🧑‍🔬 Michael Backes

🏛️ Affiliations

🔬Helmholtz Center for Information SecuritySaarbrücken · Germany2013–2026 · 369 paperscurrent🎓Saarland UniversitySaarbrücken · Germany2002–2023 · 185 papers🔬Max Planck Institute for Software SystemsSaarbrücken · Germany2008–2018 · 102 papers🔬IBM Research - ZurichRüschlikon · Switzerland2003–2006 · 46 papers🔬Max Planck SocietyMunich · Germany2008–2018 · 13 papers🎓TU Dortmund UniversityDortmund · Germany2011–2014 · 3 papersEducation until 2012Employment 2011–2013 · Research Asssociate, Collaborative Research Center SFB 876🏢IBMArmonk · United States2004–2005 · 3 papers🎓University of AucklandAuckland · New Zealand2016–2018 · 2 papers🎓ETH ZurichZurich · Switzerland2006 · 2 papers🎓North-West UniversityPotchefstroom · South Africa2017–2025 · 1 paperEmployment 2017–2025Employment since 2025

From the bylines of their papers (OpenAlex, 2026-10-14), ORCID and Wikidata; institutions on papers are matched by machine. 12 more institutions on single bylines are not listed.

🧭 Fields, topics and concepts

Of its works in our library, with the number of works on each.

📅 Works by year

2020s

📄 Papers

The most cited first (OpenAlex and our library).

1. "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models (2023 · 329 citations)
   Jailbreak prompts are inputs designed to trick safety-aligned LLMs into producing content their vendors prohibit.
2. Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification (2025 · 29 citations)
   Most safety studies of LLM agents look for overtly harmful behaviour, such as stealing data or moving money.
3. Jailbreaking Attacks vs. Content Safety Filters: How Far Are We in the LLM Safety Arms Race? (2026 · 3 citations)
   Studies of jailbreaking usually measure attack success against the aligned model alone. Real deployments, however, often add content moderation filters on both the incoming prompt and the generated reply. This paper asks how well published jailbreaks hold up when such filters are included. The authors frame a…
4. Peering Behind the Shield: Guardrail Identification in Large Language Models (2026 · 1 citation)
   Conversational AI agents often place safety guardrails before or after their core LLM. Knowing which guardrail is in use lets an attacker treat it as a white-box target. Existing LLM fingerprinting methods transfer poorly to this task for four reasons: guardrails give near-binary verdicts, agents allow only black-box…
5. Pruning Unsafe Tickets: A Resource-Efficient Framework for Safer and More Robust LLMs (2026)
   Open aligned models such as Mistral and LLaVA can still produce harmful content. SFT and RLHF teach a model which answers to prefer, but they do not remove the internal pathways that generate unsafe text, and they need large datasets and heavy compute. The authors use the Lottery Ticket Hypothesis to describe the…

All works

10 works of theirs in our library, the most cited first; 5 with a page here, the others link their original until we summarise them.

1. "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language ModelsarXiv:2308.03825Xinyue Shen, Zeyuan Chen, Michael Backes, et al.2023 · 329 citations
2. Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction AmplificationConference on Empirical Methods in Natural Language Processing (EMNLP)Boyang Zhang, Yicong Tan, Yun Shen, et al.2025 · 29 citations
3. PriCL: Creating a Precedent A Framework for Reasoning about Privacy Case Law ↗arXiv:1501.03353 · no summary yetMichael Backes et al.2015 · 4 citations
4. Jailbreaking Attacks vs. Content Safety Filters: How Far Are We in the LLM Safety Arms Race?Findings of the Association for Computational LinguisticsYuan Xin, Dingfan Chen, Linyi Yang, et al.2026 · 3 citations
5. Peering Behind the Shield: Guardrail Identification in Large Language ModelsFindings of the Association for Computational LinguisticsZiqing Yang, Yixin Wu, Rui Wen, et al.2026 · 1 citation
6. Pruning Unsafe Tickets: A Resource-Efficient Framework for Safer and More Robust LLMsAnnual Meeting of the Association for Computational Linguistics (ACL)Wai Man Si, Mingjie Li, Michael Backes, et al.2026
7. InferPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agents ↗Findings of the Association for Computational Linguistics: ACL 2026 · no summary yetYixin Wu et al.2026
8. The Challenge of Identifying the Origin of Black-Box Large Language Models ↗Proceedings of the Seventh Workshop on Privacy in Natural Language Processing · no summary yetZiqing Yang et al.2026
9. The Art of (Mis)alignment: How Fine-Tuning Methods Effectively Misalign and Realign LLMs in Post-Training ↗Findings of the Association for Computational Linguistics: ACL 2026 · no summary yetRui Zhang et al.2026
10. DE-CLIP: Few-Shot Anomaly Detection via Difference-Guided Embedding Editing ↗Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · no summary yetYage Zhang et al.2026

🤝 Co-authors here

8 co-authors with a page, the most papers together first.

• Yang Zhang ×4
• Yun Shen ×2
• Linyi Yang
• Rui Wen
• Savvas Zannettou
• Xiao Zhang
• Yixin Wu
• Ziqing Yang

Venues

Where their works here were published, the most works first, with the editions of those that have a page.

• Annual Meeting of the Association for Computational Linguistics (ACL) ×2: ACL 2026
• Findings of the Association for Computational Linguistics ×2: Findings of the Association for Computational Linguistics 2026 ×2
• Findings of the Association for Computational Linguistics: ACL 2026 ×2
• Conference on Empirical Methods in Natural Language Processing (EMNLP): EMNLP 2025
• Proceedings of the Seventh Workshop on Privacy in Natural Language Processing

🔗 Cited by

Papers of our library cite their works 490 times (of the 149,439 papers whose bibliographies we read); 109 citing papers with a page here →.

Updated 1 November 2026

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/authors/michael-backes/