{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T18:06:42Z","timestamp":1776881202233,"version":"3.51.2"},"reference-count":30,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,4,6]],"date-time":"2025-04-06T00:00:00Z","timestamp":1743897600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,4,6]],"date-time":"2025-04-06T00:00:00Z","timestamp":1743897600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,4,6]]},"DOI":"10.1109\/icassp49660.2025.10890715","type":"proceedings-article","created":{"date-parts":[[2025,3,12]],"date-time":"2025-03-12T13:52:43Z","timestamp":1741787563000},"page":"1-5","source":"Crossref","is-referenced-by-count":2,"title":["AdaPPA: Adaptive Position Pre-Fill Jailbreak Attack Approach Targeting LLMs"],"prefix":"10.1109","author":[{"given":"Lijia","family":"Lv","sequence":"first","affiliation":[{"name":"Chinese Academy of Sciences,Institute of Information Engineering"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Weigang","family":"Zhang","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences,Institute of Information Engineering"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuehai","family":"Tang","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences,Institute of Information Engineering"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jie","family":"Wen","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences,Institute of Information Engineering"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Feng","family":"Liu","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences,Institute of Information Engineering"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jizhong","family":"Han","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences,Institute of Information Engineering"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Songlin","family":"Hu","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences,Institute of Information Engineering"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"GPT-4 Technical Report","author":"Achiam","year":"2024"},{"key":"ref2","article-title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","author":"Touvron","year":"2023"},{"key":"ref3","doi-asserted-by":"crossref","DOI":"10.18653\/v1\/2023.findings-emnlp.88","article-title":"Toxicity in ChatGPT: Analyzing Personaassigned Language Models","author":"Deshpande","year":"2023"},{"key":"ref4","article-title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","author":"Zou","year":"2023"},{"key":"ref5","article-title":"AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs","author":"Liao","year":"2024"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24188"},{"key":"ref7","article-title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned LLMs","author":"Liu","year":"2024"},{"key":"ref8","article-title":"Tree of Attacks: Jailbreaking Black-Box LLMs Automatically","author":"Mehrotra","year":"2024"},{"key":"ref9","doi-asserted-by":"crossref","DOI":"10.18653\/v1\/2024.acl-long.773","article-title":"How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs","author":"Zeng","year":"2024"},{"key":"ref10","article-title":"Safety Alignment Should Be Made More Than Just a Few Tokens Deep","author":"Qi","year":"2024"},{"key":"ref11","article-title":"ChatGLM: A Family of Large Language Models from GLM-130B to GLM-4 All Tools","author":"GLM","year":"2024"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/0306-4573(88)90021-0"},{"key":"ref13","article-title":"Many-shot jailbreaking","author":"Anil","year":"2024","journal-title":"Anthropic"},{"key":"ref14","article-title":"Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena","author":"Zheng","year":"2023"},{"key":"ref15","doi-asserted-by":"crossref","article-title":"LMFlow: An Extensible Toolkit for Finetuning and Inference of Large Foundation Models","author":"Diao","DOI":"10.18653\/v1\/2024.naacl-demo.12"},{"key":"ref16","volume-title":"Meta Llama Guard 2","year":"2024"},{"key":"ref17","article-title":"Llama 3 Model Card","year":"2024"},{"key":"ref18","volume-title":"OpenAI\u2019s Content Moderation","year":"2024"},{"key":"ref19","volume-title":"Perspective API"},{"key":"ref20","article-title":"BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset","author":"Ji","year":"2023"},{"key":"ref21","article-title":"Automatically Auditing Large Language Models via Discrete Optimization","author":"Jones","year":"2023"},{"key":"ref22","doi-asserted-by":"crossref","DOI":"10.3390\/app14167150","article-title":"Open Sesame! Universal Black Box Jailbreaking of Large Language Models","author":"Lapid","year":"2024"},{"key":"ref23","article-title":"Jailbreaking Black Box Large Language Models in Twenty Queries","author":"Chao","year":"2024"},{"key":"ref24","article-title":"GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher","author":"Yuan","year":"2024"},{"key":"ref25","article-title":"Multilingual Jailbreak Challenges in Large Language Models","author":"Deng","year":"2024"},{"key":"ref26","article-title":"Low-Resource Languages Jailbreak GPT-4","author":"Yong","year":"2024"},{"key":"ref27","article-title":"GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts","author":"Yu","year":"2024"},{"key":"ref28","article-title":"Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations","author":"Wei","year":"2024"},{"key":"ref29","article-title":"Adversarial Demonstration Attacks on Large Language Models","author":"Wang","year":"2023"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/icassp48485.2024.10448041"}],"event":{"name":"ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","location":"Hyderabad, India","start":{"date-parts":[[2025,4,6]]},"end":{"date-parts":[[2025,4,11]]}},"container-title":["ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10887540\/10887541\/10890715.pdf?arnumber=10890715","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,25]],"date-time":"2026-03-25T05:22:33Z","timestamp":1774416153000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10890715\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,6]]},"references-count":30,"URL":"https:\/\/doi.org\/10.1109\/icassp49660.2025.10890715","relation":{},"subject":[],"published":{"date-parts":[[2025,4,6]]}}}