Research map / Large language models / Language, safety and interpretability
Jailbreak elicitation and risk
Elicit harmful outputs through interaction, many-shot, and weak-to-strong jailbreaks.
21 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2024–2026) · an approach in Language, safety and interpretability, keyword cluster “safety · jailbreak · harmful”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
6 papers in 2023–24 and 15 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic held steady, from 0.9% to 0.8%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2024 · Many-shot Jailbreaking (NeurIPS 2024 · 21 citations)
- 2025 · DiveR-CT: Diversity-enhanced Red Teaming Large Language Model Assistants with Relaxing Constraints (AAAI 2025 · 2 citations)
- 2026 · PersistBench: When Should Long-Term Memories Be Forgotten by LLMs? (ICML 2026 · 0 citations)
Earliest papers here
- Many-shot Jailbreaking (NeurIPS 2024 · 21 citations)
- WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models (NeurIPS 2024 · 13 citations)
- Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses (NeurIPS 2024 · 6 citations)
What has been tried
16 papers here report 182 measured changes (a component added, removed or swapped, compared with a baseline): helped 60%, no clear effect 6%, hurt 27%, mixed 7%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| swap the user and assistant tags | Opportunities to Insult · NLL of harmful response | Mixed | Many-shot Jailbreaking (NeurIPS 2024 · 21 citations) | |
| Add off-topic and low-risk pruners | HarmBench test set · attack performance | Helped | WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models (NeurIPS 2024 · 13 citations) | |
| Add demo-level random search | AdvBench, 8-shot · rule-based ASR | 38% -> 100% | Helped | Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses (NeurIPS 2024 · 6 citations) |
| Constrain gibberish instead of maximizing gibberish reward | Red teaming, d_safe=-0.7 · Self-BLEU | 0.811 -> 0.834 | Helped | DiveR-CT: Diversity-enhanced Red Teaming Large Language Model Assistants with Relaxing Constraints (AAAI 2025 · 2 citations) |
| use a fine-tuned unsafe small model rather than the base model as the unsafe guide | AdvBench · ASR (%) | 39.8 -> 99.4 | Helped | Weak-to-Strong Jailbreaking on Large Language Models (ICML 2025 · 2 citations) |
| Remove the default system prompt | Safety landscape · Visage | 85.32 -> 80.68; 4.64 pp drop | Hurt | Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models (NeurIPS 2024 · 2 citations) |
| automatically select perturbation hyperparameters rather than manually choosing them | reported attack settings · ASR-useful | 2%~10% | Helped | Uncovering Safety Risks of Large Language Models through Concept Activation Vector (NeurIPS 2024 · 2 citations) |
| ablate the refusal vector extracted from English | PolyRefuse safety-aligned languages · compliance rate | increases from 0.57 to 0.87 | Hurt | Refusal Direction is Universal Across Safety-Aligned Languages (NeurIPS 2025 · 1 citation) |
| Vary the continuity weight lambda | PAIR attacks on Vicuna-13B · ASR | No clear effect | Protecting Your LLMs with Information Bottleneck (NeurIPS 2024 · 1 citation) | |
| Use score-ranked yes-biased instructions rather than randomly selected instructions | AdvBench · ASR (GPT-4) | Helped | Investigating the Security Threat Arising from “Yes-No” Implicit Bias in Large Language Models (AAAI 2025 · 0 citations) | |
| Increase the number of aggregated sub-concepts from k = 2 toward k = 6 | Intent reconstruction across tested models · comprehension rate | below 80%; approximately 100% | Helped | Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs (ICML 2025 · 0 citations) |
| Split words to induce token segmentation bias | 1,432 harmful responses, 8 Judge LLMs · unsafe prediction ratio (average) | 84.4% -> 75.5% | Helped | Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection (ICML 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 12 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- AdvBench · 5 of 12 papers
- MaliciousInstruct · 2 of 12 papers
- SORRY-Bench · 2 of 12 papers
Baselines
- DeepInception · 3 of 12 papers
- GCG · 3 of 12 papers
- JailBroken · 2 of 12 papers
- CodeChameleon · 2 of 12 papers
- ReNeLLM · 2 of 12 papers
- AutoDAN · 2 of 12 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 21 papers; from OpenAlex and the papers' affiliations).
- Carnegie Mellon University · 3 papers
- Meta · 3 papers
- University of California, Berkeley · 3 papers
- Tsinghua University · 2 papers
- Sea AI Lab · 2 papers
- Columbia University · 2 papers
- Massachusetts Institute of Technology · 2 papers
Use it
Download BibTeX of 20 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Uncertainty quantification for LLMs (136 papers)
- Statistical frameworks for LLM evaluation (124 papers)
- Bias measurement and mitigation (59 papers)
Elsewhere in the topic
- LLM unlearning and benchmarks (298 papers)
- LLM pruning and scaling data (285 papers)
- Controlled text generation (220 papers)
- Faithfulness of LLM explanations (169 papers)
- Data and evaluation methodology (136 papers)
- Pruning and circuits in LLMs (135 papers)
- Safety alignment of LLMs (123 papers)
- Linguistic encoding in LLM representations (123 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).