+Kailong+Wang%2C+Ying+Zhang%2C+Zefeng+Li%2C+Haoyu+Wang%2C+Tianwei+Zhang%2C+and+Yang+Liu%2E+2023%2E+Masterkey%3A+Automated+jailbreak+across+multiple+large+language+model+chatbots%2E+arXiv+)
8. Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. 2024. [Catastrophic jailbreak of open-source LLMs via exploiting generation](https://md.research.elamur.ai/free/en/papers/huang-2023-catastrophic-jailbreak-open-source-llms/). In The Twelfth International Conference on Learning Representations.
9. Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. 2019. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32. [find](https://scholar.google.com/scholar?q=Andrew+Ilyas%2C+Shibani+Santurkar%2C+Dimitris+Tsipras%2C+Logan+Engstrom%2C+Brandon+Tran%2C+and+Aleksander+Madry%2E+2019%2E+Adversarial+examples+are+not+bugs%2C+they+are+features%2E+Advances+in+neural+information+proces)
10. Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825. [find](https://scholar.google.com/scholar?q=Albert+Q+Jiang%2C+Alexandre+Sablayrolles%2C+Arthur+Mensch%2C+Chris+Bamford%2C+Devendra+Singh+Chaplot%2C+Diego+de+las+Casas%2C+Florian+Bressand%2C+Gianna+Lengyel%2C+Guillaume+Lample%2C+Lucile+Saulnier%2C+et+al%2E+2023%2E+Mist)
11. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2023. [Deepinception: Hypnotize large language model to be jailbreaker](https://md.research.elamur.ai/free/en/papers/li-2023-deepinception-hypnotize-large-language-model/). arXiv preprint arXiv:2311.03191.
12. Zeyi Liao and Huan Sun. 2024. Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms. [find](https://scholar.google.com/scholar?q=Zeyi+Liao+and+Huan+Sun%2E+2024%2E+Amplegcg%3A+Learning+a+universal+and+transferable+generative+model+of+adversarial+suffixes+for+jailbreaking+both+open+and+closed+llms%2E)
13. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). arXiv preprint arXiv:2310.04451.
14. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024. Generating stealthy jailbreak prompts on aligned large language models. In The Twelfth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Xiaogeng+Liu%2C+Nan+Xu%2C+Muhao+Chen%2C+and+Chaowei+Xiao%2E+2024%2E+Generating+stealthy+jailbreak+prompts+on+aligned+large+language+models%2E+In+The+Twelfth+International+Conference+on+Learning+Representations%2E)
15. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/). Advances in neural information processing systems, 35:27730–27744.
16. Koyena Pal, Jiuding Sun, Andrew Yuan, Byron C Wallace, and David Bau. 2023. [Future lens: Anticipating subsequent tokens from a single hidden state](https://md.research.elamur.ai/free/en/papers/pal-2023-future-lens-anticipating-subsequent-tokens/). arXiv preprint arXiv:2311.04897.
17. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. [Red teaming language models with language models](https://md.research.elamur.ai/free/en/papers/perez-2022-red-teaming-language-models-language/). arXiv preprint arXiv:2202.03286.
18. Amelia Glaese, Nat McAleese, Maja Trkebacz, John Aslanides, Vlad Firoiu, Timo Ewalds, Maribeth Rauh, Laura Weidinger, Martin Chadwick, Phoebe Thacker, et al. 2022. [Improving alignment of dialogue agents via targeted human judgements](https://md.research.elamur.ai/free/en/papers/glaese-2022-improving-alignment-dialogue-agents-targeted/). arXiv preprint arXiv:2209.14375.
19. Jonathan Hayase, Ema Borevkovic, Nicholas Carlini, Florian Tramèr, and Milad Nasr. 2024. Query-based adversarial prompt generation. arXiv preprint arXiv:2402.12329. — [arXiv:2402.12329](https://arxiv.org/abs/2402.12329) [find](https://scholar.google.com/scholar?q=Jonathan+Hayase%2C+Ema+Borevkovic%2C+Nicholas+Carlini%2C+Florian+Tram%C3%A8r%2C+and+Milad+Nasr%2E+2024%2E+Query%2Dbased+adversarial+prompt+generation%2E+arXiv+preprint+arXiv%3A2402%2E12329%2E+%E2%80%94+%5BarXiv%3A2402%2E12329%5D%28https%3A%2F%2Farxiv%2E)
20. Luxi He, Mengzhou Xia, and Peter Henderson. 2024. What’s in your" safe" data?: Identifying benign data that breaks safety. arXiv preprint arXiv:2404.01099. — [arXiv:2404.01099](https://arxiv.org/abs/2404.01099) [find](https://scholar.google.com/scholar?q=Luxi+He%2C+Mengzhou+Xia%2C+and+Peter+Henderson%2E+2024%2E+What%E2%80%99s+in+your%22+safe%22+data%3F%3A+Identifying+benign+data+that+breaks+safety%2E+arXiv+preprint+arXiv%3A2404%2E01099%2E+%E2%80%94+%5BarXiv%3A2404%2E01099%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2)
21. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. [Fine-tuning aligned language models compromises safety, even when users do not intend to!](https://md.research.elamur.ai/free/en/papers/qi-2023-fine-tuning-aligned-language-models/) arXiv preprint arXiv:2310.03693.
22. Shawn Shan, Arjun Nitin Bhagoji, Haitao Zheng, and Ben Y Zhao. 2022. Traceback of targeted data poisoning attacks in neural networks. In USENIX Sec. Symp. USENIX Association, volume 8. [find](https://scholar.google.com/scholar?q=Shawn+Shan%2C+Arjun+Nitin+Bhagoji%2C+Haitao+Zheng%2C+and+Ben+Y+Zhao%2E+2022%2E+Traceback+of+targeted+data+poisoning+attacks+in+neural+networks%2E+In+USENIX+Sec%2E+Symp%2E+USENIX+Association%2C+volume+8%2E)
23. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2023. [" do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/). arXiv preprint arXiv:2308.03825.
24. Chunting Zhou, Pengfei Liu, Puxin Xu, Srinivasan Iyer, Jiao Sun, Yuning Mao, Xuezhe Ma, Avia Efrat, Ping Yu, Lili Yu, et al. 2024. Lima: Less is more for alignment. Advances in Neural Information Processing Systems, 36. [find](https://scholar.google.com/scholar?q=Chunting+Zhou%2C+Pengfei+Liu%2C+Puxin+Xu%2C+Srinivasan+Iyer%2C+Jiao+Sun%2C+Yuning+Mao%2C+Xuezhe+Ma%2C+Avia+Efrat%2C+Ping+Yu%2C+Lili+Yu%2C+et+al%2E+2024%2E+Lima%3A+Less+is+more+for+alignment%2E+Advances+in+Neural+Information+Proc)
25. Abhay Sheshadri, Aidan Ewart, Phillip Guo, Aengus Lynch, Cindy Wu, Vivek Hebbar, Henry Sleight, Asa Cooper Stickland, Ethan Perez, Dylan Hadfield-Menell, et al. 2024. Targeted latent adversarial training improves robustness to persistent harmful behaviors in llms. arXiv preprint arXiv:2407.15549. — [arXiv:2407.15549](https://arxiv.org/abs/2407.15549) [find](https://scholar.google.com/scholar?q=Abhay+Sheshadri%2C+Aidan+Ewart%2C+Phillip+Guo%2C+Aengus+Lynch%2C+Cindy+Wu%2C+Vivek+Hebbar%2C+Henry+Sleight%2C+Asa+Cooper+Stickland%2C+Ethan+Perez%2C+Dylan+Hadfield%2DMenell%2C+et+al%2E+2024%2E+Targeted+latent+adversarial+train)
26. Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.
27. Manli Shu, Jiongxiao Wang, Chen Zhu, Jonas Geiping, Chaowei Xiao, and Tom Goldstein. 2023. On the exploitability of instruction tuning. Advances in Neural Information Processing Systems, 36:61836–61856. [find](https://scholar.google.com/scholar?q=Manli+Shu%2C+Jiongxiao+Wang%2C+Chen+Zhu%2C+Jonas+Geiping%2C+Chaowei+Xiao%2C+and+Tom+Goldstein%2E+2023%2E+On+the+exploitability+of+instruction+tuning%2E+Advances+in+Neural+Information+Processing+Systems%2C+36%3A61836%E2%80%936185)
28. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. [Llama 2: Open foundation and fine-tuned chat models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-2-open-foundation-fine/). arXiv preprint arXiv:2307.09288.
29. Hao Wang, Hao Li, Minlie Huang, and Lei Sha. 2024. Asetf: A novel method for jailbreak attack on llms through translate suffix embeddings. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 2697–2711. [find](https://scholar.google.com/scholar?q=Hao+Wang%2C+Hao+Li%2C+Minlie+Huang%2C+and+Lei+Sha%2E+2024%2E+Asetf%3A+A+novel+method+for+jailbreak+attack+on+llms+through+translate+suffix+embeddings%2E+In+Proceedings+of+the+2024+Conference+on+Empirical+Methods+in)
30. Yufei Wang, Wanjun Zhong, Liangyou Li, Fei Mi, Xingshan Zeng, Wenyong Huang, Lifeng Shang, Xin Jiang, and Qun Liu. 2023. [Aligning large language models with human: A survey](https://md.research.elamur.ai/free/en/papers/wang-2023-aligning-large-language-models-human/). arXiv preprint arXiv:2307.12966.
31. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023a. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) arXiv preprint arXiv:2307.02483.
32. Zeming Wei, Yifei Wang, and Yisen Wang. 2023b. [Jailbreak and guard aligned language models with only few in-context demonstrations](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbreak-guard-aligned-language-models/). arXiv preprint arXiv:2310.06387.
33. Ziqing Yang, Michael Backes, Yang Zhang, and Ahmed Salem. 2024. Sos! soft prompt attack against open-source large language models. arXiv preprint arXiv:2407.03160. — [arXiv:2407.03160](https://arxiv.org/abs/2407.03160) [find](https://scholar.google.com/scholar?q=Ziqing+Yang%2C+Michael+Backes%2C+Yang+Zhang%2C+and+Ahmed+Salem%2E+2024%2E+Sos%21+soft+prompt+attack+against+open%2Dsource+large+language+models%2E+arXiv+preprint+arXiv%3A2407%2E03160%2E+%E2%80%94+%5BarXiv%3A2407%2E03160%5D%28https%3A%2F%2Farxiv%2Eo)
34. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. [How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). arXiv preprint arXiv:2401.06373.
35. Qiusi Zhan, Richard Fang, Rohan Bindu, Akul Gupta, Tatsunori Hashimoto, and Daniel Kang. 2023. Removing rlhf protections in gpt-4 via fine-tuning. arXiv preprint arXiv:2311.05553. [find](https://scholar.google.com/scholar?q=Qiusi+Zhan%2C+Richard+Fang%2C+Rohan+Bindu%2C+Akul+Gupta%2C+Tatsunori+Hashimoto%2C+and+Daniel+Kang%2E+2023%2E+Removing+rlhf+protections+in+gpt%2D4+via+fine%2Dtuning%2E+arXiv+preprint+arXiv%3A2311%2E05553%2E)
36. Chujie Zheng, Fan Yin, Hao Zhou, Fandong Meng, Jie Zhou, Kai-Wei Chang, Minlie Huang, and Nanyun Peng. 2024. On prompt-driven safeguarding for large language models. In Forty-first International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Chujie+Zheng%2C+Fan+Yin%2C+Hao+Zhou%2C+Fandong+Meng%2C+Jie+Zhou%2C+Kai%2DWei+Chang%2C+Minlie+Huang%2C+and+Nanyun+Peng%2E+2024%2E+On+prompt%2Ddriven+safeguarding+for+large+language+models%2E+In+Forty%2Dfirst+International+Confe)
37. Algorithm 1 Universal Feature Extractor Require: Prompts P , Targets Y , LLM F , Iterations I, Interval c, Evaluation method J, Embedding matrix E Ensure: List A suffixes Initialize suffix embeddings S for t = 1 to I do Compute  loss: L adv + λL embed if Token Attack L = L adv otherwise Update embe… [find](https://scholar.google.com/scholar?q=Algorithm+1+Universal+Feature+Extractor+Require%3A+Prompts+P+%2C+Targets+Y+%2C+LLM+F+%2C+Iterations+I%2C+Interval+c%2C+Evaluation+method+J%2C+Embedding+matrix+E+Ensure%3A+List+A+suffixes+Initialize+suffix+embeddings+)

*Updated 1 November 2026*