StealthGraph: Exposing Domain-Specific Risks in LLMs through Knowledge-Graph-Guided Harmful Prompt Generation (2026.acl-long)
Copied to clipboard
| Challenge: | Domain-specific datasets of harmful prompts are scarce and often rely on manual construction. Existing efforts to improve domain knowledge and reduce harmful prompt generation are lacking. |
| Approach: | They propose a framework that transforms domain knowledge into actionable constraints and increases the implicitness of generated harmful prompts. |
| Outcome: | The proposed framework yields high-quality datasets combining strong domain relevance with implicitness, enabling more realistic red-teaming and advancing LLM safety research. |
Similar Papers
Harmful Prompt Laundering: Jailbreaking LLMs with Abductive Styles and Symbolic Encoding (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have demonstrated remarkable capabilities but their misuse for harmful purposes remains a concern. |
| Approach: | They propose a jailbreaking technique that exploits weaknesses in LLMs' architecture . they propose abductive framing and symbolic encoding to bypass safeguards . |
| Outcome: | The proposed technique achieves over 95% attack success rate on GPT-series models and 70% across all targets. |
Understanding and Mitigating Overrefusal in LLMs from an Unveiling Perspective of Safety Decision Boundary (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large language models (LLMs) often refuse to answer legitimate queries, causing models to treat many reasonable prompts as potentially risky. |
| Approach: | They propose a framework that automatically generates and selects overrefusal prompts near the safety boundary. |
| Outcome: | The proposed framework identifies and curates boundary-aligned prompts, enabling more effective and targeted mitigation of overrefusal. |
Attack Prompt Generation for Red Teaming and Defending Large Language Models (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing studies construct attack prompts via manual or automatic methods, but these methods have limitations on cost and quality. |
| Approach: | They propose an attack framework to instruct LLMs to mimic human-generated prompts through in-context learning and a defense framework that fine-tunes victim LLM's through iterative interactions with the attack framework. |
| Outcome: | The proposed approach is based on experiments on different LLMs to evaluate their effectiveness against red teaming attacks. |
LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shifts (2025.acl-long)
Copied to clipboard
Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, Jing Shao
| Challenge: | Current safety training focuses on teaching models to reject harmful queries, but recent research shows that adversarial attacks or jailbreak methods bypass these safety mechanisms. |
| Approach: | They propose to use a new attack method to craft multi-turn toxic prompts that gradually lead LLMs to reveal unsafe content. |
| Outcome: | The proposed method outperforms existing methods in diversity, effectiveness, and efficiency across aligned LLMs. |
Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysis (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large language models (LLMs) are susceptible to a type of attack known as jailbreaking, which misleads LLMs to output harmful contents. |
| Approach: | They propose to leverage hidden representations into existing jailbreak targets to move the attacks along the acceptance direction. |
| Outcome: | The proposed methods are validated using the objective of existing jailbreak attacks. |
The TIP of the Iceberg: Revealing a Hidden Class of Task-in-Prompt Adversarial Attacks on LLMs (2025.acl-long)
Copied to clipboard
| Challenge: | cipher decoding, riddles, code execution embedded into model prompts bypass safety safeguards of large language models (LLMs) . |
| Approach: | They introduce a novel class of adversarial jailbreak adversarials on large language models, termed Task-in-Prompt (TIP) attacks. |
| Outcome: | The proposed techniques circumvent safeguards in six state-of-the-art language models, including GPT-4o and LLaMA 3.2, and consistently generate restricted content . |
GraphICL: Unlocking Graph Learning Potential in LLMs through Structured Prompt Design (2025.findings-naacl)
Copied to clipboard
| Challenge: | Text-Attributed Graphs (TAGs) are a powerful tool for understanding complex systems and relationships. |
| Approach: | They propose a benchmark to evaluate large language models for graph-structured data using prompts. |
| Outcome: | The proposed benchmark outperforms state-of-the-art graph LLMs and graph neural networks on graph learning tasks without training. |
Into the Gray Zone: Domain Contexts Can Blur LLM Safety Boundaries (2026.acl-long)
Copied to clipboard
Ki Sen Hung, Xi Yang, Chang Liu, Haoran Li, Kejiang Chen, Changxuan Fan, Tsun On Kwok, Weiming Zhang, Xiaomeng Li, Yangqiu Song
| Challenge: | a goal of LLM alignment is to balance usefulness with harmlessness, but this conflictes when knowledge serves both legitimate and malicious purposes. |
| Approach: | They propose a framework that combines safety-research contexts with adversarial interactions to exploit a vulnerability in Jargon queries. |
| Outcome: | a framework outperforms existing methods in analyzing Jargon queries, a study shows . it achieves 93% of attacks across seven models, while remaining useful, the authors say . |
Root Defense Strategies: Ensuring Safety of LLM at the Decoding Level (2025.acl-long)
Copied to clipboard
| Challenge: | Existing methods to detect harmful outputs from prefill-level lacks utilization of the model’s decoding outputs, leading to relatively lower effectiveness and robustness. |
| Approach: | They propose a robust decoding mechanism that corrects harmful queries directly rather than rejecting them outright. |
| Outcome: | The proposed model improves model security without compromising reasoning speed. |
Are My Optimized Prompts Compromised? Exploring Vulnerabilities of LLM-based Optimizers (2026.eacl-long)
Copied to clipboard
| Challenge: | Recent studies have focused on poisoning during supervised fine-tuning, RLHF, or inference-time time optimization. |
| Approach: | They propose a simple fake reward attack that requires no access to the reward model and significantly increases vulnerability. |
| Outcome: | The proposed attack reduces the fake reward ASR from 0.23 to 0.07 without degrading utility. |