The DOI matches its Crossref record; 17 of the 17 references it cites were found in a registry or an index.
MASTERKEY: Automated Jailbreaking of Large Language Model Chatbots
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Existing jailbreaking techniques can be broadly categorized into token-level [20], [54] and prompt-level [21], [22], [55] approaches, but both face significant limitations when directly applied to EDEAs:”
From External Data Extraction Attacks Against Retrieval-Augmented Large Language Models (2026) · cites this paper as [55]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
ChatGPT for Good? On Opportunities and Challenges of Large Language Models for Education
Kasneci, E., Seßler, K., Küchemann, S., Bannert, M., Dementieva, D., Fischer, F., Gasser, U., Groh, G., Günnemann, S., Hüllermeier, E., et al. (2023) · doi:10.35542/osf.io/5er8f · Cited by 7,552
ChatGPT for good? On opportunities and challenges of large language models for education
Kasneci, E., Sessler, K., Küchemann, S., Bannert, M., Dementieva, D., Fischer, F., Gasser, U., Groh, G., Günnemann, S., Hüllermeier, E., et al. (2023) · Learning and Individual Differences · doi:10.1016/j.lindif.2023.102274 · Cited by 7,326 · cited 1×
“These chatbots can generate human-like text that is unparalleled in its sophistication, ushering in novel applications across a multitude of sectors [23], [7], [48], [55].”
BackgroundLLaMA: Open and Efficient Foundation Language Models
Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., Azhar, F., et al. (2023) · arXiv · doi:10.48550/arxiv.2302.13971 · Cited by 4,602
SciBERT: A Pretrained Language Model for Scientific Text
Beltagy, I., Lo, K., & Cohan, A. (2019) · Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP) · doi:10.18653/v1/d19-1371 · Cited by 3,218
Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena
Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E. P., et al. (2023) · arXiv · doi:10.48550/arxiv.2306.05685 · Cited by 1,888
Self-citationWhy Johnny Can’t Prompt: How Non-AI Experts Try (and Fail) to Design LLM Prompts
Zamfirescu-Pereira, J. D., Wong, R. Y., Hartmann, B., & Yang, Q. (2023) · Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems · doi:10.1145/3544548.3581388 · Cited by 1,274 · cited 1×
“Prompt engineering [56], [58], [39] plays an instrumental role in the development of language models, providing a means to significantly augment a model’s ability to undertake tasks it has not been directly trained for.”
BackgroundPrompt Programming for Large Language Models: Beyond the Few-Shot Paradigm
Reynolds, L., & McDonell, K. (2021) · Extended Abstracts of the 2021 CHI Conference on Human Factors in Computing Systems · doi:10.1145/3411763.3451760 · Cited by 952 · cited 1×
“As underscored by recent studies [37], [52], [42], well-devised prompts can effectively optimize the performance of language models.”
BackgroundGreshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023) · Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security · doi:10.1145/3605764.3623985 · Cited by 667 · cited 2×
“However, despite these precautionary steps, there remains a non-negligible risk from targeted attacks where such unde-sireable output are elicited, such as jailbreaks [27], [25] and prompt injections [21], [38].”
BackgroundSelfCheckGPT: Zero-Resource Black-Box Hallucination Detection for Generative Large Language Models
Manakul, P., Liusie, A., & Gales, M. (2023) · Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing · doi:10.18653/v1/2023.emnlp-main.557 · Cited by 557
Role play with large language models
Shanahan, M., McDonell, K., & Reynolds, L. (2023) · Nature · doi:10.1038/s41586-023-06647-8 · Cited by 491 · cited 2×
“Recent studies [27], [25], [53], [44], [41], [45] have drawn attention to the rise of ”jailbreak prompts,” ingeniously crafted to circumvent the restrictions placed on language models and coax them into performing tasks beyond their intended scope.”
BackgroundRole-Play with Large Language Models
Shanahan, M., McDonell, K., & Reynolds, L. (2023) · arXiv · doi:10.48550/arxiv.2305.16367 · Cited by 490
Wordcraft: Story Writing With Large Language Models
Yuan, A., Coenen, A., Reif, E., & Ippolito, D. (2022) · 27th International Conference on Intelligent User Interfaces · doi:10.1145/3490099.3511105 · Cited by 374
Prompt Injection attack against LLM-integrated Applications
Liu, Y., Deng, G., Li, Y., Wang, K., Wang, Z., Wang, X., Zhang, T., Liu, Y., Wang, H., Zheng, Y., et al. (2023) · arXiv · doi:10.48550/arxiv.2306.05499 · Cited by 100
Self-citationContrastive Learning Reduces Hallucination in Conversations
Sun, W., Shi, Z., Gao, S., Ren, P., De Rijke, M., & Ren, Z. (2023) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v37i11.26596 · Cited by 69
SelfCheckGPT: Zero-Resource Black-Box Hallucination Detection for Generative Large Language Models
Manakul, P., Liusie, A., & Gales, M. J. F. (2023) · arXiv · doi:10.48550/arxiv.2303.08896 · Cited by 38
Wang, K., Zhang, J., Bai, G., Ko, R., & Dong, J. S. (2021) · Proceedings of the Web Conference 2021 · doi:10.1145/3442381.3450008 · Cited by 27
Self-citationTricking llms into disobedience: Formalizing, analyzing, and detecting jailbreaks
Rao, A., Vashistha, S., Naik, A., Aditya, S., & Choudhury, M. (2024) · Proceedings of the Language Resources and Evaluation Conference · doi:10.63317/2ivv5y3ufu9y · Cited by 19
Research works printed but not linked: 28
- V. Atlidakis, P. Godefroid, and M. Polishchuk, "RESTler: Stateful REST API Fuzzing," 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE), pp. 748-758, 2019. [Online]. Available: https://api.semanticscholar.org/CorpusID:85465006
- E. Bagdasaryan and V. Shmatikov, "Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures," in S&P. IEEE, 2022, pp. 769-786.
- F. L. Bauer, Cæsar Cipher. Boston, MA: Springer US, 2011, pp. 180- 180. [Online]. Available: https://doi.org/10.1007/978-1-4419-5906-5 162 · DOI
- E. M. Bender, T. Gebru, A. McMillan-Major, and S. Shmitchell, "On the Dangers of Stochastic Parrots: Can Language Models Be Too Big?" in FAccT, pp. 610-623.
- I. Cohen, Y. Huang, J. Chen, J. Benesty, J. Benesty, J. Chen, Y. Huang, and I. Cohen, "Pearson correlation coefficient," Noise reduction in speech processing, pp. 1-4, 2009.
- G. Deng, Z. Zhang, Y. Li, Y. Liu, T. Zhang, Y. Liu, G. Yu, and D. Wang, "NAUTILUS: Automated RESTful API Vulnerability Detection," in USENIX Security Symposium, 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:260777640
- S. Gehman, S. Gururangan, M. Sap, Y. Choi, and N. A. Smith, "Re- alToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models," in EMNLP, 2020, pp. 3356-3369.
- X. Hou, Y. Zhao, Y. Liu, Z. Yang, K. Wang, L. Li, X. Luo, D. Lo, J. Grundy, and H. Wang, "Large language models for software engi- neering: A systematic literature review," 2023.
- D. Lawley, "A Generalization of Fisher's Z Test," Biometrika, vol. 30, no. 1/2, pp. 180-187, 1938.
- Y. Liu, "RESTInfer: Automated Inferring Parameter Constraints from Natural Language RESTful API Descriptions," in Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ser. ESEC/FSE 2022. New York, NY, USA: Association for Computing Machinery, 2022, p. 1816-1818. [Online]. Available: https://doi.org/10.1145/3540250.3559078 · DOI
- Y. Liu, Y. Li, G. Deng, Y. Liu, R. Wan, R. Wu, D. Ji, S. Xu, and M. Bao, "Morest: Model-based RESTful API Testing with Execution Feedback," 2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE), pp. 1406-1417, 2022. [Online]. Available: https://api.semanticscholar.org/CorpusID:248392251
- Y. Liu, Y. Li, Y. Liu, R. Wan, R. Wu, and Q. Liu, "Morest: Industry practice of automatic restful api testing," in Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, ser. ASE '22. New York, NY, USA: Association for Computing Machinery, 2023. [Online]. Available: https://doi.org/10.1145/3551349.3559498 · DOI
- N. McKenna, T. Li, L. Cheng, M. J. Hosseini, M. Johnson, and M. Steedman, "Sources of Hallucination by Large Language Models on Inference Tasks," arXiv preprint, 2023.
- K. Mei, Z. Li, Z. Wang, Y. Zhang, and S. Ma, "NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Models," in ACL, 2023.
- J. Oppenlaender, R. Linder, and J. Silvennoinen, "Prompting AI Art: An Investigation into the Creative Skill of Prompt Engineering," arXiv preprint, 2023.
- F. Perez and I. Ribeiro, "Ignore Previous Prompt: Attack Techniques For Language Models," in NeurIPS ML Safety Workshop, 2022.
- R. Pryzant, D. Iter, J. Li, Y. T. Lee, C. Zhu, and M. Zeng, "Automatic Prompt Optimization with Gradient Descent and Beam Search," arXiv preprint, 2023.
- A. Rao, S. Vashistha, A. Naik, S. Aditya, and M. Choudhury, "Tricking LLMs into Disobedience: Understanding, Analyzing, and Preventing Jailbreaks," arXiv preprint, 2023.
- A. Salem, M. Backes, and Y. Zhang, "Get a Model! Model Hijacking Attack Against Machine Learning Models," in NDSS, 2022.
- W. M. Si, M. Backes, J. Blackburn, E. D. Cristofaro, G. Stringhini, S. Zannettou, and Y. Zhang, "Why So Toxic?: Measuring and Triggering Toxic Behavior in Open-Domain Chatbots," in CCS, 2022, pp. 2659- 2673.
- W. M. Si, M. Backes, Y. Zhang, and A. Salem, "Two-in-One: A Model Hijacking Attack Against Text Generation Models," arXiv preprint, 2023.
- T. Van Ede, H. Aghakhani, N. Spahn, R. Bortolameotti, M. Cova, A. Continella, M. van Steen, A. Peter, C. Kruegel, and G. Vigna, "Deepcase: Semi-supervised Contextual Analysis of Security Events," in IEEE S&P, 2022, pp. 522-539.
- E. Viglianisi, M. Dallago, and M. Ceccato, "RESTTESTGEN: Automated Black-Box Testing of RESTful APIs," 2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST), pp. 142-152, 2020. [Online]. Available: https: //api.semanticscholar.org/CorpusID:221107287
- J. White, Q. Fu, S. Hays, M. Sandborn, C. Olea, H. Gilbert, A. Elnashar, J. Spencer-Smith, and D. C. Schmidt, "A Prompt Pattern Catalog to Enhance Prompt Engineering with ChatGPT," arXiv preprint, 2023.
- Y. Wolf, N. Wies, Y. Levine, and A. Shashua, "Fundamental limitations of alignment in large language models," arXiv preprint, 2023.
- Y. Zhang, M. M. A. Kabir, Y. Xiao, D. Yao, and N. Meng, "Automatic detection of java cryptographic api misuses: Are we there yet?" IEEE Transactions on Software Engineering, vol. 49, no. 1, pp. 288-303, 2023.
- Z. Zhang, L. Lyu, X. Ma, C. Wang, and X. Sun, "Fine-mixing: Mitigating Backdoors in Fine-tuned Language Models," in EMNLP, 2022, pp. 355-372.
- Y. Zhou, A. I. Muresanu, Z. Han, K. Paster, S. Pitis, H. Chan, and J. Ba, "Large Language Models are Human-level Prompt Engineers," arXiv preprint, 2022.
Cited by
A survey on large language model (LLM) security and privacy: The Good, The Bad, and The Ugly
Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., & Zhang, Y. (2024) · High-Confidence Computing · doi:10.1016/j.hcc.2024.100211 · Cited by 1,083
Self-citationLarge Language Models for Software Engineering: A Systematic Literature Review
Hou, X., Zhao, Y., Liu, Y., Yang, Z., Wang, K., Li, L., Luo, X., Lo, D., Grundy, J., & Wang, H. (2024) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3695988 · Cited by 1,029
Self-citationWhen LLMs meet cybersecurity: a systematic literature review
Zhang, J., Bu, H., Wen, H., Liu, Y., Fei, H., Xi, R., Li, L., Yang, Y., Zhu, H., & Meng, D. (2025) · Cybersecurity · doi:10.1186/s42400-025-00361-w · Cited by 383
Self-citationAI agents under threat: A survey of key security challenges and future pathways
Deng, Z., Guo, Y., Han, C., Ma, W., Xiong, J., Wen, S., & Xiang, Y. (2025) · ACM Computing Surveys · doi:10.1145/3716628 · Cited by 210
Zeng, Y., Lin, H., Zhang, J., Yang, D., Jia, R., & Shi, W. (2024) · arXiv · doi:10.48550/arxiv.2401.06373 · Cited by 174
Metadata
- Authors
- Deng, G., Liu, Y., Li, Y., Wang, K., Zhang, Y., Li, Z., Wang, H., Zhang, T., & Liu, Y.
- Venue
- Proceedings 2024 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2024
- Cited by
- 137
- References
- 17
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
