Research map / Large language models / Language, safety and interpretability
Jailbreak attacks and defenses
Craft automated, multi-turn, and out-of-distribution jailbreaks and defend against them.
57 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2023–2026) · an approach in Language, safety and interpretability, keyword cluster “representations · interpretability · heads”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
11 papers in 2023–24 and 46 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 1.6% to 2.5%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2023 · Jailbroken: How Does LLM Safety Training Fail? (NeurIPS 2023 · 130 citations)
- 2024 · Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (NeurIPS 2024 · 55 citations)
- 2025 · Multi-Turn Jailbreaking Large Language Models via Attention Shifting (AAAI 2025 · 13 citations)
- 2026 · MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety (ICML 2026 · 1 citation)
Earliest papers here
- Jailbroken: How Does LLM Safety Training Fail? (NeurIPS 2023 · 130 citations)
- Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (NeurIPS 2024 · 55 citations)
- AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models (ICLR 2024 · 27 citations)
What has been tried
26 papers here report 273 measured changes (a component added, removed or swapped, compared with a baseline): helped 66%, no clear effect 6%, hurt 23%, mixed 4%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add branching (branching factor 4 rather than 1) | AdvBench Subset · jailbreak rate | 48% -> 84% | Helped | Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (NeurIPS 2024 · 55 citations) |
| Use machine-translated rather than human-translated prompts | MultiJail, unintentional scenario, Avg. 9 non-English languages · unsafe rate | 10.19% to 11.15% | Hurt | Multilingual Jailbreak Challenges in Large Language Models (ICLR 2024 · 16 citations) |
| Remove the system prompt | OurData · ASR | 0% to more than 95% | Helped | Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation (ICLR 2024 · 11 citations) |
| Replace image-mixing transformations with RandAug non-mixing transformations | Advbench-M scenarios · ASR and harmfulness | Hurt | Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · 10 citations) | |
| add a jailbreak prefix | JAMBench / Hate and Fairness Medium · jailbreak success rate | 26% -> 83% | Helped | Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters (NeurIPS 2024 · 5 citations) |
| add gradient-based Critical Set selection rather than selecting soft-removal tokens randomly | Vicuna-7B-V1.5, jailbreak attacks · average ASR | 0.550 -> 0.142 | Helped | Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models (AAAI 2025 · 4 citations) |
| Increase the scaling factor α | JailbreakBench · DSR | Helped | Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · 4 citations) | |
| Use harmful guidance in the optimization target | AdvBench (LLAMA2-7B-CHAT) · ASR | 54% -> 82% | Helped | Improved Techniques for Optimization-Based Jailbreaking on Large Language Models (ICLR 2025 · 3 citations) |
| Use adaptive sparsity instead of constant sparsity | AdvBench harmful behaviors, Vicuna-v1.5-7B · ASR | constant = 1: 63.1; constant = 2: 98.8; constant = 3: 98.5; adaptive (ours): 99.8 | Helped | Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization (NeurIPS 2024 · 3 citations) |
| Use both CVT and CIT rather than CVT only | JailbreakBench · ASR-O | 0.79 -> 0.95 | Helped | Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency (NeurIPS 2025 · 1 citation) |
| Add CoT to Vanilla | Claude 3.5 Sonnet · ASR-GPT | +16.92% | Helped | FlipAttack: Jailbreak LLMs via Flipping (ICML 2025 · 0 citations) |
| Add positive affirmation to MSJ | AdvBench · ASR-L | 86.15 -> 92.12 | Helped | PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Sampling (ICML 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 24 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- AdvBench · 9 of 24 papers
- HarmBench · 6 of 24 papers
- JailbreakBench · 4 of 24 papers
- AdvBench harmful behaviors · 2 of 24 papers
- GSM8K · 2 of 24 papers
- MMLU · 2 of 24 papers
Baselines
- PAIR · 11 of 24 papers
- GCG · 8 of 24 papers
- AutoDAN · 8 of 24 papers
- TAP · 7 of 24 papers
- ReNeLLM · 4 of 24 papers
- GCG-T · 3 of 24 papers
- PEZ · 3 of 24 papers
- GBDA · 3 of 24 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 57 papers; from OpenAlex and the papers' affiliations).
- University of California, Berkeley · 4 papers
- Google · 3 papers
- IBM · 2 papers
- The Chinese University of Hong Kong · 2 papers
- Nanyang Technological University · 2 papers
- Alibaba Group · 2 papers
- University of Oxford · 2 papers
- University of Illinois, Urbana Champaign · 2 papers
Use it
Download BibTeX of 21 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Safety alignment of LLMs (123 papers)
- Mechanistic analysis of attention and representations (43 papers)
Elsewhere in the topic
- LLM unlearning and benchmarks (298 papers)
- LLM pruning and scaling data (285 papers)
- Controlled text generation (220 papers)
- Faithfulness of LLM explanations (169 papers)
- Data and evaluation methodology (136 papers)
- Uncertainty quantification for LLMs (136 papers)
- Pruning and circuits in LLMs (135 papers)
- Statistical frameworks for LLM evaluation (124 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).