Julius Broomfield, Tom Gibbs, George Ingebretsen, Ethan Kosak-Hine, Tia Nasir, Jason Zhang, Reihaneh Iranmanesh, Sara Pieri, Reihaneh Rabbany, Kellin Pelrine
| Challenge: | LLM jailbreaks are a widespread safety challenge. |
| Approach: | They propose a structure-rewriting guardrail that allows for more efficient safety assessment . single-turn attacks are the most extensively explored in the literature . |
| Outcome: | The proposed framework can be used to enable new defenses, the authors show . they show that the proposed framework reduces the risk of harmful inputs . |
Similar Papers
LS-Guard: Adaptive Safety Guardrails Tailored to Individual LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing security guardrails built from static datasets ignore each model’s unique safety profile and often force trade-offs between safety and utility. |
| Approach: | They propose a framework for learning model-specific guardrails tailored to each LLM’s vulnerabilities. |
| Outcome: | The proposed framework significantly outperforms baseline guardrails on multiple real-world LLMs, achieving superior robustness, adaptability, and generalization. |
CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion (2024.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models exhibit remarkable generative capabilities but can be misused for harmful purposes. |
| Approach: | They propose a framework that transforms natural language inputs into code inputs. |
| Outcome: | The proposed framework bypasses the safety guardrails of all models more than 80% of the time. |
TRIDENT: Enhancing Large Language Model Safety with Tri-Dimensional Diversified Red-Teaming Data Synthesis (2025.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) excel in natural language processing tasks but are vulnerable to harmful content and being exploited for malicious purposes. |
| Approach: | They propose a framework to measure the risk coverage of alignment datasets across three dimensions: Lexical Diversity, Malicious Intent, and Jailbreak Tactics. |
| Outcome: | The proposed framework measures risk coverage across Lexical Diversity, Malicious Intent, and Jailbreak Tactics. |
Safety Is Not Universal: The Selective Safety Trap in LLM Alignment (2026.findings-acl)
Copied to clipboard
Iago Alves Brito, Walcy Rios, Julia Soares Dollis, Diogo Fernandes Costa Silva, Arlindo Rodrigues Galvão Filho
| Challenge: | Existing safety evaluations of large language models aggregate harms under generic categories such as "Identity Hate" a bilingual benchmark identifies a selective safety trap, where defense rates vary by up to 42% within the same model solely based on the target group. |
| Approach: | They propose a bilingual adversarial benchmark to audit selective safety in large language models . defense rates vary by up to 42% within the same model solely based on target group . |
| Outcome: | The proposed benchmark identifies a selective safety trap in large language models . defense rates vary by up to 42% within the same model solely based on the target group. |
Jailbreak Attack Initializations as Extractors of Compliance Directions (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Safety-aligned LLMs respond to prompts with compliance or refusal, each corresponding to distinct directions in the model’s activation space. |
| Approach: | They propose an initialization framework that aims to project unseen prompts further along compliance directions. |
| Outcome: | The proposed initialization framework achieves an increased attack success rate and reduced computational overhead, highlighting the fragility of safety-aligned LLMs. |
Jailbreaking Attacks vs. Content Safety Filters: How Far Are We in the LLM Safety Arms Race? (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing studies have focused on the models, neglecting the full deployment pipeline . previous studies have underestimated the practical success of these attacks . |
| Approach: | They evaluate the effectiveness of jailbreak attacks targeting LLM safety alignment . they highlight critical gaps and call for further refinement of detection accuracy and usability . |
| Outcome: | The proposed attacks can detect at least one safety filter across the entire deployment pipeline. |
When Safety Alignment Fails to Generalize: Probing with Language Game Jailbreaks (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing safety alignment methods rely on fixed or narrow transformation schemes to generalize . existing methods based on fixed and narrow transformations are often inadequate . |
| Approach: | They propose a framework for discovering and refining language game-based jailbreaks to probe alignment generalization. |
| Outcome: | The proposed framework allows controlled exploration of alignment behavior across closely related linguistic variants. |
Safety is Not Only About Refusal: Reasoning-Enhanced Fine-tuning for Interpretable LLM Safety (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are vulnerable to jailbreak attacks that exploit weaknesses in traditional safety alignment. |
| Approach: | They propose a framework that trains models to engage in explicit safe reasoning before response . they propose RATIONAL, which allows models to reject harmful prompts while providing meaningful and context-aware responses. |
| Outcome: | The proposed framework fine-tunes models to reason about query intent, ethics, and potential harm. |
When Prompt Optimization Becomes Jailbreaking: Adaptive Red-Teaming of Large Language Models (2026.eacl-srw)
Copied to clipboard
| Challenge: | Existing safety evaluations rely on fixed collections of harmful prompts . such attacks span single-shot prompts, multi-turn interactions, cross-lingual settings . |
| Approach: | They propose to use black-box prompt optimization techniques to search for safety failures . they use GPT-5.1 to optimize for a continuous danger score . |
| Outcome: | The proposed approach reduces effective safeguards for large language models . the average danger score of Qwen 3 8B increases from 0.09 in its baseline setting to 0.79 after optimization. |
X-Boundary: Establishing Exact Safety Boundary to Shield LLMs from Jailbreak Attacks without Compromising Usability (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods for enhancing LLM security compromise usability, study finds . boundary-safe representations close to harmful representations are disrupted, resulting in usability decline . |
| Approach: | They propose a method to push harmful representations away from boundary-safe representations and obtain an exact distinction boundary. |
| Outcome: | The proposed method reduces over-refusal rate and maintains general capability . it pushes harmful representations away from boundary-safe representations, thereby reducing usability. |