Research map / Adversarial robustness and security / Attacks on text and graphs
LLM jailbreak and injection defense
Study jailbreaks and prompt injections and train or evaluate safer LLMs.
113 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2019–2026) · an approach in Attacks on text and graphs, keyword cluster “llms · prompt · jailbreak”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
8 papers in 2023–24 and 101 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 2.9% to 20.8%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2019 · On Structured Argumentation with Conditional Preferences (AAAI 2019 · 18 citations)
- 2020 · Revisiting the Foundations of Abstract Argumentation – Semantics Based on Weak Admissibility and Weak Defense (AAAI 2020 · 38 citations)
- 2022 · Synthetic Disinformation Attacks on Automated Fact Verification Systems (AAAI 2022 · 24 citations)
- 2023 · DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models (NeurIPS 2023 · 62 citations)
- 2024 · AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (NeurIPS 2024 · 83 citations)
- 2025 · PhishAgent: A Robust Multimodal Agent for Phishing Webpage Detection (AAAI 2025 · 18 citations)
- 2026 · RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service Copyright Protection (AAAI 2026 · 1 citation)
Earliest papers here
- On Structured Argumentation with Conditional Preferences (AAAI 2019 · 18 citations)
- Revisiting the Foundations of Abstract Argumentation – Semantics Based on Weak Admissibility and Weak Defense (AAAI 2020 · 38 citations)
- Ranking-Based Semantics for Sets of Attacking Arguments (AAAI 2020 · 10 citations)
What has been tried
40 papers here report 451 measured changes (a component added, removed or swapped, compared with a baseline): helped 63%, no clear effect 8%, hurt 26%, mixed 4%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Use the Important message phrasing instead of TODO, Ignore previous instructions, or InjecAgent prompts | AgentDojo security cases · targeted ASR | 3.66% -> 57.7%; 5.41% -> 57.7%; 5.72% -> 57.7% | Helped | AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (NeurIPS 2024 · 83 citations) |
| add the Multimodal Retriever to MBE | TR-OP (2,310 grounded samples) · Recall | 66.28 -> 73.94 | Helped | PhishAgent: A Robust Multimodal Agent for Phishing Webpage Detection (AAAI 2025 · 18 citations) |
| Add random search and self-transfer to the prompt attack | AdvBench · attack success rate | 0% -> 100% | Helped | Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks (ICLR 2025 · 9 citations) |
| Increase defense control length | AdvBench, GCG/AutoDAN/PAIR · ASR | Helped | Fight Back Against Jailbreaking via Prompt Adversarial Tuning (NeurIPS 2024 · 9 citations) | |
| Add preference optimization to QEM | AdvBench, Llama2 · ASR (%) ClassJudge | 3.06 -> 3.26 | Helped | JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · 4 citations) |
| increase the weight factor from 0.25 to 1.00 for AEO (COS) | Text-to-image · NSFW rate (%) | 21.70 -> 95.30; 1.10 -> 77.00 | Mixed | Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreaking (CVPR 2025 · 4 citations) |
| Train on all four watermarks instead of only Exp | Surveyed watermarks · evasion rate | at least 97.0% -> at least 96.3% | Hurt | Optimizing Adaptive Attacks against Watermarks for Language Models (ICML 2025 · 2 citations) |
| Add latent Bayesian optimization (LBO) to suffix generation | Mistral-7B-v0.3 and Falcon-7B · ASR | Helped | GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs (NeurIPS 2025 · 1 citation) | |
| Add a scenario protection prompt to the Naive detector | FigStep · ASR | 28.8 -> 9.6; 36.8 -> 31.8; 26.2 -> 7.6; 35.2 -> 2.8 | Helped | The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense (NeurIPS 2025 · 1 citation) |
| Evict the lowest-ranked 20% of tokens with deterministic rather than randomized selection | AutoDAN · ASR | Helped | RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Eviction (ICLR 2025 · 1 citation) | |
| Replace the reference model with TinyLlama-1.1b | AdvBench test · ASR@10 (%) | 10.6 -> 10.6 | No clear effect | Jailbreaking as a Reward Misspecification Problem (ICLR 2025 · 1 citation) |
| Remove Lp from the loss function | 10-20 character payloads, token space · ASR(T) | 37% -> 20% | Hurt | AIA: Autoregression-Based Injection Attacks Against Text2SQL Models (AAAI 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 47 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- AdvBench · 10 of 47 papers
- HarmBench · 5 of 47 papers
- GSM8K · 4 of 47 papers
- AlpacaEval · 4 of 47 papers
- SST2 · 3 of 47 papers
- AG News · 3 of 47 papers
- WikiText · 3 of 47 papers
- BeaverTails · 2 of 47 papers
Baselines
- GCG · 10 of 47 papers
- PAIR · 5 of 47 papers
- AutoDAN · 4 of 47 papers
- TAP · 4 of 47 papers
- SmoothLLM · 3 of 47 papers
- FigStep · 2 of 47 papers
- SFT · 2 of 47 papers
- RepNoise · 2 of 47 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 109 papers; from OpenAlex and the papers' affiliations).
- University of California, Berkeley · 5 papers
- Nanyang Technological University · 4 papers
- Google · 4 papers
- Zhejiang University · 3 papers
- University of Science and Technology of China · 3 papers
- Beihang University · 3 papers
- National University of Singapore · 3 papers
- Sun Yat-sen University · 3 papers
- University of North Carolina at Chapel Hill · 3 papers
- Carnegie Mellon University · 3 papers
Use it
Download BibTeX of 27 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Adversarial prompts for language models (98 papers)
- Vision-language model robustness (96 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- Defenses against universal perturbations (97 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Biologically inspired robust vision (77 papers)
- Graph neural network robustness (71 papers)
- Adversarial perturbations beyond images (69 papers)
- Physical adversarial patches and camouflage (56 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).