Derives requirements for AI red-teaming tools from industry guidelines, then evaluates six tools against six LLMs on prompt injection and jailbreak testing and identifies gaps.
Reviews 228 red-teaming instruction sets, then runs 22,500 controlled attacks showing instruction granularity, length, examples and harm definitions significantly change attack success rates.
Proposes PrivacyEvalClaw, a training-free tool-using agent that deliberates over ambiguous evidence to judge whether LLM jailbreak responses leak personal information, outperforming baselines in pairwise judging.
Proposes SEMA-Auto, a trained multi-turn jailbreak attacker that reads victim replies and self-terminates, achieving high attack success rates against frontier models with fewer turns.
Introduces NTBench, a benchmark of near-target prompt injections that produce plausible but incorrect or harmful outputs, finding LLMs and agents far less robust to these than to fixed-target attacks.
Introduces Omni-UBench, a 183k-sample benchmark evaluating omni-modal LLM guardrails on safety, utility and reliability, finding cross-modal jailbreaks and over-sensitivity remain weaknesses.
Evaluates how well 14 LLMs, including safeguard-bypassing prompts, generate functional phishing pages, benchmarking them against real-world phishing kits and finding high end-to-end success.
Introduces ABench, a 2,895-question Chinese value-alignment benchmark using role-play and logical traps, finding that most of 16 LLMs have significant vulnerabilities to adversarially induced value stances.
Introduces Systemic Adversarial Robustness, a measure of shared vulnerabilities across model pools via attack diversity needed to compromise them, finding distilled models less systemically robust than their parents.
Presents AutoRedClaw, an automated red-teaming framework generating end-to-end attacks on persistent claw-style agents, and RedClaw-Bench, a 330-case benchmark where most agent systems exceed 50% attack success.
Shows jailbreak attack success rates depend heavily on evaluator choice and sampling budget, with repeated sampling exposing residual unsafe behaviour in open-weight models and recommending stricter evaluation practice.
Proposes ASR_STEP, a cost-aware metric that penalizes repeated victim-model calls when evaluating iterative jailbreaks, showing scores drop notably for GCG and PAIR but not single-step PAP.
Studies how to prioritize jailbreak attacks under a limited query budget for efficient LLM red-teaming, comparing historical success priors, semantic guidance, and online feedback across victim models and defenses.
Shows that guardrail classifier safety benchmark scores depend heavily on the labeling policy used in training, with benchmark contamination and teacher provenance confounding results, and argues evaluations should report these factors.
Proposes PIAtlas, a taxonomy of prompt injection attacks organized by subversion mechanism, releases a large dataset corpus, and finds agent benchmarks cover only part of the attack space.
Shows that the choice of LLM grader alone can collapse jailbreak compliance labels and shift attack success rates by large factors, and proposes a reporting minimum for jailbreak evaluations.
Proposes bounded continuation analysis to measure harmful reachability under sampled safe refusals in LLMs, showing ASR misses hidden harmful generation paths and guiding red-teaming.
Introduces GUISE, a multilingual benchmark of real criminal-assistance scenarios showing that correction-seeking framing and cultural adaptation sharply increase LLM unsafe compliance.
Introduces RiskCueBench, which separates intent recovery from safety behavior, and finds LLMs refuse less and cooperate more unsafely when harmful intent is phrased in more specific surface forms.
Proposes a training-free semantic reconstruction game to judge jailbreak success, showing ASR depends heavily on the judge LLM and reducing false positives versus human labels.
Introduces CompanionEval, a multi-turn benchmark of 1,300 companion settings showing LLMs grow less safe over longer chats, and CompanionGuard, a guard model trained on exposed failures.
Introduces STOU, a benchmark of egocentric multimodal queries that scores whether models understand and refuse harms by target (self, bystanders, society), finding refusal varies by target and models often recognize harm yet comply.
Proposes ATTCK-R, a long-horizon multi-turn red-teaming framework for prompt-protected LLMs, showing prompt-based safeguards substantially lower measured attack success rates versus unprotected evaluations.
Presents REPRO, a black-box evolutionary red-teaming method using a 7B reflective model that jailbreaks 36 LLMs, with caveats about judge overlap and protocol differences from baselines.
Proposes LEST, which turns documented model-card safety claims into black-box tests by mutating benchmark prompts, finding automated failure flags are mostly false positives after human validation of Claude and GPT-5.5 refusals.
Psychometric audit of HELM Safety finds its HarmBench refusal score does not measure a single attribute and that aggregate safety scores can hide saturation and conflate distinct harm behaviours.
Proposes pairing attack success rate with an operative understanding rate to test whether LLM refusals reflect recovery of the harmful task under intent-obscuring prompts, showing ASR alone can hide large differences.
Introduces a benchmark and black-box attack showing commercial image generators readily render false claims as credible visuals, with an attack raising bypass rates to 95%.
Introduces PatchBench, a benchmark of model-specific jailbreak failures and a local-neighbour protocol that exposes collateral damage from activation-steering safety patches missed by aggregate metrics.
Controlled ablations of image-to-text jailbreaks across multimodal models find that image-text relatedness, not tile density or count, drives attack success, with conclusions conditional on an automated judge.
Shows prompt-injection detector rankings on public benchmarks transfer poorly to agent tool outputs, and that training data form explains results, recommending agent-specific evaluation at low false-positive rates.
Introduces a end-to-end MLCommons benchmark for LLM jailbreak robustness, measuring a Resilience Gap across eight open-weight systems, where unsafe-response rates rise from 11.08% to 18.65% under attack.
Shows that LLM safety degrades sharply over long adversarial multi-turn conversations, with safe-response rates falling from 85-100% at turn one to 15-44% by depth 101, motivating long-horizon evaluations.
Anthropic analyses GLM-5.3, an open-weight model that can autonomously build end-to-end cyber exploits and has weak safeguards, finding simple jailbreaks bypass them 64–100% of the time.
Empirical case study measuring bio-weapon uplift from abliterated LLMs served through a cheap, no-filter chat service, finding high capability and compliance on dangerous-knowledge benchmarks and calling for regulation.
CART is an adaptive closed-loop red-teaming framework for LLMs and tool-using agents that discovers more failures than static prompt replay, with separated Challenger, Target and Judge roles.
Shows that KV cache compression makes keyword refusal rates drop while classifier-judged refusals stay near ceiling, so safety audits under compression should use several matched judges rather than keyword rates alone.
Shows a weaker unaligned model can decompose harmful tasks into benign subproblems, consult aligned frontier models on each, and recover dangerous capabilities, including CBRN uplift, exposing gaps in per-interaction safety defenses.
Introduces PIDS-Bench, a multi-axis benchmark showing prompt-injection detectors misclassify many benign security-adjacent prompts, with over-defense persisting on externally sourced inputs despite augmentation.
Audits 777K LMSYS-Chat conversations for user hostility toward chatbots, finding about 0.90% assistant-directed mistreatment, model-dependent rates, and apologies linked to more next-turn hostility.