The DOI matches its DataCite record; 34 of the 34 references it cites were found in a registry or an index.
Universal and Transferable Adversarial Attacks on Aligned Language Models
Open accessAbstract
Because "out-of-the-box" large language models are capable of generating a great deal of objectionable content, recent work has focused on aligning these models in an attempt to prevent undesirable generation. While there has been some success at circumventing these measures -- so-called "jailbreaks" against LLMs -- these attacks have required significant human ingenuity and are brittle in practice. In this paper, we propose a simple and effective attack method that causes aligned language models to generate objectionable behaviors. Specifically, our approach finds a suffix that, when attached to a wide range of queries for an LLM to produce objectionable content, aims to maximize the probability that the model produces an affirmative response (rather than refusing to answer). However, instead of relying on manual engineering, our approach automatically produces these adversarial suffixes by a combination of greedy and gradient-based search techniques, and also improves over past automatic prompt generation methods. Surprisingly, we find that the adversarial prompts generated by our approach are quite transferable, including to black-box, publicly released LLMs. Specifically, we train an adversarial attack suffix on multiple prompts (i.e., queries asking for many different types of objectionable content), as well as multiple models (in our case, Vicuna-7B and 13B). When doing so, the resulting attack suffix is able to induce objectionable content in the public interfaces to ChatGPT, Bard, and Claude, as well as open source LLMs such as LLaMA-2-Chat, Pythia, Falcon, and others. In total, this work significantly advances the state-of-the-art in adversarial attacks against aligned language models, raising important questions about how such systems can be prevented from producing objectionable information. Code is available at github.com/llm-attacks/llm-attacks.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source doesn’t support the claim as written.
In the citing paper
“The attacker has no access to the model's parameters or gradients, relying solely on the agent's responses to adversarial inputs, which makes gradient-based optimization techniques (Zou et al., 2023) ineffective.”
From AdvAgent: Controllable Blackbox Red-teaming on Web Agents (2024) · cites this paper as Zou et al., 2023
Checked by a reasoning model — may be wrong.
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Existing LLM red teaming focuses on red teaming the model by generating inputs that lead to undesirable behavior, absent monitoring or other countermeasures (Perez et al., 2022; Wei et al., 2023; Zou et al., 2023).”
From AI Control: Improving Safety Despite Intentional Subversion (2023) · cites this paper as Zou et al., 2023
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“AI security, by contrast, has remained largely model-centric, focused on single-agent attack surfaces and adversarial samples (Biggio et al., 2012;Szegedy et al., 2014;Zou et al., 2023).”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Zou et al., 2023
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Moreover, advanced AI promises to lower the cost and broaden the scope of coercion and extortion -whether by exposing private data through surveillance or by mounting cyber-offensive operations against rival agents -potentially weaponizing adversarial attacks, jailbreaks, and resource denial at scale (Ellsberg, 1968;Harrenstein et al., 2007;Zou et al., 2023;Gleave et al., 2020;Brundage et al., 202”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Zou et al., 2023
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“For instance, OpenAI appeared to patch its system to prevent adversarial attacks with specific suffixes discovered in Zou, Wang, et al. (2023), but the underlying vulnerability may still persist.”
From Hallucination‐Free? Assessing the Reliability of Leading AI Legal Research Tools (2025) · cites this paper as Zou, Wang, et al. (2023)
Experimental — accuracy not yet measured
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Jailbreaks Another well-known attack vector is jailbreak, which specifically aims to escape the safety behavior that is trained into an LLM.As such, they often don't specifically conflict with a model's previous instructions.”
From The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions (2024) · cites this paper as Zou et al., 2023
Experimental — accuracy not yet measuredThe cited source says what the claim attributes to it.
In the citing paper
“Safety alignment is shallow in the token dimension (Qi et al., 2025), breakable by optimized suffixes (Zou et al., 2023), and fragile under fine-tuning (Qi et al., 2024)”
From CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents (2026) · cites this paper as Zou et al., 2023
The cited source says what the claim attributes to it.
In the citing paper
“In addition, they are vulnerable to prompt injection (or jailbreak) attacks, where malicious actors manipulate inputs to trick the model into producing harmful outputs (Kang et al., 2023; Wei et al., 2023; Zou et al., 2023).”
From NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails (2023) · cites this paper as Zou et al., 2023
The cited source says what the claim attributes to it.
In the citing paper
“Such failures are surfaced by automated red-teaming and standardized refusal benchmarks (Perez et al. 2022; Mazeika et al. 2024) and intensify under optimization, from transferable adversarial suffixes (Zou et al. 2023) to long-context many-shot prompting (Anil et al. 2024).”
From Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents (2026) · cites this paper as Zou et al. 2023
The cited source says what the claim attributes to it.
In the citing paper
“our work is the first to repurpose them for detecting LLM-generated peer reviews.”
From Detecting LLM-generated peer reviews (2025) · cites this paper as [19]
The cited source says what the claim attributes to it.
In the citing paper
“the Greedy Coordinate Gradient (GCG) algorithm, originally developed for jailbreaking LLMs [19]”
From Detecting LLM-generated peer reviews (2025) · cites this paper as [19]
The cited source says what the claim attributes to it.
In the citing paper
“(ii) We do not explore more advanced jailbreaking techniques, such as optimizing the string inside the pop-ups (Zou et al., 2023) or making our pop-ups more persuasive (Zeng et al., 2024), but focus more on the high-level design of the adversarial pop-ups and the contribution analysis of different components.”
From Attacking Vision-Language Computer Agents via Pop-ups (2025) · cites this paper as Zou et al., 2023
The cited source says what the claim attributes to it.
In the citing paper
“Current research in LLM security predominantly focuses on addressing vulnerabilities in isolated models, often concentrating on jailbreak attacks (Zou et al., 2023;Liu et al., 2024) or on extracting memorized training data from a trained model (Nasr et al., 2023).”
From Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks (2025) · cites this paper as Zou et al., 2023
The cited source says what the claim attributes to it.
In the citing paper
“Many cutting-edge attack algorithms involve gradient-based or transfer attacks (Zou et al., 2023), but these are impractical for LLM agents since they often require white-box access for computing gradients or require a very large number of model calls.”
From Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks (2025) · cites this paper as Zou et al., 2023
In the citing paper
“Originally introduced for jailbreak attacks, GCG aims to train adversarial strings to let the LLM generate affirmative prefixes that induce malicious content following the malicious instruction.”
From Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents (2025) · cites this paper as Zou et al., 2023
In the citing paper
“To automate and strengthen these attacks, researchers have developed methods like GCG (Zou et al., 2023) and AutoDAN attacks (Liu et al., 2024a;Zhu et al., 2023), which automatically find prompts to jailbreak LLMs.”
From Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents (2025) · cites this paper as Zou et al., 2023
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
The publisher hasn’t deposited this paper’s reference list.
Research works printed but not linked: 12
- Hadi Abdullah, Aditya Karlekar, Vincent Bindschaedler, and Patrick Traynor. Demystifying limited adversarial transferability in automatic speech recognition systems. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=l5aSHXi8jG5.
- Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforcement learning from human preferences. Advances in neural information processing sys- tems, 30, 2017.
- Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference on machine learning. PMLR, 2019.
- Zhengxiao Du, Yujie Qian, Xiao Liu, Ming Ding, Jiezhong Qiu, Zhilin Yang, and Jie Tang. Glm: General language model pretraining with autoregressive blank infilling. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 320-335, 2022.
- Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song, and Jacob Steinhardt. Aligning {ai} with shared human values. In International Conference on Learning Representations, 2021. URL https://openreview.net/forum?id=dNy_RKzJacY.
- Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Alek- sander Madry. Adversarial examples are not bugs, they are features. In Advances in Neural Information Processing Systems (NeurIPS), 2019.
- Tomasz Korbak, Kejian Shi, Angelica Chen, Rasika Vinayak Bhalerao, Christopher Buckley, Jason Phang, Samuel R Bowman, and Ethan Perez. Pretraining language models with human prefer- ences. In International Conference on Machine Learning, pages 17506-17533. PMLR, 2023.
- Klas Leino, Zifan Wang, and Matt Fredrikson. Globally-robust neural networks. In International Conference on Machine Learning. PMLR, 2021.
- Linyi Li, Tao Xie, and Bo Li. Sok: Certified robustness for deep neural networks. In 2023 IEEE Symposium on Security and Privacy (SP), 2023.
- Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. URL https://openreview.net/forum?id=rJzIBfZAb.
- Lianhui Qin, Sean Welleck, Daniel Khashabi, and Yejin Choi. Cold decoding: Energy-based con- strained text generation with langevin dynamics. Advances in Neural Information Processing Systems, 35:9538-9551, 2022.
- Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
Cited by
Sorted by citations
Items 201–253 of 253
Wuli-Shili-Renli-Jili System Approach and Its Application in Large Model Value Alignment
Qi, J., Jia, K., Zhang, Y., Feng, X., & Yan, H. (2024) · IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C) · doi:10.1109/qrs-c63300.2024.00069
Detoxifying Large Language Models via Kahneman-Tversky Optimization
Li, Q., Du, W., & Liu, J. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-9443-0_36 · Cited by 1
Battle of transformers: Adversarial attacks on financial sentiment models
Turetken, A. C., & Leippold, M. (2026) · Journal of Banking & Finance · doi:10.1016/j.jbankfin.2026.107698 · Cited by 2
Roa, C., Mahbub, M., Srinivasan, S., Begoli, E., & Sadovnik, A. (2024) · doi:10.1145/3689932.3694758
Li, X., Wu, X., Xiao, L., Liu, T., Huang, P. S., & Shan, J. (2026) · IEEE International Conference on Data Engineering (ICDE) · doi:10.1109/icde65706.2026.00355
Adversarial Augmentation Can Improve Adversarial Robustness Better Than Double the Labeled Data
Lokshin, N. D., Khvostikov, A. V., & Krylov, A. S. (2024) · Pattern Recognition and Image Analysis · doi:10.1134/s1054661824701025
Advancing sentiment understanding and safety in NLP systems
Deng, Y. (2025) · DR-NTU (Nanyang Technological University) · doi:10.32657/10356/183610
Empirical Study on Translating Toxic Sentences with Large Language Model vs. Machine Translation
Supryadi, & Xiong, D. (2025) · Communications in computer and information science · doi:10.1007/978-981-96-5123-8_2
Non-Halting Queries: Exploiting Fixed Points in LLMs
Hammouri, G., Derya, K., & Sunar, B. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00009 · Cited by 2
How Risky Are Open Frontier Models?
Krier, S., Law, H., & Klyman, K. (2025) · Oxford University Press eBooks · doi:10.1093/oxfordhb/9780198940272.013.0023
Análise comparativa sobre atividades de Red Team de LLMs com LLMs
Alves, A. C. V., Neto, M. P. P., & Miers, C. C. (2025) · Escola Regional de Alto Desempenho da Região Sul (ERAD-RS) · doi:10.5753/eradrs.2025.6827
Estudo comparativo do uso de LLM para atividades de Red Team em LLM
Alves, A. C. V., & Miers, C. C. (2024) · Escola Regional de Redes de Computadores (ERRC) · doi:10.5753/errc.2024.4669
I Hear You: On Human Knowledge and Vocal Intelligence
Holenstein, M. A. (2025) · Revista Lusófona de Estudos Culturais · doi:10.21814/rlec.6316
NLP Security and Ethics, in the Wild
Lent, H., Galinkin, E., Chen, Y., Pedersen, J. M., Derczynski, L., & Bjerva, J. (2025) · Transactions of the Association for Computational Linguistics · doi:10.1162/tacl_a_00762 · Cited by 1
LIN, S.-W., Xu, R., & Li, X. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5387584
"Give a Positive Review Only": Can Hidden PDF Prompts Sway LLMs?Preprint
Guo, X., Huang, Z., Song, Z., & Zhang, J. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5368453
Towards a Metric to Assess Neural Network Resilience Against Adversarial Samples
Geier, J., & Heinl, P. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-00642-4_16
Efficient Safety Retrofitting Against Jailbreaking for LLMs
García-Gasulla, D., Tormos, A., Arias-Duart, A., Hinjos, D., Molina-Sedano, O., Gururajan, A. K., & Cardello, M. E. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-02018-5_39 · Cited by 3
SamJailbreak: Query-Efficient Sampling-based Jailbreak Attack against Large Language ModelsPreprint
Guo, S., Ming, Z., Zhao, D., Zhang, X., Ding, Z., Han, J., & Peng, H. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5492127
A Two-Step, Multidimensional Account of Deception in Language Models
Dung, L. (2025) · Erkenntnis · doi:10.1007/s10670-025-01017-4 · Cited by 2
Towards Model-Driven Testing for Assuring the Quality of Large Language Models
Carreño-Bolufer, J., Giachetti, G., & Pastor, Ó. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-08620-4_12
StreamGuard: A Streaming-Based Defense Against Jailbreaking Attacks in Large Language Models
Li, L., Gao, X., Wang, X., Zhao, J., & Ye, K. (2025) · Communications in computer and information science · doi:10.1007/978-981-95-4109-6_21
Development of a Red-Teaming Dataset to Defend Large Language Models Against Attacks
Alekseevskaia, I., Arkhipenko, K. V., & Турдаков, Д. Ю. (2025) · Programming and Computer Software · doi:10.1134/s0361768825700343
Investigating Adversarial Trigger Transfer in Large Language Models
Meade, N., Patel, A., & Reddy, S. (2025) · Transactions of the Association for Computational Linguistics · doi:10.1162/tacl.a.27 · Cited by 16
From Exploitation to Protection: Analysis of Attacks on Large Language Models
Валентинович, Б. С., & Velichko, I. (2025) · Automatic Control and Computer Sciences · doi:10.3103/s0146411625700750
CareEval: Evaluating Large Language Models for Decision-Making in Physical Robot Caregiving
Liu, Z., Dimitropoulou, K. A., Cheung, C., & Bhattacharjee, T. (2026) · ACM/IEEE International Conference on Human-Robot Interaction (HRI) · doi:10.1145/3776734.3794354
Mapping the Landscape of LLM Deployment in the Wild: Prevalence, Patterns, and Perils
Hou, X., Han, J., Zhao, Y., Wang, S., & Wang, H. (2026) · Proceedings of the ACM on Measurement and Analysis of Computing Systems · doi:10.1145/3788097 · Cited by 22
Sorour, S. E., El-deep, S. E., Alojail, A., & Kahouf, S. A. E. (2026) · Journal Of Big Data · doi:10.1186/s40537-026-01420-w
Danielienė, R., Driaunys, K., Veitaitė, I., Bartnykas, M., Stankūnas, R., Šilingaitė, I., & Kuliešienė, D. (2026) · Communications in computer and information science · doi:10.1007/978-3-032-16808-5_33
Generative AI jailbreaks as emerging cyberthreats: Ethical, legal, and societal implications
Teichmann, F. M. J. (2026) · International Cybersecurity Law Review · doi:10.1365/s43439-026-00171-x · Cited by 2
Security as an Ethical Imperative in AI Systems
Andrade, R., Ayala, C., & Morillo, P. (2026) · Synthesis lectures on computer science · doi:10.1007/978-3-032-25789-5_5
Token Mines: A Defense Against Agents and Large Language Models
Pasternak, A., Ashkenazy, T., Arad, I., Weiss, R., & Mirsky, Y. (2026) · doi:10.1145/3803629.3803674
Wankhade, A., & Shahade, A. K. (2026) · The International journal of networked and distributed computing · doi:10.1007/s44227-026-00105-3
Mobile App Analysis in the New Era: Challenges and the Road Ahead
Wu, J., Liu, T., Zhao, Y., & Wang, H. (2026) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3819579 · Cited by 1
Structure-Induced Safety Gaps in Multimodal Reasoning Systems
Yang, M., Liang, P., Wu, Z. W., & Liao, Y. (2026) · International Conference on Multimedia Retrieval · doi:10.1145/3805622.3810575
Kim, R. S. (2026) · Discover Artificial Intelligence · doi:10.1007/s44163-026-01573-w
InDe-LLM: Defending against Jailbreak Attacks in LLM-Powered Systems via Intention Disentangling
Wang, Y., Zhang, Q., Zhou, C., Go, G., Shi, D., & Jiang, Y. (2026) · Proceedings of the ACM on software engineering. · doi:10.1145/3797136
Conceptual Design and Taxonomy of a RAG-Based Attack Memory for LLM Red Teaming
Heithoff, I., Woldai, B., & Schacht, S. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-30860-3_5
Attention Heads Hold the Key to Understanding Safety Mechanisms in Large Language Models
Yang, S., Mei, C., Zou, H., Chen, J., & Zhao, S. G. (2026) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3770855.3818024
Cheung, N. (2026) · Scientific Reports · doi:10.1038/s41598-026-66139-3
Tchuindjang, M., Duran, N., Legg, P., & Medjek, F. (2026) · Cybersecurity · doi:10.1186/s42400-026-00633-z
Duan, Z. Y., Xiong, H., Yang, S., Cai, M., & Zhao, S. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-37676-3_12
Toward an algebraic framework for operator-based prompt engineering in large language models
Olaymi, S. E. Z. (2026) · Neural Computing and Applications · doi:10.1007/s00521-026-12434-z
AgentBreaker: Evaluating Context-Aware Indirect Prompt Injection Risks in Modern Web Agents
Son, Y., Lee, C., Shin, D., Lee, B., Hong, S., & Son, S. (2026) · Proceedings of the ACM on software engineering. · doi:10.1145/3832165
CAST: A Compiler-Based Framework for Systematically Testing LLM Compositional Safety
Yan, L., Zhang, Z., Xu, X., An, S., Shen, G., Xuan, Z., Chen, X., & Zhang, X. (2026) · Proceedings of the ACM on software engineering. · doi:10.1145/3832237
Systemic privacy risks of personal data exposure through conversational large language model agents
Yahia, A. B., Kadir, I., Harrak, E. F. E., Chisembe, S., Abdallaoui, A., Hmaidi, A. E., & Dehbi, A. (2026) · Discover Artificial Intelligence · doi:10.1007/s44163-026-02431-5
From Money to Prompt Laundering: CLEANSE*, a Risk-Calibrated Multi-View DetectorPreprint
Abaddi, S. (2026) · Research Square · doi:10.21203/rs.3.rs-11410640/v1
Aziz, M. S., Ali, M., Manzoor, A. R., Younis, M., & Khabirova, Z. (2026) · Research Square · doi:10.21203/rs.3.rs-11434787/v1
LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection
Zhao, L., Bhaskar, A., & Dobriban, E. (2026) · arXiv · doi:10.48550/arxiv.2605.17986
Prompt Persistence Attacks: Long-Term Memory Poisoning in LLM-Based Systems
Bhatnagar, P. (2026) · SSRN (preprint) · doi:10.2139/ssrn.6183548
LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge
Li, S., Xu, C., Wang, J., Gong, X., Chen, C., Zhang, J., Wang, J., Lam, K.-Y., & Ji, S. (2025) · arXiv · doi:10.48550/arxiv.2506.09443 · Cited by 40
“Jailbreaking involves designing inputs that circumvent an LLM’s built-in safeguards, coercing it into producing content that violates its usual policy constraints, such as harmful or unethical outputs [15], [16], [33], [34].”
Accelerating scientific discovery with Co-Scientist
Gottweis, J., Weng, W.-H., Daryin, A., Tu, T., Sirkovic, P., Myaskovsky, A., Glowaty, G., Weissenberger, F., Orlandi, A., Popovici, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2502.18864 · Cited by 158
Agent-SafetyBench: Evaluating the Safety of LLM Agents
Zhang, Z., Cui, S., Lu, Y., Zhou, J., Yang, J., Wang, H., & Huang, M. (2024) · arXiv · doi:10.48550/arxiv.2412.14470 · Cited by 6
“Note that for the category Produce unsafe information / misinformation , which does not involve tool usage, we sample 50 raw questions from AdvBench (Zou et al., 2023) and randomly combine them with 20 representative jailbreak templates (Zhang et al., 2024c), resulting in 200 new test cases.”
Influential
Metadata
- Authors
- Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., & Fredrikson, M.
- Affiliations
- Carnegie Mellon University (US)
- Google DeepMind (United Kingdom) (GB)
- Robert Bosch (United States) (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2023
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2307.15043
- OpenAlex
- W4385374425
- Cited by
- 197
- References
- 0
- Citations by year
- 2026: 31 · 2025: 61 · 2024: 89 · 2023: 16
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation (1943016)
- Defense Advanced Research Projects Agency (FA8750, FA8750-15-2-0277)
- Multidisciplinary University Research Initiative (W911NF-21-1-0317)
- Army Research Office (W911NF-21-1-, W911NF)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Speech Recognition and Synthesis
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- jailbreak attacks, voice assistants, audio modulation, black-box evaluation, audio-to-audio translation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
