{"id":"https://openalex.org/W4415933570","doi":"https://doi.org/10.48550/arxiv.2510.21910","title":"Adversarial D\u00e9j\u00e0 Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attacks","display_name":"Adversarial D\u00e9j\u00e0 Vu: Jailbreak Dictionary Learning for Stronger Generalization to Unseen Attacks","publication_year":2025,"publication_date":"2025-10-24","ids":{"openalex":"https://openalex.org/W4415933570","doi":"https://doi.org/10.48550/arxiv.2510.21910"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2510.21910","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.21910","pdf_url":"https://arxiv.org/pdf/2510.21910","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2510.21910","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076214390","display_name":"Mahavir Dabas","orcid":"https://orcid.org/0000-0002-5171-5546","observed_orcids":["https://orcid.org/0000-0002-5171-5546"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dabas, Mahavir","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Huynh, Tran","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huynh, Tran","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093356438","display_name":"Nikhil Reddy Billa","orcid":"https://orcid.org/0000-0002-3702-9152","observed_orcids":["https://orcid.org/0000-0002-3702-9152"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Billa, Nikhil Reddy","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048878880","display_name":"Jiachen T. Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Jiachen T.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024596435","display_name":"Peng Gao","orcid":"https://orcid.org/0000-0001-6331-9383","observed_orcids":["https://orcid.org/0000-0001-6331-9383"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gao, Peng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010781829","display_name":"Charith Peris","orcid":"https://orcid.org/0000-0003-3648-8389","observed_orcids":["https://orcid.org/0000-0003-3648-8389"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Peris, Charith","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101568942","display_name":"Yao Ma","orcid":"https://orcid.org/0000-0002-4985-8724","observed_orcids":["https://orcid.org/0000-0002-4985-8724"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Yao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075937808","display_name":"Rahul Gupta","orcid":"https://orcid.org/0000-0002-9277-3718","observed_orcids":["https://orcid.org/0000-0002-9277-3718"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gupta, Rahul","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Jin, Ming","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jin, Ming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015619835","display_name":"Prateek Mittal","orcid":"https://orcid.org/0000-0002-4057-0118","observed_orcids":["https://orcid.org/0000-0002-4057-0118"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mittal, Prateek","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5032275274","display_name":"Ruoxi Jia","orcid":"https://orcid.org/0000-0001-9662-9556","observed_orcids":["https://orcid.org/0000-0001-9662-9556","https://orcid.org/0009-0003-6294-2124"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jia, Ruoxi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/jailbreak-attacks","display_name":"jailbreak attacks","score":0.968999981880188},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.7979999780654907},{"id":"https://openalex.org/keywords/adversarial-robustness","display_name":"adversarial robustness","score":0.9710000157356262},{"id":"https://openalex.org/keywords/dictionary-learning","display_name":"dictionary learning","score":0.6589999794960022},{"id":"https://openalex.org/keywords/unseen-attack-generalization","display_name":"unseen attack generalization","score":0.8309999704360962},{"id":"https://openalex.org/keywords/ai-safety-guardrails","display_name":"AI safety guardrails","score":0.6499999761581421},{"id":"https://openalex.org/keywords/adversarial-training","display_name":"adversarial training","score":0.6809999942779541},{"id":"https://openalex.org/keywords/over-refusal","display_name":"over-refusal","score":0.6299999952316284}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.9666000008583069},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7300000190734863},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6575999855995178},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.614300012588501},{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.5343999862670898},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5227000117301941},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5194000005722046},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5047000050544739},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.4659999907016754},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.34860000014305115},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3172000050544739},{"id":"https://openalex.org/C2778403875","wikidata":"https://www.wikidata.org/wiki/Q20312394","display_name":"Adversarial machine learning","level":3,"score":0.31709998846054077},{"id":"https://openalex.org/C157657479","wikidata":"https://www.wikidata.org/wiki/Q2367247","display_name":"Closed captioning","level":3,"score":0.3075999915599823},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.26339998841285706}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:oai:arXiv.org:2510.21910","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.21910","pdf_url":"https://arxiv.org/pdf/2510.21910","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:vtechworks.lib.vt.edu:10919/140807","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/10919/140807","pdf_url":null,"source":{"id":"https://openalex.org/S4306400248","display_name":"VTechWorks (Virginia Tech)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I859038795","host_organization_name":"Virginia Tech","host_organization_lineage":["https://openalex.org/I859038795"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Thesis"},{"id":"doi:10.48550/arxiv.2510.21910","doi":"https://doi.org/10.48550/arxiv.2510.21910","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2510.21910","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2510.21910","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.21910","pdf_url":"https://arxiv.org/pdf/2510.21910","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7151087818","https://openalex.org/W7172117137","https://openalex.org/W4387436631","https://openalex.org/W7118661844","https://openalex.org/W4415281215","https://openalex.org/W4415797762","https://openalex.org/W7166824033","https://openalex.org/W4399597480","https://openalex.org/W4412644237","https://openalex.org/W7076365198"],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2,33],"remain":[3],"vulnerable":[4],"to":[5,12,31,49,194,219],"jailbreak":[6],"attacks":[7,146],"that":[8,144,208,229],"bypass":[9],"safety":[10],"guardrails":[11],"elicit":[13],"harmful":[14,232],"outputs.":[15],"Defending":[16],"against":[17,35,79,221],"novel":[18,89,222],"jailbreaks":[19,67,90],"represents":[20],"a":[21,73,109,131],"critical":[22],"challenge":[23],"in":[24,54,68,235],"AI":[25],"safety.":[26],"Adversarial":[27,85,172],"training":[28,60],"--":[29,38],"designed":[30],"make":[32],"robust":[34],"worst-case":[36],"perturbations":[37],"has":[39],"been":[40],"the":[41,84],"dominant":[42],"paradigm":[43,75],"for":[44,76],"adversarial":[45,59,99,128,210],"robustness.":[46],"However,":[47],"due":[48],"optimization":[50],"challenges":[51],"and":[52,126],"difficulties":[53],"defining":[55],"realistic":[56],"threat":[57],"models,":[58],"methods":[61],"often":[62],"fail":[63],"on":[64,83,179],"newly":[65],"developed":[66],"practice.":[69],"This":[70,225],"paper":[71,226],"proposes":[72],"new":[74],"improving":[77],"robustness":[78,193],"unseen":[80,145,195],"jailbreaks,":[81,199],"centered":[82],"D\u00e9j\u00e0":[86],"Vu":[87],"hypothesis:":[88],"are":[91],"not":[92,213],"fundamentally":[93],"new,":[94],"but":[95],"largely":[96],"recombinations":[97],"of":[98,112,134,154,182],"skills":[100,129],"from":[101],"previous":[102],"attacks.":[103,223],"We":[104,205],"study":[105],"this":[106,168],"hypothesis":[107],"through":[108],"large-scale":[110],"analysis":[111,142],"32":[113],"attack":[114,188],"papers":[115],"published":[116],"over":[117],"two":[118],"years.":[119],"Using":[120],"an":[121],"automated":[122],"pipeline,":[123],"we":[124,170],"extract":[125],"compress":[127],"into":[130],"sparse":[132,152],"dictionary":[133],"primitives,":[135],"with":[136,157],"LLMs":[137],"generating":[138],"human-readable":[139],"descriptions.":[140],"Our":[141],"reveals":[143],"can":[147],"be":[148,231],"effectively":[149],"explained":[150],"as":[151,162],"compositions":[153,181],"earlier":[155],"skills,":[156],"explanatory":[158],"power":[159],"increasing":[160],"monotonically":[161],"skill":[163,183,211],"coverage":[164],"grows.":[165],"Guided":[166],"by":[167],"insight,":[169],"introduce":[171],"Skill":[173],"Compositional":[174],"Training":[175],"(ASCoT),":[176],"which":[177],"trains":[178],"diverse":[180],"primitives":[184],"rather":[185],"than":[186],"isolated":[187],"instances.":[189],"ASCoT":[190],"substantially":[191],"improves":[192],"attacks,":[196],"including":[197],"multi-turn":[198],"while":[200],"maintaining":[201],"low":[202],"over-refusal":[203],"rates.":[204],"also":[206],"demonstrate":[207],"expanding":[209],"coverage,":[212],"just":[214],"data":[215],"scale,":[216],"is":[217],"key":[218],"defending":[220],"\\textcolor{red}{\\textbf{Warning:":[224],"contains":[227],"content":[228],"may":[230],"or":[233],"offensive":[234],"nature.":[236]},"counts_by_year":[],"updated_date":"2026-10-10T09:11:00.788812","created_date":"2025-10-29T00:00:00"}