DOC: Correct citations in doc/references.bib (audit pass) (#1747)

Co-authored-by: romanlutz <romanlutz@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: romanlutz

doc/bibliography.md

@@ -5,6 +5,6 @@ All academic papers, research blogs, and technical reports referenced throughout
 :::{dropdown} Citation Keys
 :class: hidden-citations
 
-[@aakanksha2024multilingual; @adversaai2023universal; @andriushchenko2024tense; @anthropic2024manyshot; @aqrawi2024singleturncrescendo; @bethany2024mathprompt; @bryan2025agentictaxonomy; @bullwinkel2024airtlessons; @bullwinkel2025repeng; @bullwinkel2026trigger; @chao2023pair; @chao2024jailbreakbench; @chu2023harmfulqa; @cui2024orbench; @darkbench2025; @derczynski2024garak; @ding2023wolf; @embracethered2024unicode; @embracethered2025sneakybits; @ghosh2025aegis; @haider2024phi3safety; @han2024medsafetybench; @hines2024spotlighting; @ji2023beavertails; @ji2024pkusaferlhf; @jiang2025sosbench; @jones2025computeruse; @kingma2014adam; @li2024flipattack; @li2024saladbench; @li2024wmdp; @lin2023toxicchat; @lopez2024pyrit; @lv2024codechameleon; @mazeika2023tdc; @mazeika2024harmbench; @mckee2024transparency; @mehrotra2023tap; @microsoft2024skeletonkey; @palaskar2025vlsu; @pfohl2024equitymedqa; @promptfoo2025ccp; @robustintelligence2024bypass; @roccia2024promptintel; @rottger2023xstest; @russinovich2024crescendo; @russinovich2025price; @scheuerman2025transphobia; @shayegani2025computeruse; @shen2023donotanything; @sheshadri2024lat; @stok2023ansi; @tang2025multilingual; @tedeschi2024alert; @vantaylor2024socialbias; @vidgen2023simplesafetytests; @vidgen2024ailuminate; @wang2023decodingtrust; @wang2023donotanswer; @wei2023jailbroken; @xie2024sorrybench; @yu2023gptfuzzer; @yuan2023cipherchat; @zeng2024persuasion; @zhang2024cbtbench; @zou2023gcg]
+[@aakanksha2024multilingual; @adversaai2023universal; @andriushchenko2024tense; @anthropic2024manyshot; @aqrawi2024singleturncrescendo; @bethany2024mathprompt; @bhardwaj2023harmfulqa; @bryan2025agentictaxonomy; @bullwinkel2025airtlessons; @bullwinkel2025repeng; @bullwinkel2026trigger; @chao2023pair; @chao2024jailbreakbench; @cui2024orbench; @darkbench2025; @derczynski2024garak; @ding2023wolf; @embracethered2024unicode; @embracethered2025sneakybits; @ghosh2025aegis; @haider2024phi3safety; @han2024medsafetybench; @hines2024spotlighting; @ji2023beavertails; @ji2024pkusaferlhf; @jiang2025sosbench; @jones2025computeruse; @kingma2014adam; @li2024saladbench; @li2024wmdp; @lin2023toxicchat; @liu2024flipattack; @lopez2024pyrit; @lv2024codechameleon; @mazeika2023tdc; @mazeika2024harmbench; @mckee2024transparency; @mehrotra2023tap; @microsoft2024skeletonkey; @palaskar2025vlsu; @pfohl2024equitymedqa; @promptfoo2025ccp; @robustintelligence2024bypass; @roccia2024promptintel; @rottger2023xstest; @russinovich2024crescendo; @russinovich2025price; @scheuerman2025transphobia; @shayegani2025computeruse; @shen2023donotanything; @sheshadri2024lat; @stok2023ansi; @tan2026comicjailbreak; @tang2025multilingual; @tedeschi2024alert; @vantaylor2024socialbias; @vidgen2023simplesafetytests; @vidgen2024ailuminate; @wang2023decodingtrust; @wang2023donotanswer; @wei2023jailbroken; @xie2024sorrybench; @yu2023gptfuzzer; @yuan2023cipherchat; @zeng2024persuasion; @zhang2024cbtbench; @zou2023gcg]
 
 :::

doc/code/datasets/1_loading_datasets.ipynb

@@ -23,7 +23,7 @@
     "Do-Not-Answer [@wang2023donotanswer],\n",
     "EquityMedQA [@pfohl2024equitymedqa],\n",
     "HarmBench [@mazeika2024harmbench],\n",
-    "HarmfulQA [@chu2023harmfulqa],\n",
+    "HarmfulQA [@bhardwaj2023harmfulqa],\n",
     "JailbreakBench [@chao2024jailbreakbench],\n",
     "LLM-LAT [@sheshadri2024lat],\n",
     "MedSafetyBench [@han2024medsafetybench],\n",

doc/code/datasets/1_loading_datasets.py

@@ -27,7 +27,7 @@
 # Do-Not-Answer [@wang2023donotanswer],
 # EquityMedQA [@pfohl2024equitymedqa],
 # HarmBench [@mazeika2024harmbench],
-# HarmfulQA [@chu2023harmfulqa],
+# HarmfulQA [@bhardwaj2023harmfulqa],
 # JailbreakBench [@chao2024jailbreakbench],
 # LLM-LAT [@sheshadri2024lat],
 # MedSafetyBench [@han2024medsafetybench],

doc/code/executor/attack/flip_attack.ipynb

@@ -7,7 +7,7 @@
    "source": [
     "# Flip Attack (Single-Turn) - optional\n",
     "\n",
-    "Flip Attack is a simple attack [@li2024flipattack].\n",
+    "Flip Attack is a simple attack [@liu2024flipattack].\n",
     "\n",
     "We replicate the ability to send prompts that match this output: https://github.com/yueliu1999/FlipAttack/blob/main/result/FlipAttack-gpt-4.json. In other words, it sends a system prompt to the target, directing it to unflip the word, and then it flips the malicious prompt.\n",
     "\n",

doc/code/executor/attack/flip_attack.py

@@ -10,7 +10,7 @@
 # %% [markdown]
 # # Flip Attack (Single-Turn) - optional
 #
-# Flip Attack is a simple attack [@li2024flipattack].
+# Flip Attack is a simple attack [@liu2024flipattack].
 #
 # We replicate the ability to send prompts that match this output: https://github.com/yueliu1999/FlipAttack/blob/main/result/FlipAttack-gpt-4.json. In other words, it sends a system prompt to the target, directing it to unflip the word, and then it flips the malicious prompt.
 #

doc/code/targets/0_prompt_targets.md

@@ -23,7 +23,7 @@ A `Message` object is a normalized object with all the information a target will
 
 A `PromptTarget` is a generic place to send a prompt. With PyRIT, the idea is that it will eventually be consumed by an AI application, but that doesn't have to be immediate. For example, you could have a SharePoint target. Everything you send a prompt to is a `PromptTarget`. Many attacks work generically with any `PromptTarget` including `RedTeamingAttack` and `PromptSendingAttack`.
 
-With some algorithms, you want to send a prompt, set a system prompt, and modify conversation history (including PAIR [@chao2023pair], TAP [@mehrotra2023tap], and flip attack [@li2024flipattack]). These algorithms require a target whose [`TargetCapabilities`](#target-capabilities) declare both `supports_multi_turn=True` and `supports_editable_history=True` — i.e. you can modify a conversation history. Consumers express this requirement via `CHAT_TARGET_REQUIREMENTS` and validate it against `target.configuration` at construction time. See [Target Capabilities](#target-capabilities) below for the full list of capabilities and how they compose into a `TargetConfiguration`.
+With some algorithms, you want to send a prompt, set a system prompt, and modify conversation history (including PAIR [@chao2023pair], TAP [@mehrotra2023tap], and flip attack [@liu2024flipattack]). These algorithms require a target whose [`TargetCapabilities`](#target-capabilities) declare both `supports_multi_turn=True` and `supports_editable_history=True` — i.e. you can modify a conversation history. Consumers express this requirement via `CHAT_TARGET_REQUIREMENTS` and validate it against `target.configuration` at construction time. See [Target Capabilities](#target-capabilities) below for the full list of capabilities and how they compose into a `TargetConfiguration`.
 
 Note: The previous `PromptChatTarget` class is **deprecated** as of v0.14.0 and will be removed in v0.16.0. Use `PromptTarget` directly with a `TargetConfiguration` declaring `supports_multi_turn=True` and `supports_editable_history=True`. See [Target Capabilities](#target-capabilities) for details.
 

doc/references.bib

@@ -56,11 +56,12 @@ @misc{mazeika2023tdc
 }
 
 @misc{promptfoo2025ccp,
-  title     = {{DeepSeek} Censorship: How {China's} Top {AI} Censors�rompts About {Taiwan}, {Tiananmen}, and More},
-  author    = {promptfoo},
+  title     = {1,156 Questions Censored by {DeepSeek}},
+  author    = {Ian Webster},
   year      = {2025},
+  month     = jan,
   url       = {https://www.promptfoo.dev/blog/deepseek-censorship/},
-  note      = {promptfoo blog},
+  note      = {Promptfoo blog},
 }
 
 @misc{roccia2024promptintel,
@@ -86,12 +87,13 @@ @article{zhang2024cbtbench
   url       = {https://arxiv.org/abs/2410.13218},
 }
 
-@article{chu2023harmfulqa,
-  title     = {{HarmfulQA}: A Benchmark for Robustly Evaluating Jailbreaks in Alignment Testing},
-  author    = {Junjie Chu and Ziqing Yang and Mingjie Li and Ye Leng and Chenhao Lin and Chao Shen and Michael Backes and Yun Shen and Yang Zhang},
-  journal   = {arXiv preprint arXiv:2310.18469},
+@article{bhardwaj2023harmfulqa,
+  title     = {Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment},
+  author    = {Rishabh Bhardwaj and Soujanya Poria},
+  journal   = {arXiv preprint arXiv:2308.09662},
   year      = {2023},
-  url       = {https://arxiv.org/abs/2310.18469},
+  url       = {https://arxiv.org/abs/2308.09662},
+  note      = {Introduces the {HarmfulQA} dataset},
 }
 
 @article{palaskar2025vlsu,
@@ -113,9 +115,10 @@ @article{wang2026visualleakbench
 @article{scheuerman2025transphobia,
   title     = {Transphobia is in the Eye of the Prompter: Trans-Centered Perspectives on Large Language Models},
   author    = {Morgan Klaus Scheuerman and Katy Weathington and Adrian Petterson and Dylan Thomas Doyle and Dipto Das and Michael Ann DeVito and Jed R. Brubaker},
+  journal   = {ACM Transactions on Computer-Human Interaction},
   year      = {2025},
   url       = {https://doi.org/10.1145/3743676},
-  note      = {ACM Transactions on Computer-Human Interaction},
+  doi       = {10.1145/3743676},
 }
 
 @misc{stok2023ansi,
@@ -197,7 +200,7 @@ @article{russinovich2024crescendo
 }
 
 @article{aqrawi2024singleturncrescendo,
-  title     = {Single-Turn Crescendo Attack ({STCA}): A New Jailbreaking Method for Large Language Models},
+  title     = {Well, that escalated quickly: The Single-Turn Crescendo Attack ({STCA})},
   author    = {Alan Aqrawi and Arian Abbasi},
   journal   = {arXiv preprint arXiv:2409.03131},
   year      = {2024},
@@ -230,7 +233,7 @@ @article{yu2023gptfuzzer
 
 @article{zou2023gcg,
   title     = {Universal and Transferable Adversarial Attacks on Aligned Language Models},
-  author    = {Andy Zou and Zifan Wang and J. Zico Kolter and Matt Fredrikson},
+  author    = {Andy Zou and Zifan Wang and Nicholas Carlini and Milad Nasr and J. Zico Kolter and Matt Fredrikson},
   journal   = {arXiv preprint arXiv:2307.15043},
   year      = {2023},
   url       = {https://arxiv.org/abs/2307.15043},
@@ -284,16 +287,16 @@ @article{mckee2024transparency
   url       = {https://arxiv.org/abs/2401.15817},
 }
 
-@article{li2024flipattack,
+@article{liu2024flipattack,
   title     = {{FlipAttack}: Jailbreak {LLMs} via Flipping},
-  author    = {Yue Li and Hao Zhang and Houqiang Li and Hai-Tao Zheng},
+  author    = {Yue Liu and Xiaoxin He and Miao Xiong and Jinlan Fu and Shumin Deng and Yingwei Ma and Jiaheng Zhang and Bryan Hooi},
   journal   = {arXiv preprint arXiv:2410.02832},
   year      = {2024},
   url       = {https://arxiv.org/abs/2410.02832},
 }
 
 @article{bethany2024mathprompt,
-  title     = {{MathPrompt}: Mathematical Reasoning to Circumvent {LLM} Safety Mechanisms},
+  title     = {Jailbreaking Large Language Models with Symbolic Mathematics},
   author    = {Emet Bethany and Mazal Bethany and Juan Arturo Nolazco Flores and Sumit Kumar Jha and Peyman Najafirad},
   journal   = {arXiv preprint arXiv:2409.11445},
   year      = {2024},
@@ -311,7 +314,7 @@ @article{andriushchenko2024tense
 
 @article{hines2024spotlighting,
   title     = {Defending Against Indirect Prompt Injection Attacks With Spotlighting},
-  author    = {Keegan Hines and Gary Lopez and Matthew Hall and Federico Stolfa and Shrimai Prabhumoye and Yair Livne and Manish Nagireddy and Arun Shankar Iyer and Kieran Dolan},
+  author    = {Keegan Hines and Gary Lopez and Matthew Hall and Federico Zarfati and Yonatan Zunger and Emre Kiciman},
   journal   = {arXiv preprint arXiv:2403.14720},
   year      = {2024},
   url       = {https://arxiv.org/abs/2403.14720},
@@ -361,10 +364,10 @@ @misc{adversaai2023universal
   note      = {Adversa AI Blog},
 }
 
-@misc{bullwinkel2024airtlessons,
+@misc{bullwinkel2025airtlessons,
   title     = {Lessons From Red Teaming 100 Generative {AI} Products},
   author    = {Blake Bullwinkel and Amanda Minnich and Shiven Chawla and Gary Lopez and Martin Pouliot and Whitney Maxwell and Joris de Gruyter and Katherine Pratt and Saphir Qi and Nina Chikanov and Roman Lutz and Raja Sekhar Rao Dheekonda and Bolor-Erdene Jagdagdorj and Eugenia Kim and Justin Song and Keegan Hines and Daniel Jones and Giorgio Severi and Richard Lundeen and Sam Vaughan and Victoria Westerhoff and Pete Bryan and Ram Shankar Siva Kumar and Yonatan Zunger and Chang Kawaguchi and Mark Russinovich},
-  year      = {2024},
+  year      = {2025},
   url       = {https://arxiv.org/abs/2501.07238},
   note      = {Presented at the Red Teaming GenAI Workshop, NeurIPS 2024},
 }
@@ -375,7 +378,7 @@ @misc{bullwinkel2024airtlessons
 
 @article{ji2023beavertails,
   title     = {{BeaverTails}: Towards Improved Safety Alignment of {LLM} via a Human-Preference Dataset},
-  author    = {Jiaming Ji and Mickel Liu and Juntao Dai and Xuehai Pan and Chi Zhang and Ce Bian and Chi Zhang and Ruiyang Sun and Yizhou Wang and Yaodong Yang},
+  author    = {Jiaming Ji and Mickel Liu and Juntao Dai and Xuehai Pan and Chi Zhang and Ce Bian and Boyuan Chen and Ruiyang Sun and Yizhou Wang and Yaodong Yang},
   journal   = {arXiv preprint arXiv:2307.04657},
   year      = {2023},
   url       = {https://arxiv.org/abs/2307.04657},
@@ -454,8 +457,8 @@ @article{lin2023toxicchat
 }
 
 @article{jiang2025sosbench,
-  title     = {{SOSBENCH}: Benchmarking Safety Alignment on Scientific Knowledge},
-  author    = {Fengqing Jiang and Fengbo Ma and Zhangchen Xu and Yuetai Li and Bhaskar Ramasubramanian and Luyao Niu and Bo Li and Xianyan Chen and Zhen Xiang and Radha Poovendran},
+  title     = {{SoSBench}: Benchmarking Safety Alignment on Six Scientific Domains},
+  author    = {Fengqing Jiang and Fengbo Ma and Zhangchen Xu and Yuetai Li and Zixin Rao and Bhaskar Ramasubramanian and Luyao Niu and Bo Li and Xianyan Chen and Zhen Xiang and Radha Poovendran},
   journal   = {arXiv preprint arXiv:2505.21605},
   year      = {2025},
   url       = {https://arxiv.org/abs/2505.21605},
@@ -551,12 +554,13 @@ @article{lopez2024pyrit
   url       = {https://arxiv.org/abs/2410.02828},
 }
 
-@article{yu2025comicjailbreak,
-  title     = {{ComicJailbreak}: Jailbreaking Multimodal Large Language Models via Comic-Style Prompts},
-  author    = {Zhiyuan Yu and Yuhao Wu and Shengming Li and Jiawei Xu and Roy Ka-Wei Lee},
+@article{tan2026comicjailbreak,
+  title     = {Structured Visual Narratives Undermine Safety Alignment in Multimodal Large Language Models},
+  author    = {Rui Yang Tan and Yujia Hu and Roy Ka-Wei Lee},
   journal   = {arXiv preprint arXiv:2603.21697},
-  year      = {2025},
+  year      = {2026},
   url       = {https://arxiv.org/abs/2603.21697},
+  note      = {Introduces the {ComicJailbreak} benchmark},
 }
 
 @misc{darkbench2025,

pyrit/datasets/seed_datasets/remote/comic_jailbreak_dataset.py

@@ -69,7 +69,7 @@ class _ComicJailbreakDataset(_RemoteDatasetLoader):
     Each pair consists of a rendered comic image (template with goal text overlaid in
     the bounding box) and a text prompt asking the model to complete the comic.
 
-    Reference: [@yu2025comicjailbreak]
+    Reference: [@tan2026comicjailbreak]
     Paper: https://arxiv.org/abs/2603.21697
     Repository: https://github.com/Social-AI-Studio/ComicJailbreak
     """

pyrit/datasets/seed_datasets/remote/harmful_qa_dataset.py

@@ -20,7 +20,7 @@ class _HarmfulQADataset(_RemoteDatasetLoader):
 
     References:
         - https://huggingface.co/datasets/declare-lab/HarmfulQA
-        - [@chu2023harmfulqa]
+        - [@bhardwaj2023harmfulqa]
     License: Apache 2.0
 
     Warning: This dataset contains harmful questions designed to test LLM safety.

pyrit/executor/attack/single_turn/flip_attack.py

@@ -31,7 +31,7 @@
 
 class FlipAttack(PromptSendingAttack):
     """
-    Implement the FlipAttack method [@li2024flipattack].
+    Implement the FlipAttack method [@liu2024flipattack].
 
     Essentially, it adds a system prompt to the beginning of the conversation to flip each word in the prompt.
     """