{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,21]],"date-time":"2026-04-21T12:40:50Z","timestamp":1776775250240,"version":"3.51.2"},"reference-count":102,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,3,31]],"date-time":"2026-03-31T00:00:00Z","timestamp":1774915200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100013410","name":"INCIBE","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100013410","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006393","name":"Universidad de Granada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100006393","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neurocomputing"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.neucom.2026.133534","type":"journal-article","created":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T08:02:15Z","timestamp":1775030535000},"page":"133534","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["A domain-based taxonomy of jailbreak vulnerabilities in large language models"],"prefix":"10.1016","volume":"683","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7976-3139","authenticated-orcid":false,"given":"Carlos","family":"Pel\u00e1ez-Gonz\u00e1lez","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9183-5262","authenticated-orcid":false,"given":"Andr\u00e9s","family":"Herrera-Poyatos","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Cristina","family":"Zuheros","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"David","family":"Herrera-Poyatos","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Virilo","family":"Tejedor","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Francisco","family":"Herrera","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"key":"10.1016\/j.neucom.2026.133534_bib0005","author":"Zhao"},{"key":"10.1016\/j.neucom.2026.133534_bib0010","article-title":"Emergent abilities of large language models","author":"Wei","year":"2022","journal-title":"Trans. Mach. Learn. Res. Surv. Certif."},{"key":"10.1016\/j.neucom.2026.133534_bib0015","first-page":"27730","article-title":"Training language models to follow instructions with human feedback","volume":"35","author":"Ouyang","year":"2022","journal-title":"Adv. Neural Inf. Process. Syst."},{"issue":"2","key":"10.1016\/j.neucom.2026.133534_bib0020","doi-asserted-by":"crossref","DOI":"10.1016\/j.hcc.2024.100211","article-title":"A Survey on Large Language Model (Llm) security and privacy: the good, the bad, and the ugly","volume":"4","author":"Yao","year":"2024","journal-title":"High-Confid. Comput."},{"issue":"3","key":"10.1016\/j.neucom.2026.133534_bib0025","first-page":"354","article-title":"Combating misinformation in the age of llms: opportunities and challenges","volume":"45","author":"Chen","year":"2024","journal-title":"AI Mag."},{"key":"10.1016\/j.neucom.2026.133534_bib0030","series-title":"Masterkey: Automated Jailbreaking of Large Language Model Chatbots","author":"Deng","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0035","author":"Handa"},{"key":"10.1016\/j.neucom.2026.133534_bib0040","series-title":"Advances in Neural Information Processing Systems","first-page":"129696","article-title":"Many-shot jailbreaking","volume":"vol. 37","author":"Anil","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0045","series-title":"Query-Based Adversarial Prompt Generation","author":"Hayase","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0050","author":"Yuan"},{"key":"10.1016\/j.neucom.2026.133534_bib0055","author":"Yong"},{"key":"10.1016\/j.neucom.2026.133534_bib0060","author":"Lemkin"},{"key":"10.1016\/j.neucom.2026.133534_bib0065","series-title":"Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)","first-page":"15157","article-title":"ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs","author":"Jiang","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0070","author":"Li"},{"key":"10.1016\/j.neucom.2026.133534_bib0075","author":"Handa"},{"key":"10.1016\/j.neucom.2026.133534_bib0080","series-title":"Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing","first-page":"18584","article-title":"Jailbreaking LLMs with arabic transliteration and arabizi","author":"Ghanim","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0085","author":"Jeong"},{"key":"10.1016\/j.neucom.2026.133534_bib0090","author":"Huang"},{"key":"10.1016\/j.neucom.2026.133534_bib0095","author":"Zhao"},{"key":"10.1016\/j.neucom.2026.133534_bib0100","author":"Liu"},{"key":"10.1016\/j.neucom.2026.133534_bib0105","series-title":"Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, CCS \u201924, Association for Computing Machinery","first-page":"1671","article-title":"\u201cdo anything now\u201d: characterizing and evaluating in-the-wild jailbreak prompts on large language models","author":"Shen","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0110","first-page":"4485","article-title":"FuzzLLM: a novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models","author":"Yao","year":"2024","journal-title":"ICASSP IEEE Int. Conf. Acoust. Speech Signal Process.","ISSN":"https:\/\/id.crossref.org\/issn\/2379-190X","issn-type":"print"},{"key":"10.1016\/j.neucom.2026.133534_bib0115","author":"Perez"},{"key":"10.1016\/j.neucom.2026.133534_bib0120","first-page":"4138","article-title":"Multi-step jailbreaking privacy attacks on ChatGPT","author":"Li","year":"2023"},{"key":"10.1016\/j.neucom.2026.133534_bib0125","author":"Li"},{"key":"10.1016\/j.neucom.2026.133534_bib0130","author":"Wei"},{"key":"10.1016\/j.neucom.2026.133534_bib0135","series-title":"Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation","author":"Shah","year":"2023"},{"key":"10.1016\/j.neucom.2026.133534_bib0140","author":"Wu"},{"key":"10.1016\/j.neucom.2026.133534_bib0145","series-title":"2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","first-page":"23","article-title":"Jailbreaking black box large language models in twenty queries","author":"Chao","year":"2025"},{"key":"10.1016\/j.neucom.2026.133534_bib0150","series-title":"Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)","first-page":"14322","article-title":"How johnny can persuade LLMs to jailbreak them: rethinking persuasion to challenge AI safety by humanizing LLMs","author":"Zeng","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0155","author":"Niu"},{"issue":"19","key":"10.1016\/j.neucom.2026.133534_bib0160","first-page":"21527","article-title":"Visual adversarial examples jailbreak aligned large language models","volume":"38","author":"Qi","year":"2024","journal-title":"Proc. AAAI Conf. Artif. Intell."},{"key":"10.1016\/j.neucom.2026.133534_bib0165","author":"Bagdasaryan"},{"key":"10.1016\/j.neucom.2026.133534_bib0170","series-title":"Proceedings of the IEEE\/CVF International Conference on Computer Vision (ICCV) Workshops","first-page":"3677","article-title":"On the adversarial robustness of Multi-Modal foundation models","author":"Schlarmann","year":"2023"},{"key":"10.1016\/j.neucom.2026.133534_bib0175","series-title":"Proceedings of the 41st International Conference on Machine Learning, Vol. 235 of Proceedings of Machine Learning Research","first-page":"2443","article-title":"Image hijacks: adversarial images can control generative models at runtime","author":"Bailey","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0180","author":"Gao"},{"key":"10.1016\/j.neucom.2026.133534_bib0185","author":"WANG"},{"key":"10.1016\/j.neucom.2026.133534_bib0190","series-title":"How Robust is Google\u2019s Bard to Adversarial Image Attacks?","author":"Dong","year":"2023"},{"key":"10.1016\/j.neucom.2026.133534_bib0195","author":"Zhao"},{"key":"10.1016\/j.neucom.2026.133534_bib0200","author":"Hu"},{"key":"10.1016\/j.neucom.2026.133534_bib0205","author":"Zou"},{"key":"10.1016\/j.neucom.2026.133534_bib0210","first-page":"15307","article-title":"Automatically auditing large language models via discrete optimization","author":"Jones","year":"2023","journal-title":"Proc. 40th Int. Conf. Mach. Learn.","ISSN":"https:\/\/id.crossref.org\/issn\/2640-3498","issn-type":"print"},{"key":"10.1016\/j.neucom.2026.133534_bib0215","author":"Lapid"},{"key":"10.1016\/j.neucom.2026.133534_bib0220","series-title":"AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models","author":"Zhu","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0225","author":"Paulus"},{"key":"10.1016\/j.neucom.2026.133534_bib0230","author":"Sankar Sadasivan"},{"key":"10.1016\/j.neucom.2026.133534_bib0235","author":"Guo"},{"key":"10.1016\/j.neucom.2026.133534_bib0240","series-title":"Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics","first-page":"1090","article-title":"On robustness of prompt-based semantic parsing with large pre-trained language model: an empirical study on codex","author":"Zhuo","year":"2023"},{"key":"10.1016\/j.neucom.2026.133534_bib0245","series-title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","author":"Mehrotra","year":"2024"},{"issue":"9","key":"10.1016\/j.neucom.2026.133534_bib0250","doi-asserted-by":"crossref","DOI":"10.3390\/app14093558","article-title":"All in how you ASK for: simple Black-Box method for jailbreak attacks","volume":"14","author":"Takemoto","year":"2024","journal-title":"Applied Sciences"},{"key":"10.1016\/j.neucom.2026.133534_bib0255","series-title":"Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Prompts","author":"Samvelyan","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0260","series-title":"33rd USENIX Security Symposium (USENIX Security 24)","first-page":"4657","article-title":"LLM-fuzzer: scaling assessment of large language model jailbreaks","author":"Yu","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0265","author":"Liu"},{"key":"10.1016\/j.neucom.2026.133534_bib0270","series-title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","author":"Liu","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0275","author":"Sitawarin"},{"key":"10.1016\/j.neucom.2026.133534_bib0280","series-title":"Black Box Adversarial Prompting for Foundation Models","author":"Maus","year":"2023"},{"key":"10.1016\/j.neucom.2026.133534_bib0285","author":"Shah"},{"key":"10.1016\/j.neucom.2026.133534_bib0290","author":"Shayegani"},{"key":"10.1016\/j.neucom.2026.133534_bib0295","series-title":"Computer Vision \u2013 ECCV 2024: 18th European Conference (29 September 2024)","first-page":"174","article-title":"Images are achilles\u2019 heel of alignment: exploiting visual vulnerabilities for jailbreaking multimodal large language models","author":"Li","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0300","series-title":"Proceedings of the 32nd ACM International Conference on Multimedia, MM \u201924, Association for Computing Machinery","first-page":"3578","article-title":"Arondight: RED teaming large vision language models with auto-generated multi-modal jailbreak prompts","author":"Liu","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0305","author":"Zhuo"},{"key":"10.1016\/j.neucom.2026.133534_bib0310","series-title":"Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks","author":"Kang","year":"2023"},{"key":"10.1016\/j.neucom.2026.133534_bib0315","series-title":"Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)","first-page":"2136","article-title":"A wolf in sheep\u2019s clothing: generalized nested jailbreak prompts can fool large language models easily","author":"Ding","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0320","series-title":"On the Robustness of ChatGPT: an Adversarial and Out-of-Distribution Perspective","author":"Wang","year":"2023"},{"key":"10.1016\/j.neucom.2026.133534_bib0325","author":"Wang"},{"key":"10.1016\/j.neucom.2026.133534_bib0330","author":"Zhang"},{"key":"10.1016\/j.neucom.2026.133534_bib0335","first-page":"80079","article-title":"Jailbroken: how does LLM safety training fail?","volume":"36","author":"Wei","year":"2023","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.neucom.2026.133534_bib0340","author":"Liu"},{"key":"10.1016\/j.neucom.2026.133534_bib0345","author":"Lv"},{"key":"10.1016\/j.neucom.2026.133534_bib0350","series-title":"Findings of the Association for Computational Linguistics: NAACL 2024","first-page":"3526","article-title":"Cognitive overload: jailbreaking large language models with overloaded logical thinking","author":"Xu","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0355","author":"Andriushchenko"},{"key":"10.1016\/j.neucom.2026.133534_bib0360","author":"Hendrycks"},{"key":"10.1016\/j.neucom.2026.133534_bib0365","series-title":"Improving Language Understanding by Generative Pre-Training","author":"Radford","year":"2018"},{"key":"10.1016\/j.neucom.2026.133534_bib0370","author":"Touvron"},{"key":"10.1016\/j.neucom.2026.133534_bib0375","author":"Bai"},{"issue":"136","key":"10.1016\/j.neucom.2026.133534_bib0380","first-page":"1","article-title":"A survey of Preference-Based reinforcement learning methods","volume":"18","author":"Wirth","year":"2017","journal-title":"J. Mach. Learn. Res."},{"key":"10.1016\/j.neucom.2026.133534_bib0385","series-title":"Deep Reinforcement Learning from Human Preferences (2017)","author":"Christiano","year":"2017"},{"key":"10.1016\/j.neucom.2026.133534_bib0390","series-title":"Advances in Neural Information Processing Systems","first-page":"3008","article-title":"Learning to summarize with human feedback","volume":"vol. 33","author":"Stiennon","year":"2020"},{"key":"10.1016\/j.neucom.2026.133534_bib0395","author":"Schulman"},{"key":"10.1016\/j.neucom.2026.133534_bib0400","author":"Wang"},{"key":"10.1016\/j.neucom.2026.133534_bib0405","author":"Rafailov"},{"key":"10.1016\/j.neucom.2026.133534_bib0410","series-title":"Is Dpo Superior to Ppo for LLM Alignment? A Comprehensive Study","author":"Xu","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0415","author":"Ramamurthy"},{"key":"10.1016\/j.neucom.2026.133534_bib0420","series-title":"Advances in Neural Information Processing Systems","first-page":"34453","article-title":"Metaaligner: towards generalizable multi-objective alignment of language models","volume":"vol. 37","author":"Yang","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0425","author":"Mukherjee"},{"key":"10.1016\/j.neucom.2026.133534_bib0430","series-title":"Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing","first-page":"1437","article-title":"Controllable preference optimization: toward controllable Multi-Objective alignment","author":"Guo","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0435","series-title":"Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)","first-page":"8642","article-title":"Arithmetic control of LLMs for diverse user preferences: directional preference alignment with Multi-Objective rewards","author":"Wang","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0440","author":"Xu"},{"key":"10.1016\/j.neucom.2026.133534_bib0445","author":"Zhong"},{"key":"10.1016\/j.neucom.2026.133534_bib0450","series-title":"Findings of the Association for Computational Linguistics: ACL 2025","first-page":"21865","article-title":"Adversarial preference learning for robust LLM alignment","author":"Wang","year":"2025"},{"issue":"22","key":"10.1016\/j.neucom.2026.133534_bib0455","first-page":"23951","article-title":"Figstep: jailbreaking large vision-language models via typographic visual prompts","volume":"39","author":"Gong","year":"2025","journal-title":"Proc. AAAI Conf. Artif. Intell."},{"key":"10.1016\/j.neucom.2026.133534_bib0460","author":"Silva"},{"key":"10.1016\/j.neucom.2026.133534_bib0465","author":"Xu"},{"key":"10.1016\/j.neucom.2026.133534_bib0470","series-title":"Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)","first-page":"6734","article-title":"Attacks, defenses and evaluations for LLM conversation safety: a survey","author":"Dong","year":"2024"},{"key":"10.1016\/j.neucom.2026.133534_bib0475","author":"Chowdhury"},{"key":"10.1016\/j.neucom.2026.133534_bib0480","author":"Yi"},{"key":"10.1016\/j.neucom.2026.133534_bib0485","author":"Liu"},{"key":"10.1016\/j.neucom.2026.133534_bib0490","author":"Peng"},{"key":"10.1016\/j.neucom.2026.133534_bib0495","author":"Jin"},{"key":"10.1016\/j.neucom.2026.133534_bib0500","doi-asserted-by":"crossref","DOI":"10.1016\/j.neunet.2025.108388","article-title":"Attack and defense techniques in large language models: a survey and new perspectives","volume":"196","author":"Liao","year":"2026","journal-title":"Neural Networks"},{"key":"10.1016\/j.neucom.2026.133534_bib0505","author":"Liu"},{"issue":"3\u20134","key":"10.1016\/j.neucom.2026.133534_bib0510","first-page":"1","article-title":"Safety at scale: a comprehensive survey of large model and agent safety","volume":"8","author":"Ma","year":"2025","journal-title":"Found. Trends Priv. Secur."}],"container-title":["Neurocomputing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0925231226009318?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0925231226009318?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,4,21]],"date-time":"2026-04-21T11:46:14Z","timestamp":1776771974000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0925231226009318"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":102,"alternative-id":["S0925231226009318"],"URL":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133534","relation":{},"ISSN":["0925-2312"],"issn-type":[{"value":"0925-2312","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A domain-based taxonomy of jailbreak vulnerabilities in large language models","name":"articletitle","label":"Article Title"},{"value":"Neurocomputing","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133534","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Author(s). Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"133534"}}