yueliu1999/Awesome-Jailbreak-on-LLMs
GitHub: yueliu1999/Awesome-Jailbreak-on-LLMs
一个系统整理LLM越狱攻击与防御方法的学术资源合集，涵盖论文、代码、数据集与评估分析。
Stars: 1251 | Forks: 102
# Awesome-Jailbreak-on-LLMs
Awesome-Jailbreak-on-LLMs 是一个关于 LLM 最先进、新颖且令人兴奋的越狱方法的合集。它包含论文、代码、数据集、评估和分析。任何关于越狱的额外内容、PRs、issues 都受欢迎，我们很乐意将您添加到[这里](#contributors)的贡献者列表中。如有任何问题，请联系 yliu@u.nus.edu。如果您发现此仓库对您的研究或工作有用，非常感谢您 star 本仓库并引用我们的论文[这里](#Reference)。:sparkles:
## 参考文献
如果您发现此仓库对您的研究有帮助，我们将非常感谢您引用我们的论文。:sparkles:
```
@article{zhuzhenhao_GuardReasoner_Omni,
title={GuardReasoner-Omni: A Reasoning-based Multi-modal Guardrail for Text, Image, and Video},
author={Zhu, Zhenhao and Liu, Yue and Guo, Yanpei and Qu, Wenjie and Chen, Cancan and He, Yufei and Li, Yibo and Chen, Yulin and Wu, Tianyi and Xu, Huiying and others},
journal={arXiv preprint arXiv:2602.03328},
year={2026}
}
@article{liuyue_GuardReasoner_VL,
title={GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning},
author={Liu, Yue and Zhai, Shengfang and Du, Mingzhe and Chen, Yulin and Cao, Tri and Gao, Hongcheng and Wang, Cheng and Li, Xinfeng and Wang, Kun and Fang, Junfeng and Zhang, Jiaheng and Hooi, Bryan},
journal={arXiv preprint arXiv:2505.11049},
year={2025}
}
@article{liuyue_GuardReasoner,
title={GuardReasoner: Towards Reasoning-based LLM Safeguards},
author={Liu, Yue and Gao, Hongcheng and Zhai, Shengfang and Jun, Xia and Wu, Tianyi and Xue, Zhiwei and Chen, Yulin and Kawaguchi, Kenji and Zhang, Jiaheng and Hooi, Bryan},
journal={arXiv preprint arXiv:2501.18492},
year={2025}
}
@article{liuyue_FlipAttack,
title={FlipAttack: Jailbreak LLMs via Flipping},
author={Liu, Yue and He, Xiaoxin and Xiong, Miao and Fu, Jinlan and Deng, Shumin and Hooi, Bryan},
journal={arXiv preprint arXiv:2410.02832},
year={2024}
}
@article{wang2025safety,
title={Safety in Large Reasoning Models: A Survey},
author={Wang, Cheng and Liu, Yue and Li, Baolong and Zhang, Duzhen and Li, Zhongzhi and Fang, Junfeng},
journal={arXiv preprint arXiv:2504.17704},
year={2025}
}
```
## 书签
- [越狱攻击](#jailbreak-attack)
- [针对 LRMs 的攻击](#attack-on-lrms)
- [黑盒攻击](#black-box-attack)
- [白盒攻击](#white-box-attack)
- [多轮攻击](#multi-turn-attack)
- [针对基于 RAG 的 LLM 的攻击](#attack-on-rag-based-llm)
- [多模态攻击](#multi-modal-attack)
- [越狱防御](#jailbreak-defense)
- [基于学习的防御](#learning-based-defense)
- [基于策略的防御](#strategy-based-defense)
- [Guard Model](#Guard-model)
- [Moderation API](#Moderation-API)
- [评估与分析](#evaluation--analysis)
- [应用](#application)
## 论文
### 越狱攻击
#### 针对 LRMs 的攻击
| 时间 | 标题 | 来源 | 论文 | 代码 |
| ------- | ------------------------------------------------------------ | :---: | :--------------------------------------: | :----------------------------------------------------------: |
| 2025.08 | **Jinx: Unlimited LLMs for Probing Alignment Failures** | arXiv | [链接](https://arxiv.org/abs/2508.08243) | [模型](https://huggingface.co/Jinx-org) |
| 2025.06 | **ExtendAttack: Attacking Servers of LRMs via Extending Reasoning** | AAAI'26 | [链接](https://arxiv.org/abs/2506.13737) | [链接](https://github.com/zzh-thu-22/ExtendAttack) |
| 2025.03 | **Cats Confuse Reasoning LLM: Query Agnostic Adversarial Triggers for Reasoning Models** | arXiv | [链接](https://arxiv.org/abs/2503.01781) |- |
| 2025.02 | **OverThink: Slowdown Attacks on Reasoning LLMs** | arXiv | [链接](https://arxiv.org/abs/2502.02542#:~:text=We%20increase%20overhead%20for%20applications%20that%20rely%20on,the%20user%20query%20while%20providing%20contextually%20correct%20answers.) | [链接](https://github.com/akumar2709/OVERTHINK_public) |
| 2025.02 | **BoT: Breaking Long Thought Processes of o1-like Large Language Models through Backdoor Attack** | arXiv | [链接](https://arxiv.org/abs/2502.12202) | [链接](https://github.com/zihao-ai/BoT) |
| 2025.02 | **H-CoT: Hijacking the Chain-of-Thought Safety Reasoning Mechanism to Jailbreak Large Reasoning Models, Including OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking** | arXiv | [链接](https://arxiv.org/abs/2502.12893) |[链接](https://github.com/dukeceicenter/jailbreak-reasoning-openai-o1o3-deepseek-r1) |
| 2025.02 | **A Mousetrap: Fooling Large Reasoning Models for Jailbreak with Chain of Iterative Chaos** | arXiv | [链接](https://arxiv.org/abs/2502.15806) |- |
#### 黑盒攻击
| 时间 | 标题 | 来源 | 论文 | 代码 |
|---------| ----------------------------------------------------------- | :-----: |:--------------------------------------------------------------------------------------------------------------------------:|:--------------------------------------------------------------------------------------:|
| 2025.10 | **BreakFun: Jailbreaking LLMs via Schema Exploitation** | arXiv | [链接](https://arxiv.org/abs/2510.17904) | - |
| 2025.07 | **Response Attack: Exploiting Contextual Priming to Jailbreak Large Language Models** | arXiv | [链接](https://arxiv.org/abs/2507.05248) | [链接](https://github.com/Dtc7w3PQ/Response-Attack) |
| 2025.05 | **Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection** | ICML'25 | [链接](https://arxiv.org/pdf/2411.01077) | [链接](https://github.com/zhipeng-wei/EmojiAttack) |
| 2025.05 | **FlipAttack: Jailbreak LLMs via Flipping (FlipAttack)** | ICML'25 | [链接](https://arxiv.org/pdf/2410.02832) | [链接](https://github.com/yueliu1999/FlipAttack) |
| 2025.03 | **Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (JOOD)** | CVPR'25 | [链接](http://arxiv.org/pdf/2503.20823) | [链接](https://github.com/naver-ai/JOOD) |
| 2025.02 | **StructTransform: A Scalable Attack Surface for Safety-Aligned Large Language Models** | arXiv | [链接](https://arxiv.org/abs/2502.11853) | [链接](https://github.com/StructTransform/Benchmark) |
| 2025.01 | **Understanding and Enhancing the Transferability of Jailbreaking Attacks** | ICLR'25 | [链接](https://arxiv.org/pdf/2502.03052) | [链接](https://github.com/tmllab/2025_ICLR_PiF) |
| 2024.11 | **The Dark Side of Trust: Authority Citation-Driven Jailbreak Attacks on Large Language Models** | arXiv | [链接](https://arxiv.org/pdf/2411.11407) | [链接](https://github.com/YancyKahn/DarkCite) |
| 2024.11 | **Playing Language Game with LLMs Leads to Jailbreaking** | arXiv | [链接](https://arxiv.org/pdf/2411.12762v1) | [链接](https://anonymous.4open.science/r/encode_jailbreaking_anonymous-B4C4/README.md) |
| 2024.11 | **GASP: Efficient Black-Box Generation of Adversarial Suffixes for Jailbreaking LLMs (GASP)** | arXiv | [链接](https://arxiv.org/pdf/2411.14133v1) | [链接](https://github.com/llm-gasp/gasp) |
| 2024.11 | **LLM STINGER: Jailbreaking LLMs using RL fine-tuned LLMs** | arXiv | [链接](https://arxiv.org/pdf/2411.08862v1) | - |
| 2024.11 | **SequentialBreak: Large Language Models Can be Fooled by Embedding Jailbreak Prompts into Sequential Prompt** | arXiv | [链接](https://arxiv.org/pdf/2411.06426v1) | [链接](https://anonymous.4open.science/r/JailBreakAttack-4F3B/) |
| 2024.11 | **Diversity Helps Jailbreak Large Language Models** | arXiv | [链接](https://arxiv.org/pdf/2411.04223v1) | - |
| 2024.11 | **Plentiful Jailbreaks with String Compositions** | arXiv | [链接](https://arxiv.org/pdf/2411.01084v1) | - |
| 2024.11 | **Transferable Ensemble Black-box Jailbreak Attacks on Large Language Models** | arXiv | [链接](https://arxiv.org/pdf/2410.23558v1) | [链接](https://github.com/YQYANG2233/Large-Language-Model-Break-AI) |
| 2024.11 | **Stealthy Jailbreak Attacks on Large Language Models via Benign Data Mirroring** | arXiv | [链接](https://arxiv.org/pdf/2410.21083) | - |
| 2024.10 | **Endless Jailbreaks with Bijection** | arXiv | [链接](https://arxiv.org/pdf/2410.01294v1) | - |
| 2024.10 | **Harnessing Task Overload for Scalable Jailbreak Attacks on Large Language Models** | arXiv | [链接](https://arxiv.org/pdf/2410.04190v1) | - |
| 2024.10 | **You Know What I'm Saying: Jailbreak Attack via Implicit Reference** | arXiv | [链接](https://arxiv.org/pdf/2410.03857v2) | [链接](https://github.com/Lucas-TY/llm_Implicit_reference) |
| 2024.10 | **Deciphering the Chaos: Enhancing Jailbreak Attacks via Adversarial Prompt Translation** | arXiv | [链接](https://arxiv.org/pdf/2410.11317v1) | [链接](https://github.com/qizhangli/Adversarial-Prompt-Translator) |
| 2024.10 | **AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMs (AutoDAN-Turbo)** | arXiv | [链接](https://arxiv.org/pdf/2410.05295) | [链接](https://github.com/SaFoLab-WISC/AutoDAN-Turbo) |
| 2024.10 | **PathSeeker: Exploring LLM Security Vulnerabilities with a Reinforcement Learning-Based Jailbreak Approach (PathSeeker)** | arXiv | [链接](https://www.arxiv.org/pdf/2409.14177) | - |
| 2024.10 | **Read Over the Lines: Attacking LLMs and Toxicity Detection Systems with ASCII Art to Mask Profanity** | arXiv | [链接](https://arxiv.org/pdf/2409.18708) | [链接](https://github.com/Serbernari/ToxASCII) |
| 2024.09 | **AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMs** | arXiv | [链接](https://arxiv.org/pdf/2409.07503) | [链接](https://github.com/Yummy416/AdaPPA) |
| 2024.09 | **Effective and Evasive Fuzz Testing-Driven Jailbreaking Attacks against LLMs** | arXiv | [链接](https://arxiv.org/pdf/2409.14866) | - |
| 2024.09 | **Jailbreaking Large Language Models with Symbolic Mathematics** | arXiv | [链接](https://arxiv.org/pdf/2409.11445v1) | - |
| 2024.08 | **Play Guessing Game with LLM: Indirect Jailbreak Attack with Implicit Clues** | ACL Findings'24 | [链接](https://aclanthology.org/2024.findings-acl.304) | [链接](https://github.com/czycurefun/IJBR) |
| 2024.08 | **Advancing Adversarial Suffix Transfer Learning on Aligned Large Language Models** | arXiv | [链接](https://arxiv.org/pdf/2408.14866) | - |
| 2024.08 | **Hide Your Malicious Goal Into Benign Narratives: Jailbreak Large Language Models through Neural Carrier Articles** | arXiv | [链接](https://arxiv.org/pdf/2408.11182) | - |
| 2024.08 | **h4rm3l: A Dynamic Benchmark of Composable Jailbreak Attacks for LLM Safety Assessment (h4rm3l)** | arXiv | [链接](https://arxiv.org/pdf/2408.04811) | [链接](https://mdoumbouya.github.io/h4rm3l/) |
| 2024.08 | **EnJa: Ensemble Jailbreak on Large Language Models (EnJa)** | arXiv | [链接](https://arxiv.org/pdf/2408.03603) | - |
| 2024.07 | **Knowledge-to-Jailbreak: One Knowledge Point Worth One Attack** | arXiv | [链接](https://arxiv.org/pdf/2406.11682) | [链接](https://github.com/THU-KEG/Knowledge-to-Jailbreak/) |
| 2024.07 | **LLMs can be Dangerous Reasoners: Analyzing-based Jailbreak Attack on Large Language Models** | arXiv | [链接](https://arxiv.org/pdf/2407.16205) | |
| 2024.07 | **Single Character Perturbations Break LLM Alignment** | arXiv | [链接](https://arxiv.org/pdf/2407.03232#page=3.00) | [链接](https://github.com/hannah-aught/space_attack) |
| 2024.07 | **A False Sense of Safety: Unsafe Information Leakage in 'Safe' AI Responses** | arXiv | [链接](https://arxiv.org/abs/2407.02551) | - |
| 2024.07 | **Virtual Context: Enhancing Jailbreak Attacks with Special Token Injection (Virtual Context)** | arXiv | [链接](https://arxiv.org/pdf/2406.19845) | - |
| 2024.07 | **SoP: Unlock the Power of Social Facilitation for Automatic Jailbreak Attack (SoP)** | arXiv | [链接](https://arxiv.org/pdf/2407.01902) | [链接](https://github.com/Yang-Yan-Yang-Yan/SoP) |
| 2024.06 | **Jailbreaking as a Reward Misspecification Problem**| ICLR'25| [链接](https://arxiv.org/abs/2406.14393) | [链接](https://github.com/zhxieml/remiss-jailbreak) |
| 2024.06 | **Improved Few-Shot Jailbreaking Can Circumvent Aligned Language Models and Their Defenses (I-FSJ)** | NeurIPS'24 | [链接](https://arxiv.org/abs/2406.01288) | [链接](https://github.com/sail-sg/I-FSJ) |
| 2024.06 | **When LLM Meets DRL: Advancing Jailbreaking Efficiency via DRL-guided Search (RLbreaker)** | NeurIPS'24 | [链接](https://arxiv.org/pdf/2406.08705) | - |
| 2024.06 | **Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast (Agent Smith)** | ICML'24 | [链接](https://arxiv.org/pdf/2402.08567) | [链接](https://github.com/sail-sg/Agent-Smith) |
| 2024.06 | **Covert Malicious Finetuning: Challenges in Safeguarding LLM Adaptation** | ICML'24 | [链接](https://arxiv.org/pdf/2406.20053) | - |
| 2024.06 | **ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMs (ArtPrompt)** | ACL'24 | [链接](https://arxiv.org/pdf/2402.11753) | [链接](https://github.com/uw-nsl/ArtPrompt) |
| 2024.06 | **From Noise to Clarity: Unraveling the Adversarial Suffix of Large Language Model Attacks via Translation of Text Embeddings (ASETF)** | arXiv | [链接](https://arxiv.org/pdf/2402.16006) | - |
| 2024.06 | **CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completion (CodeAttack)** | ACL'24 | [链接](https://arxiv.org/pdf/2403.07865) | - |
| 2024.06 | **Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction (DRA)** | USENIX Security'24 | [链接](https://arxiv.org/pdf/2402.18104) | [链接](https://github.com/LLM-DRA/DRA/) |
| 2024.06 | **AutoJailbreak: Exploring Jailbreak Attacks and Defenses through a Dependency Lens (AutoJailbreak)** | arXiv | [链接](https://arxiv.org/pdf/2406.08705) | - |
| 2024.06 | **Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks** | arXiv | [链接](https://arxiv.org/pdf/2404.02151) | [链接](https://github.com/tml-epfl/llm-adaptive-attacks) |
| 2024.06 | **GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts (GPTFUZZER)** | arXiv | [链接](https://arxiv.org/abs/2309.10253) | [链接](https://github.com/sherdencooper/GPTFuzz) |
| 2024.06 | **A Wolf in Sheep’s Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily (ReNeLLM)** | NAACL'24 | [链接](https://arxiv.org/abs/2311.08268) | [链接](https://github.com/NJUNLP/ReNeLLM) |
| 2024.06 | **QROA: A Black-Box Query-Response Optimization Attack on LLMs (QROA)** | arXiv | [链接](https://arxiv.org/abs/2406.02044) | [链接](https://github.com/qroa/qroa) |
| 2024.06 | **Poisoned LangChain: Jailbreak LLMs by LangChain (PLC)** | arXiv | [链接](https://arxiv.org/pdf/2406.18122) | [链接](https://github.com/CAM-FSS/jailbreak-langchain) |
| 2024.05 | **Multilingual Jailbreak Challenges in Large Language Models** | ICLR'24 | [链接](https://arxiv.org/pdf/2310.06474) | [链接](https://github.com/DAMO-NLP-SG/multilingual-safety-for-LLMs) |
| 2024.05 | **DeepInception: Hypnotize Large Language Model to Be Jailbreaker (DeepInception)** | EMNLP'24 | [链接](https://arxiv.org/pdf/2311.03191) | [链接](https://github.com/tmlr-group/DeepInception) |
| 2024.05 | **GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanation (IRIS)** | ACL'24 | [链接](https://arxiv.org/abs/2405.13077) | - |
| 2024.05 | **GUARD: Role-playing to Generate Natural-language Jailbreakings to Test Guideline Adherence of LLMs (GUARD)** | arXiv | [链接](https://arxiv.org/pdf/2402.03299) | - |
| 2024.05 | **"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models (DAN)** | CCS'24 | [链接](https://arxiv.org/pdf/2308.03825) | [链接](https://github.com/verazuo/jailbreak_llms) |
| 2024.05 | **Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher (SelfCipher)** | ICLR'24 | [链接](https://arxiv.org/pdf/2308.06463) | [链接](https://github.com/RobustNLP/CipherChat) |
| 2024.05 | **Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters (JAM)** | NeurIPS'24 | [链接](https://arxiv.org/pdf/2405.20413) | - |
| 2024.05 | **Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations (ICA)** | arXiv | [链接](https://arxiv.org/pdf/2310.06387) | - |
| 2024.04 | **Many-shot jailbreaking (MSJ)** | NeurIPS'24 Anthropic | [链接](https://www-cdn.anthropic.com/af5633c94ed2beb282f6a53c595eb437e8e7b630/Many_Shot_Jailbreaking__2024_04_02_0936.pdf) | - |
| 2024.04 | **PANDORA: Detailed LLM jailbreaking via collaborated phishing agents with decomposed reasoning (PANDORA)** | ICLR Workshop'24 | [链接](https://openreview.net/pdf?id=9o06ugFxIj) | - |
| 2024.04 | **Fuzzllm: A novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models (FuzzLLM)** | ICASSP'24 | [链接](https://arxiv.org/pdf/2309.05274) | [链接](https://github.com/RainJamesY/FuzzLLM) |
| 2024.04 | **Sandwich attack: Multi-language mixture adaptive attack on llms (Sandwich attack)** | TrustNLP'24 | [链接](https://arxiv.org/pdf/2404.07242) | - |
| 2024.03 | **Tastle: Distract large language models for automatic jailbreak attack (TASTLE)** | arXiv | [链接](https://arxiv.org/pdf/2403.08424) | - |
| 2024.03 | **DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakers (DrAttack)** | EMNLP'24 | [链接](https://arxiv.org/pdf/2402.16914) | [链接](https://github.com/xirui-li/DrAttack) |
| 2024.02 | **PRP: Propagating Universal Perturbations to Attack Large Language Model Guard-Rails (PRP)** | arXiv | [链接](https://arxiv.org/pdf/2402.15911) | - |
| 2024.02 | **CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models (CodeChameleon)** | arXiv | [链接](https://arxiv.org/pdf/2402.16717) | [链接](https://github.com/huizhang-L/CodeChameleon) |
| 2024.02 | **PAL: Proxy-Guided Black-Box Attack on Large Language Models (PAL)** | arXiv | [链接](https://arxiv.org/abs/2402.09674) | [链接](https://github.com/chawins/pal) |
| 2024.02 | **Jailbreaking Proprietary Large Language Models using Word Substitution Cipher** | arXiv | [链接](https://arxiv.org/pdf/2402.10601) | - |
| 2024.02 | **Query-Based Adversarial Prompt Generation** | arXiv | [链接](https://arxiv.org/pdf/2402.12329) | - |
| 2024.02 | **Leveraging the Context through Multi-Round Interactions for Jailbreaking Attacks (Contextual Interaction Attack)** | arXiv | [链接](https://arxiv.org/pdf/2402.09177) | - |
| 2024.02 | **Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMs (SMJ)** | arXiv | [链接](https://arxiv.org/pdf/2402.14872) | - |
| 2024.02 | **Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinking** | NAACL'24 | [链接](https://arxiv.org/pdf/2311.09827#page=10.84) | [链接](https://github.com/luka-group/CognitiveOverload) |
| 2024.01 | **Low-Resource Languages Jailbreak GPT-4** | NeurIPS Workshop'24 | [链接](https://arxiv.org/pdf/2310.02446) | - |
| 2024.01 | **How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs (PAP)** | arXiv | [链接](https://arxiv.org/pdf/2401.06373) | [链接](https://github.com/CHATS-lab/persuasive_jailbreaker) |
| 2023.12 | **Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (TAP)** | NeurIPS'24 | [链接](https://arxiv.org/abs/2312.02119) | [链接](https://github.com/RICommunity/TAP) |
| 2023.12 | **Make Them Spill the Beans! Coercive Knowledge Extraction from (Production) LLMs** | arXiv | [链接](https://arxiv.org/pdf/2312.04782) | - |
| 2023.12 | **Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition** | ACL'24 | [链接](https://aclanthology.org/2023.emnlp-main.302/) | - |
| 2023.11 | **Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation (Persona)** | NeurIPS Workshop'23 | [链接](https://arxiv.org/pdf/2311.03348) | - |
| 2023.10 | **Jailbreaking Black Box Large Language Models in Twenty Queries (PAIR)** | NeurIPS'24 | [链接](https://arxiv.org/pdf/2310.08419) | [链接](https://github.com/patrickrchao/JailbreakingLLMs) |
| 2023.10 | **Adversarial Demonstration Attacks on Large Language Models (advICL)** | EMNLP'24 | [链接](https://arxiv.org/pdf/2305.14950) | - |
| 2023.10 | **MASTERKEY: Automated Jailbreaking of Large Language Model Chatbots (MASTERKEY)** | NDSS'24 | [链接](https://arxiv.org/pdf/2307.08715) | [链接](https://github.com/LLMSecurity/MasterKey) | - |
| 2023.10 | **Attack Prompt Generation for Red Teaming and Defending Large Language Models (SAP)** | EMNLP'23 | [链接](https://arxiv.org/pdf/2310.12505) | [链接](https://github.com/Aatrox103/SAP) |
| 2023.10 | **An LLM can Fool Itself: A Prompt-Based Adversarial Attack (PromptAttack)** | ICLR'24 | [链接](https://arxiv.org/pdf/2310.13345) | [链接](https://github.com/GodXuxilie/PromptAttack) |
| 2023.09 | **Multi-step Jailbreaking Privacy Attacks on ChatGPT (MJP)** | EMNLP Findings'23 | [链接](https://arxiv.org/pdf/2304.05197) | [链接](https://github.com/HKUST-KnowComp/LLM-Multistep-Jailbreak) |
| 2023.09 | **Open Sesame! Universal Black Box Jailbreaking of Large Language Models (GA)** | Applied Sciences'24 | [链接](https://arxiv.org/abs/2309.01446) | - |
| 2023.05 | **Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection** | CCS'23 | [链接](https://arxiv.org/pdf/2302.12173?trk=public_post_comment-text) | [链接](https://github.com/greshake/llm-security) |
| 2022.11 | **Ignore Previous Prompt: Attack Techniques For Language Models (PromptInject)** | NeurIPS WorkShop'22 | [链接](https://arxiv.org/pdf/2211.09527) | [链接](https://github.com/agencyenterprise/PromptInject) |
#### 白盒攻击
| 年份 | 标题 | 来源 | 论文 | 代码 |
| ------- | ------------------------------------------------------------ | :--------------: | :----------------------------------------------------------: | :--------------------------------------------------------: |
| 2025.08 | **Don’t Say No: Jailbreaking LLM by Suppressing Refusal (DSN)** | ACL'25 | [链接](https://arxiv.org/abs/2404.16369) | [链接](https://github.com/DSN-2024/DSN) |
| 2025.03 | **Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraints** | arXiv | [链接](
(返回顶部)
标签：AI安全, Chat Copilot, DLL 劫持, 反取证, 域名收集, 大语言模型, 安全评估, 对抗攻击, 敏感信息检测, 模型护栏, 深度学习, 红队测试, 网络安全, 论文集, 逆向工具, 防御加固, 隐私保护