{"id":"https://openalex.org/W7166859281","doi":"https://doi.org/10.18653/v1/2026.findings-acl.1294","title":"Steering Away from Refusal: A Black-box Jailbreak Method Based on First-Token Distribution","display_name":"Steering Away from Refusal: A Black-box Jailbreak Method Based on First-Token Distribution","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7166859281","doi":"https://doi.org/10.18653/v1/2026.findings-acl.1294"},"language":null,"primary_location":{"id":"doi:10.18653/v1/2026.findings-acl.1294","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2026.findings-acl.1294","pdf_url":"https://aclanthology.org/2026.findings-acl.1294.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: ACL 2026","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://aclanthology.org/2026.findings-acl.1294.pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081786662","display_name":"\u4ed8\u53cc\u6770","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shuangjie Fu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139848175","display_name":"Du Su","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Du Su","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139735912","display_name":"Xin Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xin Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139772174","display_name":"Fei Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fei Sun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5139731216","display_name":"Huawei Shen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huawei Shen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139812510","display_name":"Xueqi Cheng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xueqi Cheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.84769656,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"25969","last_page":"25979"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.14190000295639038,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.14190000295639038,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.06379999965429306,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10720","display_name":"Complexity and Algorithms in Graphs","score":0.03869999945163727,"subfield":{"id":"https://openalex.org/subfields/1703","display_name":"Computational Theory and Mathematics"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/distribution","display_name":"Distribution (mathematics)","score":0.48089998960494995},{"id":"https://openalex.org/keywords/stability","display_name":"Stability (learning theory)","score":0.3179999887943268},{"id":"https://openalex.org/keywords/control-theory","display_name":"Control theory (sociology)","score":0.29429998993873596},{"id":"https://openalex.org/keywords/noise","display_name":"Noise (video)","score":0.271699994802475},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.2442999929189682}],"concepts":[{"id":"https://openalex.org/C110121322","wikidata":"https://www.wikidata.org/wiki/Q865811","display_name":"Distribution (mathematics)","level":2,"score":0.48089998960494995},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.41290000081062317},{"id":"https://openalex.org/C112972136","wikidata":"https://www.wikidata.org/wiki/Q7595718","display_name":"Stability (learning theory)","level":2,"score":0.3179999887943268},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.30169999599456787},{"id":"https://openalex.org/C47446073","wikidata":"https://www.wikidata.org/wiki/Q5165890","display_name":"Control theory (sociology)","level":3,"score":0.29429998993873596},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.271699994802475},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.2442999929189682},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.23800000548362732},{"id":"https://openalex.org/C13662910","wikidata":"https://www.wikidata.org/wiki/Q193139","display_name":"Trajectory","level":2,"score":0.2282000035047531},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.22210000455379486}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.18653/v1/2026.findings-acl.1294","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2026.findings-acl.1294","pdf_url":"https://aclanthology.org/2026.findings-acl.1294.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: ACL 2026","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.18653/v1/2026.findings-acl.1294","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2026.findings-acl.1294","pdf_url":"https://aclanthology.org/2026.findings-acl.1294.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: ACL 2026","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7166859281.pdf","grobid_xml":"https://content.openalex.org/works/W7166859281.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Investigating":[0],"black-box":[1,22],"jailbreak":[2,23,152],"attacks":[3],"is":[4,25,87,197],"crucial":[5],"for":[6,133],"revealing":[7],"the":[8,26,37,52,70,81,115,121,162,166],"actual":[9],"security":[10],"risks":[11],"faced":[12],"by":[13,160],"operational":[14],"Large":[15],"Language":[16],"Models":[17],"(LLMs).The":[18],"primary":[19],"challenge":[20],"in":[21],"attack":[24,147],"absence":[27],"of":[28,39,72],"direct":[29],"optimization":[30],"signals,":[31],"such":[32],"as":[33,56,129],"gradients,":[34],"to":[35,50,76,90,93],"guide":[36],"refinement":[38],"adversarial":[40,158],"prompts.While":[41],"current":[42],"mainstream":[43],"methods":[44],"like":[45],"PAIR":[46],"and":[47,83,154,189],"TAP":[48],"attempt":[49],"leverage":[51],"model's":[53],"textual":[54],"output":[55,100],"feedback,":[57],"facing":[58],"a":[59,109,130],"critical":[60],"limitation":[61],"when":[62],"models":[63],"consistently":[64],"generate":[65],"static":[66],"refusal":[67,106,136,168],"responses,":[68],"depriving":[69],"attacker":[71],"any":[73],"actionable":[74],"signal":[75],"distinguish":[77],"better":[78],"prompts.To":[79],"overcome":[80],"bottleneck":[82],"reveal":[84],"whether":[85],"there":[86],"potential":[88],"risk":[89],"open":[91],"access":[92],"partial":[94],"logprobs":[95],"information,":[96],"we":[97,141],"investigate":[98],"LLM":[99,134],"distribution.Our":[101],"empirical":[102],"analysis":[103],"reveals":[104],"that":[105,120,149,172],"responses":[107],"exhibit":[108],"highly":[110],"consistent":[111],"distributional":[112],"pattern":[113,126],"at":[114,200],"first":[116],"generated":[117],"token,":[118],"suggesting":[119],"deviation":[122],"from":[123,165],"this":[124,139],"standard":[125,167],"can":[127],"serve":[128],"quantifiable":[131],"metric":[132],"generating":[135],"response.Based":[137],"on":[138,184,194],"insight,":[140],"propose":[142],"Distribution":[143],"Jailbreak":[144],"(DJ),":[145],"an":[146],"method":[148],"select":[150],"effective":[151],"templates":[153],"then":[155],"iteratively":[156],"optimizes":[157],"suffixes":[159],"maximizing":[161],"KL":[163],"divergence":[164],"distribution.Extensive":[169],"experiments":[170],"demonstrate":[171],"DJ":[173,179],"achieves":[174,180],"stateof-the-art":[175],"Attack":[176],"Success":[177],"Rate(ASR).Notably,":[178],"over":[181,191],"90%":[182],"ASR":[183,193],"all":[185],"tested":[186],"opensource":[187],"models,":[188],"delivers":[190],"94%":[192],"GPT-4.1.Our":[195],"code":[196],"publicly":[198],"available":[199],"https://github.com/Zed630/DistributionJailbreak.":[201]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2026-07-02T00:00:00"}