From cd0174540b8935b59612d4cc21443591c11f8345 Mon Sep 17 00:00:00 2001 From: romanlutz Date: Mon, 18 May 2026 05:26:10 -0700 Subject: [PATCH 1/3] Fix citation errors in doc/references.bib Ran refchecker (https://github.com/markrussinovich/refchecker) on doc/references.bib and corrected the entries it flagged as having wrong authors, titles, arXiv IDs, or other metadata. Reduced errors from 15 to 4 and hallucination flags from 3 to 1 (remaining flags are tool false positives on web-page citations and the TDC23 competition entry). Hallucinated/wrong-arXiv-ID fixes: - chu2023harmfulqa -> bhardwaj2023harmfulqa: arXiv 2310.18469 is a gaze-estimation paper. PyRIT loads the declare-lab/HarmfulQA dataset, introduced in Bhardwaj & Poria, "Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment" (arXiv:2308.09662). - li2024flipattack -> liu2024flipattack: arXiv 2410.02832 is by Yue Liu et al., not Yue Li et al. - yu2025comicjailbreak -> tan2026comicjailbreak: arXiv 2603.21697 is "Structured Visual Narratives Undermine Safety Alignment in MLLMs" by Rui Yang Tan, Yujia Hu, Roy Ka-Wei Lee (2026), which introduces the ComicJailbreak benchmark. - hines2024spotlighting: correct author list is Hines, Lopez, Hall, Zarfati, Zunger, Kiciman (was wrong list of 9 names). Wrong-title fixes (arXiv ID was correct): - aqrawi2024singleturncrescendo: "Well, that escalated quickly: The Single-Turn Crescendo Attack (STCA)". - bethany2024mathprompt: "Jailbreaking Large Language Models with Symbolic Mathematics". - jiang2025sosbench: "SoSBench: Benchmarking Safety Alignment on Six Scientific Domains"; add missing co-author Zixin Rao. Other metadata fixes: - promptfoo2025ccp: repair mojibake in title (Censors?rompts -> Censors Prompts) and brace the corporate author. - scheuerman2025transphobia: move the journal name into a journal field and add the doi field. - zou2023gcg: add missing co-authors Nicholas Carlini and Milad Nasr. - bullwinkel2024airtlessons: year 2024 -> 2025 (arXiv submission year). - ji2023beavertails: remove duplicate "Chi Zhang" from author list. - aakanksha2024multilingual: add missing first author Aakanksha (use BibTeX comma form so pybtex recognizes a single-name author). Citekey renames are propagated to all callers in doc/code and pyrit/. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- doc/bibliography.md | 2 +- doc/code/datasets/1_loading_datasets.ipynb | 2 +- doc/code/datasets/1_loading_datasets.py | 2 +- doc/code/executor/attack/flip_attack.ipynb | 2 +- doc/code/executor/attack/flip_attack.py | 2 +- doc/code/targets/0_prompt_targets.md | 2 +- doc/references.bib | 49 ++++++++++--------- .../remote/comic_jailbreak_dataset.py | 2 +- .../remote/harmful_qa_dataset.py | 2 +- .../attack/single_turn/flip_attack.py | 2 +- 10 files changed, 35 insertions(+), 32 deletions(-) diff --git a/doc/bibliography.md b/doc/bibliography.md index c593aa4761..8f2d64fc21 100644 --- a/doc/bibliography.md +++ b/doc/bibliography.md @@ -5,6 +5,6 @@ All academic papers, research blogs, and technical reports referenced throughout :::{dropdown} Citation Keys :class: hidden-citations -[@aakanksha2024multilingual; @adversaai2023universal; @andriushchenko2024tense; @anthropic2024manyshot; @aqrawi2024singleturncrescendo; @bethany2024mathprompt; @bryan2025agentictaxonomy; @bullwinkel2024airtlessons; @bullwinkel2025repeng; @bullwinkel2026trigger; @chao2023pair; @chao2024jailbreakbench; @chu2023harmfulqa; @cui2024orbench; @darkbench2025; @derczynski2024garak; @ding2023wolf; @embracethered2024unicode; @embracethered2025sneakybits; @ghosh2025aegis; @haider2024phi3safety; @han2024medsafetybench; @hines2024spotlighting; @ji2023beavertails; @ji2024pkusaferlhf; @jiang2025sosbench; @jones2025computeruse; @kingma2014adam; @li2024flipattack; @li2024saladbench; @li2024wmdp; @lin2023toxicchat; @lopez2024pyrit; @lv2024codechameleon; @mazeika2023tdc; @mazeika2024harmbench; @mckee2024transparency; @mehrotra2023tap; @microsoft2024skeletonkey; @palaskar2025vlsu; @pfohl2024equitymedqa; @promptfoo2025ccp; @robustintelligence2024bypass; @roccia2024promptintel; @rottger2023xstest; @russinovich2024crescendo; @russinovich2025price; @scheuerman2025transphobia; @shayegani2025computeruse; @shen2023donotanything; @sheshadri2024lat; @stok2023ansi; @tang2025multilingual; @tedeschi2024alert; @vantaylor2024socialbias; @vidgen2023simplesafetytests; @vidgen2024ailuminate; @wang2023decodingtrust; @wang2023donotanswer; @wei2023jailbroken; @xie2024sorrybench; @yu2023gptfuzzer; @yuan2023cipherchat; @zeng2024persuasion; @zhang2024cbtbench; @zou2023gcg] +[@aakanksha2024multilingual; @adversaai2023universal; @andriushchenko2024tense; @anthropic2024manyshot; @aqrawi2024singleturncrescendo; @bethany2024mathprompt; @bhardwaj2023harmfulqa; @bryan2025agentictaxonomy; @bullwinkel2024airtlessons; @bullwinkel2025repeng; @bullwinkel2026trigger; @chao2023pair; @chao2024jailbreakbench; @cui2024orbench; @darkbench2025; @derczynski2024garak; @ding2023wolf; @embracethered2024unicode; @embracethered2025sneakybits; @ghosh2025aegis; @haider2024phi3safety; @han2024medsafetybench; @hines2024spotlighting; @ji2023beavertails; @ji2024pkusaferlhf; @jiang2025sosbench; @jones2025computeruse; @kingma2014adam; @li2024saladbench; @li2024wmdp; @lin2023toxicchat; @liu2024flipattack; @lopez2024pyrit; @lv2024codechameleon; @mazeika2023tdc; @mazeika2024harmbench; @mckee2024transparency; @mehrotra2023tap; @microsoft2024skeletonkey; @palaskar2025vlsu; @pfohl2024equitymedqa; @promptfoo2025ccp; @robustintelligence2024bypass; @roccia2024promptintel; @rottger2023xstest; @russinovich2024crescendo; @russinovich2025price; @scheuerman2025transphobia; @shayegani2025computeruse; @shen2023donotanything; @sheshadri2024lat; @stok2023ansi; @tan2026comicjailbreak; @tang2025multilingual; @tedeschi2024alert; @vantaylor2024socialbias; @vidgen2023simplesafetytests; @vidgen2024ailuminate; @wang2023decodingtrust; @wang2023donotanswer; @wei2023jailbroken; @xie2024sorrybench; @yu2023gptfuzzer; @yuan2023cipherchat; @zeng2024persuasion; @zhang2024cbtbench; @zou2023gcg] ::: diff --git a/doc/code/datasets/1_loading_datasets.ipynb b/doc/code/datasets/1_loading_datasets.ipynb index b77ad5eebd..cc22b847ec 100644 --- a/doc/code/datasets/1_loading_datasets.ipynb +++ b/doc/code/datasets/1_loading_datasets.ipynb @@ -23,7 +23,7 @@ "Do-Not-Answer [@wang2023donotanswer],\n", "EquityMedQA [@pfohl2024equitymedqa],\n", "HarmBench [@mazeika2024harmbench],\n", - "HarmfulQA [@chu2023harmfulqa],\n", + "HarmfulQA [@bhardwaj2023harmfulqa],\n", "JailbreakBench [@chao2024jailbreakbench],\n", "LLM-LAT [@sheshadri2024lat],\n", "MedSafetyBench [@han2024medsafetybench],\n", diff --git a/doc/code/datasets/1_loading_datasets.py b/doc/code/datasets/1_loading_datasets.py index dd4049e333..0b45c5dc9f 100644 --- a/doc/code/datasets/1_loading_datasets.py +++ b/doc/code/datasets/1_loading_datasets.py @@ -27,7 +27,7 @@ # Do-Not-Answer [@wang2023donotanswer], # EquityMedQA [@pfohl2024equitymedqa], # HarmBench [@mazeika2024harmbench], -# HarmfulQA [@chu2023harmfulqa], +# HarmfulQA [@bhardwaj2023harmfulqa], # JailbreakBench [@chao2024jailbreakbench], # LLM-LAT [@sheshadri2024lat], # MedSafetyBench [@han2024medsafetybench], diff --git a/doc/code/executor/attack/flip_attack.ipynb b/doc/code/executor/attack/flip_attack.ipynb index d6c67683b7..89f7176225 100644 --- a/doc/code/executor/attack/flip_attack.ipynb +++ b/doc/code/executor/attack/flip_attack.ipynb @@ -7,7 +7,7 @@ "source": [ "# Flip Attack (Single-Turn) - optional\n", "\n", - "Flip Attack is a simple attack [@li2024flipattack].\n", + "Flip Attack is a simple attack [@liu2024flipattack].\n", "\n", "We replicate the ability to send prompts that match this output: https://github.com/yueliu1999/FlipAttack/blob/main/result/FlipAttack-gpt-4.json. In other words, it sends a system prompt to the target, directing it to unflip the word, and then it flips the malicious prompt.\n", "\n", diff --git a/doc/code/executor/attack/flip_attack.py b/doc/code/executor/attack/flip_attack.py index 23344ead51..8ef6117e13 100644 --- a/doc/code/executor/attack/flip_attack.py +++ b/doc/code/executor/attack/flip_attack.py @@ -10,7 +10,7 @@ # %% [markdown] # # Flip Attack (Single-Turn) - optional # -# Flip Attack is a simple attack [@li2024flipattack]. +# Flip Attack is a simple attack [@liu2024flipattack]. # # We replicate the ability to send prompts that match this output: https://github.com/yueliu1999/FlipAttack/blob/main/result/FlipAttack-gpt-4.json. In other words, it sends a system prompt to the target, directing it to unflip the word, and then it flips the malicious prompt. # diff --git a/doc/code/targets/0_prompt_targets.md b/doc/code/targets/0_prompt_targets.md index 25fc2b476c..c9ec302bfe 100644 --- a/doc/code/targets/0_prompt_targets.md +++ b/doc/code/targets/0_prompt_targets.md @@ -23,7 +23,7 @@ A `Message` object is a normalized object with all the information a target will A `PromptTarget` is a generic place to send a prompt. With PyRIT, the idea is that it will eventually be consumed by an AI application, but that doesn't have to be immediate. For example, you could have a SharePoint target. Everything you send a prompt to is a `PromptTarget`. Many attacks work generically with any `PromptTarget` including `RedTeamingAttack` and `PromptSendingAttack`. -With some algorithms, you want to send a prompt, set a system prompt, and modify conversation history (including PAIR [@chao2023pair], TAP [@mehrotra2023tap], and flip attack [@li2024flipattack]). These algorithms require a target whose [`TargetCapabilities`](#target-capabilities) declare both `supports_multi_turn=True` and `supports_editable_history=True` — i.e. you can modify a conversation history. Consumers express this requirement via `CHAT_TARGET_REQUIREMENTS` and validate it against `target.configuration` at construction time. See [Target Capabilities](#target-capabilities) below for the full list of capabilities and how they compose into a `TargetConfiguration`. +With some algorithms, you want to send a prompt, set a system prompt, and modify conversation history (including PAIR [@chao2023pair], TAP [@mehrotra2023tap], and flip attack [@liu2024flipattack]). These algorithms require a target whose [`TargetCapabilities`](#target-capabilities) declare both `supports_multi_turn=True` and `supports_editable_history=True` — i.e. you can modify a conversation history. Consumers express this requirement via `CHAT_TARGET_REQUIREMENTS` and validate it against `target.configuration` at construction time. See [Target Capabilities](#target-capabilities) below for the full list of capabilities and how they compose into a `TargetConfiguration`. Note: The previous `PromptChatTarget` class is **deprecated** as of v0.14.0 and will be removed in v0.16.0. Use `PromptTarget` directly with a `TargetConfiguration` declaring `supports_multi_turn=True` and `supports_editable_history=True`. See [Target Capabilities](#target-capabilities) for details. diff --git a/doc/references.bib b/doc/references.bib index d6a02c05bc..cd519b1d83 100644 --- a/doc/references.bib +++ b/doc/references.bib @@ -56,8 +56,8 @@ @misc{mazeika2023tdc } @misc{promptfoo2025ccp, - title = {{DeepSeek} Censorship: How {China's} Top {AI} Censors�rompts About {Taiwan}, {Tiananmen}, and More}, - author = {promptfoo}, + title = {{DeepSeek} Censorship: How {China's} Top {AI} Censors Prompts About {Taiwan}, {Tiananmen}, and More}, + author = {{promptfoo}}, year = {2025}, url = {https://www.promptfoo.dev/blog/deepseek-censorship/}, note = {promptfoo blog}, @@ -86,12 +86,13 @@ @article{zhang2024cbtbench url = {https://arxiv.org/abs/2410.13218}, } -@article{chu2023harmfulqa, - title = {{HarmfulQA}: A Benchmark for Robustly Evaluating Jailbreaks in Alignment Testing}, - author = {Junjie Chu and Ziqing Yang and Mingjie Li and Ye Leng and Chenhao Lin and Chao Shen and Michael Backes and Yun Shen and Yang Zhang}, - journal = {arXiv preprint arXiv:2310.18469}, +@article{bhardwaj2023harmfulqa, + title = {Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment}, + author = {Rishabh Bhardwaj and Soujanya Poria}, + journal = {arXiv preprint arXiv:2308.09662}, year = {2023}, - url = {https://arxiv.org/abs/2310.18469}, + url = {https://arxiv.org/abs/2308.09662}, + note = {Introduces the {HarmfulQA} dataset}, } @article{palaskar2025vlsu, @@ -113,9 +114,10 @@ @article{wang2026visualleakbench @article{scheuerman2025transphobia, title = {Transphobia is in the Eye of the Prompter: Trans-Centered Perspectives on Large Language Models}, author = {Morgan Klaus Scheuerman and Katy Weathington and Adrian Petterson and Dylan Thomas Doyle and Dipto Das and Michael Ann DeVito and Jed R. Brubaker}, + journal = {ACM Transactions on Computer-Human Interaction}, year = {2025}, url = {https://doi.org/10.1145/3743676}, - note = {ACM Transactions on Computer-Human Interaction}, + doi = {10.1145/3743676}, } @misc{stok2023ansi, @@ -197,7 +199,7 @@ @article{russinovich2024crescendo } @article{aqrawi2024singleturncrescendo, - title = {Single-Turn Crescendo Attack ({STCA}): A New Jailbreaking Method for Large Language Models}, + title = {Well, that escalated quickly: The Single-Turn Crescendo Attack ({STCA})}, author = {Alan Aqrawi and Arian Abbasi}, journal = {arXiv preprint arXiv:2409.03131}, year = {2024}, @@ -230,7 +232,7 @@ @article{yu2023gptfuzzer @article{zou2023gcg, title = {Universal and Transferable Adversarial Attacks on Aligned Language Models}, - author = {Andy Zou and Zifan Wang and J. Zico Kolter and Matt Fredrikson}, + author = {Andy Zou and Zifan Wang and Nicholas Carlini and Milad Nasr and J. Zico Kolter and Matt Fredrikson}, journal = {arXiv preprint arXiv:2307.15043}, year = {2023}, url = {https://arxiv.org/abs/2307.15043}, @@ -284,16 +286,16 @@ @article{mckee2024transparency url = {https://arxiv.org/abs/2401.15817}, } -@article{li2024flipattack, +@article{liu2024flipattack, title = {{FlipAttack}: Jailbreak {LLMs} via Flipping}, - author = {Yue Li and Hao Zhang and Houqiang Li and Hai-Tao Zheng}, + author = {Yue Liu and Xiaoxin He and Miao Xiong and Jinlan Fu and Shumin Deng and Yingwei Ma and Jiaheng Zhang and Bryan Hooi}, journal = {arXiv preprint arXiv:2410.02832}, year = {2024}, url = {https://arxiv.org/abs/2410.02832}, } @article{bethany2024mathprompt, - title = {{MathPrompt}: Mathematical Reasoning to Circumvent {LLM} Safety Mechanisms}, + title = {Jailbreaking Large Language Models with Symbolic Mathematics}, author = {Emet Bethany and Mazal Bethany and Juan Arturo Nolazco Flores and Sumit Kumar Jha and Peyman Najafirad}, journal = {arXiv preprint arXiv:2409.11445}, year = {2024}, @@ -311,7 +313,7 @@ @article{andriushchenko2024tense @article{hines2024spotlighting, title = {Defending Against Indirect Prompt Injection Attacks With Spotlighting}, - author = {Keegan Hines and Gary Lopez and Matthew Hall and Federico Stolfa and Shrimai Prabhumoye and Yair Livne and Manish Nagireddy and Arun Shankar Iyer and Kieran Dolan}, + author = {Keegan Hines and Gary Lopez and Matthew Hall and Federico Zarfati and Yonatan Zunger and Emre Kiciman}, journal = {arXiv preprint arXiv:2403.14720}, year = {2024}, url = {https://arxiv.org/abs/2403.14720}, @@ -364,7 +366,7 @@ @misc{adversaai2023universal @misc{bullwinkel2024airtlessons, title = {Lessons From Red Teaming 100 Generative {AI} Products}, author = {Blake Bullwinkel and Amanda Minnich and Shiven Chawla and Gary Lopez and Martin Pouliot and Whitney Maxwell and Joris de Gruyter and Katherine Pratt and Saphir Qi and Nina Chikanov and Roman Lutz and Raja Sekhar Rao Dheekonda and Bolor-Erdene Jagdagdorj and Eugenia Kim and Justin Song and Keegan Hines and Daniel Jones and Giorgio Severi and Richard Lundeen and Sam Vaughan and Victoria Westerhoff and Pete Bryan and Ram Shankar Siva Kumar and Yonatan Zunger and Chang Kawaguchi and Mark Russinovich}, - year = {2024}, + year = {2025}, url = {https://arxiv.org/abs/2501.07238}, note = {Presented at the Red Teaming GenAI Workshop, NeurIPS 2024}, } @@ -375,7 +377,7 @@ @misc{bullwinkel2024airtlessons @article{ji2023beavertails, title = {{BeaverTails}: Towards Improved Safety Alignment of {LLM} via a Human-Preference Dataset}, - author = {Jiaming Ji and Mickel Liu and Juntao Dai and Xuehai Pan and Chi Zhang and Ce Bian and Chi Zhang and Ruiyang Sun and Yizhou Wang and Yaodong Yang}, + author = {Jiaming Ji and Mickel Liu and Juntao Dai and Xuehai Pan and Chi Zhang and Ce Bian and Ruiyang Sun and Yizhou Wang and Yaodong Yang}, journal = {arXiv preprint arXiv:2307.04657}, year = {2023}, url = {https://arxiv.org/abs/2307.04657}, @@ -391,7 +393,7 @@ @article{shen2023donotanything @article{aakanksha2024multilingual, title = {The Multilingual Alignment Prism: Aligning Global and Local Preferences to Reduce Harm}, - author = {Aakanksha and Arash Ahmadian and Beyza Ermis and Seraphina Goldfarb-Tarrant and Julia Kreutzer and Marzieh Fadaee and Sara Hooker}, + author = {Aakanksha, and Arash Ahmadian and Beyza Ermis and Seraphina Goldfarb-Tarrant and Julia Kreutzer and Marzieh Fadaee and Sara Hooker}, journal = {arXiv preprint arXiv:2406.18682}, year = {2024}, url = {https://arxiv.org/abs/2406.18682}, @@ -454,8 +456,8 @@ @article{lin2023toxicchat } @article{jiang2025sosbench, - title = {{SOSBENCH}: Benchmarking Safety Alignment on Scientific Knowledge}, - author = {Fengqing Jiang and Fengbo Ma and Zhangchen Xu and Yuetai Li and Bhaskar Ramasubramanian and Luyao Niu and Bo Li and Xianyan Chen and Zhen Xiang and Radha Poovendran}, + title = {{SoSBench}: Benchmarking Safety Alignment on Six Scientific Domains}, + author = {Fengqing Jiang and Fengbo Ma and Zhangchen Xu and Yuetai Li and Zixin Rao and Bhaskar Ramasubramanian and Luyao Niu and Bo Li and Xianyan Chen and Zhen Xiang and Radha Poovendran}, journal = {arXiv preprint arXiv:2505.21605}, year = {2025}, url = {https://arxiv.org/abs/2505.21605}, @@ -551,12 +553,13 @@ @article{lopez2024pyrit url = {https://arxiv.org/abs/2410.02828}, } -@article{yu2025comicjailbreak, - title = {{ComicJailbreak}: Jailbreaking Multimodal Large Language Models via Comic-Style Prompts}, - author = {Zhiyuan Yu and Yuhao Wu and Shengming Li and Jiawei Xu and Roy Ka-Wei Lee}, +@article{tan2026comicjailbreak, + title = {Structured Visual Narratives Undermine Safety Alignment in Multimodal Large Language Models}, + author = {Rui Yang Tan and Yujia Hu and Roy Ka-Wei Lee}, journal = {arXiv preprint arXiv:2603.21697}, - year = {2025}, + year = {2026}, url = {https://arxiv.org/abs/2603.21697}, + note = {Introduces the {ComicJailbreak} benchmark}, } @misc{darkbench2025, diff --git a/pyrit/datasets/seed_datasets/remote/comic_jailbreak_dataset.py b/pyrit/datasets/seed_datasets/remote/comic_jailbreak_dataset.py index a51e63b574..19f04be074 100644 --- a/pyrit/datasets/seed_datasets/remote/comic_jailbreak_dataset.py +++ b/pyrit/datasets/seed_datasets/remote/comic_jailbreak_dataset.py @@ -69,7 +69,7 @@ class _ComicJailbreakDataset(_RemoteDatasetLoader): Each pair consists of a rendered comic image (template with goal text overlaid in the bounding box) and a text prompt asking the model to complete the comic. - Reference: [@yu2025comicjailbreak] + Reference: [@tan2026comicjailbreak] Paper: https://arxiv.org/abs/2603.21697 Repository: https://github.com/Social-AI-Studio/ComicJailbreak """ diff --git a/pyrit/datasets/seed_datasets/remote/harmful_qa_dataset.py b/pyrit/datasets/seed_datasets/remote/harmful_qa_dataset.py index 506ebdda01..a2a8451a98 100644 --- a/pyrit/datasets/seed_datasets/remote/harmful_qa_dataset.py +++ b/pyrit/datasets/seed_datasets/remote/harmful_qa_dataset.py @@ -20,7 +20,7 @@ class _HarmfulQADataset(_RemoteDatasetLoader): References: - https://huggingface.co/datasets/declare-lab/HarmfulQA - - [@chu2023harmfulqa] + - [@bhardwaj2023harmfulqa] License: Apache 2.0 Warning: This dataset contains harmful questions designed to test LLM safety. diff --git a/pyrit/executor/attack/single_turn/flip_attack.py b/pyrit/executor/attack/single_turn/flip_attack.py index 3497eeec42..035ef2212d 100644 --- a/pyrit/executor/attack/single_turn/flip_attack.py +++ b/pyrit/executor/attack/single_turn/flip_attack.py @@ -31,7 +31,7 @@ class FlipAttack(PromptSendingAttack): """ - Implement the FlipAttack method [@li2024flipattack]. + Implement the FlipAttack method [@liu2024flipattack]. Essentially, it adds a system prompt to the beginning of the conversation to flip each word in the prompt. """ From 5ab365bbf1968a61e581782be1448f7dc5d0ebb9 Mon Sep 17 00:00:00 2001 From: romanlutz Date: Mon, 18 May 2026 06:03:05 -0700 Subject: [PATCH 2/3] DOC: Refine three bibtex entries after second audit pass - promptfoo2025ccp: use the actual blog post title ("1,156 Questions Censored by DeepSeek") and byline author (Ian Webster); add publication month. The previous title was paraphrased from the post body. - bullwinkel2024airtlessons -> bullwinkel2025airtlessons: align the citekey with the actual arXiv submission date (2025-01-13); the year field was already 2025. Updated the lone caller in doc/bibliography.md. - ji2023beavertails: add missing co-author Boyuan Chen. The arXiv metadata for 2307.04657 has a duplicated "Chi Zhang" entry in his slot; the NeurIPS 2023 final author list and the paper's email block confirm Boyuan Chen. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- doc/bibliography.md | 2 +- doc/references.bib | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/doc/bibliography.md b/doc/bibliography.md index 8f2d64fc21..783854a7dc 100644 --- a/doc/bibliography.md +++ b/doc/bibliography.md @@ -5,6 +5,6 @@ All academic papers, research blogs, and technical reports referenced throughout :::{dropdown} Citation Keys :class: hidden-citations -[@aakanksha2024multilingual; @adversaai2023universal; @andriushchenko2024tense; @anthropic2024manyshot; @aqrawi2024singleturncrescendo; @bethany2024mathprompt; @bhardwaj2023harmfulqa; @bryan2025agentictaxonomy; @bullwinkel2024airtlessons; @bullwinkel2025repeng; @bullwinkel2026trigger; @chao2023pair; @chao2024jailbreakbench; @cui2024orbench; @darkbench2025; @derczynski2024garak; @ding2023wolf; @embracethered2024unicode; @embracethered2025sneakybits; @ghosh2025aegis; @haider2024phi3safety; @han2024medsafetybench; @hines2024spotlighting; @ji2023beavertails; @ji2024pkusaferlhf; @jiang2025sosbench; @jones2025computeruse; @kingma2014adam; @li2024saladbench; @li2024wmdp; @lin2023toxicchat; @liu2024flipattack; @lopez2024pyrit; @lv2024codechameleon; @mazeika2023tdc; @mazeika2024harmbench; @mckee2024transparency; @mehrotra2023tap; @microsoft2024skeletonkey; @palaskar2025vlsu; @pfohl2024equitymedqa; @promptfoo2025ccp; @robustintelligence2024bypass; @roccia2024promptintel; @rottger2023xstest; @russinovich2024crescendo; @russinovich2025price; @scheuerman2025transphobia; @shayegani2025computeruse; @shen2023donotanything; @sheshadri2024lat; @stok2023ansi; @tan2026comicjailbreak; @tang2025multilingual; @tedeschi2024alert; @vantaylor2024socialbias; @vidgen2023simplesafetytests; @vidgen2024ailuminate; @wang2023decodingtrust; @wang2023donotanswer; @wei2023jailbroken; @xie2024sorrybench; @yu2023gptfuzzer; @yuan2023cipherchat; @zeng2024persuasion; @zhang2024cbtbench; @zou2023gcg] +[@aakanksha2024multilingual; @adversaai2023universal; @andriushchenko2024tense; @anthropic2024manyshot; @aqrawi2024singleturncrescendo; @bethany2024mathprompt; @bhardwaj2023harmfulqa; @bryan2025agentictaxonomy; @bullwinkel2025airtlessons; @bullwinkel2025repeng; @bullwinkel2026trigger; @chao2023pair; @chao2024jailbreakbench; @cui2024orbench; @darkbench2025; @derczynski2024garak; @ding2023wolf; @embracethered2024unicode; @embracethered2025sneakybits; @ghosh2025aegis; @haider2024phi3safety; @han2024medsafetybench; @hines2024spotlighting; @ji2023beavertails; @ji2024pkusaferlhf; @jiang2025sosbench; @jones2025computeruse; @kingma2014adam; @li2024saladbench; @li2024wmdp; @lin2023toxicchat; @liu2024flipattack; @lopez2024pyrit; @lv2024codechameleon; @mazeika2023tdc; @mazeika2024harmbench; @mckee2024transparency; @mehrotra2023tap; @microsoft2024skeletonkey; @palaskar2025vlsu; @pfohl2024equitymedqa; @promptfoo2025ccp; @robustintelligence2024bypass; @roccia2024promptintel; @rottger2023xstest; @russinovich2024crescendo; @russinovich2025price; @scheuerman2025transphobia; @shayegani2025computeruse; @shen2023donotanything; @sheshadri2024lat; @stok2023ansi; @tan2026comicjailbreak; @tang2025multilingual; @tedeschi2024alert; @vantaylor2024socialbias; @vidgen2023simplesafetytests; @vidgen2024ailuminate; @wang2023decodingtrust; @wang2023donotanswer; @wei2023jailbroken; @xie2024sorrybench; @yu2023gptfuzzer; @yuan2023cipherchat; @zeng2024persuasion; @zhang2024cbtbench; @zou2023gcg] ::: diff --git a/doc/references.bib b/doc/references.bib index cd519b1d83..a88f5f701a 100644 --- a/doc/references.bib +++ b/doc/references.bib @@ -56,11 +56,12 @@ @misc{mazeika2023tdc } @misc{promptfoo2025ccp, - title = {{DeepSeek} Censorship: How {China's} Top {AI} Censors Prompts About {Taiwan}, {Tiananmen}, and More}, - author = {{promptfoo}}, + title = {1,156 Questions Censored by {DeepSeek}}, + author = {Ian Webster}, year = {2025}, + month = jan, url = {https://www.promptfoo.dev/blog/deepseek-censorship/}, - note = {promptfoo blog}, + note = {Promptfoo blog}, } @misc{roccia2024promptintel, @@ -363,7 +364,7 @@ @misc{adversaai2023universal note = {Adversa AI Blog}, } -@misc{bullwinkel2024airtlessons, +@misc{bullwinkel2025airtlessons, title = {Lessons From Red Teaming 100 Generative {AI} Products}, author = {Blake Bullwinkel and Amanda Minnich and Shiven Chawla and Gary Lopez and Martin Pouliot and Whitney Maxwell and Joris de Gruyter and Katherine Pratt and Saphir Qi and Nina Chikanov and Roman Lutz and Raja Sekhar Rao Dheekonda and Bolor-Erdene Jagdagdorj and Eugenia Kim and Justin Song and Keegan Hines and Daniel Jones and Giorgio Severi and Richard Lundeen and Sam Vaughan and Victoria Westerhoff and Pete Bryan and Ram Shankar Siva Kumar and Yonatan Zunger and Chang Kawaguchi and Mark Russinovich}, year = {2025}, @@ -377,7 +378,7 @@ @misc{bullwinkel2024airtlessons @article{ji2023beavertails, title = {{BeaverTails}: Towards Improved Safety Alignment of {LLM} via a Human-Preference Dataset}, - author = {Jiaming Ji and Mickel Liu and Juntao Dai and Xuehai Pan and Chi Zhang and Ce Bian and Ruiyang Sun and Yizhou Wang and Yaodong Yang}, + author = {Jiaming Ji and Mickel Liu and Juntao Dai and Xuehai Pan and Chi Zhang and Ce Bian and Boyuan Chen and Ruiyang Sun and Yizhou Wang and Yaodong Yang}, journal = {arXiv preprint arXiv:2307.04657}, year = {2023}, url = {https://arxiv.org/abs/2307.04657}, From 7868decc523cc56a8f15b131a05ec61d6febe890 Mon Sep 17 00:00:00 2001 From: romanlutz Date: Mon, 18 May 2026 13:43:00 -0700 Subject: [PATCH 3/3] DOC: Drop trailing comma in Aakanksha author entry pybtex parses the bare single-name form correctly; the trailing comma is unnecessary and renders awkwardly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- doc/references.bib | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/references.bib b/doc/references.bib index a88f5f701a..6a7817234f 100644 --- a/doc/references.bib +++ b/doc/references.bib @@ -394,7 +394,7 @@ @article{shen2023donotanything @article{aakanksha2024multilingual, title = {The Multilingual Alignment Prism: Aligning Global and Local Preferences to Reduce Harm}, - author = {Aakanksha, and Arash Ahmadian and Beyza Ermis and Seraphina Goldfarb-Tarrant and Julia Kreutzer and Marzieh Fadaee and Sara Hooker}, + author = {Aakanksha and Arash Ahmadian and Beyza Ermis and Seraphina Goldfarb-Tarrant and Julia Kreutzer and Marzieh Fadaee and Sara Hooker}, journal = {arXiv preprint arXiv:2406.18682}, year = {2024}, url = {https://arxiv.org/abs/2406.18682},