{"type":"ScholarlyArticle","title":"BEACON: Budget-Efficient Discovery of Policy Violations in Large Language Models via Cognitive-Guided Monte Carlo Tree Search","authors":[{"name":"Xinyi Huang","slug":"xinyi-huang","given":"Xinyi","family":"Huang","affiliation":"Beijing University of Technology , Beijing , China"},{"name":"Jie Wang","slug":"jie-wang","given":"Jie","family":"Wang","affiliation":"Beijing University of Technology , Beijing , China"},{"name":"Pengrui Xiang","slug":"pengrui-xiang","given":"Pengrui","family":"Xiang","affiliation":"Beijing University of Technology , Beijing , China"},{"name":"Yifan Wang","slug":"yifan-wang","given":"Yifan","family":"Wang","affiliation":"Beijing University of Technology , Beijing , China"},{"name":"Yu Fu","slug":"yu-fu","given":"Yu","family":"Fu","affiliation":"Beijing University of Technology , Beijing , China"},{"name":"Jinduo Liu","slug":"jinduo-liu","given":"Jinduo","family":"Liu","affiliation":"Beijing University of Technology , Beijing , China"}],"abstract":"Systematic safety evaluation of large language models must uncover diverse policy violations under tight query budgets. However, most red-teaming methods optimize attack success rate and repeatedly probe a narrow set of vulnerabilities, yielding redundant failures and leaving rarer yet critical violation categories unexplored. Under fixed budgets, such inefficient exploration delays the first discovery and limits category coverage. To address these limitations, we propose the Budget-Efficient Adaptive Cognitive Offense Navigator (BEACON), a budget-aware safety testing framework that uses Cognitive-Guided Monte Carlo Tree Search to navigate the violation search space under fixed budgets. BEACON innovatively approaches safety testing as a budget-constrained failure discovery process, aiming to identify diverse safety violations as early as possible within a fixed query budget. It also provides an efficiency-oriented evaluation perspective that measures early discovery and harm category coverage under budget constraints. Experiments on standard benchmarks and frontier LLMs show that BEACON discovers failures earlier and achieves higher coverage across policy violation categories. These results underscore the value of evaluating safety testing through discovery efficiency rather than attack success rate alone. Warning: This paper contains examples of harmful language and images, and reader discretion is recommended.","doi":"10.24963/ijcai.2026/615","url":"https://ijcai.org/proceedings/2026/615","pdf":"https://ijcai.org/proceedings/2026/0615.pdf","markdown":"https://ijcai.org/proceedings/2026/615.md","bibtex":"https://ijcai.org/proceedings/2026/bibtex/615","volume":{"slug":"2026","title":"Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2026","url":"https://ijcai.org/proceedings/2026/","year":2026,"location":"Bremen, Germany","dates":"15-21 August 2026","editors":"Diego Calvanese","isbn":"978-1-956792-09-6","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2026"},"section":"Multidisciplinary Topics and Applications","track":"Main Track","number":615,"pages":{"first":5522,"last":5530},"keywords":["Natural Language Processing: Language models","Search: Applications","Multidisciplinary Topics and Applications: Security and privacy","Natural Language Processing: Resources and evaluation"],"videos":[],"references":[{"position":1,"raw":"[Auer et al., 2002] Peter Auer, Nicolo Cesa-Bianchi, and Paul Fischer. Finite-time analysis of the multiarmed bandit problem. Machine learning, 47(2):235-256, 2002.","title":"Finite-time analysis of the multiarmed bandit problem","authors":"Auer","year":"2002","venue":"Machine learning","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Böhme et al., 2016] Marcel Böhme, Van-Thuan Pham, and Abhik Roychoudhury. Coverage-based greybox fuzzing as Markov chain. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 1032-1043. ACM, 2016.","title":"Coverage-based greybox fuzzing as Markov chain","authors":"Böhme","year":"2016","venue":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Brown et al., 2020] Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhari- wal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Win- ter, Christopher Hesse, Mark Chen, Eric Sigler, Ma- teusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few- shot learners. Advances in Neural Information Processing Systems, 33:1877-1901, 2020.","title":"Language models are fewshot learners","authors":"B Tom, Benjamin Brown, Nick Mann, Melanie Ryder, Jared Subbiah, Prafulla Kaplan, Arvind Dhariwal, Pranav Neelakantan, Girish Shyam, Amanda Sastry, Sandhini Askell, Ariel Agarwal, Gretchen Herbert-Voss, Tom Krueger, Rewon Henighan, Aditya Child, Daniel M Ramesh, Jeffrey Ziegler, Clemens Wu, Christopher Winter, Mark Hesse, Eric Chen, Mateusz Sigler, Scott Litwin, Benjamin Gray, Jack Chess, Christopher Clark, Sam Berner, Alec Mccandlish, Ilya Radford, Dario Sutskever, Amodei","year":"2020","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Chao et al., 2023] Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419, 2023.","title":"Jailbreaking black box large language models in twenty queries","authors":"Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, Eric Wong","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Chao et al., 2024] Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flam- marion, George J. Pappas, Florian Tramer, Hamed Has- sani, and Eric Wong. JailbreakBench: An open robustness benchmark for jailbreaking large language models. arXiv preprint arXiv:2404.01318, 2024.","title":"JailbreakBench: An open robustness benchmark for jailbreaking large language models","authors":"Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, Hamed Hassani, Eric Wong","year":"2024","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Chen et al., 2025] Yunhao Chen, Xin Wang, Juncheng Li, Yixu Wang, Jie Li, Yan Teng, Yingchun Wang, and Xingjun Ma. Evolve the method, not the prompts: Evo- lutionary synthesis of jailbreak attacks on LLMs. arXiv preprint arXiv:2511.12710, 2025.","title":"Evolve the method, not the prompts: Evolutionary synthesis of jailbreak attacks on LLMs","authors":"Yunhao Chen, Xin Wang, Juncheng Li, Yixu Wang, Jie Li, Yan Teng, Yingchun Wang, Xingjun Ma","year":"2025","venue":null,"doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Feng et al., 2022] Fangxiaoyu Feng, Yinfei Yang, Daniel Cer, Naveen Arivazhagan, and Wei Wang. Language- agnostic bert sentence embedding. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 878-891, 2022.","title":"Languageagnostic bert sentence embedding","authors":"Feng","year":"2022","venue":"Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Kocsis and Szepesvári, 2006] Levente Kocsis and Csaba Szepesvári. Bandit based Monte-Carlo planning. In Eu- ropean Conference on Machine Learning, pages 282-293. Springer, 2006.","title":"Bandit based Monte-Carlo planning","authors":"Szepesvári Kocsis, Levente Kocsis, Csaba Szepesvári","year":"2006","venue":"European Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Li et al., 2025] Xurui Li, Kaisong Song, Rui Zhu, Pin- Yu Chen, and Haixu Tang. Adversarial attack-defense co-evolution for llm safety alignment via tree-group dual-aware search and optimization. arXiv preprint arXiv:2511.19218, 2025.","title":"Adversarial attack-defense co-evolution for llm safety alignment via tree-group dual-aware search and optimization","authors":"Li","year":"2025","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Liu et al., 2023] Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451, 2023.","title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models","authors":"Liu","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Liu et al., 2024] Xuannan Liu, Xing Cui, Peipei Li, Zekun Li, Huaibo Huang, Shuhan Xia, Miaoxuan Zhang, Yuey- ing Zou, and Ran He. Jailbreak attacks and defenses against multimodal generative models: A survey. arXiv preprint arXiv:2411.09259, 2024.","title":"Jailbreak attacks and defenses against multimodal generative models: A survey","authors":"Xuannan Liu, Xing Cui, Peipei Li, Zekun Li, Huaibo Huang, Shuhan Xia, Miaoxuan Zhang, Yueying Zou, Ran He","year":"2024","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Liu et al., 2025] Shuo Liu, Xiang Cheng, and Sen Su. Query-efficient and dataset-independent red teaming for llms content safety evaluation. Knowledge-Based Systems, page 114404, 2025.","title":"Query-efficient and dataset-independent red teaming for llms content safety evaluation","authors":"Shuo Liu, Xiang Cheng, Sen Su","year":"2025","venue":"Knowledge-Based Systems","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Mazeika et al., 2024] Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. HarmBench: A standard- ized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249, 2024.","title":"HarmBench: A standardized evaluation framework for automated red teaming and robust refusal","authors":"Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, Dan Hendrycks","year":"2024","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Mehrotra et al., 2024] Anay Mehrotra, Manolis Zam- petakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jail- breaking black-box LLMs automatically. In Advances in Neural Information Processing Systems, volume 37, 2024. [","title":"Tree of attacks: Jailbreaking black-box LLMs automatically","authors":"Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, Amin Karbasi","year":"2024","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[OpenAI, 2023] OpenAI. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023.","title":null,"authors":"Openai","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Rahman et al., 2025] Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Md Rizwan Parvez, Hamid Palangi, Kai-Wei Chang, Yejin Choi, and Saadia Gabriel. X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents. In Second Conference on Lan- guage Modeling, 2025.","title":"X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents","authors":"Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Rizwan Md, Hamid Parvez, Kai-Wei Palangi, Yejin Chang, Saadia Choi, Gabriel","year":"2025","venue":"Second Conference on Language Modeling","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Ramesh et al., 2025] Aditya Ramesh, Shivam Bhardwaj, Aditya Saibewar, and Manohar Kaul. Efficient jailbreak at- tack sequences on large language models via multi-armed bandit-based context switching. In The Thirteenth Inter- national Conference on Learning Representations, 2025.","title":"Efficient jailbreak attack sequences on large language models via multi-armed bandit-based context switching","authors":"Aditya Ramesh, Shivam Bhardwaj, Aditya Saibewar, Manohar Kaul","year":"2025","venue":"The Thirteenth International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Reimers and Gurevych, 2019] Nils Reimers and Iryna Gurevych. Sentence-bert: Sentence embeddings using siamese bert-networks. arXiv preprint arXiv:1908.10084, 2019.","title":"Sentence-bert: Sentence embeddings using siamese bert-networks","authors":"Gurevych Reimers, Nils Reimers, Iryna Gurevych","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Samvelyan et al., 2024] Mikayel Samvelyan, Sharath Chandra Raparthy, Andrei Lupu, Eric Ham- bro, Aram H. Markosyan, Mandar Bhatt, Vlad Mnih, Jack Parker-Holder, and Tim Rocktäschel. Rainbow teaming: Open-ended generation of diverse adversarial prompts. arXiv preprint arXiv:2402.16822, 2024.","title":"Rainbow teaming: Open-ended generation of diverse adversarial prompts","authors":"Mikayel Samvelyan, Chandra Sharath, Andrei Raparthy, Eric Lupu, Aram H Hambro, Mandar Markosyan, Vlad Bhatt, Jack Mnih, Tim Parker-Holder, Rocktäschel","year":"2024","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Sawwan and Wu, 2024] Abdalaziz Sawwan and Jie Wu. Diversity-based recruitment in crowdsensing by combina- torial multi-armed bandits. Tsinghua Science and Technol- ogy, 30(2):732-747, 2024.","title":"Abdalaziz Sawwan and Jie Wu. Diversity-based recruitment in crowdsensing by combinatorial multi-armed bandits","authors":"Wu Sawwan","year":"2024","venue":"Tsinghua Science and Technology","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Shokri et al., 2017] Reza Shokri, Marco Stronati, Con- gzheng Song, and Vitaly Shmatikov. Membership infer- ence attacks against machine learning models. In 2017 IEEE Symposium on Security and Privacy (SP), pages 3- 18. IEEE, 2017.","title":"Membership inference attacks against machine learning models","authors":"Reza Shokri, Marco Stronati, Congzheng Song, Vitaly Shmatikov","year":"2017","venue":"IEEE Symposium on Security and Privacy (SP)","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Silver et al., 2016] David Silver, Aja Huang, Chris J. Mad- dison, Arthur Guez, Laurent Sifre, George van den Driess- che, Julian Schrittwieser, Ioannis Antonoglou, Veda Pan- neershelvam, Marc Lanctot, et al. Mastering the game of Go with deep neural networks and tree search. Nature, 529(7587):484-489, 2016.","title":"George van den Driessche, Julian Schrittwieser, Ioannis Antonoglou, Veda Panneershelvam","authors":"David Silver, Aja Huang, Chris J Maddison, Arthur Guez, Laurent Sifre, Marc Lanctot","year":"2016","venue":"Nature","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Snoek et al., 2012] Jasper Snoek, Hugo Larochelle, and Ryan P. Adams. Practical Bayesian optimization of ma- chine learning algorithms. In Advances in Neural Infor- mation Processing Systems, volume 25, pages 2951-2959, 2012.","title":"Practical Bayesian optimization of machine learning algorithms","authors":"Snoek","year":"2012","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Souly et al., 2024] Alexandra Souly, Qingyuan Lu, Dil- lon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Dylan Hadfield-Menell. A strongreject for empty jail- breaks. Advances in Neural Information Processing Sys- tems, 2024.","title":"A strongreject for empty jailbreaks","authors":"Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, Dylan Hadfield-Menell","year":"2024","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Tramèr et al., 2016] Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. Steal- ing machine learning models via prediction APIs. In 25th USENIX Security Symposium (USENIX Security 16), pages 601-618, 2016.","title":"Stealing machine learning models via prediction APIs","authors":"Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, Thomas Ristenpart","year":"2016","venue":"25th USENIX Security Symposium (USENIX Security 16)","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Wang et al., 2026] Xin Wang, Yunhao Chen, Juncheng Li, Yixu Wang, Yang Yao, Tianle Gu, Jie Li, Yan Teng, Yingchun Wang, and Xia Hu. Openrt: An open-source red teaming framework for multimodal llms. arXiv preprint arXiv:2601.01592, 2026.","title":"Openrt: An open-source red teaming framework for multimodal llms","authors":"Xin Wang, Yunhao Chen, Juncheng Li, Yixu Wang, Yang Yao, Tianle Gu, Jie Li, Yan Teng, Yingchun Wang, Xia Hu","year":"2026","venue":null,"doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Watkins and Dayan, 1992] Christopher JCH Watkins and Peter Dayan. Q-learning. Machine learning, 8(3):279- 292, 1992.","title":"Q-learning","authors":"Jch Christopher, Peter Watkins, Dayan","year":"1992","venue":"Machine learning","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Wei et al., 2025] Rui Wei, Zeyu Wu, and Xuezhou Huang. The trojan knowledge: Bypassing llm guardrails via harm- less prompt weaving and adaptive tree search. arXiv preprint arXiv:2512.01353, 2025.","title":"The trojan knowledge: Bypassing llm guardrails via harmless prompt weaving and adaptive tree search","authors":"Rui Wei, Zeyu Wu, Xuezhou Huang","year":"2025","venue":null,"doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Wu et al., 2025] Suhuang Wu, Huimin Wang, Yutian Zhao, Xian Wu, Yefeng Zheng, Wei Li, Hui Li, and Rongrong Ji. Monte carlo tree search based prompt autogeneration for jailbreak attacks against LLMs. In Proc. COLING, pages 1057-1068, 2025.","title":"Monte carlo tree search based prompt autogeneration for jailbreak attacks against LLMs","authors":"Suhuang Wu, Huimin Wang, Yutian Zhao, Xian Wu, Yefeng Zheng, Wei Li, Hui Li, Rongrong Ji","year":"2025","venue":"Proc. COLING","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Xiong et al., 2025] Wen Xiong, Junzhong Ji, and Jinduo Liu. Brainec-llm: Brain effective connectivity estimation by multiscale mixing llm. In The Thirty-ninth Annual Con- ference on Neural Information Processing Systems, 2025.","title":"Brainec-llm: Brain effective connectivity estimation by multiscale mixing llm","authors":"Wen Xiong, Junzhong Ji, Jinduo Liu","year":"2025","venue":"The Thirty-ninth Annual Conference on Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Xu et al., 2024] Huiyu Xu, Wenhui Zhang, Zhibo Wang, Feng Xiao, Rui Zheng, Yunhe Feng, Zhongjie Ba, and Kui Ren. Redagent: Red teaming large language models with context-aware autonomous language agent. arXiv preprint arXiv:2407.16667, 2024.","title":"Redagent: Red teaming large language models with context-aware autonomous language agent","authors":"Huiyu Xu, Wenhui Zhang, Zhibo Wang, Feng Xiao, Rui Zheng, Yunhe Feng, Zhongjie Ba, Kui Ren","year":"2024","venue":null,"doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Yi et al., 2024] Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. Jail- break attacks and defenses against large language models: A survey. arXiv preprint arXiv:2407.04295, 2024.","title":"Jailbreak attacks and defenses against large language models: A survey","authors":"Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, Qi Li","year":"2024","venue":null,"doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Yoo and Harman, 2012] Shin Yoo and Mark Harman. Re- gression testing minimization, selection and prioritization: A survey. Software Testing, Verification and Reliability, 22(2):67-120, 2012.","title":"Regression testing minimization, selection and prioritization: A survey","authors":"Harman ; Yoo, Shin Yoo, Mark Harman","year":"2012","venue":"Software Testing, Verification and Reliability","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Yu et al., 2023] Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. GPTFuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309.10253, 2023.","title":"GPTFuzzer: Red teaming large language models with auto-generated jailbreak prompts","authors":"Jiahao Yu, Xingwei Lin, Zheng Yu, Xinyu Xing","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Zeng et al., 2024] Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. How johnny can persuade LLMs to jailbreak them: Rethinking persua- sion to challenge AI safety by humanizing LLMs. arXiv preprint arXiv:2401.06373, 2024.","title":"How johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs","authors":"Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, Weiyan Shi","year":"2024","venue":null,"doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Zou et al., 2023] Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adver- sarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023.","title":"Universal and transferable adversarial attacks on aligned language models","authors":"Andy Zou, Zifan Wang, J Zico Kolter, Matt Fredrikson","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}