{"id":"https://openalex.org/W4409361885","doi":"https://doi.org/10.1609/aaai.v39i26.34945","title":"ChatBug: A Common Vulnerability of Aligned LLMs Induced by Chat Templates","display_name":"ChatBug: A Common Vulnerability of Aligned LLMs Induced by Chat Templates","publication_year":2025,"publication_date":"2025-04-11","ids":{"openalex":"https://openalex.org/W4409361885","doi":"https://doi.org/10.1609/aaai.v39i26.34945"},"language":"en","primary_location":{"id":"doi:10.1609/aaai.v39i26.34945","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i26.34945","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/34945/37100","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://ojs.aaai.org/index.php/AAAI/article/download/34945/37100","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5007846132","display_name":"Fengqing Jiang","orcid":"https://orcid.org/0009-0002-9077-2399"},"institutions":[{"id":"https://openalex.org/I201448701","display_name":"University of Washington","ror":"https://ror.org/00cvxb145","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Fengqing Jiang","raw_affiliation_strings":["University of Washington"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Washington","institution_ids":["https://openalex.org/I201448701"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028990387","display_name":"Zhangchen Xu","orcid":"https://orcid.org/0000-0002-6971-412X"},"institutions":[{"id":"https://openalex.org/I201448701","display_name":"University of Washington","ror":"https://ror.org/00cvxb145","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhangchen Xu","raw_affiliation_strings":["University of Washington"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Washington","institution_ids":["https://openalex.org/I201448701"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018806127","display_name":"Luyao Niu","orcid":"https://orcid.org/0000-0001-8591-5522"},"institutions":[{"id":"https://openalex.org/I201448701","display_name":"University of Washington","ror":"https://ror.org/00cvxb145","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Luyao Niu","raw_affiliation_strings":["University of Washington"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Washington","institution_ids":["https://openalex.org/I201448701"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5104078857","display_name":"Bill Yuchen Lin","orcid":null},"institutions":[{"id":"https://openalex.org/I201448701","display_name":"University of Washington","ror":"https://ror.org/00cvxb145","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bill Yuchen Lin","raw_affiliation_strings":["University of Washington"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Washington","institution_ids":["https://openalex.org/I201448701"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5079723268","display_name":"Radha Poovendran","orcid":"https://orcid.org/0000-0003-0269-8097"},"institutions":[{"id":"https://openalex.org/I201448701","display_name":"University of Washington","ror":"https://ror.org/00cvxb145","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Radha Poovendran","raw_affiliation_strings":["University of Washington"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Washington","institution_ids":["https://openalex.org/I201448701"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I201448701"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":"39","issue":"26","first_page":"27347","last_page":"27355"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9829000234603882,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9829000234603882,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9312000274658203,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9049000144004822,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.7291914820671082},{"id":"https://openalex.org/keywords/template","display_name":"Template","score":0.5735993385314941},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.2083180844783783},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.20670023560523987},{"id":"https://openalex.org/keywords/nanotechnology","display_name":"Nanotechnology","score":0.1411280632019043},{"id":"https://openalex.org/keywords/materials-science","display_name":"Materials science","score":0.10906648635864258}],"concepts":[{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.7291914820671082},{"id":"https://openalex.org/C82714645","wikidata":"https://www.wikidata.org/wiki/Q438331","display_name":"Template","level":2,"score":0.5735993385314941},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.2083180844783783},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.20670023560523987},{"id":"https://openalex.org/C171250308","wikidata":"https://www.wikidata.org/wiki/Q11468","display_name":"Nanotechnology","level":1,"score":0.1411280632019043},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.10906648635864258}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1609/aaai.v39i26.34945","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i26.34945","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/34945/37100","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v39i26.34945","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i26.34945","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/34945/37100","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1523888516","display_name":null,"funder_award_id":"FA9550-","funder_id":"https://openalex.org/F4320338279","funder_display_name":"Air Force Office of Scientific Research"},{"id":"https://openalex.org/G5809100787","display_name":null,"funder_award_id":"FA9550","funder_id":"https://openalex.org/F4320338279","funder_display_name":"Air Force Office of Scientific Research"},{"id":"https://openalex.org/G6098521345","display_name":null,"funder_award_id":"FA9550","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G6360409883","display_name":"AI Institute for Agent-based Cyber Threat Intelligence and Operation","funder_award_id":"2229876","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6906012493","display_name":null,"funder_award_id":"FA9550-23-1-0208","funder_id":"https://openalex.org/F4320338279","funder_display_name":"Air Force Office of Scientific Research"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320306110","display_name":"U.S. Department of Homeland Security","ror":"https://ror.org/00jyr0d86"},{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"},{"id":"https://openalex.org/F4320338279","display_name":"Air Force Office of Scientific Research","ror":"https://ror.org/011e9bt93"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4409361885.pdf","grobid_xml":"https://content.openalex.org/works/W4409361885.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W2121300814","https://openalex.org/W4231091074","https://openalex.org/W1886613375","https://openalex.org/W4236081792","https://openalex.org/W4250583430","https://openalex.org/W4234406076","https://openalex.org/W2010731026","https://openalex.org/W4311328601","https://openalex.org/W2360893094","https://openalex.org/W4390787808"],"abstract_inverted_index":{"Large":[0],"language":[1],"models":[2],"(LLMs)":[3],"are":[4,36],"expected":[5],"to":[6,16,28,38,94,108,147,157,175,215,225,262],"follow":[7,124],"instructions":[8],"from":[9,200],"users":[10,133],"and":[11,142,195,254,269],"engage":[12],"in":[13,41],"conversations.":[14],"Techniques":[15],"enhance":[17,216],"LLMs'":[18],"instruction-following":[19],"capabilities":[20],"typically":[21],"fine-tune":[22],"them":[23],"using":[24],"data":[25],"structured":[26],"according":[27],"a":[29,80,103,118,182],"predefined":[30],"chat":[31,34,71,89,100,126,140],"template.":[32],"Although":[33],"templates":[35,72,101],"shown":[37],"be":[39,109,173,209],"effective":[40],"optimizing":[42],"LLM":[43],"performance,":[44],"their":[45,136,145,217],"impact":[46],"on":[47],"safety":[48,74,149,252],"alignment":[49,75,253],"of":[50,76,138,151,168,190],"LLMs":[51,61,194],"has":[52],"been":[53],"less":[54],"understood,":[55],"which":[56],"is":[57,86,97,266],"crucial":[58],"for":[59,259,272],"deploying":[60],"safely":[62],"at":[63],"scale.":[64],"In":[65],"this":[66,264],"paper,":[67],"we":[68,163,204],"investigate":[69,222],"how":[70],"affect":[73],"LLMs.":[77,130,152],"We":[78,153,179,221],"identify":[79,95],"common":[81],"vulnerability,":[82,238],"named":[83],"ChatBug,":[84],"that":[85,98,106,165,181,206,230],"introduced":[87],"by":[88,111,115,211],"templates.":[90],"Our":[91,227],"key":[92],"insight":[93],"ChatBug":[96,160,177,188,207,237],"the":[99,125,139,159,166,176,187,236,239,249],"provide":[102],"rigid":[104],"format":[105],"need":[107],"followed":[110],"LLMs,":[112],"but":[113],"not":[114,122],"users.":[116],"Hence,":[117],"malicious":[119,132,183],"user":[120,184],"may":[121],"necessarily":[123],"template":[127,141],"when":[128],"prompting":[129],"Instead,":[131],"could":[134],"leverage":[135],"knowledge":[137],"accordingly":[143],"craft":[144],"prompts":[146],"bypass":[148],"alignments":[150],"study":[154],"two":[155],"attacks":[156,171,214],"exploit":[158,186],"vulnerability.":[161,178],"Additionally,":[162],"demonstrate":[164],"success":[167,219],"multiple":[169],"existing":[170,212],"can":[172,185,208],"attributed":[174],"show":[180,205,229],"vulnerability":[189],"eight":[191],"state-of-the-art":[192],"(SOTA)":[193],"effectively":[196,234],"elicit":[197],"unintended":[198],"responses":[199],"these":[201],"models.":[202],"Moreover,":[203],"exploited":[210],"jailbreak":[213],"attack":[218],"rates.":[220],"potential":[223],"countermeasures":[224],"ChatBug.":[226],"results":[228,247],"while":[231],"adversarial":[232],"training":[233],"mitigates":[235],"victim":[240],"model":[241],"incurs":[242],"significant":[243],"performance":[244],"degradation.":[245],"These":[246],"highlight":[248],"trade-off":[250,265],"between":[251],"helpfulness.":[255],"Developing":[256],"new":[257],"methods":[258],"instruction":[260],"tuning":[261],"balance":[263],"an":[267],"open":[268],"critical":[270],"direction":[271],"future":[273],"research.":[274]},"counts_by_year":[{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}