{"id":"https://openalex.org/W7140302379","doi":"https://doi.org/10.48550/arxiv.2603.23269","title":"Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMs","display_name":"Not All Tokens Are Created Equal: Query-Efficient Jailbreak Fuzzing for LLMs","publication_year":2026,"publication_date":"2026-03-24","ids":{"openalex":"https://openalex.org/W7140302379","doi":"https://doi.org/10.48550/arxiv.2603.23269"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.23269","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.23269","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.23269","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5130597524","display_name":"Wenyu Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Wenyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130572057","display_name":"Xiangtao Meng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Meng, Xiangtao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130541879","display_name":"Chuanchao Zang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zang, Chuanchao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130592203","display_name":"Li Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Li","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130556179","display_name":"Xinyu Gao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gao, Xinyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130578193","display_name":"Jianing Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Jianing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130605186","display_name":"Peng Zhan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhan, Peng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130563996","display_name":"Zheng Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Zheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5130626608","display_name":"Shanqing Guo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, Shanqing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5065000057220459,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5065000057220459,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.04270000010728836,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.040699999779462814,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9404000043869019},{"id":"https://openalex.org/keywords/consistency","display_name":"Consistency (knowledge bases)","score":0.7250999808311462},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6323999762535095},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.6068999767303467},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.5087000131607056},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.33550000190734863}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9404000043869019},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7763000130653381},{"id":"https://openalex.org/C2776436953","wikidata":"https://www.wikidata.org/wiki/Q5163215","display_name":"Consistency (knowledge bases)","level":2,"score":0.7250999808311462},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6323999762535095},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.6068999767303467},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.5087000131607056},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4510999917984009},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.33550000190734863},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.32820001244544983},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2935999929904938},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.2680000066757202},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.26570001244544983},{"id":"https://openalex.org/C8505890","wikidata":"https://www.wikidata.org/wiki/Q605095","display_name":"Budget constraint","level":2,"score":0.25099998712539673}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.23269","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.23269","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.23269","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.23269","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7409741282463074,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models(LLMs)":[2],"are":[3,7,79],"widely":[4],"deployed,":[5],"yet":[6],"vulnerable":[8],"to":[9,41,101,105,139,146,174,218],"jailbreak":[10,119],"prompts":[11,169],"that":[12,76,122,165,193],"elicit":[13],"policy-violating":[14],"outputs.":[15],"Although":[16],"prior":[17],"studies":[18],"have":[19],"uncovered":[20],"these":[21,46,112],"risks,":[22],"they":[23],"typically":[24],"treat":[25],"all":[26],"tokens":[27,40,145],"as":[28],"equally":[29],"important":[30],"during":[31],"prompt":[32],"mutation,":[33],"overlooking":[34],"the":[35,95,106,124,141,150,156,176],"varying":[36],"contributions":[37,78,104],"of":[38,71,97,131,143,152,226],"individual":[39,144],"triggering":[42],"model":[43,100,138],"refusals.":[44,109],"Consequently,":[45],"attacks":[47],"introduce":[48],"substantial":[49],"redundant":[50],"searching":[51],"under":[52,221],"query-constrained":[53],"scenarios,":[54],"reducing":[55],"attack":[56,197],"efficiency":[57],"and":[58,74,188],"hindering":[59],"comprehensive":[60],"vulnerability":[61],"assessment.":[62],"In":[63],"this":[64],"work,":[65],"we":[66,86,114],"conduct":[67],"a":[68,98,117,129,136,161,171,209],"token-level":[69,103],"analysis":[70],"refusal":[72,92,147],"behavior":[73],"observe":[75],"token":[77],"highly":[80],"skewed":[81],"rather":[82],"than":[83],"uniform.":[84],"Moreover,":[85],"find":[87],"strong":[88],"cross-model":[89],"consistency":[90],"in":[91],"tendencies,":[93],"enabling":[94,149],"use":[96],"surrogate":[99,137],"estimate":[102,140],"target":[107],"model's":[108],"Motivated":[110],"by":[111,235],"findings,":[113],"propose":[115],"TriageFuzz,":[116],"token-aware":[118],"fuzzing":[120],"framework":[121],"adapts":[123],"fuzz":[125],"testing":[126],"approach":[127],"with":[128,170,201,212],"series":[130],"customized":[132],"designs.":[133],"TriageFuzz":[134,194,229],"leverages":[135],"contribution":[142],"behaviors,":[148],"identification":[151],"sensitive":[153],"regions":[154],"within":[155],"prompt.":[157],"Furthermore,":[158],"it":[159,207],"incorporates":[160],"refusal-guided":[162],"evolutionary":[163],"strategy":[164],"adaptively":[166],"weights":[167],"candidate":[168],"lightweight":[172],"scorer":[173],"steer":[175],"evolution":[177],"toward":[178],"bypassing":[179],"safety":[180],"constraints.":[181],"Extensive":[182],"experiments":[183],"on":[184],"six":[185],"open-source":[186],"LLMs":[187],"three":[189],"commercial":[190],"APIs":[191],"demonstrate":[192],"achieves":[195],"comparable":[196],"success":[198],"rates":[199],"(ASR)":[200],"significantly":[202],"reduced":[203],"query":[204],"costs.":[205],"Notably,":[206],"attains":[208],"90%":[210],"ASR":[211,234],"over":[213],"70%":[214],"fewer":[215],"queries":[216],"compared":[217],"baselines.":[219],"Even":[220],"an":[222],"extremely":[223],"restrictive":[224],"budget":[225],"25":[227],"queries,":[228],"outperforms":[230],"existing":[231],"methods,":[232],"improving":[233],"20-40%.":[236]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-03-26T00:00:00"}