{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,30]],"date-time":"2025-09-30T00:21:13Z","timestamp":1759191673827,"version":"3.44.0"},"publisher-location":"Cham","reference-count":35,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032060778","type":"print"},{"value":"9783032060785","type":"electronic"}],"license":[{"start":{"date-parts":[[2025,9,30]],"date-time":"2025-09-30T00:00:00Z","timestamp":1759190400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,9,30]],"date-time":"2025-09-30T00:00:00Z","timestamp":1759190400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-06078-5_14","type":"book-chapter","created":{"date-parts":[[2025,9,29]],"date-time":"2025-09-29T18:50:07Z","timestamp":1759171807000},"page":"240-256","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["IntentBreaker: Intent-Adaptive Jailbreak Attack on\u00a0Large Language Models"],"prefix":"10.1007","author":[{"given":"Shengnan","family":"Guo","sequence":"first","affiliation":[]},{"given":"Yuchen","family":"Zhai","sequence":"additional","affiliation":[]},{"given":"Shenyi","family":"Zhang","sequence":"additional","affiliation":[]},{"given":"Lingchen","family":"Zhao","sequence":"additional","affiliation":[]},{"given":"Zhangyi","family":"Wang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,9,30]]},"reference":[{"key":"14_CR1","unstructured":"Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., et\u00a0al.: GPT-4 technical report. arXiv preprint arXiv:2303.08774 (2023)"},{"key":"14_CR2","unstructured":"Alon, G., Kamfonas, M.: Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132 (2023)"},{"key":"14_CR3","unstructured":"Andriushchenko, M., Croce, F., Flammarion, N.: Jailbreaking leading safety-aligned LLMs with simple adaptive attacks. In: Proceedings of ICLR (2025)"},{"key":"14_CR4","unstructured":"Carlini, N., Nasr, M., Choquette-Choo, C.A., Jagielski, M., Gao, I., et\u00a0al.: Are aligned neural networks adversarially aligned? In: Proceedings of NeurIPS (2023)"},{"key":"14_CR5","doi-asserted-by":"crossref","unstructured":"Chang, Z., Li, M., Liu, Y., Wang, J., Wang, Q., et\u00a0al.: Play guessing game with LLM: indirect jailbreak attack with implicit clues. In: Proceedings of ACL (2024)","DOI":"10.18653\/v1\/2024.findings-acl.304"},{"key":"14_CR6","unstructured":"Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G.J., et\u00a0al.: Jailbreaking black box large language models in twenty queries. In: Proceedings of NeurIPS R0-FoMo Workshop (2023)"},{"key":"14_CR7","unstructured":"Chiang, W.L., Li, Z., Lin, Z., Sheng, Y., Wu, Z., et\u00a0al.: Vicuna: an open-source chatbot impressing GPT-4 with 90%* chatGPT quality. https:\/\/lmsys.org\/blog\/2023-03-30-vicuna\/ (2023)"},{"key":"14_CR8","doi-asserted-by":"crossref","unstructured":"Deng, G., et al.: Masterkey: automated jailbreaking of large language model chatbots. In: Proceedings of NDSS (2024)","DOI":"10.14722\/ndss.2024.24188"},{"key":"14_CR9","doi-asserted-by":"crossref","unstructured":"Deshpande, A., Murahari, V., Rajpurohit, T., Kalyan, A., Narasimhan, K.R.: Toxicity in chatGPT: analyzing persona-assigned language models. In: Proceedings of EMNLP (2023)","DOI":"10.18653\/v1\/2023.findings-emnlp.88"},{"key":"14_CR10","unstructured":"Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: BERT: pre-training of deep bidirectional transformers for language understanding. In: Proceedings of NAACL (2019)"},{"key":"14_CR11","doi-asserted-by":"crossref","unstructured":"Dong, Y., Jiang, X., Jin, Z., Li, G.: Self-collaboration code generation via chatGPT. ACM Trans. Softw. Eng. Methodol. (2024)","DOI":"10.1145\/3672459"},{"key":"14_CR12","doi-asserted-by":"crossref","unstructured":"Fakhoury, S., Naik, A., Sakkas, G., Chakraborty, S., Lahiri, S.K.: LLM-based test-driven interactive code generation: user study and empirical evaluation. IEEE Trans. Softw. Eng. (2024)","DOI":"10.1109\/TSE.2024.3428972"},{"key":"14_CR13","unstructured":"Guo, X., Yu, F., Zhang, H., Qin, L., Hu, B.: Cold-attack: jailbreaking LLMs with stealthiness and controllability. In: Proceedings of ICML (2024)"},{"key":"14_CR14","unstructured":"Jia, X., et al.: Improved techniques for optimization-based jailbreaking on large language models. In: Proceedings of ICLR (2025)"},{"key":"14_CR15","unstructured":"Jiang, A.Q., Sablayrolles, A., Mensch, A., Bamford, C., Chaplot, D.S., et\u00a0al.: Mistral 7B. arXiv preprint arXiv:2310.06825 (2023)"},{"key":"14_CR16","doi-asserted-by":"crossref","unstructured":"Joko, H., Chatterjee, S., Ramsay, A., de\u00a0Vries, A.P., Dalton, J., Hasibi, F.: Doing personal laps: LLM-augmented dialogue construction for personalized multi-session conversational search. In: Proceedings of SIGIR (2024)","DOI":"10.1145\/3626772.3657815"},{"key":"14_CR17","doi-asserted-by":"crossref","unstructured":"Li, X., Wang, R., Cheng, M., Zhou, T., Hsieh, C.J.: DrAttack: prompt decomposition and reconstruction makes powerful LLM jailbreakers. In: Proceedings of EMNLP (2024)","DOI":"10.18653\/v1\/2024.findings-emnlp.813"},{"key":"14_CR18","unstructured":"Liu, X., Xu, N., Chen, M., Xiao, C.: AutoDAN: generating stealthy jailbreak prompts on aligned large language models. In: Proceedings of ICLR (2024)"},{"key":"14_CR19","unstructured":"Liu, Y., et al.: Jailbreaking chatGPT via prompt engineering: an empirical study. arXiv preprint arXiv:2305.13860 (2024)"},{"key":"14_CR20","unstructured":"Mehrotra, A., Zampetakis, M., Kassianik, P., Nelson, B., Anderson, H., et\u00a0al.: Tree of attacks: jailbreaking black-box LLMs automatically. In: Proceedings of NeurIPS (2024)"},{"key":"14_CR21","unstructured":"Meta: The LLaMA 3 family of models (2024). https:\/\/github.com\/meta-llama\/PurpleLlama\/blob\/main\/Llama-Guard3\/1B\/MODEL_CARD.md"},{"key":"14_CR22","unstructured":"Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., et\u00a0al.: Training language models to follow instructions with human feedback. In: Proceedings of NeurIPS (2022)"},{"key":"14_CR23","unstructured":"Qi, X., Zeng, Y., Xie, T., Chen, P.Y., Jia, R., et\u00a0al.: Fine-tuning aligned language models compromises safety, even when users do not intend to! In: Proceedings of ICLR (2024)"},{"key":"14_CR24","unstructured":"Riviere, M., et\u00a0al.: Gemma 2: improving open language models at a practical size. arXiv preprint arXiv:2408.00118 (2024)"},{"key":"14_CR25","doi-asserted-by":"crossref","unstructured":"Shen, X., Chen, Z., Backes, M., Shen, Y., Zhang, Y.: \u201cdo anything now\u201d: characterizing and evaluating in-the-wild jailbreak prompts on large language models. In: Proceedings of ACM CCS (2024)","DOI":"10.1145\/3658644.3670388"},{"key":"14_CR26","unstructured":"Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, et\u00a0al.: LLaMA 2: open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 (2023)"},{"key":"14_CR27","unstructured":"Wei, A., Haghtalab, N., Steinhardt, J.: Jailbroken: How does LLM safety training fail? In: Proceedings of NeurIPS (2023)"},{"key":"14_CR28","unstructured":"Wei, Z., Wang, Y., Wang, Y.: Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387 (2023)"},{"key":"14_CR29","doi-asserted-by":"crossref","unstructured":"Xie, Y., Fang, M., Pi, R., Gong, N.: GradSafe: detecting unsafe prompts for LLMs via safety-critical gradient analysis. In: Proceedings of ACL (2024)","DOI":"10.18653\/v1\/2024.acl-long.30"},{"key":"14_CR30","doi-asserted-by":"crossref","unstructured":"Xie, Y., Yi, J., Shao, J., Curl, J., Lyu, L., et\u00a0al.: Defending chatGPT against jailbreak attack via self-reminders. Nat. Mach. Intell. (2023)","DOI":"10.1038\/s42256-023-00765-8"},{"key":"14_CR31","unstructured":"Yang, A., et\u00a0al.: Qwen2.5 technical report. arXiv preprint arXiv:2412.15115 (2025)"},{"key":"14_CR32","unstructured":"Yong, Z.X., Menghini, C., Bach, S.: Low-resource languages jailbreak GPT-4. In: Proceedings of NeurIPS SoLaR Workshop (2023)"},{"key":"14_CR33","unstructured":"Yu, J., Lin, X., Xing, X.: LLM-fuzzer: scaling assessment of large language model jailbreaks. In: Proceedings of USENIX Security (2024)"},{"key":"14_CR34","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Shen, G., Tao, G., Cheng, S., Zhang, X.: On large language models\u2019 resilience to coercive interrogation. In: Proceedings of IEEE S &P (2024)","DOI":"10.1109\/SP54263.2024.00208"},{"key":"14_CR35","unstructured":"Zou, A., Wang, Z., Kolter, J.Z., Fredrikson, M.: Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023)"}],"container-title":["Lecture Notes in Computer Science","Machine Learning and Knowledge Discovery in Databases. Research Track"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-06078-5_14","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,29]],"date-time":"2025-09-29T18:50:24Z","timestamp":1759171824000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-06078-5_14"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,30]]},"ISBN":["9783032060778","9783032060785"],"references-count":35,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-06078-5_14","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,30]]},"assertion":[{"value":"30 September 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors have no competing interests to declare that are relevant to the content of this article.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"ECML PKDD","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Joint European Conference on Machine Learning and Knowledge Discovery in Databases","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Porto","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Portugal","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 September 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19 September 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ecml2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/ecmlpkdd.org\/2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}