Cited by 112Adversarial Robustness in Machine LearningEthics and Social Impacts of AISecurity and Verification in Computing

The DOI matches its Crossref record; 2 of the 2 references it cites were found in a registry or an index.

How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs

Open access

Zeng, Yi, Lin, Hongpeng, Zhang, Jingwen, Yang, Diyi, Jia, Ruoxi, Shi, Weiyan·2024·Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)

DOI 10.18653/v1/2024.acl-long.773

Open this paper in CoChat — free account Open PDF

Abstract

Most traditional AI safety research views models as machines and centers on algorithmfocused attacks developed by security experts.As large language models (LLMs) become increasingly common and competent, non-expert users can also impose risks during daily interactions.Observing this, we shift the perspective, by treating LLMs as human-like communicators to examine the interplay between everyday language interaction and AI safety.Specifically, we study how to persuade LLMs to jailbreak them.First, we propose a persuasion taxonomy derived from decades of social science research.Then, we apply the taxonomy to automatically generate persuasive adversarial prompts (PAP) to jailbreak LLMs.Results show that persuasion significantly increases the jailbreak risk across all risk categories: PAP consistently achieves an attack success rate of over 92% on Llama-2-7b-Chat, GPT-3.5, and GPT-4 in 10 trials, surpassing recent algorithm-focused attacks.On the defense side, we explore various mechanisms against PAP, find a significant gap in existing defenses, and advocate for more fundamental solutions for AI safety 1 .

Integrity signals

Registry

Crossref · 10.18653/v1/2024.acl-long.773

Cites

0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

The publisher hasn’t deposited this paper’s reference list.

Sorted by citations

On the Conversational Persuasiveness of Large Language Models: A Randomized Controlled Trial
Salvi, F., Ribeiro, M. H., Gallotti, R., & West, R. (2024) · doi:10.21203/rs.3.rs-4429707/v1 · Cited by 285
"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models
Shen, X., Chen, Z., Backes, M., Shen, Y., & Zhang, Y. (2024) · Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3658644.3670388 · Cited by 441
Jailbreaking Black Box Large Language Models in Twenty Queries
Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G. J., & Wong, E. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00010 · Cited by 1,298
When helpfulness backfires: LLMs and the risk of false medical information due to sycophantic behavior
Chen, S., Gao, M., Sasse, K., Hartvigsen, T., Anthony, B., Fan, L., Aerts, H., Gallifant, J., & Bitterman, D. S. (2025) · npj Digital Medicine · doi:10.1038/s41746-025-02008-z · Cited by 112
Jailbreak and Guard Aligned Language Models With Only Few In-Context Demonstrations
Wei, Z., Wang, Y., Li, A., Mo, Y., & Wang, Y. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3660147 · Cited by 51
Right to be forgotten in the Era of large language models: implications, challenges, and solutions
Zhang, D., Finckenberg-Broman, P., Hoang, T., Pan, S., Xing, Z., Staples, M., & Xu, X. (2024) · AI and Ethics · doi:10.1007/s43681-024-00573-9 · Cited by 138
Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessment
Raina, V., Liusie, A., & Gales, M. (2024) · arXiv · doi:10.48550/arxiv.2402.14016 · Cited by 40
Red teaming large language models: A comprehensive review and critical analysis
Jabbar, M. S., Al-Azani, S., Alotaibi, A., & Ahmed, M. (2025) · Information Processing & Management · doi:10.1016/j.ipm.2025.104239 · Cited by 31
A survey on large language models with multilingualism: recent advances and new frontiers
Huang, K., Mo, F., Zhang, X., Li, H., Li, Y., Zhang, Y., yi, W., Mao, Y., Liu, J., Xu, Y., et al. (2026) · Artificial Intelligence Review · doi:10.1007/s10462-026-11534-5 · Cited by 131
User-Driven Value Alignment: Understanding Users' Perceptions and Strategies for Addressing Biased and Discriminatory Statements in AI Companions
Fan, X., Xiao, Q., Zhou, X., Pei, J., Sap, M., Lu, Z., & Shen, H. (2025) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3706598.3713477 · Cited by 52
SafeBench: A Safety Evaluation Framework for Multimodal Large Language Models
Ying, Z., Liu, A., Liang, S., Huang, L., Guo, J., Zhou, W., Liu, X., & Tao, D. (2025) · International Journal of Computer Vision · doi:10.1007/s11263-025-02613-1 · Cited by 91
Boosting Jailbreak Attack with Momentum
Zhang, Y., & Wei, Z. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10888812 · Cited by 32
Enhancing Security in Large Language Models: A Comprehensive Review of Prompt Injection Attacks and Defenses
Mathew, E. S. (2025) · Journal on artificial intelligence · doi:10.32604/jai.2025.069841 · Cited by 18
Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks
Xing, W., Li, M., Li, M., & Han, M. (2026) · ACM Computing Surveys · doi:10.1145/3806048 · Cited by 67
Mind the Gap! Choice Independence in Using Multilingual LLMs for Persuasive Co-Writing Tasks in Different Languages
Biswas, S., Erlei, A., & Gadiraju, U. (2025) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3706598.3713201 · Cited by 17
Exploring Research and Tools in AI Security: A Systematic Mapping Study
Narula, S., GhasemiGol, M., Carnerero-Cano, J., Minnich, A., Lupu, E., & Takabi, D. (2025) · IEEE Access · doi:10.1109/access.2025.3567195 · Cited by 21
Summon a demon and bind it: A grounded theory of LLM red teaming
Inie, N., Stray, J., & Derczynski, L. (2025) · PLoS ONE · doi:10.1371/journal.pone.0314658 · Cited by 34
Generative AI in Heritage Practice: Improving the Accessibility of Heritage Guidance
Witte, J., Lee, E., Brausem, L., Shillabeer, V., & Bonacchi, C. (2025) · Heritage · doi:10.3390/heritage8120513 · Cited by 11
Large reasoning models are autonomous jailbreak agents
Hagendorff, T., Derner, E., & Oliver, N. (2026) · Nature Communications · doi:10.1038/s41467-026-69010-1 · Cited by 22
JailBench: A Comprehensive Chinese Security Assessment Benchmark for Large Language Models
Liu, S., Cui, S., Bu, H., Shang, Y.-M., & Zhang, X. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-8186-0_13 · Cited by 14
Improving LLM Outputs Against Jailbreak Attacks With Expert Model Integration
Tsmindashvili, T., Kolkhidashvili, A., Kurtskhalia, D., Maghlakelidze, N., Mekvabishvili, E., Dentoshvili, G., Shamilov, O., Gachechiladze, Z., Saporta, S., & Choladze, D. D. (2025) · IEEE Access · doi:10.1109/access.2025.3592458 · Cited by 7
Must Read: A Comprehensive Survey of Computational Persuasion
Bozdag, N. B., Mehri, S., Yang, X., Ha, H., Cheng, Z., Durmus, E., You, J., Ji, H., Tür, G., & Hakkani-Tur, D. Z. (2026) · ACM Computing Surveys · doi:10.1145/3800687 · Cited by 32
DARE to Diversify: DAta Driven and Diverse LLM REd Teaming
Nagireddy, M., Pegueroles, B. G., & Baldini, I. (2024) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3637528.3671444 · Cited by 6
A Multimodal conceptual framework to achieve automated software evolution for context-rich intelligent applications
Yue, S. (2024) · Innovations in Systems and Software Engineering · doi:10.1007/s11334-024-00591-0 · Cited by 9
Prompt-Based Jailbreaking of Leading LLM Chatbots: A Survey of Attacks and Defenses
Knowlton, B., Campa, J., Gallo, D. S., Dajani, K. F., & Alzahrani, N. (2026) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2026.3665656 · Cited by 6
The state as a model for AI control and alignment
Elsner, M. (2024) · AI & Society · doi:10.1007/s00146-024-02063-2 · Cited by 5
AI Act for the Working Programmer
Hermanns, H., Lauber-Rönsberg, A., Meinel, P., Sterz, S., & Zhang, H. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-75434-0_6 · Cited by 7
Exploring Cognitive Vulnerabilities: Self-Persuasion in Jailbreaking LLMs
Wang, Z., Xie, W., Ma, S., Wang, E., & Wang, B. (2025) · Electronics · doi:10.3390/electronics14163259 · Cited by 3
RedAgent: An Autonomous Agent for Context-Aware Red Teaming of LLM Jailbreaks
Xu, H., Zhang, W., Wang, Z., Xiao, F., Zheng, R., Ba, Z., & Ren, K. (2026) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2026.3665230 · Cited by 58
Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviors
Zhao, Y., & Zhang, Y. (2025) · Annual Computer Security Applications Conference · doi:10.1109/acsac67867.2025.00095 · Cited by 25
Robustness Over Time: Understanding Adversarial Examples’ Effectiveness on Longitudinal Versions of Large Language Models
Liu, Y., Cong, T., Zhao, Z., Michael Backes, A., Shen, Y., & Zhang, Y. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3672386 · Cited by 23
Persuade Me if You Can: A Framework for Evaluating Persuasion Effectiveness and Susceptibility Among Large Language Models
Bozdag, N. B., Mehri, S., Tür, G., & Hakkani-Tur, D. Z. (2026) · ACM Conference on AI and Agentic Systems (CAIS) · doi:10.1145/3786335.3813181 · Cited by 35
Safety and security of large language models in healthcare
Clusmann, J., Freyer, O., Ostermann, M., Ferber, D., Laleh, N. G., Hilgers, L., Kolbinger, F. R., Schneider, C. V., Downing, A., Wekenborg, M., et al. (2026) · Nature · doi:10.1038/s41586-026-10687-1 · Cited by 5
StructTransform: A Scalable Attack Surface for Safety-Aligned Large Language Models
Yoosuf, S., Ali, T., Lekssays, A., AlSabah, M., & Khalil, I. M. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-07884-1_25 · Cited by 7
Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
de Witt, C. S., Krawiecka, K., Krawczuk, I., Hagag, B., Anderson, W. L., Belcak, P., Bucknall, B., Cai, X., Chopra, A., Cohen, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2505.02077 · Cited by 108
Jailbreak Attacks on Large Language Models and Possible Defenses: Present Status and Future Possibilities
Ahmed, S. S., & Jothi, J. A. A. (2024) · IEEE International Symposium on Technology and Society (ISTAS) · doi:10.1109/istas61960.2024.10732418 · Cited by 4
Innovations in Digital Health From a Global Perspective: Proceedings of PRC‐HI 2024
Feng, X., Sun, Y., Wu, Y., Wang, H., & Wu, Y. (2025) · Health care science · doi:10.1002/hcs2.128 · Cited by 2
Chain-of-Detection enables robust and efficient jailbreak defense
Wu, T., & Zhang, H. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.108217 · Cited by 2
Modeling the Attack: Detecting AI-Generated Text by Quantifying Adversarial Perturbations
Teja, L. D. M. S. S., Yadagiri, A., Anish, S. S., Nuthakki, S. G. K., & Pakray, P. (2026) · International Conference on Ubiquitous Information Management and Communication (IMCOM) · doi:10.1109/imcom69009.2026.11360855 · Cited by 9
Revealing the intrinsic ethical vulnerability of aligned large language models
Lian, J., Jianhong, P., Wang, L., Wang, Y., Wang, X., Lu, Y., Mei, S., & Chau, L. (2026) · Nature Communications · doi:10.1038/s41467-026-70917-y · Cited by 6
AI-Facilitated Coercive Control: An Experimental Study
Kim, H., Ristenpart, T., & Dell, N. L. (2026) · CHI Conference on Human Factors in Computing Systems · doi:10.1145/3772318.3790859 · Cited by 2
Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Models
Ma, T., Jia, X., Duan, R., Li, X. Q., Huang, Y., Jia, X., Chu, Z., & Ren, W. (2025) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51701.2025.00258 · Cited by 40
Harmful Prompt Classification for Large Language Models
Gupta, O., Lozano, M., Busalim, A. H., Jaiswal, R. R., & Quille, K. (2024) · Conference on Human Centred Artificial Intelligence - Education and Practice (HCAIep) · doi:10.1145/3701268.3701271 · Cited by 4
AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMs
Lv, L., Zhang, W., Tang, X., Wen, J., Liu, F., Han, J., & Hu, S. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10890715 · Cited by 5
DS-GCG: Enhancing LLM Jailbreaks with Token Suppression and Induction Dual-Strategy
Tang, X., Yang, X., Yao, Z., Wen, J., Zhou, X., Han, J., & Hu, S. (2025) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd64889.2025.11033375 · Cited by 2
Detecting Jailbreaking Prompts: an Anti-Persuasion Filter Framework
Fenza, G., Gallo, M., Loia, V., Nicolosi, A., & Stanzione, C. (2025) · Lecture notes in social networks · doi:10.1007/978-3-031-85240-4_14 · Cited by 2
Unmasking Bias in Financial AI: A Robust Framework for Evaluating and Mitigating Hidden Biases in LLMs
Mehrotra, S., Raghavendra, P., Prajesh, B., Kambale, H., & Majumdar, P. (2025) · ACM International Conference on AI in Finance (ICAIF) · doi:10.1145/3768292.3770355 · Cited by 4
Adversarial Attacks on IoT Systems Leveraging Large Language Models
Shan, W., Long, T., & Zhou, Z. (2024) · International Conference on Identification, Information and Knowledge in the Internet of Things (IIKI) · doi:10.1109/iiki65561.2024.00035 · Cited by 3
Fast and Controllable Bias-Guided Jailbreak Attack on Large Language Models
Kang, Z. H., Xia, H., Zhang, R., Song, X., Li, L., & Hu, C. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3599199 · Cited by 1
Ality? Personality without a Person: Revisiting the Psycho-Lexical Approach for the Study of Personality in Large Language Models
Müller, L., & Sütterlin, S. (2025) · Mensch und Computer (MuC) · doi:10.1145/3743049.3748562 · Cited by 1
Countering Jailbreak Attacks with Two-Axis Pre-detection and Conditional Warning Wrappers
Na, H., Kim, H., Yoon, D., & Choi, D. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-07884-1_13 · Cited by 1
Uncovering the Persuasive Fingerprint of LLMs in Jailbreaking Attacks
Noughabi, H. A., Serbanescu, J., Zarrinkalam, F., & Dehghantanha, A. (2025) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3746252.3760929 · Cited by 1
Smoke and Mirrors: Jailbreaking LLM-based Code Generation via Implicit Malicious Prompts
Ouyang, S., Qin, Y., Lin, B., Chen, L., Mao, X., & Wang, S. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3764566 · Cited by 11
Iterative Prompting with Persuasion Skills in Jailbreaking Large Language Models
Ke, S.-W., Lai, G.-Y., Fang, G.-L., & Kao, H.-Y. (2026) · Lecture notes in electrical engineering · doi:10.1007/978-981-95-0887-7_33 · Cited by 2
Beware of the Woozle Effect: Exploring and Mitigating Hallucination Propagation in Multi-Agent Debate
Zhang, Z., Zhang, Y., Zeng, D., Liu, K., & Zhao, J. (2026) · IEEE Transactions on Audio Speech and Language Processing · doi:10.1109/taslpro.2026.3675803 · Cited by 1
Breaking Barriers: Multi-Agent Prompt Fusion for Automated LLM Jailbreaks
Hu, J., Zhang, J., & Li, Z. (2026) · Cognitive Computation · doi:10.1007/s12559-026-10552-3 · Cited by 1
Self-citation
EvoJail: Evolutionary diverse jailbreak prompt generation for large language models
Tang, R., Xu, K., Cheng, P., Ren, H., Wang, H., & Jiang, S. (2026) · Information Processing & Management · doi:10.1016/j.ipm.2026.104831 · Cited by 3
Did the Prompt Break the Model?: Perplexity-Based Detection of Adversarial Attacks on LLMs
Khan, R. A., Momo, T. T., Kabir, F., & Shah, F. M. (2025) · International Conference on Computer and Information Technology (ICCIT) · doi:10.1109/iccit68739.2025.11491788 · Cited by 1
The Anthropomimetic Turn in Contemporary AI
Shevlin, H. (2026) · Springer eBooks · doi:10.1007/978-3-032-11814-1_26 · Cited by 3
Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injection
Chen, M., Wang, K., Li, L., Zhang, J., & Zhang, T. (2026) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp63933.2026.00214 · Cited by 5
Self-citation
Jailbreaking LLMs Through Alignment Vulnerabilities in Out-of-Distribution Settings
Huang, Y., Tang, J., Chen, D., Tang, B., Wan, Y., Sun, L., Yu, P. S., & Zhang, X. (2025) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3746252.3760899 · Cited by 21
The Mirage of Artificial Intelligence Terms of Use RestrictionsPreprint
Lemley, M. A., & Henderson, P. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5049562 · Cited by 2
Rules Created by Symbolic Systems Cannot Constrain a Learning System v3, 2025-05-16Preprint
LIN, S.-W., Xu, R., Li, X., & Xu, W. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5256795 · Cited by 1
Generative AI in child sexual exploitation and abuse: views from UK law enforcement
Demeocq, C., Taylor, A., Ross, B., & McFeeters, A. (2026) · AI & SOCIETY · doi:10.1007/s00146-026-03176-6 · Cited by 1
Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats
Thota, P., Lei, Y., Thangaraj, S., Jonnalagadda, S. R., & Nilizadeh, S. (2026) · arXiv · doi:10.48550/arxiv.2606.26377
Developing Assurance Cases for Adversarial Robustness and Regulatory Compliance in LLMs
Momčilović, T. B., Balta, D., Buesser, B., Zizzo, G., & Purcell, M. (2024) · IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) · doi:10.1109/issrew63542.2024.00081 · Cited by 2
A Low-cost Black-box Jailbreak Based on Custom Mapping Dictionary with Multi-round Induction
Wu, F. H., Wang, W., Qu, Y., & Yu, S. (2024) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom63139.2024.00131
Introspective Reward Modeling via Inverse Reinforcement Learning for LLM Alignment
Wang, Z., Cheng, R., Yuan, S., Ding, Y., & Zhang, R. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-0014-7_20
Position Paper: Not a Stochastic Parrot, but Heterogeneous Rationality: Rules Created by Symbolic Systems Cannot Constrain a Learning SystemPreprint
LIN, S.-W., Xu, R., & Li, X. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5387584
Reward-Guided Many-Shot Jailbreaking
Chen, Y., Zou, X., Wang, T., Tian, J., Li, H., & Kuang, X. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-3343-5_32
Social Influence across conversational contexts: a new taxonomy of social influence techniques and public understanding of the characteristics of persuasion, manipulation, and coercion in interpersonal dialogue
Muir, K., Dewdney, N., Walker, F., & Joinson, A. (2025) · Social Influence · doi:10.1080/15534510.2025.2590842 · Cited by 1
RIVAL: From Information Accumulation to LLM Jailbreaking via Reflective Action LoopsPreprint
Peng, Y., Li, X., Yan, Y., Liu, M., Li, M., & Chen, D. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5901185
A Study on Cross-Lingual Security Vulnerabilities in Large Language Models
Ozcelik, M. B., Şentaş, A., Koçyiğit, B., Özen, S., & Akmeşe, A. (2025) · National Conference on Electrical and Electronics Engineering (ELECO) · doi:10.1109/eleco69582.2025.11329228
From Vibe Coding to Jailbreaking in Large Language Models: A Comparative Security Study
Castillo, E. S., Trujillo, A. G. S., Ibarra, M. S., Dominguez, D. J., & Cuevas-Tello, J. C. (2026) · Summer School on Artificial Intelligence in Cybersecurity · doi:10.3390/engproc2026123008
Statistical Invariance vs. AI Safety: Why Prompt Filtering Fails Against Contextual Attacks
Ioste, A. R., Peres, S. M., & Finger, M. (2026) · Journal of the Brazilian Computer Society · doi:10.5753/jbcs.2026.5961
A Systematic Survey of Jailbreak Attacks Against Large Language Models
Gu, Y., Chang, Q., You, J., Li, L., Chen, X. S., & Chen, Y. (2025) · International Conference on Computer, Big Data and Artificial Intelligence (ICCBD+AI) · doi:10.1109/iccbdai66607.2025.11387914
Defamiliarization Attack: Literary Theory Enabled Discussion of LLM Safety
Babu, B., Agafonova, I., Biedermann, S., & Yamshchikov, I. P. (2026) · Electronics · doi:10.3390/electronics15051047
Critical Safety Attention Heads: Architecture-Dependent Vulnerabilities in LLMsPreprint
Sha, L., Sun, P., Xue, H., Hao, S., & Xiao, F. (2026) · Research Square · doi:10.21203/rs.3.rs-8886237/v1
GRA: Graph-Based Role-Playing Attack for Single-Turn Jailbreak
Liu, A., Wu, Z., Wen, J., Peng, W., & Dou, C. (2026) · IEEE Signal Processing Letters · doi:10.1109/lsp.2026.3677330
JailbreakMaster: Low-Interaction Jailbreak Prompt Generation via Feature-Guided Strategy Search and Adaptive Fusion
Ba, Z., Zhao, J., Chen, K., Zhang, W., & Yu, N. (2025) · International Conference on Cyber Resilience and Endogenous Safety & Security (CRESS) · doi:10.1109/cress68073.2025.11452634
RPDP-Guard: Defending Large Language Models Against Jailbreaking Attacks Through Risk Perception and Dynamic Prompting
Zhang, B., Wang, H., Hu, T., Zhou, R., Tan, M., Han, W., & Ma, H. (2026) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-032-21168-2_4
MnMR-GenA: a morphological recombination genetic algorithm for jailbreak attacks in low-resource language
Li, Y., Wang, G., & Wang, H. (2026) · Scientific Reports · doi:10.1038/s41598-026-47434-5
DarkCite: Unveiling Authority Bias as Implicit Rag Jailbreak Attacks
Yang, X., Tang, X., Han, J., & Hu, S. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11463457
Boundary Safety in Multi-Turn Mental Health Dialogues With Large Language Models: A Simulation-Based Evaluation Study (Preprint)Preprint
Cheng, Y., Kang, Z., Jiang, K., Sun, C., Pan, Q., & Jiang, T. (2026) · doi:10.2196/preprints.96433
A Behavioral Benchmark Dataset for Evaluating Access Control Compliance in Large Language Models
Xin, Y., Yang, C. R., & Zhang, Z. Q. (2026) · International Conference on Generative Artificial Intelligence and Information Security (GAIIS) · doi:10.1109/gaiis69281.2026.11519174
Bridging the Scale Gap: Augmenting Human Red-Teaming to Uncover Latent Risks in T2I Models
Quaye, J. A., Parrish, A., Rastogi, C., Kahng, M., Inel, O., Aroyo, L. M., & Reddi, V. J. (2026) · ACM Conference on Fairness, Accountability, and Transparency (FAccT) · doi:10.1145/3805689.3812210
Casting a SPELL: Sentence Pairing Exploration for LLM Limitation-Breaking
Huang, Y., Jia, X., Guo, W., Sun, Y., Huang, Y., Wang, C., & Liu, Y. (2026) · Proceedings of the ACM on software engineering. · doi:10.1145/3797063 · Cited by 3
DUA: Automated Jailbreak via Dual-Use Ambiguity and Semantic-Operational Disentanglement
Ma, S., Liu, W. T., Xie, W., Wen, L., Wang, P., Chen, R., & Chen, S. (2026) · ICEENG International Conference for Innovations in Intelligent Computing and Cybersecurity (IICC) · doi:10.1109/iicc69623.2026.11582014
Stereotype-Strategy Interplay: Warmth and Competence as Moderators of Persuasion Effectiveness in Online Communities
Wang, Y., Yang, Y., Yao, N., Zhu, J., & Chen, H. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581730
Evolva: A Multi-turn Contextual Attack for Long-Reasoning LLMs
Du, W., Yang, X., Liu, Z., Zhang, B., & Xue, J. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-2852-2_46
UniNDM: A Unified Noise-Driven Detection and Mitigation Framework Against Sexual Content in Text-to-Image Generation
Huang, Y., Sun, Y., Chen, H., Zhang, R., Ruan, S., Duan, R., Yuan, M., Dong, Y., Xue, H., Cao, X., et al. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3713771
LLMSafeGuard: A Training-Free Framework for Safeguarding LLM Decoding via Context-Wise Similarity Validation
Dong, X., Wang, S., Lin, D., & Hassan, A. E. (2026) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3803437.3806718
A Comparative Survey of Security Risks in AI Systems: From LLMs to AI Agents and Embodied Agents
Wu, B., Li, Q., Zhou, C., Wang, T., & Ji, S. (2026) · ACM Computing Surveys · doi:10.1145/3837083 · Cited by 2
Research on Dynamic Security Intervention and Semantic Robustness Detection Mechanism of Large Language Models for Sensitive Fields
Wang, S., He, R., Li, H., Yang, J., & Yin, R. (2026) · International Conference on Electronic Information Technology and Computer Engineering (EITCE) · doi:10.1109/eitce70137.2026.11634335
REMEDy: a dataset for rationale extraction and span-based moderation of dialogue prompts
Piano, L., Battistin, C., den Abeele, J. V., & Pompianu, L. (2026) · Neural Computing and Applications · doi:10.1007/s00521-026-12381-9
Specialized Domain Jailbreak Benchmark: Exposing Severe Jailbreak Vulnerabilities in Large Language Models
Ding, F., Liao, Z., & Li, Q. (2026) · International Conference on Computer Communication and Artificial Intelligence (CCAI) · doi:10.1109/ccai69603.2026.11642016
Fine-tuning as Jailbreaking: A data-centric red teaming framework via logic injection
Li, Q., Xu, K., Qu, Y., & Wu, J. (2026) · Automated Software Engineering · doi:10.1007/s10515-026-00659-0
A C-SSRS-Based Risk-Aware Evaluation Framework for Self-Harm Safety in LLMs
Zhang, L., Zhao, F., & Yang, X. (2026) · IEEE International Conference on Artificial Intelligence Testing (AITest) · doi:10.1109/aitest70988.2026.00035
Adaptive and Explicit $$\texttt {<safe>}$$: Triggering Latent Safety Awareness in Large Reasoning Models
Miao, K., Li, J., Chen, H., Hu, Y., & Qin, Z. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-37673-2_11
EASE-CloudNet: Adaptive Safety Alignment for Edge–Cloud SLMs via GNN-Informed Selective Reasoning and Multi-Objective Distillation
Shi, J., Chen, H., & Han, L. (2026) · Electronics · doi:10.3390/electronics15174015

Authors: Zeng, Y., Lin, H., Zhang, J., Yang, D., Jia, R., & Shi, W.
Affiliations: Virginia Tech (US)
Renmin University of China (CN)
Northeastern University (US)
Stanford University (US)
ORCID: Zhang, Jingwen
Yang, Diyi
Jia, Ruoxi
Shi, Weiyan
Venue: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)
Publisher: Association for Computational Linguistics
Published: 2024
Pages: 14322-14350
ISSN: 0736-587X (ISSN-L)
DOI: 10.18653/v1/2024.acl-long.773
OpenAlex: W4402671039
Cited by: 107
References: 0
Citations by year: 2026: 57 · 2025: 39 · 2024: 11
FWCI: 31.58
Type: conference paper
Language: en
Open access: hybrid
doi.org
Licence: cc-by
Locations: Proceedings of the conference - Association for Computational Linguistics. Meeting (publishedVersion, cc-by)
arXiv (Cornell University) (submittedVersion)
arXiv (Cornell University)
Funders: National Science Foundation (2313130, 2308994, 2239622, 2312794)
Defense Advanced Research Projects Agency
Office of Naval Research
Topics: Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Physical Sciences › Computer Science › Artificial Intelligence › Ethics and Social Impacts of AI
Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
Keywords: persuasion, adversarial prompts, AI safety, non-expert users, Llama 2, GPT-4

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs

Abstract

Overview

Integrity signals

Verification

Claims the paper makes

Claims other papers make about this one

Citations

Cites

Cited by

Related

Metadata

Record

About these checks