---
title: "Adaptive Instruction Composition for Automated LLM Red-Teaming"
description: "The authors propose Adaptive Instruction Composition (AIC), which treats choosing a query–tactic combination as a… 55 references."
authors: ["Jesse Zymet", "Andy Luo", "Swapnil Shinde", "Sahil Wadhwa", "Emily Chen"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.2174/"
doi: "10.18653/v1/2026.acl-long.2174"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zymet-2026-adaptive-instruction-composition-automated-llm/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zymet-2026-adaptive-instruction-composition-automated-llm/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/21/) / Adaptive Instruction Composition for Automated LLM Red-Teaming

# Adaptive Instruction Composition for Automated LLM Red-Teaming

**Authors:** Jesse Zymet, [Andy Luo](https://md.research.elamur.ai/free/en/authors/andy-luo/), [Swapnil Shinde](https://md.research.elamur.ai/free/en/authors/swapnil-shinde/), [Sahil Wadhwa](https://md.research.elamur.ai/free/en/authors/sahil-wadhwa/) and Emily Chen · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.2174/) · [PDF](https://aclanthology.org/2026.acl-long.2174.pdf) · [DOI 10.18653/v1/2026.acl-long.2174](https://doi.org/10.18653/v1/2026.acl-long.2174) · [OpenAlex](https://openalex.org/W7166862820)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Automated red-teaming uses an attacker LLM to find jailbreaks against a target model. Existing methods face a trade-off. Attackers that invent their own strategies by trial and error tend to settle on a narrow set of attack types. WildTeaming gets variety by filling its attacker prompt with harmful queries and tactics from the crowdsourced WildJailbreak corpus, but it pairs them randomly and never learns from earlier successes. The authors propose Adaptive Instruction Composition (AIC), which treats choosing a query–tactic combination as a contextual bandit problem. A small neural network trained with Neural Thompson Sampling learns to predict the evaluator's verdict for candidate compositions, which are represented by compressed sentence embeddings. It then samples compositions so that exploiting known weaknesses is balanced against further exploration. Compared with random combination, AIC scores substantially higher on both effectiveness and diversity metrics, and it keeps this advantage under model transfer. It also beats several recent adaptive methods on Harmbench. The work matters for safety teams that need broad, target-specific attack sets for safety training, since AIC runs in roughly the same time as WildTeaming.

## Key points
- **Search space:** Built on WildJailbreak data, which contains 50,500 vanilla harmful queries and 13,311 jailbreak tactics. Instructions combining one query with two tactics yield over 8 trillion possibilities.
- **Feature pipeline:** Texts are embedded with the contrastively pretrained Sentence Transformer all-mpnet-base-v2 (768 dimensions) and reduced to 10 dimensions with UMAP. The embeddings of each composition's components are concatenated to form the bandit input. Ablations suggest the contrastive embeddings let the network generalize across this huge space.
- **Experimental setup:** Mixtral-8x7B serves as attacker and Llama-Guard-2 as judge. Targets are Mistral-7B, Llama-3-70B-Instruct and Llama-3.3-70B-Instruct. Results were additionally checked with the Harmbench evaluator (Harmbench-Llama-2-13b-cls).
- **Compute cost:** A training simulation takes about 10–12 hours, or roughly 70–120 GPU hours. A 10,000-trial run against Mistral-7B took about 10 hours, mainly because three LLMs are queried in sequence.
- **Limitations and future work:** Only three open-source targets were tested, and the evaluators can produce false positives and negatives. The authors suggest richer instruction templates and adapting AIC to indirect prompt injection against RAG agents.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Capital One](https://md.research.elamur.ai/free/en/companies/capital-one/) — Company, Tysons Corner, United States · 7 works · 16 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Jesse Zymet, Andy Luo, Swapnil Shinde, Sahil Wadhwa and Emily Chen. 2026. Adaptive Instruction Composition for Automated LLM Red-Teaming. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zymet2026adaptive,
  title = {{Adaptive Instruction Composition for Automated LLM Red-Teaming}},
  author = {Jesse Zymet, Andy Luo, Swapnil Shinde, Sahil Wadhwa and Emily Chen},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.2174},
  url = {https://doi.org/10.18653/v1/2026.acl-long.2174}
}
```

- [← previous Adaptive Emotion Management in Human-robot Dialogue using Online Group Relative Policy Optimization](https://md.research.elamur.ai/free/en/papers/manaseryan-2026-adaptive-emotion-management-human-robot/)
- [next → Adaptive Planning for Multi-Attribute Controllable Summarization with Monte Carlo Tree Search](https://md.research.elamur.ai/free/en/papers/ryu-2026-adaptive-planning-multi-attribute-controllable/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/21/)

## References

55 references, 26 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Shipra Agrawal and Navin Goyal. 2013. Thompson sampling for contextual bandits with linear payoffs. In Proceedings of the 30th International Conference on Machine Learning, volume 28 of Proceedings of Machine Learning Research, pages 127–135, Atlanta, Georgia, USA. PMLR. [find](https://scholar.google.com/scholar?q=Shipra+Agrawal+and+Navin+Goyal%2E+2013%2E+Thompson+sampling+for+contextual+bandits+with+linear+payoffs%2E+In+Proceedings+of+the+30th+International+Conference+on+Machine+Learning%2C+volume+28+of+Proceedings+of)
2. Peter Auer. 2002. Using confidence bounds for exploitation-exploration trade-offs. Journal of Machine Learning Research, 3(Nov):397–422. [find](https://scholar.google.com/scholar?q=Peter+Auer%2E+2002%2E+Using+confidence+bounds+for+exploitation%2Dexploration+trade%2Doffs%2E+Journal+of+Machine+Learning+Research%2C+3%28Nov%29%3A397%E2%80%93422%2E)
3. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, Carol Chen, Catherine Olsson, Christopher Olah, Danny Hernandez, Dawn Drain, Deep Ganguli, Dustin Li, Eli Tran-Johnson, Ethan Perez, Jamie Kerr, Jared… — [Constitutional AI: Harmlessness from AI Feedback](https://md.research.elamur.ai/free/en/papers/bai-2022-constitutional-ai-harmlessness-ai-feedback/)
4. Mohsen Bayati, Nima Hamidi, Ramesh Johari, and Khashayar Khosravi. 2024. The unreasonable effectiveness of greedy algorithms in multi-armed bandit with many arms. [find](https://scholar.google.com/scholar?q=Mohsen+Bayati%2C+Nima+Hamidi%2C+Ramesh+Johari%2C+and+Khashayar+Khosravi%2E+2024%2E+The+unreasonable+effectiveness+of+greedy+algorithms+in+multi%2Darmed+bandit+with+many+arms%2E)
5. Alex Beutel, Kai Xiao, Johannes Heidecke, and Lilian Weng. 2024. Diverse and effective red teaming with auto-generated rewards and multi-step reinforcement learning. [find](https://scholar.google.com/scholar?q=Alex+Beutel%2C+Kai+Xiao%2C+Johannes+Heidecke%2C+and+Lilian+Weng%2E+2024%2E+Diverse+and+effective+red+teaming+with+auto%2Dgenerated+rewards+and+multi%2Dstep+reinforcement+learning%2E)
6. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2024. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/).
7. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2024. Masterkey: Automated jailbreaking of large language model chatbots. In Proceedings 2024 Network and Distributed System Security Symposium, NDSS 2024. Internet Society. [find](https://scholar.google.com/scholar?q=Gelei+Deng%2C+Yi+Liu%2C+Yuekang+Li%2C+Kailong+Wang%2C+Ying+Zhang%2C+Zefeng+Li%2C+Haoyu+Wang%2C+Tianwei+Zhang%2C+and+Yang+Liu%2E+2024%2E+Masterkey%3A+Automated+jailbreaking+of+large+language+model+chatbots%2E+In+Proceedings+2)
8. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. [Bert: Pre-training of deep bidirectional transformers for language understanding](https://md.research.elamur.ai/free/en/papers/devlin-2019-bert-pre-training-deep-bidirectional/).
9. Yi Dong, Ronghui Mu, Yanghao Zhang, Siqi Sun, Tianle Zhang, Changshun Wu, Gaojie Jin, Yi Qi, Jinwei Hu, Jie Meng, Saddek Bensalem, and Xiaowei Huang. 2024. Safeguarding [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/).
10. Michael Feffer, Anusha Sinha, Wesley H Deng, Zachary C Lipton, and Hoda Heidari. 2024. Red-teaming for generative ai: Silver bullet or security theater? In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, volume 7, pages 421–437. [find](https://scholar.google.com/scholar?q=Michael+Feffer%2C+Anusha+Sinha%2C+Wesley+H+Deng%2C+Zachary+C+Lipton%2C+and+Hoda+Heidari%2E+2024%2E+Red%2Dteaming+for+generative+ai%3A+Silver+bullet+or+security+theater%3F+In+Proceedings+of+the+AAAI%2FACM+Conference+on+AI)
11. Sarah Filippi, Olivier Cappe, Aurélien Garivier, and Csaba Szepesvári. 2010. Parametric bandits: The generalized linear case. Advances in neural information processing systems, 23. [find](https://scholar.google.com/scholar?q=Sarah+Filippi%2C+Olivier+Cappe%2C+Aur%C3%A9lien+Garivier%2C+and+Csaba+Szepesv%C3%A1ri%2E+2010%2E+Parametric+bandits%3A+The+generalized+linear+case%2E+Advances+in+neural+information+processing+systems%2C+23%2E)
12. Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, Andy Jones, Sam Bowman, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Nelson Elhage, Sheer El-Showk, Stanislav Fort, Zac Hatfield-Dodds, Tom Henighan… — [Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned](https://md.research.elamur.ai/free/en/papers/ganguli-2022-red-teaming-language-models-reduce/)
13. Suyu Ge, Chunting Zhou, Rui Hou, Madian Khabsa, Yi-Chia Wang, Qifan Wang, Jiawei Han, and Yuning Mao. 2023. [Mart: Improving llm safety with multi-round automatic red-teaming](https://md.research.elamur.ai/free/en/papers/ge-2024-mart-improving-llm-safety-multi/). arXiv preprint arXiv:2311.07689.
14. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, Arun Rao,… — [The Llama 3 Herd of Models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/)
15. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. [Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection](https://md.research.elamur.ai/free/en/papers/greshake-2023-ve-signed-up-compromising-real/). In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security,…
16. Taehyun Hwang, Kyuwook Chai, and Min hwan Oh. 2023. Combinatorial neural bandits. [find](https://scholar.google.com/scholar?q=Taehyun+Hwang%2C+Kyuwook+Chai%2C+and+Min+hwan+Oh%2E+2023%2E+Combinatorial+neural+bandits%2E)
17. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. 2023. [Llama guard: Llm-based input-output safeguard for human-ai conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/).
18. Arthur Jacot, Franck Gabriel, and Clément Hongler. 2020. Neural tangent kernel: Convergence and generalization in neural networks. [find](https://scholar.google.com/scholar?q=Arthur+Jacot%2C+Franck+Gabriel%2C+and+Cl%C3%A9ment+Hongler%2E+2020%2E+Neural+tangent+kernel%3A+Convergence+and+generalization+in+neural+networks%2E)
19. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de Las Casas, Florian Bressand, Gianmario Calafiore, Guillaume Bour, Guillaume Lample, Jean-Baptiste Bordes, Jose Cano, Lauri Sintonen, Madeleine-Clémence Gros, Matthieu Cord, Moïse Debbabi, Paul-Emm… [find](https://scholar.google.com/scholar?q=Albert+Q%2E+Jiang%2C+Alexandre+Sablayrolles%2C+Arthur+Mensch%2C+Chris+Bamford%2C+Devendra+Singh+Chaplot%2C+Diego+de+Las+Casas%2C+Florian+Bressand%2C+Gianmario+Calafiore%2C+Guillaume+Bour%2C+Guillaume+Lample%2C+Jean%2DBaptist)
20. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix,… [find](https://scholar.google.com/scholar?q=Albert+Q%2E+Jiang%2C+Alexandre+Sablayrolles%2C+Arthur+Mensch%2C+Chris+Bamford%2C+Devendra+Singh+Chaplot%2C+Diego+de+las+Casas%2C+Florian+Bressand%2C+Gianna+Lengyel%2C+Guillaume+Lample%2C+Lucile+Saulnier%2C+L%C3%A9lio+Renard+Lav)
21. Bojian Jiang, Yi Jing, Tianhao Shen, Tong Wu, Qing Yang, and Deyi Xiong. 2024b. [Automated progressive red teaming](https://md.research.elamur.ai/free/en/papers/jiang-2025-automated-progressive-red-teaming/). arXiv preprint arXiv:2407.03876.
22. Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, and Nouha Dziri. 2024c. [Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models](https://md.research.elamur.ai/free/en/papers/jiang-2024-wildteaming-scale-wild-jailbreaks-adversarially/).
23. Tomasz Korbak, Kejian Shi, Angelica Chen, Rasika Bhalerao, Christopher L. Buckley, Jason Phang, Samuel R. Bowman, and Ethan Perez. 2023. Pre-training language models with human preferences. [find](https://scholar.google.com/scholar?q=Tomasz+Korbak%2C+Kejian+Shi%2C+Angelica+Chen%2C+Rasika+Bhalerao%2C+Christopher+L%2E+Buckley%2C+Jason+Phang%2C+Samuel+R%2E+Bowman%2C+and+Ethan+Perez%2E+2023%2E+Pre%2Dtraining+language+models+with+human+preferences%2E)
24. George Kour, Naama Zwerdling, Marcel Zalmanovici, Ateret Anaby-Tavor, Ora Nova Fandina, and Eitan Farchi. 2024. Exploring straightforward conversational red-teaming. [find](https://scholar.google.com/scholar?q=George+Kour%2C+Naama+Zwerdling%2C+Marcel+Zalmanovici%2C+Ateret+Anaby%2DTavor%2C+Ora+Nova+Fandina%2C+and+Eitan+Farchi%2E+2024%2E+Exploring+straightforward+conversational+red%2Dteaming%2E)
25. Lihong Li, Wei Chu, John Langford, and Robert E Schapire. 2010. A contextual-bandit approach to personalized news article recommendation. In Proceedings of the 19th international conference on World wide web, pages 661–670. [find](https://scholar.google.com/scholar?q=Lihong+Li%2C+Wei+Chu%2C+John+Langford%2C+and+Robert+E+Schapire%2E+2010%2E+A+contextual%2Dbandit+approach+to+personalized+news+article+recommendation%2E+In+Proceedings+of+the+19th+international+conference+on+World+w)
26. Lizhi Lin, Honglin Mu, Zenan Zhai, Minghan Wang, Yuxia Wang, Renxi Wang, Junjie Gao, Yixuan Zhang, Wanxiang Che, Timothy Baldwin, et al. 2024. Against the achilles’ heel: A survey on red teaming for generative models. arXiv preprint arXiv:2404.00629. — [arXiv:2404.00629](https://arxiv.org/abs/2404.00629) [find](https://scholar.google.com/scholar?q=Lizhi+Lin%2C+Honglin+Mu%2C+Zenan+Zhai%2C+Minghan+Wang%2C+Yuxia+Wang%2C+Renxi+Wang%2C+Junjie+Gao%2C+Yixuan+Zhang%2C+Wanxiang+Che%2C+Timothy+Baldwin%2C+et+al%2E+2024%2E+Against+the+achilles%E2%80%99+heel%3A+A+survey+on+red+teaming+for+g)
27. Alisa Liu, Swabha Swayamdipta, Noah A. Smith, and Yejin Choi. 2022. [Wanli: Worker and ai collaboration for natural language inference dataset creation](https://md.research.elamur.ai/free/en/papers/liu-2022-wanli-worker-ai-collaboration-natural/).
28. Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick Mc-Daniel, Huan Sun, Bo Li, and Chaowei Xiao. 2024a. Autodan-turbo: A lifelong agent for strategy self-exploration to jailbreak llms. [find](https://scholar.google.com/scholar?q=Xiaogeng+Liu%2C+Peiran+Li%2C+Edward+Suh%2C+Yevgeniy+Vorobeychik%2C+Zhuoqing+Mao%2C+Somesh+Jha%2C+Patrick+Mc%2DDaniel%2C+Huan+Sun%2C+Bo+Li%2C+and+Chaowei+Xiao%2E+2024a%2E+Autodan%2Dturbo%3A+A+lifelong+agent+for+strategy+self%2Dexpl)
29. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024b. [Autodan: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/).
30. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2024c. [Jailbreaking chatgpt via prompt engineering: An empirical study](https://md.research.elamur.ai/free/en/papers/liu-2023-jailbreaking-chatgpt-prompt-engineering-empirical/).
31. Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. [RoBERTa: A robustly optimized BERT pretraining approach](https://md.research.elamur.ai/free/en/papers/liu-2019-roberta-robustly-optimized-bert-pretraining/). arXiv preprint arXiv:1907.11692.
32. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/).
33. Leland McInnes, John Healy, and James Melville. 2020. [Umap: Uniform manifold approximation and projection for dimension reduction](https://md.research.elamur.ai/free/en/papers/mcinnes-2018-umap-uniform-manifold-approximation-projection/).
34. Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2023. [Tree of attacks: Jailbreaking black-box llms automatically](https://md.research.elamur.ai/free/en/papers/mehrotra-2023-tree-attacks-jailbreaking-black-box/). arXiv preprint arXiv:2312.02119.
35. Lingbo Mo, Zeyi Liao, Boyuan Zheng, Yu Su, Chaowei Xiao, and Huan Sun. 2024. A trembling house of cards? mapping adversarial attacks against language agents. [find](https://scholar.google.com/scholar?q=Lingbo+Mo%2C+Zeyi+Liao%2C+Boyuan+Zheng%2C+Yu+Su%2C+Chaowei+Xiao%2C+and+Huan+Sun%2E+2024%2E+A+trembling+house+of+cards%3F+mapping+adversarial+attacks+against+language+agents%2E)
36. John X. Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020. [Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp](https://md.research.elamur.ai/free/en/papers/morris-2020-textattack-framework-adversarial-attacks-data/).
37. Gary D. Lopez Munoz, Amanda J. Minnich, Roman Lutz, Richard Lundeen, Raja Sekhar Rao Dheekonda, Nina Chikanov, Bolor-Erdene Jagdagdorj, Martin Pouliot, Shiven Chawla, Whitney Maxwell, Blake Bullwinkel, Katherine Pratt, Joris de Gruyter, Charlotte Siska, Pete Bryan, Tori Westerhoff, Chang Kawaguchi,… [find](https://scholar.google.com/scholar?q=Gary+D%2E+Lopez+Munoz%2C+Amanda+J%2E+Minnich%2C+Roman+Lutz%2C+Richard+Lundeen%2C+Raja+Sekhar+Rao+Dheekonda%2C+Nina+Chikanov%2C+Bolor%2DErdene+Jagdagdorj%2C+Martin+Pouliot%2C+Shiven+Chawla%2C+Whitney+Maxwell%2C+Blake+Bullwinkel)
38. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. [Train…](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/)
39. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. [Red teaming language models with language models](https://md.research.elamur.ai/free/en/papers/perez-2022-red-teaming-language-models-language/). arXiv preprint arXiv:2202.03286.
40. Alberto Purpura, Sahil Wadhwa, Jesse Zymet, Akshay Gupta, Andy Luo, Melissa Kazemi Rad, Swapnil Shinde, and Mohammad Shahed Sorower. 2025. Building safe genai applications: An end-to-end overview of red teaming for large language models. [find](https://scholar.google.com/scholar?q=Alberto+Purpura%2C+Sahil+Wadhwa%2C+Jesse+Zymet%2C+Akshay+Gupta%2C+Andy+Luo%2C+Melissa+Kazemi+Rad%2C+Swapnil+Shinde%2C+and+Mohammad+Shahed+Sorower%2E+2025%2E+Building+safe+genai+applications%3A+An+end%2Dto%2Dend+overview+of+r)
41. Ambrish Rawat, Stefan Schoepf, Giulio Zizzo, Giandomenico Cornacchia, Muhammad Zaid Hameed, Kieran Fraser, Erik Miehling, Beat Buesser, Elizabeth M Daly, Mark Purcell, et al. 2024. Attack atlas: A practitioner’s perspective on challenges and pitfalls in red teaming genai. arXiv preprint arXiv:2409.1… — [arXiv:2409.15398](https://arxiv.org/abs/2409.15398) [find](https://scholar.google.com/scholar?q=Ambrish+Rawat%2C+Stefan+Schoepf%2C+Giulio+Zizzo%2C+Giandomenico+Cornacchia%2C+Muhammad+Zaid+Hameed%2C+Kieran+Fraser%2C+Erik+Miehling%2C+Beat+Buesser%2C+Elizabeth+M+Daly%2C+Mark+Purcell%2C+et+al%2E+2024%2E+Attack+atlas%3A+A+pra)
42. Nils Reimers and Iryna Gurevych. 2019. [Sentence-bert: Sentence embeddings using siamese bert-networks](https://md.research.elamur.ai/free/en/papers/reimers-2019-sentence-bert-sentence-embeddings-siamese/). In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics.
43. Elias Abad Rocamora, Yongtao Wu, Fanghui Liu, Grigorios G. Chrysos, and Volkan Cevher. 2024. Revisiting character-level adversarial attacks for language models. [find](https://scholar.google.com/scholar?q=Elias+Abad+Rocamora%2C+Yongtao+Wu%2C+Fanghui+Liu%2C+Grigorios+G%2E+Chrysos%2C+and+Volkan+Cevher%2E+2024%2E+Revisiting+character%2Dlevel+adversarial+attacks+for+language+models%2E)
44. Daniel Russo and Benjamin Van Roy. 2020. Satisficing in time-sensitive bandit learning. [find](https://scholar.google.com/scholar?q=Daniel+Russo+and+Benjamin+Van+Roy%2E+2020%2E+Satisficing+in+time%2Dsensitive+bandit+learning%2E)
45. Chantal Shaib, Joe Barrow, Jiuding Sun, Alexa F. Siu, Byron C. Wallace, and Ani Nenkova. 2025. Standardizing the measurement of text diversity: A tool and a comparative analysis of scores. [find](https://scholar.google.com/scholar?q=Chantal+Shaib%2C+Joe+Barrow%2C+Jiuding+Sun%2C+Alexa+F%2E+Siu%2C+Byron+C%2E+Wallace%2C+and+Ani+Nenkova%2E+2025%2E+Standardizing+the+measurement+of+text+diversity%3A+A+tool+and+a+comparative+analysis+of+scores%2E)
46. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. ["do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/). In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685.
47. Guy Tevet and Jonathan Berant. 2021. [Evaluating the evaluation of diversity in natural language generation](https://md.research.elamur.ai/free/en/papers/tevet-2021-evaluating-evaluation-diversity-natural-language/).
48. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2021. Universal adversarial triggers for attacking and analyzing nlp. [find](https://scholar.google.com/scholar?q=Eric+Wallace%2C+Shi+Feng%2C+Nikhil+Kandpal%2C+Matt+Gardner%2C+and+Sameer+Singh%2E+2021%2E+Universal+adversarial+triggers+for+attacking+and+analyzing+nlp%2E)
49. Yizao Wang, Jean-Yves Audibert, and Rémi Munos. 2008. Algorithms for infinitely many-armed bandits. Advances in Neural Information Processing Systems, 21. [find](https://scholar.google.com/scholar?q=Yizao+Wang%2C+Jean%2DYves+Audibert%2C+and+R%C3%A9mi+Munos%2E+2008%2E+Algorithms+for+infinitely+many%2Darmed+bandits%2E+Advances+in+Neural+Information+Processing+Systems%2C+21%2E)
50. Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. 2024. A comprehensive study of jailbreak attack versus defense for large language models. [find](https://scholar.google.com/scholar?q=Zihao+Xu%2C+Yi+Liu%2C+Gelei+Deng%2C+Yuekang+Li%2C+and+Stjepan+Picek%2E+2024%2E+A+comprehensive+study+of+jailbreak+attack+versus+defense+for+large+language+models%2E)
51. Zheng-Xin Yong, Cristina Menghini, and Stephen H. Bach. 2024. [Low-resource languages jailbreak gpt-4](https://md.research.elamur.ai/free/en/papers/yong-2023-low-resource-languages-jailbreak-gpt/).
52. Tianhui Zhang, Bei Peng, and Danushka Bollegala. 2024. Improving diversity of commonsense generation by large language models via in-context learning. [find](https://scholar.google.com/scholar?q=Tianhui+Zhang%2C+Bei+Peng%2C+and+Danushka+Bollegala%2E+2024%2E+Improving+diversity+of+commonsense+generation+by+large+language+models+via+in%2Dcontext+learning%2E)
53. Weitong Zhang, Dongruo Zhou, Lihong Li, and Quanquan Gu. 2021. Neural thompson sampling. [find](https://scholar.google.com/scholar?q=Weitong+Zhang%2C+Dongruo+Zhou%2C+Lihong+Li%2C+and+Quanquan+Gu%2E+2021%2E+Neural+thompson+sampling%2E)
54. Dongruo Zhou, Lihong Li, and Quanquan Gu. 2020. Neural contextual bandits with ucb-based exploration. [find](https://scholar.google.com/scholar?q=Dongruo+Zhou%2C+Lihong+Li%2C+and+Quanquan+Gu%2E+2020%2E+Neural+contextual+bandits+with+ucb%2Dbased+exploration%2E)
55. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/).

*Updated 2 November 2026*