On Surjectivity of Neural Networks: Can you elicit any behavior from your model?

Haozhe Jiang; Nika Haghtalab

REVIEW 4 major objections 4 minor 1 cited by

On Surjectivity of Neural Networks: Can you elicit any behavior from your model?

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Any behavior can be elicited from Pre-LayerNorm networks: the paper proves that any continuous function wrapped in Pre-LayerNorm is surjective, so every output vector has some input that produces it, regardless of safety training.

desk verdict Crisp surjectivity theorems for Pre-LayerNorm and linear attention; the safety gloss outruns the theorems, but the paper is honest about the gap and deserves a serious referee. read the letter →

arxiv 2508.19445 v3 pith:HPZXJZTK submitted 2025-08-26 cs.LG stat.ML

Haozhe Jiang , Nika Haghtalab This is my paper · ORCID

classification cs.LGstat.ML MSC 55M2568T07

keywords surjectivityPre-LayerNormlinearattentionBrouwerdegreeadversarialattackstransformersdiffusionmodelssafetytraining

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether a trained neural network can be made to produce any specified output — that is, whether the network function is surjective. It proves that many fundamental modern components are almost always surjective: any continuous function wrapped in Pre-LayerNorm, MLPs with LeakyReLU activations, and linear-attention layers. As a consequence, GPT-style transformers and diffusion models with deterministic ODE solvers admit inverse mappings for arbitrary outputs, meaning any behavior can in principle be elicited from these models. The result is framed as a formal obstacle to safety training: if every output is reachable, then training cannot guarantee that harmful outputs are impossible, even if finding the input may be computationally difficult. The paper also shows that softmax attention and ReLU MLPs are not surjective, so the property is not universal across architectures.

What carries the argument

The proofs use two differential-topology tools: Brouwer's fixed-point theorem and Brouwer degree with homotopy invariance. For Pre-LayerNorm, the normalized input LN(x) always lies in a bounded set, so the map x ↦ y − f(LN(x)) carries a large ball into itself and therefore has a fixed point, which is exactly a preimage of y — no parameter genericity is needed. For MLPs and linear attention, the proof constructs a homotopy from the target function to a simpler surjective function (an identity-like MLP, or a function of the form f(x) = Mx + (xᵀNx)x), shows the Brouwer degree is nonzero on a large ball for all homotopy parameters, and concludes via degree invariance that a preimage exists for e

What would settle it

Apply the paper's own Algorithm 1 to a GPT-style transformer (e.g., GPT-2) with a fixed target sentence that never appeared in training, optimizing the input embedding by gradient descent. If for some target the optimization provably cannot reach zero loss and a global search confirms no preimage exists, the practical surjectivity corollary for that trained model would be contradicted; a robust way to test this is to run the algorithm across many random targets and check whether every one converges to loss zero.

Watch

Extended reading notes

Core claim

The paper proves that most standard building blocks of modern neural networks are surjective functions, and it does so almost always — that is, for all parameter configurations except a measure-zero set. The central results are: (1) any continuous function wrapped in Pre-LayerNorm, defined as g(x) = f(LN(x)) + x, is surjective (Theorems 3.1 and 3.2); (2) two-layer MLPs with LeakyReLU are almost always surjective when the hidden dimension is at least the input dimension (Theorem 3.4); and (3) linear attention layers such as RetNet (Ret) are almost always surjective (Theorem 3.5). Because surjectivity is closed under composition, GPT-style transformers made of Pre-LayerNorm blocks, and diffusi

Load-bearing premise

The safety conclusions depend on treating the model as a function on the continuous embedding space in which an attacker directly chooses arbitrary real vectors; the paper concedes in Section 4.1 that the theorems do not directly apply to token-based autoregressive prompting, so if deployment restricts inputs to discrete tokens or typical decoding schemes, surjectivity does not imply that harmful outputs are elicitable.

Editorial extensions

If this is right

Any continuous network block wrapped in Pre-LayerNorm becomes surjective, so residual-stream transformers (GPT-style) are almost always surjective as whole models.
Linear-attention layers (RetNet and likely similar variants) are almost always surjective, extending the property to recurrent-style and efficient attention architectures.
Diffusion models with deterministic ODE solvers map the noise space onto the full output space, so every target image or video frame has a noise preimage, irrespective of training data or safety filtering.
Softmax attention and ReLU MLPs fail surjectivity, so surjectivity is not an unavoidable property of all neural architectures — it depends on the specific blocks used.
Because surjectivity is closed under composition, the property holds for deep stacks built from the surjective blocks, not just single layers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The practical severity of surjectivity depends on the gap between existence and construction: the paper proves preimages exist but does not give efficient algorithms, so safety interventions that make preimage-finding computationally hard could still be effective in practice — this is our inference, not the paper's claim.
If token-based autoregressive generation is the only interface, the direct-embedding surjectivity results do not immediately translate to prompt-based attacks; the paper says this limitation may actually be reassuring, but we infer that a similar surjectivity argument might apply to the full autoregressive trajectory if embeddings are treated as continuous intermediates.
The Brouwer-degree technique appears applicable to other linear-attention and gated architectures (e.g., Mamba-2, RWKV-6, DeltaNet) with rank conditions, though the paper only sketches this and we regard it as an open extension rather than an established result.
A testable consequence of non-surjectivity of softmax attention: architectures that drop Pre-LayerNorm or use pure softmax attention could in principle admit outputs that are unreachable, but the paper does not propose such architectures, and we infer that the safety benefit would be limited because the network could still elicit most behaviors.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The thing to know: the core mathematical claims are real and worth your time. Theorem 3.1 is a genuinely elegant observation—any continuous f wrapped in Pre-LayerNorm gives a surjective map, just by Brouwer plus boundedness of LayerNorm. The sequence version (3.2) follows the same way. The linear attention result (3.5) is more substantial: the proof uses degree theory to handle the cubic term, and the appendix's modified function h_delta is a clever way to cut out the cone where x^T N x = 0. That section is a sketch in the main text, but the appendix gives the real argument, and it looks plausible. The paper also deserves credit for stating the autoregressive caveat plainly in Section 4.1: the theorems do not directly apply to prompt-based attacks on decoder-only models. That is the right thing to say. The soft spots are in proportion to how soft they are. The stress-test is correct: surjectivity of the one-shot embedding-space map does not transfer to autoregressive generation, because the preimage may require choosing all input positions jointly, including positions that in deployment are model outputs. The paper's own caveat concedes this, which means the title's 'any behavior' and the abstract's 'GPT-style transformers admit inverse mappings for arbitrary outputs' are stronger than what the theorems actually support for language models. That is a real gap, but the authors flagged it, so it is not a hidden flaw. The diffusion claim in 4.2 is asserted informally rather than proven; that needs tightening. And the LeakyReLU proof (Theorem 3.4) has a norm inequality that does not parse as written—looks like a typo—and the argument is left as a sketch. For a theory-minded reader, this paper is worth engaging. The Pre-LayerNorm theorem is a clean new result, and the linear attention analysis is a substantive piece of differential topology applied to a modern architecture. The safety interpretation is more limited than the packaging suggests, but the paper is honest about that. I would send it to peer review, asking for a checked proof of the LeakyReLU lemma and a more careful statement of the diffusion claim.

Referee Report

4 major / 4 minor

Summary. The paper defines almost-always surjectivity for neural architectures and uses tools from differential topology (Brouwer fixed point, inverse function theorem, Brouwer degree) to argue that several common building blocks are surjective except on a measure-zero set of parameters. The main positive results are Theorem 3.1/3.2 (any continuous function wrapped in Pre-LayerNorm with residual connection is surjective), Theorem 3.3 (a Post-LayerNorm GeLU MLP is almost surjective on the normalized sphere), Theorem 3.4 (two-layer LeakyReLU MLPs are almost always surjective), and Theorem 3.5 (RetNet linear attention is almost always surjective). The paper then claims consequences for GPT-style transformers, diffusion models, and robotics policies, and draws safety conclusions about eliciting arbitrary harmful outputs. Section 4.1 explicitly concedes that the theorems do not apply to autoregressive prompt-based settings, and Section 5.1 nevertheless asserts that an attacker can elicit any behavior from the model.

Significance. The Pre-LayerNorm result (Theorem 3.1) is elegant, self-contained, and genuinely useful: it shows that any continuous function wrapped as x + f(LN(x)) is surjective, with a short Brouwer fixed-point proof. The paper is honest about several limitations and does not rely on circular assumptions. However, the advertised breadth of the results is not supported. In particular, Theorem 3.4 is false as stated, and the proof of Theorem 3.5 has concrete errors. Since these are central results that appear in the abstract and Table 1, the paper cannot be accepted in its current form. The safety interpretation also overreaches: the surjectivity results concern direct control of the entire embedding sequence, which is not the input interface of deployed autoregressive models.

major comments (4)

[§3.2, Theorem 3.4] The theorem is false as stated. Take d=1, d1=2, α∈(0,1), W1=[a,-b]^T, W2=[c,c], and zero biases, with a>αb and αa<b. For x≥0, f(x)=c(a-αb)x≥0; for x≤0, f(x)=c(αa-b)x≥0 because x<0 and αa-b<0. Hence f maps R to [0,∞), so it is not surjective. This is an open set of parameters and therefore has positive Lebesgue measure, contradicting 'almost always surjective.' The proof's inequality ∥F(x,t)∥≥α∥W2(W1x+λ1)+λ2∥ is also false; with W2=[1,1], z=(α,-1)^T x, the left side is 0 while the right side is positive.
[§3.3 and Appendix B.1, Theorem 3.5] The proof of almost-always surjectivity for Ret is incomplete and contains concrete errors. The displayed closed-form preimage for b1 uses the inverse exponent: setting a=μV^{-1}b1 yields b1=μ^3(z^TK^TQz)b1, so μ=(z^TK^TQz)^{-1/3}, not (z^TK^TQz)^{1/3}. In Lemma 3, ∥hδ(x)∥ is Θ(∥x∥^3), not o(∥x∥^2), so the stated asymptotic justification is wrong. Lemma 4's contrapositive argument does not handle sequences of solutions escaping to infinity as δ→0. These gaps affect a central claimed result.
[§4.2] The claim that diffusion models with deterministic ODE solvers are almost always surjective is asserted informally rather than proved. Theorem 3.1 applies to maps x↦x+f(LN(x)); an Euler step is x↦x+Δ v(x,z_k). The paper does not show that v has the required first-layer bounded normalization applied directly to the raw input; U-Nets typically begin with convolutions and transformer diffusion backbones begin with patch embeddings. Thus the composition argument is not a direct corollary of Theorems 3.1/3.2.
[§4.1, §5.1, abstract] The paper's central safety framing overstates the reach of the results. The surjectivity theorems apply to maps in which the attacker directly chooses all input positions in the embedding space; they do not apply to autoregressive prompting, as Section 4.1 explicitly concedes ('our theorems do not directly apply settings such as prompt-based attacks'). Nevertheless, the abstract and Section 5.1 claim that an attacker 'can elicit any behavior from the model.' This is a load-bearing gap between the mathematical results and the stated practical implications, and the claims should be substantially qualified.

minor comments (4)

[Appendix B, proof of Theorem 3.2] The line 'M = sup ... ≤ ∞' should be 'M = sup ... < ∞'.
[Definition 2] LayerNorm is undefined when x is the constant vector, since the denominator ∥x−x̄∥ vanishes. The theorems ignore this edge case; adding the standard epsilon or excluding a measure-zero set would make the definitions precise.
[Appendix C, Algorithm 1] The inner loss 'loss(b_1 − TF(a_1,...,a_i)_i)^2' appears to use b_1 for all i; it should presumably be b_i. Also, 'architeuctres' is a typo.
[Theorem 3.6] The proof sketch for non-surjectivity of softmax attention is informal and does not account for the contribution of previous tokens V a_j, whose norms may depend on earlier inputs. This deserves a more careful argument if the negative result is to be relied upon.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: main theorems are self-contained fixed-point/degree arguments; the safety transfer to autoregressive prompting is explicitly disclaimed and is a scope limitation, not a circular step.

full rationale

The paper's central derivations (Theorems 3.1, 3.2, 3.4, 3.5) do not assume their conclusions. Theorem 3.1 invokes Brouwer's fixed point theorem on a ball into which the residual map sends itself; boundedness of LN and continuity of f are the only inputs, and surjectivity follows by solving x = y - f(LN(x)). Theorem 3.2 repeats this on the product of balls. The MLP and linear-attention proofs use homotopy invariance of Brouwer degree (cited to the external monograph Dinca and Mawhin), constructing homotopies to functions whose degree is explicitly computed; no target output is used as an assumption. Corollary 4.1 and Theorem 4.2 are compositions of already-proved surjective blocks, so no fitted parameter is renamed as a prediction. The only self-citation (Wei et al. 2023, by co-author Haghtalab) appears as an example of suffix-injection attacks in Sections 1.1 and 5.2 and is not load-bearing in any proof. Section 4.1 contains the limitation: 'our theorems do not directly apply settings such as prompt-based attacks that exploit autoregressive generation.' This is an honest scope limitation on the practical safety claim, not a circularity: it concedes that surjectivity of the embedding-space map does not by itself establish that arbitrary prompts elicit arbitrary outputs. Overall, no step in the derivation chain reduces to its own inputs.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The central claims rest on standard topological tools (Brouwer fixed point, inverse function theorem, degree theory) plus the domain assumption that LayerNorm is bounded and that parameters are drawn from a continuous distribution. No fitted constants or invented entities are introduced.

assumptions (6)

standard math Brouwer's fixed point theorem (Theorem 2.1)
Used to prove surjectivity of Pre-LayerNorm in Theorem 3.1.
standard math Inverse function theorem (Theorem 2.2)
Used in Theorem 3.3 for Post-LayerNorm and implicitly in degree arguments.
standard math Brouwer degree homotopy invariance (Lemma 1)
Central tool for LeakyReLU MLP and linear attention proofs.
domain assumption LayerNorm output is bounded
LN(x)=gamma*(x-mean)/||x-mean||+beta lies in a compact set; this boundedness is what makes Pre-LayerNorm a bounded perturbation of identity.
domain assumption Parameter space is Euclidean and 'almost always' means except on a measure-zero set
The probabilistic framing of almost-always surjectivity (Definition 9) assumes parameters are drawn from an absolutely continuous distribution.
domain assumption Trained networks are treated as deterministic functions from R^d to R^d
The whole analysis views the final network as a fixed deterministic map; stochastic decoding or sampling is discussed only as a separate perspective in Section 5.1.

how reviews work

0 comments

Cite this review

Pith. "Pith review of On Surjectivity of Neural Networks: Can you elicit any behavior from your model?." pith.science (2026). https://pith.science/paper/HPZXJZTK

@misc{pith2026250819445,
  author       = {Pith},
  title        = {Pith review of: On Surjectivity of Neural Networks: Can you elicit any behavior from your model?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HPZXJZTK}},
  note         = {Machine review of arXiv:2508.19445}
}

read the original abstract

Given a trained neural network, can any specified output be generated by some input? Equivalently, does the network correspond to a function that is surjective? In generative models, surjectivity implies that any output, including harmful or undesirable content, can in principle be generated by the networks, raising concerns about model safety and jailbreak vulnerabilities. In this paper, we prove that many fundamental building blocks of modern neural architectures, such as networks with pre-layer normalization and linear-attention modules, are almost always surjective. As corollaries, widely used generative frameworks, including GPT-style transformers and diffusion models with deterministic ODE solvers, admit inverse mappings for arbitrary outputs. By studying surjectivity of these modern and commonly used neural architectures, we contribute a formalism that sheds light on their unavoidable vulnerability to a broad class of adversarial attacks.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Prompting Complexity: Shortest Prompts for Texts and Behaviors in LLMs
cs.CL 2026-07 conditional novelty 6.0 of 10

The paper defines prompting complexity as the length of the shortest plausible prompt that deterministically generates a target text with a fixed language model.

Reference graph

Works this paper leans on

118 extracted references · 9 canonical work pages · cited by 1 Pith paper

[1]

Synthesizing robust adversarial examples

Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference on machine learning, pages 284--293. PMLR, 2018

2018
[2]

Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E. Hinton. Layer normalization, 2016. URL https://arxiv.org/abs/1607.06450

arXiv 2016
[3]

Neural machine translation by jointly learning to align and translate, 2016

Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. Neural machine translation by jointly learning to align and translate, 2016. URL https://arxiv.org/abs/1409.0473

arXiv 2016
[4]

Image hijacks: Adversarial images can control generative models at runtime, 2024

Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. Image hijacks: Adversarial images can control generative models at runtime, 2024. URL https://arxiv.org/abs/2309.00236

arXiv 2024
[5]

Invertible residual networks

Jens Behrmann, Will Grathwohl, Ricky TQ Chen, David Duvenaud, and J \"o rn-Henrik Jacobsen. Invertible residual networks. In International conference on machine learning, pages 573--582. PMLR, 2019

2019
[6]

Language models are few-shot learners

Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33: 0 1877--1901, 2020

1901
[7]

Residual flows for invertible generative modeling

Ricky TQ Chen, Jens Behrmann, David K Duvenaud, and J \"o rn-Henrik Jacobsen. Residual flows for invertible generative modeling. Advances in Neural Information Processing Systems, 32, 2019

2019
[8]

Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models

Simin Chen, Zihe Song, Mirazul Haque, Cong Liu, and Wei Yang. Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15365--15374, 2022

2022

Show all 118 references

[9]

Diffusion policy: Visuomotor policy learning via action diffusion

Cheng Chi, Zhenjia Xu, Siyuan Feng, Eric Cousineau, Yilun Du, Benjamin Burchfiel, Russ Tedrake, and Shuran Song. Diffusion policy: Visuomotor policy learning via action diffusion. The International Journal of Robotics Research, page 02783649241273668, 2023

2023
[10]

Palm: Scaling language modeling with pathways

Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. Journal of Machine Learning Research, 24 0 (240): 0 1--113, 2023

2023
[11]

Transformers are ssms: Generalized models and efficient algorithms through structured state space duality, 2024

Tri Dao and Albert Gu. Transformers are ssms: Generalized models and efficient algorithms through structured state space duality, 2024. URL https://arxiv.org/abs/2405.21060

2024 arXiv
[12]

Multilingual jailbreak challenges in large language models, 2024

Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. Multilingual jailbreak challenges in large language models, 2024. URL https://arxiv.org/abs/2310.06474

2024 arXiv
[13]

Toxicity in chatgpt: Analyzing persona-assigned language models

Ameet Deshpande, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, and Karthik Narasimhan. Toxicity in chatgpt: Analyzing persona-assigned language models. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Findings of the Association for Computational Linguistics: EMNLP...

2023 doi
[14]

Brouwer Degree: The Core of Nonlinear Analysis, volume XIX of Progress in Nonlinear Differential Equations and Their Applications

George Dinca and Jean Mawhin. Brouwer Degree: The Core of Nonlinear Analysis, volume XIX of Progress in Nonlinear Differential Equations and Their Applications. Birkhäuser Cham, 2021. ISBN 978-3-030-63229-8. doi:10.1007/978-3-030-63230-4. 2 illustrations in colour

2021 doi
[15]

Nice: Non-linear independent components estimation, 2015

Laurent Dinh, David Krueger, and Yoshua Bengio. Nice: Non-linear independent components estimation, 2015. URL https://arxiv.org/abs/1410.8516

2015 arXiv
[16]

Density estimation using real nvp, 2017

Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio. Density estimation using real nvp, 2017. URL https://arxiv.org/abs/1605.08803

2017 arXiv
[17]

How robust is google's bard to adversarial image attacks?, 2023

Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. How robust is google's bard to adversarial image attacks?, 2023. URL https://arxiv.org/abs/2309.11751

2023 arXiv
[18]

Physical adversarial attacks on an aerial imagery object detector

Andrew Du, Bo Chen, Tat-Jun Chin, Yee Wei Law, Michele Sasdelli, Ramesh Rajasegaran, and Dillon Campbell. Physical adversarial attacks on an aerial imagery object detector. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 1796--1806, 2022

2022
[19]

Neural spline flows

Conor Durkan, Artur Bekasov, Iain Murray, and George Papamakarios. Neural spline flows. Advances in neural information processing systems, 32, 2019

2019
[20]

Simon Geisler, Tom Wollschläger, M. H. I. Abdalla, Johannes Gasteiger, and Stephan Günnemann. Attacking large language models with projected gradient descent, 2025. URL https://arxiv.org/abs/2402.09154

2025 arXiv
[21]

The reversible residual network: Backpropagation without storing activations

Aidan N Gomez, Mengye Ren, Raquel Urtasun, and Roger B Grosse. The reversible residual network: Backpropagation without storing activations. Advances in neural information processing systems, 30, 2017

2017
[22]

Figstep: Jailbreaking large vision-language models via typographic visual prompts

Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 2395...

2025
[23]

Goodfellow, Jonathon Shlens, and Christian Szegedy

Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2015. URL https://arxiv.org/abs/1412.6572

2015 arXiv
[24]

Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Art...

2024 arXiv
[25]

Dirk Groeneveld, Iz Beltagy, Pete Walsh, Akshita Bhagia, Rodney Kinney, Oyvind Tafjord, Ananya Harsh Jha, Hamish Ivison, Ian Magnusson, Yizhong Wang, Shane Arora, David Atkinson, Russell Authur, Khyathi Raghavi Chandu, Arman Cohan, Jennifer Dumas, Yanai Elazar, Yuling Gu, Jack...

2024 arXiv
[26]

competency

Divij Handa, Zehua Zhang, Amir Saeidi, Shrinidhi Kumbhar, and Chitta Baral. When "competency" in reasoning opens the door to vulnerability: Jailbreaking llms via novel complex ciphers, 2025. URL https://arxiv.org/abs/2402.10601

2025
[27]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770--778, 2016

2016
[28]

Fantastic copyrighted beasts and how (not) to generate them, 2025

Luxi He, Yangsibo Huang, Weijia Shi, Tinghao Xie, Haotian Liu, Yue Wang, Luke Zettlemoyer, Chiyuan Zhang, Danqi Chen, and Peter Henderson. Fantastic copyrighted beasts and how (not) to generate them, 2025. URL https://arxiv.org/abs/2406.14526

2025 arXiv
[29]

Gaussian error linear units (gelus), 2023

Dan Hendrycks and Kevin Gimpel. Gaussian error linear units (gelus), 2023. URL https://arxiv.org/abs/1606.08415

2023 arXiv
[30]

Denoising diffusion probabilistic models

Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33: 0 6840--6851, 2020

2020
[31]

Efficient llm jailbreak via adaptive dense-to-sparse constrained optimization

Kai Hu, Weichen Yu, Yining Li, Tianjun Yao, Xiang Li, Wenhe Liu, Lijun Yu, Zhiqiang Shen, Kai Chen, and Matt Fredrikson. Efficient llm jailbreak via adaptive dense-to-sparse constrained optimization. Advances in Neural Information Processing Systems, 37: 0 23224--23245, 2024

2024
[32]

Droj: A prompt-driven attack against large language models, 2024

Leyang Hu and Boran Wang. Droj: A prompt-driven attack against large language models, 2024. URL https://arxiv.org/abs/2411.09125

2024 arXiv
[33]

Stronger universal and transferable attacks by suppressing refusals

David Huang, Avidan Shah, Alexandre Araujo, David Wagner, and Chawin Sitawarin. Stronger universal and transferable attacks by suppressing refusals. In Luis Chiruzzo, Alan Ritter, and Lu Wang, editors, Proceedings of the 2025 Conference of the Nations of the Americas Chapter o...

2025
[34]

Semantic-guided prompt organization for universal goal hijacking against llms, 2024

Yihao Huang, Chong Wang, Xiaojun Jia, Qing Guo, Felix Juefei-Xu, Jian Zhang, Geguang Pu, and Yang Liu. Semantic-guided prompt organization for universal goal hijacking against llms, 2024. URL https://arxiv.org/abs/2405.14189

2024 arXiv
[35]

Imagen-Team-Google, :, Jason Baldridge, Jakob Bauer, Mukul Bhutani, Nicole Brichtova, Andrew Bunner, Lluis Castrejon, Kelvin Chan, Yichang Chen, Sander Dieleman, Yuqing Du, Zach Eaton-Rosen, Hongliang Fei, Nando de Freitas, Yilin Gao, Evgeny Gladchenko, Sergio Gómez Colmenarej...

2024
[36]

Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023

Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023. URL https://arxiv.org/abs/2312.06674

2023 arXiv
[37]

i-revnet: Deep invertible networks, 2018

Jörn-Henrik Jacobsen, Arnold Smeulders, and Edouard Oyallon. i-revnet: Deep invertible networks, 2018. URL https://arxiv.org/abs/1802.07088

2018 arXiv
[38]

Improved techniques for optimization-based jailbreaking on large language models, 2024

Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. Improved techniques for optimization-based jailbreaking on large language models, 2024. URL https://arxiv.org/abs/2405.21018

2024 arXiv
[39]

Exploiting programmatic behavior of llms: Dual-use through standard security attacks

Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting programmatic behavior of llms: Dual-use through standard security attacks. In 2024 IEEE Security and Privacy Workshops (SPW), pages 132--143, 2024. doi:10.1109/SPW63631.2024.00018

2024
[40]

Openvla: An open-source vision-language-action model, 2024

Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, Quan Vuong, Thomas Kollar, Benjamin Burchfiel, Russ Tedrake, Dorsa Sadigh, Sergey Levine, Percy Liang, and Chelsea Finn. Openvla...

2024 arXiv
[41]

Glow: Generative flow with invertible 1x1 convolutions

Durk P Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions. Advances in neural information processing systems, 31, 2018

2018
[42]

Improved variational inference with inverse autoregressive flow

Durk P Kingma, Tim Salimans, Rafal Jozefowicz, Xi Chen, Ilya Sutskever, and Max Welling. Improved variational inference with inverse autoregressive flow. Advances in neural information processing systems, 29, 2016

2016
[43]

Reformer: The efficient transformer, 2020

Nikita Kitaev, Łukasz Kaiser, and Anselm Levskaya. Reformer: The efficient transformer, 2020. URL https://arxiv.org/abs/2001.04451

2020 arXiv
[44]

Wang, Qinbin Li, Ming Jin, Dawn Song, and Ruoxi Jia

Myeongseob Ko, Henry Li, Zhun Wang, Jonathan Patsenker, Jiachen T. Wang, Qinbin Li, Ming Jin, Dawn Song, and Ruoxi Jia. Boosting alignment for post-unlearning text-to-image generative models. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang,...

2024
[45]

Amplegcg-plus: A strong generative model of adversarial suffixes to jailbreak llms with higher success rates in fewer attempts, 2024

Vishal Kumar, Zeyi Liao, Jaylen Jones, and Huan Sun. Amplegcg-plus: A strong generative model of adversarial suffixes to jailbreak llms with higher success rates in fewer attempts, 2024. URL https://arxiv.org/abs/2410.22143

2024 arXiv
[46]

Multi-step jailbreaking privacy attacks on C hat GPT

Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song. Multi-step jailbreaking privacy attacks on C hat GPT . In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Findings of the Association for Computational Linguistics: EMNLP 2023, pages 4138--4...

2023 doi
[47]

Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation

Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In International conference on machine learning, pages 12888--12900. PMLR, 2022

2022
[48]

Mix-ln: Unleashing the power of deeper layers by combining pre-ln and post-ln, 2024 a

Pengxiang Li, Lu Yin, and Shiwei Liu. Mix-ln: Unleashing the power of deeper layers by combining pre-ln and post-ln, 2024 a . URL https://arxiv.org/abs/2412.13795

2024 arXiv
[49]

Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models

Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. In European Conference on Computer Vision, pages 174--189. Springer, 2024 b

2024
[50]

Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms, 2024

Zeyi Liao and Huan Sun. Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms, 2024. URL https://arxiv.org/abs/2404.07921

2024 arXiv
[51]

Boosting jailbreak transferability for large language models, 2024 a

Hanqing Liu, Lifeng Zhou, and Huanqian Yan. Boosting jailbreak transferability for large language models, 2024 a . URL https://arxiv.org/abs/2410.15645

2024 arXiv
[52]

Prompt injection attack against llm-integrated applications, 2024 b

Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu. Prompt injection attack against llm-integrated applications, 2024 b . URL https://arxiv.org/abs/2306.05499

2024 arXiv
[53]

Jailbreaking chatgpt via prompt engineering: An empirical study, 2024 c

Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study, 2024 c . URL https://arxiv.org/abs/2305.13860

2024 arXiv
[54]

Sora: A review on background, technology, limitations, and opportunities of large vision models, 2024 d

Yixin Liu, Kai Zhang, Yuan Li, Zhiling Yan, Chujie Gao, Ruoxi Chen, Zhengqing Yuan, Yue Huang, Hanchi Sun, Jianfeng Gao, Lifang He, and Lichao Sun. Sora: A review on background, technology, limitations, and opportunities of large vision models, 2024 d . URL https://arxiv.org/a...

2024 arXiv
[55]

An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models, 2024

Haochen Luo, Jindong Gu, Fengyuan Liu, and Philip Torr. An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models, 2024. URL https://arxiv.org/abs/2403.09766

2024 arXiv
[56]

Jailbreaking prompt attack: A controllable adversarial attack against diffusion models, 2024 a

Jiachen Ma, Anda Cao, Zhiqing Xiao, Yijiang Li, Jie Zhang, Chao Ye, and Junbo Zhao. Jailbreaking prompt attack: A controllable adversarial attack against diffusion models, 2024 a . URL https://arxiv.org/abs/2404.02928

2024 arXiv
[57]

Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character, 2024 b

Siyuan Ma, Weidi Luo, Yu Wang, and Xiaogeng Liu. Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character, 2024 b . URL https://arxiv.org/abs/2405.20773

2024 arXiv
[58]

Reversible recurrent neural networks

Matthew MacKay, Paul Vicol, Jimmy Ba, and Roger B Grosse. Reversible recurrent neural networks. Advances in Neural Information Processing Systems, 31, 2018

2018
[59]

Towards deep learning models resistant to adversarial attacks, 2019

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019. URL https://arxiv.org/abs/1706.06083

2019 arXiv
[60]

Reversible vision transformers

Karttikeya Mangalam, Haoqi Fan, Yanghao Li, Chao-Yuan Wu, Bo Xiong, Christoph Feichtenhofer, and Jitendra Malik. Reversible vision transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10830--10840, 2022

2022
[61]

Jailbreaking attack against multimodal large language model, 2024

Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. Jailbreaking attack against multimodal large language model, 2024. URL https://arxiv.org/abs/2402.02309

2024 arXiv
[62]

OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff ...

2024 arXiv
[63]

Masked autoregressive flow for density estimation

George Papamakarios, Theo Pavlakou, and Iain Murray. Masked autoregressive flow for density estimation. Advances in neural information processing systems, 30, 2017

2017
[64]

Advprompter: Fast adaptive adversarial prompting for llms, 2024

Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. Advprompter: Fast adaptive adversarial prompting for llms, 2024. URL https://arxiv.org/abs/2404.16873

2024 arXiv
[65]

Scalable diffusion models with transformers

William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4195--4205, 2023

2023
[66]

Eagle and finch: Rwkv with matrix-valued states and dynamic recurrence, 2024

Bo Peng, Daniel Goldstein, Quentin Anthony, Alon Albalak, Eric Alcaide, Stella Biderman, Eugene Cheah, Xingjian Du, Teddy Ferdinan, Haowen Hou, Przemysław Kazienko, Kranthi Kiran GV, Jan Kocoń, Bartłomiej Koptyra, Satyapriya Krishna, Ronald McClelland Jr., Jiaju Lin, Niklas Mu...

2024 arXiv
[67]

Ignore previous prompt: Attack techniques for language models, 2022

Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models, 2022. URL https://arxiv.org/abs/2211.09527

2022 arXiv
[68]

Visual adversarial examples jailbreak aligned large language models

Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pages 21527--21536, 2024

2024
[69]

Maan Qraitem, Nazia Tasnim, Piotr Teterwak, Kate Saenko, and Bryan A. Plummer. Vision-llms can fool themselves with self-generated typographic attacks, 2025. URL https://arxiv.org/abs/2402.00626

2025 arXiv
[70]

Improving language understanding by generative pre-training

Alec Radford, Karthik Narasimhan, Tim Salimans, Ilya Sutskever, et al. Improving language understanding by generative pre-training. 2018

2018
[71]

Learning transferable visual models from natural language supervision

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pa...

2021
[72]

Real-world humanoid locomotion with reinforcement learning

Ilija Radosavovic, Tete Xiao, Bike Zhang, Trevor Darrell, Jitendra Malik, and Koushil Sreenath. Real-world humanoid locomotion with reinforcement learning. Science Robotics, 9 0 (89): 0 eadi9579, 2024

2024
[73]

Universal jailbreak backdoors from poisoned human feedback, 2024

Javier Rando and Florian Tramèr. Universal jailbreak backdoors from poisoned human feedback, 2024. URL https://arxiv.org/abs/2311.14455

2024 arXiv
[74]

Tricking LLM s into disobedience: Formalizing, analyzing, and detecting jailbreaks

Abhinav Sukumar Rao, Atharva Roshan Naik, Sachin Vashistha, Somak Aditya, and Monojit Choudhury. Tricking LLM s into disobedience: Formalizing, analyzing, and detecting jailbreaks. In Nicoletta Calzolari, Min-Yen Kan, Veronique Hoste, Alessandro Lenci, Sakriani Sakti, and Nian...

2024
[75]

Variational inference with normalizing flows

Danilo Rezende and Shakir Mohamed. Variational inference with normalizing flows. In International conference on machine learning, pages 1530--1538. PMLR, 2015

2015
[76]

U-net: Convolutional networks for biomedical image segmentation

Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-assisted intervention--MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part...

2015
[77]

Linear transformers are secretly fast weight programmers

Imanol Schlag, Kazuki Irie, and J \"u rgen Schmidhuber. Linear transformers are secretly fast weight programmers. In International conference on machine learning, pages 9355--9366. PMLR, 2021

2021
[78]

On the adversarial robustness of multi-modal foundation models

Christian Schlarmann and Matthias Hein. On the adversarial robustness of multi-modal foundation models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3677--3685, 2023

2023
[79]

Scalable and transferable black-box jailbreaks for language models via persona modulation, 2023

Rusheb Shah, Quentin Feuillade-Montixi, Soroush Pour, Arush Tagade, Stephen Casper, and Javier Rando. Scalable and transferable black-box jailbreaks for language models via persona modulation, 2023. URL https://arxiv.org/abs/2311.03348

2023 arXiv
[80]

Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models, 2023

Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models, 2023. URL https://arxiv.org/abs/2307.14539

2023 arXiv
[81]

Large language model safety: A holistic survey, 2024

Dan Shi, Tianhao Shen, Yufei Huang, Zhigen Li, Yongqi Leng, Renren Jin, Chuang Liu, Xinwei Wu, Zishan Guo, Linhao Yu, Ling Shi, Bojian Jiang, and Deyi Xiong. Large language model safety: A holistic survey, 2024. URL https://arxiv.org/abs/2412.17686

2024 arXiv
[82]

Promptarmor: Simple yet effective prompt injection defenses

Tianneng Shi, Kaijie Zhu, Zhun Wang, Yuqi Jia, Will Cai, Weida Liang, Haonan Wang, Hend Alzahrani, Joshua Lu, Kenji Kawaguchi, et al. Promptarmor: Simple yet effective prompt injection defenses. arXiv preprint arXiv:2507.15219, 2025

2025 arXiv
[83]

Sponge examples: Energy-latency attacks on neural networks

Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, and Ross Anderson. Sponge examples: Energy-latency attacks on neural networks. In 2021 IEEE European symposium on security and privacy (EuroS&P), pages 212--231. IEEE, 2021

2021
[84]

Pal: Proxy-guided black-box attack on large language models, 2024

Chawin Sitawarin, Norman Mu, David Wagner, and Alexandre Araujo. Pal: Proxy-guided black-box attack on large language models, 2024. URL https://arxiv.org/abs/2402.09674

2024 arXiv
[85]

Deep unsupervised learning using nonequilibrium thermodynamics

Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learning, pages 2256--2265. pmlr, 2015

2015
[86]

Denoising diffusion implicit models, 2022

Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models, 2022. URL https://arxiv.org/abs/2010.02502

2022 arXiv
[87]

Mintnet: Building invertible neural networks with masked convolutions

Yang Song, Chenlin Meng, and Stefano Ermon. Mintnet: Building invertible neural networks with masked convolutions. Advances in Neural Information Processing Systems, 32, 2019

2019
[88]

Retentive network: A successor to transformer for large language models, 2023

Yutao Sun, Li Dong, Shaohan Huang, Shuming Ma, Yuqing Xia, Jilong Xue, Jianyong Wang, and Furu Wei. Retentive network: A successor to transformer for large language models, 2023. URL https://arxiv.org/abs/2307.08621

2023 arXiv
[89]

Alex Hofer, Jan Humplik, Atil Iscen, Mithun George Jacob, Deepali Jain, Ryan Julian, Dmitry Kalashnikov, M

Gemini Robotics Team, Saminda Abeyruwan, Joshua Ainslie, Jean-Baptiste Alayrac, Montserrat Gonzalez Arenas, Travis Armstrong, Ashwin Balakrishna, Robert Baruch, Maria Bauza, Michiel Blokzijl, Steven Bohez, Konstantinos Bousmalis, Anthony Brohan, Thomas Buschmann, Arunkumar Byr...

2025 arXiv
[90]

Heuristic-induced multimodal risk distribution jailbreak attack for multimodal large language models, 2025

Ma Teng, Jia Xiaojun, Duan Ranjie, Li Xinfeng, Huang Yihao, Chu Zhixuan, Liu Yang, and Ren Wenqi. Heuristic-induced multimodal risk distribution jailbreak attack for multimodal large language models, 2025. URL https://arxiv.org/abs/2412.05934

2025 arXiv
[91]

Llama 2: Open foundation and fine-tuned chat models, 2023

Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, W...

2023 arXiv
[92]

Attention is all you need

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, ukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017

2017
[93]

Poisoning language models during instruction tuning

Alexander Wan, Eric Wallace, Sheng Shen, and Dan Klein. Poisoning language models during instruction tuning. In International Conference on Machine Learning, pages 35413--35425. PMLR, 2023

2023
[94]

Juli: Jailbreak large language models by self-introspection, 2025 a

Jesson Wang, Zhanhao Hu, and David Wagner. Juli: Jailbreak large language models by self-introspection, 2025 a . URL https://arxiv.org/abs/2505.11790

2025
[95]

White-box multimodal jailbreaks against large vision-language models

Ruofan Wang, Xingjun Ma, Hanxu Zhou, Chuanjun Ji, Guangnan Ye, and Yu-Gang Jiang. White-box multimodal jailbreaks against large vision-language models. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 6920--6928, 2024 a

2024
[96]

Exploring the adversarial vulnerabilities of vision-language-action models in robotics, 2025 b

Taowen Wang, Cheng Han, James Chenhao Liang, Wenhao Yang, Dongfang Liu, Luna Xinyu Zhang, Qifan Wang, Jiebo Luo, and Ruixiang Tang. Exploring the adversarial vulnerabilities of vision-language-action models in robotics, 2025 b . URL https://arxiv.org/abs/2411.13587

2025 arXiv
[97]

Jailbreak large vision-language models through multi-modal linkage, 2024 b

Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. Jailbreak large vision-language models through multi-modal linkage, 2024 b . URL https://arxiv.org/abs/2412.00473

2024 arXiv
[98]

Attngcg: Enhancing jailbreaking attacks on llms with attention manipulation, 2024 c

Zijun Wang, Haoqin Tu, Jieru Mei, Bingchen Zhao, Yisen Wang, and Cihang Xie. Attngcg: Enhancing jailbreaking attacks on llms with attention manipulation, 2024 c . URL https://arxiv.org/abs/2410.09040

2024 arXiv
[99]

Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36: 0 80079--80110, 2023

Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36: 0 80079--80110, 2023

2023
[100]

Jailbreak and guard aligned language models with only few in-context demonstrations, 2024

Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. Jailbreak and guard aligned language models with only few in-context demonstrations, 2024. URL https://arxiv.org/abs/2310.06387

2024 arXiv
[101]

Group normalization

Yuxin Wu and Kaiming He. Group normalization. In Proceedings of the European conference on computer vision (ECCV), pages 3--19, 2018

2018
[102]

On layer normalization in the transformer architecture

Ruibin Xiong, Yunchang Yang, Di He, Kai Zheng, Shuxin Zheng, Chen Xing, Huishuai Zhang, Yanyan Lan, Liwei Wang, and Tieyan Liu. On layer normalization in the transformer architecture. In International conference on machine learning, pages 10524--10533. PMLR, 2020

2020
[103]

Adversarial t-shirt! evading person detectors in a physical world

Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin-Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in a physical world. In Computer vision--ECCV 2020: 16th European conference, glasgow, UK, August 23--28, 2020, procee...

2020
[104]

Cognitive overload: Jailbreaking large language models with overloaded logical thinking

Nan Xu, Fei Wang, Ben Zhou, Bangzheng Li, Chaowei Xiao, and Muhao Chen. Cognitive overload: Jailbreaking large language models with overloaded logical thinking. In Kevin Duh, Helena Gomez, and Steven Bethard, editors, Findings of the Association for Computational Linguistics: ...

2024 doi
[105]

Gated linear attention transformers with hardware-efficient training, 2024

Songlin Yang, Bailin Wang, Yikang Shen, Rameswar Panda, and Yoon Kim. Gated linear attention transformers with hardware-efficient training, 2024. URL https://arxiv.org/abs/2312.06635

2024 arXiv
[106]

Gated delta networks: Improving mamba2 with delta rule, 2025

Songlin Yang, Jan Kautz, and Ali Hatamizadeh. Gated delta networks: Improving mamba2 with delta rule, 2025. URL https://arxiv.org/abs/2412.06464

2025 arXiv
[107]

A survey of safety on large vision-language models: Attacks, defenses and evaluations, 2025

Mang Ye, Xuankun Rong, Wenke Huang, Bo Du, Nenghai Yu, and Dacheng Tao. A survey of safety on large vision-language models: Attacks, defenses and evaluations, 2025. URL https://arxiv.org/abs/2502.14881

2025 arXiv
[108]

Jailbreak vision language models via bi-modal adversarial prompt, 2024

Zonghao Ying, Aishan Liu, Tianyuan Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. Jailbreak vision language models via bi-modal adversarial prompt, 2024. URL https://arxiv.org/abs/2406.04031

2024 arXiv
[109]

Zheng-Xin Yong, Cristina Menghini, and Stephen H. Bach. Low-resource languages jailbreak gpt-4, 2024. URL https://arxiv.org/abs/2310.02446

2024 arXiv
[110]

Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher, 2024

Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher, 2024. URL https://arxiv.org/abs/2308.06463

2024 arXiv
[111]

Advi2i: Adversarial image attack on image-to-image diffusion models, 2024

Yaopei Zeng, Yuanpu Cao, Bochuan Cao, Yurui Chang, Jinghui Chen, and Lu Lin. Advi2i: Adversarial image attack on image-to-image diffusion models, 2024. URL https://arxiv.org/abs/2410.21471

2024 arXiv
[112]

Root mean square layer normalization

Biao Zhang and Rico Sennrich. Root mean square layer normalization. Advances in Neural Information Processing Systems, 32, 2019

2019
[113]

Boosting jailbreak attack with momentum

Yihao Zhang and Zeming Wei. Boosting jailbreak attack with momentum. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1--5. IEEE, 2025

2025
[114]

On evaluating adversarial robustness of large vision-language models

Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems, 36: 0 54111--54138, 2023

2023
[115]

Transformers without normalization

Jiachen Zhu, Xinlei Chen, Kaiming He, Yann LeCun, and Zhuang Liu. Transformers without normalization. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 14901--14911, 2025

2025
[116]

Hybridnorm: Towards stable and efficient transformer training via hybrid normalization, 2025

Zhijian Zhuo, Yutao Zeng, Ya Wang, Sijun Zhang, Jian Yang, Xiaoqing Li, Xun Zhou, and Jinwen Ma. Hybridnorm: Towards stable and efficient transformer training via hybrid normalization, 2025. URL https://arxiv.org/abs/2503.04598

2025
[117]

Zico Kolter, and Matt Fredrikson

Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023. URL https://arxiv.org/abs/2307.15043

2023 arXiv
[118]

Image-to-text logic jailbreak: Your imagination can help you do anything, 2024

Xiaotian Zou, Ke Li, and Yongkang Chen. Image-to-text logic jailbreak: Your imagination can help you do anything, 2024. URL https://arxiv.org/abs/2407.02534

2024 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

Synthesizing robust adversarial examples

Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference on machine learning, pages 284--293. PMLR, 2018

2018

[2] [2]

Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E. Hinton. Layer normalization, 2016. URL https://arxiv.org/abs/1607.06450

arXiv 2016

[3] [3]

Neural machine translation by jointly learning to align and translate, 2016

Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. Neural machine translation by jointly learning to align and translate, 2016. URL https://arxiv.org/abs/1409.0473

arXiv 2016

[4] [4]

Image hijacks: Adversarial images can control generative models at runtime, 2024

Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. Image hijacks: Adversarial images can control generative models at runtime, 2024. URL https://arxiv.org/abs/2309.00236

arXiv 2024

[5] [5]

Invertible residual networks

Jens Behrmann, Will Grathwohl, Ricky TQ Chen, David Duvenaud, and J \"o rn-Henrik Jacobsen. Invertible residual networks. In International conference on machine learning, pages 573--582. PMLR, 2019

2019

[6] [6]

Language models are few-shot learners

Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in neural information processing systems, 33: 0 1877--1901, 2020

1901

[7] [7]

Residual flows for invertible generative modeling

Ricky TQ Chen, Jens Behrmann, David K Duvenaud, and J \"o rn-Henrik Jacobsen. Residual flows for invertible generative modeling. Advances in Neural Information Processing Systems, 32, 2019

2019

[8] [8]

Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models

Simin Chen, Zihe Song, Mirazul Haque, Cong Liu, and Wei Yang. Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15365--15374, 2022

2022