How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs
Open accessAbstract
Most traditional AI safety research views models as machines and centers on algorithmfocused attacks developed by security experts.As large language models (LLMs) become increasingly common and competent, non-expert users can also impose risks during daily interactions.Observing this, we shift the perspective, by treating LLMs as human-like communicators to examine the interplay between everyday language interaction and AI safety.Specifically, we study how to persuade LLMs to jailbreak them.First, we propose a persuasion taxonomy derived from decades of social science research.Then, we apply the taxonomy to automatically generate persuasive adversarial prompts (PAP) to jailbreak LLMs.Results show that persuasion significantly increases the jailbreak risk across all risk categories: PAP consistently achieves an attack success rate of over 92% on Llama-2-7b-Chat, GPT-3.5, and GPT-4 in 10 trials, surpassing recent algorithm-focused attacks.On the defense side, we explore various mechanisms against PAP, find a significant gap in existing defenses, and advocate for more fundamental solutions for AI safety 1 .
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Previous research into the potential of LLMs to manipulate and generate false information has largely focused on single-turn or multi-turn conversational techniques aimed at exploiting a model's inherent helpful nature to bend its "beliefs" or outputs to align with dangerous or unethical goals.
“Previous research into the potential of LLMs to manipulate and generate false information has largely focused on single-turn or multi-turn conversational techniques aimed at exploiting a model’s inherent helpful nature to bend its “beliefs” or outputs to align with dangerous or unethical goals38,39.”
From When helpfulness backfires: LLMs and the risk of false medical information due to sycophantic behavior (2025) · cites this paper as [38]
Persuasive arguments and contrived scenarios are effective at causing jailbreaks.
“intuitive jailbreaking strategies easily performed by a human such as persuasive arguments (Zeng et al., 2024) or contrived scenarios (Li et al., 2023b) have been found to be effective at causing jailbreaks.”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Zeng et al., 2024
There is a persistent whack-a-mole dynamic between attackers and defenders due to evolving sophistication of jailbreak prompts.
“the evolving sophistication of jailbreak prompts, ranging from encoded payloads to psychological coercion techniques (Zeng et al., 2024), suggests a persistent whack-a-mole dynamic between attackers and defenders.”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Zeng et al., 2024
Cites
The publisher hasn’t deposited this paper’s reference list.
Cited by
Sorted by citations
Shen, X., Chen, Z., Backes, M., Shen, Y., & Zhang, Y. (2024) · Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3658644.3670388 · Cited by 441 · see citing works
Jailbreaking Black Box Large Language Models in Twenty Queries
Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G. J., & Wong, E. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00010 · Cited by 522 · see citing works
Chen, S., Gao, M., Sasse, K., Hartvigsen, T., Anthony, B., Fan, L., Aerts, H., Gallifant, J., & Bitterman, D. S. (2025) · npj Digital Medicine · doi:10.1038/s41746-025-02008-z · Cited by 112 · see citing works
Jailbreak and Guard Aligned Language Models With Only Few In-Context Demonstrations
Wei, Z., Wang, Y., Li, A., Mo, Y., & Wang, Y. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3660147 · Cited by 51 · see citing works
Right to be forgotten in the Era of large language models: implications, challenges, and solutions
Zhang, D., Finckenberg-Broman, P., Hoang, T., Pan, S., Xing, Z., Staples, M., & Xu, X. (2024) · AI and Ethics · doi:10.1007/s43681-024-00573-9 · Cited by 47 · see citing works
Red teaming large language models: A comprehensive review and critical analysis
Jabbar, M. S., Al-Azani, S., Alotaibi, A., & Ahmed, M. (2025) · Information Processing & Management · doi:10.1016/j.ipm.2025.104239 · Cited by 25 · see citing works
A survey on large language models with multilingualism: recent advances and new frontiers
Huang, K., Mo, F., Zhang, X., Li, H., Li, Y., Zhang, Y., yi, W., Mao, Y., Liu, J., Xu, Y., et al. (2026) · Artificial Intelligence Review · doi:10.1007/s10462-026-11534-5 · Cited by 73 · see citing works
Fan, X., Xiao, Q., Zhou, X., Pei, J., Sap, M., Lu, Z., & Shen, H. (2025) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3706598.3713477 · Cited by 23 · see citing works
SafeBench: A Safety Evaluation Framework for Multimodal Large Language Models
Ying, Z., Liu, A., Liang, S., Huang, L., Guo, J., Zhou, W., Liu, X., & Tao, D. (2025) · International Journal of Computer Vision · doi:10.1007/s11263-025-02613-1 · Cited by 37 · see citing works
Boosting Jailbreak Attack with Momentum
Zhang, Y., & Wei, Z. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10888812 · Cited by 14 · see citing works
Mathew, E. S. (2025) · Journal on artificial intelligence · doi:10.32604/jai.2025.069841 · Cited by 15 · see citing works
Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks
Xing, W., Li, M., Li, M., & Han, M. (2026) · ACM Computing Surveys · doi:10.1145/3806048 · Cited by 31 · see citing works
Biswas, S., Erlei, A., & Gadiraju, U. (2025) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3706598.3713201 · Cited by 12 · see citing works
Exploring Research and Tools in AI Security: A Systematic Mapping Study
Narula, S., GhasemiGol, M., Carnerero-Cano, J., Minnich, A., Lupu, E., & Takabi, D. (2025) · IEEE Access · doi:10.1109/access.2025.3567195 · Cited by 15 · see citing works
Summon a demon and bind it: A grounded theory of LLM red teaming
Inie, N., Stray, J., & Derczynski, L. (2025) · PLoS ONE · doi:10.1371/journal.pone.0314658 · Cited by 9 · see citing works
Generative AI in Heritage Practice: Improving the Accessibility of Heritage Guidance
Witte, J., Lee, E., Brausem, L., Shillabeer, V., & Bonacchi, C. (2025) · Heritage · doi:10.3390/heritage8120513 · Cited by 10 · see citing works
Large reasoning models are autonomous jailbreak agents
Hagendorff, T., Derner, E., & Oliver, N. (2026) · Nature Communications · doi:10.1038/s41467-026-69010-1 · Cited by 8 · see citing works
JailBench: A Comprehensive Chinese Security Assessment Benchmark for Large Language Models
Liu, S., Cui, S., Bu, H., Shang, Y.-M., & Zhang, X. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-8186-0_13 · Cited by 7 · see citing works
Improving LLM Outputs Against Jailbreak Attacks With Expert Model Integration
Tsmindashvili, T., Kolkhidashvili, A., Kurtskhalia, D., Maghlakelidze, N., Mekvabishvili, E., Dentoshvili, G., Shamilov, O., Gachechiladze, Z., Saporta, S., & Choladze, D. D. (2025) · IEEE Access · doi:10.1109/access.2025.3592458 · Cited by 7 · see citing works
Must Read: A Comprehensive Survey of Computational Persuasion
Bozdag, N. B., Mehri, S., Yang, X., Ha, H., Cheng, Z., Durmus, E., You, J., Ji, H., Tür, G., & Hakkani-Tur, D. Z. (2026) · ACM Computing Surveys · doi:10.1145/3800687 · Cited by 14 · see citing works
DARE to Diversify: DAta Driven and Diverse LLM REd Teaming
Nagireddy, M., Pegueroles, B. G., & Baldini, I. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671444 · Cited by 5 · see citing works
Yue, S. (2024) · Innovations in Systems and Software Engineering · doi:10.1007/s11334-024-00591-0 · Cited by 7 · see citing works
Prompt-Based Jailbreaking of Leading LLM Chatbots: A Survey of Attacks and Defenses
Knowlton, B., Campa, J., Gallo, D. S., Dajani, K. F., & Alzahrani, N. (2026) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2026.3665656 · Cited by 4 · see citing works
The state as a model for AI control and alignment
Elsner, M. (2024) · AI & Society · doi:10.1007/s00146-024-02063-2 · Cited by 4 · see citing works
AI Act for the Working Programmer
Hermanns, H., Lauber-Rönsberg, A., Meinel, P., Sterz, S., & Zhang, H. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-75434-0_6 · Cited by 5 · see citing works
Exploring Cognitive Vulnerabilities: Self-Persuasion in Jailbreaking LLMs
Wang, Z., Xie, W., Ma, S., Wang, E., & Wang, B. (2025) · Electronics · doi:10.3390/electronics14163259 · Cited by 3 · see citing works
RedAgent: An Autonomous Agent for Context-Aware Red Teaming of LLM Jailbreaks
Xu, H., Zhang, W., Wang, Z., Xiao, F., Zheng, R., Ba, Z., & Ren, K. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3665230 · Cited by 3 · see citing works
Zhao, Y., & Zhang, Y. (2025) · Annual Computer Security Applications Conference · doi:10.1109/acsac67867.2025.00095 · Cited by 3 · see citing works
Liu, Y., Cong, T., Zhao, Z., Michael Backes, A., Shen, Y., & Zhang, Y. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3672386 · Cited by 3 · see citing works
Bozdag, N. B., Mehri, S., Tür, G., & Hakkani-Tur, D. Z. (2026) · ACM Conference on AI and Agentic Systems (CAIS) · doi:10.1145/3786335.3813181 · Cited by 9 · see citing works
Safety and security of large language models in healthcare
Clusmann, J., Freyer, O., Ostermann, M., Ferber, D., Laleh, N. G., Hilgers, L., Kolbinger, F. R., Schneider, C. V., Downing, A., Wekenborg, M., et al. (2026) · Nature · doi:10.1038/s41586-026-10687-1 · Cited by 4 · see citing works
StructTransform: A Scalable Attack Surface for Safety-Aligned Large Language Models
Yoosuf, S., Ali, T., Lekssays, A., AlSabah, M., & Khalil, I. M. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-07884-1_25 · Cited by 3 · see citing works
Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
de Witt, C. S., Krawiecka, K., Krawczuk, I., Hagag, B., Anderson, W. L., Belcak, P., Bucknall, B., Cai, X., Chopra, A., Cohen, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2505.02077 · Cited by 2 · see citing works
Ahmed, S. S., & Jothi, J. A. A. (2024) · IEEE International Symposium on Technology and Society (ISTAS) · doi:10.1109/istas61960.2024.10732418 · Cited by 3 · see citing works
Innovations in Digital Health From a Global Perspective: Proceedings of PRC‐HI 2024
Feng, X., Sun, Y., Wu, Y., Wang, H., & Wu, Y. (2025) · Health care science · doi:10.1002/hcs2.128 · Cited by 2 · see citing works
Chain-of-Detection enables robust and efficient jailbreak defense
Wu, T., & Zhang, H. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.108217 · Cited by 2 · see citing works
Modeling the Attack: Detecting AI-Generated Text by Quantifying Adversarial Perturbations
Teja, L. S., Yadagiri, A., Anish, S. S., Nuthakki, S., & Pakray, P. (2025) · International Conference on Ubiquitous Information Management and Communication · doi:10.1109/imcom69009.2026.11360855 · Cited by 8 · see citing works
Revealing the intrinsic ethical vulnerability of aligned large language models
Lian, J., Jianhong, P., Wang, L., Wang, Y., Wang, X., Lu, Y., Mei, S., & Chau, L. (2026) · Nature Communications · doi:10.1038/s41467-026-70917-y · Cited by 4 · see citing works
AI-Facilitated Coercive Control: An Experimental Study
Kim, H., Ristenpart, T., & Dell, N. L. (2026) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3772318.3790859 · Cited by 2 · see citing works
Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Models
Ma, T., Jia, X., Duan, R., Li, X. Q., Huang, Y., Jia, X., Chu, Z., & Ren, W. (2025) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51701.2025.00258 · Cited by 2 · see citing works
Harmful Prompt Classification for Large Language Models
Gupta, O., Lozano, M., Busalim, A. H., Jaiswal, R. R., & Quille, K. (2024) · Conference on Human Centred Artificial Intelligence - Education and Practice (HCAIep) · doi:10.1145/3701268.3701271 · Cited by 4 · see citing works
AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMs
Lv, L., Zhang, W., Tang, X., Wen, J., Liu, F., Han, J., & Hu, S. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10890715 · Cited by 2 · see citing works
DS-GCG: Enhancing LLM Jailbreaks with Token Suppression and Induction Dual-Strategy
Tang, X., Yang, X., Yao, Z., Wen, J., Zhou, X., Han, J., & Hu, S. (2025) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd64889.2025.11033375 · Cited by 2 · see citing works
Detecting Jailbreaking Prompts: an Anti-Persuasion Filter Framework
Fenza, G., Gallo, M., Loia, V., Nicolosi, A., & Stanzione, C. (2025) · Lecture notes in social networks · doi:10.1007/978-3-031-85240-4_14 · Cited by 2 · see citing works
Mehrotra, S., Raghavendra, P., Prajesh, B., Kambale, H., & Majumdar, P. (2025) · ACM International Conference on AI in Finance (ICAIF) · doi:10.1145/3768292.3770355 · Cited by 2 · see citing works
Adversarial Attacks on IoT Systems Leveraging Large Language Models
Shan, W., Long, T., & Zhou, Z. (2024) · International Conference on Identification, Information and Knowledge in the Internet of Things (IIKI) · doi:10.1109/iiki65561.2024.00035 · Cited by 1 · see citing works
Fast and Controllable Bias-Guided Jailbreak Attack on Large Language Models
Kang, Z. H., Xia, H., Zhang, R., Song, X., Li, L., & Hu, C. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3599199 · Cited by 1 · see citing works
Müller, L., & Sütterlin, S. (2025) · Mensch und Computer (MuC) · doi:10.1145/3743049.3748562 · Cited by 1 · see citing works
Countering Jailbreak Attacks with Two-Axis Pre-detection and Conditional Warning Wrappers
Na, H., Kim, H., Yoon, D., & Choi, D. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-07884-1_13 · Cited by 1 · see citing works
Uncovering the Persuasive Fingerprint of LLMs in Jailbreaking Attacks
Noughabi, H. A., Serbanescu, J., Zarrinkalam, F., & Dehghantanha, A. (2025) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3746252.3760929 · Cited by 1 · see citing works
Smoke and Mirrors: Jailbreaking LLM-based Code Generation via Implicit Malicious Prompts
Ouyang, S., Qin, Y., Lin, B., Chen, L., Mao, X., & Wang, S. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3764566 · Cited by 4 · see citing works
Iterative Prompting with Persuasion Skills in Jailbreaking Large Language Models
Ke, S.-W., Lai, G.-Y., Fang, G.-L., & Kao, H.-Y. (2026) · Lecture notes in electrical engineering · doi:10.1007/978-981-95-0887-7_33 · Cited by 1 · see citing works
Zhang, Z., Zhang, Y., Zeng, D., Liu, K., & Zhao, J. (2026) · IEEE Transactions on Audio Speech and Language Processing · doi:10.1109/taslpro.2026.3675803 · Cited by 1 · see citing works
Breaking Barriers: Multi-Agent Prompt Fusion for Automated LLM Jailbreaks
Hu, J., Zhang, J., & Li, Z. (2026) · Cognitive Computation · doi:10.1007/s12559-026-10552-3 · Cited by 1 · see citing works
Self-citationEvoJail: Evolutionary diverse jailbreak prompt generation for large language models
Tang, R., Xu, K., Cheng, P., Ren, H., Wang, H., & Jiang, S. (2026) · Information Processing & Management · doi:10.1016/j.ipm.2026.104831 · Cited by 1 · see citing works
Did the Prompt Break the Model?: Perplexity-Based Detection of Adversarial Attacks on LLMs
Khan, R. A., Momo, T. T., Kabir, F., & Shah, F. M. (2025) · International Conference on Computer and Information Technology (ICCIT) · doi:10.1109/iccit68739.2025.11491788 · Cited by 1 · see citing works
The Anthropomimetic Turn in Contemporary AI
Shevlin, H. (2026) · Springer eBooks · doi:10.1007/978-3-032-11814-1_26 · Cited by 1 · see citing works
Chen, M., Wang, K., Li, L., Zhang, J., & Zhang, T. (2026) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp63933.2026.00214 · Cited by 1 · see citing works
Self-citationJailbreaking LLMs Through Alignment Vulnerabilities in Out-of-Distribution Settings
Huang, Y., Tang, J., Chen, D., Tang, B., Wan, Y., Sun, L., Yu, P. S., & Zhang, X. (2025) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3746252.3760899 · Cited by 9 · see citing works
The Mirage of Artificial Intelligence Terms of Use RestrictionsPreprint
Lemley, M. A., & Henderson, P. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5049562 · Cited by 1 · see citing works
Rules Created by Symbolic Systems Cannot Constrain a Learning System v3, 2025-05-16Preprint
LIN, S.-W., Xu, R., Li, X., & Xu, W. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5256795 · Cited by 1 · see citing works
Generative AI in child sexual exploitation and abuse: views from UK law enforcement
Demeocq, C., Taylor, A., Ross, B., & McFeeters, A. (2026) · AI & SOCIETY · doi:10.1007/s00146-026-03176-6 · Cited by 1 · see citing works
Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats
Thota, P., Lei, Y., Thangaraj, S., Jonnalagadda, S. R., & Nilizadeh, S. (2026) · arXiv · doi:10.48550/arxiv.2606.26377
Developing Assurance Cases for Adversarial Robustness and Regulatory Compliance in LLMs
Momčilović, T. B., Balta, D., Buesser, B., Zizzo, G., & Purcell, M. (2024) · IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) · doi:10.1109/issrew63542.2024.00081
A Low-cost Black-box Jailbreak Based on Custom Mapping Dictionary with Multi-round Induction
Wu, F. H., Wang, W., Qu, Y., & Yu, S. (2024) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom63139.2024.00131
Introspective Reward Modeling via Inverse Reinforcement Learning for LLM Alignment
Wang, Z., Cheng, R., Yuan, S., Ding, Y., & Zhang, R. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-0014-7_20
LIN, S.-W., Xu, R., & Li, X. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5387584
Reward-Guided Many-Shot Jailbreaking
Chen, Y., Zou, X., Wang, T., Tian, J., Li, H., & Kuang, X. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3343-5_32
Muir, K., Dewdney, N., Walker, F., & Joinson, A. (2025) · Social Influence · doi:10.1080/15534510.2025.2590842
RIVAL: From Information Accumulation to LLM Jailbreaking via Reflective Action LoopsPreprint
Peng, Y., Li, X., Yan, Y., Liu, M., Li, M., & Chen, D. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5901185
A Study on Cross-Lingual Security Vulnerabilities in Large Language Models
Ozcelik, M. B., Şentaş, A., Koçyiğit, B., Özen, S., & Akmeşe, A. (2025) · National Conference on Electrical and Electronics Engineering (ELECO) · doi:10.1109/eleco69582.2025.11329228
From Vibe Coding to Jailbreaking in Large Language Models: A Comparative Security Study
Castillo, E. S., Trujillo, A. G. S., Ibarra, M. S., Dominguez, D. J., & Cuevas-Tello, J. C. (2026) · Summer School on Artificial Intelligence in Cybersecurity · doi:10.3390/engproc2026123008
Statistical Invariance vs. AI Safety: Why Prompt Filtering Fails Against Contextual Attacks
Ioste, A. R., Peres, S. M., & Finger, M. (2026) · Journal of the Brazilian Computer Society · doi:10.5753/jbcs.2026.5961
A Systematic Survey of Jailbreak Attacks Against Large Language Models
Gu, Y., Chang, Q., You, J., Li, L., Chen, X. S., & Chen, Y. (2025) · International Conference on Computer, Big Data and Artificial Intelligence (ICCBD+AI) · doi:10.1109/iccbdai66607.2025.11387914
Defamiliarization Attack: Literary Theory Enabled Discussion of LLM Safety
Babu, B., Agafonova, I., Biedermann, S., & Yamshchikov, I. P. (2026) · Electronics · doi:10.3390/electronics15051047
Critical Safety Attention Heads: Architecture-Dependent Vulnerabilities in LLMsPreprint
Sha, L., Sun, P., Xue, H., Hao, S., & Xiao, F. (2026) · Research Square · doi:10.21203/rs.3.rs-8886237/v1
GRA: Graph-Based Role-Playing Attack for Single-Turn Jailbreak
Liu, A., Wu, Z., Wen, J., Peng, W., & Dou, C. (2026) · IEEE Signal Processing Letters · doi:10.1109/lsp.2026.3677330
Ba, Z., Zhao, J., Chen, K., Zhang, W., & Yu, N. (2025) · International Conference on Cyber Resilience and Endogenous Safety & Security (CRESS) · doi:10.1109/cress68073.2025.11452634
Zhang, B., Wang, H., Hu, T., Zhou, R., Tan, M., Han, W., & Ma, H. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-21168-2_4
Li, Y., Wang, G., & Wang, H. (2026) · Scientific Reports · doi:10.1038/s41598-026-47434-5
DarkCite: Unveiling Authority Bias as Implicit Rag Jailbreak Attacks
Yang, X., Tang, X., Han, J., & Hu, S. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11463457
Cheng, Y., Kang, Z., Jiang, K., Sun, C., Pan, Q., & Jiang, T. (2026) · doi:10.2196/preprints.96433
A Behavioral Benchmark Dataset for Evaluating Access Control Compliance in Large Language Models
Xin, Y., Yang, C. R., & Zhang, Z. Q. (2026) · International Conference on Generative Artificial Intelligence and Information Security (GAIIS) · doi:10.1109/gaiis69281.2026.11519174
Bridging the Scale Gap: Augmenting Human Red-Teaming to Uncover Latent Risks in T2I Models
Quaye, J. A., Parrish, A., Rastogi, C., Kahng, M., Inel, O., Aroyo, L. M., & Reddi, V. J. (2026) · ACM Conference on Fairness, Accountability, and Transparency (FAccT) · doi:10.1145/3805689.3812210
Casting a SPELL: Sentence Pairing Exploration for LLM Limitation-Breaking
Huang, Y., Jia, X., Guo, W., Sun, Y., Huang, Y., Wang, C., & Liu, Y. (2026) · Proceedings of the ACM on software engineering. · doi:10.1145/3797063
DUA: Automated Jailbreak via Dual-Use Ambiguity and Semantic-Operational Disentanglement
Ma, S., Liu, W. T., Xie, W., Wen, L., Wang, P., Chen, R., & Chen, S. (2026) · ICEENG International Conference for Innovations in Intelligent Computing and Cybersecurity (IICC) · doi:10.1109/iicc69623.2026.11582014
Wang, Y., Yang, Y., Yao, N., Zhu, J., & Chen, H. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581730
Evolva: A Multi-turn Contextual Attack for Long-Reasoning LLMs
Du, W., Yang, X., Liu, Z., Zhang, B., & Xue, J. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-2852-2_46
Huang, Y., Sun, Y., Chen, H., Zhang, R., Ruan, S., Duan, R., Yuan, M., Dong, Y., Xue, H., Cao, X., et al. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3713771
Dong, X., Wang, S., Lin, D., & Hassan, A. E. (2026) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3803437.3806718
A Comparative Survey of Security Risks in AI Systems: From LLMs to AI Agents and Embodied Agents
Wu, B., Li, Q., Zhou, C., Wang, T., & Ji, S. (2026) · ACM Computing Surveys · doi:10.1145/3837083
Wang, S., He, R., Li, H., Yang, J., & Yin, R. (2026) · International Conference on Electronic Information Technology and Computer Engineering (EITCE) · doi:10.1109/eitce70137.2026.11634335
REMEDy: a dataset for rationale extraction and span-based moderation of dialogue prompts
Piano, L., Battistin, C., den Abeele, J. V., & Pompianu, L. (2026) · Neural Computing and Applications · doi:10.1007/s00521-026-12381-9
Ding, F., Liao, Z., & Li, Q. (2026) · International Conference on Computer Communication and Artificial Intelligence (CCAI) · doi:10.1109/ccai69603.2026.11642016
Fine-tuning as Jailbreaking: A data-centric red teaming framework via logic injection
Li, Q., Xu, K., Qu, Y., & Wu, J. (2026) · Automated Software Engineering · doi:10.1007/s10515-026-00659-0
A C-SSRS-Based Risk-Aware Evaluation Framework for Self-Harm Safety in LLMs
Zhang, L., Zhao, F., & Yang, X. (2026) · IEEE International Conference on Artificial Intelligence Testing (AITest) · doi:10.1109/aitest70988.2026.00035
Miao, K., Li, J., Chen, H., Hu, Y., & Qin, Z. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-37673-2_11
Shi, J., Chen, H., & Han, L. (2026) · Electronics · doi:10.3390/electronics15174015
JailFlowEval: a workflow-safety benchmark for LLM-driven enterprise service workflows
Liu, Z., Yu, H., Pan, W., Li, X., Zhang, W., & Wang, B. (2026) · Service Oriented Computing and Applications · doi:10.1007/s11761-026-00511-z
Park, J., Lim, Y., Kim, G., Yun, T., & Min, M. (2026) · ETRI Journal · doi:10.4218/etrij.2026-0186
- Authors
- Zeng, Y., Lin, H., Zhang, J., Yang, D., Jia, R., & Shi, W.
- Affiliations
- Virginia Tech (US)
- Renmin University of China (CN)
- Northeastern University (US)
- Stanford University (US)
- Venue
- Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)
- Published
- 2024
- Pages
- 14322-14350
- ISSN
- 0736-587X (ISSN-L)
- OpenAlex
- W4402671039
- Cited by
- 107
- References
- 0
- Citations by year
- 2026: 57 · 2025: 39 · 2024: 11
- FWCI
- 31.58
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- cc-by
- Locations
- Proceedings of the conference - Association for Computational Linguistics. Meeting (publishedVersion, cc-by)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation (2313130, 2308994, 2239622, 2312794)
- Defense Advanced Research Projects Agency
- Office of Naval Research
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- persuasion, adversarial prompts, AI safety, non-expert users, Llama 2, GPT-4
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
