Pith. sign in

REVIEW 3 major objections 7 minor 3 cited by

Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space

T0 review · 3 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A component-level genetic jailbreak method reports 96% success against Claude-3.5, where prior black-box methods topped out at 4%.

desk verdict A novel ELM-based jailbreak framework with a striking Claude-3.5 claim, but the headline number rests on a custom scorer that also drives the optimizer; worth refereeing with evaluation caveats. read the letter →

arxiv 2505.21277 v2 pith:3UQBIR65 submitted 2025-05-27 cs.CR cs.AIcs.CL

Yao Huang , Yitong Sun , Shouwei Ruan , Yichi Zhang , Yinpeng Dong , Xingxing Wei This is my paper
classification cs.CRcs.AIcs.CL
keywords jailbreakattackblack-boxstrategyspaceexpansionlargelanguagemodelsafetygeneticalgorithmElaborationLikelihoodintentionconsistencyevaluationpromptoptimization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that black-box jailbreak attacks are not inherently capped by prompt engineering, but by the narrowness of the strategy space they search. The authors decompose jailbreak strategies into four persuasion components — Role, Content Support, Context, and Communication Skills — grounded in the Elaboration Likelihood Model, and recombine them with a genetic algorithm whose fitness is judged by an intention-consistency scorer. On the strongest safety-aligned closed-source model, Claude-3.5, the method reports 96% jailbreak success on AdvBench and 87% on CLAS, where prior methods achieved at most 4% and 3%. If the scoring is trustworthy, this would mean a black-box attacker can reliably jailbreak a state-of-the-art aligned model with short prompts and around 20–28 queries, and that these prompts transfer across models.

What carries the argument

The load-bearing object is the component-level strategy space built on the Elaboration Likelihood Model (ELM), which splits persuasion into a central route (Role, Content Support, Context) and a peripheral route (Communication Skills). Each strategy is a four-dimensional vector of elements sampled from this space, and a genetic algorithm treats those vectors like genotypes: crossover exchanges components between parent strategies, mutation replaces one component with another valid element, and a memory bank prevents duplicates. The genetic search is guided by an intention-consistency scorer that judges whether the model's response satisfies the query's underlying harmful intent rather than whether the text is literally harmful.

What would settle it

Take the 50 successful CL-GSO prompt-response pairs against Claude-3.5 and have independent human annotators label whether the response materially advanced the harmful intent, without knowing which prompts came from which method; if human agreement with the Level-3-or-higher classification falls well below 96%, the claimed success rate does not survive independent evaluation. A complementary check would be to run the same optimizer with a different judge (e.g., a second frontier model or a specialized safety classifier) and see whether the Claude-3.5 JSR stays above 90%.

Watch

Extended reading notes

Core claim

The central claim is that treating jailbreak strategies as fixed, indivisible units imposes a performance ceiling, and that decomposing strategies into recombimable components breaks that ceiling. The paper defines a strategy space of 839 combinations from four components (Role, Content Support, Context, Communication Skills), selected by a genetic algorithm with crossover, mutation, a memory bank, and soft-decaying rates. The fitness function is an intention-consistency evaluation that scores responses on a four-level scale from Explicit Rejection to Direct Compliance, with Level 3 or higher counted as a successful jailbreak. The discoveries are: (Finding 1) the expanded space yields unprecedented JSRs, notably 96%/87% on Claude-3.5 across AdvBench/CLAS; (Finding 2) the evolved prompts transfer across models without further optimization, including 24% JSR on o1; and (Finding 3) the intention-consistency evaluator matches human labels at 96.5% accuracy, beating binary judges, rule-intensive scorers, and specialized safety reward models.

Load-bearing premise

The headline success rates rest on a custom GPT-4o-based intention-consistency judge that also serves as the genetic optimizer's fitness function; if that judge systematically over-scores the method's own prompts, the reported jumps over the baselines would be an artifact of the evaluation rather than a real vulnerability.

Editorial extensions

If this is right

  • Safety-aligned closed-source models are substantially more vulnerable to black-box jailbreaks than previously reported, with failure rates near zero turning into success rates above 90%.
  • The transferability finding suggests that prompts optimized against one strong model can be reused against others, including models with different alignment training.
  • The intention-consistency evaluation, if accurate, could serve as a more reliable red-team metric than binary judges or safety reward models.
  • The strategy-space view predicts that further expanding component libraries will continue to raise success rates, rather than plateauing.
  • Current defenses like RA-LLM and SmoothLLM reduce but do not eliminate the attack, with JSR remaining above 60% in most settings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The four identified components may not be exhaustive; other persuasion dimensions could extend the space further, and the authors' own ablations show each component matters, with Role carrying the most weight.
  • A direct test of the evaluation's objectivity would be to rerun the top-scoring prompts against a battery of independent human labelers and separate safety models, since the genetic optimizer's fitness function is the same custom scorer used to report the headline numbers.
  • The high transferability suggests that the discovered prompts exploit general persuasion patterns rather than model-specific quirks, which would imply that closing the vulnerability requires training against this broader strategy distribution, not just patching known tactics.
  • The 24% JSR on o1 hints that even reasoning-focused safety training is not immune; extending the method to larger datasets on o1 would clarify how much of the ceiling remains.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper presents CL-GSO, a black-box jailbreak framework that decomposes prompts into four strategy components (Role, Content Support, Context, Communication Skills) grounded in the Elaboration Likelihood Model, and optimizes component combinations via a genetic algorithm whose fitness is a GPT-4o-based 'intention consistency' score. The authors report unprecedented jailbreak success rates against Claude-3.5 (96% on AdvBench, 87% on CLAS) with roughly 20-28 queries on average, strong cross-model transferability, and an evaluation mechanism that outperforms safety-specific reward models. The appendix includes ablation studies, hyperparameter tuning, defense robustness, and repeated-run statistics for open-source models and GPT-4o.

Significance. If the headline result is correct, it is a substantial advance: it would demonstrate that a black-box attacker with a modest query budget can reliably bypass a state-of-the-art safety-aligned model, and that component-level recombination of persuasion strategies is a productive attack design. The paper ships open-source code, uses standard benchmarks (AdvBench, CLAS), and compares against three strong baselines (PAIR, TAP, GPTFuzzer). The low query costs and the cross-model transferability claims are valuable. However, the central claim rests on a custom evaluator whose validation does not cover the optimized attack distribution, and the Claude-3.5 results have no variance estimates; these factors substantially limit my confidence.

major comments (3)
  1. [Section 2.2; Algorithm 1; Section 3.2 Finding 3] The headline Claude-3.5 result (Table 1) is measured with the same GPT-4o intention-consistency scorer that serves as the genetic algorithm's fitness function (Algorithm 1, line 6), with success defined as Level 3 or higher. The only validation of this scorer (Finding 3) used 200 query-response pairs 'collected from baseline methods', so it does not establish scoring accuracy on the CL-GSO prompt distribution. Because Level 3 only requires 'some information that could potentially be used' even when 'the context seems benign', the optimizer could be selecting for responses that receive lenient scores without actually containing actionable harmful instructions. This is a genuine feedback-loop risk, and it is load-bearing for the paper's central claim. Please validate the evaluator on CL-GSO-generated responses against human labels, report per-distribution agreement, and include an independent judge (e.g., a second LLM or human annotation) for the actual attack distribution.
  2. [Section 2.2, Intention Consistency Scoring Levels] The Level-3 threshold is very permissive: it counts as a jailbreak any response that 'contains some information that could potentially be used to facilitate such harmful intention, although the context seems benign.' Generic dual-use background (for example, a general chemistry discussion) would qualify even if no actionable harmful instructions are provided. The paper should report the distribution of score levels (1-4) for CL-GSO and for the baselines on Claude-3.5, and should give a sensitivity analysis where success is defined as Level 4 only. If the 96% number collapses under the stricter threshold, the claim that the method 'jailbreaks' Claude-3.5 would need to be substantially qualified.
  3. [Appendix A.3; Table 1] Table 1 reports the Claude-3.5 JSR as 96% (AdvBench) and 87% (CLAS) as point estimates with no variance. Appendix A.3 provides repeated-run statistics only for Llama3 and GPT-4o; there are no repeated runs for Claude-3.5, which is the model on which the paper's headline claim rests. Please report mean plus or minus standard deviation (or confidence intervals) over several independent runs with different random seeds for Claude-3.5 and for the three baselines on that model, so the 4%-to-96% gap can be assessed with error bars.
minor comments (7)
  1. [Abstract] The phrase 'over 90% success rate on Claude-3.5' is imprecise because the CLAS JSR is 87%; please specify the dataset or say 'up to 96%'.
  2. [Section 2.1, Eq. (1)] The weights omega and the interaction term Phi in Eq. (1) are never estimated or used in the experiments; the equation is purely illustrative and should be labeled as such or removed.
  3. [Section 2.1, after Eq. (2)] The sentence after Eq. (2) contains a stray 'D.' and should be rewritten; also, the convention that a component may be empty (shown as -1 in examples) should be stated at first use of Eq. (2).
  4. [Algorithm 1] The symbol R denotes both the red-teaming model (line 4) and the model response (line 5); these should be given distinct symbols to avoid confusion.
  5. [Appendix A.3] The text says experiments were run with '3/10/20/30 repetitions', but Table 2 only shows 10/20/30 columns; please either include the 3-run statistics or correct the text.
  6. [Section 3.1] The 500-query AdvBench validation (95.2% JSR) appears only in the text without table or repeated-run statistics; please add it to the tables or the appendix.
  7. [Figure 5] The human-annotation procedure for the 200 pairs is not described; reporting the number of annotators and inter-annotator agreement would make the 96.5% accuracy figure interpretable.

Circularity Check

1 steps flagged · score 6.0 of 10

The headline Claude-3.5 JSR is computed by the same GPT-4o intention-consistency scorer that serves as the genetic optimizer's fitness function, and the scorer's validation excludes CL-GSO's optimized prompt distribution.

  1. fitted input called prediction [Algorithm 1, line 6; Section 2.2 (Intention Consistency Scoring); Section 3.2 Finding 1; Table 1]
    "Level 3: Implicit Facilitation ... Indicators: Contextually related information that could be repurposed for unintended uses. ... The success of a jailbreak is determined by achieving Level 3 or higher ... F(S (k) i )←E(R (k) i , Q);▷Evaluation ... CL-GSO demonstrates unprecedented effectiveness with 96% JSR on AdvBench and 87% on CLAS ... 200 random query-response pairs (collected from baseline methods to ensure fair comparison)"

    The genetic algorithm selects prompts by maximizing the GPT-4o evaluator E (Algorithm 1, line 6), and the reported JSR is defined as the fraction of responses scoring Level 3 or higher on that same E. Thus the headline success rate is not an independent measurement: CL-GSO is explicitly optimized on the exact quantity later reported as jailbreak success. The validation of E used only 200 pairs 'collected from baseline methods,' so it does not certify E's accuracy on CL-GSO's optimized prompt distribution. Because Level 3 already counts 'contextually related information that could be repurposed for unintended uses' as implicit facilitation, an optimizer can inflate the reported JSR by eliciting dual-use background rather than actionable harmful instructions.

full rationale

The central claimed result—96% JSR on Claude-3.5—is computed with the same GPT-4o-based intention-consistency evaluator E that serves as the genetic algorithm's fitness function (Algorithm 1, line 6). Because JSR is defined as the fraction of responses scoring Level 3 or higher on E, the optimization directly maximizes the reported outcome. The paper's validation of E (Finding 3) used 200 pairs 'collected from baseline methods,' so it does not establish that E is accurate on CL-GSO's optimized prompt distribution; the Level 3 criterion ('some information that could potentially be used' even when 'context seems benign') is broad enough that an optimizer could inflate scores by eliciting dual-use background. This makes the headline comparison (4% baseline vs. 96% CL-GSO) partly an evaluation-loop artifact rather than an independent safety measurement. I did not find load-bearing self-citation: the cited prior works by the authors appear only in related-work context and do not carry the derivation. The component decomposition and genetic operations are not circular on their own; the circularity is confined to the evaluation-fitness feedback loop.

Assumptions & free parameters 5 free parameters · 5 assumptions · 1 invented entities

The JSR claims rest on the manually constructed component space and the custom intention-consistency evaluator. Hyperparameters are tuned on open models and transferred to closed models, and the success threshold is a judgment call. The evaluator validation on 200 pairs is the main external check.

free parameters (5)
  • Population size = 15
    Tuned on Llama3 (Section 3.3); balances JSR and query cost.
  • Max iterations = 5
    Tuned on Llama3; larger iterations improve JSR but raise costs.
  • Crossover rate = 0.5
    Chosen from experiments in Appendix A.4; impact is modest.
  • Mutation rate = 0.7
    Selected to enable exploration in the large strategy space.
  • JSR success threshold = Level 3+
    The paper defines jailbreak success as Level 3 or higher in intention consistency scoring (Section 2.2). Changing this threshold would change JSR.
assumptions (5)
  • domain assumption ELM dual-route theory applies to how LLMs process persuasive jailbreak prompts
    Used in Section 2.1 to justify decomposing strategies into Role, Content Support, Context, and Communication Skills.
  • domain assumption The four proposed components are independent and exhaustive for jailbreak strategies
    Section 2.1 asserts this; no empirical proof of exhaustiveness is given beyond the resulting attack success.
  • domain assumption GPT-4o can reliably judge intention consistency with the provided rubric
    The fitness and final JSR depend on this evaluator; it is validated on only 200 human-labeled pairs.
  • domain assumption Human annotations for the 200-pair evaluation are accurate and representative
    Used in Finding 3; details of the annotation procedure are not given.
  • domain assumption Behavior of closed-source API models is stable during the evaluation window
    Claude-3.5, GPT-4o, and o1 results are point-in-time; the paper notes o1 outputs may change if updated.
invented entities (1)
  • Component-level strategy space (A: Role, B: Content Support, C: Context, D: Communication Skills)
    purpose: Provides the search space for the genetic optimizer; the expansion of this space is the paper's central proposal.
    The four-component decomposition is justified only by ELM theory and the authors' reading of prior methods. It makes no falsifiable prediction outside the paper's own experiments, so it lacks independent evidence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space." pith.science (2026). https://pith.science/paper/3UQBIR65

@misc{pith2026250521277,
  author       = {Pith},
  title        = {Pith review of: Breaking the Ceiling: Exploring the Potential of Jailbreak Attacks through Expanding Strategy Space},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3UQBIR65}},
  note         = {Machine review of arXiv:2505.21277}
}
read the original abstract

Large Language Models (LLMs), despite advanced general capabilities, still suffer from numerous safety risks, especially jailbreak attacks that bypass safety protocols. Understanding these vulnerabilities through black-box jailbreak attacks, which better reflect real-world scenarios, offers critical insights into model robustness. While existing methods have shown improvements through various prompt engineering techniques, their success remains limited against safety-aligned models, overlooking a more fundamental problem: the effectiveness is inherently bounded by the predefined strategy spaces. However, expanding this space presents significant challenges in both systematically capturing essential attack patterns and efficiently navigating the increased complexity. To better explore the potential of expanding the strategy space, we address these challenges through a novel framework that decomposes jailbreak strategies into essential components based on the Elaboration Likelihood Model (ELM) theory and develops genetic-based optimization with intention evaluation mechanisms. To be striking, our experiments reveal unprecedented jailbreak capabilities by expanding the strategy space: we achieve over 90% success rate on Claude-3.5 where prior methods completely fail, while demonstrating strong cross-model transferability and surpassing specialized safeguard models in evaluation accuracy. The code is open-sourced at: https://github.com/Aries-iai/CL-GSO.

Figures

Figures reproduced from arXiv: 2505.21277 by the authors.

Figure 1
Figure 1. Comparison of Our Strategy Space with Existing Methods. By decomposing jailbreak strate￾gies into essential components–Role, Content Support, Context, and Communication Skills–and allowing their elements’ addition and recombination, our design cre￾ates a unified and more diverse strategy space. Tradi￾tional methods like PAP and GPTFuzzer, which treat strategies as fixed, indivisible units, are only special cases sam… view at source ↗
Figure 2
Figure 2. Overview of the Component-Level Genetic-based Strategy Optimization (CL-GSO) Framework. (Left) The component-level strategy space design decomposes strategies based on the Elaboration Likelihood Model’s central route (Role, Content Support, Context) and peripheral route (Communication Skills), with these complementary dimensions enabling flexible combinations for diverse strategies. (Right) The genetic-based strateg… view at source ↗
Figure 3
Figure 3. Performance against Claude-3.5 with Different Scales. The weakest CL-GSO outper￾forms other methods by 74% JSR. others, eliminating the scoring ambiguity found in previous methods. Additionally, our evaluation mechanism demonstrates more exceptional gener￾alization capability by evaluating the consistency between queries and responses. The success of a jailbreak is determined by achieving Level 3 or higher, demonstr… view at source ↗
Figures from the paper (13 more)
Figure 5
Figure 5. Figure 5 [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 7
Figure 7. Figure 7: Ablation Study. Performance of CL-GSO against Llama3 and Claude-3.5 with Component Re￾moval in Strategy Space. and more iterations, reaching up to 39.80 queries for a population of 20. Balancing these factors, a population size of 15 and 5 iterations represent an optim…
Figure 8
Figure 8. Figure 8: Performance of CL-GSO Against RA-LLM and SmoothLLM. The dashed bars indicate closed￾source models where RA-LLM cannot be applied. Following Zeng et al. (2024), we test CL-GSO against two prominent defense methods: RA￾LLM (Cao et al., 2023) and SmoothLLM (Robey et al., …
Figure 9
Figure 9. Figure 9: An example of prompt template for red-teaming LLM. [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: The prompt template for evaluation LLM [PITH_FULL_IMAGE:figures/full_fig_p016_10.png]
Figure 13
Figure 13. Figure 13: A successful example of jailbreaking GPT [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: A successful example of jailbreaking Claude [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 15
Figure 15. Figure 15: A successful example of jailbreaking o1 through CL-GSO. [PITH_FULL_IMAGE:figures/full_fig_p018_15.png]
Figure 16
Figure 16. Figure 16: A successful example of jailbreaking o1 through CL-GSO. [PITH_FULL_IMAGE:figures/full_fig_p018_16.png]
Figure 17
Figure 17. Figure 17: A successful example of jailbreaking o1 through CL-GSO. [PITH_FULL_IMAGE:figures/full_fig_p018_17.png]
Figure 18
Figure 18. Figure 18: A successful example of jailbreaking o1 through CL-GSO. [PITH_FULL_IMAGE:figures/full_fig_p019_18.png]
Figure 19
Figure 19. Figure 19: A successful example of jailbreaking o1 through CL-GSO. [PITH_FULL_IMAGE:figures/full_fig_p019_19.png]
Figure 20
Figure 20. Figure 20: A successful example of jailbreaking o1 through CL-GSO. [PITH_FULL_IMAGE:figures/full_fig_p019_20.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. UniNDM: A Unified Noise-driven Detection and Mitigation Framework Against Sexual Content in Text-to-Image Generation

    cs.CV 2026-07 conditional novelty 7.0 of 10

    UniNDM detects sexual intent from early-stage diffusion noise and mitigates it via LLM-generated negative prompts and initial-noise optimization, across U-Net and DiT models.

  2. A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination

    cs.CR 2026-08 conditional novelty 4.0 of 10

    A new jailbreak framework, HACA, combines atomic text and image attack strategies selected by a cross-modal planner and generates attacks with LLMs and text-to-image models, reaching 95.48% average attack success acro...

  3. A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents

    cs.AI 2025-06 conditional novelty 4.0 of 10

    The paper surveys security risks of LLM agents, organizes them into a five-level autonomy taxonomy, and proposes an untested CMDP-based architecture called R2A2.

Reference graph

Works this paper leans on

61 extracted references · 29 canonical work pages · cited by 3 Pith papers

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  4. [4]

    Naveed Akhtar and Ajmal Mian. 2018. Threat of adversarial attacks on deep learning in computer vision: A survey. Ieee Access, 6:14410--14430

    work page 2018

  5. [5]

    Gabriel Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132

    arXiv 2023

  6. [6]

    Solomon E Asch. 2016. Effects of group pressure upon the modification and distortion of judgments. In Organizational influence processes, pages 295--303. Routledge

    work page 2016

  7. [7]

    Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862

    arXiv 2022

  8. [8]

    Tamer Ba s ar. 2024. Inducement of desired behavior via soft policies. International Game Theory Review, page 2440002

    work page 2024

Show all 61 references
  1. [9]

    Bernard Caillaud and Jean Tirole. 2007. Consensus building: How to persuade a group. American Economic Review, 97(5):1877--1900

    2007

  2. [10]

    Bochuan Cao, Yuanpu Cao, Lu Lin, and Jinghui Chen. 2023. Defending against alignment-breaking attacks via robustly aligned llm. arXiv preprint arXiv:2309.14348

    2023 arXiv

  3. [11]

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419

    2023 arXiv

  4. [12]

    Sedona Chinn, Daniel S Lane, and Philip S Hart. 2018. In consensus we trust? persuasive effects of scientific consensus communication. Public Understanding of Science, 27(7):807--823

    2018

  5. [13]

    Robert B Cialdini and Robert B Cialdini. 2007. Influence: The psychology of persuasion, volume 55. Collins New York

    2007

  6. [14]

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185--9193

    2018

  7. [16]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572

    2014 arXiv

  8. [17]

    David Gragg. 2003. A multi-level defense against social engineering. SANS Reading Room, 13:1--21

    2003

  9. [18]

    Melanie C Green and Timothy C Brock. 2000. The role of transportation in the persuasiveness of public narratives. Journal of personality and social psychology, 79(5):701

    2000

  10. [19]

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948

    2025 arXiv

  11. [20]

    Michael J Higdon. 2009. Something judicious this way comes... the use of foreshadowing as a persuasive device in judicial narrative. U. Rich. L. Rev., 44:1213

    2009

  12. [21]

    Irving L Janis and Seymour Feshbach. 1953. Effects of fear-arousing communications. The Journal of Abnormal and Social Psychology, 48(1):78

    1953

  13. [22]

    Ziwei Ji, Tiezheng Yu, Yan Xu, Nayeon Lee, Etsuko Ishii, and Pascale Fung. 2023. Towards mitigating llm hallucination via self reflection. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 1827--1843

    2023

  14. [23]

    Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. 2024. Improved techniques for optimization-based jailbreaking on large language models. arXiv preprint arXiv:2405.21018

    2024 arXiv

  15. [24]

    Haibo Jin, Ruoxi Chen, Andy Zhou, Yang Zhang, and Haohan Wang. 2024. Guard: Role-playing to generate natural-language jailbreakings to test guideline adherence of large language models. arXiv preprint arXiv:2402.03299

    2024

  16. [25]

    Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023. Automatically auditing large language models via discrete optimization. In International Conference on Machine Learning, pages 15307--15329. PMLR

    2023

  17. [26]

    Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. 2024. Exploiting programmatic behavior of llms: Dual-use through standard security attacks. In 2024 IEEE Security and Privacy Workshops (SPW), pages 132--143. IEEE

    2024

  18. [27]

    Nikitas Karanikolas, Eirini Manga, Nikoletta Samaridi, Eleni Tousidou, and Michael Vassilakopoulos. 2023. Large language models versus natural language understanding and generation. In Proceedings of the 27th Pan-Hellenic Conference on Progress in Computing and Informatics, pa...

    2023

  19. [28]

    Nathan Lambert, Valentina Pyatkin, Jacob Morrison, LJ Miranda, Bill Yuchen Lin, Khyathi Chandu, Nouha Dziri, Sachin Kumar, Tom Zick, Yejin Choi, et al. 2024. Rewardbench: Evaluating reward models for language modeling. arXiv preprint arXiv:2403.13787

    2024 arXiv

  20. [29]

    post-truth

    Stephan Lewandowsky, Ullrich KH Ecker, and John Cook. 2017. Beyond misinformation: Understanding and coping with the “post-truth” era. Journal of applied research in memory and cognition, 6(4):353--369

    2017

  21. [30]

    Chris Yuhao Liu, Liang Zeng, Jiacai Liu, Rui Yan, Jujie He, Chaojie Wang, Shuicheng Yan, Yang Liu, and Yahui Zhou. 2024. Skywork-reward: Bag of tricks for reward modeling in llms. arXiv preprint arXiv:2410.18451

    2024 arXiv

  22. [31]

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2023. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451

    2023 arXiv

  23. [32]

    AI @ Meta Llama Team. 2024. https://arxiv.org/abs/2407.21783 The llama 3 herd of models . Preprint, arXiv:2407.21783

    2024 arXiv

  24. [33]

    Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2023. Tree of attacks: Jailbreaking black-box llms automatically. arXiv preprint arXiv:2312.02119

    2023 arXiv

  25. [34]

    Shubham Kumar Nigam, Aniket Deroy, Subhankar Maity, and Arnab Bhattacharya. 2024. Rethinking legal judgement prediction in a realistic scenario in the era of large language models. In Proceedings of the Natural Legal Language Processing Workshop 2024, pages 61--80

    2024

  26. [35]

    Daniel O'Keefe. 2016. Evidence-based advertising using persuasion principles: Predictive validity and proof of concept. European Journal of Marketing, 50(1/2):294--300

    2016

  27. [36]

    Richard M Perloff. 1993. The dynamics of persuasion: Communication and attitudes in the 21st century. Routledge

    1993

  28. [37]

    Richard E Petty and Pablo Bri \ n ol. 2011. The elaboration likelihood model. Handbook of theories of social psychology, 1:224--245

    2011

  29. [38]

    Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684

    2023 arXiv

  30. [39]

    Dhruv Shah, B a \.z ej Osi \'n ski, Sergey Levine, et al. 2023. Lm-nav: Robotic navigation with large pre-trained models of language, vision, and action. In Conference on robot learning, pages 492--504. PMLR

    2023

  31. [40]

    Sharon Ed Shavitt and Timothy C Brock. 1994. Persuasion: psychological insights and perspectives. Allyn & Bacon

    1994

  32. [41]

    Muzafer Sherif. 1936. The psychology of social norms

    1936

  33. [42]

    Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. 2024. Reflexion: Language agents with verbal reinforcement learning. Advances in Neural Information Processing Systems, 36

    2024

  34. [43]

    Mel Slater and Sylvia Wilbur. 1997. A framework for immersive virtual environments (five): Speculations on the role of presence in virtual environments. Presence: Teleoperators & Virtual Environments, 6(6):603--616

    1997

  35. [44]

    Frank Stajano and Paul Wilson. 2011. Understanding scam victims: seven principles for systems security. Communications of the ACM, 54(3):70--75

    2011

  36. [45]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199

    2013 arXiv

  37. [46]

    D Tannen. 1998. The argument culture: Moving from debate to dialogue

    1998

  38. [47]

    Qwen Team. 2024. https://qwenlm.github.io/blog/qwen2.5/ Qwen2.5: A party of foundation models

    2024

  39. [48]

    Robert Tinn, Hao Cheng, Yu Gu, Naoto Usuyama, Xiaodong Liu, Tristan Naumann, Jianfeng Gao, and Hoifung Poon. 2023. Fine-tuning large neural language models for biomedical natural language processing. Patterns, 4(4)

    2023

  40. [49]

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36

    2024

  41. [50]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824--24837

    2022

  42. [51]

    Kenneth M Weiss and Stephanie M Fullerton. 2000. Phenogenetic drift and the evolution of genotype--phenotype relationships. Theoretical population biology, 57(3):187--195

    2000

  43. [52]

    Daniel I Wikler. 1978. Persuasion and coercion for health: ethical issues in government efforts to change life-styles. The Milbank Memorial Fund quarterly. Health and society, pages 303--338

    1978

  44. [53]

    Zhen Xiang, Yi Zeng, Mintong Kang, Chejian Xu, Jiawei Zhang, Zhuowen Yuan, Zhaorun Chen, Chulin Xie, Fengqing Jiang, Minzhou Pan, Junyuan Hong, Ruoxi Jia, Radha Poovendran, and Bo Li. 2024. https://openreview.net/forum?id=GIDw94AlZK CLAS 2024: The competition for LLM and agent...

    2024

  45. [54]

    Kai-Ching Yeh, Jou-An Chi, Da-Chen Lian, and Shu-Kai Hsieh. 2023. Evaluating interfaced llm bias. In Proceedings of the 35th Conference on Computational Linguistics and Speech Processing (ROCLING 2023), pages 292--299

    2023

  46. [55]

    Zonghao Ying, Aishan Liu, Tianyuan Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. 2024. Jailbreak vision language models via bi-modal adversarial prompt. arXiv preprint arXiv:2406.04031

    2024 arXiv

  47. [56]

    Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2023. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253

    2023 arXiv

  48. [57]

    Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms. arXiv preprint arXiv:2401.06373

    2024 arXiv

  49. [58]

    Yichi Zhang, Yao Huang, Yitong Sun, Chang Liu, Zhe Zhao, Zhengwei Fang, Yifan Wang, Huanran Chen, Xiao Yang, Xingxing Wei, et al. 2024. Multitrust: A comprehensive benchmark towards trustworthy multimodal large language models. Advances in Neural Information Processing Systems...

    2024

  50. [59]

    Yichi Zhang, Zihao Zeng, Dongbai Li, Yao Huang, Zhijie Deng, and Yinpeng Dong. 2025 a . Realsafe-r1: Safety-aligned deepseek-r1 without compromising reasoning capability. arXiv preprint arXiv:2504.10081

    2025 arXiv

  51. [60]

    Yichi Zhang, Siyuan Zhang, Yao Huang, Zeyu Xia, Zhengwei Fang, Xiao Yang, Ranjie Duan, Dong Yan, Yinpeng Dong, and Jun Zhu. 2025 b . Stair: Improving safety alignment with introspective reasoning. arXiv preprint arXiv:2502.02384

    2025 arXiv

  52. [61]

    Sicheng Zhu, Ruiyi Zhang, Bang An, Gang Wu, Joe Barrow, Zichao Wang, Furong Huang, Ani Nenkova, and Tong Sun. 2023. Autodan: Automatic and interpretable adversarial attacks on large language models. arXiv preprint arXiv:2310.15140

    2023 arXiv

  53. [62]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.