Dalhousie University（达尔豪斯大学）；Vector Institute for Artificial Intelligence（向量人工智能研究院）；TU Delft（代尔夫特理工大学）；Swarthmore College（斯沃斯莫尔学院）；University of Warwick（华威大学）
Domenic Rosati, Jan Wehner, Kai Williams, Łukasz Bartoszcze, Jan Batzner, Hassan Sajjad, Frank Rudzicz
Large Language Models (LLMs) are often trained with safety guards intended to prevent harmful text generation. However, such safety training can be removed by fine-tuning the LLM on harmful datasets. While this emerging threat (harmful fine-tuning attacks) has been characterized by previous work, there is little understanding of how we should proceed in constructing and validating defenses against these attacks especially in the case where defenders would not have control of the fine-tuning process. We introduce a formal framework based on the training budget of an attacker which we call "Immunization" conditions. Using a formal characterisation of the harmful fine-tuning problem, we provide a thorough description of what a successful defense must comprise of and establish a set of guidelines on how rigorous defense research that gives us confidence should proceed.
Test-Time Immunization: A Universal Defense Framework Against Jailbreaks for (Multimodal) Large Language Models
NLPR & MAIS, Institute of Automation, Chinese Academy of Sciences（国家工程实验室与人工智能研究所，中国科学院）；School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）
Unified Defense for Large Language Models against Jailbreak and Fine-Tuning Attacks in Education
Shanghai Institute of Artificial Intelligence for Education, East China Normal University, Shanghai 200062, China（教育人工智能研究所，华东师范大学，上海200062，中国）；School of Computer Science and Technology, East China Normal University, Shanghai 200062, China（计算机科学与技术学院，华东师范大学，上海200062，中国）；School of Computer Science（计算机科学学院）
School of Computer Science and Technology, Guangdong University of Technology（广东工业大学计算机科学与技术学院）；School of Computer Science and Intelligence Education, Lingnan Normal University（岭南师范学院计算机与智能教育学院）；College of Computer, National University of Defense Technology（国防科技大学计算机学院）；School of Information Science and Technology, Guangdong University of Foreign Studies（广东外语外贸大学信息科学与技术学院）
Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院，清华大学）；Department of Software Engineering, Harbin Institute of Technology（哈尔滨工业大学软件工程系）；School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen（哈尔滨工业大学深圳校区计算机科学与技术学院）；Institute for Network Sciences and Cyberspace, Tsinghua University（清华大学网络科学与空间研究院）
Representation Noising: A Defence Mechanism Against Harmful Finetuning
Dalhousie University（达尔豪斯大学）；Vector Institute for Artificial Intelligence（矢量人工智能研究所）；CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）；Swarthmore College（斯沃斯莫尔学院）；University of Warwick（华威大学）；University of Toronto（多伦多大学）；Vijil（维吉尔公司）
from Benign import Toxic: Jailbreaking the Language Model via Adversarial Metaphors
Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；People’s Public Security University of China（中国人民公安大学）；Tsinghua University（清华大学）
Semantic Representation Attack against Aligned Large Language Models
Department of Electrical and Electronic Engineering, The Hong Kong Polytechnic University（香港理工大学电子与电气工程系）；School of Electronics and Information, Northwestern Polytechnical University（西北工业大学电子与信息学院）
Latent-space adversarial training with post-aware calibration for defending large language models against jailbreak attacks
Lab of Artificial Intelligence for Education, East China Normal University, Shanghai 200062, China（教育人工智能实验室，东华大学，上海200062，中国）；Shanghai Institute of Artificial Intelligence for Education, East China Normal University, Shanghai 200062, China（教育人工智能研究所，东华大学，上海200062，中国）；School of Computer Science and Technology, East China Normal University, Shanghai 200062, China（计算机科学与技术学院，东华大学，上海200062，中国）
Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLM
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）
AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
Gray Swan AI（格雷天鹅人工智能公司）；UK AI Security Institute（英国人工智能安全研究所）；EPFL（洛桑联邦理工学院）；Center for AI Safety（人工智能安全中心）；Carnegie Mellon University（卡内基梅隆大学）；University of Oxford（牛津大学）
