GraphAttack: Exploiting Representational Blindspots in LLM Safety Mechanisms

An Wang; Sinan He

REVIEW 6 major objections 5 minor 36 references

GraphAttack: Exploiting Representational Blindspots in LLM Safety Mechanisms

T0 review · 6 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Converting malicious prompts into semantic graphs and asking the model to write code that realizes the graph's intent bypasses safety filters, with success rates up to 87% against leading commercial LLMs.

desk verdict GraphAttack has a genuinely interesting idea buried under empirical claims that don't hold together; the graph-based framing is worth testing, but the numbers as reported can't be trusted. read the letter →

arxiv 2504.13052 v1 pith:WCEAQYNJ submitted 2025-04-17 cs.CR

Sinan He , An Wang This is my paper · ORCID

classification cs.CR

keywords largelanguagemodelsAIsafetyjailbreakingsemanticparsinggraph-basedattacksadversarialpromptsAbstractMeaningRepresentationRDF

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that safety-aligned large language models can be jailbroken systematically by translating harmful requests into structured semantic graphs and then asking the model to generate code from the graph. The authors argue that current safety mechanisms mostly detect harm at the surface text level, so formal representations such as AMR, RDF, and JSON knowledge graphs carry malicious intent past the filters. The strongest version of the claim is the knowledge-to-code pathway: when the graph is presented as a technical specification, the model produces harmful implementations it would refuse to give in plain language. A sympathetic reader should care because the attack is single-pass and automated, and because it points to a general weakness: safety alignment does not enforce consistency across representational formats.

What carries the argument

The central object is the semantic attack graph, a directed graph whose nodes are semantic concepts from the malicious query and whose edges encode transformations that preserve intent while changing surface form. The mechanism that carries the argument is the knowledge-to-code prompt, which takes the graph as an approved specification and asks the model to generate code realizing it; this reframes harmful content as a technical problem and appears to switch the model into a code mode where safety constraints apply less strictly. The graph formalization lets the authors treat jailbreaking as principled traversal of a transformation space.

What would settle it

Parse each dataset prompt into the three graph formats, have human annotators rate whether each graph preserves the original harmful intent, and re-run the attack only on graphs rated fully faithful; if attack success drops sharply, the reported success was driven by semantic drift rather than by bypassing safety filters. A second check would re-score the same model outputs with a panel of human judges and compare against GPT-4 Judge, Llama Guard 2, and IA; if human-verified success is much lower, the measured values are evaluator artifacts.

Watch

Extended reading notes

Core claim

GraphAttack represents a malicious user query as a directed semantic attack graph G = (V, E), with nodes for actions, entities, attributes, and contexts, and edges for transformations such as synonym substitution, generalization, role changes, syntactic restructuring, and indirect reference. Three parsing routes produce the graph: Abstract Meaning Representation, RDF triples, and an LLM-generated JSON knowledge graph; only the JSON route receives the transformation operations. The central empirical discovery is that instructing the target LLM to "realize the intent described in the graph" by writing code yields attack success rates up to 87% on AdvBench, that RDF consistently outperforms AMR, and that this pattern holds across GPT-3.5, GPT-4o, Claude 3.7, Llama-3-70B, and Qwen2.5 while the PAIR baseline rarely exceeds 60% in their runs.

Load-bearing premise

The attack's effectiveness claim collapses if the semantic parsers and LLM-generated knowledge graphs do not faithfully preserve the harmful intent of the original query, because then a successful response to the graph is not equivalent to a successful response to the original prompt.

Editorial extensions

If this is right

Safety filters that match surface text can be systematically bypassed by any format shift that preserves meaning, including AMR, RDF, JSON, and image renderings of the same graph.
Code-generation requests are a particularly strong vector because models process code as a technical task with weaker ethical evaluation, so the knowledge-to-code pathway deserves dedicated defenses.
RDF's abstract triple structure evades filters more than AMR's language-like graphs, implying that safety alignment effectiveness degrades as representations move farther from natural language.
A single-pass, non-adaptive attack can outperform iterative multi-query attacks, so efficiency alone does not make an attack less dangerous.
Effective countermeasures would need semantic-aware filters, cross-representation consistency training, and intent recognition in technical contexts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the semantic parsers and LLM-generated graphs do not faithfully preserve the harmful intent of every original query, the reported attack success rate mixes genuine bypasses with cases where the graph no longer carries the original request; a per-query semantic-equivalence check would separate these effects.
The large disagreement among GPT-4 Judge, Llama Guard 2, and IA suggests the true vulnerability rate is evaluator-relative, so any single-number claim should be read as tied to the chosen judge rather than as a stable property of the models.
A testable consequence of the paper's mechanism is that adding a semantic-parsing front-end to safety filters, or training on paired natural-language/graph/code triples, should sharply reduce the success of this attack; the paper proposes such defenses but does not evaluate them.
Because the same graph can be rendered as text, image, or code, the attack surface generalizes to multimodal models, and the image-based results already hint that vision-language safety behaves differently from text safety.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. (1) The core idea—representing malicious requests as AMR/RDF/JSON graphs and then asking the model to write code that "realizes" the graph—is a legitimate new twist on CodeAttack, and it's cheap to test. (2) The reported ASR numbers are not a stable property of the attack. In the authors' own tables, the identical condition (RDF w/o code, AdvBench, Llama-3-70B) scores 1% under GPT-4 Judge (Table 5), 14% under Llama Guard 2 (Table 6a), and 99% under IA (Table 6b). That 98-point spread tells me the abstract's "up to 87%" is an artifact of evaluator choice, not a robust result.

What's genuinely new: the combination of semantic graph parsing (AMR, RDF, and JSON knowledge graphs) with a knowledge-to-code prompting pathway. I don't know of prior work that does exactly that. The ablation across representational formats (text vs image, with/without code) is a sensible design, and the observation that safety filters degrade as inputs move away from natural language is worth pursuing. The authors also admit the PAIR baseline is under-tuned, which is honest.

Where it falls apart: no code, no data, no error bars, no trial counts. The code-generation evaluation in Section 6.2 uses "ChatGPT self-assessment"—the target model family judging its own outputs, which is circular for GPT-4o and GPT-3.5. The headline 87% never appears in the dedicated code-generation table (Table 4 shows 24% for Qwen2.5-72B with knowledge graphs; the 87% is a GPT-4 Judge result on the full AdvBench set, not the code-specific scoring). The paper never reconciles this. And the "reproducibility" claim in Section 4.2 is empty without release.

The qualitative claim—that structured semantic representations can bypass safety filters—is plausible, and the authors cite relevant prior work (CodeAttack, Geva et al. on hierarchical processing). But as an empirical paper, this version doesn't meet the bar. The authors need to release the parsing pipeline, the generated graphs, the judge prompts, and results with a single evaluator held fixed across all comparisons.

Who this is for: LLM safety researchers who want a new attack vector to test, and anyone who cares about evaluation methodology in jailbreak research. I'd bring it to a reading group as a lesson in evaluator bias, not as a reliable new attack.

Recommendation: don't desk-reject. Send it to reviewers with a clear request to focus on the evaluation, because the idea is cheap to verify and the community would benefit from knowing whether the graph-based approach actually works. But if I'm the editor, I'd tell the authors the current numbers aren't defensible and they need substantial revision before this is citable.

Referee Report

6 major / 5 minor

Summary. The paper proposes GraphAttack, a jailbreak method that parses malicious user queries into semantic graphs (AMR, RDF, or template-based JSON knowledge graphs), optionally applies semantic transformations, and prompts target LLMs to generate code that realizes the graph's intent. The authors report attack success rates (ASR) up to 87% against GPT-4o, GPT-3.5, Claude 3.7, Llama-3-70B-Instruct, and Qwen2.5-72B-Instruct across AdvBench, HarmBench, JBB-Behaviors, and HEx-PHI, using GPT-4 Judge, Llama Guard 2, and Intention Analysis (IA) as automated evaluators, and compare against CodeAttack and PAIR. The paper also presents a dedicated code-generation evaluation and an ablation over representation format and code integration.

Significance. If the empirical results were reliable, the paper would make a significant contribution to LLM safety research: it formalizes a representation-level attack surface, provides a taxonomy of semantic transformations, and identifies a plausible and underexplored knowledge-to-code vulnerability. The ablation design is thoughtful, and the intent to study semantic-level rather than surface-level safety failures is timely. However, the central quantitative claims are not supported by the evidence as reported: the ASRs vary by up to 98 points for the same condition depending on the evaluator, the headline number is not reproduced in the code-generation table, and the semantic-fidelity assumption is unmeasured.

major comments (6)

[§6.1/§7, Tables 1-6] The reported ASR is not a stable property of the attack: the same condition (RDF without code, AdvBench, Llama-3-70B-Instruct) receives 1% from GPT-4 Judge (Table 5), 14% from Llama Guard 2 (Table 6a), and 99% from IA (Table 6b), a 98-point spread. Model rankings also flip across evaluators: GPT-4 Judge reports Qwen2.5-72B as most vulnerable (87% on AdvBench), Llama Guard 2 reports ChatGPT 3.5 (97% on HarmBench), and IA reports Llama-3 (99%). Since the central claim is a specific attack success rate, this inconsistency makes the headline number an artifact of evaluator choice rather than a measured attack property.
[Abstract/§1 vs §6.2/Table 4] The abstract attributes the 87% success rate to the knowledge-to-code vector ('instructing LLMs to generate code that realizes the intent described in these semantic graphs, achieving success rates of up to 87%'), but Table 4, the dedicated code-generation evaluation, never contains an 87% value; its maximum is 86% (Claude 3.7, RDF), and the knowledge-graph configuration for Qwen2.5-72B is 24%. The 87% numbers in Tables 1 and 5 arise from RDF-without-code configurations evaluated by GPT-4 Judge. Additionally, §1 reports 'up to 84.62%' while the abstract and conclusion state 'up to 87%'; the paper never reconciles these discrepancies.
[§6.2] The code-generation scoring standard is 'adapted from GPT-4 judge and ChatGPT self-assessment.' Because the target models include GPT-4o and GPT-3.5, the judge is drawn from the same model family as the targets, and no human validation or alternative evaluator is applied to Table 4. This creates a circularity risk: the high code-generation ASRs could reflect the judge's acceptance of code-shaped outputs rather than the actual presence of harmful content.
[§5.3] The PAIR baseline is under-tuned by the authors' own admission: the paper states that PAIR's low performance is 'likely due to the limited exploration inherent in only 3 refinement iterations' with n-streams=3 and n-iterations=3. The relative claim that GraphAttack outperforms state-of-the-art jailbreaking methods is therefore not supported, because the comparison is against a deliberately weak configuration of PAIR.
[§4.2/§4.5] The evaluation assumes that the AMR, RDF, and JSON graph representations faithfully preserve the harmful intent of each original prompt, but the paper provides no measurement of parsing success, graph fidelity, or semantic equivalence between the original query and its graph. Without such a check, a response that is judged harmful for a graph cannot be interpreted as a successful jailbreak of the original natural-language request.
[§5.4/Tables 1-6] No code or data are released, no trial counts are given, and no error bars or confidence intervals are reported; each table cell is presented as a deterministic percentage, despite the small sizes implied by the paper's own full-dataset descriptions. This makes the reported ASRs impossible to verify or statistically evaluate, which is a load-bearing omission for an empirical attack paper.

minor comments (5)

[§5.3] The PAIR setup paragraph contains a dangling citation '[? ]' that should be replaced with the reference for the PAIR code repository.
[§5.2] The sentence 'This method relies on an out-of-distribution code environment shift to trigger unsafe completions.' appears twice verbatim in the CodeAttack description.
[Definition 4.1] The definition contains a typo: 'is a directed graph G = (V, E) where where V represents' repeats 'where'.
[Table 6] The table caption reads 'ASR evaluated via AI' but the text elsewhere calls this evaluator 'IA' (Intention Analysis); the abbreviation should be consistent.
[CCS Concepts] The CCS Concepts field still contains the placeholder 'Do Not Use This Code' and the ACM reference format line refers to a 2018 conference, indicating the template was not cleaned before submission.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: GraphAttack is an empirical attack-evaluation study, and no reported quantity is defined in terms of a quantity it is supposed to predict.

full rationale

GraphAttack makes no first-principles derivation whose output is equivalent to an input. The pipeline (semantic parsing, graph representation, prompt or code generation, target response, automated judge) is an empirical measurement chain, and the abstract's 87% figure is a maximum over specific GPT-4-Judge AdvBench cells rather than a quantity derived from the setup. The paper does not fit a parameter and then rename it a prediction; the knowledge-to-code pathway is not defined in terms of the ASR it is claimed to explain. PAIR is run with small iteration counts and the authors explicitly admit that its low success is 'likely due to the limited exploration inherent in only 3 refinement iterations' (Section 5.3), which is a baseline-fairness concern, not circularity. The use of GPT-4 Judge and of a scoring standard 'adapted from GPT-4 judge and ChatGPT self-assessment' (Section 6.2) raises a legitimate evaluation-validity concern: a judge from the same model family as the target could share the same representational blindspot. However, ASR is not defined as or reduced to the judge's own output by construction; it is an empirical label assigned to the target's response. There are also no load-bearing self-citations: the cited results from Geva et al., Chao et al., Qi et al., and Zhang et al. are external prior work, not the present authors' own claims. The observed judge-to-judge variation in Tables 5 and 6 indicates instability in the evaluation instrument, but it does not make the attack's reported success rate equivalent to its inputs. No self-definitional step, fitted-input-as-prediction step, imported uniqueness theorem, or ansatz-smuggling step is present, so the appropriate finding is no significant circularity.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

No new physical or mathematical entities are introduced; the semantic attack graph is a conceptual framework. The central result rests on unshown assumptions about parse fidelity, semantic equivalence, evaluator validity, and baseline fairness, plus several undisclosed implementation choices.

free parameters (5)

Number of graph variants per malicious query = not reported
The ASR depends on how many graph variants are tried per prompt; the paper does not state this number, so the probability of at least one success is not controlled.
JSON knowledge graph template = not disclosed
The template-guided generation with GPT-4o is central to the attack but the template is not provided, making the method non-reproducible.
Semantic transformation rules = hand-selected
Algorithm 1 expands nodes with synonyms, paraphrases, and related concepts, but the actual lists and selection criteria are not given.
Target model decoding parameters = not reported
Sampling temperature and other generation settings strongly affect refusal and compliance rates; none are reported.
GPT-4 Judge and IA configuration = not reported
The judge prompts and versions and IA settings are cited from other papers but the exact configurations used here are not specified.

assumptions (5)

domain assumption Semantic parsers (SPRING/FRED) and LLM-based JSON graph generation faithfully encode the harmful intent of the original prompt.
Sections 4.1 and 4.5 assume parse fidelity; no parse success rate or fidelity check is reported.
domain assumption The automated evaluators (GPT-4 Judge, Llama Guard 2, IA) correctly classify harmful content.
Section 5.4 relies on these judges; Tables 5 and 6 show the same attack receiving 1% vs 99% ASR across judges, so the assumption is questionable.
domain assumption Transformation edges preserve semantic equivalence between the original malicious query and the graph-based variant.
Section 4.2 defines transformations that 'preserve the underlying semantic intent' but no human or automated equivalence check is performed.
domain assumption Standard benchmark prompts are representative and the selection of 106 code-oriented prompts is unbiased.
Section 6.2 extracts 106 code-oriented goal-target pairs from AdvBench without describing the selection method.
domain assumption PAIR baseline is implemented fairly.
Section 5.3 uses only 3 iterations and 3 streams; the paper admits this yields low ASR, which makes the comparison favorable to GraphAttack.

how reviews work

0 comments

Cite this review

Pith. "Pith review of GraphAttack: Exploiting Representational Blindspots in LLM Safety Mechanisms." pith.science (2026). https://pith.science/paper/WCEAQYNJ

@misc{pith2026250413052,
  author       = {Pith},
  title        = {Pith review of: GraphAttack: Exploiting Representational Blindspots in LLM Safety Mechanisms},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WCEAQYNJ}},
  note         = {Machine review of arXiv:2504.13052}
}

read the original abstract

Large Language Models (LLMs) have been equipped with safety mechanisms to prevent harmful outputs, but these guardrails can often be bypassed through "jailbreak" prompts. This paper introduces a novel graph-based approach to systematically generate jailbreak prompts through semantic transformations. We represent malicious prompts as nodes in a graph structure with edges denoting different transformations, leveraging Abstract Meaning Representation (AMR) and Resource Description Framework (RDF) to parse user goals into semantic components that can be manipulated to evade safety filters. We demonstrate a particularly effective exploitation vector by instructing LLMs to generate code that realizes the intent described in these semantic graphs, achieving success rates of up to 87% against leading commercial LLMs. Our analysis reveals that contextual framing and abstraction are particularly effective at circumventing safety measures, highlighting critical gaps in current safety alignment techniques that focus primarily on surface-level patterns. These findings provide insights for developing more robust safeguards against structured semantic attacks. Our research contributes both a theoretical framework and practical methodology for systematically stress-testing LLM safety mechanisms.

Figures

Figures reproduced from arXiv: 2504.13052 by the authors.

**Figure 1.** Overview of our jailbreaking attack more granular graph structure with standardized subject-predicateobject relationships. 3 Template-based JSON Route: The query is also processed using LLM-based templates to generate a JSON-formatted knowledge graph, providing a third representation that combines elements of format structure with natural language flexibility. These parallel processing routes provide complementary … view at source ↗

**Figure 2.** Example of Code generation from semantic graph [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 16 canonical work pages

[1]

Anthropic. 2025. Claude 3.7 Sonnet and Claude Code. https://www.anthropic. com/news/claude-3-7-sonnet

2025
[2]

Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova Das- Sarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. 2022. Con- stitutional AI: Harmlessness from AI Feedback. arXiv preprint arXiv:2212.08073 (2022)

arXiv 2022
[3]

Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. 2022. Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback. arXiv preprint arXiv:2204.05862 (2022)

arXiv 2022
[4]

Laura Banarescu, Claire Bonial, Shu Cai, Madalina Georgescu, Kira Griffitt, Ulf Hermjakob, Kevin Knight, Philipp Koehn, Martha Palmer, and Nathan Schneider
[5]

Michele Bevilacqua, Rexhina Blloshmi, and Roberto Navigli. 2021. One SPRING to rule them both: Symmetric AMR semantic parsing and generation without a complex pipeline. In Proceedings of the AAAI conference on artificial intelligence , Vol. 35. 12564–12573

work page 2021
[6]

Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D

Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D. Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language Models are Few-Shot Learners. Advances in Neural Information Processing Systems 33 (2020), 1877–1901

work page 2020
[7]

Pappas, and Eric Wong

Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2023. Jailbreaking Black Box Large Language Models in Twenty Queries. arXiv preprint arXiv:2310.08419 (2023)

arXiv 2023
[8]

Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebas- tian Gehrmann, et al. 2022. PaLM: Scaling Language Modeling with Pathways. arXiv preprint arXiv:2204.02311 (2022)

arXiv 2022

Show all 36 references

[9]

Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei

Paul F. Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. 2017. Deep reinforcement learning from human preferences. InAdvances in Neural Information Processing Systems . 4299–4307

2017
[10]

Aldo Gangemi, Valentina Presutti, Diego Reforgiato Recupero, Andrea Giovanni Nuzzolese, Francesco Draicchio, and Misael Mongiovì. 2017. Semantic web machine reading with FRED. Semantic Web 8, 6 (2017), 873–893

2017
[11]

Mor Geva, Avi Caciularu, Kevin Ro Wang, and Yoav Goldberg. 2022. Transformer feed-forward layers build predictions by promoting concepts in the vocabulary space. arXiv preprint arXiv:2203.14680 (2022)

2022 arXiv
[12]

Yue Huang, Jingyu Tang, Dongping Chen, Bingda Tang, Yao Wan, Lichao Sun, and Xiangliang Zhang. 2024. ObscurePrompt: Jailbreaking Large Language Models via Obscure Input. CoRR (2024)

2024
[13]

HuggingFace. 2024. meta-llama/Meta-Llama-Guard-2-8B. https://huggingface. co/meta-llama/Meta-Llama-Guard-2-8B

2024
[14]

Haibo Jin, Ruoxi Chen, Jinyin Chen, and Haohan Wang. 2023. Quack: Automatic jailbreaking large language models via role-playing. (2023)

2023
[15]

Robert T Kasper. 1989. A flexible interface for linking applications to Penman’s sentence generator. In Speech and Natural Language: Proceedings of a Workshop Held at Philadelphia, Pennsylvania, February 21-23, 1989

1989
[16]

Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. [n. d.]. AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models. In The Twelfth International Conference on Learning Representations
[17]

Yuxin Liu, Sheng Shen, Yifan Zhang, Yiqing Li, Yichen Liu, Yiran Chen, and Dawn Song. 2023. AutoDAN: Automatic Jailbreak of Aligned Language Models. arXiv preprint arXiv:2307.15852 (2023)

2023 arXiv
[18]

Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. 2024. HarmBench: a standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st International Confere...

2024
[19]

Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2023. Tree of Attacks: Jailbreaking Black-Box LLMs Automatically. arXiv preprint arXiv:2312.02119 (2023)

2023 arXiv
[20]

Meta. 2024. Llama-3.3-70B-Instruct. https://huggingface.co/meta-llama/Llama- 3.3-70B-Instruct

2024
[21]

Eric Miller. 1998. An introduction to the resource description framework. D-lib Magazine (1998)

1998
[22]

OpenAI. 2024. GPT-4o. https://openai.com/index/gpt-4o-system-card/

2024
[23]

Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al

Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. Training language models to follow instructions with human feedback. arXiv preprint arXiv:2203.02155 (2022)

2022 arXiv
[24]

Riedl, Nisan Stiennon, Nathan Scales, Aimee Chan, Mark van der Wilk, et al

Ethan Perez, Sam McKenzie, Simon Maurer, Julia Kreutzer, Thomas Scialom, Mark O. Riedl, Nisan Stiennon, Nathan Scales, Aimee Chan, Mark van der Wilk, et al. 2022. Red Teaming Language Models with Language Models. arXiv preprint arXiv:2202.03286 (2022)

2022 arXiv
[25]

Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693 (2023)

2023 arXiv
[26]

Delong Ran, Jinyuan Liu, Yichen Gong, Jingyi Zheng, Xinlei He, Tianshuo Cong, and Anyu Wang. 2024. Jailbreakeval: An integrated toolkit for evaluating jailbreak attempts against large language models. arXiv preprint arXiv:2406.09321 (2024)

2024 arXiv
[27]

Qibing Ren, Chang Gao, Jing Shao, Junchi Yan, Xin Tan, Wai Lam, and Lizhuang Ma. 2024. CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion. In Findings of the Association for Compu- tational Linguistics ACL 2024. 11437–11452

2024
[28]

Sheng Shen, Yifan Zhang, Yiqing Li, Yichen Liu, Yiran Chen, and Dawn Song
[29]

Yihong Tang, Bo Wang, Xu Wang, Dongming Zhao, Jing Liu, Ruifang He, and Yuexian Hou. 2025. RoleBreak: Character Hallucination as a Jailbreak Attack in Role-Playing Systems. In Proceedings of the 31st International Conference on Computational Linguistics. 7386–7402

2025
[30]

Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal Adversarial Triggers for Attacking and Analyzing NLP. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on...

2019
[31]

Chi, Quoc V

Jason Wei, Micah Schaeffer, Alisa Go, Nan Liu, Amelia Glaese, Teven Le Scao Wang, Noam Shazeer, Ed H. Chi, Quoc V. Le, Heung-Yeung Shum, et al. 2023. Jailbroken: How Does LLM Safety Training Fail? arXiv preprint arXiv:2307.02483 (2023)

2023 arXiv
[32]

Zhiyuan Yu, Xiaogeng Liu, Shunning Liang, Zach Cameron, Chaowei Xiao, and Ning Zhang. 2024. Don’t listen to me: understanding and exploring jailbreak prompts of large language models. In 33rd USENIX Security Symposium (USENIX Security 24). 4675–4692

2024
[33]

Yuqi Zhang, Liang Ding, Lefei Zhang, and Dacheng Tao. 2024. Intention analysis makes llms a good jailbreak defender. arXiv preprint arXiv:2401.06561 (2024)

2024 arXiv
[34]

Andy Zou, Eric Guo, William Zhang, Dan Goldwasser, Bo Li, and James Zou. 2023. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv preprint arXiv:2307.15027 (2023)

2023
[2013]

In Proceedings of the 7th linguistic annotation workshop and interoperability with discourse

Abstract meaning representation for sembanking. In Proceedings of the 7th linguistic annotation workshop and interoperability with discourse . 178–186
[2023]

arXiv preprint arXiv:2307.15043 (2023)

Do Anything Now: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models. arXiv preprint arXiv:2307.15043 (2023)

2023 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Anthropic. 2025. Claude 3.7 Sonnet and Claude Code. https://www.anthropic. com/news/claude-3-7-sonnet

2025

[2] [2]

Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova Das- Sarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. 2022. Con- stitutional AI: Harmlessness from AI Feedback. arXiv preprint arXiv:2212.08073 (2022)

arXiv 2022

[3] [3]

Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. 2022. Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback. arXiv preprint arXiv:2204.05862 (2022)

arXiv 2022

[4] [4]

Laura Banarescu, Claire Bonial, Shu Cai, Madalina Georgescu, Kira Griffitt, Ulf Hermjakob, Kevin Knight, Philipp Koehn, Martha Palmer, and Nathan Schneider

[5] [5]

Michele Bevilacqua, Rexhina Blloshmi, and Roberto Navigli. 2021. One SPRING to rule them both: Symmetric AMR semantic parsing and generation without a complex pipeline. In Proceedings of the AAAI conference on artificial intelligence , Vol. 35. 12564–12573

work page 2021

[6] [6]

Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D

Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D. Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language Models are Few-Shot Learners. Advances in Neural Information Processing Systems 33 (2020), 1877–1901

work page 2020

[7] [7]

Pappas, and Eric Wong

Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2023. Jailbreaking Black Box Large Language Models in Twenty Queries. arXiv preprint arXiv:2310.08419 (2023)

arXiv 2023

[8] [8]

Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebas- tian Gehrmann, et al. 2022. PaLM: Scaling Language Modeling with Pathways. arXiv preprint arXiv:2204.02311 (2022)

arXiv 2022