该仓库是论文索引而非可运行工具，不提供安装或运行方式；多数条目的代码链接指向外部仓库，需逐个自行获取；部分论文未提供代码，仅能读论文
Awesome-Jailbreak-on-LLMs
yueliu1999MIT活跃维护收集大模型越狱攻击的前沿论文、代码、数据集与评测分析，帮安全研究者快速跟进 LLM 与多模态模型的攻防进展。
Awesome-Jailbreak-on-LLMs is a collection of state-of-the-art, novel, exciting jailbreak methods on LLMs. It contains papers, codes, datasets, evaluations, and analyses.
暂无版本1,732star +2 / 7 天148fork同步于 2026-11-11 05:44 UTC
LLM 越狱研究论文、代码与数据集的分类索引库，帮你快速定位攻击与防御方法
收集大模型越狱攻击的前沿论文、代码、数据集与评测分析，帮安全研究者快速跟进 LLM 与多模态模型的攻防进展。
核心能力
- 按 LRM、黑盒、白盒、多轮、RAG、多模态分类攻击论文
- 单列防御方向，含学习型防御、策略防御、Guard 模型与审核 API
- 每条论文附时间、会议、arXiv 链接和代码仓库链接
- 收录评估分析与应用章节，便于对比方法效果
容易踩的坑
内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README
暂无 release 数据（可能没有发版，或尚未同步）。
用户点评
登录用户的真实使用记录，可按版本和硬件筛选共 0 条
还没有人点评。第一个说出真实体验的人最有价值。
Awesome-Jailbreak-on-LLMs
Awesome-Jailbreak-on-LLMs is a collection of state-of-the-art, novel, exciting jailbreak methods on LLMs. It contains papers, codes, datasets, evaluations, and analyses. Any additional things regarding jailbreak, PRs, issues are welcome and we are glad to add you to the contributor list here. Any problems, please contact [email protected]. If you find this repository useful to your research or work, it is really appreciated to star this repository and cite our papers here. :sparkles:
Reference
If you find this repository helpful for your research, we would greatly appreciate it if you could cite our papers. :sparkles:
@article{zhuzhenhao_GuardReasoner_Omni,
title={GuardReasoner-Omni: A Reasoning-based Multi-modal Guardrail for Text, Image, and Video},
author={Zhu, Zhenhao and Liu, Yue and Guo, Yanpei and Qu, Wenjie and Chen, Cancan and He, Yufei and Li, Yibo and Chen, Yulin and Wu, Tianyi and Xu, Huiying and others},
journal={arXiv preprint arXiv:2602.03328},
year={2026}
}
@article{liuyue_GuardReasoner_VL,
title={GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning},
author={Liu, Yue and Zhai, Shengfang and Du, Mingzhe and Chen, Yulin and Cao, Tri and Gao, Hongcheng and Wang, Cheng and Li, Xinfeng and Wang, Kun and Fang, Junfeng and Zhang, Jiaheng and Hooi, Bryan},
journal={arXiv preprint arXiv:2505.11049},
year={2025}
}
@article{liuyue_GuardReasoner,
title={GuardReasoner: Towards Reasoning-based LLM Safeguards},
author={Liu, Yue and Gao, Hongcheng and Zhai, Shengfang and Jun, Xia and Wu, Tianyi and Xue, Zhiwei and Chen, Yulin and Kawaguchi, Kenji and Zhang, Jiaheng and Hooi, Bryan},
journal={arXiv preprint arXiv:2501.18492},
year={2025}
}
@article{liuyue_FlipAttack,
title={FlipAttack: Jailbreak LLMs via Flipping},
author={Liu, Yue and He, Xiaoxin and Xiong, Miao and Fu, Jinlan and Deng, Shumin and Hooi, Bryan},
journal={arXiv preprint arXiv:2410.02832},
year={2024}
}
@article{wang2025safety,
title={Safety in Large Reasoning Models: A Survey},
author={Wang, Cheng and Liu, Yue and Li, Baolong and Zhang, Duzhen and Li, Zhongzhi and Fang, Junfeng},
journal={arXiv preprint arXiv:2504.17704},
year={2025}
}
Bookmarks
Papers
Jailbreak Attack
Attack on LRMs
| Time | Title | Venue | Paper | Code |
|---|---|---|---|---|
| 2026.05 | Reasoning as an Attack Surface: Adaptive Evolutionary CoT Jailbreaks for LLMs | arXiv | link | link |
| 2025.11 | BadThink: Triggered Overthinking Attacks on Chain-of-Thought Reasoning in Large Language Models | AAAI'26 | link | - |
| 2025.10 | When Models Outthink Their Safety: Unveiling and Mitigating Self-Jailbreak in Large Reasoning Models | arXiv | link | - |
| 2025.10 | AutoDAN-Reasoning: Enhancing Strategies Exploration based Jailbreak Attacks with Test-Time Scaling | arXiv | link | link |
| 2025.08 | Jinx: Unlimited LLMs for Probing Alignment Failures | arXiv | link | models |
| 2025.07 | BadReasoner: Planting Tunable Overthinking Backdoors into Large Reasoning Models for Fun or Profit | arXiv | link | link |
| 2025.06 | ExtendAttack: Attacking Servers of LRMs via Extending Reasoning | AAAI'26 | link | link |
| 2025.06 | Excessive Reasoning Attack on Reasoning LLMs | arXiv | link | - |
| 2025.03 | Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Models | arXiv | link | - |
| 2025.02 | OverThink: Slowdown Attacks on Reasoning LLMs | arXiv | link | link |
| 2025.02 | BoT: Breaking Long Thought Processes of o1-like Large Language Models through Backdoor Attack | arXiv | link | link |
| 2025.02 | H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking | arXiv | link | link |
| 2025.02 | A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos | arXiv | link | - |
Black-box Attack
| Time | Title | Venue | Paper | Code |
|---|---|---|---|---|
| 2026.05 | LASH: Adaptive Semantic Hybridization for Black-Box Jailbreaking of Large Language Models | arXiv | link | - |
| 2026.03 | Internal Safety Collapse in Frontier Large Language Models (ISC-Bench) | arXiv | link | link |
| 2026.03 | Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMs | arXiv | link | - |
| 2026.01 | Jailbreaking LLMs Without Gradients or Priors: Effective and Transferable Attacks | arXiv | link | - |
| 2025.12 | Safe2Harm: Semantic Isomorphism Attacks for Jailbreaking Large Language Models | arXiv | link | - |
| 2025.11 | "To Survive, I Must Defect": Jailbreaking LLMs via the Game-Theory Scenarios | arXiv | link | - |
| 2025.10 | Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency | NeurIPS'25 | link | - |
| 2025.10 | Jailbreak Mimicry: Automated Discovery of Narrative-Based Jailbreaks for Large Language Models | arXiv | link | - |
| 2025.10 | MetaBreak: Jailbreaking Online LLM Services via Special Token Manipulation | arXiv | link | - |
| 2025.10 | BreakFun: Jailbreaking LLMs via Schema Exploitation | arXiv | link | - |
| 2025.07 | Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Models | arXiv | link | link |
| 2025.05 | Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection | ICML'25 | link | link |
| 2025.05 | FlipAttack: Jailbreak LLMs via Flipping (FlipAttack) | ICML'25 | link | link |
| 2025.03 | Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (JOOD) | CVPR'25 | link | link |
| 2025.03 | JBFuzz: Jailbreaking LLMs Efficiently and Effectively Using Fuzzing | arXiv | link | - |
| 2025.02 | StructTransform: A Scalable Attack Surface for Safety-Aligned Large Language Models | arXiv | link | link |
| 2025.01 | Jailbreaking LLMs' Safeguard with Universal Magic Words for Text Embedding Models | arXiv | link | - |
| 2025.01 | Understanding and Enhancing the Transferability of Jailbreaking Attacks | ICLR'25 | link | link |
| 2024.11 | The Dark Side of Trust: Authority Citation-Driven Jailbreak Attacks on Large Language Models | arXiv | link | link |
| 2024.11 | Playing Language Game with LLMs Leads to Jailbreaking | arXiv | link | link |
| 2024.11 | GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs (GASP) | arXiv | link | link |
| 2024.11 | LLM STINGER: Jailbreaking LLMs using RL fine-tuned LLMs | arXiv | link | - |
| 2024.11 | SequentialBreak: Large Language Models Can be Fooled by Embedding Jailbreak Prompts into Sequential Prompt | arXiv | link | link |
| 2024.11 | Diversity Helps Jailbreak Large Language Models | arXiv | link | - |
| 2024.11 | Plentiful Jailbreaks with String Compositions | arXiv | link | - |
| 2024.11 | Transferable Ensemble Black-box Jailbreak Attacks on Large Language Models | arXiv | link | link |
| 2024.11 | Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring | arXiv | link | - |
| 2024.10 | Endless Jailbreaks with Bijection | arXiv | link | - |
| 2024.10 | Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models | arXiv | link | - |
| 2024.10 | You Know What I'm Saying: Jailbreak Attack via Implicit Reference | arXiv | link | link |
| 2024.10 | Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation | arXiv | link | link |
| 2024.10 | AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs (AutoDAN-Turbo) | arXiv | link | link |
| 2024.10 | PathSeeker: Exploring LLM Security Vulnerabilities with a Reinforcement Learning-Based Jailbreak Approach (PathSeeker) | arXiv | link | - |
| 2024.10 | Read Over the Lines: Attacking LLMs and Toxicity Detection Systems with ASCII Art to Mask Profanity | arXiv | link | link |
| 2024.09 | AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMs | arXiv | link | link |
| 2024.09 | Effective and Evasive Fuzz Testing-Driven Jailbreaking Attacks against LLMs | arXiv | link | - |
| 2024.09 | Jailbreaking Large Language Models with Symbolic Mathematics | arXiv | link | - |
| 2024.08 | Play Guessing Game with LLM: Indirect Jailbreak Attack with Implicit Clues | ACL Findings'24 | link | link |
| 2024.08 | Advancing Adversarial Suffix Transfer Learning on Aligned Large Language Models | arXiv | link | - |
| 2024.08 | Hide Your Malicious Goal Into Benign Narratives: Jailbreak Large Language Models through Neural Carrier Articles | arXiv | link | - |
| 2024.08 | h4rm3l: A Dynamic Benchmark of Composable Jailbreak Attacks for LLM Safety Assessment (h4rm3l) | arXiv | link | link |
| 2024.08 | EnJa: Ensemble Jailbreak on Large Language Models (EnJa) | arXiv | link | - |
| 2024.07 | Knowledge-to-Jailbreak: One Knowledge Point Worth One Attack | arXiv | link | link |
| 2024.07 | LLMs can be Dangerous Reasoners: Analyzing-based Jailbreak Attack on Large Language Models | arXiv | link | |
| 2024.07 | Single Character Perturbations Break LLM Alignment | arXiv | link | link |
| 2024.07 | A False Sense of Safety: Unsafe Information Leakage in 'Safe' AI Responses | arXiv | link | - |
| 2024.07 | Virtual Context: Enhancing Jailbreak Attacks with Special Token Injection (Virtual Context) | arXiv | link | - |
| 2024.07 | SoP: Unlock the Power of Social Facilitation for Automatic Jailbreak Attack (SoP) | arXiv | link | link |
| 2024.06 | Jailbreaking as a Reward Misspecification Problem | ICLR'25 | link | link |
| 2024.06 | Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses (I-FSJ) | NeurIPS'24 | link | link |
| 2024.06 | When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search (RLbreaker) | NeurIPS'24 | link | - |
| 2024.06 | Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast (Agent Smith) | ICML'24 | link | link |
| 2024.06 | Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptation | ICML'24 | link | - |
| 2024.06 | ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs (ArtPrompt) | ACL'24 | link | link |
| 2024.06 | From Noise to Clarity: Unraveling the Adversarial Suffix of Large Language Model Attacks via Translation of Text Embeddings (ASETF) | arXiv | link | - |
| 2024.06 | CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion (CodeAttack) | ACL'24 | link | - |
| 2024.06 | Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction (DRA) | USENIX Security'24 | link | link |
| 2024.06 | AutoJailbreak: Exploring Jailbreak Attacks and Defenses through a Dependency Lens (AutoJailbreak) | arXiv | link | - |
| 2024.06 | Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks | arXiv | link | link |
| 2024.06 | GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts (GPTFUZZER) | arXiv | link | link |
| 2024.06 | A Wolf in Sheep’s Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily (ReNeLLM) | NAACL'24 | link | link |
| 2024.06 | QROA: A Black-Box Query-Response Optimization Attack on LLMs (QROA) | arXiv | link | link |
| 2024.06 | Poisoned LangChain: Jailbreak LLMs by LangChain (PLC) | arXiv | link | link |
| 2024.05 | Multilingual Jailbreak Challenges in Large Language Models | ICLR'24 | link | link |
| 2024.05 | DeepInception: Hypnotize Large Language Model to Be Jailbreaker (DeepInception) | EMNLP'24 | link | link |
| 2024.05 | GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation (IRIS) | ACL'24 | link | - |
| 2024.05 | GUARD: Role-playing to Generate Natural-language Jailbreakings to Test Guideline Adherence of LLMs (GUARD) | arXiv | link | - |
| 2024.05 | "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models (DAN) | CCS'24 | link | link |
| 2024.05 | Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher (SelfCipher) | ICLR'24 | link | link |
| 2024.05 | Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters (JAM) | NeurIPS'24 | link | - |
| 2024.05 | Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations (ICA) | arXiv | link | - |
| 2024.04 | Many-shot jailbreaking (MSJ) | NeurIPS'24 Anthropic | link | - |
| 2024.04 | PANDORA: Detailed LLM jailbreaking via collaborated phishing agents with decomposed reasoning (PANDORA) | ICLR Workshop'24 | link | - |
| 2024.04 | Fuzzllm: A novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models (FuzzLLM) | ICASSP'24 | link | link |
| 2024.04 | Sandwich attack: Multi-language mixture adaptive attack on llms (Sandwich attack) | TrustNLP'24 | link | - |
| 2024.03 | Tastle: Distract large language models for automatic jailbreak attack (TASTLE) | arXiv | link | - |
| 2024.03 | DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers (DrAttack) | EMNLP'24 | link | link |
| 2024.02 | PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails (PRP) | arXiv | link | - |
| 2024.02 | CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models (CodeChameleon) | arXiv | link | link |
| 2024.02 | PAL: Proxy-Guided Black-Box Attack on Large Language Models (PAL) | arXiv | link | link |
| 2024.02 | Jailbreaking Proprietary Large Language Models using Word Substitution Cipher | arXiv | link | - |
| 2024.02 | Query-Based Adversarial Prompt Generation | arXiv | link | - |
| 2024.02 | Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks (Contextual Interaction Attack) | arXiv | link | - |
| 2024.02 | Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs (SMJ) | arXiv | link | - |
| 2024.02 | Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking | NAACL'24 | link | link |
| 2024.01 | Low-Resource Languages Jailbreak GPT-4 | NeurIPS Workshop'24 | link | - |
| 2024.01 | How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs (PAP) | arXiv | link | link |
| 2023.12 | Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (TAP) | NeurIPS'24 | link | link |
| 2023.12 | Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMs | arXiv | link | - |
| 2023.12 | Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition | ACL'24 | link | - |
| 2023.11 | Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation (Persona) | NeurIPS Workshop'23 | link | - |
| 2023.10 | Jailbreaking Black Box Large Language Models in Twenty Queries (PAIR) | NeurIPS'24 | link | link |
| 2023.10 | Adversarial Demonstration Attacks on Large Language Models (advICL) | EMNLP'24 | link | - |
| 2023.10 | MASTERKEY: Automated Jailbreaking of Large Language Model Chatbots (MASTERKEY) | NDSS'24 | link | link |
| 2023.10 | Attack Prompt Generation for Red Teaming and Defending Large Language Models (SAP) | EMNLP'23 | link | link |
| 2023.10 | An LLM can Fool Itself: A Prompt-Based Adversarial Attack (PromptAttack) | ICLR'24 | link | link |
| 2023.09 | Multi-step Jailbreaking Privacy Attacks on ChatGPT (MJP) | EMNLP Findings'23 | link | link |
| 2023.09 | Open Sesame! Universal Black Box Jailbreaking of Large Language Models (GA) | Applied Sciences'24 | link | - |
| 2023.05 | Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection | CCS'23 | link | link |
| 2022.11 | Ignore Previous Prompt: Attack Techniques For Language Models (PromptInject) | NeurIPS WorkShop'22 | link | link |
White-box Attack
| Year | Title | Venue | Paper | Code |
|---|---|---|---|---|
| 2026.02 | Beyond Suffixes: Token Position in GCG Adversarial Attacks on Large Language Models | arXiv | link | - |
| 2026.01 | TrojanPraise: Jailbreak LLMs via Benign Fine-Tuning | arXiv | link | - |
| 2025.11 | TASO: Jailbreak LLMs via Alternative Template and Suffix Optimization | arXiv | link | - |
| 2025.11 | SABER: Uncovering Vulnerabilities in Safety Alignment via Cross-Layer Residual Connection | EMNLP'25 | link | link |
| 2025.10 | Imperceptible Jailbreaking against Large Language Models | arXiv | link | - |
| 2025.10 | Attack via Overfitting: 10-shot Benign Fine-tuning to Jailbreak LLMs | arXiv | link | - |
| 2025.10 | Dynamic Target Attack | arXiv | link | - |
| 2025.10 | Untargeted Jailbreak Attack | arXiv | link | - |
| 2025.08 | Don’t Say No: Jailbreaking LLM by Suppressing Refusal (DSN) | ACL'25 | link | link |
| 2025.03 | Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints | arXiv | link | link |
| 2025.02 | Improved techniques for optimization-based jailbreaking on large language models (I-GCG) | ICLR'25 | link | link |
| 2024.12 | Efficient Adversarial Training in LLMs with Continuous Attacks | NeurIPS'24 | link | link |
| 2024.11 | AmpleGCG-Plus: A Strong Generative Model of Adversarial Suffixes to Jailbreak LLMs with Higher Success Rates in Fewer Attempts | arXiv | link | - |
| 2024.11 | DROJ: A Prompt-Driven Attack against Large Language Models | arXiv | link | link |
| 2024.11 | SQL Injection Jailbreak: a structural disaster of large language models | arXiv | link | link |
| 2024.10 | Functional Homotopy: Smoothing Discrete Optimization via Continuous Parameters for LLM Jailbreak Attacks | arXiv | link | - |
| 2024.10 | AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulation | arXiv | link | link |
| 2024.10 | Jailbreak Instruction-Tuned LLMs via end-of-sentence MLP Re-weighting | arXiv | link | - |
| 2024.10 | Boosting Jailbreak Transferability for Large Language Models (SI-GCG) | arXiv | link | - |
| 2024.10 | Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities (ADV-LLM) | arXiv | link | link |
| 2024.08 | Probing the Safety Response Boundary of Large Language Models via Unsafe Decoding Path Generation (JVD) | arXiv | link | - |
| 2024.08 | Jailbreak Open-Sourced Large Language Models via Enforced Decoding (EnDec) | ACL'24 | link | - |
| 2024.07 | Best-of-Venom: Attacking RLHF by Injecting Poisoned Preference Data | COLM'24 | Link | - |
| 2024.07 | Refusal in Language Models Is Mediated by a Single Direction | arXiv | Link | Link |
| 2024.07 | Revisiting Character-level Adversarial Attacks for Language Models | ICML'24 | link | link |
| 2024.07 | Badllama 3: removing safety finetuning from Llama 3 in minutes (Badllama 3) | arXiv | link | - |
| 2024.07 | SOS! Soft Prompt Attack Against Open-Source Large Language Models | arXiv | link | - |
| 2024.06 | COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability (COLD-Attack) | ICML'24 | link | link |
| 2024.05 | Semantic-guided Prompt Organization for Universal Goal Hijacking against LLMs | arXiv | link | |
| 2024.05 | Efficient LLM Jailbreak via Adaptive Dense-to-sparse Constrained Optimization | NeurIPS'24 | Link | - |
| 2024.05 | AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models (AutoDAN) | ICLR'24 | link | link |
| 2024.05 | AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs (AmpleGCG) | arXiv | link | link |
| 2024.05 | Boosting jailbreak attack with momentum (MAC) | ICLR Workshop'24 | link | link |
| 2024.04 | AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (AdvPrompter) | arXiv | link | link |
| 2024.03 | Universal Jailbreak Backdoors from Poisoned Human Feedback | ICLR'24 | link | - |
| 2024.02 | Attacking large language models with projected gradient descent (PGD) | arXiv | link | - |
| 2024.02 | Open the Pandora's Box of LLMs: Jailbreaking LLMs through Representation Engineering (JRE) | arXiv | link | - |
| 2024.02 | Curiosity-driven red-teaming for large language models (CRT) | arXiv | link | link |
| 2023.12 | AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models (AutoDAN) | arXiv | link | link |
| 2023.10 | Catastrophic jailbreak of open-source llms via exploiting generation | ICLR'24 | link | link |
| 2023.06 | Automatically Auditing Large Language Models via Discrete Optimization (ARCA) | ICML'23 | link | link |
| 2023.07 | Universal and Transferable Adversarial Attacks on Aligned Language Models (GCG) | arXiv | link | link |
Multi-turn Attack
| Time | Title | Venue | Paper | Code |
|---|---|---|---|---|
| 2026.02 | SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attacks | arXiv | link | link |
| 2026.01 | Knowledge-Driven Multi-Turn Jailbreaking on Large Language Models | arXiv | link | - |
| 2025.12 | TROJail: Trajectory-Level Optimization for Multi-Turn Large Language Model Jailbreaks with Process Rewards | ACL'26 | link | link |
| 2025.10 | HarmNet: A Framework for Adaptive Multi-Turn Jailbreak Attacks on Large Language Models | arXiv | link | - |
| 2025.10 | Pattern Enhanced Multi-Turn Jailbreaking: Exploiting Structural Vulnerabilities in Large Language Models | arXiv | link | link |
| 2025.10 | NEXUS: Network Exploration for eXploiting Unsafe Sequences in Multi-Turn LLM Jailbreaks | arXiv | link | - |
| 2025.04 | Multi-Turn Jailbreaking Large Language Models via Attention Shifting | AAAI'25 | link | - |
| 2025.04 | X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agents | arXiv | link | link |
| 2025.04 | Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learning | arXiv | link | - |
| 2025.03 | Foot-In-The-Door: A Multi-turn Jailbreak for LLMs | arXiv | link | link |
| 2025.03 | Siege: Autonomous Multi-Turn Jailbreaking of Large Language Models with Tree Search | arXiv | link | - |
| 2024.11 | MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue | arXiv | link | - |
| 2024.10 | Jigsaw Puzzles: Splitting Harmful Questions to Jailbreak Large Language Models (JSP) | arXiv | link | link |
| 2024.10 | Multi-round jailbreak attack on large language | arXiv | link | - |
| 2024.10 | Derail Yourself: Multi-turn LLM Jailbreak Attack through Self-discovered Clues | arXiv | link | link |
| 2024.10 | Automated Red Teaming with GOAT: the Generative Offensive Agent Tester | arXiv | link | - |
| 2024.09 | LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yet | arXiv | link | link |
| 2024.09 | RED QUEEN: Safeguarding Large Language Models against Concealed Multi-Turn Jailbreaking | arXiv | link | link |
| 2024.08 | FRACTURED-SORRY-Bench: Framework for Revealing Attacks in Conversational Turns Undermining Refusal Efficacy and Defenses over SORRY-Bench (Automated Multi-shot Jailbreaks) | arXiv | link | - |
| 2024.08 | Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attacks | arXiv | link | link |
| 2024.05 | CoA: Context-Aware based Chain of Attack for Multi-Turn Dialogue LLM (CoA) | arXiv | link | link |
| 2024.04 | Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack (Crescendo) | Microsoft Azure | link | - |
Attack on RAG-based LLM
| Time | Title | Venue | Paper | Code |
|---|---|---|---|---|
| 2024.09 | Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking | arXiv | link | link |
| 2024.02 | Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning (Pandora) | arXiv | link | - |
Multi-modal Attack
| Time | Title | Venue | Paper | Code |
|---|---|---|---|---|
| 2026.03 | Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models | arXiv | link | - |
| 2026.02 | Toward Universal and Transferable Jailbreak Attacks on Vision-Language Models (UltraBreak) | arXiv | link | link |
| 2026.01 | Jailbreaks on Vision Language Model via Multimodal Reasoning | arXiv | link | - |
| 2026.01 | Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs | arXiv | link | - |
| 2026.01 | Multi-turn Jailbreaking Attack in Multi-Modal Large Language Models | arXiv | link | - |
| 2025.12 | Metaphor-based Jailbreaking Attacks on Text-to-Image Models | arXiv | link | - |
| 2025.11 | Multi-Faceted Attack: Exposing Cross-Model Vulnerabilities in Defense-Equipped Vision-Language Models | AAAI'26 | link | - |
| 2025.10 | Beyond Text: Multimodal Jailbreaking of Vision-Language and Audio Models through Perceptually Simple Transformations | arXiv | link | - |
| 2025.10 | VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models | arXiv | link | - |
| 2025.10 | Multimodal Safety Is Asymmetric: Cross-Modal Exploits Unlock Black-Box MLLMs Jailbreaks | arXiv | link | - |
| 2025.10 | Sequential Comics for Jailbreaking Multimodal Large Language Models via Structured Visual Storytelling | arXiv | link | - |
| 2025.10 | VisualDAN: Exposing Vulnerabilities in VLMs with Visual-Driven DAN Commands | arXiv | link | - |
| 2025.09 | Phi: Preference Hijacking in Multi-modal Large Language Models at Inference Time | EMNLP'25 | link | link |
| 2024.11 | Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey | arXiv | link | link |
| 2024.10 | Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Step | arXiv | link | - |
| 2024.10 | ColJailBreak: Collaborative Generation and Editing for Jailbreaking Text-to-Image Deep Generation | NeurIPS'24 | Link | - |
| 2024.08 | Jailbreaking Text-to-Image Models with LLM-Based Agents (Atlas) | arXiv | link | - |
| 2024.07 | Image-to-Text Logic Jailbreak: Your Imagination can Help You Do Anything | arXiv | link | - |
| 2024.06 | Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt | arXiv | link | link |
| 2024.05 | Voice Jailbreak Attacks Against GPT-4o | arXiv | link | link |
| 2024.05 | Automatic Jailbreaking of the Text-to-Image Generative AI Systems | ICML'24 Workshop | link | link |
| 2024.04 | Image hijacks: Adversarial images can control generative models at runtime | arXiv | link | link |
| 2024.03 | An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models (CroPA) | ICLR'24 | link | link |
| 2024.03 | Jailbreak in pieces: Compositional adversarial attacks on multi-modal language model | ICLR'24 | link | - |
| 2024.03 | Rethinking model ensemble in transfer-based adversarial attacks | ICLR'24 | link | link |
| 2024.02 | VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models | NeurIPS'23 | link | link |
| 2024.02 | Jailbreaking Attack against Multimodal Large Language Model | arXiv | link | - |
| 2024.01 | Jailbreaking GPT-4V via Self-Adversarial Attacks with System Prompts | arXiv | link | - |
| 2024.03 | Visual Adversarial Examples Jailbreak Aligned Large Language Models | AAAI'24 | link | - |
| 2023.12 | OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimization (OT-Attack) | arXiv | link | - |
| 2023.12 | FigStep: Jailbreaking Large Vision-language Models via Typographic Visual Prompts (FigStep) | arXiv | link | link |
| 2023.11 | SneakyPrompt: Jailbreaking Text-to-image Generative Models | S&P'24 | link | [link](https://github.com/Yuchen413/text2image_sa |
MiniCPM-V
OpenBMB·Python
MiniCPM-V 是面壁智能开源的多模态视觉语言模型，能在手机、PC 等本地设备上完成看图、听音和对话交互，无需依赖云端。
多模态+4视觉语言模型进阶
27128+432.1k202505272026-11-09 07:37 UTC
LLaVA
haotian-liu·Python
开源的多模态视觉指令微调模型，让 LLaMA 类大模型能看图对话，效果对标 GPT-4V，适合做图文问答和视觉助手。
视觉指令微调+4视觉语言模型进阶
250762.8kv1.2.02024-08-12 09:52 UTC
screenpipe
screenpipe·Rust
持续录制电脑屏幕和音频，把日常工作流整理成可检索的记录，帮你找出值得自动化的环节，并为 AI 智能体提供上下文。
屏幕录制+4视觉语言模型进阶
22343+842.3kapp-v2.7.1452026-11-11 02:39 UTC
Qwen3-VL
QwenLM·Jupyter Notebook
阿里云通义团队开源的多模态大模型系列，能同时理解图像和文本，用于视觉问答、图文推理等视觉语言任务。
多模态大模型+4视觉语言模型进阶
20191+161.9k2026-01-30 04:47 UTC