{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T23:08:49Z","timestamp":1778368129263,"version":"3.51.4"},"publisher-location":"Cham","reference-count":39,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032190987","type":"print"},{"value":"9783032190994","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-19099-4_35","type":"book-chapter","created":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T22:12:56Z","timestamp":1778364776000},"page":"500-516","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Small but\u00a0Dangerous: Evaluating and\u00a0Mitigating Jailbreak Vulnerabilities in\u00a0Small Language Models"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1047-5491","authenticated-orcid":false,"given":"Leonardo","family":"Piano","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7808-5129","authenticated-orcid":false,"given":"Claudia","family":"Battistin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3077-6390","authenticated-orcid":false,"given":"Jeriek Van den","family":"Abeele","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3745-4324","authenticated-orcid":false,"given":"Livio","family":"Pompianu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,4,1]]},"reference":[{"key":"35_CR1","doi-asserted-by":"publisher","unstructured":"Abouelenin, A., et al.: Phi-4-Mini Technical Report: Compact yet Powerful Multimodal Language Models via Mixture-of-LoRAs. arXiv, March 2025. https:\/\/doi.org\/10.48550\/arXiv.2503.01743","DOI":"10.48550\/arXiv.2503.01743"},{"key":"35_CR2","doi-asserted-by":"publisher","unstructured":"Alexandrov, A., et al.: Mitigating Catastrophic Forgetting in Language Transfer via Model Merging. ACL Anthology, pp. 17167\u201317186, November 2024. https:\/\/doi.org\/10.18653\/v1\/2024.findings-emnlp.1000","DOI":"10.18653\/v1\/2024.findings-emnlp.1000"},{"key":"35_CR3","doi-asserted-by":"publisher","unstructured":"Allal, L.B., et al.: SmolLM2: When Smol Goes Big - Data-Centric Training of a Small Language Model. arXiv, February 2025. https:\/\/doi.org\/10.48550\/arXiv.2502.02737","DOI":"10.48550\/arXiv.2502.02737"},{"key":"35_CR4","doi-asserted-by":"publisher","unstructured":"Chennabasappa, S., et al.: LlamaFirewall: an open source guardrail system for building secure AI agents. arXiv, May 2025. https:\/\/doi.org\/10.48550\/arXiv.2505.03574","DOI":"10.48550\/arXiv.2505.03574"},{"key":"35_CR5","doi-asserted-by":"publisher","unstructured":"Curry, J.: Quantifying Emotional Soft Jailbreaking in LLMs: Defining the ESJS Metric. OSF, April 2025. https:\/\/doi.org\/10.31219\/osf.io\/ktnf4_v2","DOI":"10.31219\/osf.io\/ktnf4_v2"},{"key":"35_CR6","doi-asserted-by":"publisher","unstructured":"Deng, B., et al.: Attack Prompt Generation for Red Teaming and Defending Large Language Models. ACL Anthology, pp. 2176\u20132189, December 2023. https:\/\/doi.org\/10.18653\/v1\/2023.findings-emnlp.143","DOI":"10.18653\/v1\/2023.findings-emnlp.143"},{"key":"35_CR7","doi-asserted-by":"publisher","unstructured":"Guan, M.Y., et al.: Deliberative Alignment: Reasoning Enables Safer Language Models. AGIRSA 2(3), July 2025. https:\/\/doi.org\/10.70777\/si.v2i3.15159","DOI":"10.70777\/si.v2i3.15159"},{"key":"35_CR8","unstructured":"Inan, H., et al.: Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations. arXiv (2023). https:\/\/doi.org\/10.48550\/arXiv.2312.06674"},{"key":"35_CR9","unstructured":"Kotha, S., et al.: Understanding catastrophic forgetting in language models via implicit inference. In: ICLR (2024). https:\/\/openreview.net\/forum?id=VrHiF2hsrm"},{"key":"35_CR10","doi-asserted-by":"publisher","unstructured":"Li, H., et al.: Revisiting catastrophic forgetting in large language model tuning. In: EMNLP 2024, pp. 4297\u20134308. Association for Computational Linguistics, November 2024. https:\/\/doi.org\/10.18653\/v1\/2024.findings-emnlp.249","DOI":"10.18653\/v1\/2024.findings-emnlp.249"},{"key":"35_CR11","doi-asserted-by":"publisher","unstructured":"Li, X., et al.: DeepInception: Hypnotize Large Language Model to Be Jailbreaker. arXiv, November 2023. https:\/\/doi.org\/10.48550\/arXiv.2311.03191","DOI":"10.48550\/arXiv.2311.03191"},{"key":"35_CR12","unstructured":"Liu, X., et al.: AutoDAN: generating stealthy jailbreak prompts on aligned large language models. In: ICLR (2024). https:\/\/openreview.net\/forum?id=7Jwpw4qKkb"},{"key":"35_CR13","doi-asserted-by":"publisher","unstructured":"Liu, Y., et al.: A Hitchhiker\u2019s Guide to Jailbreaking ChatGPT via Prompt Engineering. In: Proceedings of SEA4DQ 2024, pp. 12\u201321. ACM (2024). https:\/\/doi.org\/10.1145\/3663530.3665021","DOI":"10.1145\/3663530.3665021"},{"key":"35_CR14","doi-asserted-by":"crossref","unstructured":"Ma, X., et al.: Safety at Scale: A Comprehensive Survey of Large Model Safety. AGIRSA 2(2), June 2025. https:\/\/doi.org\/10.70777\/si.v2i2.14741","DOI":"10.70777\/si.v2i2.14741"},{"key":"35_CR15","doi-asserted-by":"publisher","unstructured":"\u00d6rpek, Z., et al.: The language model revolution: LLM and SLM analysis. In: 2024 8th International Artificial Intelligence and Data Processing Symposium (IDAP), pp. 1\u20134 (2024). https:\/\/doi.org\/10.1109\/IDAP64064.2024.10710677","DOI":"10.1109\/IDAP64064.2024.10710677"},{"key":"35_CR16","doi-asserted-by":"publisher","unstructured":"Qi, X., et al.: Safety Alignment Should Be Made More Than Just a Few Tokens Deep. arXiv, June 2024. https:\/\/doi.org\/10.48550\/arXiv.2406.05946","DOI":"10.48550\/arXiv.2406.05946"},{"key":"35_CR17","doi-asserted-by":"publisher","unstructured":"Raza, M., et al.: Industrial applications of large language models. Sci. Rep. 15(1), April 2025. https:\/\/doi.org\/10.1038\/s41598-025-98483-1","DOI":"10.1038\/s41598-025-98483-1"},{"key":"35_CR18","unstructured":"Riviere, M., et al.: Gemma 2: improving open language models at a practical size. arXiv (2024). https:\/\/doi.org\/10.48550\/arXiv.2408.00118"},{"key":"35_CR19","doi-asserted-by":"publisher","unstructured":"Shen, X., et al.: Do anything now: characterizing and evaluating in-the-wild jailbreak prompts on large language models. In: ACM Conferences, pp. 1671\u20131685. ACM, December 2024. https:\/\/doi.org\/10.1145\/3658644.3670388","DOI":"10.1145\/3658644.3670388"},{"key":"35_CR20","doi-asserted-by":"publisher","unstructured":"Stepanov, I., et al.: GLiNER multi-task: Generalist Lightweight Model for Various Information Extraction Tasks. arXiv, June 2024. https:\/\/doi.org\/10.48550\/arXiv.2406.12925","DOI":"10.48550\/arXiv.2406.12925"},{"key":"35_CR21","unstructured":"Tang, Y., et al.: RoleBreak: Character Hallucination as a Jailbreak Attack in Role-Playing Systems. arXiv, September 2024. https:\/\/doi.org\/10.48550\/arXiv.2409.16727"},{"key":"35_CR22","doi-asserted-by":"publisher","unstructured":"Tedeschi, S., et al.: ALERT: A Comprehensive Benchmark for Assessing Large Language Models\u2019 Safety through Red Teaming. arXiv, April 2024. https:\/\/doi.org\/10.48550\/arXiv.2404.08676","DOI":"10.48550\/arXiv.2404.08676"},{"key":"35_CR23","unstructured":"Turbal, B., et al.: On Adversarial Robustness of Language Models in Transfer Learning. In: NeurIPS 2024 Workshop SoLaR (2024), https:\/\/openreview.net\/forum?id=DUMVB9a9sX"},{"key":"35_CR24","doi-asserted-by":"crossref","unstructured":"Wallace, E., et al.: Universal adversarial triggers for attacking and analyzing NLP. In: EMNLP (2019)","DOI":"10.18653\/v1\/D19-1221"},{"key":"35_CR25","unstructured":"Wang, Z., et al.: A Comprehensive Survey of LLM Alignment Techniques: RLHF, RLAIF, PPO, DPO and More. arXiv, July 2024. https:\/\/doi.org\/10.48550\/arXiv.2407.16216"},{"key":"35_CR26","doi-asserted-by":"publisher","unstructured":"Yang, A., et al.: Qwen2 Technical Report. arXiv, July 2024. https:\/\/doi.org\/10.48550\/arXiv.2407.10671","DOI":"10.48550\/arXiv.2407.10671"},{"key":"35_CR27","doi-asserted-by":"publisher","unstructured":"Yang, A., et al.: Qwen3 Technical Report. arXiv, May 2025. https:\/\/doi.org\/10.48550\/arXiv.2505.09388","DOI":"10.48550\/arXiv.2505.09388"},{"key":"35_CR28","unstructured":"Yi, S., et al.: Jailbreak Attacks and Defenses Against Large Language Models: A Survey. arXiv, July 2024. https:\/\/doi.org\/10.48550\/arXiv.2407.04295"},{"key":"35_CR29","doi-asserted-by":"publisher","unstructured":"Yi, S., et al.: Beyond the Tip of Efficiency: Uncovering the Submerged Threats of Jailbreak Attacks in Small Language Models. ACL 2025, May 2025. https:\/\/doi.org\/10.48550\/arXiv.2502.19883","DOI":"10.48550\/arXiv.2502.19883"},{"key":"35_CR30","doi-asserted-by":"publisher","unstructured":"Zaratiana, U., et al.: GLiNER: Generalist Model for Named Entity Recognition using Bidirectional Transformer. ACL Anthology, pp. 5364\u20135376, June 2024. https:\/\/doi.org\/10.18653\/v1\/2024.naacl-long.300","DOI":"10.18653\/v1\/2024.naacl-long.300"},{"key":"35_CR31","doi-asserted-by":"publisher","unstructured":"Zhang, P., et al.: TinyLlama: An Open-Source Small Language Model. arXiv, January 2024. https:\/\/doi.org\/10.48550\/arXiv.2401.02385","DOI":"10.48550\/arXiv.2401.02385"},{"key":"35_CR32","doi-asserted-by":"publisher","unstructured":"Zhang, W., et al.: Can Small Language Models Reliably Resist Jailbreak Attacks? A Comprehensive Evaluation. arXiv, March 2025. https:\/\/doi.org\/10.48550\/arXiv.2503.06519","DOI":"10.48550\/arXiv.2503.06519"},{"key":"35_CR33","doi-asserted-by":"publisher","DOI":"10.1145\/3724393","author":"X Zhang","year":"2024","unstructured":"Zhang, X., et al.: JailGuard: a universal detection framework for prompt-based attacks on LLM systems. ACM Trans. Software Eng. Method. (2024). https:\/\/doi.org\/10.1145\/3724393","journal-title":"ACM Trans. Software Eng. Method."},{"key":"35_CR34","unstructured":"Zhang, Y., et al.: Intention Analysis Makes LLMs A Good Jailbreak Defender, January 2025. https:\/\/aclanthology.org\/2025.coling-main.199\/"},{"key":"35_CR35","doi-asserted-by":"publisher","unstructured":"Zhao, W., et al.: Unleashing the Unseen: Harnessing Benign Datasets for Jailbreaking Large Language Models. arXiv, October 2024. https:\/\/doi.org\/10.48550\/arXiv.2410.00451","DOI":"10.48550\/arXiv.2410.00451"},{"key":"35_CR36","doi-asserted-by":"publisher","unstructured":"Zheng, L., et al.: Judging LLM-as-a-judge with MT-bench and Chatbot Arena. In: NeurIPS, pp. 46595\u201346623, December 2023. https:\/\/doi.org\/10.5555\/3666122.3668142","DOI":"10.5555\/3666122.3668142"},{"key":"35_CR37","doi-asserted-by":"publisher","unstructured":"Zhou, Y., et al.: Defending Jailbreak Prompts via In-Context Adversarial Game. ACL Anthology, pp. 20084\u201320105, November 2024. https:\/\/doi.org\/10.18653\/v1\/2024.emnlp-main.1121","DOI":"10.18653\/v1\/2024.emnlp-main.1121"},{"key":"35_CR38","doi-asserted-by":"publisher","unstructured":"Zou, A., et al.: Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv, July 2023. https:\/\/doi.org\/10.48550\/arXiv.2307.15043","DOI":"10.48550\/arXiv.2307.15043"},{"key":"35_CR39","doi-asserted-by":"publisher","unstructured":"Zou, X., et al.: Is the System Message Really Important to Jailbreaks in Large Language Models? arXiv, February 2024. https:\/\/doi.org\/10.48550\/arXiv.2402.14857","DOI":"10.48550\/arXiv.2402.14857"}],"container-title":["Communications in Computer and Information Science","Machine Learning and Principles and Practice of Knowledge Discovery in Databases"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-19099-4_35","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T22:13:02Z","timestamp":1778364782000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-19099-4_35"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032190987","9783032190994"],"references-count":39,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-19099-4_35","relation":{},"ISSN":["1865-0929","1865-0937"],"issn-type":[{"value":"1865-0929","type":"print"},{"value":"1865-0937","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"1 April 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors have no competing interests to declare that\u00a0are relevant to the content of this article.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"ECML PKDD","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Joint European Conference on Machine Learning and Knowledge Discovery in Databases","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Porto","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Portugal","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"15 September 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19 September 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ecml2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/ecmlpkdd.org\/2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}