Papers with attack success rates
TurboFuzzLLM: Turbocharging Mutation-based Fuzzing for Effectively Jailbreaking Large Language Models in Practice (2025.naacl-industry)
Copied to clipboard
| Challenge: | Existing methods for jailbreaking large-language models are limited by their limitations . authors present a mutation-based fuzzing technique that generates effective jailbreaking templates . |
| Approach: | They propose a mutation-based fuzzing technique for efficiently finding effective jailbreaking templates that combine with harmful questions to generate harmful responses. |
| Outcome: | The proposed technique achieves 95% attack success rates on public datasets for leading LLMs . it also shows impressive generalizability to unseen harmful questions and improves model defenses to prompt attacks. |
Graph of Attacks with Pruning: Optimizing Stealthy Jailbreak Prompt Generation for Enhanced LLM Content Moderation (2025.emnlp-industry)
Copied to clipboard
| Challenge: | Existing jailbreaking methods create adversarial prompts to bypass LLM safeguards. |
| Approach: | They propose a framework for generating stealthy jailbreak prompts that enables knowledge sharing across attack paths. |
| Outcome: | The proposed framework outperforms state-of-the-art methods for attacking both open and closed LLMs with attack success rates of >96%. |
Exploring Backdoor Vulnerabilities of Chat Models (2025.coling-main)
Copied to clipboard
| Challenge: | Recent studies show that Large Language Models (LLMs) are susceptible to a security threat known as Backdoor Attack. |
| Approach: | They propose a backdoor attack method that distributes trigger scenarios across user inputs in different rounds and makes the backdoor be triggered only when all trigger scenarios have appeared in the historical conversations. |
| Outcome: | The proposed method achieves high attack success rates on chat models while maintaining normal capabilities on providing helpful responses to benign user requests. |
Distinguishing Non-natural from Natural Adversarial Samples for More Robust Pre-trained Language Model (2022.findings-acl)
Copied to clipboard
| Challenge: | Recent studies on adversarial attacks achieve high success rates against PrLMs, claiming that they are not robust. |
| Approach: | They propose to use anomaly detector to evaluate PrLMs with more natural adversarial samples to evaluate their robustness. |
| Outcome: | The proposed method can be used to defend all types of attacks and achieve higher accuracy on adversarial samples and compliant samples than other defense frameworks. |
Typos that Broke the RAG’s Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing studies on the robustness of Large Language Models (LLMs) overlook the interconnected relationships between RAG components or the potential threats prevalent in real-world databases, such as minor textual errors. |
| Approach: | They propose a novel attack method that exploits vulnerabilities in RAG components and tests its robustness against noisy documents. |
| Outcome: | The proposed method devastates the performance of each component and their synergy, and significantly devases the performance. |
Between a Rock and a Hard Place: The Tension Between Ethical Reasoning and Safety Alignment in LLMs (2026.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) safety alignment predominantly operates on a binary assumption that requests are either safe or unsafe. |
| Approach: | They propose a methodology that embeds harmful requests within ethical framings to exploit this vulnerability. |
| Outcome: | The proposed framework achieves high success rates by exploiting model's own ethical reasoning to frame harmful actions as morally necessary compromises. |
Perturbations in the Wild: Leveraging Human-Written Text Perturbations for Realistic Adversarial Attack and Defense (2022.findings-acl)
Copied to clipboard
| Challenge: | ANTHRO extracts over 600K human-written text perturbations and leverages them for realistic adversarial attacks. |
| Approach: | They propose an adversarial text manipulation algorithm that inductively extracts over 600K human-written text perturbations and leverages them for realistic adversarials. |
| Outcome: | The proposed algorithm outperforms the TextBugger baseline with an increase of 50% and 40% in terms of semantic preservation and stealthiness when evaluated by layperson and professional human workers. |
TombRaider: Entering the Vault of History to Jailbreak Large Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing jailbreak techniques focus on prompt manipulation or intent obfuscation to bypass safety filters. |
| Approach: | They propose a jailbreak technique that exploits the ability to store, retrieve, and use historical knowledge of Large Language Models (LLMs) they use an inspector agent to extract historical information and an attacker agent to generate adversarial prompts, enabling effective bypassing of safety filters. |
| Outcome: | The proposed jailbreak technique outperforms state-of-the-art jailbreak techniques on six popular models and maintains over 55.4% ASR against defence mechanisms. |
QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Language (2025.findings-acl)
Copied to clipboard
Qingsong Zou, Jingyu Xiao, Qing Li, Zhi Yan, Yuhang Wang, Li Xu, Wenxuan Wang, Kuofeng Gao, Ruoyu Li, Yong Jiang
| Challenge: | Existing methods to bypass security defenses of large language models (LLMs) are not effective, but QueryAttack can be jailbroken. |
| Approach: | They propose a framework to examine generalizability of safety alignment by translating malicious queries into structured non-natural query languages. |
| Outcome: | The proposed framework can achieve high attack success rates and jailbreak various defense methods on mainstream LLMs. |
VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in Large Reasoning Models (LRMs) have enabled sophisticated visual reasoning capabilities by integrating reinforcement learning and Chain-of-Thought (CoT) supervision. |
| Approach: | They propose a jailbreak framework that exploits visual reasoning chains to bypass safety mechanisms. |
| Outcome: | The proposed framework achieves high attack success rates on leading closed-source MLRMs. |
SQL Injection Jailbreak: A Structural Disaster of Large Language Models (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to jailbreak Large Language Models (LLMs) exploited internal properties or capabilities of the model, such as optimization-based jailbreak methods and methods that leveraged the model’s context-learning abilities. |
| Approach: | They propose a new method which injects jailbreak information into user prompts and induces the model to generate harmful content. |
| Outcome: | The proposed method achieves near 100% success rates on open-source models while incurring lower time costs compared to previous methods. |
Conflicts Make Large Reasoning Models Vulnerable to Attacks (2026.findings-acl)
Copied to clipboard
| Challenge: | Large Reasoning Models have demonstrated outstanding capabilities in solving complex reasoning tasks by incorporating step-by-step chain-of-thought (CoT) reasoning. |
| Approach: | They evaluate three large reasoning models that perform explicit and coherent reasoning under conflicting objectives and use them to evaluate their performance. |
| Outcome: | The proposed models perform explicit and coherent reasoning before producing their outputs, improving problem-solving and multi-step decision making. |
CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Models (2024.emnlp-main)
Copied to clipboard
Yuetai Li, Zhangchen Xu, Fengqing Jiang, Luyao Niu, Dinuka Sahabandu, Bhaskar Ramasubramanian, Radha Poovendran
| Challenge: | Generative large language models (LLMs) have remarkable performance in generation tasks, but datasets used to train or fine-tune these models are often not disclosed to users. |
| Approach: | They develop an inference time defense called CleanGen to mitigate backdoor attacks for generation tasks in large language models. |
| Outcome: | The proposed inference time defense achieves lower attack success rates (ASR) compared to baseline defenses for all five backdoor attacks. |
ONION: A Simple and Effective Defense Against Textual Backdoor Attacks (2021.emnlp-main)
Copied to clipboard
| Challenge: | Backdoor attacks can manipulate the output of deep neural networks and possess high insidiousness. |
| Approach: | They propose a textual backdoor defense based on outlier word detection that can handle all the textual attacks. |
| Outcome: | The proposed method can handle all the textual backdoor attack situations. |
What You Read Isn’t What You Hear: Linguistic Sensitivity in Deepfake Speech Detection (2025.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in text-to-speech technology have enabled highly realistic voice generation, fueling deepfake attacks. |
| Approach: | They propose a framework for transcript-to-audio perturbation anti-spoofing that incorporates linguistic variation into detectors to investigate spoof detection. |
| Outcome: | The proposed framework can bypass commercial detectors by incorporating linguistic variation into the design of anti-spoofing systems. |
Your RAG is Unfair: Exposing Fairness Vulnerabilities in Retrieval-Augmented Generation via Backdoor Attacks (2025.emnlp-main)
Copied to clipboard
Gaurav Bagwe, Saket Sanjeev Chaturvedi, Xiaolong Ma, Xiaoyong Yuan, Kuang-Ching Wang, Lan Emily Zhang
| Challenge: | Retrieval-augmented generation (RAG) enhances factual grounding but introduces new attack surfaces, particularly through backdoor attacks. |
| Approach: | They propose a framework that exposes fairness vulnerabilities in RAG through a two-phase backdoor attack. |
| Outcome: | Empirical results show that BiasRAG achieves high attack success rates while remaining undetectable under standard fairness evaluations. |
JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs (2025.acl-long)
Copied to clipboard
| Challenge: | Large language models (LLMs) have been used to mitigate misuse and to align with human values. |
| Approach: | They propose to use large-scale evaluations of various jailbreak attacks to identify key patterns and test them under eight advanced defenses. |
| Outcome: | The proposed attacks achieve high success rates but are easy to mitigate by defenses. |
Adversarial Text Generation by Search and Learning (2023.findings-emnlp)
Copied to clipboard
Guoyi Li, Bingkang Shi, Zongzhen Liu, Dehan Kong, Yulei Wu, Xiaodan Zhang, Longtao Huang, Honglei Lyu
| Challenge: | Existing text generation methods only use heuristic replacement strategies or language models to generate replacement words at the word level. |
| Approach: | They propose a search and learning framework for Adversarial Text Generation by Search and Learning to evaluate the robustness of natural language processing models. |
| Outcome: | The proposed methods are significantly superior to the most advanced methods in terms of attack efficiency and adversarial text quality. |
Exploring Jailbreak Attacks on LLMs through Intent Concealment and Diversion (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing jailbreak methods face an excessive number of iterative queries and poor generalization across models. |
| Approach: | They propose a jailbreak method that employs **I**ntent **C**oncealment and div**E**rsion to circumvent security constraints. |
| Outcome: | The proposed method outperforms existing jailbreak techniques in question-answering and text-generation tasks. |
When Personalization Legitimizes Risks: Uncovering Safety Vulnerabilities in Personalized Dialogue Agents (2026.acl-long)
Copied to clipboard
Jiahe Guo, Xiangran Guo, Yulin Hu, Zimo Long, Xingyu Sui, Xuda Zhi, Yongbo Huang, Hao He, Weixiang Zhao, Yanyan Zhao, Bing Qin
| Challenge: | Existing research on personalized LLM agents focuses on the effectiveness of personalized responses. |
| Approach: | They propose a benchmark to quantify intent legitimation in personalized interactions . they propose 'detection-reflection' method that detects intent legititimation from internal representation space . |
| Outcome: | The proposed method reduces safety degradation by using internal representation space. |
Don’t Say No: Jailbreaking LLM by Suppressing Refusal (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are vulnerable to "jailbreaking" attacks where crafted prompts manipulate them into producing toxic content. |
| Approach: | They propose to improve the target loss objective by combining a cosine decay schedule method with refusal suppression to achieve higher success rates. |
| Outcome: | The proposed approach outperforms baseline attacks and achieves state-of-the-art attack success rates. |
When Backdoors Go Beyond Triggers: Semantic Drift in Diffusion Models Under Encoder Attacks (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing studies on text-to-image models only measure trigger activation and visual fidelity, but backdoors can induce semantic corruption. |
| Approach: | They propose a framework that measures internal embedding drift and downstream functional misalignment. |
| Outcome: | The proposed model is vulnerable to backdoor attacks, the authors show . they show that the model is optimized to generate the desired style for benign prompts . |
Towards Identification and Intervention of Safety-Critical Parameters in Large Language Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing safety-related methodologies for large language models are lacking . despite advances in safety alignment techniques, safeguarding LLMs during adaptation to various tasks remains a challenge. |
| Approach: | They propose a framework to quantify how different parameters affect LLM safety . they propose two targeted intervention paradigms for safety enhancement and preservation . |
| Outcome: | The proposed framework reveals safety-critical patterns across different LLM architectures. |
Chimera: Compositional Jailbreak Attacks on LLMs via Judgment-Driven Search over Heterogeneous Strategies (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing methods for evaluating large language models face two limitations: they explore homogeneous transformations in isolation and rely on brittle judgment metrics that misclassify non-refusal hallucinations as successful attacks. |
| Approach: | They propose a framework that generates compositional jailbreak attacks via judgment-driven search over heterogeneous strategies. |
| Outcome: | The proposed framework generates compositional jailbreak attacks over heterogeneous strategies . strongREJECT++ improves attack success rates and transferability compared to state-of-the-art . |
SHARP: Self-adaptive Harmful Category-aware Prompt Generation for Black-box Jailbreaking (2026.acl-long)
Copied to clipboard
| Challenge: | Existing methods for jailbreak ignore the semantic differences between categories of harmful questions, leading to inconsistent success rates and reduced overall attack effectiveness. |
| Approach: | They propose a category-aware jailbreak framework that incorporates the semantic category of harmful questions into prompt generation. |
| Outcome: | The proposed framework improves attack success rates and category alignment and achieves better cross-category robustness compared to the state-of-the-art (SOTA) baselines. |
Red-Bandit: Test-Time Adaptation for LLM Red-Teaming via Bandit-Guided LoRA Experts (2026.acl-long)
Copied to clipboard
| Challenge: | Existing approaches to audit Large Language Models (LLMs) lack mechanisms to efficiently adapt to model-specific vulnerabilities at inference. |
| Approach: | They propose a red-teaming framework that adapts online to identify and exploit model failure modes under distinct attack styles. |
| Outcome: | The proposed framework outperforms state-of-the-art methods on AdvBench and HarmBench, while generating more human-readable adversarial prompts (lower perplexity). |