OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution

OpenART scales agent red teaming via open-ended environment evolution across 10,000 stateful scenarios, with EMHA achieving 85% attack success that grows with complexity.

Yunhao Chen, Xin Wang, Yixu Wang, Yi Liu and 5 more

Published Aug 1, 2026 · 0 citations · ▲ 266 on Hugging Face · Code ★ 231

Few-Shot Truly Benign DPO Attack for Jailbreaking LLMs

Yoon Sangyeon, Wonje Jeung, Yoonjun Cho, Dongjae Jeon and 1 more

Sydney Poster Session 2, Tue, Dec 8, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Alloy Agents Can Be More Dangerous Than Either Model Alone

Diogo Cruz

Paris Poster Session 3, Thu, Dec 10, 12:30 PM–2:30 PM, Paris Poster Hall · Published 2026

MMA-SafetyBench: A Benchmark for Multimodal Agent Safety Evaluation

Yuke Wang, Benlei Cui, Shen Pang, Xuemei Dong and 6 more

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

JailBound: A FOL-Guided Jailbreak Evaluation Framework for Revealing Safety Boundaries of LLMs

Fazong Wu, Ming Yang, Xin Wang, Zhenyong Zhang and 1 more

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

TraceGuard: Defending Multi-Turn Jailbreak Attacks via Prompt-Response Risk Signal Tracking

Hongyi Li, Yufei Wang, Chengxuan Zhou, Qinlin Xie and 3 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge

Wonjun Lee, Kyungsik Yang, Gaeun Ji, Vaidehi Patil and 4 more

Atlanta Poster Session 1, Wed, Dec 9, 10:00 AM–1:00 PM, Hall C1 · Published 2026

JEDI: Real-Time Jailbreak Defense for LLMs via In-Generation Detection and Intervention

Ruilin Xie, Bixin Li, Xinyu Chen, Yongqiang Tian and 1 more

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Safe, or Simply Incapable? Rethinking Safety Evaluation for Phone-Use Agents

Zhengyang Tang, Yi Zhang, Chenxin Li, Xin Lai and 17 more

Sydney Poster Session 2, Tue, Dec 8, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Keep It CALM: Analyzing the Limits of Global Unsafety in Text-to-Image Generation

NaHyeon Park, Minhyun Lee, Hyunjung Shim

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

PoSafeNet: Structured Safety Learning via Compositional Projection

Kiwan Wong, Wei Xiao, Daniela Rus

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

MetaPI: Constructing Prompt Injection Benchmarks from Any Agent Benchmarks

Peiran Wang, Chong Xiang, Wenjie Qu, Ying Li and 3 more

Atlanta Poster Session 3, Thu, Dec 10, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Brute-Force Jailbreaks and Codon-Aware Watermarking for DNA Foundation Models

Munish B Persaud, Amrit Singh Bedi, Souradip Chakraborty

Atlanta Poster Session 3, Thu, Dec 10, 10:00 AM–1:00 PM, Hall C1 · Published 2026

Harmless in Pieces, Harmful in Motion: Detecting Multi-Agent Jailbreaks

Vishal Pramanik, Maisha Maliha, Olivera Kotevska, Nathaniel D Bastian and 2 more

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Reasoning Poisoning: Utilizing Social-Engineering to Steer Chain-of-Thought

Matan Levy, Ilan Zendel, Stav Cohen, Amit LeVi and 1 more

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Failure-Band Authorization for Filtered Retrieval

Harry Li, Thea Cao

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Bridging the Gap Between Harmfulness Belief and Refusal Behavior for Safety Alignment

Lu Zhang, Chen Feng, Qingzhuo Wang, Wen Shen and 1 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Safe in Its Own Words: Self-Guided Safety Alignment for Multimodal Reasoning Models

Adeel Yousaf, Souradip Chakraborty, Mubarak Shah, Amrit Singh Bedi

Atlanta Poster Session 4, Thu, Dec 10, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Auditing Instruction Robustness in Vision-Language-Action Models via Diversity-Aware Red Teaming

Baoshun Tong, Haoran He, Yang Liu, Ling Pan and 1 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Measuring and Strengthening Behavioral Suppression in Language Models

Luxi (Lucy) He, Pengcheng Jiang, Jifan Zhang, Jiawei Han and 1 more

Atlanta Poster Session 4, Thu, Dec 10, 4:30 PM–7:30 PM, Hall C1 · Published 2026

When Safety Becomes An Outlier: Understanding the Retention of LLM Safety Behaviors

Binchi Zhang, Hadi Abdullah, Yiwei Cai, Jundong Li

Atlanta Poster Session 6, Fri, Dec 11, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Adaptive Test Case Discovery for LLM-Assisted Decision Making in High-Stakes Domains

Anjali Parashar, Carson Sobolewski, Yingke Li, Fei Chen and 1 more

Atlanta Poster Session 5, Fri, Dec 11, 10:00 AM–1:00 PM, Hall C1 · Published 2026

MLLMs Fail to Refuse when Using Tools Agentically

Rikiya Takehi, Ryo Hachiuma, Shaona Ghosh, Dan Zhao and 2 more

Atlanta Poster Session 6, Fri, Dec 11, 4:30 PM–7:30 PM, Hall C1 · Published 2026

Fail-Closed Alignment for Large Language Models

Fail-closed alignment builds redundant refusal pathways to prevent alignment collapse under jailbreaks, yielding stronger robustness with minimal overhead.

Zachary Coalson, Sanghyun Hong

Paris Poster Session 2, Wed, Dec 9, 5:00 PM–7:00 PM, Paris Poster Hall · Published 2026

Dialectics of Alignment: Harnessing Unsafe Knowledge for Dynamic Safety Routing

SafeMoE isolates unsafe knowledge into domain-specific LoRA experts and routes them with a lightweight gating network to improve safe response rates by over 20% relative while maintaining informative outputs.

Maryam Hashemzadeh Barvarz, Jerry Huang, Minseon Kim, Marc-Alexandre Côté and 1 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

CodeMimicry: Exploiting Safety Generalization Lag in Large Language Models via Structured Code Completion

Safety alignment lags in code domains enable automated jailbreaks through structured code completion, achieving 96.25% attack success across eight commercial LLMs.

Liang Zhen, Wentao Chen, Hai Huang

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Graph-Regularized Sparse Autoencoders for LLM Safety Steering

Graph-Regularized Sparse Autoencoders smooth SAE decoder vectors over a neuron co-activation graph to learn safety-steering directions, improving selective refusal by over 16 points across jailbreak benchmarks while preserving benign performance and generalizing across models.

Jehyeok Yeon, Federico Cinus, Yifan Wu, Luca Luceri

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Diffusion LLMs are Natural Adversaries for any LLM

Diffusion LLMs amortize adversarial prompt optimization by directly generating diverse, transferable jailbreak prompts that bypass black-box target models.

David Lüdke, Tom Wollschläger, Paul Ungermann, Stephan Günnemann and 1 more

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026 · ▲ 2 on Hugging Face

MJ: Multi-turn LLM Jailbreaking via Decomposed Credit Assignment

DC-GRPO assigns turn-level group-relative credit in multi-turn LLM jailbreaking, achieving over 97% attack success and outperforming prior methods.

Junyoung Park, Namgyu Park, Sechan Lee, Yoon-Chan Jhi and 2 more

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoring

SciHazard benchmarks LLM scientific safety risks via decomposed harm scoring across 3,000 real-world grounded queries, finding deep research agents 32.3% more harmful than standard models.

Chunxiao Li, Yuan Xiong, Lijun Li, Tianyi Du and 3 more

Sydney Poster Session 3, Wed, Dec 9, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

The Geometry of Alignment Collapse: When Fine-Tuning Breaks Safety

Fine-tuning breaks safety via unstable geometric alignment subspaces, with alignment loss scaling quartically in training time via curvature-driven drift.

Max Springer, Chung Peng Lee, Bohdan Turbal, Blossom Metevier and 4 more

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

Safety Geometry Collapse in Multimodal LLMs and Adaptive Drift Correction

Multimodal LLM safety failure stems from geometry collapse along refusal directions caused by modality drift, which adaptive drift correction and self-rectification restore without training.

Jiahe Guo, Xiangran Guo, Jiaxuan Chen, Weixiang Zhao and 5 more

Paris Poster Session 6, Fri, Dec 11, 2:30 PM–4:30 PM, Paris Poster Hall · Published 2026

Steering Frozen LLMs: Adaptive Social Alignment via Online Prompt Routing

CCLUB enables adaptive LLM alignment via online system-prompt routing with conservative consensus clustering, achieving sublinear regret and improving cumulative reward by 10.98% over baselines.

Zeyu Zhang, Xiangxiang Dai, Ziyi Han, Xutong Liu and 1 more

Sydney Poster Session 1, Tue, Dec 8, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

On-Policy Consistency Training Improves LLM Safety with Minimal Capability Degradation

On-Policy Consistency Training improves LLM safety across sycophancy, jailbreaks, and safety awareness while avoiding the capability regressions of supervised fine-tuning.

Andy Q Han, Kristina Fujimoto, Avidan Shah, Kiet Nguyen and 4 more

Sydney Poster Session 5, Thu, Dec 10, 10:00 AM–1:00 PM, Hall 1-4 · Published 2026

TROPT: An Open Framework for Unifying and Advancing Discrete Text Optimization

TROPT unifies discrete text optimization via a modular open-source framework with 30+ recipes, enabling cross-domain optimizer comparison, enhancement, and portability.

Matan Ben-Tov, Mahmood Sharif

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026 · Code ★ 11

Internal Safety Collapse in Frontier Large Language Models

Frontier LLMs suffer Internal Safety Collapse, generating harmful content during benign tasks with 95.3% failure rates and revealing alignment does not eliminate underlying risks.

Oscar W, Xiao Liu, Hanxun Huang, Yige Li and 6 more

Sydney Poster Session 2, Tue, Dec 8, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026 · ▲ 31 on Hugging Face · Code ★ 1,198

GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines

GitInject tests real AI CI/CD workflows and finds all providers vulnerable to prompt injection via structural credential and config handling flaws.

Jafar Isbarov, Umid Suleymanov, I Shumailov, Murat Kantarcioglu

Paris Poster Session 6, Fri, Dec 11, 2:30 PM–4:30 PM, Paris Poster Hall · Published 2026

LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments

LITMUS benchmarks LLM agent behavioral jailbreaks in real OS environments, revealing agents execute 40.64% of high-risk operations despite refusals and suffer pervasive execution hallucination.

Chiyu Zhang, Huiqin Yang, Bendong Jiang, Xiaolei Zhang and 7 more

Paris Poster Session 6, Fri, Dec 11, 2:30 PM–4:30 PM, Paris Poster Hall · Published 2026

Metaphor Is Not All Attention Needs

Poetic jailbreaks bypass LLM safety not via specific devices or format confusion, but through accumulated stylistic irregularities altering processing independently of harm detection, requiring style-aware defenses.

Olga Sorokoletova, Francesco Giarrusso, Giacomo De Luca, Piercosma Bisconti and 5 more

Sydney Poster Session 6, Thu, Dec 10, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026

Alignment Collapse Under KV Cache Quantization: Diagnosis and Mitigation

Low-bit KV cache quantization silently collapses LLM safety alignment via geometric subspace vulnerability, and per-channel reduction diagnostics recover up to 97% of lost refusals.

Bruce C Xu, Adarsh Kumarappan, Mu Zhou

Sydney Poster Session 4, Wed, Dec 9, 5:00 PM–8:00 PM, Hall 1-4 · Published 2026