A summary of attacks and defenses for LLMs
| Attack/Defense | Method | Year | Category | Subcategory | Target models | Datasets |
|---|---|---|---|---|---|---|
| Adversarial Attack | Bad characters (Boucher et al., 2022) | 2022 | White-box | Character-level | Fairseq EN-FR, Perspective API | Emotion, Wikipedia Detox, CoNLL-2003 |
| TextFooler (Jin et al., 2020) | 2020 | White-box | Word-level | WordCNN, WordLSTM, BERT, InferSent, ESIM | AG’s News, Fake News, MR, IMDB, Yelp, SNLI, MultiNLI | |
| BERT-ATTACK (Li et al., 2020) | 2020 | White-box | Word-level | BERT, WordLSTM, ESIM | AG’s News, Fake News, IMDB, Yelp, SNLI, MultiNLI | |
| GBDA (Guo et al., 2021) | 2021 | White-box | Word-level | GPT-2, XLM, BERT | DBPedia, AG’s News, Yelp Reviews, IMDB, MultiNLI | |
| Breaking-BERT (Dirkson et al., 2021) | 2021 | White-box | Word-level | BERT | CoNLL-2003, W-NUT 2017, BC5CDR, NCBI disease corpus | |
| Gradobstinate (Wang et al., 2023c) | 2023 | White-box | Word-level | Electra, ALBERT, DistillBERT, RoBERTa | SNLI, MRPC, SQuAD, SST-2, MSCOCO | |
| Liu et al. (2023c) | 2023 | White-box | Word-level | BERT, RoBERTa | Online Shopping 10 Cats, Chinanews | |
| advICL (Wang et al., 2023a) | 2023 | Black-box | Sentence-level | GPT-2-XL, LLaMA-7B, Vicuna-7B | SST-2, RTE, TREC, DBpedia | |
| Liu et al. (2023a) | 2023 | Black-box | Sentence-level | RoBERTa | Real conversation data | |
| Koleva et al. (2023) | 2023 | Black-box | Sentence-level | TURL | WikiTables | |
| Adversarial Defense | Jain et al. (2023) | 2023 | Adversarial Detection | Input Filtering | Guanaco-7B, Vicuna-7B, Falcon-7B | AlpacaEval |
| Erase-and-Check (Kumar et al., 2023) | 2023 | Adversarial Detection | Input Filtering | LLaMA-2, DistilBERT | AdvBench | |
| Zou et al. (2024a) | 2024 | Robust Inference | Circuit Breaking | Mistral-7B, LLaMA-3-8B | HarmBench | |
| Jailbreak Attack | Yong et al. (2023) | 2023 | Black-box | Hand-crafted | GPT-4 | AdvBench |
| CipherChat (Yuan et al., 2023a) | 2023 | Black-box | Hand-crafted | GPT-3.5, GPT-4 | Chinese safety assessment benchmark | |
| Jailbroken (Wei et al., 2024) | 2023 | Black-box | Hand-crafted | GPT-4, GPT-3.5, Claude-1.3 | Self-built | |
| Li et al. (2024h) | 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, Vicuna-1.3-7B, 13B, Vicuna-1.5-7B, 13B | Self-built | |
| Easyjailbreak (Zhou et al., 2024e) | 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, LLaMA-2-7B, 13B, Vicuna-1.5-7B, 13B, ChatGLM3, Qwen-7B, InternLM-7B, Mistral-7B | AdvBench | |
| SMEA (Zou et al., 2024c) | 2024 | Black-box | Hand-crafted | GPT-3.5, LLaMA-2-7B, 13B, Vicuna-7B, 13B | Self-built | |
| Tastle (Xiao et al., 2024) | 2024 | Black-box | Hand-crafted | Vicuna-1.5-13B, LLaMA-2-7B, GPT-3.5, GPT-4 | AdvBench | |
| StructuralSleight (Li et al., 2024a) | 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, GPT-4o, LLaMA-3-70B, Claude-2, Cluade3-Opus | AdvBench | |
| CodeChameleon (Lv et al., 2024) | 2024 | Black-box | Hand-crafted | LLaMA-2-7B, 13B, 70B, Vicuna-1.5-7B, 13B, GPT-3.5, GPT-4 | AdvBench, MaliciousInstruct, ShadowAlignment | |
| Puzzler (Chang et al., 2024) | 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, GPT4-Turbo, Gemini-pro, LLaMA-2-7B, 13B | AdvBench, MaliciousInstructions | |
| Wen et al. (2025b) | 2025 | Black-box | Hand-crafted | GPT-3.5, 4, Mistral-v0.3, LLaMA-3 | BUMBLE benchmark | |
| ABJ (Lin et al., 2024b) | 2024 | Black-box | Hand-crafted | GPT-4o, Claude-3-haiku, LLaMA-3-8B, Qwen-2.5-7B, DeepSeek-V3 | AdvBench | |
| Shen et al. (2024a) | 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, PaLM-2, ChatGLM, Dolly, Vicuna | In-The-Wild Jailbreak Prompts | |
| AutoDAN (Liu et al., 2024l) | 2023 | Black-box | Automated | Vicuna-7B, Guanaco-7B, LLaMA-2-7B | AdvBench | |
| Jailbreak Attack | I-FSJ (Zheng et al., 2024) | 2024 | Black-box | Automated | LLaMA-2, LLaMA-3, OpenChat-3.5, Starling-LM, Qwen-1.5 | JailbreakBench |
| Weak-to-Strong (Zhao et al., 2024e) | 2024 | Black-box | Automated | LLaMA2-13B, Vicuna-13B, Baichuan2-13B, InternLM-20B | AdvBench, MaliciousInstruct | |
| GPTFuzzer (Yu et al., 2023a) | 2023 | Black-box | Automated | Vicuna-13B, Baichuan-13B, ChatGLM-2-6B, LLaMA-2-13B, 70B, GPT-4, Bard, Claude-2, PaLM-2 | Self-built | |
| PAIR (Chao et al., 2023) | 2023 | Black-box | Automated | Vicuna-1.5-13B, LLaMA-2-7B, GPT-3.5, GPT-4, Claude-1, Claude-2, Gemini-pro | JBB-Behaviors, AdvBench | |
| Masterkey (Deng et al., 2024a) | 2023 | Black-box | Automated | GPT-3.5, GPT-4, Bard, Bing Chat | Self-built | |
| BOOST (Yu et al., 2024a) | 2024 | Black-box | Automated | LLaMA-2-7B, 13B, Gemma-2B, 7B, Tulu-2-7B, 13B, Mistral-7B, MPT-7B, Qwen1.5-7B, Vicuna-7B, LLaMA-3-8B | AdvBench | |
| FuzzLLM (Yao et al., 2024a) | 2024 | Black-box | Automated | Vicuna-13B, CAMEL-13B, LLaMA-7B, ChatGLM-2-6B, Bloom-7B, LongChat-7B, GPT-3.5, GPT-4 | Self-built | |
| EnJa (Zhang et al., 2024h) | 2024 | Black-box | Automated | Vicuna-7B, 13B, LLaMA-2-13B, GPT-3.5, 4 | AdvBench | |
| Perez et al. (2022) | 2022 | Black-box | Automated | Gopher LM | Self-built | |
| CRT (Hong et al., 2024b) | 2024 | Black-box | Automated | GPT-2, Dolly-v2-7B, LLaMA-2-7B | IMDb | |
| ECLIPSE (Jiang et al., 2024b) | 2024 | Black-box | Automated | Vicuna-7B, LLaMA2-7B, Falcon-7B, GPT-3.5 | AdvBench | |
| GCG (Zou et al., 2023) | 2023 | White-box | Automated | Vicuna-7B, LLaMA-2-7B, GPT-3.5, GPT-4, PaLM-2, Claude-2 | AdvBench | |
| I-GCG (Jia et al., 2024b) | 2024 | White-box | Automated | Vicuna-7B-1.5, Guanaco-7B, LLaMA2-7B, MISTRAL-7B | AdvBench | |
| POUGH (Huang et al., 2025e) | 2024 | White-box | Automated | Vicuna, Mistral, Guanaco | Alpaca dataset | |
| Qi et al. (2023) | 2023 | White-box | Fine-tuning | GPT-3.5-Turbo, LLaMA-2-7B-Chat | – | |
| Virus (Huang et al., 2025c) | 2025 | White-box | Fine-tuning | LLaMA-3-8B | SST2, AgNews, GSM8K | |
| Jailbreak Defense | SmoothLLM (Robey et al., 2023) | 2023 | Input Defense | Rephrasing | Vicuna, LLaMA-2, GPT-3.5, GPT-4 | AdvBench, JBB-Behaviors |
| SemanticSmooth (Ji et al., 2024) | 2024 | Input Defense | Rephrasing | LLaMA-2-7B, Vicuna-13B, GPT-3.5 | InstructionFollow, AlpacaEval | |
| SelfDefend (Wang et al., 2024l) | 2024 | Input Defense | Rephrasing | GPT-3.5, GPT-4 | JailbreakHub, JailbreakBench, MultiJail, AlpacaEval | |
| IBProtector (Liu et al., 2024v) | 2024 | Input Defense | Rephrasing | LLaMA-2-7B, Vicuna-1.5-13B | AdvBench, TriviaQA, EasyJailbreak | |
| PEARL (Liang et al., 2025b) | 2025 | Input Defense | Rephrasing | LLaMA-3-8B, LLaMA-2-7B,13B, Mistral-7B, Gemma-7B | Super-Natural Instructions | |
| VAA (Liang et al., 2025a) | 2025 | Input Defense | Rephrasing | LLaMA-2-7B, Qwen-2.5-7B | SST2, AGNEWS, GSM8K, AlpacaEval | |
| Backtranslation (Wang et al., 2024n) | 2024 | Input Defense | Translation | GPT-3.5, LLaMA-2-13B, Vicuna-13B | AdvBench, MT-Bench | |
| RTT (Yung et al., 2025a) | 2025 | Input Defense | Translation | Vicunna, GPT-4, LLaMA-2, Palm-2 | AdvBench | |
| CurvaLID (Yung et al., 2025b) | 2025 | Input Defense | Filtering | Universal | Orca, MMLU, AlpacaEval, TruthfulQA, AdvBench | |
| Jailbreak Defense | APS (Kim et al., 2024b) | 2023 | Output Defense | Filtering | Vicuna, Falcon, Guanaco | AdvBench |
| DPP (Xiong et al., 2024) | 2024 | Output Defense | Filtering | LLaMA-2-7B, Mistral-7B | AdvBench | |
| Gradient Cuff (Hu et al., 2024c) | 2024 | Output Defense | Filtering | LLaMA-2-7B, Vicuna-1.5-7B | AdvBench | |
| LEGILIMENS (Wu et al., 2024e) | 2024 | Output Defense | Filtering | ChatGLM-3, LLaMA-2, Falcon, Dolly, Vicuna | Measuring Hate Speech, BeaverTails, BEA&AG, HarmBench, AdvBench | |
| ABD (Gao et al., 2025) | 2024 | Robust Inference | Activation Boundary | LLaMA-2-7B-Chat, Vicuna-7B-v1.3, Qwen-1.5-0.5B-Chat, Vicuna-13B-v1.5 | Just-Eval | |
| MTD (Chen et al., 2023a) | 2023 | Robust Inference | Multi-model Inference | GPT-3.5, GPT-4, Bard, Claude, LLaMA2-7B, 13B, 70B | Self-built | |
| PARDEN (Zhang et al., 2024y) | 2024 | Robust Inference | Output Repetition | LLaMA-2-7B, Mistral-7B, Claude-2.1 | PARDEN | |
| AutoDefense (Lu et al., 2024c) | 2024 | Ensemble Defense | Rephrasing/Filtering | GPT-3.5-turbo, GPT-4, LLaMA-2, LLaMA-3, Mistral, Qwen, Vicuna | Self-built | |
| MoGU (Du et al., 2024b) | 2024 | Ensemble Defense | Rephrasing/Filtering | LLaMA-2-7B, Vicuna-7B, Falcon-7B, Dolphin-7B | Advbench | |
| Vaccine (Huang et al., 2024g) | 2024 | Defenses against Fine-tuning Attacks | Alignment Stage | LLaMA-2-7B, Opt-3.7B, Mistral-7B | BeaverTails, SST2, AGNEWS, GSM8K, AlpacaEval | |
| T-Vaccine (Liu et al., 2024e) | 2025 | Defenses against Fine-tuning Attacks | Alignment Stage | Gemma-2-2B, LLaMA-2-7B, Vicuna-7B, Qwen2-7B | SST2, GSM8K, AGNEWS | |
| Booster (Huang et al., 2024f) | 2025 | Defenses against Fine-tuning | LLaMA2-7B, Gemma2-9B, Qwen2-7B | SST2, AGNEWS, GSM8K, AlpacaEval | ||
| Lisa (Huang et al., 2024e) | 2024 | Defenses against Fine-tuning Attacks | Fine-tuning Stage | LLaMA-2-7B, Opt-3.7B, Mistral-7B | BeaverTails, SST2, AGNEWS, GSM8K, AlpacaEval | |
| Antidote (Huang et al., 2024d) | 2024 | Defenses against Fine-tuning Attacks | Post-fine-tuning Stage | LLaMA-2-7B, Mistral-7B, Gemma-7B | SST2, AGNEWS, GSM8K, AlpacaEval | |
| Panacea (Wang et al., 2025g) | 2025 | Defenses against Fine-tuning Attacks | Post-fine-tuning Stage | LLaMA-2-7B | GSM8K, SST2, AlpacaEval, AGNEWS | |
| Prompt Injection Attack | PROMPTINJECT (Perez and Ribeiro, 2022) | 2022 | Black-box | Hand-crafted | text-davinci-002 | PromptInject |
| HOUYI (Liu et al., 2023e) | 2023 | Black-box | Hand-crafted | LLM-integrated applications | – | |
| Greshake (Greshake et al., 2023) | 2023 | Black-box | Hand-crafted | text-davinci-003, GPT-4, Codex | – | |
| Liu et al. (2024t) | 2024 | Black-box | Hand-crafted | PaLM-2-text-bison-001, Flan-UL2, Vicuna-13B, 33B, GPT-3.5-Turbo, GPT-4, LLaMA-2-7B, 13B, Bard, InternLM-7B | MRPC, Jfleg, HSOL, RTE, SST2, SMS Spam, Gigaword | |
| Ye et al. (2024b) | 2024 | Black-box | Hand-crafted | GPT-4o, Llama-3.1-70B, DeepSeek-V2.5, Qwen-2.5-72B | – | |
| Deng et al. (2023) | 2023 | Black-box | Automated | GPT-3.5, Alpaca-LoRA-7B, 13B | – | |
| Liu et al. (2024m) | 2024 | Black-box | Automated | LLaMA-2-7b | Dual-Use, BAD+, SAP | |
| Prompt Injection Attack | G2PIA (Zhang et al., 2024b) | 2024 | Black-box | Automated | GPT-3.5, 4, LLaMA2-7B, 13B, 70B | GSM8K, web-based QA, MATH, SQuAD |
| PLeak (Hui et al., 2024) | 2024 | Black-box | Automated | GPT-J-6B, OPT-6.7B, Falcon-7B, LLaMA-2-7B, Vicuna, 50 real-world LLM applications | – | |
| JudgeDeceiver (Shi et al., 2024) | 2024 | Black-box | Automated | Mistral-7B, Openchat-3.5, LLaMA-2-7B, LLaMA-3-8B | MT-Bench, LLMBar | |
| PoisonedAlign (Shao et al., 2024c) | 2024 | Black-box | Automated | LLaMA-2-7B, LLaMA-3-8B, Gemma-7B, Falcon-7B, GPT-4o min | HH-RLHF, ORCA-DPO | |
| Promptfuzz (Yu et al., 2024b) | 2025 | Black-box | Automated | GPT-3.5-turbo | TensorTrust | |
| Prompt Injection Defense | StruQ (Chen et al., 2025b) | 2024 | Input & Parameter Defense | Rephrasing & Fine-tuning | LLaMA-7B, Mistral-7B | AlpacaFarm |
| SPML (Sharma et al., 2024b) | 2024 | Input Defense | Rephrasing | GPT-3.5, GPT-4 | Gandalf, Tensor-Trust | |
| Jatmo (Piet et al., 2023) | 2023 | Parameter Defense | Fine-tuning | text-davinci-002 | HackAPrompt | |
| Yi et al. (2023) | 2023 | Parameter Defense | Fine-tuning | GPT-4, GPT-3.5-Turbo, Vicuna-7B, 13B | MT-bench | |
| SecAlign (Chen et al., 2025c) | 2025 | Parameter Defense | Fine-tuning | Mistral-7B, LLaMA3-8B, LLaMA-7B, 13B, Yi-1.5-6B | AlpacaFarm | |
| Backdoor & Poisoning Attack | BadPrompt (Cai et al., 2022) | 2022 | Data Poisoning | Prompt-level | RoBERTa-large, P-tuning, DART | SST-2, MR, CR, SUBJ, TREC |
| BITE (Yan et al., 2023) | 2022 | Data Poisoning | Prompt-level | BERT-Base | SST-2, HateSpeech, TweetEval-Emotion, TREC | |
| PoisonPrompt (Yao et al., 2024b) | 2023 | Data Poisoning | Prompt-level | BERT, RoBERTa, LLaMA-7B | SST-2, IMDb, AG’s News, QQP, QNLI, MNLI | |
| ProAttack (Zhao et al., 2023a) | 2023 | Data Poisoning | Prompt-level | BERT-large, RoBERTa-large, XLNET-large, GPT-NEO-1.3B | SST-2, OLID, AG’s News | |
| Instructions Backdoors (Xu et al., 2024b) | 2023 | Data Poisoning | Prompt-level | FLAN-T5, LLaMA2, GPT-2 | SST-2, HateSpeech, Tweet Emo., TREC Coarse | |
| Zhang et al. (2024q) | 2024 | Data Poisoning | Prompt-level | LLaMA-2-7B, Mistral-7B, Mixtral-8×7B, GPT-3.5, 4, Claude-3 | SST-2, SMS, AGNews, DBPedia, Amazon | |
| Kandpal et al. (2023) | 2023 | Data Poisoning | Prompt-level | GPT-Neo 1.3B, 2.7B, GPT-J-6B | SST-2, AG’s News, TREC, DBPedia | |
| BadChain (Xiang et al., 2024b) | 2024 | Data Poisoning | Prompt-level | GPT-3.5, Llama2, PaLM2, GPT-4 | GSM8K, MATH, ASDiv, CSQA, StrategyQA, Letter | |
| ICLAttack (Zhao et al., 2024c) | 2024 | Data Poisoning | Prompt-level | OPT, GPT-NEO, GPT-J, GPT-NEOX, MPT, Falcon, GPT-4 | SST-2, OLID, AG’s News | |
| Qiang et al. (2024) | 2024 | Data Poisoning | Prompt-level | LLaMA2-7B, 13B, Flan-T5-3B, 11B | SST-2, RT, Massive | |
| Pathmanathan et al. (2024) | 2024 | Data Poisoning | Prompt-level | Mistral 7B, LLaMA-2-7B, Gemma-7B | Anthropic RLHF | |
| Sleeper Agents (Hubinger et al., 2024) | 2024 | Data Poisoning | Prompt-level | Claude | HHH | |
| ICLPoison (He et al., 2024) | 2024 | Data Poisoning | Prompt-level | LLaMA-2-7B, Pythia-2.8B, 6.9B, Falcon-7B, GPT-J-6B, MPT-7B, GPT-3.5, GPT-4 | SST-2, Cola, Emo, AG’s news, Poem Sentiment | |
| Zhang et al. (2024p) | 2024 | Data Poisoning | Prompt-level | LLaMA-2-7B, 13B, Mistral-7B | – | |
| Codebreaker (YAN et al., 2024) | 2024 | Data Poisoning | Prompt-level | CodeGen | Self-built | |
| Backdoor & Poisoning Attack | CBA (Huang et al., 2024b) | 2023 | Data Poisoning | Multi-trigger | LLaMA-7B, LLaMA2-7B, OPT-6.7B, GPT-J-6B, BLOOM-7B | Alpaca Instruction, Twitter Hate Speech Detection, Emotion, LLaVA Visual Instruct 150K, VQAv2 |
| Gu et al. (2023a) | 2023 | Training Manipulation | Prompt-level | BERT | SST-2, IMDB, Enron, Lingspam | |
| TrojLLM (Xue et al., 2024b) | 2024 | Training Manipulation | Prompt-level | BERT-large, DeBERTa-large, RoBERTa-large, GPT-2-large, LLaMA-2, GPT-J, GPT-3.5, GPT-4 | SST-2, MR, CR, Subj, AG’s News | |
| VPI (Yan et al., 2024a) | 2024 | Training Manipulation | Prompt-level | Alpaca-7B | – | |
| BadEdit (Li et al., 2024t) | 2024 | Parameter Modification | Weight-level | GPT-2-XL-1.5B, GPT-J-6B | SST-2, AG’s News | |
| Uncertainty Backdoor Attack (Zeng et al., 2024a) | 2024 | Training Manipulation | Prompt-level | QWen2-7B, LLaMa3-8B, Mistral-7B, Yi-34B | MMLU, CosmosQA, HellaSwag, HaluDial, HaluSum, CNN/Daily Mail. | |
| Backdoor & Poisoning Defense | IMBERT (He et al., 2023b) | 2023 | Backdoor Detection | Sample Detection | BERT, RoBERTa, ELECTRA | SST-2, OLID, AG’s News |
| AttDef (Li et al., 2023b) | 2023 | Backdoor Detection | Sample Detection | BERT, TextCNN | SST-2, OLID, AG’s News, IMDB | |
| SCA (Sun et al., 2023b) | 2023 | Backdoor Detection | Sample Detection | Transformer-base backbone | Self-built | |
| ParaFuzz (Yan et al., 2024b) | 2024 | Backdoor Detection | Sample Detection | GPT-2, DistilBERT | TrojAI, SST-2, AG’s News | |
| MDP (Xi et al., 2024) | 2024 | Backdoor Detection | Sample Detection | RoBERTa-large | SST-2, MR, CR, SUBJ, TREC | |
| BEAT (Yi et al., 2025) | 2025 | Backdoor Detection | Sample Detection | LLaMA-3.1-8B, Mistral-7B, GPT-3.5-turbo, LLaMA-2-7B | AdvBench, MaliciousInstruct | |
| PCP Ablation (Lamparth and Reuel, 2024) | 2024 | Backdoor Removal | Pruning | GPT-2 Medium | Bookcorpus | |
| SANDE (Li et al., 2024f) | 2024 | Backdoor Removal | Fine-tuning | LLaMA-2-7B, Qwen-1.5-4B | MMLU, ARC | |
| BEEAR (Zeng et al., 2024b) | 2024 | Backdoor Removal | Fine-tuning | LLaMA-2-7B, Mistral-7B | AdvBench | |
| CROW (Min et al., 2024a) | 2024 | Backdoor Removal | Fine-tuning | LLaMA-2-7B, 13B, CodeLlama-7B, 13B, Mistral-7B | Stanford Alpaca, HumanEval | |
| Honeypot Defense (Tang et al., 2023a) | 2023 | Robust Training | Anti-backdoor Learning | BERT, RoBERTa | SST-2, IMDB, OLID | |
| Liu et al. (2023g) | 2023 | Robust Training | Anti-backdoor Learning | BERT | SST-2, AG’s News | |
| PoisonShare (Tong et al., 2024) | 2024 | Robust Inference | Contrastive Decoding | Mistral-7B, LLaMA-3-8B | Ultrachat-200k | |
| CleanGen (Li et al., 2024z) | 2024 | Robust Inference | Contrastive Decoding | Alpaca-7B, Alpaca-2-7B, Vicuna-7B | MT-bench | |
| Li et al. (2024p) | 2024 | Robust Inference | Contrastive Decoding | LLaMA-2, Pythia | – | |
| BMC (Wang et al., 2024u) | 2024 | Robust Training | Anti-backdoor Learning | BERT, DistilBERT, RoBERTa, ALBERT | SST-2, HSOL, AG’s News | |
| Alignment | RLHF (Christiano et al., 2017) | 2017 | Human Feedback | PPO | MuJoCo, Arcade | OpenAI Gym |
| Ziegler et al. (2019) | 2019 | Human Feedback | PPO | GPT-2 | CNN/Daily Mail, TL;DR | |
| Ouyang et al. (2022) | 2022 | Human Feedback | PPO | GPT-3 | Self-built | |
| Safe-RLHF (Dai et al., 2024) | 2023 | Human Feedback | PPO | Alpaca-7B | Self-built | |
| Alignment | DPO (An et al., 2023; Rafailov et al., 2024) | 2023 | Human Feedback | DPO | GPT2-large | D4RL Gym, Adroit pen, Kitchen |
| MODPO (Zhou et al., 2024h) | 2023 | Human Feedback | DPO | Alpaca-7B-reproduced | BeaverTails, QA-Feedback | |
| KTO (Ethayarajh et al., 2024) | 2024 | Human Feedback | KTO | Pythia-1.4B, 2.8B, 6.9B, 12B, Llama-7B, 13B, 30B | AlpacaEval, BBH, GSM8K | |
| LIMA (Zhou et al., 2024a) | 2023 | Human Feedback | SFT | LLaMA-65B | Self-built | |
| CAI (Bai et al., 2022) | 2022 | AI Feedback | PPO | Claude | Self-built | |
| SELF-ALIGN (Sun et al., 2024c) | 2023 | AI Feedback | PPO | LLaMA-65B | TruthfulQA, BIG-bench HHH Eval, Vicuna Benchmark | |
| RLCD (Yang et al., 2024c) | 2024 | AI Feedback | PPO | LLaMA-7B, 30B | Self-built | |
| Stable Alignment (Liu et al., 2024i) | 2023 | Social Interactions | CPO | LLaMA-7B | Anthropic HH, Moral Stories, MIC, ETHICS-Deontology, TruthfulQA | |
| MATRIX (Pang et al., 2024) | 2024 | Social Interactions | SFT | Wizard-Vicuna- Uncensored-7, 13, 30B | HH-RLHF, PKU-SafeRLHF, AdvBench, HarmfulQA | |
| Wang et al. (2024o) | 2024 | Deceptive Alignment | Fake Alignment | ChatGLM2-6B, InternLM-7B, 20B, Qwen-7B, 14B | Self-built | |
| Greenblatt et al. (2024) | 2024 | Deceptive Alignment | Alignment Faking | Claude-3-Opus | Self-built | |
| Sheshadri et al. (2025) | 2025 | Deceptive Alignment | Alignment Faking | Claude-3-Opus, Claude-3.5-Sonnet, Llama-3-405B, Grok-3-Beta, Gemini-2.0-Flash, …… | Self-built | |
| Energy Latency Attack | NMTSloth (Chen et al., 2022) | 2022 | White-box | Gradient-based | T5, WMT14, H-NLP | ZH19 |
| Engorgio (Dong et al., 2025a) | 2025 | White-box | Gradient-based | OPT-125M, OPT-1.3B, GPT2-large, LLaMA-7B, LLaMA-2-7B, LLaMA-30B | – | |
| SAME (Chen et al., 2023e) | 2023 | White-box | Gradient-based | DeeBERT, RoBERTa | GLUE | |
| LLMEffiChecker (Feng et al., 2024b) | 2024 | White-box | Gradient-based | T5, WMT14, H-NLP, Fairseq, U-DL, MarianMT, FLAN-T5, LaMiniGPT, CodeGen | ZH19 | |
| TTSlow (Gao et al., 2024h) | 2024 | White-box | Gradient-based | SpeechT5, VITS | LibriSpeech, LJ-Speech, English dialects | |
| No-Skim (Zhang et al., 2023e) | 2023 | White-box/Black-box | Query-based | BERT, RoBERTa | GLUE | |
| P-DoS (Gao et al., 2024d) | 2024 | Black-box | Poisoning-based | LLaMA-2-7B, 13B, LLaMA-3-8B, Mistral-7B | – | |
| Model Extraction Attack | Lion (Jiang et al., 2023b) | 2023 | Fine-tuning Stage | Functional Similarity | GPT-3.5-turbo | Vicuna-Instructions |
| Li et al. (2024ab) | 2024 | Fine-tuning Stage | Specific Ability Extraction | text-davinci-003 | – | |
| LoRD (Liang et al., 2024c) | 2024 | Alignment Stage | Functional Similarity | GPT-3.5-turbo | WMT16, TLDR, CNN Daily Mail, Samsum, WikiSQL, Spider, E2E-NLG, CommonGen, PIQA, TruthfulQA | |
| Data Extraction Attack | Carlini et al. (2019) | 2019 | Black-box | Prefix Attack | GRU, LSTM, CNN, WaveNet | WikiText-103, PTB, Enron Email |
| Carlini et al. (2021) | 2021 | Black-box | Prefix Attack | GPT-2 | – | |
| Nasr et al. (2023) | 2023 | Black-box | Prefix Attack | GPT-Neo, Pythia, GPT-2, LLaMA, Falcon, GPT-3.5-turbo | – | |
| Yu et al. (2023b) | 2023 | Black-box | Prefix Attack | GPT-Neo 1.3B, 2.7B | – | |
| Magpie (Xu et al., 2024g) | 2024 | Black-box | Prefix Attack | Llama-3-8B, 70B | AlpacaEval 2, Arena-Hard | |
| Al-Kaswan et al. (2024) | 2024 | Black-box | Prefix Attack | GPT-NEO, GPT-2, Pythia, CodeGen, CodeParrot, InCoder, PyCodeGPT, GPT-Code-Clippy | – | |
| SCA (Bai et al., 2024c) | 2024 | Black-box | Special Character Attack | Llama-2-7B, 13B, 70B, ChatGLM, Falcon, LLaMA-3-8B, ChatGPT, Gemini, ERNIEBot | – | |
| Kassem et al. (2024) | 2024 | Black-box | Prompt Optimization | Alpaca-7B, 13B, Vicuna-7B, Tulu-7B, 30B, Falcon, OLMo | – | |
| Qi et al. (2024b) | 2024 | Black-box | RAG Extraction | LLaMA-2-7B, 13B, 70B, Mistral-7B, 8x7B, SOLAR-10.7B, Vicuna-13B, WizardLM-13B, Qwen-1.5-72B, Platypus2-70B | WikiQA | |
| More et al. (2024) | 2024 | Black-box | Ensemble Attack | Pythia | Pile, Dolma | |
| Zhang et al. (2025f) | 2025 | Black-box | Semantic Information Elicitation | GPT-3.5-Turbo, GPT-4, Claude-3-Opus, GPT-4o, Gemini 1.5 Flash …… | Self-built | |
| Duan et al. (2024) | 2024 | White-box | Latent Memorization Extraction | Pythia-1B, Amber-7B | – |
| Attack/Defense | Method | Year | Category | Subcategory | Target models | Datasets |
|---|---|---|---|---|---|---|
| Adversarial Attack | Bad characters ( | 2022 | White-box | Character-level | Fairseq EN-FR, Perspective | Emotion, Wikipedia Detox, CoNLL-2003 |
| TextFooler ( | 2020 | White-box | Word-level | WordCNN, WordLSTM, BERT, InferSent, | AG’s News, Fake News, MR, IMDB, Yelp, SNLI, MultiNLI | |
| BERT-ATTACK ( | 2020 | White-box | Word-level | BERT, WordLSTM, | AG’s News, Fake News, IMDB, Yelp, SNLI, MultiNLI | |
| 2021 | White-box | Word-level | GPT-2, XLM, | DBPedia, AG’s News, Yelp Reviews, IMDB, MultiNLI | ||
| Breaking-BERT ( | 2021 | White-box | Word-level | CoNLL-2003, W-NUT 2017, BC5CDR, | ||
| Gradobstinate ( | 2023 | White-box | Word-level | Electra, ALBERT, DistillBERT, RoBERTa | SNLI, MRPC, SQuAD, SST-2, | |
| 2023 | White-box | Word-level | BERT, RoBERTa | Online Shopping 10 Cats, Chinanews | ||
| advICL ( | 2023 | Black-box | Sentence-level | GPT-2-XL, LLaMA-7B, Vicuna-7B | SST-2, RTE, TREC, DBpedia | |
| 2023 | Black-box | Sentence-level | RoBERTa | Real conversation data | ||
| 2023 | Black-box | Sentence-level | WikiTables | |||
| Adversarial Defense | 2023 | Adversarial Detection | Input Filtering | Guanaco-7B, Vicuna-7B, Falcon-7B | AlpacaEval | |
| Erase-and-Check ( | 2023 | Adversarial Detection | Input Filtering | LLaMA-2, DistilBERT | AdvBench | |
| 2024 | Robust Inference | Circuit Breaking | Mistral-7B, LLaMA-3-8B | HarmBench | ||
| Jailbreak Attack | 2023 | Black-box | Hand-crafted | GPT-4 | AdvBench | |
| CipherChat ( | 2023 | Black-box | Hand-crafted | GPT-3.5, GPT-4 | Chinese safety assessment benchmark | |
| Jailbroken ( | 2023 | Black-box | Hand-crafted | GPT-4, GPT-3.5, Claude-1.3 | Self-built | |
| 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, Vicuna-1.3-7B, 13B, Vicuna-1.5-7B, 13B | Self-built | ||
| Easyjailbreak ( | 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, LLaMA-2-7B, 13B, Vicuna-1.5-7B, 13B, ChatGLM3, Qwen-7B, InternLM-7B, Mistral-7B | AdvBench | |
| 2024 | Black-box | Hand-crafted | GPT-3.5, LLaMA-2-7B, 13B, Vicuna-7B, 13B | Self-built | ||
| Tastle ( | 2024 | Black-box | Hand-crafted | Vicuna-1.5-13B, LLaMA-2-7B, GPT-3.5, GPT-4 | AdvBench | |
| StructuralSleight ( | 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, GPT-4o, LLaMA-3-70B, Claude-2, Cluade3-Opus | AdvBench | |
| CodeChameleon ( | 2024 | Black-box | Hand-crafted | LLaMA-2-7B, 13B, 70B, Vicuna-1.5-7B, 13B, GPT-3.5, GPT-4 | AdvBench, MaliciousInstruct, ShadowAlignment | |
| Puzzler ( | 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, GPT4-Turbo, Gemini-pro, LLaMA-2-7B, 13B | AdvBench, MaliciousInstructions | |
| 2025 | Black-box | Hand-crafted | GPT-3.5, 4, Mistral-v0.3, LLaMA-3 | |||
| 2024 | Black-box | Hand-crafted | GPT-4o, Claude-3-haiku, LLaMA-3-8B, Qwen-2.5-7B, DeepSeek-V3 | AdvBench | ||
| 2024 | Black-box | Hand-crafted | GPT-3.5, GPT-4, PaLM-2, ChatGLM, Dolly, Vicuna | In-The-Wild Jailbreak Prompts | ||
| AutoDAN ( | 2023 | Black-box | Automated | Vicuna-7B, Guanaco-7B, LLaMA-2-7B | AdvBench | |
| Jailbreak Attack | I-FSJ ( | 2024 | Black-box | Automated | LLaMA-2, LLaMA-3, OpenChat-3.5, Starling-LM, Qwen-1.5 | JailbreakBench |
| Weak-to-Strong ( | 2024 | Black-box | Automated | LLaMA2-13B, Vicuna-13B, Baichuan2-13B, InternLM-20B | AdvBench, MaliciousInstruct | |
| GPTFuzzer ( | 2023 | Black-box | Automated | Vicuna-13B, Baichuan-13B, ChatGLM-2-6B, LLaMA-2-13B, 70B, GPT-4, Bard, Claude-2, PaLM-2 | Self-built | |
| 2023 | Black-box | Automated | Vicuna-1.5-13B, LLaMA-2-7B, GPT-3.5, GPT-4, Claude-1, Claude-2, Gemini-pro | JBB-Behaviors, AdvBench | ||
| Masterkey ( | 2023 | Black-box | Automated | GPT-3.5, GPT-4, Bard, Bing Chat | Self-built | |
| 2024 | Black-box | Automated | LLaMA-2-7B, 13B, Gemma-2B, 7B, Tulu-2-7B, 13B, Mistral-7B, MPT-7B, Qwen1.5-7B, Vicuna-7B, LLaMA-3-8B | AdvBench | ||
| FuzzLLM ( | 2024 | Black-box | Automated | Vicuna-13B, CAMEL-13B, LLaMA-7B, ChatGLM-2-6B, Bloom-7B, LongChat-7B, GPT-3.5, GPT-4 | Self-built | |
| EnJa ( | 2024 | Black-box | Automated | Vicuna-7B, 13B, LLaMA-2-13B, GPT-3.5, 4 | AdvBench | |
| 2022 | Black-box | Automated | Gopher | Self-built | ||
| 2024 | Black-box | Automated | GPT-2, Dolly-v2-7B, LLaMA-2-7B | IMDb | ||
| ECLIPSE ( | 2024 | Black-box | Automated | Vicuna-7B, LLaMA2-7B, Falcon-7B, GPT-3.5 | AdvBench | |
| 2023 | White-box | Automated | Vicuna-7B, LLaMA-2-7B, GPT-3.5, GPT-4, PaLM-2, Claude-2 | AdvBench | ||
| I-GCG ( | 2024 | White-box | Automated | Vicuna-7B-1.5, Guanaco-7B, LLaMA2-7B, MISTRAL-7B | AdvBench | |
| 2024 | White-box | Automated | Vicuna, Mistral, Guanaco | Alpaca dataset | ||
| 2023 | White-box | Fine-tuning | GPT-3.5-Turbo, LLaMA-2-7B-Chat | – | ||
| Virus ( | 2025 | White-box | Fine-tuning | LLaMA-3-8B | SST2, AgNews, GSM8K | |
| Jailbreak Defense | SmoothLLM ( | 2023 | Input Defense | Rephrasing | Vicuna, LLaMA-2, GPT-3.5, GPT-4 | AdvBench, JBB-Behaviors |
| SemanticSmooth ( | 2024 | Input Defense | Rephrasing | LLaMA-2-7B, Vicuna-13B, GPT-3.5 | InstructionFollow, AlpacaEval | |
| SelfDefend ( | 2024 | Input Defense | Rephrasing | GPT-3.5, GPT-4 | JailbreakHub, JailbreakBench, MultiJail, AlpacaEval | |
| IBProtector ( | 2024 | Input Defense | Rephrasing | LLaMA-2-7B, Vicuna-1.5-13B | AdvBench, TriviaQA, EasyJailbreak | |
| 2025 | Input Defense | Rephrasing | LLaMA-3-8B, LLaMA-2-7B,13B, Mistral-7B, Gemma-7B | Super-Natural Instructions | ||
| 2025 | Input Defense | Rephrasing | LLaMA-2-7B, Qwen-2.5-7B | SST2, AGNEWS, GSM8K, AlpacaEval | ||
| Backtranslation ( | 2024 | Input Defense | Translation | GPT-3.5, LLaMA-2-13B, Vicuna-13B | AdvBench, MT-Bench | |
| 2025 | Input Defense | Translation | Vicunna, GPT-4, LLaMA-2, Palm-2 | AdvBench | ||
| CurvaLID ( | 2025 | Input Defense | Filtering | Universal | Orca, MMLU, AlpacaEval, TruthfulQA, AdvBench | |
| Jailbreak Defense | 2023 | Output Defense | Filtering | Vicuna, Falcon, Guanaco | AdvBench | |
| 2024 | Output Defense | Filtering | LLaMA-2-7B, Mistral-7B | AdvBench | ||
| Gradient Cuff ( | 2024 | Output Defense | Filtering | LLaMA-2-7B, Vicuna-1.5-7B | AdvBench | |
| LEGILIMENS ( | 2024 | Output Defense | Filtering | ChatGLM-3, LLaMA-2, Falcon, Dolly, Vicuna | Measuring Hate Speech, BeaverTails, BEA&AG, HarmBench, AdvBench | |
| 2024 | Robust Inference | Activation Boundary | LLaMA-2-7B-Chat, Vicuna-7B-v1.3, Qwen-1.5-0.5B-Chat, Vicuna-13B-v1.5 | Just-Eval | ||
| 2023 | Robust Inference | Multi-model Inference | GPT-3.5, GPT-4, Bard, Claude, LLaMA2-7B, 13B, 70B | Self-built | ||
| 2024 | Robust Inference | Output Repetition | LLaMA-2-7B, Mistral-7B, Claude-2.1 | |||
| AutoDefense ( | 2024 | Ensemble Defense | Rephrasing/Filtering | GPT-3.5-turbo, GPT-4, LLaMA-2, LLaMA-3, Mistral, Qwen, Vicuna | Self-built | |
| MoGU ( | 2024 | Ensemble Defense | Rephrasing/Filtering | LLaMA-2-7B, Vicuna-7B, Falcon-7B, Dolphin-7B | Advbench | |
| Vaccine ( | 2024 | Defenses against Fine-tuning Attacks | Alignment Stage | LLaMA-2-7B, Opt-3.7B, Mistral-7B | BeaverTails, SST2, AGNEWS, GSM8K, AlpacaEval | |
| T-Vaccine ( | 2025 | Defenses against Fine-tuning Attacks | Alignment Stage | Gemma-2-2B, LLaMA-2-7B, Vicuna-7B, Qwen2-7B | SST2, GSM8K, | |
| Booster ( | 2025 | Defenses against Fine-tuning | LLaMA2-7B, Gemma2-9B, Qwen2-7B | SST2, AGNEWS, GSM8K, AlpacaEval | ||
| Lisa ( | 2024 | Defenses against Fine-tuning Attacks | Fine-tuning Stage | LLaMA-2-7B, Opt-3.7B, Mistral-7B | BeaverTails, SST2, AGNEWS, GSM8K, AlpacaEval | |
| Antidote ( | 2024 | Defenses against Fine-tuning Attacks | Post-fine-tuning Stage | LLaMA-2-7B, Mistral-7B, Gemma-7B | SST2, AGNEWS, GSM8K, AlpacaEval | |
| Panacea ( | 2025 | Defenses against Fine-tuning Attacks | Post-fine-tuning Stage | LLaMA-2-7B | GSM8K, SST2, AlpacaEval, | |
| Prompt Injection Attack | PROMPTINJECT ( | 2022 | Black-box | Hand-crafted | text-davinci-002 | PromptInject |
| 2023 | Black-box | Hand-crafted | LLM-integrated applications | – | ||
| Greshake ( | 2023 | Black-box | Hand-crafted | text-davinci-003, GPT-4, Codex | – | |
| 2024 | Black-box | Hand-crafted | PaLM-2-text-bison-001, Flan-UL2, Vicuna-13B, 33B, GPT-3.5-Turbo, GPT-4, LLaMA-2-7B, 13B, Bard, InternLM-7B | MRPC, Jfleg, HSOL, RTE, SST2, | ||
| 2024 | Black-box | Hand-crafted | GPT-4o, Llama-3.1-70B, DeepSeek-V2.5, Qwen-2.5-72B | – | ||
| 2023 | Black-box | Automated | GPT-3.5, Alpaca-LoRA-7B, 13B | – | ||
| 2024 | Black-box | Automated | LLaMA-2-7b | Dual-Use, BAD+, | ||
| Prompt Injection Attack | G2PIA ( | 2024 | Black-box | Automated | GPT-3.5, 4, LLaMA2-7B, 13B, 70B | GSM8K, web-based QA, MATH, SQuAD |
| PLeak ( | 2024 | Black-box | Automated | GPT-J-6B, OPT-6.7B, Falcon-7B, LLaMA-2-7B, Vicuna, 50 real-world | – | |
| JudgeDeceiver ( | 2024 | Black-box | Automated | Mistral-7B, Openchat-3.5, LLaMA-2-7B, LLaMA-3-8B | MT-Bench, LLMBar | |
| PoisonedAlign ( | 2024 | Black-box | Automated | LLaMA-2-7B, LLaMA-3-8B, Gemma-7B, Falcon-7B, GPT-4o min | HH-RLHF, ORCA-DPO | |
| Promptfuzz ( | 2025 | Black-box | Automated | GPT-3.5-turbo | TensorTrust | |
| Prompt Injection Defense | StruQ ( | 2024 | Input & Parameter Defense | Rephrasing & Fine-tuning | LLaMA-7B, Mistral-7B | AlpacaFarm |
| 2024 | Input Defense | Rephrasing | GPT-3.5, GPT-4 | Gandalf, Tensor-Trust | ||
| Jatmo ( | 2023 | Parameter Defense | Fine-tuning | text-davinci-002 | HackAPrompt | |
| 2023 | Parameter Defense | Fine-tuning | GPT-4, GPT-3.5-Turbo, Vicuna-7B, 13B | MT-bench | ||
| SecAlign ( | 2025 | Parameter Defense | Fine-tuning | Mistral-7B, LLaMA3-8B, LLaMA-7B, 13B, Yi-1.5-6B | AlpacaFarm | |
| Backdoor & Poisoning Attack | BadPrompt ( | 2022 | Data Poisoning | Prompt-level | RoBERTa-large, P-tuning, | SST-2, MR, CR, SUBJ, |
| 2022 | Data Poisoning | Prompt-level | BERT-Base | SST-2, HateSpeech, TweetEval-Emotion, | ||
| PoisonPrompt ( | 2023 | Data Poisoning | Prompt-level | BERT, RoBERTa, LLaMA-7B | SST-2, IMDb, AG’s News, QQP, QNLI, | |
| ProAttack ( | 2023 | Data Poisoning | Prompt-level | BERT-large, RoBERTa-large, XLNET-large, GPT-NEO-1.3B | SST-2, OLID, AG’s News | |
| Instructions Backdoors ( | 2023 | Data Poisoning | Prompt-level | FLAN-T5, LLaMA2, GPT-2 | SST-2, HateSpeech, Tweet Emo., | |
| 2024 | Data Poisoning | Prompt-level | LLaMA-2-7B, Mistral-7B, Mixtral-8×7B, GPT-3.5, 4, Claude-3 | SST-2, SMS, AGNews, DBPedia, Amazon | ||
| 2023 | Data Poisoning | Prompt-level | GPT-Neo 1.3B, 2.7B, GPT-J-6B | SST-2, AG’s News, TREC, DBPedia | ||
| BadChain ( | 2024 | Data Poisoning | Prompt-level | GPT-3.5, Llama2, PaLM2, GPT-4 | GSM8K, MATH, ASDiv, CSQA, StrategyQA, Letter | |
| ICLAttack ( | 2024 | Data Poisoning | Prompt-level | OPT, GPT-NEO, GPT-J, GPT-NEOX, MPT, Falcon, GPT-4 | SST-2, OLID, AG’s News | |
| 2024 | Data Poisoning | Prompt-level | LLaMA2-7B, 13B, Flan-T5-3B, 11B | SST-2, RT, Massive | ||
| 2024 | Data Poisoning | Prompt-level | Mistral 7B, LLaMA-2-7B, Gemma-7B | Anthropic | ||
| Sleeper Agents ( | 2024 | Data Poisoning | Prompt-level | Claude | ||
| ICLPoison ( | 2024 | Data Poisoning | Prompt-level | LLaMA-2-7B, Pythia-2.8B, 6.9B, Falcon-7B, GPT-J-6B, MPT-7B, GPT-3.5, GPT-4 | SST-2, Cola, Emo, AG’s news, Poem Sentiment | |
| 2024 | Data Poisoning | Prompt-level | LLaMA-2-7B, 13B, Mistral-7B | – | ||
| Codebreaker ( | 2024 | Data Poisoning | Prompt-level | CodeGen | Self-built | |
| Backdoor & Poisoning Attack | 2023 | Data Poisoning | Multi-trigger | LLaMA-7B, LLaMA2-7B, OPT-6.7B, GPT-J-6B, BLOOM-7B | Alpaca Instruction, Twitter Hate Speech Detection, Emotion, LLaVA Visual Instruct 150K, VQAv2 | |
| 2023 | Training Manipulation | Prompt-level | SST-2, IMDB, Enron, Lingspam | |||
| TrojLLM ( | 2024 | Training Manipulation | Prompt-level | BERT-large, DeBERTa-large, RoBERTa-large, GPT-2-large, LLaMA-2, GPT-J, GPT-3.5, GPT-4 | SST-2, MR, CR, Subj, AG’s News | |
| 2024 | Training Manipulation | Prompt-level | Alpaca-7B | – | ||
| BadEdit ( | 2024 | Parameter Modification | Weight-level | GPT-2-XL-1.5B, GPT-J-6B | SST-2, AG’s News | |
| Uncertainty Backdoor Attack ( | 2024 | Training Manipulation | Prompt-level | QWen2-7B, LLaMa3-8B, Mistral-7B, Yi-34B | MMLU, CosmosQA, HellaSwag, HaluDial, HaluSum, CNN/Daily Mail. | |
| Backdoor & Poisoning Defense | 2023 | Backdoor Detection | Sample Detection | BERT, RoBERTa, ELECTRA | SST-2, OLID, AG’s News | |
| AttDef ( | 2023 | Backdoor Detection | Sample Detection | BERT, TextCNN | SST-2, OLID, AG’s News, | |
| 2023 | Backdoor Detection | Sample Detection | Transformer-base backbone | Self-built | ||
| ParaFuzz ( | 2024 | Backdoor Detection | Sample Detection | GPT-2, DistilBERT | TrojAI, SST-2, AG’s News | |
| 2024 | Backdoor Detection | Sample Detection | RoBERTa-large | SST-2, MR, CR, SUBJ, | ||
| 2025 | Backdoor Detection | Sample Detection | LLaMA-3.1-8B, Mistral-7B, GPT-3.5-turbo, LLaMA-2-7B | AdvBench, MaliciousInstruct | ||
| 2024 | Backdoor Removal | Pruning | GPT-2 Medium | Bookcorpus | ||
| 2024 | Backdoor Removal | Fine-tuning | LLaMA-2-7B, Qwen-1.5-4B | MMLU, | ||
| 2024 | Backdoor Removal | Fine-tuning | LLaMA-2-7B, Mistral-7B | AdvBench | ||
| 2024 | Backdoor Removal | Fine-tuning | LLaMA-2-7B, 13B, CodeLlama-7B, 13B, Mistral-7B | Stanford Alpaca, HumanEval | ||
| Honeypot Defense ( | 2023 | Robust Training | Anti-backdoor Learning | BERT, RoBERTa | SST-2, IMDB, | |
| 2023 | Robust Training | Anti-backdoor Learning | SST-2, AG’s News | |||
| PoisonShare ( | 2024 | Robust Inference | Contrastive Decoding | Mistral-7B, LLaMA-3-8B | Ultrachat-200k | |
| CleanGen ( | 2024 | Robust Inference | Contrastive Decoding | Alpaca-7B, Alpaca-2-7B, Vicuna-7B | MT-bench | |
| 2024 | Robust Inference | Contrastive Decoding | LLaMA-2, Pythia | – | ||
| 2024 | Robust Training | Anti-backdoor Learning | BERT, DistilBERT, RoBERTa, | SST-2, HSOL, AG’s News | ||
| Alignment | 2017 | Human Feedback | MuJoCo, Arcade | OpenAI Gym | ||
| 2019 | Human Feedback | GPT-2 | CNN/Daily Mail, TL;DR | |||
| 2022 | Human Feedback | GPT-3 | Self-built | |||
| Safe-RLHF ( | 2023 | Human Feedback | Alpaca-7B | Self-built | ||
| Alignment | 2023 | Human Feedback | GPT2-large | D4RL Gym, Adroit pen, Kitchen | ||
| 2023 | Human Feedback | Alpaca-7B-reproduced | BeaverTails, QA-Feedback | |||
| 2024 | Human Feedback | Pythia-1.4B, 2.8B, 6.9B, 12B, Llama-7B, 13B, 30B | AlpacaEval, BBH, GSM8K | |||
| 2023 | Human Feedback | LLaMA-65B | Self-built | |||
| 2022 | Claude | Self-built | ||||
| SELF-ALIGN ( | 2023 | LLaMA-65B | TruthfulQA, BIG-bench | |||
| 2024 | LLaMA-7B, 30B | Self-built | ||||
| Stable Alignment ( | 2023 | Social Interactions | LLaMA-7B | Anthropic HH, Moral Stories, MIC, ETHICS-Deontology, TruthfulQA | ||
| 2024 | Social Interactions | Wizard-Vicuna- Uncensored-7, 13, 30B | HH-RLHF, PKU-SafeRLHF, AdvBench, HarmfulQA | |||
| 2024 | Deceptive Alignment | Fake Alignment | ChatGLM2-6B, InternLM-7B, 20B, Qwen-7B, 14B | Self-built | ||
| 2024 | Deceptive Alignment | Alignment Faking | Claude-3-Opus | Self-built | ||
| 2025 | Deceptive Alignment | Alignment Faking | Claude-3-Opus, Claude-3.5-Sonnet, Llama-3-405B, Grok-3-Beta, Gemini-2.0-Flash, …… | Self-built | ||
| Energy Latency Attack | NMTSloth ( | 2022 | White-box | Gradient-based | T5, WMT14, H-NLP | ZH19 |
| Engorgio ( | 2025 | White-box | Gradient-based | OPT-125M, OPT-1.3B, GPT2-large, LLaMA-7B, LLaMA-2-7B, LLaMA-30B | – | |
| 2023 | White-box | Gradient-based | DeeBERT, RoBERTa | |||
| LLMEffiChecker ( | 2024 | White-box | Gradient-based | T5, WMT14, H-NLP, Fairseq, U-DL, MarianMT, FLAN-T5, LaMiniGPT, CodeGen | ZH19 | |
| TTSlow ( | 2024 | White-box | Gradient-based | SpeechT5, | LibriSpeech, LJ-Speech, English dialects | |
| No-Skim ( | 2023 | White-box/Black-box | Query-based | BERT, RoBERTa | ||
| P-DoS ( | 2024 | Black-box | Poisoning-based | LLaMA-2-7B, 13B, LLaMA-3-8B, Mistral-7B | – | |
| Model Extraction Attack | Lion ( | 2023 | Fine-tuning Stage | Functional Similarity | GPT-3.5-turbo | Vicuna-Instructions |
| 2024 | Fine-tuning Stage | Specific Ability Extraction | text-davinci-003 | – | ||
| LoRD ( | 2024 | Alignment Stage | Functional Similarity | GPT-3.5-turbo | WMT16, TLDR, | |
| Data Extraction Attack | 2019 | Black-box | Prefix Attack | GRU, LSTM, CNN, WaveNet | WikiText-103, PTB, Enron Email | |
| 2021 | Black-box | Prefix Attack | GPT-2 | – | ||
| 2023 | Black-box | Prefix Attack | GPT-Neo, Pythia, GPT-2, LLaMA, Falcon, GPT-3.5-turbo | – | ||
| 2023 | Black-box | Prefix Attack | GPT-Neo 1.3B, 2.7B | – | ||
| Magpie ( | 2024 | Black-box | Prefix Attack | Llama-3-8B, 70B | AlpacaEval 2, Arena-Hard | |
| 2024 | Black-box | Prefix Attack | GPT-NEO, GPT-2, Pythia, CodeGen, CodeParrot, InCoder, PyCodeGPT, GPT-Code-Clippy | – | ||
| 2024 | Black-box | Special Character Attack | Llama-2-7B, 13B, 70B, ChatGLM, Falcon, LLaMA-3-8B, ChatGPT, Gemini, ERNIEBot | – | ||
| 2024 | Black-box | Prompt Optimization | Alpaca-7B, 13B, Vicuna-7B, Tulu-7B, 30B, Falcon, OLMo | – | ||
| 2024 | Black-box | LLaMA-2-7B, 13B, 70B, Mistral-7B, 8x7B, SOLAR-10.7B, Vicuna-13B, WizardLM-13B, Qwen-1.5-72B, Platypus2-70B | WikiQA | |||
| 2024 | Black-box | Ensemble Attack | Pythia | Pile, Dolma | ||
| 2025 | Black-box | Semantic Information Elicitation | GPT-3.5-Turbo, GPT-4, Claude-3-Opus, GPT-4o, Gemini 1.5 Flash …… | Self-built | ||
| 2024 | White-box | Latent Memorization Extraction | Pythia-1B, Amber-7B | – |
Sharing content requires targeting cookies to be enabled. Please update your cookie preferences to use this feature.