% Key papers for LLM jailbreak and injection defense (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{neurips2024_agentdojo_73716,
  title = {{AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/97522},
}

@inproceedings{neurips2024_jailbreakbench_74317,
  title = {{JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/97459},
}

@inproceedings{neurips2023_decodingtrust_69258,
  title = {{DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2023},
  url = {https://nips.cc/virtual/2023/poster/73486},
}

@inproceedings{aaai2020_revisiting_101374,
  title = {{Revisiting the Foundations of Abstract Argumentation – Semantics Based on Weak Admissibility and Weak Defense}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/5661},
}

@inproceedings{aaai2022_synthetic_2800,
  title = {{Synthetic Disinformation Attacks on Automated Fact Verification Systems}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2022},
  url = {https://aaai.org/papers/10581-synthetic-disinformation-attacks-on-automated-fact-verification-systems/},
}

@inproceedings{icml2024_harmbench_44977,
  title = {{HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/33475},
}

@inproceedings{aaai2025_phishagent_10294,
  title = {{PhishAgent: A Robust Multimodal Agent for Phishing Webpage Detection}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/35003},
}

@inproceedings{aaai2019_on_101331,
  title = {{On Structured Argumentation with Conditional Preferences}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2019},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/4131},
}

@inproceedings{aaai2025_medical_9930,
  title = {{Medical MLLM Is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Models}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32396},
}

@inproceedings{aaai2020_ranking_101410,
  title = {{Ranking-Based Semantics for Sets of Attacking Arguments}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/5697},
}

@inproceedings{neurips2024_fight_73816,
  title = {{Fight Back Against Jailbreaking via Prompt Adversarial Tuning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/93692},
}

@inproceedings{iclr2025_jailbreaking_83050,
  title = {{Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/28755},
}

@inproceedings{iclr2023_trojtext_33045,
  title = {{TrojText: Test-time Invisible Textual Trojan Insertion}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2023},
  url = {https://iclr.cc/virtual/2023/poster/10756},
}

@inproceedings{aaai2025_jailpo_9620,
  title = {{JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/34953},
}

@inproceedings{cvpr2025_mind_26956,
  title = {{Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreaking}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/35195},
}

@inproceedings{iclr2024_can_33722,
  title = {{Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/19353},
}

@inproceedings{icml2025_optimizing_46417,
  title = {{Optimizing Adaptive Attacks against Watermarks for Language Models}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/46148},
}

@inproceedings{aaai2023_advances_3081,
  title = {{Advances in AI for Safety, Equity, and Well-Being on Web and Social Media: Detection, Robustness, Attribution, and Mitigation}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2023},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/26811},
}

@inproceedings{neurips2025_gasp_74739,
  title = {{GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=0fBQAckQK3},
}

@inproceedings{neurips2025_reliabilityrag_75884,
  title = {{ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=D9JeNTs5Bu},
}

@inproceedings{neurips2025_the_78648,
  title = {{The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defense}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=gpCleSGCkV},
}

@inproceedings{iclr2025_robustkv_81761,
  title = {{RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Eviction}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/30018},
}

@inproceedings{iclr2025_jailbreaking_83826,
  title = {{Jailbreaking as a Reward Misspecification Problem}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/27994},
}

@inproceedings{aaai2026_regionmarker_108376,
  title = {{RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service Copyright Protection}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/40728},
}

@inproceedings{aaai2026_cost_108735,
  title = {{Cost-Minimized Label-Flipping Poisoning Attack to LLM Alignment}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/41087},
}

@inproceedings{aaai2026_stylebreak_108741,
  title = {{StyleBreak: Revealing Alignment Vulnerabilities in Large Audio-Language Models via Style-Aware Audio Jailbreak}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/41093},
}

@inproceedings{aaai2026_on_108812,
  title = {{On the Feasibility of Using MultiModal LLMs to Execute AR Social Engineering Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/41164},
}