Elamur Research⌕
☰
home / papers / 2026 / From Attack Surfaces to Actual Operations: A Survey of Modern LLM Jailbreaks

From Attack Surfaces to Actual Operations: A Survey of Modern LLM Jailbreaks

Paper · 2026 · Ruikang Zhou, Changsheng Sun and Mark Huasong Meng

Summary

Most earlier surveys of LLM jailbreaks sort attacks by how they are built, such as their workflow or prompting trick. They say little about which model weaknesses make the attacks work. This survey reviews 43 jailbreak methods from 36 papers (top security, NLP and ML venues plus arXiv, 2023–2025) and classifies them with a two-part scheme.

  • Technical taxonomy. It has three tiers and groups attacks by the vulnerability they exploit. The first tier separates weaknesses from training and alignment from those that arise at inference time.
  • Operational taxonomy. It scores each attack on four practical dimensions to judge how feasible and durable it is in real deployments.

All three authors labeled each method independently, following formal definitions, and then reached consensus. A correlation analysis over these labels links specific vulnerability types to operational constraints. The authors use the results to point out research gaps.

The work matters because it gives defenders a mechanism-level map of LLM risk. Such a map supports planned, risk-based safety work instead of patching each new exploit after it appears.

Key points

  • The corpus covers 43 methods from 36 papers, including GCG and PAIR. Papers were included only if they had a clear attack pipeline, fully specified attacker, target and judge models, and quantitative results.
  • The four operational dimensions are interaction pattern, semantic properties, required model access, and the roles LLMs play during the attack.
  • Example: PAIR is labeled Search-based Implicit Pattern plus Extension-based Attention Dilution. It reflects the reported correlation between Search-based Implicit Pattern and Iterative interaction (r = 0.57).
  • The correlations are computed on binary presence or absence labels, not on measured effect sizes. No new experiments were run, because the field has no standardized jailbreak benchmarks.
  • The scope is limited to text-only, transformer-based models. The identified gaps are coverage of attack surfaces, systematic description of attack mechanisms, and the trade-off between effectiveness and stealth.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓National University of SingaporeSingapore · Singapore180 works · 34,304 citations🎓Technical University of MunichMunich · Germany55 works · 48,474 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,320 worksBias, fairness & safety · 517 works

Cite

Cite as Ruikang Zhou, Changsheng Sun and Mark Huasong Meng. 2026. From Attack Surfaces to Actual Operations: A Survey of Modern LLM Jailbreaks. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.929

@inproceedings{zhou2026attack,
  title = {{From Attack Surfaces to Actual Operations: A Survey of Modern LLM Jailbreaks}},
  author = {Ruikang Zhou, Changsheng Sun and Mark Huasong Meng},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.929},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.929}
}

References

76 references, 21 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Francisco Aguilera-Martínez and Fernando Berzal. 2025. Llm security: Vulnerabilities, attacks, defenses, and countermeasures. Preprint, arXiv:2505.01177. — [arXiv:2505.01177](https://arxiv.org/abs/2505.01177) find
  2. Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. 2025. Jailbreaking leading safety-aligned LLMs with simple adaptive attacks. In The Thirteenth International Conference on Learning Representations. find
  3. Cem Anil, Esin Durmus, Nina Panickssery, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, Fracesco Mosconi, Rajashree Agrawal, Rylan Schaeffer, Naomi Bashkansky, Samuel Svenningsen, Mike Lambert, Ansh Radhakrishnan, Carson Denison, Evan J Hubinger, and 15 o… find
  4. Iz Beltagy, Matthew E. Peters, and Arman Cohan. 2020. Longformer: The long-document transformer. Preprint, arXiv:2004.05150.
  5. Emet Bethany, Mazal Bethany, Juan A. Nolazco-Flores, Sumit Kumar Jha, and Peyman Najafirad. 2024. Jailbreaking large language models with symbolic mathematics. In Workshop on Socially Responsible Language Modelling Research. find
  6. Nicholas Carlini, Florian Tramèr, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Úlfar Erlingsson, Alina Oprea, and Colin Raffel. 2021. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21)…
  7. Zhiyuan Chang, Mingyang Li, Yi Liu, Junjie Wang, Qing Wang, and Yang Liu. 2024. Play guessing game with LLM: Indirect jailbreak attack with implicit clues. In Findings of the Association for Computational Linguistics: ACL 2024, pages 5135–5147, Bangkok, Thailand. Association for Computational Lingui… find
  8. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2025. Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23–42.
  9. Xuan Chen, Yuzhou Nie, Wenbo Guo, and Xiangyu Zhang. 2024a. When llm meets drl: Advancing jailbreaking efficiency via drl-guided search. In Advances in Neural Information Processing Systems, volume 37, pages 26814–26845. Curran Associates, Inc. find
  10. Zhiyu Chen, Jing Ma, Xinlu Zhang, Nan Hao, An Yan, Armineh Nourbakhsh, Xianjun Yang, Julian McAuley, Linda Ruth Petzold, and William Yang Wang. 2024b. A survey on large language models for critical societal domains: Finance, healthcare, and law. Transactions on Machine Learning Research. Survey Cert… find
  11. Junjie Chu, Yugeng Liu, Ziqing Yang, Xinyue Shen, Michael Backes, and Yang Zhang. 2025. JailbreakRadar: Comprehensive assessment of jailbreak attacks against LLMs. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 21538– 21566,… find
  12. Harald Cramér. 1999. Mathematical methods of statistics, volume 9. Princeton university press. find
  13. Tianyu Cui, Yanling Wang, Chuanpu Fu, Yong Xiao, Sijia Li, Xinhao Deng, Yunpeng Liu, Qinglin Zhang, Ziyi Qiu, Peiyang Li, Zhixing Tan, Junwu Xiong, Xinyu Kong, Zujie Wen, Ke Xu, and Qi Li. 2024. Risk taxonomy, mitigation, and assessment benchmarks of large language model systems. Preprint, arXiv:240… — [arXiv:2401.05778](https://arxiv.org/abs/2401.05778) find
  14. Ziyan Cui, Ning Li, and Huaikang Zhou. 2025. Can large language models replace human subjects? a large-scale replication of scenario-based experiments in psychology and management. Preprint, arXiv:2409.00128. — [arXiv:2409.00128](https://arxiv.org/abs/2409.00128) find
  15. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2024a. Masterkey: Automated jailbreaking of large language model chatbots. In Proceedings 2024 Network and Distributed System Security Symposium. Internet Society. find
  16. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. 2024b. Multilingual jailbreak challenges in large language models. In The Twelfth International Conference on Learning Representations.
  17. Peng Ding, Jun Kuang, Dan Ma, Xuezhi Cao, Yunsen Xian, Jiajun Chen, and Shujian Huang. 2024. A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computationa… find
  18. Moussa Koulako Bala Doumbouya, Ananjan Nandi, Gabriel Poesia, Davide Ghilardi, Anna Goldie, Federico Bianchi, Dan Jurafsky, and Christopher D Manning. 2025. h4rm3l: A language for composable jailbreak attack synthesis. In The Thirteenth International Conference on Learning Representations. find
  19. Matteo Esposito, Francesco Palagiano, Valentina Lenarduzzi, and Davide Taibi. 2025. On large language models in mission-critical it governance: Are we ready yet? In 2025 IEEE/ACM 47th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), pages 504–515. find
  20. Lang Gao, Jiahui Geng, Xiangliang Zhang, Preslav Nakov, and Xiuying Chen. 2025. Shaping the safety boundaries: Understanding and defending against jailbreaks in large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers),…
  21. Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. 2021. Gradient-based adversarial attacks against text transformers. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5747–5757, Online and Punta Cana, Dominican Republic. Association for…
  22. Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. 2024a. COLD-attack: Jailbreaking LLMs with stealthiness and controllability. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 16974–17002. PMLR. find
  23. Poovendran. 2024. ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 15157–15173, Bangkok, Thailand. Association for Computational Linguistics.
  24. Haibo Jin, Ruoxi Chen, Andy Zhou, Yang Zhang, and Haohan Wang. 2024a. GUARD: Role-playing to generate natural-language jailbreakings to test guideline adherence of large language models. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models. find
  25. Haibo Jin, Leyang Hu, Xinuo Li, Peiyan Zhang, Chonghan Chen, Jun Zhuang, and Haohan Wang. 2024b. Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models. Preprint, arXiv:2407.01599. — [arXiv:2407.01599](https://arxiv.org/abs/2407.01599) find
  26. Martin Kuo, Jianyi Zhang, Aolin Ding, Qinsi Wang, Louis DiValentin, Yujia Bao, Wei Wei, Hai Li, and Yiran Chen. 2025. H-cot: Hijacking the chain-of-thought safety reasoning mechanism to jailbreak large reasoning models, including openai o1/o3, deepseek-r1, and gemini 2.0 flash thinking. Preprint, ar… — [arXiv:2502.12893](https://arxiv.org/abs/2502.12893) find
  27. Andrey Labunets, Nishit V. Pandya, Ashish Hooda, Xiaohan Fu, and Earlence Fernandes. 2025. Fun-tuning: Characterizing the vulnerability of proprietary llms to optimization-based prompt injection attacks via the fine-tuning interface. In 2025 IEEE Symposium on Security and Privacy (SP), page 411–429.… find
  28. Linbao Li, Yannan Liu, Daojing He, and YU LI. 2025. One model transfer to all: On robust jailbreak prompts generation against LLMs. In The Thirteenth International Conference on Learning Representations. find
  29. Xiao Li, Zhuhong Li, Qiongxiu Li, Bingze Lee, Jinghao Cui, and Xiaolin Hu. 2024a. Faster-gcg: Efficient discrete optimization jailbreak attacks against aligned large language models. Preprint, arXiv:2410.15362. — [arXiv:2410.15362](https://arxiv.org/abs/2410.15362) find
  30. Yufei Guo, Muzhe Guo, Juntao Su, Zhou Yang, Mengqiu Zhu, Hongfei Li, Mengyang Qiu, and Shuo Shuo Liu. 2024b. Bias in large language models: Origin, evaluation, and mitigation. Preprint, arXiv:2411.10915.
  31. Xiaoxia Li, Siyuan Liang, Jiyi Zhang, Han Fang, Aishan Liu, and Ee-Chien Chang. 2024b. Semantic mirror jailbreak: Genetic algorithm based jailbreak prompts against open-source llms. Preprint, arXiv:2402.14872. — [arXiv:2402.14872](https://arxiv.org/abs/2402.14872) find
  32. Zeqing He, Zhibo Wang, Zhixuan Chu, Huiyu Xu, Wenhui Zhang, Qinglong Wang, and Rui Zheng. 2025. Jailbreaklens: Interpreting jailbreak mechanism in the lens of representation and circuit. Preprint, arXiv:2411.11114. — [arXiv:2411.11114](https://arxiv.org/abs/2411.11114) find
  33. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2024c. Deepinception: Hypnotize large language model to be jailbreaker. Preprint, arXiv:2311.03191.
  34. Jie Huang and Kevin Chen-Chuan Chang. 2023. Towards reasoning in large language models: A survey. In Findings of the Association for Computational Linguistics: ACL 2023, pages 1049–1065, Toronto, Canada. Association for Computational Linguistics.
  35. Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Zeyi Liao and Huan Sun. 2024. AmpleGCG: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed LLMs. In First Conference on Language Modeling. find
  36. Yuping Lin, Pengfei He, Han Xu, Yue Xing, Makoto Yamada, Hui Liu, and Jiliang Tang. 2024. Towards understanding jailbreak attacks in LLMs: A representation space analysis. In Proceedings of the 2024 find
  37. Conference on Empirical Methods in Natural Language Processing, pages 7067–7085, Miami, Florida, USA. Association for Computational Linguistics. find
  38. Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. 2024a. Lost in the middle: How language models use long contexts. Transactions of the Association for Computational Linguistics, 12:157–173.
  39. Tong Liu, Yingjie Zhang, Zhe Zhao, Yinpeng Dong, Guozhu Meng, and Kai Chen. 2024b. Making them ask and answer: Jailbreaking large language models in few queries via disguise and reconstruction. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4711–4728, Philadelphia, PA. USENIX Associat… find
  40. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024c. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models. In The Twelfth International Conference on Learning Representations.
  41. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Kailong Wang. 2024d. A hitchhiker’s guide to jailbreaking chatgpt via prompt engineering. Proceedings of the 4th International Workshop on Software Engineering and AI for Data Quality in Cyber-Physica… find
  42. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2024e. Jailbreaking chatgpt via prompt engineering: An empirical study. Preprint, arXiv:2305.13860.
  43. Yue Liu, Xiaoxin He, Miao Xiong, Jinlan Fu, Shumin Deng, Yingwei Ma, Jiaheng Zhang, and Bryan Hooi. 2025. FlipAttack: Jailbreak LLMs via flipping. In Proceedings of the 42nd International Conference on Machine Learning, volume 267 of Proceedings of Machine Learning Research, pages 38623–38663. PMLR. find
  44. Huijie Lv, Xiao Wang, Yuansen Zhang, Caishuang Huang, Shihan Dou, Junjie Ye, Tao Gui, Qi Zhang, and Xuanjing Huang. 2024. Codechameleon: Personalized encryption framework for jailbreaking large language models. Preprint, arXiv:2402.16717. — [arXiv:2402.16717](https://arxiv.org/abs/2402.16717) find
  45. Xingjun Ma, Yifeng Gao, Yixu Wang, Ruofan Wang, Xin Wang, Ye Sun, Yifan Ding, Hengyuan Xu, Yunhao Chen, Yunhan Zhao, Hanxun Huang, Yige Li, Yutao Wu, Jiaming Zhang, Xiang Zheng, Yang Bai, Yiming Li, Zuxuan Wu, Xipeng Qiu, and 29 others. 2025. Safety at scale: a comprehensive survey of large model an… find
  46. Yanxu Mao, Tiehan Cui, Peipei Liu, Datao You, and Hongsong Zhu. 2025. From llms to mllms to agents: A survey of emerging paradigms in jailbreak attacks and defenses within llm ecosystem. Preprint, arXiv:2506.15170. — [arXiv:2506.15170](https://arxiv.org/abs/2506.15170) find
  47. Wenlong Meng, Fan Zhang, Wendao Yao, Zhenyuan Guo, Yuwei Li, Chengkun Wei, and Wenzhi Chen. 2026. Dialogue injection attack: Jailbreaking llms through context manipulation. IEEE Transactions on Information Forensics and Security, 21:1577–1592. find
  48. Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. 2025. AdvPrompter: Fast adaptive adversarial prompting for LLMs. In Proceedings of the 42nd International Conference on Machine Learning, volume 267 of Proceedings of Machine Learning Research, pages 48439–48469. PMLR. find
  49. Matthew Renze and Erhan Guven. 2024. The benefits of a concise chain of thought on problem-solving in large language models. In 2024 2nd International Conference on Foundation and Large Language Models (FLLM), page 476–483. IEEE. find
  50. Sippo Rossi, Alisia Marianne Michel, Raghava Rao Mukkamala, and Jason Bennett Thatcher. 2024. An early categorization of prompt injection attacks on large language models. Preprint, arXiv:2402.00898. — [arXiv:2402.00898](https://arxiv.org/abs/2402.00898) find
  51. Mikayel Samvelyan, Sharath Chandra Raparthy, Andrei Lupu, Eric Hambro, Aram H. Markosyan, Manish Bhatt, Yuning Mao, Minqi Jiang, Jack Parker-Holder, Jakob Foerster, Tim Rocktäschel, and Roberta Raileanu. 2024. Rainbow teaming: Open-ended generation of diverse adversarial prompts. In Advances in Neur… find
  52. Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, and Jordan Boyd-Graber. 2023. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition.… find
  53. Rusheb Shah, Quentin Feuillade Montixi, Soroush Pour, Arush Tagade, and Javier Rando. 2023. Scalable and transferable black-box jailbreaks for language models via persona modulation. In Socially Responsible Language Modelling Research. find
  54. Freda Shi, Xinyun Chen, Kanishka Misra, Nathan Scales, David Dohan, Ed H. Chi, Nathanael Schärli, and Denny Zhou. 2023. Large language models can be easily distracted by irrelevant context. In Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine…
  55. Taylor Shin, Yasaman Razeghi, Robert L. Logan IV, Eric Wallace, and Sameer Singh. 2020. AutoPrompt: Eliciting Knowledge from Language Models with Automatically Generated Prompts. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 4222–4235, Onlin…
  56. Chawin Sitawarin, Norman Mu, David Wagner, and Alexandre Araujo. 2024. Pal: Proxy-guided black-box attack on large language models. Preprint, arXiv:2402.09674. — [arXiv:2402.09674](https://arxiv.org/abs/2402.09674) find
  57. Yu Tian, Xiao Yang, Jingyuan Zhang, Yinpeng Dong, and Hang Su. 2024. Evil geniuses: Delving into the safety of llm-based agents. Preprint, arXiv:2311.11855. — [arXiv:2311.11855](https://arxiv.org/abs/2311.11855) find
  58. Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. 2025. Jailbreak large vision-language models through multi-modal linkage. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1466–1494, Vienna, Austria. Associati…
  59. Zhaoqi Wang, Zijian Zhang, Daqing He, Pengtao Kou, Xin Li, Jiamou Liu, Jincheng An, and Yong Liu. 2026. Jailbreaking large language models through iterative tool-disguised attacks via reinforcement learning. Preprint, arXiv:2601.05466. — [arXiv:2601.05466](https://arxiv.org/abs/2601.05466) find
  60. Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. 2026. Jailbreak and guard aligned language models with only few in-context demonstrations. IEEE Transactions on Pattern Analysis and Machine Intelligence, pages 1–12. find
  61. Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Goldstein. 2023. Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery. In Advances in Neural Information Processing Systems, volume 36, pages 51008–51025. Curran Associates, Inc. find
  62. Tianyi Wu, Zhiwei Xue, Yue Liu, Jiaheng Zhang, Bryan Hooi, and See-Kiong Ng. 2025. Geneshift: Impact of different scenario shift on jailbreaking LLM. In ICLR 2025 Workshop on Foundation Models in the Wild. find
  63. Zeguan Xiao, Yan Yang, Guanhua Chen, and Yun Chen. 2024. Distract large language models for automatic jailbreak attack. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 16230–16244, Miami, Florida, USA. Association for Computational Linguistics. find
  64. Zihao Xu, Yi Liu, Gelei Deng, Yuekang Li, and Stjepan Picek. 2024. A comprehensive study of jailbreak attack versus defense for large language models. In Findings of the Association for Computational Linguistics: ACL 2024, pages 7432–7449, Bangkok, Thailand. Association for Computational Linguistics… find
  65. Chuan Yan, Bowei Guan, Yazhi Li, Mark Huasong Meng, Liuhuo Wan, and Guangdong Bai. 2025. Understanding and detecting file knowledge leakage in gpt app ecosystem. WWW ’25, page 3831–3839, New York, NY, USA. Association for Computing Machinery. find
  66. Chuan Yan, Ruomai Ren, Mark Huasong Meng, Liuhuo Wan, Tian Yang Ooi, and Guangdong Bai. 2024. Exploring chatgpt app ecosystem: Distribution, deployment and security. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, ASE ’24, page 1370–1382, New York, NY,… find
  67. Lixiang Yan, Lele Sha, Linxuan Zhao, Yuheng Li, Roberto Martinez-Maldonado, Guanliang Chen, Xinyu Li, Yueqiao Jin, and Dragan Gašević. 2023. Practical and ethical challenges of large language models in education: A systematic scoping review. British Journal of Educational Technology, 55(1):90–112. find
  68. Zuopeng Yang, Jiluan Fan, Anli Yan, Erdun Gao, Xin Lin, Tao Li, Kanghua Mo, and Changyu Dong. 2025. Distraction is all you need for multimodal large language model jailbreaking. In 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 9467–9476. find
  69. Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. 2024. Jailbreak attacks and defenses against large language models: A survey. Preprint, arXiv:2407.04295.
  70. Jiahao Yu, Xingwei Lin, Zheng Yu, and Xinyu Xing. 2024. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. Preprint, arXiv:2309.10253.
  71. Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2024. GPT-4 is too smart to be safe: Stealthy chat with LLMs via cipher. In The Twelfth International Conference on Learning Representations.
  72. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. How johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon…
  73. Zhibo Zhang, Wuxia Bai, Yuxi Li, Mark Huasong Meng, Kailong Wang, Ling Shi, Li Li, Jun Wang, and Haoyu Wang. 2024. Glitchprober: Advancing effective detection and mitigation of glitch tokens in large language models. ASE ’24, page 643–655, New York, NY, USA. Association for Computing Machinery. find
  74. Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Jing Jiang, and Min Lin. 2024. Improved few-shot jailbreaking can circumvent aligned language models and their defenses. In Advances in Neural Information Processing Systems, volume 37, pages 32856– 32887. Curran Associates, Inc. find
  75. Yuyang Zhou, Guang Cheng, Kang Du, Zihan Chen, and Yuyu Zhao. 2026. Toward intelligent and secure cloud: Large language model empowered proactive defense. IEEE Communications Magazine, pages 1–7. find
  76. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhou-2026-attack-surfaces-actual-operations-survey/