Papers with Attack Success Rate
Defensive Prompt Patch: A Robust and Generalizable Defense of Large Language Models against Jailbreak Attacks (2025.findings-acl)
Copied to clipboard
| Challenge: | Recent advances in large language models (LLMs) have showcased their ability to understand and generate text akin to human interaction. |
| Approach: | They propose a prompt-based defense mechanism specifically designed to protect LLMs against jailbreak attacks by introducing jailbreak prompts into malicious queries. |
| Outcome: | Empirical results show that the proposed defense outperforms existing defense strategies in balancing safety and utility while maintaining high utility. |
Automating Steering for Safe Multimodal Large Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in Multimodal Large Language Models (MLLMs) have unlocked powerful cross-modal reasoning abilities, but also raised new safety concerns, especially when faced with adversarial multimodal inputs. |
| Approach: | They propose a modular and adaptive inference-time intervention technology, AutoSteer, that integrates a safety awareness score, an adaptive safety prober, and a lightweight Refusal Head to modulate generation when safety risks are detected. |
| Outcome: | Experiments on LLaVA-OV and Chameleon show that AutoSteer significantly reduces the Attack Success Rate (ASR) for textual, visual, and cross-modal threats while maintaining general abilities. |
Composite Backdoor Attacks Against Large Language Models (2024.findings-naacl)
Copied to clipboard
| Challenge: | Large language models (LLMs) have demonstrated superior performance on various tasks, but untrustworthy third-party LLMs may covertly introduce vulnerabilities for downstream tasks. |
| Approach: | They propose a composite backdoor attack that scatters multiple trigger keys in different prompt components. |
| Outcome: | The proposed attack achieves 100% Attack Success Rate (ASR) with a False Triggered Rate (FTR) below 2.06% and negligible model accuracy degradation. |
Iron Sharpens Iron: Defending Against Attacks in Machine-Generated Text Detection with Adversarial Training (2025.acl-long)
Copied to clipboard
| Challenge: | Existing MGT detectors are vulnerable to simple perturbations and adversarial attacks. |
| Approach: | They propose an adversarial framework for training a robust machine-generated text detector called GREedy Adversary PromoTed DefendER. |
| Outcome: | The proposed framework reduces the Attack Success Rate (ASR) by 0.67% compared with SOTA defense methods. |
PivotAttack: Rethinking the Search Trajectory in Hard-Label Text Attacks via Pivot Words (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing hard-label text attacks rely on inefficient "outside-in" strategies that traverse vast search spaces. |
| Approach: | They propose a query-efficient "inside-out" framework that perturbs Pivot Sets to induce label flips. |
| Outcome: | The proposed framework outperforms state-of-the-art methods in both Attack Success Rate and query efficiency. |
Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization (2024.acl-long)
Copied to clipboard
| Challenge: | Despite the success of jailbreaking attacks, there is a lack of effort in defending against them. |
| Approach: | They propose to integrate goal prioritization at both training and inference stages to counteract this conflict between the goals of being helpful and ensuring safety. |
| Outcome: | The proposed approach reduces the Attack Success Rate (ASR) of jailbreaking from 66.4% to 3.6% for ChatGPT and reduces it from 71.0% to 6.6% for Llama2-13B. |
Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent studies have shown that visual encoders can induce harmful behavior in multimodal large language models. |
| Approach: | They propose a vision-centric jailbreak attack that uses visual information to create a jailbreak context. |
| Outcome: | The proposed attack outperforms baseline attacks on MM-SafetyBench and GPT-4o. |
Unraveling the Mystery: Defending Against Jailbreak Attacks Via Unearthing Real Intention (2025.coling-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are increasingly vulnerable to elusive and implicit intentions, causing security risks and compromising user experience. |
| Approach: | They propose a method to detect and mitigate implicit jailbreak attacks using LLMs by unearthing real intentions and a greedy gradient-based algorithm to remove the least important parts of a sentence. |
| Outcome: | The proposed method reduces attacks success rate and Harmful Score while maintaining overall model performance. |
Can Textual Unlearning Solve Cross-Modality Safety Alignment? (2024.findings-emnlp)
Copied to clipboard
Trishna Chakraborty, Erfan Shayegani, Zikui Cai, Nael Abu-Ghazaleh, M. Salman Asif, Yue Dong, Amit Roy-Chowdhury, Chengyu Song
| Challenge: | integrating new modalities into large language models creates new attack surface . existing safety training techniques like SFT and RLHF are not feasible in multi-modal settings . |
| Approach: | They explore whether unlearning in the textual domain can be effective for cross-modality safety alignment. |
| Outcome: | The proposed approach reduces the Attack Success Rate (ASR) to less than 8% and preserves the utility. |
TRIDENT: Enhancing Large Language Model Safety with Tri-Dimensional Diversified Red-Teaming Data Synthesis (2025.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) excel in natural language processing tasks but are vulnerable to harmful content and being exploited for malicious purposes. |
| Approach: | They propose a framework to measure the risk coverage of alignment datasets across three dimensions: Lexical Diversity, Malicious Intent, and Jailbreak Tactics. |
| Outcome: | The proposed framework measures risk coverage across Lexical Diversity, Malicious Intent, and Jailbreak Tactics. |
Securing Multi-turn Conversational Language Models From Distributed Backdoor Attacks (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Large language models (LLMs) have acquired the ability to handle longer context lengths and understand nuances in text, expanding their dialogue capabilities beyond a single utterance. |
| Approach: | They propose a decoding time defense that scales linearly with the input sequence length and reduces the backdoor to as low as 0.35%. |
| Outcome: | The proposed framework is generalizable, compatible with any trigger in an adversary’s toolbox in a plug-and-play manner. |
Beyond Surface-Level Patterns: An Essence-Driven Defense Framework Against Jailbreak Attacks in LLMs (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing methods focus on surface-level patterns, overlooking the deeper attack essences. |
| Approach: | They propose an Essence-Driven Defense Framework Against Jailbreak Attacks in Aligned Large Language Models that extracts the "attack essence" from a diverse set of known attack instances and stores it in an offline vector database. |
| Outcome: | The proposed framework outperforms existing methods by reducing the Attack Success Rate by at least 20%, underscoring its superior robustness against jailbreak attacks. |
Activation-Guided Local Editing for Jailbreaking Attacks (2026.acl-long)
Copied to clipboard
| Challenge: | Existing methods for jailbreaking Large Language Models (LLMs) are limited and produce incoherent or unreadable inputs. |
| Approach: | They propose a two-stage framework that performs a one-shot, scenario-based generation of context and rephrases the original malicious query to obscure its harmful intent. |
| Outcome: | The proposed framework achieves state-of-the-art Attack Success Rate, with gains of up to 37.74% over the strongest baseline, and excellent transferability to black-box and large-scale models. |
LogicAttack: Adversarial Attacks for Evaluating Logical Consistency of Natural Language Inference (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Recent advances in Large Language Models (LLMs) have demonstrated impressive performance on Natural Language Inference (NLI) tasks. |
| Approach: | They propose a method to attack NLI models using diverse logical forms of premise and hypothesis using propositional logic to generate effective adversarial attacks. |
| Outcome: | The proposed method achieves an average 53% Attack Success Rate (ASR) across multiple logic-based attacks. |
FLASH: Focused Layer Attention Sink Hijacking (2026.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) remain vulnerable to jailbreaking attacks despite advances in safety alignment . |
| Approach: | They propose a new diagnostic auditing framework that dismantles the model's internal safety anchor by precisely scaling attention scores in these vulnerable layers. |
| Outcome: | The proposed framework achieves a state-of-the-art Attack Success Rate of over 77% with an unprecedented efficiency of 1.53 queries on average. |
RoCoIns: Enhancing Robustness of Large Language Models through Code-Style Instructions (2024.lrec-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have shown remarkable capabilities in following human instructions and solving NLU tasks. |
| Approach: | They propose to use code style instructions to replace typically natural language instructions to provide more precise instructions and strengthen the robustness of LLMs. |
| Outcome: | The proposed method outperforms natural language models on eight robustness datasets and achieves an improvement of 5.68% in test set accuracy and a reduction of 5.66 points in Attack Success Rate (ASR). |
More Thinking, Less Talking: Internalizing Deliberative Safety into LLM Parameters (2026.acl-long)
Copied to clipboard
| Challenge: | Existing safety alignment methods leave Large Language Models vulnerable to sophisticated jailbreak attacks. |
| Approach: | They propose a safety reasoning internalization framework that internalizes safety reasoning into an implicit computational pathway using Low-Rank Adaptation (LoRA). |
| Outcome: | The proposed framework achieves a 43% lower Attack Success Rate (ASR) against distinct jailbreak attacks compared to strong baselines. |
SilentDrift: Exploiting Action Chunking for Stealthy Backdoor Attacks on Vision-Language-Action Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing backdoor attacks introduce kinematic discontinuities and distributional anomalies that can be flagged by standard trajectory detection. |
| Approach: | They propose a backdoor attack exploiting an intra-chunk visual open-loop vulnerability . they propose 93.2% Attack Success Rate and a poisoning rate under 2% . |
| Outcome: | The proposed attack achieves a 93.2% Attack Success Rate with a poisoning rate under 2% while maintaining a 95.3% Clean Task Success Rate. |